Release/0.63.0

.aws/deploy/appspec.json

@@ -0,0 +1,17 @@
+{
+  "version": 1,
+  "Resources": [
+    {
+      "TargetService": {
+        "Type": "AWS::ECS::Service",
+        "Properties": {
+          "TaskDefinition": "arn:aws:ecs:ap-southeast-1:<AWS_ACCOUNT_ID>:task-definition/isomer-<SHORTENV>-ecs:1",
+          "LoadBalancerInfo": {
+            "ContainerName": "backend",
+            "ContainerPort": 8081
+          }
+        }
+      }
+    }
+  ]
+}

.aws/deploy/backend-task-definition.prod.json

@@ -10,14 +10,17 @@
         }
       ],
       "essential": true,
-      "environment": [],
+      "environment": [{ "name": "ENV_TYPE", "value": "PROD" }],
       "mountPoints": [
         {
           "sourceVolume": "ggs-efs",
           "containerPath": "/efs",
           "readOnly": false
         }
       ],
+      "linuxParameters": {
+        "initProcessEnabled": true
+      },
       "volumesFrom": [],
       "secrets": [
         {
@@ -63,6 +66,10 @@
           "valueFrom": "PROD_FF_DEPRECATE_SITE_QUEUES"
         },
         { "name": "FRONTEND_URL", "valueFrom": "PROD_FRONTEND_URL" },
+        {
+          "name": "GGS_REPAIR_FORM_KEY",
+          "valueFrom": "PROD_GGS_REPAIR_FORM_KEY"
+        },
         {
           "name": "GGS_EXPERIMENTAL_TRACKING_SITES",
           "valueFrom": "PROD_GGS_EXPERIMENTAL_TRACKING_SITES"
@@ -113,6 +120,55 @@
         {
           "name": "POSTMAN_SMS_CRED_NAME",
           "valueFrom": "PROD_POSTMAN_SMS_CRED_NAME"
+        },
+        {
+          "name": "REDIRECT_URI",
+          "valueFrom": "PROD_REDIRECT_URI"
+        },
+        {
+          "name": "SESSION_SECRET",
+          "valueFrom": "PROD_SESSION_SECRET"
+        },
+        { "name": "SGID_CLIENT_ID", "valueFrom": "PROD_SGID_CLIENT_ID" },
+        {
+          "name": "SGID_CLIENT_SECRET",
+          "valueFrom": "PROD_SGID_CLIENT_SECRET"
+        },
+        {
+          "name": "SGID_REDIRECT_URI",
+          "valueFrom": "PROD_SGID_REDIRECT_URI"
+        },
+        {
+          "name": "SGID_PRIVATE_KEY",
+          "valueFrom": "PROD_SGID_PRIVATE_KEY"
+        },
+        {
+          "name": "SITE_CREATE_FORM_KEY",
+          "valueFrom": "PROD_SITE_CREATE_FORM_KEY"
+        },
+        {
+          "name": "SITE_LAUNCH_FORM_KEY",
+          "valueFrom": "PROD_SITE_LAUNCH_FORM_KEY"
+        },
+        {
+          "name": "SITE_PASSWORD_SECRET_KEY",
+          "valueFrom": "PROD_SITE_PASSWORD_SECRET_KEY"
+        },
+        {
+          "name": "PROD_SSH_PUBLIC_KEY",
+          "valueFrom": "PROD_SSH_PUBLIC_KEY"
+        },
+        {
+          "name": "PROD_SSH_PRIVATE_KEY",
+          "valueFrom": "PROD_SSH_PRIVATE_KEY"
+        },
+        {
+          "name": "STEP_FUNCTIONS_ARN",
+          "valueFrom": "PROD_STEP_FUNCTIONS_ARN"
+        },
+        {
+          "name": "SYSTEM_GITHUB_TOKEN",
+          "valueFrom": "PROD_SYSTEM_GITHUB_TOKEN"
         }
       ],
       "logConfiguration": {
@@ -170,19 +226,19 @@
         },
         {
           "name": "DD_AGENT_MAJOR_VERSION",
-          "value": 7
+          "value": "7"
         },
         {
           "name": "DD_LOGS_INJECTION",
-          "value": true
+          "value": "true"
         },
         {
           "name": "DD_TRACE_STARTUP_LOGS",
-          "value": true
+          "value": "true"
         },
         {
           "name": "DD_API_KEY",
-          "valueFrom": "<DD_API_KEY>"
+          "value": "<DD_API_KEY>"
         }
       ],
       "mountPoints": [],
@@ -205,7 +261,7 @@
       "name": "ggs-efs",
       "efsVolumeConfiguration": {
         "fileSystemId": "<EFS_FILE_SYSTEM_ID>",
-        "rootDirectory": "/efs"
+        "rootDirectory": "/"
       }
     }
   ],
@@ -214,8 +270,8 @@
     "operatingSystemFamily": "LINUX"
   },
   "requiresCompatibilities": ["FARGATE"],
-  "taskRoleArn": "arn:aws:iam::<AWS_ACCOUNT_ID>:role/isomer-infra-github-oidc-role-16ea937",
-  "executionRoleArn": "arn:aws:iam::<AWS_ACCOUNT_ID>:role/isomer-infra-github-oidc-role-16ea937",
+  "taskRoleArn": "arn:aws:iam::<AWS_ACCOUNT_ID>:role/isomer-prod-ecs-task-role",
+  "executionRoleArn": "arn:aws:iam::<AWS_ACCOUNT_ID>:role/isomer-prod-ecs-task-exec-role",
   "cpu": "1024",
   "memory": "8192"
 }

.aws/deploy/backend-task-definition.staging.json

@@ -18,6 +18,9 @@
           "readOnly": false
         }
       ],
+      "linuxParameters": {
+        "initProcessEnabled": true
+      },
       "volumesFrom": [],
       "secrets": [
         {
@@ -72,6 +75,10 @@
           "valueFrom": "STAGING_FF_DEPRECATE_SITE_QUEUES"
         },
         { "name": "FRONTEND_URL", "valueFrom": "STAGING_FRONTEND_URL" },
+        {
+          "name": "GGS_REPAIR_FORM_KEY",
+          "valueFrom": "STAGING_GGS_REPAIR_FORM_KEY"
+        },
         {
           "name": "GGS_EXPERIMENTAL_TRACKING_SITES",
           "valueFrom": "STAGING_GGS_EXPERIMENTAL_TRACKING_SITES"
@@ -123,19 +130,60 @@
           "name": "POSTMAN_SMS_CRED_NAME",
           "valueFrom": "STAGING_POSTMAN_SMS_CRED_NAME"
         },
+        {
+          "name": "REDIRECT_URI",
+          "valueFrom": "STAGING_REDIRECT_URI"
+        },
+        {
+          "name": "SESSION_SECRET",
+          "valueFrom": "STAGING_SESSION_SECRET"
+        },
+        { "name": "SGID_CLIENT_ID", "valueFrom": "STAGING_SGID_CLIENT_ID" },
+        {
+          "name": "SGID_CLIENT_SECRET",
+          "valueFrom": "STAGING_SGID_CLIENT_SECRET"
+        },
+        {
+          "name": "SGID_REDIRECT_URI",
+          "valueFrom": "STAGING_SGID_REDIRECT_URI"
+        },
+        {
+          "name": "SGID_PRIVATE_KEY",
+          "valueFrom": "STAGING_SGID_PRIVATE_KEY"
+        },
+        {
+          "name": "SITE_CREATE_FORM_KEY",
+          "valueFrom": "STAGING_SITE_CREATE_FORM_KEY"
+        },
+        {
+          "name": "SITE_LAUNCH_FORM_KEY",
+          "valueFrom": "STAGING_SITE_LAUNCH_FORM_KEY"
+        },
+        {
+          "name": "SITE_PASSWORD_SECRET_KEY",
+          "valueFrom": "STAGING_SITE_PASSWORD_SECRET_KEY"
+        },
         {
           "name": "STAGING_SSH_PUBLIC_KEY",
           "valueFrom": "STAGING_SSH_PUBLIC_KEY"
         },
         {
           "name": "STAGING_SSH_PRIVATE_KEY",
           "valueFrom": "STAGING_SSH_PRIVATE_KEY"
+        },
+        {
+          "name": "STEP_FUNCTIONS_ARN",
+          "valueFrom": "STAGING_STEP_FUNCTIONS_ARN"
+        },
+        {
+          "name": "SYSTEM_GITHUB_TOKEN",
+          "valueFrom": "STAGING_SYSTEM_GITHUB_TOKEN"
         }
       ],
       "logConfiguration": {
         "logDriver": "awslogs",
         "options": {
-          "awslogs-group": "/aws/elasticbeanstalk/cms-backend-prod-node18/var/log/web.stdout.log",
+          "awslogs-group": "/aws/elasticbeanstalk/cms-backend-staging-node18/var/log/web.stdout.log",
           "awslogs-region": "ap-southeast-1",
           "awslogs-stream-prefix": "ecs"
         }
@@ -187,19 +235,19 @@
         },
         {
           "name": "DD_AGENT_MAJOR_VERSION",
-          "value": 7
+          "value": "7"
         },
         {
           "name": "DD_LOGS_INJECTION",
-          "value": true
+          "value": "true"
         },
         {
           "name": "DD_TRACE_STARTUP_LOGS",
-          "value": true
+          "value": "true"
         },
         {
           "name": "DD_API_KEY",
-          "valueFrom": "<DD_API_KEY>"
+          "value": "<DD_API_KEY>"
         }
       ],
       "mountPoints": [],
@@ -222,7 +270,7 @@
       "name": "ggs-efs",
       "efsVolumeConfiguration": {
         "fileSystemId": "<EFS_FILE_SYSTEM_ID>",
-        "rootDirectory": "/efs"
+        "rootDirectory": "/"
       }
     }
   ],
@@ -231,8 +279,8 @@
     "operatingSystemFamily": "LINUX"
   },
   "requiresCompatibilities": ["FARGATE"],
-  "taskRoleArn": "arn:aws:iam::<AWS_ACCOUNT_ID>:role/isomer-infra-github-oidc-role-16ea937",
-  "executionRoleArn": "arn:aws:iam::<AWS_ACCOUNT_ID>:role/isomer-infra-github-oidc-role-16ea937",
+  "taskRoleArn": "arn:aws:iam::<AWS_ACCOUNT_ID>:role/isomer-stg-ecs-task-role",
+  "executionRoleArn": "arn:aws:iam::<AWS_ACCOUNT_ID>:role/isomer-stg-ecs-task-exec-role",
   "cpu": "1024",
   "memory": "8192"
 }

.github/workflows/aws_deploy.yml

@@ -39,6 +39,15 @@ on:
         description: "Path to task definition file"
         required: true
         type: string
+      codedeploy-application:
+        description: 'CodeDeploy application to use'
+        required: true
+        type: string
+      codedeploy-deployment-group:
+        description: 'CodeDeploy deployment group to use'
+        required: true
+        type: string
+
     secrets: 
       AWS_ACCOUNT_ID:
         description: "AWS account ID to deploy to"
@@ -114,6 +123,11 @@ jobs:
             sed -i 's/<EFS_FILE_SYSTEM_ID>/${{ secrets.EFS_FILE_SYSTEM_ID }}/g' ${{ inputs.task-definition-path }}
             sed -i 's/<DD_API_KEY>/${{ secrets.DD_API_KEY }}/g' ${{ inputs.task-definition-path }}
 
+      - name: Replace variables in appspec
+        run: |
+          sed -i 's/<AWS_ACCOUNT_ID>/${{ secrets.AWS_ACCOUNT_ID }}/g' .aws/deploy/appspec.json
+          sed -i 's/<ENVIRONMENT>/${{ inputs.shortEnv }}/g' .aws/deploy/appspec.json
+
       - name: Fill in the new image ID in the Amazon ECS task definition
         id: task-def
         uses: aws-actions/amazon-ecs-render-task-definition@v1
@@ -128,4 +142,7 @@ jobs:
           task-definition: ${{ steps.task-def.outputs.task-definition }}
           cluster: ${{ inputs.ecs-cluster-name }}
           service: ${{ inputs.ecs-web-service-name }}
-          wait-for-service-stability: true
+          wait-for-service-stability: true
+          codedeploy-appspec: .aws/deploy/appspec.json
+          codedeploy-application: ${{ inputs.codedeploy-application }}
+          codedeploy-deployment-group: ${{ inputs.codedeploy-deployment-group }}

.github/workflows/ci.yml

@@ -102,8 +102,7 @@ jobs:
           import os
           ref = os.environ['GITHUB_REF']
           prod = os.environ['PRODUCTION_BRANCH']
-          staging = os.environ['STAGING_BRANCH']
-          if ref == prod or ref == staging:
+          if ref == prod:
             print('::set-output name=proceed::true')
           else:
             print('::set-output name=proceed::false')
@@ -162,16 +161,11 @@ jobs:
             import os
             branch = os.environ['GITHUB_REF']
             production = os.environ['PRODUCTION_BRANCH']
-            staging = os.environ['STAGING_BRANCH']
             eb_app = os.environ['EB_APP']
             eb_env_production = os.environ['EB_ENV_PRODUCTION']
-            eb_env_staging = os.environ['EB_ENV_STAGING']
             if branch == production:
               print('::set-output name=eb_app::' + eb_app)
               print('::set-output name=eb_env::' + eb_env_production)
-            elif branch == staging:
-              print('::set-output name=eb_app::' + eb_app)
-              print('::set-output name=eb_env::' + eb_env_staging)
           id: select_eb_vars
         - name: Deploy to EB
           uses: opengovsg/beanstalk-deploy@v11

.github/workflows/deploy_staging.yml

@@ -7,8 +7,7 @@ concurrency:
 on:
   push:
     branches:
-      # TODO: Update this to allow `staging` once ecs deploys work
-      # - staging
+      - staging
       - feat/ecs
 
 jobs:
@@ -19,12 +18,15 @@ jobs:
       aws-region: "ap-southeast-1"
       cicd-role: "arn:aws:iam::095733531422:role/isomer-infra-github-oidc-role-16ea937"
       ecr-repository: "isomer-infra-staging-ecr"
-      ecs-cluster-name: "isomer-infra-staging-ecs"
-      ecs-web-service-name: "isomer-infra-staging-ecs-service"
+      ecs-cluster-name: "isomer-stg-ecs"
+      ecs-web-service-name: "isomer-stg-ecs-service"
       ecs-container-name: "backend"
       environment: "staging"
       shortEnv: "stg"
-      task-definition-path: ".aws/deploy/backend-task-definition.staging.json"
+      task-definition-path: ".aws/deploy/backend-task-definition.staging.json" 
+      codedeploy-application: "isomer-stg-ecs-app"
+      codedeploy-deployment-group: "isomer-stg-ecs-dg"
+
     secrets: 
       AWS_ACCOUNT_ID: ${{ secrets.AWS_ACCOUNT_ID }}
       EFS_FILE_SYSTEM_ID: ${{ secrets.STAGING_EFS_FILE_SYSTEM_ID }}