Deploy to Amazon ECS #2225
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # This workflow will build and push a new container image to Amazon ECR, | |
| # and then will deploy a new task definition for each of the services to Amazon ECS. | |
| # Expected vars: | |
| # The following vars must be set at the repo level. Their values must be JSON and contain one key per | |
| # environment (dev, prod, etc.) and the value for each key must be the value for that environment. | |
| # | |
| # DEPLOY_APP_NAME: {"dev": "app1", "prod": "app2"} | |
| # DEPLOY_AWS_REGION: {"dev": "us-west-2", "prod": "us-east-1"} | |
| # AWS_ACCOUNT: {"dev": "123456789012", "prod": "123456789012"} | |
| # Note: The names of repository, cluster, services match what is configured in https://github.com/dimagi/ocs-deploy | |
| name: Deploy to Amazon ECS | |
| on: | |
| workflow_dispatch: | |
| inputs: | |
| environment: | |
| description: "Deploy environment" | |
| required: true | |
| type: choice | |
| options: | |
| - dev | |
| - prod | |
| workflow_run: | |
| workflows: [ Lint and Test ] | |
| types: [completed] | |
| branches: [main] | |
| permissions: | |
| id-token: write | |
| contents: read | |
| deployments: write | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }}-${{ inputs.environment }} | |
| cancel-in-progress: false | |
| jobs: | |
| deploy: | |
| name: Deploy | |
| runs-on: ubuntu-latest | |
| if: ${{ github.event_name == 'workflow_dispatch' || github.event.workflow_run.conclusion == 'success' }} | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v6 | |
| - name: Set Deploy Env | |
| # Set the deploy env based on the input from the event or else from the branch | |
| run: | | |
| if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then | |
| DEPLOY_ENV="${{ inputs.environment }}" | |
| elif [[ "${{github.base_ref}}" == "main" || "${{github.ref}}" == "refs/heads/main" ]]; then | |
| DEPLOY_ENV="prod" | |
| else | |
| DEPLOY_ENV="dev" | |
| fi | |
| echo "DEPLOY_ENV=$DEPLOY_ENV" >> "$GITHUB_ENV" | |
| - name: Set variables | |
| # Set other variables accordingly | |
| run: | | |
| # you can't reference the `env` context when defining other env vars to do it here | |
| APP_NAME="${{ fromJSON(vars.DEPLOY_APP_NAME)[env.DEPLOY_ENV] }}" | |
| AWS_REGION="${{ fromJSON(vars.DEPLOY_AWS_REGION)[env.DEPLOY_ENV] }}" | |
| { | |
| echo "APP_NAME=$APP_NAME" | |
| echo "AWS_REGION=$AWS_REGION" | |
| echo "ECR_REPOSITORY=$APP_NAME-${{ env.DEPLOY_ENV }}-ecr-repo" | |
| echo "ECS_CLUSTER=$APP_NAME-${{ env.DEPLOY_ENV }}-Cluster" | |
| echo "ECS_SERVICE_DJANGO=$APP_NAME-${{ env.DEPLOY_ENV }}-Django" | |
| echo "ECS_SERVICE_CELERY=$APP_NAME-${{ env.DEPLOY_ENV }}-Celery" | |
| echo "ECS_SERVICE_CELERY_BEAT=$APP_NAME-${{ env.DEPLOY_ENV }}-CeleryBeat" | |
| echo "DJANGO_STACK_NAME=$APP_NAME-${{ env.DEPLOY_ENV }}-$AWS_REGION-django-stack" | |
| } >> "$GITHUB_ENV" | |
| - name: Create GitHub deployment | |
| uses: chrnorm/deployment-action@v2 | |
| id: deployment | |
| with: | |
| token: '${{ github.token }}' | |
| environment: "aws-${{ env.DEPLOY_ENV }}" | |
| production-environment: ${{ env.DEPLOY_ENV == 'prod' }} | |
| description: "Deploying ${{ github.head_ref || github.ref }} to AWS ${{ env.DEPLOY_ENV }}" | |
| - name: configure aws credentials | |
| uses: aws-actions/configure-aws-credentials@v6.2.1 | |
| with: | |
| role-to-assume: "arn:aws:iam::${{ fromJSON(vars.AWS_ACCOUNT)[env.DEPLOY_ENV] }}:role/github_deploy" | |
| role-session-name: GithubDeploy | |
| aws-region: ${{ fromJSON(vars.DEPLOY_AWS_REGION)[env.DEPLOY_ENV] }} | |
| - name: Login to Amazon ECR | |
| id: login-ecr | |
| uses: aws-actions/amazon-ecr-login@v2.1.6 | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v3 | |
| - name: Get image names | |
| id: image-name | |
| env: | |
| ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }} | |
| IMAGE_TAG: ${{ github.sha }} | |
| run: | | |
| echo "image=$ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG" >> "$GITHUB_OUTPUT" | |
| echo "image_latest=$ECR_REGISTRY/$ECR_REPOSITORY:latest" >> "$GITHUB_OUTPUT" | |
| - name: Check for pre-built image | |
| # The Lint and Test workflow pre-builds the prod image (tagged by SHA) in | |
| # parallel with the tests, so the common main->prod deploy can skip the | |
| # build entirely. Manual dev deploys (and the rare case where the pre-build | |
| # hasn't finished) fall through to the build step below. | |
| id: check-image | |
| run: | | |
| if aws ecr describe-images \ | |
| --repository-name "$ECR_REPOSITORY" \ | |
| --image-ids imageTag="${{ github.sha }}" >/dev/null 2>&1; then | |
| echo "exists=true" >> "$GITHUB_OUTPUT" | |
| echo "Image ${{ github.sha }} already in ECR — skipping build" | |
| else | |
| echo "exists=false" >> "$GITHUB_OUTPUT" | |
| echo "Image ${{ github.sha }} not found in ECR — building" | |
| fi | |
| - name: Build and push | |
| if: steps.check-image.outputs.exists != 'true' | |
| uses: docker/build-push-action@v7 | |
| with: | |
| tags: | | |
| ${{ steps.image-name.outputs.image }} | |
| ${{ steps.image-name.outputs.image_latest }} | |
| file: Dockerfile | |
| cache-from: type=gha | |
| cache-to: type=gha,mode=max | |
| outputs: type=image,push=true,oci-mediatypes=true,compression=zstd,compression-level=3 | |
| - name: Update ECS task def for Django web container | |
| id: django-web-def | |
| uses: aws-actions/amazon-ecs-render-task-definition@v1.8.4 | |
| with: | |
| task-definition-family: ${{ env.APP_NAME }}-${{ env.DEPLOY_ENV }}-Django | |
| container-name: web | |
| image: ${{ steps.image-name.outputs.image }} | |
| - name: Update ECS task def for Migration container | |
| id: migration-def | |
| uses: aws-actions/amazon-ecs-render-task-definition@v1.8.4 | |
| with: | |
| task-definition-family: ${{ env.APP_NAME }}-${{ env.DEPLOY_ENV }}-Migration | |
| container-name: migrate | |
| image: ${{ steps.image-name.outputs.image }} | |
| - name: Update ECS task def for Celery worker container | |
| id: celery-worker-def | |
| uses: aws-actions/amazon-ecs-render-task-definition@v1.8.4 | |
| with: | |
| task-definition-family: ${{ env.APP_NAME }}-${{ env.DEPLOY_ENV }}-CeleryWorkerTask | |
| container-name: celery-worker | |
| image: ${{ steps.image-name.outputs.image }} | |
| - name: Update ECS task def for Celery beat container | |
| id: celery-beat-def | |
| uses: aws-actions/amazon-ecs-render-task-definition@v1.8.4 | |
| with: | |
| task-definition-family: ${{ env.APP_NAME }}-${{ env.DEPLOY_ENV }}-CeleryBeatTask | |
| container-name: celery-beat | |
| image: ${{ steps.image-name.outputs.image }} | |
| - name: Get stack outputs for network config | |
| id: stack-outputs | |
| run: | | |
| set -e | |
| OUTPUTS=$(aws cloudformation describe-stacks \ | |
| --stack-name "$DJANGO_STACK_NAME" \ | |
| --query 'Stacks[0].Outputs' \ | |
| --output json) || { echo "Failed to retrieve CloudFormation stack outputs"; exit 1; } | |
| SUBNETS=$(echo "$OUTPUTS" | jq -r '.[] | select(.OutputKey | endswith("PrivateSubnets")) | .OutputValue') | |
| SG=$(echo "$OUTPUTS" | jq -r '.[] | select(.OutputKey | endswith("ServiceSecurityGroup")) | .OutputValue') | |
| [[ -z "$SUBNETS" ]] && { echo "Error: Could not find subnets in stack outputs"; exit 1; } | |
| [[ -z "$SG" ]] && { echo "Error: Could not find security group in stack outputs"; exit 1; } | |
| echo "subnets=$SUBNETS" >> "$GITHUB_OUTPUT" | |
| echo "security_group=$SG" >> "$GITHUB_OUTPUT" | |
| - name: Run migration task | |
| id: run-migration | |
| run: | | |
| # Strip metadata fields that cause issues when re-registering | |
| jq 'del(.tags, .registeredAt, .registeredBy, .taskDefinitionArn, .revision, .status, .requiresAttributes, .compatibilities)' \ | |
| ${{ steps.migration-def.outputs.task-definition }} > /tmp/migration-task-def.json | |
| # Register task definition with new image | |
| TASK_DEF_ARN=$(aws ecs register-task-definition \ | |
| --cli-input-json file:///tmp/migration-task-def.json \ | |
| --query 'taskDefinition.taskDefinitionArn' \ | |
| --output text) | |
| # Run the migration task | |
| TASK_ARN=$(aws ecs run-task \ | |
| --cluster "$ECS_CLUSTER" \ | |
| --task-definition "$TASK_DEF_ARN" \ | |
| --launch-type FARGATE \ | |
| --network-configuration "awsvpcConfiguration={subnets=[${{ steps.stack-outputs.outputs.subnets }}],securityGroups=[${{ steps.stack-outputs.outputs.security_group }}],assignPublicIp=DISABLED}" \ | |
| --query 'tasks[0].taskArn' \ | |
| --output text) | |
| echo "task_arn=$TASK_ARN" >> "$GITHUB_OUTPUT" | |
| echo "Started migration task: $TASK_ARN" | |
| - name: Wait for migration & output logs | |
| run: | | |
| echo "Waiting for migration task to complete..." | |
| aws ecs wait tasks-stopped \ | |
| --cluster "$ECS_CLUSTER" \ | |
| --tasks "${{ steps.run-migration.outputs.task_arn }}" | |
| # Check exit code | |
| EXIT_CODE=$(aws ecs describe-tasks \ | |
| --cluster "$ECS_CLUSTER" \ | |
| --tasks "${{ steps.run-migration.outputs.task_arn }}" \ | |
| --query 'tasks[0].containers[0].exitCode' \ | |
| --output text) | |
| # Get task details for log configuration | |
| TASK_ID=$(echo "${{ steps.run-migration.outputs.task_arn }}" | cut -d'/' -f3) | |
| # Output migration logs | |
| LOG_STREAM="${LOG_STREAM_PREFIX}/${TASK_ID}" | |
| echo "Fetching migration logs from CloudWatch..." | |
| LOGS=$(aws logs get-log-events \ | |
| --log-group-name "$LOG_GROUP" \ | |
| --log-stream-name "$LOG_STREAM" \ | |
| --limit 100 \ | |
| --query 'events[*].message' \ | |
| --output json 2>&1) || LOGS="Could not fetch logs" | |
| # Output to console | |
| echo "----------------------------------------" | |
| echo "$LOGS" | |
| echo "----------------------------------------" | |
| # Add to job summary | |
| { | |
| echo "## Migration Logs" | |
| echo "" | |
| echo "**Task ID:** \`$TASK_ID\`" | |
| echo "**Log Group:** \`$LOG_GROUP\`" | |
| echo "**Log Stream:** \`$LOG_STREAM\`" | |
| echo "" | |
| echo "<details>" | |
| echo "<summary>View Logs</summary>" | |
| echo "" | |
| echo "\`\`\`json" | |
| echo "$LOGS" | |
| echo "\`\`\`" | |
| echo "</details>" | |
| } >> "$GITHUB_STEP_SUMMARY" | |
| if [ "$EXIT_CODE" != "0" ]; then | |
| echo "Migration failed with exit code: $EXIT_CODE" | |
| { | |
| echo "" | |
| echo "❌ **Migration failed with exit code: $EXIT_CODE**" | |
| } >> "$GITHUB_STEP_SUMMARY" | |
| exit 1 | |
| fi | |
| echo "Migration completed successfully" | |
| { | |
| echo "" | |
| echo "✅ **Migration completed successfully**" | |
| } >> "$GITHUB_STEP_SUMMARY" | |
| env: | |
| LOG_GROUP: ${{ env.APP_NAME }}-${{ env.DEPLOY_ENV }}-DjangoMigrationLogs | |
| LOG_STREAM_PREFIX: ${{ env.APP_NAME }}-${{ env.DEPLOY_ENV }}-migrate/migrate | |
| - name: Deploy Django Web | |
| uses: aws-actions/amazon-ecs-deploy-task-definition@v2 | |
| with: | |
| task-definition: ${{ steps.django-web-def.outputs.task-definition }} | |
| service: ${{ env.ECS_SERVICE_DJANGO }} | |
| cluster: ${{ env.ECS_CLUSTER }} | |
| wait-for-service-stability: false | |
| - name: Deploy Celery Worker | |
| uses: aws-actions/amazon-ecs-deploy-task-definition@v2 | |
| with: | |
| task-definition: ${{ steps.celery-worker-def.outputs.task-definition }} | |
| service: ${{ env.ECS_SERVICE_CELERY }} | |
| cluster: ${{ env.ECS_CLUSTER }} | |
| wait-for-service-stability: false | |
| - name: Deploy Celery Beat | |
| uses: aws-actions/amazon-ecs-deploy-task-definition@v2 | |
| with: | |
| task-definition: ${{ steps.celery-beat-def.outputs.task-definition }} | |
| service: ${{ env.ECS_SERVICE_CELERY_BEAT }} | |
| cluster: ${{ env.ECS_CLUSTER }} | |
| wait-for-service-stability: false | |
| - name: Wait for service stability | |
| run: | | |
| # Run the three waiters in parallel. `set -e` (default in GH Actions bash) | |
| # doesn't apply to background processes, so we capture each exit code via | |
| # `wait <pid>` and fail only after all three have finished. | |
| aws ecs wait services-stable --cluster "$ECS_CLUSTER" --services "$ECS_SERVICE_DJANGO" & | |
| pid_django=$! | |
| aws ecs wait services-stable --cluster "$ECS_CLUSTER" --services "$ECS_SERVICE_CELERY" & | |
| pid_celery=$! | |
| aws ecs wait services-stable --cluster "$ECS_CLUSTER" --services "$ECS_SERVICE_CELERY_BEAT" & | |
| pid_celery_beat=$! | |
| rc=0 | |
| wait "$pid_django" || { echo "Django service failed to stabilise"; rc=1; } | |
| wait "$pid_celery" || { echo "Celery service failed to stabilise"; rc=1; } | |
| wait "$pid_celery_beat" || { echo "CeleryBeat service failed to stabilise"; rc=1; } | |
| exit $rc | |
| - name: Update deployment status | |
| if: always() | |
| uses: chrnorm/deployment-status@v2 | |
| with: | |
| token: '${{ github.token }}' | |
| environment-url: ${{ steps.deployment.outputs.environment_url }} | |
| deployment-id: ${{ steps.deployment.outputs.deployment_id }} | |
| state: ${{ job.status == 'success' && 'success' || 'failure' }} | |
| - name: Create Sentry release | |
| if: success() | |
| uses: getsentry/action-release@v3 | |
| env: | |
| SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }} | |
| SENTRY_ORG: ${{ secrets.SENTRY_ORG }} | |
| SENTRY_PROJECT: ${{ secrets.SENTRY_PROJECT }} | |
| with: | |
| environment: "${{ env.DEPLOY_ENV == 'prod' && 'production' || 'development' }}" | |
| ignore_empty: true | |
| ignore_missing: true |