deploy-stack-nextjs-example/.github/workflows/deploy.yml at main · anton-codes-iac/deploy-stack-nextjs-example · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
name: Deploy to AWS ECS

on:
  push:
    branches:
      - main
    schedule:
    - cron: '0 0 * * 0'

env:
  AWS_REGION: us-east-1
  ECR_REPOSITORY: deploy-stack-nextjs-example-repo
  ECS_CLUSTER: deploy-stack-nextjs-example-cluster
  ECS_SERVICE: deploy-stack-nextjs-example-service

permissions:
  id-token: write
  contents: read

jobs:
  deploy:
    name: Build & Deploy
    runs-on: ubuntu-latest

    steps:
      - name: Checkout Code
        uses: actions/checkout@v4

      # --- 1. IaC SECURITY SCAN ---
      - name: Scan Terraform for Misconfigurations
        uses: aquasecurity/trivy-action@master
        with:
          scan-type: 'fs'
          scan-ref: 'terraform/'
          scanners: 'vuln,secret,misconfig'
          format: 'table'
          exit-code: '0' # Informational only, will not break the build
          severity: 'CRITICAL,HIGH'
          output: 'trivy-iac-summary.txt'

      - name: Publish IaC Summary
        if: always()
        run: |
          if [ -f trivy-iac-summary.txt ]; then
            echo "### 🏗️ Terraform Misconfiguration Scan" >> $GITHUB_STEP_SUMMARY
            echo '```' >> $GITHUB_STEP_SUMMARY
            cat trivy-iac-summary.txt >> $GITHUB_STEP_SUMMARY
            echo '```' >> $GITHUB_STEP_SUMMARY
          fi

      # --- 2. INFRASTRUCTURE SYNC (The New Marketplace Action) ---
      - name: Apply Infrastructure Changes
        uses: anton-codes-iac/deploy-stack-action@v1
        with:
          aws-region: ${{ env.AWS_REGION }}
          role-to-assume: arn:aws:iam::710596603276:role/deploy-stack-nextjs-example-github-actions-role
          terraform-dir: 'terraform'

      # --- 3. BUILD & PUSH ---
      - name: Login to Amazon ECR
        id: login-ecr
        uses: aws-actions/amazon-ecr-login@v2

      - name: Build Docker image
        id: build-image
        env:
          ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
          IMAGE_TAG: latest
        run: |
          docker build -t $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG .

      # --- 4. CONTAINER SECURITY SCAN ---
      - name: Scan Container for Vulnerabilities (SARIF Output)
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: '${{ steps.login-ecr.outputs.registry }}/${{ env.ECR_REPOSITORY }}:latest'
          format: 'table'
          output: 'trivy-container-summary.txt'
          exit-code: '0' # Informational only, will not break the build
          ignore-unfixed: true
          vuln-type: 'os,library'
          severity: 'CRITICAL,HIGH'

      - name: Publish Container Summary
        if: always()
        run: |
          if [ -f trivy-container-summary.txt ]; then
            echo "### 🛡️ Container Security Scan Results" >> $GITHUB_STEP_SUMMARY
            echo '```' >> $GITHUB_STEP_SUMMARY
            cat trivy-container-summary.txt >> $GITHUB_STEP_SUMMARY
            echo '```' >> $GITHUB_STEP_SUMMARY
          fi

      # --- 5. DEPLOY ---
      - name: Push image to Amazon ECR
        env:
          ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
          IMAGE_TAG: latest
        run: |
          docker push $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG
          echo "image=$ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG" >> $GITHUB_OUTPUT

      - name: Force ECS deployment
        run: |
          aws ecs update-service \
            --cluster ${{ env.ECS_CLUSTER }} \
            --service ${{ env.ECS_SERVICE }} \
            --force-new-deployment \
            --region ${{ env.AWS_REGION }}