callable-deploy-ecs.yml

name: "Task: Deploy"
on:
  workflow_call:
    inputs:
      env:
        description: Target environment of deployment. (dev, stg, prod)
        required: true
        type: string
      container_digest:
        description: 'The container sha256 digest to deploy'
        required: true
        type: string

permissions:
  contents: 'read'
  id-token: 'write'

concurrency:
  group: ${{ inputs.env }}
  cancel-in-progress: false

jobs:
  deploy:
    runs-on: ubuntu-24.04
    environment: ${{ inputs.env }}
    steps:
      - uses: actions/checkout@v4

      - name: Configuration
        id: config
        run: |
          REPOSITORY_OWNER=$(tr "[:upper:]" "[:lower:]" <<< "${{ github.repository_owner }}")
          echo "REPOSITORY_OWNER=${REPOSITORY_OWNER}" >> "$GITHUB_OUTPUT"

          REPOSITORY_NAME=$(tr "[:upper:]" "[:lower:]" <<< "${{ github.event.repository.name }}")
          echo "REPOSITORY_NAME=${REPOSITORY_NAME}" >> "$GITHUB_OUTPUT"

          TARGET_IMAGE="ghcr.io/${REPOSITORY_OWNER}/${REPOSITORY_NAME}"
          echo "TARGET_IMAGE=${TARGET_IMAGE}" >> "$GITHUB_OUTPUT"

          TARGET_IMAGE_W_DIGEST="${TARGET_IMAGE}@${{ inputs.container_digest }}"
          echo "TARGET_IMAGE_W_DIGEST=${TARGET_IMAGE_W_DIGEST}" >> "$GITHUB_OUTPUT"

      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ vars.IAM_ROLE_ARN }}
          aws-region: us-east-2

      - name: Download task definition
        run: |
          aws ecs describe-task-definition \
            --task-definition ${{ vars.ECS_TASK_DEF_FAMILY }} \
            --query taskDefinition \
            > task.json
          
          # Remove Ignored Properties

          echo "$( jq 'del(.compatibilities)'    task.json )" > task.json
          echo "$( jq 'del(.taskDefinitionArn)'  task.json )" > task.json
          echo "$( jq 'del(.requiresAttributes)' task.json )" > task.json
          echo "$( jq 'del(.revision)'           task.json )" > task.json
          echo "$( jq 'del(.status)'             task.json )" > task.json
          echo "$( jq 'del(.registeredAt)'       task.json )" > task.json
          echo "$( jq 'del(.registeredBy)'       task.json )" > task.json

          # Update Image
          echo "$( jq --arg image "${{ steps.config.outputs.TARGET_IMAGE_W_DIGEST }}" '.containerDefinitions |= map((select(.name == "server") | .image) |= $image)' task.json )" > task.json
          cat task.json

      - name: Deploy Amazon ECS task definition
        id: ecs-deploy
        uses: aws-actions/amazon-ecs-deploy-task-definition@v2
        with:
          task-definition: task.json
          service: ${{ vars.ECS_SERVICE }}
          cluster: ${{ vars.ECS_CLUSTER }}
          wait-for-service-stability: true
          propagate-tags: SERVICE

      - name: Verify deploy
        id: check-deployment
        run: |
          TASK_DEF_EXPECTED=${{ steps.ecs-deploy.outputs.task-definition-arn }}
          TASK_DEF_CURRENT=$(
            aws ecs describe-services \
              --cluster ${{ vars.ECS_CLUSTER }} \
              --services ${{ vars.ECS_SERVICE }} \
              --query services[0].deployments[0].taskDefinition \
              | jq -r "."
          )
          echo "Task Arn - Current: $TASK_DEF_CURRENT"
          echo "Task Arn - Expected: $TASK_DEF_EXPECTED"
          if [ "$TASK_DEF_CURRENT" != "$TASK_DEF_EXPECTED" ]; then
            echo "Current task arn does not match the expected task arn."
            echo "The deployment may have been rolled back or been deposed by a more recent deployment attempt"
            exit 1
          fi