dpc-app/.github/workflows/deploy_go_lambda.yml at main · CMSgov/dpc-app · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
name: utility-deploy-go-lambda

on:
  workflow_call:
    inputs:
      env:
        description: AWS environment to deploy to
        required: true
        type: string
      project:
        description: Project name
        required: true
        type: string
      go_files:
        description: space-delimited go files
        required: true
        type: string

jobs:
  deploy:
    name: "Build and Deploy Lambda"
    if: ${{ inputs.env != 'prod' }}
    permissions:
      contents: read
      id-token: write
    runs-on: >-
      codebuild-dpc-app${{
        contains(fromJSON('["prod", "sandbox"]'), inputs.env) && '-prod' || '-non-prod'
      }}-${{ github.run_id }}-${{ github.run_attempt }}
    defaults:
      run:
        working-directory: ./lambda/${{ inputs.project }}
    environment: ${{ inputs.env }}
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.3.0
      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
        with:
          go-version: '1.27.3'
      - name: Build ${{ inputs.project }} zip file
        env:
          CGO_ENABLED: 0
        run: |
          go build -o bootstrap ${{ inputs.go_files }}
          zip function.zip bootstrap
      - name: AWS Credentials (non-prod) # there are no go lambdas on sandbox, so do not need to worry about non-prod credentials for this step
        if: ${{ inputs.env == 'dev' || inputs.env == 'test' }}
        uses: aws-actions/configure-aws-credentials@ec61189d14ec14c8efccab744f656cffd0e33f37 # v6.1.0
        with:
          aws-region: ${{ vars.AWS_REGION }}
          role-to-assume: arn:aws:iam::${{ secrets.NON_PROD_ACCOUNT_ID }}:role/delegatedadmin/developer/dpc-${{ inputs.env }}-github-actions
      - name: retrieve s3 bucket
        uses: cmsgov/cdap/actions/aws-params-env-action@main
        env:
          AWS_REGION: ${{ vars.AWS_REGION }}
        with:
          params: |
            LAMBDA_BUCKET_NAME=/dpc/${{ inputs.env }}/dpc-${{ inputs.env }}-${{ inputs.project }}-bucket

      - name: Upload and reload
        env:
          LABEL: ${{ inputs.env }}-${{ inputs.project }}
        run: |
          aws s3 cp --no-progress function.zip \
          "s3://${LAMBDA_BUCKET_NAME}/function-${{ github.sha }}.zip"
          aws lambda update-function-code --function-name "dpc-${LABEL}" \
          --s3-bucket "$LAMBDA_BUCKET_NAME" --s3-key function-${{ github.sha }}.zip

  promote:
    name: "Promote to prod"
    if: ${{ inputs.env == 'prod' }}
    permissions:
      contents: read
      id-token: write
    runs-on: codebuild-dpc-app-prod-${{github.run_id}}-${{github.run_attempt}}
    environment: prod
    steps:
      - name: AWS Credentials (non-prod)
        uses: aws-actions/configure-aws-credentials@ec61189d14ec14c8efccab744f656cffd0e33f37 # v6.1.0
        with:
          aws-region: ${{ vars.AWS_REGION }}
          role-to-assume: arn:aws:iam::${{ secrets.NON_PROD_ACCOUNT_ID }}:role/delegatedadmin/developer/dpc-test-github-actions
      - name: retrieve test S3 bucket
        uses: cmsgov/cdap/actions/aws-params-env-action@main
        env:
          AWS_REGION: ${{ vars.AWS_REGION }}
        with:
          params: |
            TEST_LAMBDA_BUCKET_NAME=/dpc/test/dpc-test-${{ inputs.project }}-bucket
      - name: Download lambda code from test
        run: |
          aws s3 cp --no-progress \
            "s3://${TEST_LAMBDA_BUCKET_NAME}/function-${{ github.sha }}.zip" \
            function.zip
      - name: AWS Credentials (prod)
        uses: aws-actions/configure-aws-credentials@ec61189d14ec14c8efccab744f656cffd0e33f37 # v6.1.0
        with:
          aws-region: ${{ vars.AWS_REGION }}
          role-to-assume: arn:aws:iam::${{ secrets.PROD_ACCOUNT_ID }}:role/delegatedadmin/developer/dpc-prod-github-actions
      - name: retrieve prod S3 bucket
        uses: cmsgov/cdap/actions/aws-params-env-action@main
        env:
          AWS_REGION: ${{ vars.AWS_REGION }}
        with:
          params: |
            PROD_LAMBDA_BUCKET_NAME=/dpc/prod/dpc-prod-${{ inputs.project }}-bucket
      - name: Promote lambda code to prod
        run: |
          aws s3 cp --no-progress \
            function.zip \
            "s3://${PROD_LAMBDA_BUCKET_NAME}/function-${{ github.sha }}.zip"
          aws lambda update-function-code --function-name dpc-prod-${{ inputs.project }} \
            --s3-bucket $PROD_LAMBDA_BUCKET_NAME --s3-key function-${{ github.sha }}.zip