build-deploy-lambda.yaml

name: Deploy to ECR-Lambda on Release
on:
  workflow_run:
    workflows: ["Create and Publish Release"]
    types: [completed]
    branches:
      - main
      - dev
  workflow_dispatch:
    inputs:
      release_tag:
        description: "Release tag to deploy (e.g., v1.0.0)"
        required: true
        type: string
      deployment_environment:
        description: "Environment to deploy to"
        required: true
        default: "prod"
        type: choice
        options:
          - prod
          - dev
jobs:
  build-push-and-update-lambda:
    # Only run if the workflow run was successful
    if: ${{ github.event.workflow_run.conclusion == 'success' || github.event_name == 'workflow_dispatch' }}
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    env:
      BASETAG: ${{ secrets.LAMBDA_FUNCTION_BASENAME }}_
    steps:
      # Validate the necessary secrets to run the workflow
      - name: Preflight Check for Secrets
        run: |
          echo "Validating GitHub Actions secrets in repo=${{ github.event.repository.name }}"
          MISSING_SECRETS=()

          # Explicitly check each secret
          if [[ -z "${{ secrets.AWS_ACCESS_KEY_ID }}" ]]; then
            echo "❌ AWS_ACCESS_KEY_ID is missing"
            MISSING_SECRETS+=("AWS_ACCESS_KEY_ID")
          else
            echo "✅ AWS_ACCESS_KEY_ID found"
          fi

          if [[ -z "${{ secrets.AWS_SECRET_ACCESS_KEY }}" ]]; then
            echo "❌ AWS_SECRET_ACCESS_KEY is missing"
            MISSING_SECRETS+=("AWS_SECRET_ACCESS_KEY")
          else
            echo "✅ AWS_SECRET_ACCESS_KEY found"
          fi

          if [[ -z "${{ secrets.AWS_REGION_NAME }}" ]]; then
            echo "❌ AWS_REGION_NAME is missing"
            MISSING_SECRETS+=("AWS_REGION_NAME")
          else
            echo "✅ AWS_REGION_NAME found"
          fi

          if [[ -z "${{ secrets.ECR_REPO_NAME }}" ]]; then
            echo "❌ ECR_REPO_NAME is missing"
            MISSING_SECRETS+=("ECR_REPO_NAME")
          else
            echo "✅ ECR_REPO_NAME found"
          fi

          if [[ -z "${{ secrets.LAMBDA_FUNCTION_BASENAME }}" ]]; then
            echo "❌ LAMBDA_FUNCTION_BASENAME is missing"
            MISSING_SECRETS+=("LAMBDA_FUNCTION_BASENAME")
          else
            echo "✅ LAMBDA_FUNCTION_BASENAME found"
          fi

          # Secret validation check
          if [ ${#MISSING_SECRETS[@]} -ne 0 ]; then
            echo "One or more required secrets are missing: ${MISSING_SECRETS[@]}. Please set them before running the workflow."
            exit 1
          else
            echo "✅ All required secrets are set. Proceeding..."
          fi

      # Initial checkout to default branch to be able to get releases lists
      - name: Initial repository checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 1
      # First determine the deployment environment
      - name: Determine environment from release
        id: determine-env
        run: |
          if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then
            # Use the explicitly provided environment
            DEPLOYMENT_ENV="${{ github.event.inputs.deployment_environment }}"
          elif [[ "${{ github.event_name }}" == "workflow_run" ]]; then
            # Extract branch from workflow_run
            if [[ "${{ github.event.workflow_run.head_branch }}" == "main" ]]; then
              DEPLOYMENT_ENV="prod"
            else
              DEPLOYMENT_ENV="dev"
            fi
          else
            # Fallback logic based on branch
            if [[ "${{ github.ref_name }}" == "main" ]]; then
              DEPLOYMENT_ENV="prod"
            else
              DEPLOYMENT_ENV="dev"
            fi
          fi

          echo "Using deployment environment: $DEPLOYMENT_ENV"
          echo "DEPLOYMENT_ENVIRONMENT=$DEPLOYMENT_ENV" >> $GITHUB_OUTPUT

      - name: Get latest release
        id: get-latest-release
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then
            # Use the explicitly provided release tag
            LATEST_TAG="${{ github.event.inputs.release_tag }}"
            
            # Verify the tag matches the environment (prerelease status check)
            IS_PRERELEASE=$(gh release view $LATEST_TAG --json isPrerelease -q .isPrerelease)
            if [[ "${{ steps.determine-env.outputs.DEPLOYMENT_ENVIRONMENT }}" == "prod" && "$IS_PRERELEASE" == "true" ]]; then
              echo "Error: Cannot deploy prerelease $LATEST_TAG to prod environment"
              exit 1
            elif [[ "${{ steps.determine-env.outputs.DEPLOYMENT_ENVIRONMENT }}" == "dev" && "$IS_PRERELEASE" == "false" ]]; then
              echo "Warning: Deploying non-prerelease $LATEST_TAG to dev environment"
            fi
          else
            # Get latest release tag from successfull create-publish workflow
            echo "Getting release for deployment environment: ${{ steps.determine-env.outputs.DEPLOYMENT_ENVIRONMENT }}"
            if [[ "${{ steps.determine-env.outputs.DEPLOYMENT_ENVIRONMENT }}" == "prod" ]]; then
              # Get latest non-prerelease for prod environment
              LATEST_TAG=$(gh release list --limit 10 --json tagName,isPrerelease \
                | jq -r '.[] | select(.isPrerelease==false) | .tagName' | head -n 1)
            else
              # Get latest prerelease for dev environment
              LATEST_TAG=$(gh release list --limit 10 --json tagName,isPrerelease \
                | jq -r '.[] | select(.isPrerelease==true) | .tagName' | head -n 1)
            fi
          fi

          echo "Extracted LATEST_TAG: $LATEST_TAG"
          echo "tag_name=$LATEST_TAG" >> $GITHUB_OUTPUT
      # Checkout the repo at the specific tag/release
      - name: Checkout release code
        uses: actions/checkout@v4
        with:
          ref: ${{ steps.get-latest-release.outputs.tag_name }}
          fetch-depth: 1

      - name: Setup AWS ECR Details
        uses: aws-actions/configure-aws-credentials@v2
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: ${{ secrets.AWS_REGION_NAME }}

      - name: Login to Amazon ECR
        id: login-pf-aws-ecr
        uses: aws-actions/amazon-ecr-login@v1
        with:
          mask-password: true
      - name: Set the image tag for build/deploy
        id: set-image-tag
        run: |
          # Extract version from release tag (remove 'v' prefix if present)
          RELEASE_VERSION="${{ steps.get-latest-release.outputs.tag_name }}"
          if [[ -z $RELEASE_VERSION ]]; then
            RELEASE_VERSION="${{ github.ref_name }}" # fallback
          fi
          RELEASE_VERSION="${RELEASE_VERSION#v}"  # Remove 'v' prefix if present

          IM_TAG="${{ env.BASETAG }}${{ steps.determine-env.outputs.DEPLOYMENT_ENVIRONMENT }}-${RELEASE_VERSION}"
          echo "IMAGE_TAG=$IM_TAG" >> $GITHUB_OUTPUT

          LAMBDA_FUNC_TARGET="${{ secrets.LAMBDA_FUNCTION_BASENAME }}_${{ steps.determine-env.outputs.DEPLOYMENT_ENVIRONMENT }}"
          echo "LAMBDA_FUNC_TARGET=$LAMBDA_FUNC_TARGET" >> $GITHUB_OUTPUT
      - name: Build, tag, and push image to ECR
        id: build-publish
        env:
          ECR_REGISTRY: ${{ steps.login-pf-aws-ecr.outputs.registry }}
          ECR_REPOSITORY: ${{ secrets.ECR_REPO_NAME }}
          IMAGE_TAG: ${{ steps.set-image-tag.outputs.IMAGE_TAG }}
        run: |
          DOCKER_BUILDKIT=1
          docker build \
              --platform linux/amd64 \
              -t "$ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG" .
          docker push "$ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG"
          echo "IMAGE $IMAGE_TAG is pushed to $ECR_REGISTRY/$ECR_REPOSITORY"
          echo "full_image=$ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG" >> $GITHUB_OUTPUT
      - name: Update AWS Lambda function
        run: |
          aws lambda update-function-code \
            --function-name "${{ steps.set-image-tag.outputs.LAMBDA_FUNC_TARGET }}" \
            --image-uri "${{ steps.build-publish.outputs.full_image }}" \
            --region "${{ secrets.AWS_REGION_NAME }}"
          echo "Lambda function ${{ steps.set-image-tag.outputs.LAMBDA_FUNC_TARGET }} updated."