deploy.yml

name: Deploy

on:
  push:
    branches: ["main"]

permissions:
  id-token: write
  contents: read

env:
  AWS_REGION: us-east-1
  ECR_REPOSITORY: ssdlc-demo
  IMAGE_TAG: ${{ github.sha }}

jobs:
  build-scan-push:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v6
        with:
          python-version: "3.11"
      - name: Login to Amazon ECR
        uses: aws-actions/amazon-ecr-login@v2
      - name: Build Docker image
        run: |
          docker build -t $ECR_REPOSITORY:$IMAGE_TAG .
      - name: Trivy scan
        uses: aquasecurity/trivy-action@0.24.0
        with:
          image-ref: ${{ env.ECR_REPOSITORY }}:${{ env.IMAGE_TAG }}
          format: 'table'
          exit-code: '1'
          ignore-unfixed: true
          vuln-type: 'os,library'
      - name: Tag image with ECR registry
        id: ecr
        run: |
          ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)
          echo "account_id=$ACCOUNT_ID" >> $GITHUB_OUTPUT
          docker tag $ECR_REPOSITORY:$IMAGE_TAG $ACCOUNT_ID.dkr.ecr.$AWS_REGION.amazonaws.com/$ECR_REPOSITORY:$IMAGE_TAG
      - name: Push to ECR
        run: |
          docker push ${{ steps.ecr.outputs.account_id }}.dkr.ecr.$AWS_REGION.amazonaws.com/$ECR_REPOSITORY:$IMAGE_TAG

  terraform-apply:
    needs: build-scan-push
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: infra
    steps:
      - uses: actions/checkout@v4
      # - name: Configure AWS credentials
      #   uses: aws-actions/configure-aws-credentials@v4
      #   with:
      #     role-to-assume: ${{ secrets.AWS_ROLE_TO_ASSUME }}
      #     aws-region: ${{ env.AWS_REGION }}
      - name: Setup Terraform
        uses: hashicorp/setup-terraform@v3
        with:
          terraform_version: 1.8.5
      - name: Terraform Init
        run: terraform init -input=false
      - name: Terraform Validate
        run: terraform validate
      - name: Checkov IaC scan
        uses: bridgecrewio/checkov-action@v12
        with:
          directory: infra
          quiet: true
          framework: terraform
          download_external_modules: true
      - name: Terraform Plan
        run: terraform plan -input=false -out=tfplan
      # - name: Terraform Apply
      #   if: github.ref == 'refs/heads/main'
      #   run: terraform apply -input=false -auto-approve tfplan