###############################################################################

# CD — Option 2: EKS / ArgoCD GitOps Deployment

###############################################################################

#

# Repository separation (three-repo GitOps model):

# mypythonproject1 ← app code + this workflow (YOU ARE HERE)

# mypythonproject1-infra2 ← Terraform for EKS infrastructure

# mypythonproject1-gitops ← Helm charts + ArgoCD Application manifests

#

# Pipeline per environment:

# ┌──────────────────────────────────────────────────────────────────┐

# │ 1. Build & push image to ECR (digest pinned) │

# │ 2. deploy-env composite action: │

# │ a. Update image tag in gitops repo → ArgoCD commit │

# │ b. Upsert K8s DB credentials secret │

# │ c. Wait for ArgoCD Healthy + Synced │

# │ d. Smoke test (opt-in via smoke-test-enabled) │

# └──────────────────────────────────────────────────────────────────┘

#

# Composite action: .github/actions/deploy-env/action.yml

#

# This workflow does NOT run Terraform — infrastructure is managed by a

# dedicated pipeline in mypythonproject1-infra2.

#

# Secrets (GitHub Environments "dev", "staging", and "production"):

# AWS_ROLE_TO_ASSUME — OIDC role ARN with ECR push + EKS access

# AWS_REGION — e.g. us-east-1

# GITOPS_DEPLOY_TOKEN — PAT (contents:write) on mypythonproject1-gitops

# ARGOCD_SERVER — ArgoCD server hostname only, no scheme

# ARGOCD_TOKEN — ArgoCD API token for health poll

# DATABASE_PORT / DATABASE_PORT / DATABASE_NAME / DATABASE_USERNAME / DATABASE_PASSWORD

#

# Variables (GitHub Environments):

# APP_URL — Base URL for smoke test health check

###############################################################################

name: "CD — EKS/ArgoCD GitOps"

on:

workflow_run:

workflows: ["CI"]

branches: [developer]

types: [completed]

push:

tags:

- "v*"

workflow_dispatch:

inputs:

environment:

description: "Target environment"

required: true

type: choice

options: [dev, staging, prod]

default: staging

permissions:

contents: read

concurrency:

group: >-

${{ startsWith(github.ref, 'refs/tags/v') && 'cd-gitops-production'

|| github.event_name == 'workflow_dispatch' && format('cd-gitops-{0}', inputs.environment)

|| 'cd-gitops-staging' }}

cancel-in-progress: ${{ !startsWith(github.ref, 'refs/tags/v') }}

###############################################################################

# ─── DEV ────────────────────────────────────────────────────────────────────

###############################################################################

jobs:

# ---------------------------------------------------------------------------

# 0a. Build + push dev images (every CI success on develop)

# ---------------------------------------------------------------------------

build-dev:

name: "Build & Push [dev]"

if: >

(github.event_name == 'workflow_run'

&& github.event.workflow_run.conclusion == 'success') || (github.event_name == 'workflow_dispatch'

&& inputs.environment == 'dev')

permissions:

contents: read

id-token: write

uses: ./.github/workflows/_build-and-push.yml

with:

git-ref: ${{ github.event.workflow_run.head_sha || github.sha }}

env-name: ${{ inputs.environment }}

tags: |

type=raw,value=dev

type=sha,prefix=dev-,format=short

build-args: |

BUILD_ENV=dev

GIT_SHA=${{ github.event.workflow_run.head_sha || github.sha }}

scan-severity: CRITICAL

scan-exit-code: "0"

secrets: inherit

# ---------------------------------------------------------------------------

# 0b. Update GitOps repo → sync K8s secrets → wait ArgoCD → smoke test

# ---------------------------------------------------------------------------

deploy-dev:

name: "Deploy [dev]"

needs: [build-dev]

runs-on: ubuntu-latest

timeout-minutes: 30

environment: dev

permissions:

contents: read

id-token: write

steps:

- uses: actions/checkout@v4

- uses: ./.github/actions/deploy-env

with:

gitops-env: default

target-environment: dev

image-tag: ${{ format('dev-{0}', needs.build-dev.outputs.sha-short) }}

gitops-repo: ${{ github.repository_owner }}/python-angular-project1-gitops

eks-cluster-name: mypythonproject1-dev-eks

namespace: mypythonproject1-dev

aws-role-arn: ${{ secrets.AWS_ROLE_TO_ASSUME }}

aws-region: ${{ secrets.AWS_REGION }}

gitops-deploy-token: ${{ secrets.GITOPS_DEPLOY_TOKEN }}

db-host: ${{ secrets.DATABASE_HOST }}

db-port: ${{ secrets.DATABASE_PORT }}

db-name: ${{ secrets.DATABASE_NAME }}

db-username: ${{ secrets.DATABASE_USERNAME }}

db-password: ${{ secrets.DATABASE_PASSWORD }}

argocd-server: ${{ secrets.ARGOCD_SERVER }}

argocd-token: ${{ secrets.ARGOCD_TOKEN }}

argocd-app-name: mypythonproject1-dev

argocd-max-retries: "30"

smoke-test-enabled: "false" # enable once APP_URL is set after first deploy

app-url: ${{ vars.APP_URL }}

warmup-seconds: "15"

deploy-sha: ${{ github.event.workflow_run.head_sha || github.sha }}

###############################################################################

# ─── STAGING ────────────────────────────────────────────────────────────────

###############################################################################

# ---------------------------------------------------------------------------

# 1a. Build + push staging images

# ---------------------------------------------------------------------------

build-staging:

name: "Build & Push [staging]"

if: >

(github.event_name == 'workflow_run'

&& github.event.workflow_run.conclusion == 'success')|| (github.event_name == 'workflow_dispatch'

&& inputs.environment == 'staging')

permissions:

contents: read

id-token: write

uses: ./.github/workflows/_build-and-push.yml

with:

git-ref: ${{ github.event.workflow_run.head_sha || github.sha }}

env-name: ${{ inputs.environment }}

tags: |

type=raw,value=staging

type=sha,prefix=staging-,format=short

build-args: |

BUILD_ENV=staging

GIT_SHA=${{ github.event.workflow_run.head_sha || github.sha }}

scan-severity: CRITICAL,HIGH

scan-exit-code: "0"

secrets: inherit

# ---------------------------------------------------------------------------

# 1b. Update GitOps repo → sync K8s secrets → wait ArgoCD → smoke test

# ---------------------------------------------------------------------------

deploy-staging:

name: "Deploy [staging]"

needs: [build-staging]

runs-on: ubuntu-latest

timeout-minutes: 30

environment: staging

permissions:

contents: read

id-token: write

steps:

- uses: actions/checkout@v4

- uses: ./.github/actions/deploy-env

with:

gitops-env: default

target-environment: staging

image-tag: ${{ format('staging-{0}', needs.build-staging.outputs.sha-short) }}

gitops-repo: ${{ github.repository_owner }}/python-angular-project1-gitops

eks-cluster-name: mypythonproject1-staging-eks

namespace: mypythonproject1-staging

aws-role-arn: ${{ secrets.AWS_ROLE_TO_ASSUME }}

aws-region: ${{ secrets.AWS_REGION }}

gitops-deploy-token: ${{ secrets.GITOPS_DEPLOY_TOKEN }}

db-host: ${{ secrets.DATABASE_HOST }}

db-port: ${{ secrets.DATABASE_PORT }}

db-name: ${{ secrets.DATABASE_NAME }}

db-username: ${{ secrets.DATABASE_USERNAME }}

db-password: ${{ secrets.DATABASE_PASSWORD }}

argocd-server: ${{ secrets.ARGOCD_SERVER }}

argocd-token: ${{ secrets.ARGOCD_TOKEN }}

argocd-app-name: mypythonproject1-staging

argocd-max-retries: "30"

smoke-test-enabled: "false" # enable once APP_URL is set after first deploy

app-url: ${{ vars.APP_URL }}

warmup-seconds: "15"

deploy-sha: ${{ github.event.workflow_run.head_sha || github.sha }}

###############################################################################

# ─── PRODUCTION ─────────────────────────────────────────────────────────────

###############################################################################

# ---------------------------------------------------------------------------

# 2a. Semantic release on CI success from main → creates tag

# ---------------------------------------------------------------------------

autoversion:

name: "Semantic Release"

runs-on: ubuntu-latest

timeout-minutes: 10

if: >

github.event_name == 'workflow_run'

&& github.event.workflow_run.conclusion == 'success'

&& github.event.workflow_run.head_branch == 'main'

permissions:

contents: write

issues: write

pull-requests: write

steps:

- uses: actions/checkout@v4

with:

fetch-depth: 0

persist-credentials: true

ref: main

- uses: actions/setup-node@v4

with:

node-version: "22"

cache: "npm"

cache-dependency-path: .github/package-lock.json

- name: Install semantic-release

working-directory: .github

run: npm ci --ignore-scripts

- name: Run semantic-release

working-directory: .github

env:

GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

run: npx semantic-release

# ---------------------------------------------------------------------------

# 2b. Build + push production images (CRITICAL vulns block)

# ---------------------------------------------------------------------------

build-production:

name: "Build & Push [production]"

if: startsWith(github.ref, 'refs/tags/v')

permissions:

contents: read

id-token: write

uses: ./.github/workflows/_build-and-push.yml

with:

git-ref: ${{ github.ref }}

env-name: ${{ inputs.environment }}

tags: |

type=semver,pattern={{version}}

type=semver,pattern={{major}}.{{minor}}

type=raw,value=latest

type=sha,prefix=,format=short

build-args: |

BUILD_ENV=prod

GIT_SHA=${{ github.sha }}

VERSION=${{ github.ref_name }}

scan-severity: CRITICAL

scan-exit-code: "1"

secrets: inherit

# ---------------------------------------------------------------------------

# 2c. Update GitOps repo → sync K8s secrets → wait ArgoCD → smoke test

# ---------------------------------------------------------------------------

deploy-production:

name: "Deploy [production]"

needs: [build-production]

runs-on: ubuntu-latest

timeout-minutes: 35

environment: prod

permissions:

contents: read

id-token: write

steps:

- uses: actions/checkout@v4

- uses: ./.github/actions/deploy-env

with:

gitops-env: default

target-environment: prod

image-tag: ${{ github.ref_name }}

gitops-repo: ${{ github.repository_owner }}/python-angular-project1-gitops

eks-cluster-name: mypythonproject1-prod-eks

namespace: mypythonproject1-production

aws-role-arn: ${{ secrets.AWS_ROLE_TO_ASSUME }}

aws-region: ${{ secrets.AWS_REGION }}

gitops-deploy-token: ${{ secrets.GITOPS_DEPLOY_TOKEN }}

db-host: ${{ secrets.DATABASE_HOST }}

db-port: ${{ secrets.DATABASE_PORT }}

db-name: ${{ secrets.DATABASE_NAME }}

db-username: ${{ secrets.DATABASE_USERNAME }}

db-password: ${{ secrets.DATABASE_PASSWORD }}

argocd-server: ${{ secrets.ARGOCD_SERVER }}

argocd-token: ${{ secrets.ARGOCD_TOKEN }}

argocd-app-name: mypythonproject1-production

argocd-max-retries: "40"

smoke-test-enabled: "false" # enable once APP_URL is set after first deploy

app-url: ${{ vars.APP_URL }}

warmup-seconds: "20"

deploy-version: ${{ github.ref_name }}

deploy-sha: ${{ github.sha }}