origin-actions/.github/workflows/deploy-node.yml at main · OriginAS/origin-actions · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
name: Deploy node application to varwww
on:
  workflow_call:
    inputs:
      securitygroup:
        required: true
        type: string
      file:
        required: true
        type: string
      server:
        required: true
        type: string
      instance:
        required: true
        type: string
      context:
        required: true
        type: string
      node-version:
        type: string
        default: '20.x'
      goals:
        type: string
        default: 'clean package'

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Set up node
        uses: actions/setup-node@v4
        with:
          node-version: ${{ inputs.node-version }}
      - name: Build with Node
        run: ${{ inputs.goals }}

      - name: Check for GitHub OIDC token
        id: oidc
        run: echo "available=$([ -n "${ACTIONS_ID_TOKEN_REQUEST_URL:-}" ] && echo true || echo false)" >> $GITHUB_OUTPUT
      - name: Configure AWS credentials (OIDC)
        if: steps.oidc.outputs.available == 'true'
        uses: aws-actions/configure-aws-credentials@e1253824e5c10ff9df46874f81ed3ec929e19cfd # v6.3.0
        with:
          role-to-assume: arn:aws:iam::835337142747:role/github-deploy
          role-session-name: ${{ github.event.repository.name || 'github-actions' }}
          aws-region: eu-north-1
      - name: Configure AWS credentials (access key, deprecated)
        if: steps.oidc.outputs.available != 'true'
        uses: aws-actions/configure-aws-credentials@e1253824e5c10ff9df46874f81ed3ec929e19cfd # v6.3.0
        with:
          aws-access-key-id: ${{ secrets.ACTIONS_AWS_ACCESS_KEY }}
          aws-secret-access-key: ${{ secrets.ACTIONS_AWS_ACCESS_SECRET }}
          aws-region: eu-north-1
      - name: Get runner IP address
        id: ip
        run: echo "ipv4=$(curl -4 -s https://checkip.amazonaws.com)" >> $GITHUB_OUTPUT
      - name: Whitelist runner IP address
        run: |
          aws ec2 authorize-security-group-ingress \
            --group-id ${{ inputs.securitygroup }} \
            --protocol tcp \
            --port 22 \
            --cidr ${{ steps.ip.outputs.ipv4 }}/32

      - name: Deploy to server
        run: |
          echo "${{ secrets.ACTIONS_SSH_PRIVATE_KEY }}" > private_key && chmod 600 private_key
          scp -o StrictHostKeyChecking=no -i private_key ${{ inputs.file }} actions@${{ inputs.server }}:work/${{ inputs.context }}.tar.gz || exit 1
          ssh -o StrictHostKeyChecking=no -i private_key actions@${{ inputs.server }} "~/deploy-webapp work/${{ inputs.context }}.tar.gz ${{ inputs.instance }}" || exit 1

      - name: Revoke runner IP address
        if: always() && steps.ip.outputs.ipv4 != ''
        run: |
          aws ec2 revoke-security-group-ingress \
            --group-id ${{ inputs.securitygroup }} \
            --protocol tcp \
            --port 22 \
            --cidr ${{ steps.ip.outputs.ipv4 }}/32