Skip to content

Commit ac83a8a

Browse files
mishraompCopilot
mishraomp
and
Copilot
authored
chore: LZA move and tf modules (#126)
* chore: LZA move and tf modules * fix: env name * fix: aurora * fix: aurora * fix: envs * Update infrastructure/modules/common/variables.tf Co-authored-by: Copilot <[email protected]> * fix: AWS deploy instructions --------- Co-authored-by: Copilot <[email protected]>
1 parent d0f37da commit ac83a8a

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

50 files changed

+2646
-998
lines changed

‎.github/workflows/.deploy_stack.yml‎

Lines changed: 50 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -38,8 +38,57 @@ permissions:
3838
id-token: write # This is required for requesting the JWT
3939
contents: write # This is required for actions/checkout
4040
jobs:
41+
42+
ecr:
43+
name: ECR
44+
runs-on: ubuntu-24.04
45+
environment: ${{ inputs.environment_name }}
46+
strategy:
47+
matrix:
48+
package: [backend,migrations]
49+
steps:
50+
- name: Configure AWS Credentials
51+
uses: aws-actions/configure-aws-credentials@v4
52+
with:
53+
role-to-assume: ${{ secrets.AWS_DEPLOY_ROLE_ARN }}
54+
role-session-name: gha-ecr-push
55+
aws-region: ca-central-1
56+
57+
- name: Login to Amazon ECR
58+
id: login-ecr
59+
uses: aws-actions/amazon-ecr-login@v2
60+
61+
- name: Login to GitHub Container Registry
62+
uses: docker/login-action@v3
63+
with:
64+
registry: ghcr.io
65+
username: ${{ github.actor }}
66+
password: ${{ secrets.GITHUB_TOKEN }}
67+
68+
- name: Pull, tag and push image to ECR
69+
env:
70+
ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
71+
GHCR_IMAGE: ghcr.io/${{ github.repository }}/${{ matrix.package }}:${{ inputs.tag }}
72+
run: |
73+
# Check if command is apply and validate image exists
74+
if [ "${{ inputs.command }}" == "apply" ]; then
75+
docker manifest inspect $GHCR_IMAGE > /dev/null 2>&1 || { echo "Error: Image $GHCR_IMAGE does not exist and command is apply"; exit 1; }
76+
docker pull $GHCR_IMAGE || { echo "Error: Failed to pull image $GHCR_IMAGE"; exit 1; }
77+
78+
# Tag for ECR
79+
ECR_IMAGE=$ECR_REGISTRY/${{ github.repository }}:${{ matrix.package }}-${{ inputs.tag }}
80+
docker tag $GHCR_IMAGE $ECR_IMAGE
81+
82+
# Push to ECR
83+
docker push $ECR_IMAGE
84+
else
85+
echo "Command is not apply, continuing"
86+
exit 0;
87+
fi
88+
4189
stack-prefix:
4290
name: Stack Prefix
91+
needs: ecr
4392
uses: ./.github/workflows/.stack-prefix.yml
4493
deploy-db:
4594
name: Deploys Database
@@ -79,7 +128,7 @@ jobs:
79128
build-ui:
80129
name: Build And upload UI to s3 ${{ inputs.environment_name }}
81130
environment: ${{ inputs.environment_name }}
82-
if: ( inputs.command == 'apply' )
131+
if: (inputs.command == 'apply')
83132
needs: [deploy-api, deploy-cloudfront]
84133
runs-on: ubuntu-24.04
85134
steps:

‎.github/workflows/.deployer.yml‎

Lines changed: 47 additions & 62 deletions
Original file line numberDiff line numberDiff line change
@@ -41,15 +41,12 @@ on:
4141
value: ${{ jobs.infra.outputs.CF_DOMAIN }}
4242
CF_DISTRIBUTION_ID:
4343
value: ${{ jobs.infra.outputs.CF_DISTRIBUTION_ID }}
44-
4544

46-
47-
4845
env:
49-
TG_VERSION: 0.55.2
50-
TF_VERSION: 1.5.3
51-
TG_SRC_PATH: terraform/${{ inputs.working_directory }}
52-
AWS_REGION: ca-central-1
46+
TG_VERSION: 0.63.6
47+
TF_VERSION: 1.12.2
48+
TG_SRC_PATH: terraform/${{ inputs.working_directory }}
49+
AWS_REGION: ca-central-1
5350
permissions:
5451
id-token: write # This is required for requesting the JWT
5552
contents: write # This is required for actions/checkout
@@ -66,92 +63,80 @@ jobs:
6663
steps:
6764
- name: Checkout
6865
uses: actions/checkout@v4
69-
7066
- name: Configure AWS Credentials
7167
uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4
7268
with:
7369
role-to-assume: ${{ secrets.AWS_DEPLOY_ROLE_ARN }}
7470
role-session-name: ${{ inputs.environment_name }}-deployment
7571
aws-region: ${{ env.AWS_REGION }}
76-
7772
- uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3
7873
with:
7974
terraform_version: ${{ env.TF_VERSION }}
80-
81-
- name: Setup Terragrunt
82-
uses: autero1/action-terragrunt@aefb0a43c4f5503a91fefb307745c4d51c26ed0e # v3
83-
with:
84-
terragrunt-version: ${{ env.TG_VERSION }}
85-
8675
- name: Get ECR Registry
87-
if: inputs.app_env == 'prod'
8876
id: ecr-check
8977
run: |
9078
ECR_REGISTRY=$(aws sts get-caller-identity --query Account --output text).dkr.ecr.ca-central-1.amazonaws.com
9179
echo "ecr-registry=$ECR_REGISTRY" >> $GITHUB_OUTPUT
92-
9380
- name: Image Tags
9481
id: image-tags
9582
shell: bash
9683
run: |
97-
if [[ "${{ inputs.app_env }}" == "prod" && "${{ inputs.working_directory }}" == "api" ]]; then
98-
API_IMAGE="${{ steps.ecr-check.outputs.ecr-registry }}/${{ github.event.repository.name }}-backend-prod:${{ inputs.tag }}"
99-
FLYWAY_IMAGE="${{ steps.ecr-check.outputs.ecr-registry }}/${{ github.event.repository.name }}-migrations-prod:${{ inputs.tag }}"
100-
else
101-
API_IMAGE="ghcr.io/${{ github.repository }}/backend:${{ inputs.tag }}"
102-
FLYWAY_IMAGE="ghcr.io/${{ github.repository }}/migrations:${{ inputs.tag }}"
103-
fi
84+
API_IMAGE="${{ steps.ecr-check.outputs.ecr-registry }}/${{ github.repository }}:backend-${{ inputs.tag }}"
85+
FLYWAY_IMAGE="${{ steps.ecr-check.outputs.ecr-registry }}/${{ github.repository }}:migrations-${{ inputs.tag }}"
10486
echo "api-image=$API_IMAGE" >> $GITHUB_OUTPUT
10587
echo "flyway-image=$FLYWAY_IMAGE" >> $GITHUB_OUTPUT
88+
89+
- name: Setup Terragrunt
90+
uses: autero1/action-terragrunt@aefb0a43c4f5503a91fefb307745c4d51c26ed0e # v3
91+
with:
92+
terragrunt-version: ${{ env.TG_VERSION }}
10693
- name: Terragrunt ${{inputs.command}}
10794
working-directory: terraform/${{ inputs.working_directory }}/${{ inputs.environment_name }}
10895
env:
109-
target_env: ${{ inputs.environment_name }}
110-
aws_license_plate: ${{ secrets.AWS_LICENSE_PLATE }}
111-
flyway_image: ${{ steps.image-tags.outputs.flyway-image }}
112-
api_image: ${{ steps.image-tags.outputs.api-image }}
113-
app_env: ${{inputs.app_env}}
114-
stack_prefix: ${{ inputs.stack_prefix }}
115-
repo_name: ${{ github.event.repository.name }}
96+
target_env: ${{ inputs.environment_name }}
97+
aws_license_plate: ${{ secrets.AWS_LICENSE_PLATE }}
98+
api_image: ${{ steps.image-tags.outputs.api-image }}
99+
flyway_image: ${{ steps.image-tags.outputs.flyway-image }}
100+
app_env: ${{inputs.app_env}}
101+
stack_prefix: ${{ inputs.stack_prefix }}
102+
repo_name: ${{ github.event.repository.name }}
116103
run: |
117-
# Run terraform
118-
terragrunt run-all ${{inputs.command}} --terragrunt-non-interactive
119-
104+
# Run terraform
105+
terragrunt run-all ${{inputs.command}} --terragrunt-non-interactive
120106
- name: Terragrunt API Outputs
121-
if: ( inputs.working_directory == 'api' && inputs.command == 'apply' )
107+
if: (inputs.working_directory == 'api' && inputs.command == 'apply')
122108
working-directory: terraform/${{ inputs.working_directory }}/${{ inputs.environment_name }}
123109
id: tg-outputs
124110
env:
125-
target_env: ${{ inputs.environment_name }}
126-
aws_license_plate: ${{ secrets.AWS_LICENSE_PLATE }}
127-
flyway_image: ${{ steps.image-tags.outputs.flyway-image }}
128-
api_image: ${{ steps.image-tags.outputs.api-image }}
129-
app_env: ${{inputs.app_env}}
130-
stack_prefix: ${{ inputs.stack_prefix }}
131-
repo_name: ${{ github.event.repository.name }}
111+
target_env: ${{ inputs.environment_name }}
112+
aws_license_plate: ${{ secrets.AWS_LICENSE_PLATE }}
113+
api_image: ${{ steps.image-tags.outputs.api-image }}
114+
flyway_image: ${{ steps.image-tags.outputs.flyway-image }}
115+
app_env: ${{inputs.app_env}}
116+
stack_prefix: ${{ inputs.stack_prefix }}
117+
repo_name: ${{ github.event.repository.name }}
132118
run: |
133-
terragrunt output -json > outputs.json
134-
#print the output
135-
cat outputs.json
136-
echo "API_GW_URL=$(jq -r .apigw_url.value outputs.json)" >> $GITHUB_OUTPUT
137-
119+
terragrunt output -json > outputs.json
120+
#print the output
121+
cat outputs.json
122+
echo "API_GW_URL=$(jq -r .apigw_url.value outputs.json)" >> $GITHUB_OUTPUT
138123
- name: Terragrunt Frontend Outputs
139-
if: ( inputs.working_directory == 'frontend' && inputs.command == 'apply' )
124+
if: (inputs.working_directory == 'frontend' && inputs.command == 'apply')
140125
working-directory: terraform/${{ inputs.working_directory }}/${{ inputs.environment_name }}
141126
id: tg-outputs-frontend
142127
env:
143-
target_env: ${{ inputs.environment_name }}
144-
aws_license_plate: ${{ secrets.AWS_LICENSE_PLATE }}
145-
flyway_image: ${{ steps.image-tags.outputs.flyway-image }}
146-
api_image: ${{ steps.image-tags.outputs.api-image }}
147-
app_env: ${{inputs.app_env}}
148-
stack_prefix: ${{ inputs.stack_prefix }}
149-
repo_name: ${{ github.event.repository.name }}
128+
target_env: ${{ inputs.environment_name }}
129+
aws_license_plate: ${{ secrets.AWS_LICENSE_PLATE }}
130+
api_image: ${{ steps.image-tags.outputs.api-image }}
131+
flyway_image: ${{ steps.image-tags.outputs.flyway-image }}
132+
app_env: ${{inputs.app_env}}
133+
stack_prefix: ${{ inputs.stack_prefix }}
134+
repo_name: ${{ github.event.repository.name }}
150135
run: |
151-
terragrunt output -json > outputs.json
152-
#print the output
153-
cat outputs.json
154-
155-
echo "S3_BUCKET_ARN=$(jq -r .s3_bucket_arn.value outputs.json)" >> $GITHUB_OUTPUT
156-
echo "CF_DOMAIN=$(jq -r .cloudfront.value.domain_name outputs.json)" >> $GITHUB_OUTPUT
157-
echo "CF_DISTRIBUTION_ID=$(jq -r .cloudfront.value.distribution_id outputs.json)" >> $GITHUB_OUTPUT
136+
terragrunt output -json > outputs.json
137+
#print the output
138+
cat outputs.json
139+
140+
echo "S3_BUCKET_ARN=$(jq -r .s3_bucket_arn.value outputs.json)" >> $GITHUB_OUTPUT
141+
echo "CF_DOMAIN=$(jq -r .cloudfront.value.domain_name outputs.json)" >> $GITHUB_OUTPUT
142+
echo "CF_DISTRIBUTION_ID=$(jq -r .cloudfront.value.distribution_id outputs.json)" >> $GITHUB_OUTPUT

‎.github/workflows/merge.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -44,7 +44,7 @@ jobs:
4444
needs: [resume-resources, vars]
4545
uses: ./.github/workflows/.deploy_stack.yml
4646
with:
47-
environment_name: dev
47+
environment_name: prod # ::change it to:: dev , template repo only has PROD
4848
command: apply
4949
tag: ${{ needs.vars.outputs.pr }}
5050
app_env: dev
@@ -77,7 +77,7 @@ jobs:
7777
needs: [vars, e2e]
7878
uses: ./.github/workflows/.deploy_stack.yml
7979
with:
80-
environment_name: dev # since we are using the same namespace env for dev and test
80+
environment_name: prod # ::change it to:: test , template repo only has PROD
8181
command: apply
8282
tag: ${{ needs.vars.outputs.pr }}
8383
app_env: test

‎.github/workflows/pause-resources.yml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,7 @@ jobs:
3434
pause-resources-dev:
3535
name: Pause Resources Dev
3636
if: (inputs.app_env == 'dev' || inputs.app_env == 'all' || github.event_name == 'schedule')
37+
environment: prod # ::change it to:: dev , template repo only has PROD
3738
needs: [stack-prefix]
3839
runs-on: ubuntu-24.04
3940
steps:
@@ -53,7 +54,7 @@ jobs:
5354
pause-resources-test:
5455
name: Pause Resources Test
5556
if: (inputs.app_env == 'test' || inputs.app_env == 'all' || github.event_name == 'schedule')
56-
environment: test
57+
environment: prod # ::change it to:: test , template repo only has PROD
5758
needs: [stack-prefix]
5859
runs-on: ubuntu-24.04
5960
steps:

‎.github/workflows/pr-open.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@ jobs:
3434
cancel-in-progress: false
3535
uses: ./.github/workflows/.deploy_stack.yml
3636
with:
37-
environment_name: dev
37+
environment_name: prod # ::change it to:: dev , template repo only has PROD
3838
command: plan
3939
tag: ${{ github.event.number || 'latest' }}
4040
app_env: ${{ github.event.number || 'latest' }} # ephermal, prefixed for easy clean up of PR resources in s3 and dynamodb generated by terraform
@@ -69,10 +69,10 @@ jobs:
6969
concurrency:
7070
group: deploy-dev-${{ github.event.number || 'latest' }}
7171
cancel-in-progress: false
72-
needs: [resume-resources-dev]
72+
needs: [resume-resources-dev, plan-stack]
7373
uses: ./.github/workflows/.deploy_stack.yml
7474
with:
75-
environment_name: dev
75+
environment_name: prod # ::change it to:: dev , template repo only has PROD
7676
command: apply
7777
tag: manual
7878
app_env: dev

‎.github/workflows/release.yml‎

Lines changed: 2 additions & 55 deletions
Original file line numberDiff line numberDiff line change
@@ -88,59 +88,6 @@ jobs:
8888
tags: |
8989
${{ needs.vars.outputs.tags }}
9090
91-
push-to-ecr:
92-
name: Push Images to ECR
93-
needs: [vars, retag-images]
94-
runs-on: ubuntu-24.04
95-
strategy:
96-
matrix:
97-
package: [backend, migrations]
98-
steps:
99-
- name: Configure AWS Credentials
100-
uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4
101-
with:
102-
role-to-assume: ${{ secrets.AWS_DEPLOY_ROLE_ARN }}
103-
role-session-name: gha-ecr-push
104-
aws-region: ca-central-1
105-
106-
- name: Login to Amazon ECR
107-
id: login-ecr
108-
uses: aws-actions/amazon-ecr-login@v2
109-
110-
- name: Login to GitHub Container Registry
111-
uses: docker/login-action@v3
112-
with:
113-
registry: ghcr.io
114-
username: ${{ github.actor }}
115-
password: ${{ secrets.GITHUB_TOKEN }}
116-
117-
- name: Pull, tag and push image to ECR
118-
env:
119-
ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
120-
GHCR_IMAGE: ghcr.io/${{ github.repository }}/${{ matrix.package }}:${{ needs.vars.outputs.tag }}
121-
run: |
122-
# Create ECR repository if it doesn't exist
123-
aws ecr create-repository \
124-
--repository-name ${{ github.event.repository.name }}-${{ matrix.package }}-prod \
125-
--image-tag-mutability IMMUTABLE \
126-
--image-scanning-configuration scanOnPush=true \
127-
|| true
128-
129-
# Apply lifecycle policy separately
130-
aws ecr put-lifecycle-policy \
131-
--repository-name ${{ github.event.repository.name }}-${{ matrix.package }}-prod \
132-
--lifecycle-policy '{"rules":[{"rulePriority":1,"description":"Keep only 5 tagged images","selection":{"tagStatus":"tagged","tagPatternList":["*"],"countType":"imageCountMoreThan","countNumber":5},"action":{"type":"expire"}},{"rulePriority":2,"description":"Remove untagged images","selection":{"tagStatus":"untagged","countType":"imageCountMoreThan","countNumber":1},"action":{"type":"expire"}}]}' \
133-
|| true
134-
135-
# Pull image from GHCR
136-
docker pull $GHCR_IMAGE || { echo "Error: Failed to pull image $GHCR_IMAGE"; exit 1; }
137-
138-
# Tag for ECR
139-
ECR_IMAGE=$ECR_REGISTRY/${{ github.event.repository.name }}-${{ matrix.package }}-prod:${{ needs.vars.outputs.tag }}
140-
docker tag $GHCR_IMAGE $ECR_IMAGE
141-
142-
# Push to ECR
143-
docker push $ECR_IMAGE
14491

14592
resume-resources:
14693
name: Resume Resources # This job resumes resources for the merged PR which is needed if the resources were paused.
@@ -152,11 +99,11 @@ jobs:
15299

153100
deploy:
154101
name: Deploy Stack
155-
needs: [vars, resume-resources, retag-images, push-to-ecr]
102+
needs: [vars, resume-resources, retag-images]
156103
uses: ./.github/workflows/.deploy_stack.yml
157104
secrets: inherit
158105
with:
159-
environment_name: dev # since we only have one namespace dev, update this to PROD
106+
environment_name: prod
160107
command: apply
161108
tag: ${{ needs.vars.outputs.tag}} # this is the tag of the containers to deploy
162109
app_env: prod

‎.github/workflows/resume-resources.yml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,7 @@ jobs:
3434
resume-resources-dev:
3535
if: (inputs.app_env == 'dev' || inputs.app_env == 'all' || github.event_name == 'schedule')
3636
name: Resume Resources Dev
37+
environment: prod # ::change it to:: dev , template repo only has PROD
3738
needs: [stack-prefix]
3839
runs-on: ubuntu-24.04
3940
steps:
@@ -53,7 +54,7 @@ jobs:
5354
resume-resources-test:
5455
name: Resume Resources Test
5556
if: (inputs.app_env == 'test' || inputs.app_env == 'all' || github.event_name == 'schedule')
56-
environment: test
57+
environment: prod # ::change it to:: test , template repo only has PROD
5758
needs: [stack-prefix]
5859
runs-on: ubuntu-24.04
5960
steps:

‎.gitignore‎

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -368,4 +368,13 @@ pyrightconfig.json
368368
**/node_modules
369369
**/dist
370370
# nested terragrunt-cache
371-
**/.terragrunt-cache/**
371+
**/.terragrunt-cache/**
372+
**/.terraform
373+
# terraform plan output
374+
*.tfplan
375+
# terraform state
376+
*.tfstate
377+
# terraform state backup
378+
*.tfstate.backup
379+
# terraform lock file
380+
*.terraform.lock.hcl

0 commit comments

Comments
 (0)