deploy.yml

name: Deploy Code

on:
  push:
    branches: [ dev ]
    tags:
      - "v*.*.*"

permissions:
      id-token: write   # This is required for requesting the JWT
      contents: read    # This is required for actions/checkout
jobs:
  Deploy:
    runs-on: ubuntu-latest
    env:
      POETRY_VERSION: 1.7.1
      POETRY_EXPORT_VERSION: 1.6.0
      POETRY_HOME: /home/runner/.local/bin/
      POETRY: /home/runner/.local/bin/bin/poetry
      PROJECT_NAME: inews
      STAGE: ${{ startsWith(github.ref, 'refs/tags/v') && 'prod' || github.ref_name == 'dev' && 'dev' }}
    steps:
      ###############################################
      # Checkout
      ###############################################
      - name: Git clone the repository
        uses: actions/checkout@v4


      ###############################################
      # Export Requirements (cached)
      ###############################################
      - name: Cache requirements
        id: req-cache
        uses: actions/cache/restore@v3
        with:
          path: ${{ github.workspace }}/requirements.txt
          key: requirements-${{ hashFiles('poetry.lock') }}

      - name: Cache Poetry installation
        id: poetry-cache
        if: steps.req-cache.outputs.cache-hit != 'true'
        uses: actions/cache/restore@v3
        with:
          path: ${{ env.POETRY_HOME }}
          key: poetry-${{ env.POETRY_VERSION }}-${{ env.POETRY_EXPORT_VERSION }}

      - name: Install Poetry
        if: |
          steps.req-cache.outputs.cache-hit != 'true' &&
          steps.poetry-cache.outputs.cache-hit != 'true'
        run: |
          python3 -m venv $POETRY_HOME
          $POETRY_HOME/bin/pip install poetry==$POETRY_VERSION
          $POETRY self add poetry-plugin-export==$POETRY_EXPORT_VERSION

      - name: Export requirements.txt
        if: steps.req-cache.outputs.cache-hit != 'true'
        run: |
          $POETRY config warnings.export false
          $POETRY export -f requirements.txt --output requirements.txt --without-hashes


      ###############################################
      # AWS Authentications
      ###############################################
      - name: Configure aws credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::976114805627:role/${{ env.PROJECT_NAME }}-${{ env.STAGE }}-github-actions
          role-session-name: GitHub_to_AWS_via_FederatedOIDC
          aws-region: "eu-west-3"

      - name: Login to Amazon ECR
        id: login-ecr
        uses: aws-actions/amazon-ecr-login@v2


      # ###############################################
      # # Build (cached), Push & Deploy
      # ###############################################
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Docker meta
        id: meta
        uses: docker/metadata-action@v5
        env:
          ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
        with:
          images: ${{ env.ECR_REGISTRY }}/${{ env.PROJECT_NAME }}-${{ env.STAGE }}
          tags: |
            type=semver,pattern={{raw}},enable=${{ env.STAGE == 'prod' }}
            type=raw,value=latest,enable=${{ env.STAGE == 'dev' }}

      - name: Build and push
        uses: docker/build-push-action@v5
        with:
          context: .
          push: true
          provenance: false
          tags: ${{ steps.meta.outputs.tags }}
          platforms: linux/amd64
          cache-from: type=gha,scope=global

      - name: Update Lambda code
        env:
          ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
          IMAGE: ${{ env.PROJECT_NAME }}-${{ env.STAGE }}
          VERSION: ${{ steps.meta.outputs.version }}
        run: |
          aws lambda update-function-code \
            --function-name ${{ env.PROJECT_NAME }}-${{ env.STAGE }} \
            --image-uri ${{ env.ECR_REGISTRY }}/${{ env.IMAGE }}:${{ env.VERSION }} > /dev/null