cdk_release_code.yml

name: cdk release code

on:
  workflow_call:
    inputs:
      CDK_RESOURCE_STACK_NAME:
        required: true
        type: string
      DEPLOYED_STACK_NAME:
        required: true
        type: string
      TARGET_ENVIRONMENT:
        required: true
        type: string
      VERSION:
        required: true
        type: string
      COMMIT_ID:
        required: true
        type: string
      CDK_APP_NAME:
        required: true
        type: string
      DEPLOY_CDK_CODE:
        required: true
        type: boolean
      AWS_REGION:
        required: false
        type: string
        default: eu-west-2
      LOG_RETENTION_IN_DAYS:
        required: true
        type: string
      FORWARD_CSOC_LOGS:
        type: boolean
        default: false   
      pinned_image:
        type: string
        required: true
    secrets:
      CDK_DEPLOY_ROLE:
        required: true

jobs:
  deploy_cdk_code:
    runs-on: ubuntu-22.04
    container:
      image: ${{ inputs.pinned_image }}
      options: --user 1001:1001 --group-add 128
    defaults:
      run:
        shell: bash
    name: "${{ inputs.DEPLOY_CDK_CODE && 'Deploy' || 'Diff' }} cdk app ${{ inputs.CDK_APP_NAME }} stack ${{ inputs.DEPLOYED_STACK_NAME }}"
    environment: ${{ inputs.TARGET_ENVIRONMENT }}
    permissions:
      id-token: write
      contents: write

    steps:
      - name: copy .tool-versions
        run: |
          cp /home/vscode/.tool-versions "$HOME/.tool-versions"
      - name: build_artifact download
        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131
        with:
          name: cdk_build_artifact

      - name: extract build_artifact
        run: |
          tar -xf artifact.tar
      - name: Configure AWS Credentials for diff or deploy
        id: connect-aws-deploy
        uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7
        with:
          aws-region: ${{ inputs.AWS_REGION }}
          role-to-assume: ${{ secrets.CDK_DEPLOY_ROLE }}
          role-session-name: account-resources-cdk-diff
          output-credentials: true

      - name: get existing tag
        id: get_existing_tags
        if: ${{ inputs.DEPLOY_CDK_CODE == false }}
        run: |
          if aws cloudformation describe-stacks --stack-name "$STACK_NAME" >/dev/null 2>&1; then
            VERSION_NUMBER=$(aws cloudformation describe-stacks \
              --region "${AWS_REGION}" \
              --stack-name "$STACK_NAME" \
              --query "Stacks[0].Tags[?Key=='version'].Value" \
              --output text)
            COMMIT_ID=$(aws cloudformation describe-stacks \
              --region "${AWS_REGION}" \
              --stack-name "$STACK_NAME" \
              --query "Stacks[0].Tags[?Key=='commit'].Value" \
              --output text)
          else
            echo "Initial deployment. Using unknown tag"
            VERSION_NUMBER="unknown"
            COMMIT_ID="unknown"
          fi
          {
            echo VERSION_NUMBER="${VERSION_NUMBER}"
            echo COMMIT_ID="${COMMIT_ID}" 
          } >> "$GITHUB_OUTPUT"

        env:
          STACK_NAME: "${{ inputs.DEPLOYED_STACK_NAME }}"
          COMMIT_ID: "${{ inputs.COMMIT_ID }}"
          AWS_REGION: "${{ inputs.AWS_REGION }}"

      - name: Fix path
        run: |
          echo "$PWD/node_modules/.bin" >> "$GITHUB_PATH"
      - name: "Run diff for cdk app ${{ inputs.CDK_APP_NAME }} stack ${{ inputs.DEPLOYED_STACK_NAME }} existing tag"
        if: ${{ inputs.DEPLOY_CDK_CODE == false }}
        run: |
          npm run cdk-diff --workspace packages/cdk  2>&1 | tee "cdk_deploy_diff_existing_tag.log"
        shell: bash
        env:
          CDK_STACK_NAME: "${{ inputs.CDK_RESOURCE_STACK_NAME }}"
          CDK_CONFIG_DEPLOYED_STACK_NAME: "${{ inputs.DEPLOYED_STACK_NAME }}"
          AWS_REGION: "${{ inputs.AWS_REGION }}"
          CDK_APP_NAME: "${{ inputs.CDK_APP_NAME }}"
          CDK_CONFIG_isPullRequest: false
          CDK_CONFIG_environment: "${{ inputs.TARGET_ENVIRONMENT }}"
          CDK_CONFIG_commitId: "${{ steps.get_existing_tags.outputs.COMMIT_ID }}"
          CDK_CONFIG_versionNumber: "${{ steps.get_existing_tags.outputs.VERSION_NUMBER }}"
          CDK_CONFIG_LOG_RETENTION_IN_DAYS: "${{ inputs.LOG_RETENTION_IN_DAYS }}"
          CDK_CONFIG_FORWARD_CSOC_LOGS: "${{ inputs.FORWARD_CSOC_LOGS }}"

      - name: "Run diff for cdk app ${{ inputs.CDK_APP_NAME }} stack ${{ inputs.DEPLOYED_STACK_NAME }} new tag"
        if: ${{ inputs.DEPLOY_CDK_CODE == false }}
        run: |
          npm run cdk-diff --workspace packages/cdk 2>&1 | tee "cdk_deploy_diff_new_tag.log"
        shell: bash
        env:
          CDK_STACK_NAME: "${{ inputs.CDK_RESOURCE_STACK_NAME }}"
          CDK_CONFIG_DEPLOYED_STACK_NAME: "${{ inputs.DEPLOYED_STACK_NAME }}"
          AWS_REGION: "${{ inputs.AWS_REGION }}"
          CDK_APP_NAME: "${{ inputs.CDK_APP_NAME }}"
          CDK_CONFIG_isPullRequest: false
          CDK_CONFIG_environment: "${{ inputs.TARGET_ENVIRONMENT }}"
          CDK_CONFIG_commitId: "${{ inputs.COMMIT_ID }}"
          CDK_CONFIG_versionNumber: "${{ inputs.VERSION }}"
          CDK_CONFIG_LOG_RETENTION_IN_DAYS: "${{ inputs.LOG_RETENTION_IN_DAYS }}"
          CDK_CONFIG_FORWARD_CSOC_LOGS: "${{ inputs.FORWARD_CSOC_LOGS }}"

      - name: "Run create changeset for cdk app ${{ inputs.CDK_APP_NAME }} stack ${{ inputs.DEPLOYED_STACK_NAME }} new tag"
        run: |
          SANITIZED_VERSION="${CDK_CONFIG_versionNumber//./-}"
          CDK_CHANGE_SET_NAME="${CDK_CONFIG_DEPLOYED_STACK_NAME}-changeset-${SANITIZED_VERSION}-$(date +%s)"
          export CDK_CHANGE_SET_NAME
          echo "CDK_CHANGE_SET_NAME=${CDK_CHANGE_SET_NAME}" >> "$GITHUB_ENV"
          echo "Created changeset ${CDK_CHANGE_SET_NAME} for app ${CDK_APP_NAME} stack ${CDK_CONFIG_DEPLOYED_STACK_NAME}" >> "$GITHUB_STEP_SUMMARY"
          npm run cdk-prepare-changeset --workspace packages/cdk 2>&1 | tee "cdk_deploy_new_tag.log"
        shell: bash
        env:
          CDK_STACK_NAME: "${{ inputs.CDK_RESOURCE_STACK_NAME }}"
          CDK_CONFIG_DEPLOYED_STACK_NAME: "${{ inputs.DEPLOYED_STACK_NAME }}"
          AWS_REGION: "${{ inputs.AWS_REGION }}"
          CDK_APP_NAME: "${{ inputs.CDK_APP_NAME }}"
          CDK_CONFIG_isPullRequest: false
          CDK_CONFIG_environment: "${{ inputs.TARGET_ENVIRONMENT }}"
          CDK_CONFIG_commitId: "${{ inputs.COMMIT_ID }}"
          CDK_CONFIG_versionNumber: "${{ inputs.VERSION }}"
          REQUIRE_APPROVAL: "never"
          CDK_CONFIG_LOG_RETENTION_IN_DAYS: "${{ inputs.LOG_RETENTION_IN_DAYS }}"
          CDK_CONFIG_FORWARD_CSOC_LOGS: "${{ inputs.FORWARD_CSOC_LOGS }}"
      - name: Header output
        if: ${{ inputs.DEPLOY_CDK_CODE == false }}
        shell: bash
        working-directory: .github/scripts
        run: ./header_output.sh
        env:
          TARGET_ENVIRONMENT: ${{ inputs.TARGET_ENVIRONMENT }}
          STACK_NAME: ${{ inputs.DEPLOYED_STACK_NAME }}
          VERSION: ${{ inputs.VERSION }}
      - name: Describe existing tag CDK Changes
        if: ${{ inputs.DEPLOY_CDK_CODE == false }}
        shell: bash
        env:
          SUMMARY: "[${{ inputs.target_environment }}] CDK Changes for existing tag ${{ inputs.DEPLOYED_STACK_NAME }}"
          STACK_NAME: ${{ inputs.DEPLOYED_STACK_NAME }}
          DIFF_FILE: ./cdk_deploy_diff_existing_tag.log
        run: ./.github/scripts/describe_cdk_changes.sh
  
      - name: Describe Full CDK Changes
        if: ${{ inputs.DEPLOY_CDK_CODE == false }}
        shell: bash
        env:
          SUMMARY: "[${{ inputs.target_environment }}] FULL CDK Changes for ${{ inputs.DEPLOYED_STACK_NAME }}"
          STACK_NAME: ${{ inputs.DEPLOYED_STACK_NAME }}
          DIFF_FILE: ./cdk_deploy_diff_new_tag.log
        run: ./.github/scripts/describe_cdk_changes.sh

      - name: Check for destructive changes
        shell: bash
        env:
          STACK_NAME: ${{ inputs.DEPLOYED_STACK_NAME }}
          DIFF_FILE: ./cdk_deploy_diff_new_tag.log
          AWS_REGION: ${{ inputs.AWS_REGION }}
          ALLOWED_CHANGES_FILENAME: "${{ github.workspace }}/packages/cdk/allowedChanges.json"
        run: |
          npm run cdk-check-changeset --workspace packages/cdk
          
      - name: Execute change set
        if: ${{ inputs.DEPLOY_CDK_CODE == true }}
        run: |
          echo "Executing change set"
          aws cloudformation execute-change-set \
            --stack-name "$STACK_NAME" \
            --change-set-name "${CDK_CHANGE_SET_NAME}"
        env:
          STACK_NAME: "${{ inputs.DEPLOYED_STACK_NAME }}"
      - name: Checkout gh-pages
        if: ${{ inputs.DEPLOY_CDK_CODE == true }}
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
        with:
          ref: gh-pages
          path: gh-pages

      - name: Update release tag in github pages
        if: ${{ inputs.DEPLOY_CDK_CODE == true }}
        run: |
          cd gh-pages
          NOW=$(date +'%Y-%m-%dT%H:%M:%S')
          echo "tag,release_datetime" > "_data/${TARGET_ENVIRONMENT}_${STACK_NAME}_${AWS_REGION}_latest.csv"
          echo "${VERSION},${NOW}" >> "_data/${TARGET_ENVIRONMENT}_${STACK_NAME}_${AWS_REGION}_latest.csv"
          echo "${VERSION},${NOW}" >> "_data/${TARGET_ENVIRONMENT}_${STACK_NAME}_${AWS_REGION}_deployments.csv"
          git config user.name github-actions
          git config user.email github-actions@github.com
          git add "_data/${TARGET_ENVIRONMENT}_${STACK_NAME}_${AWS_REGION}_latest.csv"
          git add "_data/${TARGET_ENVIRONMENT}_${STACK_NAME}_${AWS_REGION}_deployments.csv"
          git commit -m "update releases for ${TARGET_ENVIRONMENT} and stack ${STACK_NAME}"
          parallel --retries 10 --delay 3 ::: "git pull --rebase && git push"
        env:
          STACK_NAME: ${{ inputs.DEPLOYED_STACK_NAME }}
          TARGET_ENVIRONMENT: ${{ inputs.TARGET_ENVIRONMENT }}
          VERSION: ${{ inputs.VERSION }}
          AWS_REGION: ${{ inputs.AWS_REGION }}