Portfolio/.github/workflows/deploy.yml at main · SeturamanKumar/Portfolio · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
---
name: Deploy Portfolio to AWS

on:
  push:
    branches:
      - main

permissions:
  id-token: write
  contents: read

env:
  AWS_REGION: ap-south-1
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true

jobs:
  # Checks for changes in directories, always run hoga
  changes:
    name: Detect changes
    runs-on: ubuntu-latest

    outputs:
      infrastructure: ${{ steps.filter.outputs.infrastructure }}
      lambda: ${{ steps.filter.outputs.lambda }}
      frontend: ${{ steps.filter.outputs.frontend }}

    steps:
      - name: Checkout code
        uses: actions/checkout@v5

      - name: Detect changed directories
        uses: dorny/paths-filter@v4
        id: filter
        with:
          filters: |
            infrastructure:
              - 'infrastructure/**'
            lambda:
              - 'lambda/**'
            frontend:
              - 'client/**'

  terraform:
    name: Provision Infrastructure
    runs-on: ubuntu-latest
    needs: changes
    if: needs.changes.outputs.infrastructure == 'true'

    steps:
      - name: Checkout code
        uses: actions/checkout@v5

      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ secrets.AWS_GITHUB_ACTIONS_ROLE_ARN }}
          aws-region: ${{ env.AWS_REGION }}

      - name: Setup terraform
        uses: hashicorp/setup-terraform@v3
        with:
          terraform_wrapper: false

      - name: Terraform Init
        working-directory: infrastructure
        run: terraform init

      - name: Terraform Format Check
        working-directory: infrastructure
        run: terraform fmt -check

      - name: Terraform Validate
        working-directory: infrastructure
        run: terraform validate

      - name: Terraform Plan
        working-directory: infrastructure
        run: |
          terraform plan -out=tfplan \
          -var="sender_email=${{ secrets.SENDER_EMAIL }}" \
          -var="recipient_email=${{ secrets.RECIPIENT_EMAIL }}" \
          -var="recaptcha_secret_key=${{ secrets.RECAPTCHA_SECRET_KEY }}" \
          -var="cloudflare_api_token=${{ secrets.CLOUDFLARE_API_TOKEN }}" \
          -var="cloudflare_zone_id=${{ secrets.CLOUDFLARE_ZONE_ID }}" \
          -var="aws_account_id=${{ secrets.AWS_ACCOUNT_ID }}" \
          -var="github_repo=SeturamanKumar/Portfolio"

      - name: Terraform Apply
        working-directory: infrastructure
        run: terraform apply -auto-approve tfplan

  deploy-lambda:
    name: Deploy Lambda Function
    runs-on: ubuntu-latest
    needs: [changes, terraform]
    if: |
      always() && needs.changes.outputs.lambda == 'true' && (needs.terraform.result == 'success' || needs.terraform.result == 'skipped')

    steps:
      - name: Checkout code
        uses: actions/checkout@v5

      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ secrets.AWS_GITHUB_ACTIONS_ROLE_ARN }}
          aws-region: ${{ env.AWS_REGION }}

      - name: Package Lambda Function
        run: |
          pip install -r lambda/requirements.txt -t lambda/package/ --quiet
          cp lambda/handler.py lambda/package/
          cd lambda/package && zip -r ../../lambda.zip .

      - name: Deploy Lambda Function
        run: |
          aws lambda update-function-code \
            --function-name ${{ secrets.LAMBDA_FUNCTION_NAME }} \
            --zip-file fileb://lambda.zip
          aws lambda wait function-updated \
            --function-name ${{ secrets.LAMBDA_FUNCTION_NAME }}

  deploy-frontend:
    name: Build and Deploy Frontend
    runs-on: ubuntu-latest
    needs: [changes, terraform, deploy-lambda]
    if: |
      always() && needs.changes.outputs.frontend == 'true' && (needs.terraform.result == 'success' || needs.terraform.result == 'skipped') && (needs.deploy-lambda.result == 'success' || needs.deploy-lambda.result == 'skipped')

    steps:
      - name: Checkout code
        uses: actions/checkout@v5

      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ secrets.AWS_GITHUB_ACTIONS_ROLE_ARN }}
          aws-region: ${{ env.AWS_REGION }}

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: "20"

      - name: Install Dependencies
        working-directory: client
        run: npm ci

      - name: Build Next.js static export
        working-directory: client
        env:
          NEXT_PUBLIC_API_URL: ${{ secrets.NEXT_PUBLIC_API_URL }}
          NEXT_PUBLIC_RECAPTCHA_SITE_KEY: ${{ secrets.NEXT_PUBLIC_RECAPTCHA_SITE_KEY }}
        run: npm run build

      - name: Sync to S3
        run: aws s3 sync client/out/ s3://${{ secrets.S3_BUCKET_NAME }}/ --delete

      - name: Invalidate Cloudfront Cache
        run: |
          aws cloudfront create-invalidation \
            --distribution-id ${{ secrets.CLOUDFRONT_DISTRIBUTION_ID }} \
            --paths "/*"