deploy-template.yml

# Based on https://docs.github.com/en/actions/deployment/deploying-to-your-cloud-provider/deploying-to-amazon-elastic-container-service

name: aws ecs deploy template

on:
    workflow_call:
        inputs:
            service: # example: core
                required: true
                type: string
            proper-name: # example: blake
                required: true
                type: string
            environment: # example: staging
                required: true
                type: string
            repo-name-override:
                type: string
            image-tag-override: # example: latest, 7037e37a18a379d583164441baff9e594cc479f8
                type: string # use this to force a container version.
        secrets:
            AWS_ACCESS_KEY_ID:
                required: true
            AWS_SECRET_ACCESS_KEY:
                required: true
    workflow_dispatch:
        inputs:
            service: # example: core
                required: true
                type: string
            proper-name: # example: blake
                required: true
                type: string
            environment: # example: staging
                required: true
                type: string
            repo-name-override:
                type: string
            image-tag-override: # example: latest, 7037e37a18a379d583164441baff9e594cc479f8
                type: string # use this to force a container version.

env:
    AWS_REGION: us-east-1
    ECR_REPOSITORY_PREFIX: pubpub-v7
    ECR_REPOSITORY_NAME_OVERRIDE: ${{ inputs.repo-name-override }}
    ECS_SERVICE: ${{ inputs.proper-name }}-${{inputs.service}}
    ECS_CLUSTER: ${{inputs.proper-name}}-ecs-cluster-${{inputs.environment}}
    ECS_TASK_DEFINITION_TEMPLATE: ${{ inputs.proper-name }}-${{inputs.service}}
    CONTAINER_NAME: ${{inputs.service}}

jobs:
    deploy:
        name: Deploy
        runs-on: ubuntu-latest
        environment: ${{ inputs.proper-name }}-${{ inputs.environment }}

        steps:
            - name: Checkout
              uses: actions/checkout@v4

            - name: Configure AWS credentials
              uses: aws-actions/configure-aws-credentials@v4
              with:
                  role-to-assume: ${{ vars.IAM_ROLE_TO_ASSUME }}
                  aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
                  aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
                  aws-region: ${{ env.AWS_REGION }}

            - name: Get image tag based on SHA
              id: gettag
              env:
                  OVERRIDE: ${{inputs.image-tag-override}}
              # use shell substitution
              run: echo "tag=${OVERRIDE:-$(git describe --always --abbrev=40 --dirty)}" >> $GITHUB_OUTPUT

            - name: Login to Amazon ECR
              id: login-ecr
              uses: aws-actions/amazon-ecr-login@v2

            - name: Retrieve Task Definition contents from template
              id: get-taskdef
              run: |
                  aws ecs describe-task-definition \
                    --task-definition $ECS_TASK_DEFINITION_TEMPLATE \
                    --query taskDefinition >> template_task_def.json

            - name: Get image labels
              id: label
              env:
                  ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
                  IMAGE_TAG: ${{ steps.gettag.outputs.tag }}
              run: |
                  echo "label=$ECR_REGISTRY/${ECR_REPOSITORY_NAME_OVERRIDE:-$ECR_REPOSITORY_PREFIX-${CONTAINER_NAME}}:$IMAGE_TAG" >> $GITHUB_OUTPUT
                  echo "base_label=$ECR_REGISTRY/$ECR_REPOSITORY_PREFIX:$IMAGE_TAG" >> $GITHUB_OUTPUT

            - name: Fill in the new image ID in the Amazon ECS task definition
              id: task-def-service
              uses: aws-actions/amazon-ecs-render-task-definition@c804dfbdd57f713b6c079302a4c01db7017a36fc
              with:
                  task-definition: template_task_def.json
                  container-name: ${{ env.CONTAINER_NAME }}
                  image: ${{ steps.label.outputs.label }}

            # Complication when the number of containers in the task are unknown:
            # we have to know where to get the inputs for each step, including the upload
            # step.
            - name: Fill in the new image ID in the Amazon ECS task definition for migrations
              id: task-def-migration
              if: inputs.service == 'core'
              uses: aws-actions/amazon-ecs-render-task-definition@c804dfbdd57f713b6c079302a4c01db7017a36fc
              with:
                  task-definition: ${{ steps.task-def-service.outputs.task-definition }}
                  container-name: migrations
                  image: ${{ steps.label.outputs.base_label }}

            - name: Deploy Amazon ECS task definition
              id: deploy-service-only
              # This one is different. The single-image case is when not deploying core.
              if: inputs.service != 'core'
              uses: aws-actions/amazon-ecs-deploy-task-definition@16f052ed696e6e5bf88c208a8e5ba1af7ced3310
              with:
                  # it is because of this line that the two steps need different if conditions
                  task-definition: ${{ steps.task-def-service.outputs.task-definition }}
                  service: ${{ env.ECS_SERVICE }}
                  cluster: ${{ env.ECS_CLUSTER }}
                  wait-for-service-stability: true

            - name: Deploy Amazon ECS task definition including migrations
              id: deploy-service-and-migrations
              if: inputs.service == 'core'
              uses: aws-actions/amazon-ecs-deploy-task-definition@16f052ed696e6e5bf88c208a8e5ba1af7ced3310
              with:
                  # it is because of this line that the two steps need different if conditions
                  task-definition: ${{ steps.task-def-migration.outputs.task-definition }}
                  service: ${{ env.ECS_SERVICE }}
                  cluster: ${{ env.ECS_CLUSTER }}
                  wait-for-service-stability: true