aegis/.github/workflows/deploy-lambda.yml at main · nandanadileep/aegis · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
name: Deploy backend to Lambda

on:
  push:
    branches: [main]
    paths:
      - 'app.py'
      - 'wsgi.py'
      - 'scripts/**'
      - 'requirements.txt'
      - 'zappa_settings.json'
      - '.github/workflows/deploy-lambda.yml'
  workflow_dispatch:

permissions:
  id-token: write
  contents: read

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.12'

      - name: Install dependencies
        run: |
          python -m venv .venv
          source .venv/bin/activate
          python -m pip install --upgrade pip
          pip install -r requirements.txt

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-region: ap-south-1
          role-to-assume: arn:aws:iam::277707124741:role/GitHubActionsDeployRole
          role-session-name: github-actions

      - name: Verify AWS identity
        run: aws sts get-caller-identity

      - name: Deploy with Zappa
        run: |
          source .venv/bin/activate
          zappa update dev

      - name: Configure Lambda secrets
        env:
          NEO4J_DATABASE: \${{ secrets.NEO4J_DATABASE }}
          NEO4J_URI: \${{ secrets.NEO4J_URI }}
          NEO4J_USER: \${{ secrets.NEO4J_USER }}
          NEO4J_PASSWORD: \${{ secrets.NEO4J_PASSWORD }}
          SUPABASE_URL: \${{ secrets.SUPABASE_URL }}
          SUPABASE_ANON_KEY: \${{ secrets.SUPABASE_ANON_KEY }}
          ENCRYPTION_SECRET: \${{ secrets.ENCRYPTION_SECRET }}
          GROQ_API_KEY: \${{ secrets.GROQ_API_KEY }}
          REDIS_URL: \${{ secrets.REDIS_URL }}
        run: |
          if [ -z "$NEO4J_URI" ]; then
            echo "::warning::NEO4J_URI GitHub secret not set \u2014 add secrets or configure Lambda env in AWS console"
            exit 0
          fi
          python << 'PY'
          import json, os, subprocess
          base = {
              "PERSON_ID": "nandana_dileep",
              "LLM_MODEL": "groq/llama-3.3-70b-versatile",
              "LLM_FAST": "groq/qwen3-32b",
              "DAILY_MSG_LIMIT": "30",
              "LITELLM_LOG": "WARNING",
              "ALLOWED_ORIGINS": "https://identiti.nandanadileep.com,https://www.identiti.nandanadileep.com,https://infiniti-ochre.vercel.app,http://localhost:5173,http://localhost:3000",
          }
          for key in (
              "NEO4J_DATABASE", "NEO4J_URI", "NEO4J_USER", "NEO4J_PASSWORD",
              "SUPABASE_URL", "SUPABASE_ANON_KEY", "ENCRYPTION_SECRET",
              "GROQ_API_KEY", "REDIS_URL",
          ):
              val = os.getenv(key, "")
              if val:
                  base[key] = val
          payload = json.dumps({"Variables": base})
          subprocess.run(
              ["aws", "lambda", "update-function-configuration",
               "--function-name", "aegis-api-dev",
               "--environment", payload],
              check=True,
          )
          print("Lambda environment updated.")
          PY