-
Notifications
You must be signed in to change notification settings - Fork 421
214 lines (206 loc) · 8.82 KB
/
reusable_deploy_v3_layer_stack.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
name: Deploy CDK Layer v3 stack
# PROCESS
#
# 1. Split what AWS regions support ARM vs regions that Lambda support ARM
# 2. We build the Lambda layer for 3.8 to 3.12 Python runtime and both x86_64 and arm64 (see `matrix` section)
# 3. Deploy previously built layer for each AWS commercial region
# 4. Export all published Layers as JSON
# 5. Deploy Canaries to every deployed region to test whether Powertools can be imported etc.
# USAGE
#
# NOTE: meant to be used with ./.github/workflows/publish_v3_layer.yml
#
# beta:
# needs: build-layer
# # lower privilege propagated from parent workflow (release.yml)
# permissions:
# id-token: write
# contents: read
# pages: write # docs will be updated with latest Layer ARNs
# pull-requests: write # creation-action will create a PR with Layer ARN updates
# uses: ./.github/workflows/reusable_deploy_v3_layer_stack.yml
# secrets: inherit
# with:
# stage: "BETA"
# environment: "layer-beta"
# source_code_artifact_name: code.zip
# source_code_integrity_hash: sha256string
on:
workflow_call:
inputs:
stage:
description: "Deployment stage (BETA, PROD)"
required: true
type: string
environment:
description: "GitHub Environment to use for encrypted secrets"
required: true
type: string
source_code_artifact_name:
description: "Artifact name to restore sealed source code"
type: string
required: true
source_code_integrity_hash:
description: "Sealed source code integrity hash"
type: string
required: true
permissions:
contents: read
env:
RELEASE_COMMIT: ${{ github.sha }} # it gets propagated from the caller for security reasons
jobs:
deploy-cdk-stack:
runs-on: ubuntu-latest
environment: ${{ inputs.environment }}
# lower privilege propagated from parent workflow (publish_v3_layer.yml)
permissions:
id-token: write
pull-requests: none
contents: read
pages: none
defaults:
run:
working-directory: ./layer_v3
strategy:
fail-fast: false
matrix:
# To get a list of current regions, use:
# aws ec2 describe-regions --all-regions --query "Regions[].RegionName" --output text | tr "\t" "\n" | sort
region: ["af-south-1", "ap-east-1", "ap-northeast-1", "ap-northeast-2", "ap-northeast-3",
"ap-south-1", "ap-south-2", "ap-southeast-1", "ap-southeast-2", "ap-southeast-3",
"ap-southeast-4", "ca-central-1", "ca-west-1", "eu-central-1", "eu-central-2",
"eu-north-1", "eu-south-1", "eu-south-2", "eu-west-1", "eu-west-2", "eu-west-3",
"il-central-1", "me-central-1", "me-south-1", "sa-east-1", "us-east-1",
"us-east-2", "us-west-1", "us-west-2"]
python-version: ["3.8","3.9","3.10","3.11","3.12"]
include:
- region: "af-south-1"
has_arm64_support: "true"
- region: "ap-east-1"
has_arm64_support: "true"
- region: "ap-northeast-1"
has_arm64_support: "true"
- region: "ap-northeast-2"
has_arm64_support: "true"
- region: "ap-northeast-3"
has_arm64_support: "true"
- region: "ap-south-1"
has_arm64_support: "true"
- region: "ap-south-2"
has_arm64_support: "true"
- region: "ap-southeast-1"
has_arm64_support: "true"
- region: "ap-southeast-2"
has_arm64_support: "true"
- region: "ap-southeast-3"
has_arm64_support: "true"
- region: "ap-southeast-4"
has_arm64_support: "true"
- region: "ca-central-1"
has_arm64_support: "true"
- region: "ca-west-1"
has_arm64_support: "true"
- region: "eu-central-1"
has_arm64_support: "true"
- region: "eu-central-2"
has_arm64_support: "true"
- region: "eu-north-1"
has_arm64_support: "true"
- region: "eu-south-1"
has_arm64_support: "true"
- region: "eu-south-2"
has_arm64_support: "true"
- region: "eu-west-1"
has_arm64_support: "true"
- region: "eu-west-2"
has_arm64_support: "true"
- region: "eu-west-3"
has_arm64_support: "true"
- region: "il-central-1"
has_arm64_support: "true"
- region: "me-central-1"
has_arm64_support: "true"
- region: "me-south-1"
has_arm64_support: "true"
- region: "sa-east-1"
has_arm64_support: "true"
- region: "us-east-1"
has_arm64_support: "true"
- region: "us-east-2"
has_arm64_support: "true"
- region: "us-west-1"
has_arm64_support: "true"
- region: "us-west-2"
has_arm64_support: "true"
steps:
- name: checkout
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
with:
ref: ${{ env.RELEASE_COMMIT }}
- name: Restore sealed source code
uses: ./.github/actions/seal-restore
with:
integrity_hash: ${{ inputs.source_code_integrity_hash }}
artifact_name: ${{ inputs.source_code_artifact_name }}
- name: Install poetry
run: pipx install git+https://github.com/python-poetry/poetry@68b88e5390720a3dd84f02940ec5200bfce39ac6 # v1.5.0
- name: aws credentials
uses: aws-actions/configure-aws-credentials@5fd3084fc36e372ff1fff382a39b10d03659f355 # v2.2.0
with:
aws-region: ${{ matrix.region }}
role-to-assume: ${{ secrets.AWS_LAYERS_ROLE_ARN }}
- name: Setup Node.js
uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # v4.0.2
with:
node-version: "18.20.4"
- name: Setup python
uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3 # v5.2.0
with:
python-version: ${{ matrix.python-version }}
cache: "pip"
- name: Resolve and install project dependencies
# CDK spawns system python when compiling stack
# therefore it ignores both activated virtual env and cached interpreter by GH
run: |
poetry export --format requirements.txt --output requirements.txt
pip install --require-hashes -r requirements.txt
- name: install cdk and deps
working-directory: ./
run: |
npm ci
npx cdk --version
- name: install deps
run: poetry install
- name: Download artifact
uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
with:
name: cdk-layer-artifact-py${{ matrix.python-version }}
path: layer_v3
- name: unzip artefact
run: unzip cdk.py${{ matrix.python-version }}.out.zip
- name: Define constants
id: constants
run: |
PYTHON_VERSION=$(echo ${{ matrix.python-version }} | tr -d '.')
echo "PYTHON_VERSION=${PYTHON_VERSION}" >> "$GITHUB_OUTPUT"
LAYER_VERSION=${{ matrix.region }}-$PYTHON_VERSION-layer-version.txt
echo "LAYER_VERSION=${LAYER_VERSION}" >> "$GITHUB_OUTPUT"
- name: CDK Deploy Layer
run: npx cdk deploy --app cdk.out --context region=${{ matrix.region }} --parameters HasARM64Support=${{ matrix.has_arm64_support }} "LayerV3Stack-python${{steps.constants.outputs.PYTHON_VERSION}}" --require-approval never --verbose --outputs-file cdk-outputs.json
- name: Store latest Layer ARN
if: ${{ inputs.stage == 'PROD' }}
run: |
mkdir cdk-layer-stack
jq -r -c ".[\"LayerV3Stack-python${{steps.constants.outputs.PYTHON_VERSION}}\"].LatestLayerArn" cdk-outputs.json > cdk-layer-stack/${{steps.constants.outputs.LAYER_VERSION}}
jq -r -c ".[\"LayerV3Stack-python${{steps.constants.outputs.PYTHON_VERSION}}\"].LatestLayerArm64Arn" cdk-outputs.json >> cdk-layer-stack/${{steps.constants.outputs.LAYER_VERSION}}
cat cdk-layer-stack/${{steps.constants.outputs.LAYER_VERSION}}
- name: Save Layer ARN artifact
if: ${{ inputs.stage == 'PROD' }}
uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4.4.0
with:
name: cdk-layer-stack-${{ matrix.region }}-${{ matrix.python-version }}
path: ./layer_v3/cdk-layer-stack/* # NOTE: upload-artifact does not inherit working-directory setting.
if-no-files-found: error
retention-days: 1
- name: CDK Deploy Canary
run: npx cdk deploy --app cdk.out --context region=${{ matrix.region }} --parameters DeployStage="${{ inputs.stage }}" --parameters HasARM64Support=${{ matrix.has_arm64_support }} "CanaryV3Stack-python${{steps.constants.outputs.PYTHON_VERSION}}" --require-approval never --verbose