Sync .github with platforms latest patterns

.github/actions/setup-terraform

@@ -0,0 +1,17 @@
+name: "Set up Terraform"
+description: "Set up Terraform with the version stored in the .terraform-version file"
+runs:
+  using: "composite"
+  steps:
+    - name: Get .terraform-version
+      id: get-terraform-version
+      run: |
+        terraform_version="$(cat .terraform-version)"
+        echo "Terraform version: ${terraform_version}"
+        echo "terraform_version=${terraform_version}" >> "$GITHUB_OUTPUT"
+      shell: bash
+    - name: Set up Terraform
+      uses: hashicorp/setup-terraform@v2
+      with:
+        terraform_version: ${{ steps.get-terraform-version.outputs.terraform_version }}
+        terraform_wrapper: false

.github/workflows/build-and-publish.yml

@@ -1,5 +1,5 @@
-name: Build and Publish
-run-name: Build and Publish ${{ inputs.ref }} to ${{ inputs.app_name }} ${{ inputs.environment || (github.event_name == 'release' && 'prod') || 'nonprod' }}
+name: Build and publish
+run-name: Build and publish ${{ inputs.app_name }}:${{ inputs.ref }}
 
 on:
   workflow_call:
@@ -12,11 +12,10 @@ on:
         description: The branch, tag or SHA to checkout. When checking out the repository that triggered a workflow, this defaults to the reference or SHA for that event. Otherwise, use branch or tag that triggered the workflow run.
         required: true
         type: string
-      environment:
-        description: "The environment where the build will be deployed. eg. dev or prod. Will default to dev."
-        default: dev
-        required: false
-        type: string
+    outputs:
+      commit_hash:
+        description: The SHA that was built
+        value: ${{ jobs.get-commit-hash.outputs.commit_hash }}
   workflow_dispatch:
     inputs:
       app_name:
@@ -27,27 +26,40 @@ on:
         description: The branch, tag or SHA to checkout. When checking out the repository that triggered a workflow, this defaults to the reference or SHA for that event. Otherwise, use branch or tag that triggered the workflow run.
         required: true
         type: string
-      environment:
-        description: "The environment where the build will be deployed. eg. dev or prod. Will default to dev."
-        default: dev
-        required: false
-        type: string
 
 jobs:
+  get-commit-hash:
+    name: Get commit hash
+    runs-on: ubuntu-22.04
+    outputs:
+      commit_hash: ${{ steps.get-commit-hash.outputs.commit_hash }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.ref }}
+      - name: Get commit hash
+        id: get-commit-hash
+        run: |
+          COMMIT_HASH=$(git rev-parse ${{ inputs.ref }})
+          echo "Commit hash: $COMMIT_HASH"
+          echo "commit_hash=$COMMIT_HASH" >> "$GITHUB_OUTPUT"
   build-and-publish:
     name: Build and publish
     runs-on: ubuntu-22.04
+    needs: get-commit-hash
+    concurrency: ${{ github.workflow }}-${{ needs.get-commit-hash.outputs.commit_hash }}
 
     permissions:
       contents: read
       id-token: write
 
     steps:
       - uses: actions/checkout@v4
-      - uses: hashicorp/setup-terraform@v3
         with:
-          terraform_version: 1.9.7
-          terraform_wrapper: false
+          ref: ${{ inputs.ref }}
+
+      - name: Set up Terraform
+        uses: ./.github/actions/setup-terraform
 
       - name: Configure AWS credentials
         uses: ./.github/actions/configure-aws-credentials
@@ -58,7 +70,7 @@ jobs:
       - name: Check if image is already published
         id: check-image-published
         run: |
-          is_image_published=$(./bin/is-image-published "${{ inputs.app_name }}" "${{ inputs.ref }}")
+          is_image_published=$(./bin/is-image-published "${{ inputs.app_name }}" "${{ needs.get-commit-hash.outputs.commit_hash }}")
           echo "Is image published: $is_image_published"
           echo "is_image_published=$is_image_published" >> "$GITHUB_OUTPUT"
 

.github/workflows/database-migrations.yml

@@ -1,5 +1,4 @@
-name: Database Migrations
-run-name: Database Migrations ${{ github.ref_name }} to ${{ inputs.app_name }} ${{ inputs.environment || (github.event_name == 'release' && 'prod') || 'nonprod' }}
+name: Database migrations
 
 on:
   workflow_call:
@@ -12,24 +11,38 @@ on:
         description: "the name of the application environment (e.g. dev, staging, prod)"
         required: true
         type: string
+      version:
+        description: "git reference to deploy (e.g., a branch, tag, or commit SHA)"
+        required: true
+        type: string
+    outputs:
+      commit_hash:
+        description: The SHA that was used for migrations
+        value: ${{ jobs.build-and-publish.outputs.commit_hash }}
 
-concurrency: database-migrations-${{ inputs.environment }}
+concurrency: database-migrations-${{ inputs.app_name }}-${{ inputs.environment }}
 
 jobs:
+  build-and-publish:
+    name: Build
+    uses: ./.github/workflows/build-and-publish.yml
+    with:
+      app_name: ${{ inputs.app_name }}
+      ref: ${{ inputs.version }}
   run-migrations:
     name: Run migrations
     runs-on: ubuntu-22.04
+    needs: [build-and-publish]
 
     permissions:
       contents: read
       id-token: write
 
     steps:
       - uses: actions/checkout@v4
-      - uses: hashicorp/setup-terraform@v3
-        with:
-          terraform_version: 1.9.7
-          terraform_wrapper: false
+
+      - name: Set up Terraform
+        uses: ./.github/actions/setup-terraform
 
       - name: Configure AWS credentials
         uses: ./.github/actions/configure-aws-credentials
@@ -39,4 +52,4 @@ jobs:
 
       - name: Run migrations
         run: |
-          make release-run-database-migrations APP_NAME=${{ inputs.app_name }} ENVIRONMENT=${{ inputs.environment }}
+          make release-run-database-migrations APP_NAME=${{ inputs.app_name }} ENVIRONMENT=${{ inputs.environment }} IMAGE_TAG=${{ needs.build-and-publish.outputs.commit_hash }}

.github/workflows/deploy.yml

@@ -1,5 +1,4 @@
-name: Chained Deploy
-run-name: Chained Deploy Layer for ${{ github.ref_name }} to ${{ inputs.app_name }} ${{ inputs.environment || (github.event_name == 'release' && 'prod') || 'nonprod' }}
+name: Deploy
 
 on:
   workflow_call:
@@ -12,25 +11,27 @@ on:
         description: "the name of the application environment (e.g. dev, staging, prod)"
         required: true
         type: string
+      version:
+        description: "git reference to deploy (e.g., a branch, tag, or commit SHA)"
+        required: true
+        type: string
+    outputs:
+      commit_hash:
+        description: The SHA that was deployed
+        value: ${{ jobs.database-migrations.outputs.commit_hash }}
 
 concurrency: cd-${{inputs.app_name}}-${{ inputs.environment }}
 
 jobs:
-  build-and-publish:
-    name: Build
-    uses: ./.github/workflows/build-and-publish.yml
-    with:
-      app_name: ${{ inputs.app_name }}
-      ref: ${{ github.ref }}
-
+  # Don't need to call the build-and-publish workflow since the database-migrations
+  # workflow already calls it
   database-migrations:
     name: Database migrations
     uses: ./.github/workflows/database-migrations.yml
-    needs: [build-and-publish]
     with:
       app_name: ${{ inputs.app_name }}
       environment: ${{ inputs.environment }}
-
+      version: ${{ inputs.version }}
   deploy:
     name: Deploy
     runs-on: ubuntu-22.04
@@ -40,10 +41,9 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@v4
-      - uses: hashicorp/setup-terraform@v3
-        with:
-          terraform_version: 1.9.7
-          terraform_wrapper: false
+
+      - name: Set up Terraform
+        uses: ./.github/actions/setup-terraform
 
       - name: Configure AWS credentials
         uses: ./.github/actions/configure-aws-credentials
@@ -52,6 +52,4 @@ jobs:
           environment: ${{ inputs.environment }}
 
       - name: Deploy release
-        run: make release-deploy \
-          APP_NAME=${{ inputs.app_name }} \
-          ENVIRONMENT=${{ inputs.environment }}
+        run: make release-deploy APP_NAME=${{ inputs.app_name }} ENVIRONMENT=${{ inputs.environment }} IMAGE_TAG=${{ needs.database-migrations.outputs.commit_hash }}

.terraform-version

@@ -0,0 +1 @@
+1.9.7