Deploy #28
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Deploy | |
| on: | |
| workflow_run: | |
| workflows: [Test] | |
| types: [completed] | |
| branches: [main] | |
| workflow_dispatch: | |
| permissions: | |
| id-token: write | |
| contents: read | |
| concurrency: | |
| group: dataqna-deploy | |
| cancel-in-progress: false | |
| jobs: | |
| deploy: | |
| if: github.event_name == 'workflow_dispatch' || github.event.workflow_run.conclusion == 'success' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| # The role trusts two subject claims: the plain one, and the ID-qualified | |
| # form GitHub sends while the org has immutable subject claims enabled | |
| # (repo:DataTalksClub@72699292/dataqna@1324938407:...). Listing both means | |
| # toggling that org setting does not break the deploy. | |
| - uses: aws-actions/configure-aws-credentials@v4 | |
| with: | |
| role-to-assume: arn:aws:iam::817685572750:role/dataqna-github-actions-deploy | |
| aws-region: eu-west-1 | |
| - uses: aws-actions/setup-sam@v2 | |
| with: | |
| use-installer: true | |
| - uses: astral-sh/setup-uv@v5 | |
| - name: Install dependencies | |
| run: uv sync | |
| # `make build`, not `sam build`: src/requirements.txt is generated from the | |
| # lockfile and gitignored, so building without it ships a Lambda with no | |
| # dependencies — which deploys cleanly and then 500s on every request. | |
| - name: Build | |
| run: make build | |
| - name: Deploy | |
| run: sam deploy --config-env sandbox --no-confirm-changeset --no-fail-on-empty-changeset | |
| # Fails the workflow if the deployed site is not actually working, rather | |
| # than reporting success because CloudFormation returned CREATE_COMPLETE. | |
| - name: Verify the deployment | |
| run: uv run python scripts/verify_deployment.py --base-url https://qna.dtcdev.click | |
| env: | |
| DATAQNA_KEY: ${{ secrets.DATAQNA_VERIFY_KEY }} |