cf-deploy.yml

---
name: "Deploy CloudFormation Stack"

on:
  workflow_call:
    inputs:
      s3-bucket:
        description: 'Add bucket name'
        required: true
        type: string
      bucket-prefix:
        description: 'bucket folder name'
        required: true
        type: string
      aws-region:
        description: 'AWS REGION'
        required: false
        default: 'us-east-1'
        type: string
      role-to-assume:
        description: 'ARN of the IAM role to assume. Leave empty to use the static access keys.'
        required: false
        default: ''
        type: string
      role_duration_seconds:
        description: "The duration in seconds for the AWS IAM role session."
        required: false
        type: number
        default: 3600
      role_skip_session_tagging:
        description: "Whether to skip adding session tags when assuming the AWS IAM role."
        required: false
        type: boolean
        default: true
      stack-name:
        description: 'Stack name defined'
        required: true
        type: string
      template-path:
        description: 'Cloudformation template path add here'
        required: true
        type: string
      organization-name:
        description: ' GitHub organization name'
        required: true
        type: string
      GitHub-repo-name:
        description: ' GitHub repo name'
        required: true
        type: string
      GitHub-branch:
        description: 'GitHub branch name'
        required: true
        default: 'main'
        type: string
      code-folder:
        description: 'Code folder where your lambda code stored ex-src(format-.ts/.py)'
        required: false
        default: 'src'
        type: string
      zip-file-name:
        description: 'Name of zip file which converted into zip & adding into S3 bucket'
        required: true
        default: 'main.zip'
        type: string
      parameter-overrides:
        description: 'The parameters to override in the stack inputs. You can pass a comma-delimited list or a file URL. The comma-delimited list has each entry formatted as <ParameterName>=<ParameterValue> or <ParameterName>="<ParameterValue>,<ParameterValue>".'
        required: false
        type: string
      capabilities:
        description: "The comma-delimited list of stack template capabilities to acknowledge. Defaults to 'CAPABILITY_IAM'"
        required: false
        default: "CAPABILITY_IAM"
        type: string

    secrets:
      AWS_ACCESS_KEY_ID:
        required: false
        description: 'AWS Access Key ID to install AWS CLI.'
      AWS_SECRET_ACCESS_KEY:
        required: false
        description: 'AWS Secret access key to install AWS CLI'
      AWS_SESSION_TOKEN:
        required: false
        description: 'AWS Session Token to install AWS CLI'
      ROLE-TO-ASSUME:
        required: false
        description: 'AWS Role ARN defined'
      GITHUB:
        required: false
        description: 'GitHub token'
      NAORU_API_KEY:
        required: false
        description: 'API key for naoru AI failure diagnosis (OpenRouter provider by default).'

jobs:
  deploy-cf-stack:
    runs-on: ubuntu-latest

    steps:
      - name: 📦 Checkout Repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: 📥 Checkout code from another Repo
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          repository: ${{ inputs.organization-name }}/${{ inputs.GitHub-repo-name }}
          ref: ${{ inputs.GitHub-branch }}
          token: ${{ secrets.GITHUB }}
          path: ${{ inputs.GitHub-repo-name }}

      - name: 🔐 Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID}}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-session-token: ${{ secrets.AWS_SESSION_TOKEN }}
          aws-region: ${{ inputs.aws-region }}
          role-to-assume: ${{ inputs.role-to-assume }}
          role-duration-seconds: ${{ inputs.role_duration_seconds }}
          role-skip-session-tagging: ${{ inputs.role_skip_session_tagging }}

      - name: 📦 Src folder code convert into zip and upload to S3
        run: |
            cd ${{ inputs.GitHub-repo-name }}/${{ inputs.code-folder }}
            find . -maxdepth 1 -type f -exec zip  ${{inputs.zip-file-name}} {} +
            run: |
            aws s3 cp  ${{inputs.zip-file-name}} s3://${{ inputs.s3-bucket }}/${{ inputs.bucket-prefix }}/

      - name: 🚀 Deploy cloudformation stack using template
        uses: aws-actions/aws-cloudformation-github-deploy@81e3b03d2266bcb76c4bcc37a7d71d9cb67838bb # v2.2.0
        with:
          name: ${{ inputs.stack-name }}
          template: ${{ inputs.template-path }}
          no-fail-on-empty-changeset: "1"
          parameter-overrides: ${{ inputs.parameter-overrides }}
          capabilities: ${{ inputs.capabilities }}

  naoru:
    name: 🩺 Diagnose failure (naoru)
    needs: [deploy-cf-stack]
    if: ${{ failure() }}
    runs-on: ubuntu-latest
    permissions:
      contents: read
      actions: read
      pull-requests: write
    steps:
      - name: 🩺 Diagnose with naoru
        env:
          NAORU_KEY: ${{ secrets.NAORU_API_KEY }}
        if: ${{ env.NAORU_KEY != '' }}
        uses: clouddrove/naoru@1fbf9f8977d855a35865c771679bb51f7474e397 # v0.2.3
        with:
          api-key: ${{ secrets.NAORU_API_KEY }}
          provider: openrouter
          model: openai/gpt-4o
...