sst_workflow.yml

---
name: 🚀 Shared Workflow - SST Deploy

on:
  workflow_call:
    inputs:
      app-env:
        description: 'Application environment'
        required: true
        type: string
      preview:
        description: 'Create or destroy preview env'
        required: false
        type: string
        default: false
      working-directory:
        description: 'Working directory in repo'
        required: false
        type: string
        default: ./
      stack-name:
        description: 'Stack name'
        required: false
        default: ""
        type: string
      yarn-cache:
        description: 'Cache required or not for yarn install'
        type: string
        default: false
      deploy:
        description: 'Default deploy otherwise run diff command to detect changes in stacks'
        type: string
        default: true
      self-hosted:
        description: 'Deploy stack with github self hosted runner or not'
        type: string
        default: true
      provider:
        required: false
        type: string
        default: aws
        description: 'Cloud provider to run the workflow. e.g. azurerm, aws, gcp or digitalocean'
      aws_region:
        required: false
        type: string
        default: us-east-2
        description: 'AWS region of terraform deployment.'
      role_duration_seconds:
        description: "The duration in seconds for the AWS IAM role session."
        required: false
        type: number
        default: 3600
      role_skip_session_tagging:
        description: "Whether to skip adding session tags when assuming the AWS IAM role."
        required: false
        type: boolean
        default: true

    secrets:
      token:
        description: 'GitHub Token'
        required: false
      env-vars:
        description: 'Environment-variables to store in .env file'
        required: false
      build-role:
        required: false
        description: 'AWS OIDC role for aws authentication.'
      AWS_ACCESS_KEY_ID:
        required: false
        description: 'AWS Access Key ID to install AWS CLI.'
      AWS_SECRET_ACCESS_KEY:
        required: false
        description: 'AWS Secret access key to install AWS CLI'
      AWS_SESSION_TOKEN:
        required: false
        description: 'AWS Session Token to install AWS CLI'

jobs:
  setup:
    runs-on: ubuntu-latest
    outputs:
      runner: ${{ steps.step1.outputs.runner }}
    steps:
      - name: 🕵️ Check branch
        id: step1
        run: |
          if [ ${{ inputs.self-hosted }} == 'true' ]; then
            echo "runner=${{ inputs.app-env }}" >> "$GITHUB_OUTPUT"
          else
            echo "runner=ubuntu-latest" >> "$GITHUB_OUTPUT"
          fi

  sst-deploy:
    needs: [setup]
    runs-on: ${{ needs.setup.outputs.runner }}
    environment:
      name: ${{ (((github.event.action == 'opened' || github.event.action == 'synchronize') && inputs.preview == 'true') || (github.event.pull_request.merged == true && inputs.preview == 'false' && inputs.app-env == 'staging') || (inputs.app-env == 'production' && startsWith(github.ref, 'refs/tags/v'))) && ((inputs.preview == 'true' && (inputs.stack-name != '' && inputs.stack-name || github.head_ref) || inputs.app-env)) || '' }}
      url: ${{ ((github.event.action == 'opened' && inputs.preview == 'true') || (github.event.action == 'synchronize' && inputs.preview == 'true') || (github.event.pull_request.merged == true && inputs.preview == 'false' && inputs.app-env == 'staging') || (inputs.app-env == 'production' && startsWith(github.ref, 'refs/tags/v'))) && env.API_ENDPOINT_URL }}
    defaults:
      run:
        working-directory: ${{ inputs.working-directory }}

    name: 🚀 Run sst-deploy
    steps:
      - name: 📦 Checkout Repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: 📝 Update environment variable in .env file
        run: |
          if [ -n "${{ secrets.env-vars }}" ]; then
           echo -e "${{ secrets.env-vars }}" > ./.env
          fi

      - name: 🟦 Install AWS CLI
        if: ${{ inputs.provider == 'aws' }}
        uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-session-token: ${{ secrets.AWS_SESSION_TOKEN }}
          role-to-assume: ${{ secrets.build-role }}
          aws-region: ${{ inputs.aws_region }}
          role-duration-seconds: ${{ inputs.role_duration_seconds }}
          role-skip-session-tagging: ${{ inputs.role_skip_session_tagging }}

      - name: 📦 Install yarn
        run: sudo npm install -g yarn

      - name: 📥 Install dependencies
        if: ${{ inputs.yarn-cache != 'true' }}
        run: yarn install --frozen-lockfile

      - name: 📦 Install dependencies with yarn cache
        if: ${{ inputs.yarn-cache == 'true' }}
        uses: ./.github/actions/yarn-nm-install

      - name: 🌿 Set branch name
        run: |
          BRANCH_NAME=$(echo "${{ github.head_ref }}" | cut -d'|' -f2)
          echo "BRANCH_NAME=${BRANCH_NAME}"
          SLUG_BRANCH_NAME=$(echo "${BRANCH_NAME}" | sed 's/[^[:alnum:]]/-/g' | tr -s '-' | tr A-Z a-z)
          echo "SLUG_BRANCH_NAME=${SLUG_BRANCH_NAME}"
          echo "GITHUB_HEAD_REF_SLUG=${SLUG_BRANCH_NAME}" >> $GITHUB_ENV

      - name: 🔍 Check diffrence in deployed and local stacks
        if: ${{ inputs.deploy != 'true' }}
        run: yarn sst diff --stage ${{ inputs.app-env }}

      - name: 🚀 Deploy and get API endpoint
        if: ${{ inputs.deploy == 'true' && ((github.event.action == 'opened' && inputs.preview == 'true') || (github.event.action == 'synchronize' && inputs.preview == 'true') || (github.event.pull_request.merged == true && inputs.preview == 'false' && inputs.app-env == 'staging') || (inputs.app-env == 'production' && startsWith(github.ref, 'refs/tags/v'))) }}
        run: |
          if [[ ${{ inputs.preview }} == true ]]; then
            if [[ -n "${{ inputs.stack-name }}" ]]; then
              yarn sst deploy --stage pr-${{ github.event.number }}-${{ env.GITHUB_HEAD_REF_SLUG }} ${{ inputs.stack-name }} | tee deploy-output.log
            else
              yarn sst deploy --stage pr-${{ github.event.number }}-${{ env.GITHUB_HEAD_REF_SLUG }} | tee deploy-output.log
            fi
          else
            if [[ -n "${{ inputs.stack-name }}" ]]; then
              yarn sst deploy --stage ${{ inputs.app-env }} ${{ inputs.stack-name }} | tee deploy-output.log
            else
              yarn sst deploy --stage ${{ inputs.app-env }} | tee deploy-output.log
            fi
          fi
          api_endpoint=$(cat deploy-output.log | egrep "ApiEndpoint|SiteUrl" | awk '{print $2}')
          echo "API endpoint: $api_endpoint"
          echo "API_ENDPOINT_URL=$api_endpoint" >> $GITHUB_ENV

      - name: 🗑️ Destroy preview env
        if: ${{ ( github.event.action == 'labeled' && github.event.label.name == 'destroy' && inputs.preview == 'true' ) || (github.event.action == 'closed' && inputs.preview == 'true' || github.event.pull_request.merged == true && inputs.preview == 'true' ) }}
        run: yarn sst remove --stage pr-${{ github.event.number }}-${{ env.GITHUB_HEAD_REF_SLUG }}

      - name: 🧹 Cleanup preview env deployment
        if: ${{ ( github.event.action == 'labeled' && github.event.label.name == 'destroy' && inputs.preview == 'true' ) || (github.event.action == 'closed' && inputs.preview == 'true' || github.event.pull_request.merged == true && inputs.preview == 'true' ) }}
        uses: strumwolf/delete-deployment-environment@035f6d27c8b8951729f4d71b2d3d6a7975139476 # v4.0.0
        with:
          token: ${{ secrets.token }}
          environment: ${{ github.head_ref }}
...