ECS deploy CI (+ revert)

deploy-production.yml

name: deploy-production

concurrency:
  group: ${{ github.workflow }}
  cancel-in-progress: true

on:
  workflow_dispatch:

jobs:

  backup-tag:
    uses: d7oss/open-ops/.github/workflows/retag-ecr-image.yml@1.5.5
    with:
      aws_region: us-east-2
      repository_name: acme-be
      from_tag: production
      to_tag: production-minus-1
    secrets:
      aws_access_key_id: ${{ secrets.AWS_ACCESS_KEY_ID }}
      aws_secret_access_key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}

  promote-tag:
    uses: d7oss/open-ops/.github/workflows/retag-ecr-image.yml@1.5.5
    with:
      aws_region: us-east-2
      repository_name: acme-be
      from_tag: main
      to_tag: production
    secrets:
      aws_access_key_id: ${{ secrets.AWS_ACCESS_KEY_ID }}
      aws_secret_access_key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}

  deploy:
    needs: [promote-tag]
    uses: d7oss/open-ops/.github/workflows/deploy-ecs.yml@1.5.5
    with:
      aws_region: us-east-2
      environment: production
      ecs_cluster_name: production-acme-be
      ecs_services: |  # See services list in .infra/production/app.tf
        web
        worker
      pre_script: |
        export CLUSTER_NAME=production-acme-be
        export SERVICE_NAME=web
        export CONTAINER_NAME=uwsgi
        bin/run-ecs python manage.py migrate --noinput
        bin/run-ecs python manage.py collectstatic --noinput
    secrets:
      aws_access_key_id: ${{ secrets.AWS_ACCESS_KEY_ID }}
      aws_secret_access_key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}

deploy-staging.yml

name: deploy-staging

concurrency:
  group: ${{ github.workflow }}
  cancel-in-progress: true

on:
  push:
    branches: [main]
  workflow_dispatch:

jobs:
  test:
    uses: ./.github/workflows/_test.yml
    with:
      checks: migrations

  build-push-app:
    needs: [test]
    uses: d7oss/open-ops/.github/workflows/build-push-ecr.yml@1.5.5
    with:
      aws_region: us-east-2
      ecr_repository_name: acme-be
      docker_tag: main
      dockerfile: Dockerfile
    secrets:
      aws_access_key_id: ${{ secrets.AWS_ACCESS_KEY_ID }}
      aws_secret_access_key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}

  deploy:
    needs: [build-push-app]
    uses: d7oss/open-ops/.github/workflows/deploy-ecs.yml@1.5.5
    with:
      aws_region: us-east-2
      environment: staging
      ecs_cluster_name: staging-acme-be
      ecs_services: |  # See services list in .infra/staging/app.tf
        api
        worker
      pre_script: |
        export CLUSTER_NAME=staging-acme-be
        export SERVICE_NAME=api
        export CONTAINER_NAME=uwsgi
        bin/run-ecs python manage.py migrate --noinput
        bin/run-ecs python manage.py collectstatic --noinput
    secrets:
      aws_access_key_id: ${{ secrets.AWS_ACCESS_KEY_ID }}
      aws_secret_access_key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}

revert-production.yml

name: revert-production

concurrency:
  group: ${{ github.workflow }}
  cancel-in-progress: true

on:
  workflow_dispatch:

jobs:

  revert-tag:
    uses: d7oss/open-ops/.github/workflows/retag-ecr-image.yml@1.5.5
    with:
      aws_region: us-east-2
      repository_name: acme-be
      from_tag: production-minus-1
      to_tag: production
    secrets:
      aws_access_key_id: ${{ secrets.AWS_ACCESS_KEY_ID }}
      aws_secret_access_key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}

  deploy:
    needs:
      - revert-tag
    uses: d7oss/open-ops/.github/workflows/deploy-ecs.yml@1.5.5
    with:
      aws_region: us-east-2
      environment: production
      ecs_cluster_name: production-acme-be
      ecs_services: |  # See services list in .infra/production/app.tf
        web
        worker
      pre_script:  # DO NOT EVER RUN MIGRATIONS BACKWARDS AUTOMATICALLY WHEN REVERTING
        export CLUSTER_NAME=production-acme-be
        export SERVICE_NAME=web
        export CONTAINER_NAME=uwsgi
        bin/run-ecs python manage.py collectstatic --noinput
    secrets:
      aws_access_key_id: ${{ secrets.AWS_ACCESS_KEY_ID }}
      aws_secret_access_key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}