mirror of
https://github.com/Sea-Haven-Industries/sh-openswe-traces.git
synced 2026-09-30 05:43:16 +00:00
5f430d9dfd
Freeze SAM CD and add terraform/ for seahaven-prod with account-suffixed buckets so HCP owns deploy before mgmt cutover. Suppress CKV_AWS_40 for the LangSmith export IAM user with documented mitigations.
30 lines
961 B
YAML
30 lines
961 B
YAML
# FROZEN for PLAT-73: HCP Terraform is the sole deploy path.
|
|
# Previous SAM CD preserved as deploy.yaml.frozen until mgmt cutover.
|
|
# Do not re-enable until the migration is rolled back intentionally.
|
|
name: Deploy
|
|
on:
|
|
workflow_dispatch:
|
|
inputs:
|
|
confirm_unfreeze:
|
|
description: "Type UNFREEZE to acknowledge this bypasses PLAT-73 freeze"
|
|
required: true
|
|
type: string
|
|
|
|
permissions:
|
|
id-token: write
|
|
contents: read
|
|
|
|
concurrency:
|
|
group: deploy
|
|
cancel-in-progress: false
|
|
|
|
jobs:
|
|
deploy:
|
|
if: ${{ inputs.confirm_unfreeze == 'UNFREEZE' }}
|
|
uses: Sea-Haven-Industries/.github/.github/workflows/cd-sam.yaml@3f746774229d41770727e2e4fd63ed5f5555a8b3 # v1.0.3
|
|
with:
|
|
stack-name: sh-openswe-traces
|
|
cfn-role-arn: arn:aws:iam::328440206208:role/sh-openswe-traces-cfn-exec-role
|
|
secrets:
|
|
deploy-role-arn: ${{ secrets.AWS_DEPLOY_ROLE_ARN }}
|
|
parameter-overrides: ${{ secrets.SAM_PARAMETER_OVERRIDES }}
|