deploy.yml

name: deploy

on:
  push:
    branches: [ 'main', 'develop']

env:
  AWS_DEFAULT_REGION: us-east-1
  AWS_DEFAULT_OUTPUT: json

jobs:
  code-quality:
    name: Check coding standards
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - run: echo "Job triggered by ${{ github.event_name }} event."
      - run: echo "Job running on a ${{ runner.os }} server hosted by GitHub."
      - run: echo "Branch name is ${{ github.ref }} and repository is ${{ github.repository }}."
      - name: Set up NodeJs
        uses: actions/setup-node@v3
        with:
          node-version: "20"
      - name: Run Prettier and Lint
        run: |
          cd src
          npm ci
          npm run prettier-check
          npm run lint

  build-nextjs:
    name: Build NextJS Application
    runs-on: ubuntu-latest
    needs: code-quality
    steps:
      - uses: actions/checkout@v3
      - name: Set up NodeJs
        uses: actions/setup-node@v3
        with:
          node-version: "20"
      - name: Build NextJs App to Output folder
        run: bash build.sh
      - name: Archive NextJS Output dir
        uses: actions/upload-artifact@v3
        with:
          name: nextjs-output-dir
          path: src/out

  cdk-synth-diff:
    name: CDK Synth & Diff
    runs-on: ubuntu-latest
    needs: build-nextjs
    permissions:
      id-token: write  # This is required for requesting the JWT
      contents: read  # This is required for actions/checkout
    steps:
      - uses: actions/checkout@v3

      - name: Dowload NextJS output folder
        uses: actions/download-artifact@v3
        with:
          name: nextjs-output-dir
          path: ./src/out

      - name: Set up NodeJs
        uses: actions/setup-node@v3
        with:
          node-version: "20"

      - name: Install CDK and Modules
        run: |
          npm install -g aws-cdk
          cd ./cdk
          npm ci

      # Same task with different secrets depending on the branch ref (dev vs prod deployments)
      # Note: there might be better alternatives, but this is a workaround to deploy to both envs
      - name: Configure AWS Credentials (DEV)
        if: github.ref != 'refs/heads/main'
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-region: ${{ env.AWS_DEFAULT_REGION }}
          role-to-assume: arn:aws:iam::${{ secrets.DEV_AWS_ACCOUNT_ID }}:role/${{ secrets.DEV_AWS_DEPLOY_ROLE }}
          role-session-name: myGitHubActions
      - name: Configure AWS Credentials (PROD)
        if: github.ref == 'refs/heads/main'
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-region: ${{ env.AWS_DEFAULT_REGION }}
          role-to-assume: arn:aws:iam::${{ secrets.PROD_AWS_ACCOUNT_ID }}:role/${{ secrets.PROD_AWS_DEPLOY_ROLE }}
          role-session-name: myGitHubActions

      - run: aws sts get-caller-identity

      # Not 100% optimal, but does the work for setting deployment environments from branch
      - name: Setup Deployment Environment from Branch
        run: |
          # To update the deployment environment based on the git branch
          if [[ $GITHUB_REF == 'refs/heads/main' ]]; then
            echo "DEPLOYMENT_ENVIRONMENT=prod" >> "$GITHUB_ENV"
            echo "Deployment environment is PROD"
          else
            echo "DEPLOYMENT_ENVIRONMENT=dev" >> "$GITHUB_ENV"
            echo "Deployment environment is DEV"
          fi

      - name: CDK Synth
        run: |
          cd ./cdk
          cdk synth

      - name: CDK Diff
        run: |
          cd ./cdk
          cdk diff

      - name: Archive CDK Synth results (no assets)
        uses: actions/upload-artifact@v3
        with:
          name: cdk-synth-folder
          path: |
            ./cdk/cdk.out
            !./cdk/cdk.out/asset.*
          retention-days: 1

  iac-checkov:
    name: IaC Checkov Validations
    runs-on: ubuntu-latest
    needs: cdk-synth-diff
    steps:
      - uses: actions/checkout@v3

      - name: Dowload CDK Synth results
        uses: actions/download-artifact@v3
        with:
          name: cdk-synth-folder
          path: ./cdk-synth-output-folder

      - name: Display files in the output folder
        run: tree
        working-directory: ./cdk-synth-output-folder

      - name: Run Checkov action
        id: checkov
        uses: bridgecrewio/checkov-action@v12
        with:
          directory: cdk-synth-output-folder/
          framework: cloudformation
          soft_fail: true # optional: do not return an error code if there are failed checks
          skip_check: CKV_AWS_2 # optional: skip a specific check_id. can be comma separated list
          quiet: true # optional: display only failed checks

  cdk-deploy:
    name: Deploy CDK
    runs-on: ubuntu-latest
    needs:
      - iac-checkov
    permissions:
      id-token: write  # This is required for requesting the JWT
      contents: read  # This is required for actions/checkout
    steps:
      - uses: actions/checkout@v3

      - name: Dowload NextJS output folder
        uses: actions/download-artifact@v3
        with:
          name: nextjs-output-dir
          path: ./src/out

      - name: Set up NodeJs
        uses: actions/setup-node@v3
        with:
          node-version: "20"

      - name: Install CDK and Modules
        run: |
          npm install -g aws-cdk
          cd ./cdk
          npm ci

      # Same task with different secrets depending on the branch ref (dev vs prod deployments)
      # Note: there might be better alternatives, but this is a workaround to deploy to both envs
      - name: Configure AWS Credentials (DEV)
        if: github.ref != 'refs/heads/main'
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-region: ${{ env.AWS_DEFAULT_REGION }}
          role-to-assume: arn:aws:iam::${{ secrets.DEV_AWS_ACCOUNT_ID }}:role/${{ secrets.DEV_AWS_DEPLOY_ROLE }}
          role-session-name: myGitHubActions
      - name: Configure AWS Credentials (PROD)
        if: github.ref == 'refs/heads/main'
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-region: ${{ env.AWS_DEFAULT_REGION }}
          role-to-assume: arn:aws:iam::${{ secrets.PROD_AWS_ACCOUNT_ID }}:role/${{ secrets.PROD_AWS_DEPLOY_ROLE }}
          role-session-name: myGitHubActions

      # Not 100% optimal, but does the work for setting deployment environments from branch
      - name: Setup Deployment Environment from Branch
        run: |
          # To update the deployment environment based on the git branch
          if [[ $GITHUB_REF == 'refs/heads/main' ]]; then
            echo "DEPLOYMENT_ENVIRONMENT=prod" >> "$GITHUB_ENV"
            echo "Deployment environment is PROD"
          else
            echo "DEPLOYMENT_ENVIRONMENT=dev" >> "$GITHUB_ENV"
            echo "Deployment environment is DEV"
          fi

      # NOTE: for now no manual approvals are required
      - name: Deploy to AWS
        run: bash deploy.sh $DEPLOYMENT_ENVIRONMENT