deploy-devops-porter-cd-pipeline-stack.yml

name: Deploy Porter CD pipeline CloudFormation stacks

# This workflow updates the CloudFormations stacks that manage the continuous
# deployment pipelines for Porter. These pipelines exist in multiple regions,
# and this workflow updates all of them. This workflow is only intended to
# update **existing** stacks, not to launch new stacks.
#
# The stacks that this workflow interacts with are only for the deployment
# pipelines, **not** for Porter itself.
#
# tl;dr deploys devops/porter-cd-pipeline.yml

on:
  push:
    branches:
      - main
    paths:
      - devops/porter-cd-pipeline.yml

concurrency:
  group: ${{ github.workflow }}

jobs:
  deploy:
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read
    strategy:
      matrix:
        region:
          - us-east-1
          - us-east-2
          - us-west-2
    steps:
      - uses: actions/checkout@v4

      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-region: ${{ matrix.region }}
          role-to-assume: arn:aws:iam::561178107736:role/PRX-GHA-AccessRole
          role-session-name: gha-deploy-porter-cd

      - name: Deploy CloudFormation stack
        working-directory: devops
        run: |
          aws cloudformation deploy \
            --region ${{ matrix.region }} \
            --stack-name porter-cd-pipeline \
            --template-file porter-cd-pipeline.yml \
            --capabilities CAPABILITY_NAMED_IAM CAPABILITY_AUTO_EXPAND \
            --no-fail-on-empty-changeset \
            --role-arn arn:aws:iam::561178107736:role/PRX-GHA-ServiceRoleForCloudFormation