deploy.yml

# This workflow will do a clean install of node dependencies, build the source code and run tests across different versions of node
# For more information see: https://help.github.com/actions/language-and-framework-guides/using-nodejs-with-github-actions
name: Deploy
on:
  push:
    branches: [ main ]
jobs:
  deploy-image:
    # Ensure test job passes before pushing image.
    runs-on: ubuntu-22.04
    permissions:
      id-token: write   # This is required for requesting the JWT
      contents: read
    steps:
      - uses: actions/checkout@v4
      - name: Set up Python 3.10
        uses: actions/setup-python@v5
        with:
          python-version: '3.10'
      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4 # More information on this action can be found below in the 'AWS Credentials' section
        with:
          role-to-assume: ${{ secrets.AWS_ROLE_TO_ASSUME }}
          role-session-name: ${{ secrets.AWS_ROLE_SESSION_NAME }}
          aws-region: 'ap-southeast-1'
      - name: Install CDK
        run: |
          npm install -g aws-cdk
          cdk doctor
      - name: Login to Amazon ECR
        id: login-ecr
        uses: aws-actions/amazon-ecr-login@v2
      - name: Extract metadata (tags, labels) for Docker
        id: meta
        uses: docker/metadata-action@v5
        env:
          REGISTRY: ${{ steps.login-ecr.outputs.registry }}
          REPOSITORY: telegram-bot
        with:
          images: "${{ env.REGISTRY }}/${{ env.REPOSITORY }}"
          tags: |
            type=ref,event=branch
            type=ref,event=pr
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=sha,format=long
      - name: Build and push Docker images
        uses: docker/build-push-action@v5
        with:
          context: .
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
  deploy-apprunner:
    runs-on: ubuntu-22.04
    environment: production
    needs: deploy-image
    permissions:
      id-token: write   # This is required for requesting the JWT
      contents: read
    steps:
      - uses: actions/checkout@v4
      - name: Use Node.js 18.x
        uses: actions/setup-node@v4
        with:
          node-version: '18.x'
      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4 # More information on this action can be found below in the 'AWS Credentials' section
        with:
          role-to-assume: ${{ secrets.AWS_ROLE_TO_ASSUME }}
          role-session-name: ${{ secrets.AWS_ROLE_SESSION_NAME }}
          aws-region: 'ap-southeast-1'
      - name: Install CDK
        run: |
          npm install -g aws-cdk
          cdk doctor
      - name: Prepare App Runner
        uses: bervProject/prepare-apprunner-action@0.1.3
        with:
          arn: ${{ secrets.ARN }}
          region: 'ap-southeast-1'
      - name: Deploy Infra
        working-directory: 'infra'
        run: |
          python -m venv .venv
          source .venv/bin/activate
          pip install -r requirements.txt
          cdk deploy TelegramBotInfraStack --parameters "imageTag=sha-${{ github.sha }}" --require-approval never