Add public-samples/refunds-wyx7mz/.github/workflows/deploy-prod.yml

asharkov-briklabs · Mar 4, 2025 · 0c30bde · 0c30bde
1 parent abd8708
commit 0c30bde
Showing 1 changed file with 196 additions and 0 deletions.
diff --git a/.github/workflows/deploy-prod.yml b/.github/workflows/deploy-prod.yml
@@ -0,0 +1,196 @@
+name: Deploy to Production
+
+on:
+  release:
+    types: [published]
+    tags: ['v*']
+  workflow_dispatch:
+    inputs:
+      service:
+        description: 'Service to deploy (leave blank for all)'
+        required: false
+        type: string
+      version:
+        description: 'Version tag to deploy'
+        required: true
+        type: string
+
+env:
+  AWS_REGION: 'us-east-1'
+  ECR_REPOSITORY: 'refund-service'
+  ECS_CLUSTER: 'refund-service-prod'
+  TF_WORKING_DIR: 'infrastructure/terraform/environments/prod'
+
+jobs:
+  approval:
+    runs-on: ubuntu-latest
+    environment: production
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v3
+
+      - name: Display deployment summary
+        run: echo "Deploying version ${{ github.event.release.tag_name || github.event.inputs.version }} to production"
+
+      - name: Notify pending approval
+        uses: slackapi/[email protected]
+        with:
+          channel-id: ${{ secrets.SLACK_DEPLOY_CHANNEL }}
+          payload: '{"text":"Production deployment pending approval: ${{ github.event.release.tag_name || github.event.inputs.version }}"}'
+        env:
+          SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
+
+  deploy_infrastructure:
+    needs: approval
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v3
+
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@v2
+        with:
+          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          aws-region: ${{ env.AWS_REGION }}
+
+      - name: Setup Terraform
+        uses: hashicorp/setup-terraform@v2
+        with:
+          terraform_version: '1.5.x'
+
+      - name: Terraform Init
+        run: terraform init
+        working-directory: ${{ env.TF_WORKING_DIR }}
+
+      - name: Terraform Plan
+        run: terraform plan -out=tfplan
+        working-directory: ${{ env.TF_WORKING_DIR }}
+
+      - name: Terraform Apply
+        run: terraform apply -auto-approve tfplan
+        working-directory: ${{ env.TF_WORKING_DIR }}
+
+      - name: Output Terraform Variables
+        id: terraform-outputs
+        run: terraform output -json > terraform-outputs.json
+        working-directory: ${{ env.TF_WORKING_DIR }}
+
+  deploy_services:
+    needs: deploy_infrastructure
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        service: ['refund-api', 'refund-workers', 'refund-web']
+      fail-fast: false
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v3
+
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@v2
+        with:
+          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          aws-region: ${{ env.AWS_REGION }}
+
+      - name: Login to Amazon ECR
+        id: login-ecr
+        uses: aws-actions/amazon-ecr-login@v1
+
+      - name: Set image tag from release
+        run: echo "IMAGE_TAG=${{ github.event.release.tag_name }}" >> $GITHUB_ENV
+        if: github.event_name == 'release'
+
+      - name: Set image tag from input
+        run: echo "IMAGE_TAG=${{ github.event.inputs.version }}" >> $GITHUB_ENV
+        if: github.event_name == 'workflow_dispatch'
+
+      - name: Skip non-specified service
+        run: echo "Service ${{ matrix.service }} not selected for deployment, skipping"
+        if: github.event.inputs.service != '' && github.event.inputs.service != matrix.service
+
+      - name: Update Task Definition
+        id: task-def
+        run: |
+          aws ecs describe-task-definition --task-definition ${{ matrix.service }}-task --query taskDefinition > task-definition.json
+          python infrastructure/scripts/update_task_definition.py task-definition.json ${{ steps.login-ecr.outputs.registry }}/${{ env.ECR_REPOSITORY }}:${{ env.IMAGE_TAG }}
+          aws ecs register-task-definition --cli-input-json file://task-definition-updated.json
+        if: github.event.inputs.service == '' || github.event.inputs.service == matrix.service
+
+      - name: Deploy with Blue/Green Strategy
+        run: bash infrastructure/scripts/deploy.sh --environment prod --service ${{ matrix.service }} --tag ${{ env.IMAGE_TAG }} --canary
+        if: github.event.inputs.service == '' || github.event.inputs.service == matrix.service
+
+      - name: Monitor Deployment
+        run: python infrastructure/scripts/monitor_deployment.py --cluster ${{ env.ECS_CLUSTER }} --service ${{ matrix.service }}-service --timeout 1800 --error-threshold 1
+        if: github.event.inputs.service == '' || github.event.inputs.service == matrix.service
+
+  validation:
+    needs: deploy_services
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v3
+
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@v2
+        with:
+          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          aws-region: ${{ env.AWS_REGION }}
+
+      - name: Set up Python
+        uses: actions/setup-python@v4
+        with:
+          python-version: '3.11'
+
+      - name: Install test dependencies
+        run: pip install -r src/backend/tests/requirements.txt
+
+      - name: Run smoke tests
+        run: pytest src/backend/tests/smoke/ --env=prod -v
+
+      - name: Run integration tests
+        run: pytest src/backend/tests/validation/ --env=prod -v
+
+      - name: Verify service health
+        run: python infrastructure/scripts/verify_deployment.py --environment prod
+
+      - name: Generate validation report
+        run: python infrastructure/scripts/generate_validation_report.py --environment prod --version ${{ env.IMAGE_TAG }}
+
+  finalize:
+    needs: validation
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v3
+
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@v2
+        with:
+          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          aws-region: ${{ env.AWS_REGION }}
+
+      - name: Send DataDog deployment event
+        uses: datadog/actions@v1
+        with:
+          api_key: ${{ secrets.DATADOG_API_KEY }}
+          app_key: ${{ secrets.DATADOG_APP_KEY }}
+          create_deployment: 'true'
+          deployment_env: 'production'
+          deployment_service: 'refund-service'
+          deployment_version: '${{ env.IMAGE_TAG }}'
+
+      - name: Send Slack notification
+        uses: slackapi/[email protected]
+        with:
+          channel-id: ${{ secrets.SLACK_DEPLOY_CHANNEL }}
+          payload: '{"text":"✅ Production deployment of ${{ env.IMAGE_TAG }} completed successfully!"}'
+        env:
+          SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
+
+      - name: Tag production release
+        run: git tag prod-${{ env.IMAGE_TAG }}-$(date +'%Y%m%d%H%M%S') && git push --tags