PLT-655 Add workflows to promote images and release app

.github/workflows/promote.yml

@@ -0,0 +1,82 @@
+name: promote
+
+on:
+  workflow_call:
+    inputs:
+      environment:
+        required: true
+        type: string
+      module:
+        required: true
+        type: string
+  workflow_dispatch:
+    inputs:
+      environment:
+        required: true
+        type: choice
+        options:
+          - sbx
+          - prod
+          - prod-test  
+      module:
+        required: true
+        type: choice
+        options:
+          - api
+          - worker          
+permissions:
+  contents: read
+  id-token: write
+
+jobs:
+  promote:
+    runs-on: ubuntu-latest
+    env:
+        ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION: true
+        AWS_REGION: ${{ vars.AWS_REGION }}
+        DEPLOYMENT_ENV: ${{ vars[format('{0}_DEPLOYMENT_ENV', inputs.environment)] }}
+
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@v3
+
+      - name: Assume role in AB2D Management account
+        uses: aws-actions/configure-aws-credentials@v3
+        with:
+          aws-region: ${{ vars.AWS_REGION }}
+          role-to-assume: arn:aws:iam::${{ secrets.MGMT_ACCOUNT_ID }}:role/delegatedadmin/developer/ab2d-mgmt-github-actions    
+
+      - name: Retag images in ECR
+        run: |
+          SHA_SHORT=$(git rev-parse --short HEAD)        
+          ECR_REPO_DOMAIN="${{ secrets.MGMT_ACCOUNT_ID }}.dkr.ecr.$AWS_REGION.amazonaws.com"
+          ECR_REPO_URI="$ECR_REPO_DOMAIN/ab2d_${{ inputs.module }}"
+
+          # Define target tags based on the environment
+          if [ "${{ inputs.environment }}" == "sbx" ]; then
+            TARGET_TAG="ab2d-sbx-sandbox-latest"
+          elif [ "${{ inputs.environment }}" == "prod" ]; then
+            TARGET_TAG="ab2d-east-prod-latest"
+          elif [ "${{ inputs.environment }}" == "prod-test" ]; then
+            TARGET_TAG="ab2d-east-prod-test-latest"
+          else
+            echo "Unsupported environment: ${{ inputs.environment }}"
+            exit 1
+          fi
+
+
+          IMAGE_EXISTS=$(aws ecr describe-images --repository-name "ab2d_${{ inputs.module }}" --image-ids imageTag=$TARGET_TAG --query 'imageDetails' --output text)
+
+          if [ -n "$IMAGE_EXISTS" ]; then
+            echo "Image with tag $TARGET_TAG already exists. Skipping put-image."
+          else
+            # Get the manifest of the latest test image
+            MANIFEST=$(aws ecr batch-get-image --repository-name "ab2d_${{ inputs.module }}" --image-ids imageTag=ab2d-east-impl-latest --output text --query 'images[].imageManifest' --debug)
+
+          # Retag the image
+          aws ecr put-image --repository-name "ab2d_${{ inputs.module }}" --image-tag "$TARGET_TAG-$SHA_SHORTs" --image-manifest "$MANIFEST"
+          fi  
+
+      - name: Verify new tags
+        run: |
+          aws ecr describe-images --repository-name "ab2d_${{ inputs.module }}"

.github/workflows/release.yml

@@ -0,0 +1,104 @@
+name: release
+
+on:
+  release:
+    types: [released]
+  workflow_dispatch:
+    inputs:
+      environment:
+        required: true
+        type: choice
+        options:
+          - sbx
+          - prod
+          - prod-test  
+
+permissions:
+  contents: read
+  id-token: write
+
+jobs:
+  # Promote and Deploy to prod-test
+  promote-prod-test-api:
+    uses: ./.github/workflows/promote.yml
+    with:
+      environment: prod-test
+      module: api
+    secrets: inherit
+
+  promote-prod-test-worker:
+    uses: ./.github/workflows/promote.yml
+    with:
+      environment: prod-test
+      module: worker
+    secrets: inherit
+
+  deploy-prod-test-worker:
+    needs: promote-prod-test-worker
+    uses: ./.github/workflows/deploy.yml
+    with:
+      environment: prod-test
+      module: worker
+    secrets: inherit
+
+   # Promote and Deploy to prod
+  promote-prod-api:
+    uses: ./.github/workflows/promote.yml
+    with:
+      environment: prod
+      module: api
+    secrets: inherit
+
+  promote-prod-worker:
+    uses: ./.github/workflows/promote.yml
+    with:
+      environment: prod
+      module: worker
+    secrets: inherit
+
+  deploy-prod-api:
+    needs: promote-prod-api
+    uses: ./.github/workflows/deploy.yml
+    with:
+      environment: prod
+      module: api
+    secrets: inherit
+
+  deploy-prod-worker:
+    needs: promote-prod-worker
+    uses: ./.github/workflows/deploy.yml
+    with:
+      environment: prod
+      module: worker
+    secrets: inherit
+
+  # Promote and Deploy to sandbox
+  promote-sbx-api:
+    uses: ./.github/workflows/promote.yml
+    with:
+      environment: sbx
+      module: api
+    secrets: inherit
+
+  promote-sbx-worker:
+    uses: ./.github/workflows/promote.yml
+    with:
+      environment: sbx
+      module: worker
+    secrets: inherit
+
+  deploy-sbx-api:
+    needs: promote-sbx-api
+    uses: ./.github/workflows/deploy.yml 
+    with:
+      environment: sbx
+      module: api
+    secrets: inherit
+
+  deploy-sbx-worker:
+    needs: promote-sbx-worker
+    uses: ./.github/workflows/deploy.yml
+    with:
+      environment: sbx
+      module: worker
+    secrets: inherit