Skip to content

Commit 6cf4c8b

Browse files
lehorslehors
authored
Merge pull request #26 from gregcube/main
Improve workflows and add AWS integration.
2 parents 6ece587 + bb4b688 commit 6cf4c8b

File tree

5 files changed

+193
-75
lines changed

5 files changed

+193
-75
lines changed

‎.github/actions/authorize-ip/action.yml

+22
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
name: Authorize IP
2+
description: 'Add IP to AWS security group'
3+
4+
inputs:
5+
ip:
6+
description: 'IP address to authorize'
7+
required: true
8+
sgid:
9+
description: 'AWS security group id'
10+
required: true
11+
12+
runs:
13+
using: 'composite'
14+
steps:
15+
- name: Authorize IP address
16+
shell: bash
17+
run: |
18+
aws ec2 authorize-security-group-ingress \
19+
--group-id ${{ inputs.sgid }} \
20+
--protocol tcp \
21+
--port 22 \
22+
--cidr ${{ inputs.ip }}/32

‎.github/actions/revoke-ip/action.yml

+22
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
name: Revoke IP
2+
description: 'Revoke IP from AWS security group'
3+
4+
inputs:
5+
ip:
6+
description: 'IP address to revoke'
7+
required: true
8+
sgid:
9+
description: 'AWS security group id'
10+
required: true
11+
12+
runs:
13+
using: 'composite'
14+
steps:
15+
- name: Revoke IP address
16+
shell: bash
17+
run: |
18+
aws ec2 revoke-security-group-ingress \
19+
--group-id ${{ inputs.sgid }} \
20+
--protocol tcp \
21+
--port 22 \
22+
--cidr ${{ inputs.ip }}/32

‎.github/actions/setup-check/action.yml

+59
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
name: Setup check
2+
description: 'Check if required secrets and environments are configured'
3+
4+
inputs:
5+
deploy_host:
6+
description: 'Deploy host'
7+
required: true
8+
deploy_user:
9+
description: 'Deploy user'
10+
required: true
11+
deploy_path:
12+
description: 'Deploy path'
13+
required: true
14+
deploy_key:
15+
description: 'Deploy key'
16+
required: true
17+
18+
runs:
19+
using: 'composite'
20+
steps:
21+
- name: Check DEPLOY_HOST
22+
shell: bash
23+
env:
24+
INPUT_DEPLOY_HOST: ${{ inputs.deploy_host }}
25+
run: |
26+
if [ -z "${INPUT_DEPLOY_HOST}" ]; then
27+
echo "DEPLOY_HOST is not set."
28+
exit 1
29+
fi
30+
31+
- name: Check DEPLOY_USER
32+
shell: bash
33+
env:
34+
INPUT_DEPLOY_USER: ${{ inputs.deploy_user }}
35+
run: |
36+
if [ -z "${INPUT_DEPLOY_USER}" ]; then
37+
echo "DEPLOY_USER is not set."
38+
exit 1
39+
fi
40+
41+
- name: Check DEPLOY_PATH
42+
shell: bash
43+
env:
44+
INPUT_DEPLOY_PATH: ${{ inputs.DEPLOY_PATH }}
45+
run: |
46+
if [ -z "${INPUT_DEPLOY_PATH}" ]; then
47+
echo "DEPLOY_PATH is not set."
48+
exit 1
49+
fi
50+
51+
- name: Check DEPLOY_KEY
52+
shell: bash
53+
env:
54+
INPUT_DEPLOY_KEY: ${{ inputs.deploy_key }}
55+
run: |
56+
if [ -z "${INPUT_DEPLOY_KEY}" ]; then
57+
echo "DEPLOY_KEY is not set."
58+
exit 1
59+
fi

‎.github/workflows/deploy.yml

+46-38
Original file line numberDiff line numberDiff line change
@@ -15,62 +15,61 @@ on:
1515
default: 'Stage'
1616

1717
jobs:
18-
secrets-check:
18+
setup-check:
1919
runs-on: ubuntu-latest
2020
environment: ${{ inputs.environment || 'Production' }}
2121
steps:
22-
- name: Check DEPLOY_HOST
23-
env:
24-
DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }}
25-
run: |
26-
if [ -z "$DEPLOY_HOST" ]; then
27-
echo "DEPLOY_HOST is not set."
28-
exit 1
29-
fi
30-
31-
- name: Check DEPLOY_USER
32-
env:
33-
DEPLOY_USER: ${{ secrets.DEPLOY_USER }}
34-
run: |
35-
if [ -z "$DEPLOY_USER" ]; then
36-
echo "DEPLOY_USER is not set."
37-
exit 1
38-
fi
39-
40-
- name: Check DEPLOY_PATH
41-
env:
42-
DEPLOY_PATH: ${{ secrets.DEPLOY_PATH }}
43-
run: |
44-
if [ -z "$DEPLOY_PATH" ]; then
45-
echo "DEPLOY_PATH is not set."
46-
exit 1
47-
fi
22+
- name: Checkout code
23+
uses: actions/checkout@v4
4824

49-
- name: Check DEPLOY_KEY
50-
env:
51-
DEPLOY_KEY: ${{ secrets.DEPLOY_KEY }}
52-
run: |
53-
if [ -z "$DEPLOY_KEY" ]; then
54-
echo "DEPLOY_KEY is not set"
55-
exit 1
56-
fi
25+
- name: Check environment variables
26+
uses: ./.github/actions/setup-check
27+
with:
28+
deploy_host: ${{ secrets.DEPLOY_HOST }}
29+
deploy_user: ${{ secrets.DEPLOY_USER }}
30+
deploy_path: ${{ secrets.DEPLOY_PATH }}
31+
deploy_key: ${{ secrets.DEPLOY_KEY }}
5732

5833
deploy:
5934
runs-on: ubuntu-latest
60-
needs: secrets-check
35+
needs: setup-check
6136
environment: ${{ inputs.environment || 'Production' }}
62-
if: ${{ github.event.workflow_run.conclusion == 'success' ||
63-
github.event_name == 'workflow_dispatch' }}
37+
if: ${{ github.event.workflow_run.conclusion == 'success' || github.event_name == 'workflow_dispatch' }}
38+
39+
permissions:
40+
id-token: write
41+
contents: read
6442

6543
env:
6644
DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }}
6745
DEPLOY_USER: ${{ secrets.DEPLOY_USER }}
6846
DEPLOY_PATH: ${{ secrets.DEPLOY_PATH }}
47+
AWS_ENABLED: ${{ secrets.AWS_ACCOUNT != '' && secrets.AWS_REGION != '' && secrets.AWS_SECURITY_GROUP != '' }}
6948

7049
steps:
7150
- name: Checkout code
7251
uses: actions/checkout@v4
7352

53+
- name: Configure AWS credentials
54+
if: ${{ env.AWS_ENABLED == 'true' }}
55+
uses: aws-actions/configure-aws-credentials@v4
56+
with:
57+
aws-region: ${{ secrets.AWS_REGION }}
58+
role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCOUNT }}:role/MOT-SSH
59+
60+
- name: Get runners public IP address
61+
if: ${{ env.AWS_ENABLED == 'true' }}
62+
id: ip
63+
uses: haythem/[email protected]
64+
65+
- name: Authorize IP address
66+
if: ${{ env.AWS_ENABLED == 'true' }}
67+
id: auth-ip
68+
uses: ./.github/actions/authorize-ip
69+
with:
70+
ip: ${{ steps.ip.outputs.ipv4 }}
71+
sgid: ${{ secrets.AWS_SECURITY_GROUP }}
72+
7473
- name: Start ssh-agent and add key
7574
uses: webfactory/[email protected]
7675
with:
@@ -88,6 +87,8 @@ jobs:
8887
--exclude 'tests' \
8988
--exclude 'config' \
9089
--exclude 'models/' \
90+
--exclude 'web/sites/*/files' \
91+
--exclude 'web/libraries' \
9192
./ $DEPLOY_USER@$DEPLOY_HOST:$DEPLOY_PATH
9293
9394
- name: Post-deploy tasks
@@ -99,3 +100,10 @@ jobs:
99100
./vendor/bin/drush cr
100101
./vendor/bin/drush updb -y
101102
EOF
103+
104+
- name: Revoke IP address
105+
if: ${{ steps.auth-ip.outcome == 'success' }}
106+
uses: ./.github/actions/revoke-ip
107+
with:
108+
ip: ${{ steps.ip.outputs.ipv4 }}
109+
sgid: ${{ secrets.AWS_SECURITY_GROUP }}

‎.github/workflows/update_models.yml

+44-37
Original file line numberDiff line numberDiff line change
@@ -15,62 +15,62 @@ on:
1515
default: 'Stage'
1616

1717
jobs:
18-
secrets-check:
18+
setup-check:
1919
runs-on: ubuntu-latest
2020
environment: ${{ inputs.environment || 'Production' }}
2121
steps:
22-
- name: Check DEPLOY_HOST
23-
env:
24-
DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }}
25-
run: |
26-
if [ -z "$DEPLOY_HOST" ]; then
27-
echo "DEPLOY_HOST is not set."
28-
exit 1
29-
fi
30-
31-
- name: Check DEPLOY_USER
32-
env:
33-
DEPLOY_USER: ${{ secrets.DEPLOY_USER }}
34-
run: |
35-
if [ -z "$DEPLOY_USER" ]; then
36-
echo "DEPLOY_USER is not set."
37-
exit 1
38-
fi
39-
40-
- name: Check DEPLOY_PATH
41-
env:
42-
DEPLOY_PATH: ${{ secrets.DEPLOY_PATH }}
43-
run: |
44-
if [ -z "$DEPLOY_PATH" ]; then
45-
echo "DEPLOY_PATH is not set."
46-
exit 1
47-
fi
48-
49-
- name: Check DEPLOY_KEY
50-
env:
51-
DEPLOY_KEY: ${{ secrets.DEPLOY_KEY }}
52-
run: |
53-
if [ -z "$DEPLOY_KEY" ]; then
54-
echo "DEPLOY_KEY is not set"
55-
exit 1
56-
fi
22+
- name: Checkout code
23+
uses: actions/checkout@v4
24+
25+
- name: Check environment variables
26+
uses: ./.github/actions/setup-check
27+
with:
28+
deploy_host: ${{ secrets.DEPLOY_HOST }}
29+
deploy_user: ${{ secrets.DEPLOY_USER }}
30+
deploy_path: ${{ secrets.DEPLOY_PATH }}
31+
deploy_key: ${{ secrets.DEPLOY_KEY }}
5732

5833
update-models:
5934
runs-on: ubuntu-latest
60-
needs: secrets-check
35+
needs: setup-check
6136
environment: ${{ inputs.environment || 'Production' }}
6237

38+
permissions:
39+
id-token: write
40+
contents: read
41+
6342
env:
6443
DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }}
6544
DEPLOY_USER: ${{ secrets.DEPLOY_USER }}
6645
DEPLOY_PATH: ${{ secrets.DEPLOY_PATH }}
46+
AWS_ENABLED: ${{ secrets.AWS_ACCOUNT != '' && secrets.AWS_REGION != '' && secrets.AWS_SECURITY_GROUP != '' }}
6747

6848
steps:
6949
- name: Checkout code
7050
uses: actions/checkout@v4
7151
with:
7252
fetch-depth: 0
7353

54+
- name: Configure AWS credentials
55+
if: ${{ env.AWS_ENABLED == 'true' }}
56+
uses: aws-actions/configure-aws-credentials@v4
57+
with:
58+
aws-region: ${{ secrets.AWS_REGION }}
59+
role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCOUNT }}:role/MOT-SSH
60+
61+
- name: Get runners public IP address
62+
if: ${{ env.AWS_ENABLED == 'true' }}
63+
id: ip
64+
uses: haythem/[email protected]
65+
66+
- name: Authorize IP address
67+
if: ${{ env.AWS_ENABLED == 'true' }}
68+
id: auth-ip
69+
uses: ./.github/actions/authorize-ip
70+
with:
71+
ip: ${{ steps.ip.outputs.ipv4 }}
72+
sgid: ${{ secrets.AWS_SECURITY_GROUP }}
73+
7474
- name: Start ssh-agent and add key
7575
uses: webfactory/[email protected]
7676
with:
@@ -126,3 +126,10 @@ jobs:
126126
- name: No changes
127127
if: ${{ env.sync == 'false' }}
128128
run: echo "No model changes detected. Skipping"
129+
130+
- name: Revoke IP address
131+
if: ${{ steps.auth-ip.outcome == 'success' }}
132+
uses: ./.github/actions/revoke-ip
133+
with:
134+
ip: ${{ steps.ip.outputs.ipv4 }}
135+
sgid: ${{ secrets.AWS_SECURITY_GROUP }}

0 commit comments

Comments
 (0)