Skip to content

Merge pull request #11 from Stealinglight/copilot/fix-jq-parse-error #17

Merge pull request #11 from Stealinglight/copilot/fix-jq-parse-error

Merge pull request #11 from Stealinglight/copilot/fix-jq-parse-error #17

Workflow file for this run

name: Deploy Infrastructure
on:
push:
branches: [ main ]
paths:
- 'cdk/**'
- 'lambda/**'
- '.github/workflows/deploy-infra.yml'
pull_request:
branches: [ main ]
paths:
- 'cdk/**'
- 'lambda/**'
permissions:
id-token: write
contents: read
actions: read
security-events: write
jobs:
test:
name: Test Code
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v4
- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: '20'
cache: 'npm'
cache-dependency-path: 'cdk/package-lock.json'
- name: Setup Go
uses: actions/setup-go@v4
with:
go-version: '1.22'
cache-dependency-path: 'lambda/go.sum'
- name: Install CDK dependencies
run: |
cd cdk
npm ci
- name: Install Go dependencies
run: |
cd lambda
go mod download
- name: Run Go tests
run: |
cd lambda
go test -v ./...
- name: Build CDK
run: |
cd cdk
npm run build
- name: CDK Synth
run: |
cd cdk
npx cdk synth
deploy:
name: Deploy to AWS
runs-on: ubuntu-latest
needs: test
if: github.ref == 'refs/heads/main' && github.event_name == 'push'
environment: production
steps:
- name: Checkout
uses: actions/checkout@v4
- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: '20'
cache: 'npm'
cache-dependency-path: 'cdk/package-lock.json'
- name: Setup Go
uses: actions/setup-go@v4
with:
go-version: '1.22'
cache-dependency-path: 'lambda/go.sum'
- name: Configure AWS Credentials
uses: aws-actions/configure-aws-credentials@v4
with:
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
aws-region: us-west-2
- name: Install CDK dependencies
run: |
cd cdk
npm ci
- name: Install Go dependencies
run: |
cd lambda
go mod download
- name: Build CDK
run: |
cd cdk
npm run build
- name: Bootstrap CDK
run: |
cd cdk
npx cdk bootstrap
- name: Deploy CDK Stack
run: |
cd cdk
npx cdk deploy --require-approval never --outputs-file outputs.json
- name: Get Function URL
id: function-url
run: |
cd cdk
if [ -f outputs.json ]; then
FUNCTION_URL=$(jq -r '.WristAgentStack.FunctionUrl // empty' outputs.json)
echo "function-url=$FUNCTION_URL" >> $GITHUB_OUTPUT
else
echo "function-url=" >> $GITHUB_OUTPUT
fi
- name: Comment Function URL
if: github.event_name == 'pull_request' && steps.function-url.outputs.function-url != ''
uses: actions/github-script@v7
with:
script: |
github.rest.issues.createComment({
issue_number: context.issue.number,
owner: context.repo.owner,
repo: context.repo.repo,
body: '🚀 **Deployment Complete**\n\nFunction URL: `${{ steps.function-url.outputs.function-url }}`'
})
security-scan:
name: Security Scan
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v4
- name: Run Trivy vulnerability scanner
uses: aquasecurity/trivy-action@master
with:
scan-type: 'fs'
scan-ref: '.'
format: 'sarif'
output: 'trivy-results.sarif'
- name: Upload Trivy scan results
uses: github/codeql-action/upload-sarif@v3
with:
sarif_file: 'trivy-results.sarif'