Skip to content

Commit 7420ffa

Browse files
ruckerf22warp-agent
ruckerf22
and
warp-agent
committed
Add DevColor ECS Fargate and MariaDB infrastructure
Add account-guarded CDK stacks for ECR, private MariaDB, and ECS Fargate; secure development delivery and container health checks; target the dev branch workflow. Co-Authored-By: Warp <agent@warp.dev>
1 parent 3316e78 commit 7420ffa

30 files changed

Lines changed: 2504 additions & 62 deletions

‎.dockerignore‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
.git
2+
.github
3+
.env
4+
.env.*
5+
**/.env
6+
**/.env.*
7+
**/*.pem
8+
**/*.key
9+
**/*.p12
10+
**/*.pfx
11+
.aws
12+
**/.aws
13+
.ssh
14+
**/.ssh
15+
**/credentials
16+
**/node_modules
17+
**/__pycache__
18+
**/*.py[cod]
19+
.venv
20+
venv
21+
ENV
22+
infra
23+
tests
24+
testscripts
25+
data
26+
*.xlsx
27+
*.csv
28+
database_schema.json

‎.github/workflows/docker-build.yml‎

Lines changed: 117 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -1,42 +1,126 @@
1-
name: Build and Deploy to ECR
1+
name: Validate and deploy development API
22

33
on:
44
push:
5-
branches: [ main, develop ]
5+
branches: [main, develop, dev]
66
pull_request:
7-
branches: [ main ]
7+
branches: [main, develop, dev]
8+
workflow_dispatch:
9+
10+
permissions:
11+
contents: read
812

913
jobs:
10-
build-and-deploy:
14+
validate:
1115
runs-on: ubuntu-latest
12-
16+
timeout-minutes: 20
1317
steps:
14-
- name: Checkout code
15-
uses: actions/checkout@v4
16-
17-
- name: Configure AWS credentials
18-
uses: aws-actions/configure-aws-credentials@v4
19-
with:
20-
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
21-
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
22-
aws-region: us-west-2
23-
24-
- name: Login to Amazon ECR
25-
id: login-ecr
26-
uses: aws-actions/amazon-ecr-login@v2
18+
- uses: actions/checkout@v4
19+
- uses: actions/setup-python@v5
20+
with:
21+
python-version: '3.11'
22+
cache: pip
23+
cache-dependency-path: |
24+
requirements.txt
25+
requirements-dev.txt
26+
- name: Test API health without database access
27+
run: |
28+
python -m pip install -r requirements-dev.txt
29+
python -m unittest discover -s tests -v
30+
- uses: actions/setup-node@v4
31+
with:
32+
node-version: '24'
33+
cache: npm
34+
cache-dependency-path: infra/package-lock.json
35+
- name: Compile and test synthesized infrastructure and workflow
36+
working-directory: infra
37+
run: |
38+
npm ci
39+
npm test
40+
- name: Build container without publishing
41+
run: docker build --platform linux/amd64 -f docker/Dockerfile -t schools-api:validation .
2742

28-
- name: Set up Docker Buildx
29-
uses: docker/setup-buildx-action@v3
30-
31-
- name: Build, tag, and push image to Amazon ECR
32-
env:
33-
ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
34-
ECR_REPOSITORY: devcolor00-school
35-
run: |
36-
docker build -f docker/Dockerfile -t $ECR_REGISTRY/$ECR_REPOSITORY:latest .
37-
docker push $ECR_REGISTRY/$ECR_REPOSITORY:latest
38-
39-
# - name: Deploy to App Runner
40-
# if: github.ref == 'refs/heads/main'
41-
# run: |
42-
# aws apprunner start-deployment --service-arn ${{ secrets.APPRUNNER_SERVICE_ARN }}
43+
deploy-development:
44+
needs: validate
45+
if: >-
46+
github.event_name != 'pull_request' &&
47+
(github.ref == 'refs/heads/dev' || github.ref == 'refs/heads/develop') &&
48+
vars.ENABLE_DEV_DEPLOY == 'true'
49+
runs-on: ubuntu-latest
50+
timeout-minutes: 30
51+
environment: development
52+
concurrency:
53+
group: schools-api-development
54+
cancel-in-progress: false
55+
permissions:
56+
contents: read
57+
id-token: write
58+
env:
59+
AWS_REGION: us-west-2
60+
ECR_REPOSITORY: devcolor00-school
61+
ECS_CLUSTER: ${{ vars.ECS_CLUSTER }}
62+
ECS_SERVICE: ${{ vars.ECS_SERVICE }}
63+
ECS_CONTAINER_NAME: api
64+
steps:
65+
- uses: actions/checkout@v4
66+
- name: Validate deployment configuration
67+
env:
68+
AWS_DEPLOY_ROLE_ARN: ${{ vars.AWS_DEPLOY_ROLE_ARN }}
69+
run: |
70+
test -n "$AWS_DEPLOY_ROLE_ARN"
71+
test -n "$ECS_CLUSTER"
72+
test -n "$ECS_SERVICE"
73+
- name: Assume scoped GitHub OIDC role
74+
uses: aws-actions/configure-aws-credentials@v4
75+
with:
76+
role-to-assume: ${{ vars.AWS_DEPLOY_ROLE_ARN }}
77+
aws-region: ${{ env.AWS_REGION }}
78+
allowed-account-ids: '775398469131'
79+
- name: Login to Amazon ECR
80+
id: login-ecr
81+
uses: aws-actions/amazon-ecr-login@v2
82+
- name: Build and publish commit image
83+
id: image
84+
env:
85+
ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
86+
run: |
87+
IMAGE="$ECR_REGISTRY/$ECR_REPOSITORY:$GITHUB_SHA"
88+
DIGEST=$(aws ecr list-images --repository-name "$ECR_REPOSITORY" --filter tagStatus=TAGGED \
89+
--query "imageIds[?imageTag=='$GITHUB_SHA'].imageDigest | [0]" --output text)
90+
if [ "$DIGEST" = "None" ]; then
91+
docker build --platform linux/amd64 -f docker/Dockerfile -t "$IMAGE" .
92+
docker push "$IMAGE"
93+
DIGEST=$(aws ecr describe-images --repository-name "$ECR_REPOSITORY" \
94+
--image-ids imageTag="$GITHUB_SHA" --query 'imageDetails[0].imageDigest' --output text)
95+
fi
96+
test "$DIGEST" != "None"
97+
echo "uri=$ECR_REGISTRY/$ECR_REPOSITORY@$DIGEST" >> "$GITHUB_OUTPUT"
98+
- name: Read current task definition
99+
run: |
100+
TASK_DEFINITION=$(aws ecs describe-services --cluster "$ECS_CLUSTER" \
101+
--services "$ECS_SERVICE" --query 'services[0].taskDefinition' --output text)
102+
test "$TASK_DEFINITION" != "None"
103+
aws ecs describe-task-definition --task-definition "$TASK_DEFINITION" \
104+
--query taskDefinition > task-definition.json
105+
- name: Render task definition with new image
106+
id: render
107+
uses: aws-actions/amazon-ecs-render-task-definition@v1
108+
with:
109+
task-definition: task-definition.json
110+
container-name: ${{ env.ECS_CONTAINER_NAME }}
111+
image: ${{ steps.image.outputs.uri }}
112+
- name: Deploy and wait for service stability
113+
id: deploy
114+
uses: aws-actions/amazon-ecs-deploy-task-definition@v2
115+
with:
116+
task-definition: ${{ steps.render.outputs.task-definition }}
117+
cluster: ${{ env.ECS_CLUSTER }}
118+
service: ${{ env.ECS_SERVICE }}
119+
wait-for-service-stability: true
120+
- name: Verify ECS did not roll back
121+
env:
122+
EXPECTED_TASK_DEFINITION: ${{ steps.deploy.outputs.task-definition-arn }}
123+
run: |
124+
ACTIVE=$(aws ecs describe-services --cluster "$ECS_CLUSTER" \
125+
--services "$ECS_SERVICE" --query 'services[0].taskDefinition' --output text)
126+
test "$ACTIVE" = "$EXPECTED_TASK_DEFINITION"

‎.gitignore‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,7 @@ wheels/
2626

2727
# Virtual Environment
2828
venv/
29+
.venv/
2930
ENV/
3031

3132
# IDE specific files
@@ -36,6 +37,19 @@ ENV/
3637

3738
# Environment variables
3839
.env
40+
.env.*
41+
!.env.example
42+
43+
# CDK / Node build output and local deployment configuration
44+
!infra/lib/
45+
!infra/lib/**
46+
node_modules/
47+
infra/dist/
48+
infra/cdk.out/
49+
infra/cdk.context.json
50+
infra/config.dev.json
51+
infra/config.database.json
52+
infra/config.registry.json
3953

4054
# Database files
4155
*.db

0 commit comments

Comments
 (0)