reusable_deploy_v2_sar.yml

name: Deploy V2 SAR

permissions:
  id-token: write
  contents: read

env:
  SAM_VERSION: 2.44.0
  NODE_VERSION: 16.12
  AWS_REGION: eu-west-1
  SAR_NAME: aws-lambda-powertools-python-layer-v2

on:
  workflow_call:
    inputs:
      stage:
        description: "Deployment stage (BETA, PROD)"
        required: true
        type: string
      artefact-name:
        description: "CDK Layer Artefact name to download"
        required: true
        type: string
      package-version:
        description: "The version of the package to deploy"
        required: true
        type: string
      environment:
        description: "GitHub Environment to use for encrypted secrets"
        required: true
        type: string

jobs:
  deploy-sar-app:
    runs-on: ubuntu-latest
    environment: ${{ inputs.environment }}
    strategy:
      matrix:
        architecture: ["x86_64", "arm64"]
    steps:
      - name: Checkout
        uses: actions/checkout@v3
      - name: AWS credentials
        uses: aws-actions/configure-aws-credentials@v1
        with:
          aws-region: ${{ env.AWS_REGION }}
          role-to-assume: ${{ secrets.AWS_LAYERS_ROLE_ARN }}
      - name: AWS credentials SAR role
        uses: aws-actions/configure-aws-credentials@v1
        id: aws-credentials-sar-role
        with:
          aws-access-key-id: ${{ env.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ env.AWS_SECRET_ACCESS_KEY }}
          aws-session-token: ${{ env.AWS_SESSION_TOKEN }}
          role-duration-seconds: 1200
          aws-region: ${{ env.AWS_REGION }}
          role-to-assume: ${{ secrets.AWS_SAR_V2_ROLE_ARN }}
      - name: Setup Node.js
        uses: actions/setup-node@v3
        with:
          node-version: ${{ env.NODE_VERSION }}
      - name: Download artifact
        uses: actions/download-artifact@v3
        with:
          name: ${{ inputs.artefact-name }}
      - name: Unzip artefact
        run: unzip cdk.out.zip
      - name: Configure SAR name
        run: |
          NAME=${{ env.SAR_NAME }}
          if [[ "${{ inputs.stage }}" == "BETA" ]]; then
            NAME="test-$NAME"
          fi
          echo SAR_NAME="${NAME}" >> "$GITHUB_ENV"
      - name: Adds arm64 suffix to SAR name
        if: ${{ matrix.architecture == 'arm64' }}
        run: echo SAR_NAME="${SAR_NAME}-arm64" >> "$GITHUB_ENV"
      - name: Deploy SAR
        run: |
          asset=$(jq -jc '.Resources[] | select(.Properties.CompatibleArchitectures == ["${{ matrix.architecture }}"]) | .Metadata."aws:asset:path"' cdk.out/LayerV2Stack.template.json)
          sed -e "s|<VERSION>|${{ inputs.package-version }}|g" -e "s/<SAR_APP_NAME>/${{ env.SAR_NAME }}/g" -e "s|<LAYER_CONTENT_PATH>|./cdk.out/$asset|g" layer/sar/template.txt > template.yml
          cp README.md LICENSE "./cdk.out/$asset/"
          sam package --template-file template.yml --output-template-file packaged.yml --s3-bucket ${{ secrets.AWS_SAR_S3_BUCKET }}
          sam publish --template packaged.yml --region "$AWS_REGION"
      - name: Deploy BETA canary
        if: ${{ inputs.stage == 'BETA' }}
        run: |
          STACK_NAME=serverlessrepo-v2-powertools-layer-test-stack

          if [[ "${{ matrix.architecture }}" == "arm64" ]]; then
            STACK_NAME="${STACK_NAME}-arm64"
          fi

          echo "Check if stack does not exist"
          stack_exists=$(aws cloudformation list-stacks --query "StackSummaries[?(StackName == '$STACK_NAME' && StackStatus == 'CREATE_COMPLETE')].{StackId:StackId, StackName:StackName, CreationTime:CreationTime, StackStatus:StackStatus}" --output text)
          if [[ -n "$stack_exists" ]] ; then
            echo "Found test deployment stack, removing..."
            aws cloudformation delete-stack --stack-name "$STACK_NAME"
            aws cloudformation wait stack-delete-complete --stack-name "$STACK_NAME"
          fi

          echo "Creating canary stack"
          echo "Stack name: $STACK_NAME"
          aws serverlessrepo create-cloud-formation-change-set --application-id arn:aws:serverlessrepo:${{ env.AWS_REGION }}:${{ steps.aws-credentials-sar-role.outputs.aws-account-id }}:applications/${{ env.SAR_NAME }} --stack-name "${STACK_NAME/serverlessrepo-/}" --capabilities CAPABILITY_NAMED_IAM
          CHANGE_SET_ID=$(aws cloudformation list-change-sets --stack-name "$STACK_NAME" --query 'Summaries[*].ChangeSetId' --output text)
          aws cloudformation wait change-set-create-complete --change-set-name "$CHANGE_SET_ID"
          aws cloudformation execute-change-set --change-set-name "$CHANGE_SET_ID"
          aws cloudformation wait stack-create-complete --stack-name "$STACK_NAME"
          echo "Waiting until stack deployment completes..."

          echo "Exit with error if stack is not in CREATE_COMPLETE"
          stack_exists=$(aws cloudformation list-stacks --query "StackSummaries[?(StackName == '$STACK_NAME' && StackStatus == 'CREATE_COMPLETE')].{StackId:StackId, StackName:StackName, CreationTime:CreationTime, StackStatus:StackStatus}")
          if [[ -z "$stack_exists" ]] ; then
            echo "Could find successful deployment, exit error..."
            exit 1
          fi
          echo "Deployment successful"
      - name: Publish SAR
        if: ${{ inputs.stage == 'PROD' }}
        run: |
          # wait until SAR registers the app, otherwise it fails to make it public
          sleep 15
          echo "Make SAR app public"
          aws serverlessrepo put-application-policy --application-id arn:aws:serverlessrepo:${{ env.AWS_REGION }}:${{ steps.aws-credentials-sar-role.outputs.aws-account-id }}:applications/${{ env.SAR_NAME }} --statements Principals='*',Actions=Deploy