default.yaml

on:
  workflow_dispatch:
    inputs:
      force-rollback:
        type: boolean
        required: true
        default: false
        description: 'Force an immediate rollback'
  push:
    branches:
      - main
    tags-ignore:
      - '*'
  schedule:
    - cron: '30 7 * * 0'
permissions:
  id-token: write
  checks: write
  contents: write
jobs:
  cdk-deploy:
    environment: test
    runs-on: ubuntu-22.04
    steps:
      - name: force-rollback
        run: 'false'
        if: ${{ inputs.force-rollback }}
      - name: check-aws-account-id
        uses: actions/github-script@v7.0.1
        with:
          script: |
            if ("${{ vars.AWS_ACCOUNT_ID }}" == "") {
              core.setFailed("AWS_ACCOUNT_ID is unspecified")
            } else {
              core.info("AWS_ACCOUNT_ID is ${{ vars.AWS_ACCOUNT_ID }}")
            }
      - name: aws-assume-role
        uses: hertzsprung/binsley/actions/aws-assume-role@main
        with:
          account-id: ${{ vars.AWS_ACCOUNT_ID }}
      - name: npm-install-cdk
        run: npm install -g aws-cdk@2.117.0
      - name: checkout
        uses: actions/checkout@v4.1.1
      - name: setup-java
        uses: hertzsprung/binsley/actions/setup-java@main
      - name: cdk-permissions-broadening
        id: cdk-permissions-broadening
        run: cdk diff --security-only --fail Binsley > cdk-diff-security
        continue-on-error: true
      - name: cdk-diff-security
        id: cdk-diff-security
        uses: actions/upload-artifact@v4.0.0
        if: ${{ !cancelled() && steps.cdk-permissions-broadening.outcome == 'failure' }}
        with:
          name: cdk-diff-security
          path: cdk-diff-security
      - name: cdk-deploy
        run: cdk deploy --require-approval never Binsley
        if: ${{ !cancelled() && (steps.cdk-permissions-broadening.outcome == 'success' || steps.cdk-permissions-broadening.outcome == 'failure') }}
  test:
    uses: ./.github/workflows/test.yaml
    needs: cdk-deploy
    with:
      environment: test
  rollback:
    runs-on: ubuntu-22.04
    needs: [cdk-deploy, test]
    if: ${{ !cancelled() && contains(needs.*.result, 'failure') }}
    steps:
      - name: checkout
        uses: actions/checkout@v4.1.1
        with:
          fetch-depth: 2
      - name: rollback
        shell: bash
        run: |
          branch_name="rollback-$(printf '%(%Y-%m-%d_%H.%M.%S)T\n')"
          git branch $branch_name
          git checkout main
          git reset --hard HEAD~1
          git push origin main --force
          git push --upstream origin $branch_name