コンテナイメージのビルド&プッシュと、AWS Serverless Application Model （SAM）のビルド&デプロイを、GitHub Actionsで設定してみた

├── actions
│   ├── container
│   │   └── action.yaml
│   ├── sam
│   │   └── action.yaml
│   └── update-ecs-service
│       └── action.yaml
└── workflows
    ├── deploy-system1-to-dev.yaml

name: Deploy system1 to dev environment

on:
  push:
    branches:
      - feature/**
    paths:
      - system1/**
  pull_request:
    branches:
      - develop
    types:
      - closed
    paths:
      - sysutem1/**

env:
  AWS_DEV_ACCOUNT_ID: xxxxxxxxxxxx
  AWS_ENV_NAME: dev

permissions:
  id-token: write
  actions: write
  contents: read
  pull-requests: read

jobs:

  #===================================================#
  # system1-component1のコンテナイメージを開発環境にプッシュ
  #===================================================#

  push_system1-component1_image_to_dev:
    needs:
      - cfn_lint_system1
      - pytest_system1-component1
      - pytest_system1-component2
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Push system1 component1 container image
        uses: ./.github/actions/container
        with:
          aws-account-id: ${{ env.AWS_DEV_ACCOUNT_ID }}
          env-name: ${{ env.AWS_ENV_NAME }}
          working-directory: system1
          image-name: system1-component1
          dockerfile-path: ./system1-component1
          image-tag: 'latest'

  #===================================================#
  # System1を開発環境にデプロイ
  #===================================================#

  deploy_system1_to_dev:
    needs:
      - push_system1-component1_image_to_dev
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Deploy System1
        uses: ./.github/actions/sam
        with:
          aws-account-id: ${{ env.AWS_DEV_ACCOUNT_ID }}
          env-name: ${{ env.AWS_ENV_NAME }}
          working-directory: system1

  #===================================================#
  # ECSサービスを更新
  #===================================================#

  update_system1_ecs_service:
    needs:
      - deploy_system1_to_dev
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Update ECS Service
        uses: ./.github/actions/update-ecs-service
        with:
          aws-account-id: ${{ env.AWS_DEV_ACCOUNT_ID }}
          env-name: ${{ env.AWS_ENV_NAME }}
          system-name: system1-component1

name: Build container image and push it to ECR

inputs:
  aws-account-id:
    type: string
    description: AWS account id

  env-name:
    type: choice
    description: The environment name to deploy
    options:
      - dev
      - prd

  working-directory:
    type: choice
    description: The working directory to run the commands

  dockerfile-path:
    type: string
    description: Path to Dockerfile relative to working directory

  image-tag:
    type: string
    description: Image tag to push
    default: 001

  image-name:
    type: string
    description: Image name to push

runs:
  using: composite
  steps:
    - name: Get AWS credentials
      uses: aws-actions/configure-aws-credentials@v4
      with:
        role-to-assume: arn:aws:iam::${{ inputs.aws-account-id }}:role/${{ inputs.env-name }}-role-github-actions-oicd
        aws-region: ap-northeast-1

    - name: Login to ECR
      id: login-ecr
      uses: aws-actions/amazon-ecr-login@v2

    - name: Push image to ECR
      shell: bash
      working-directory: ${{ inputs.working-directory }}
      env:
        ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
        ECR_REPOSITORY: ${{ inputs.env-name }}-${{ inputs.image-name }}-ecr
        IMAGE_TAG: ${{ inputs.image-tag }}
      run: |
        # Build Docker image
        docker build --platform linux/amd64 -t $ECR_REPOSITORY ${{ inputs.dockerfile-path }}
        # Tag Docker image for ECR
        docker tag $ECR_REPOSITORY:latest $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG
        # Push Docker image to ECR
        docker push $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG

name: Build and deploy SAM application

inputs:
  aws-account-id:
    type: string
    description: AWS account id

  env-name:
    type: choice
    description: The environment name to deploy
    options:
      - dev
      - prd

  working-directory:
    type: choice
    description: The working directory to run the commands

runs:
  using: composite
  steps:
    - name: Setup Python
      uses: actions/setup-python@v5
      with:
        python-version: 3.12

    - name: Setup SAM
      uses: aws-actions/setup-sam@v2

    - name: Get credential
      uses: aws-actions/configure-aws-credentials@v4
      with:
        role-to-assume: arn:aws:iam::${{ inputs.aws-account-id }}:role/${{ inputs.env-name }}-role-github-actions-oicd
        aws-region: ap-northeast-1

    - name: SAM build
      run: sam build
      shell: bash
      working-directory: ${{ inputs.working-directory }}

    - name: SAM deploy
      run: sam deploy --config-env ${{ inputs.env-name }} --no-confirm-changeset --no-fail-on-empty-changeset
      shell: bash
      working-directory: ${{ inputs.working-directory }}

name: Update ECS Service

inputs:
  aws-account-id:
    type: string
    description: AWS account id
    required: true

  env-name:
    type: choice
    description: The environment name to deploy
    required: true
    options:
      - dev
      - prd

  system-name:
    type: string
    description: System name to update
    required: true

runs:
  using: composite
  steps:
    - name: Configure AWS credentials
      uses: aws-actions/configure-aws-credentials@v4
      with:
        role-to-assume: arn:aws:iam::${{ inputs.aws-account-id }}:role/${{ inputs.env-name }}-role-github-actions-oicd
        aws-region: ap-northeast-1

    - name: Update ECS Service
      run: |
        aws ecs update-service \
          --cluster ${{ inputs.env-name }}-${{ inputs.system-name }}-ecs-cluster \
          --service ${{ inputs.env-name }}-${{ inputs.system-name }}-ecs-service \
          --force-new-deployment
      shell: bash