deploy-devops-spire-cd-pipeline-stack.yml

name: Deploy Spire CD pipeline CloudFormation stack

on:
  push:
    branches:
      - main
    paths:
      - spire/cd/template.yml
      - spire/cd/src/**

concurrency:
  group: ${{ github.workflow }}

jobs:
  deploy:
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read
    strategy:
      matrix:
        include:
          - region: us-east-1
            stack: infrastructure-cd
          - region: us-west-2
            stack: infrastructure-cd
    steps:
      - uses: actions/checkout@v4

      - uses: aws-actions/setup-sam@v2
        with:
          use-installer: true

      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-region: ${{ matrix.region }}
          role-to-assume: arn:aws:iam::561178107736:role/PRX-GHA-AccessRole
          role-session-name: gha-deploy-spire-cd

      - name: Deploy CloudFormation stack
        working-directory: spire/cd
        run: |
          sam deploy \
            --region "${{ matrix.region }}" \
            --no-confirm-changeset \
            --no-fail-on-empty-changeset \
            --stack-name "${{ matrix.stack }}" \
            --resolve-s3 \
            --s3-prefix "${{ matrix.stack }}" \
            --capabilities CAPABILITY_IAM \
            --role-arn arn:aws:iam::561178107736:role/PRX-GHA-ServiceRoleForCloudFormation