update-web-service.yml

name: Update Web Service

on:
  workflow_call:
    inputs:
      aws-region:
        required: true
        type: string
      cluster:
        required: true
        type: string
      github-actions-role:
        required: true
        type: string
      images:
        description: 'A semicolon separated list of images to update'
        required: true
        type: string
      service:
        required: true
        type: string
      task-definition-family:
        required: true
        type: string

permissions:
  id-token: write
  contents: read

jobs:
  update-web-service:
    runs-on: ubuntu-22.04

    steps:
      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ inputs.github-actions-role }}
          aws-region: ${{ inputs.aws-region }}

      - name: Login to Amazon ECR
        id: ecr-login
        uses: aws-actions/amazon-ecr-login@v2

      - name: Download and clean task definition
        run: >
          aws ecs describe-task-definition --task-definition ${{ inputs.task-definition-family }} --query taskDefinition
          | jq -r 'del(.taskDefinitionArn, .requiresAttributes, .compatibilities, .revision, .status, .registeredAt, .registeredBy)'
          > task-definition.json

      - name: Render task definition
        run: |
          IFS=";" read -a IMAGES <<< "${{ inputs.images }}"
          for image in "${IMAGES[@]}"
          do
            FULL_IMAGE="${{ steps.ecr-login.outputs.registry }}/$image"
            REPOSITORY=${FULL_IMAGE%:*}
            jq ".containerDefinitions[] |= if (.image | startswith(\"$REPOSITORY\")) then (.image = \"$FULL_IMAGE\") else . end" task-definition.json > new-task-definition.json
            mv new-task-definition.json task-definition.json
          done

      - name: Deploy task definition
        uses: aws-actions/amazon-ecs-deploy-task-definition@v2
        with:
          task-definition: task-definition.json
          service: ${{ inputs.service }}
          cluster: ${{ inputs.cluster }}
          wait-for-service-stability: true