==============================================================================

Artifact: Infrastructure GitHub Actions Workflow

Workflow: DCI — Design & Deploy Cloud Infra

Thin wrapper around make targets. No business logic in YAML.

Copy to {project}-infra/.github/workflows/infra.yml

==============================================================================

name: Infrastructure

on:
push:
branches: [main]
paths:
- 'stacks/**'
- 'app.py'
- 'cdk.json'
- 'requirements.txt'
workflow_dispatch:
inputs:
action:
description: 'Infrastructure action to perform'
required: true
type: choice
options:
- deploy
- destroy
- status
- traffic-switch
- traffic-rollback
- traffic-status

permissions:
id-token: write # For OIDC federation with AWS
contents: read

env:
PYTHON_VERSION: '3.12'
NODE_VERSION: '20'

jobs:
# --------------------------------------------------------------------------
# Deploy — runs on push to main (stack changes) or manual trigger
# --------------------------------------------------------------------------
deploy:
if: >-
github.event_name == 'push' ||
(github.event_name == 'workflow_dispatch' && github.event.inputs.action == 'deploy')
runs-on: ubuntu-latest
environment: infrastructure
steps:
- uses: actions/checkout@v4

  - name: Configure AWS credentials (OIDC)
    uses: aws-actions/configure-aws-credentials@v4
    with:
      role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
      aws-region: ${{ vars.AWS_REGION }}

  - name: Setup Python
    uses: actions/setup-python@v5
    with:
      python-version: ${{ env.PYTHON_VERSION }}

  - name: Setup Node (for CDK CLI)
    uses: actions/setup-node@v4
    with:
      node-version: ${{ env.NODE_VERSION }}

  - name: Install dependencies
    run: make provision

  - name: Synthesize (dry run)
    run: make synth

  - name: Deploy all stacks
    run: make deploy

  - name: Show status
    run: make status

# --------------------------------------------------------------------------
# Destroy — manual trigger only, requires infrastructure environment approval
# --------------------------------------------------------------------------
destroy:
if: >-
github.event_name == 'workflow_dispatch' &&
github.event.inputs.action == 'destroy'
runs-on: ubuntu-latest
environment: infrastructure # Add required reviewers for safety
steps:
- uses: actions/checkout@v4

  - name: Configure AWS credentials (OIDC)
    uses: aws-actions/configure-aws-credentials@v4
    with:
      role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
      aws-region: ${{ vars.AWS_REGION }}

  - name: Setup Python
    uses: actions/setup-python@v5
    with:
      python-version: ${{ env.PYTHON_VERSION }}

  - name: Setup Node
    uses: actions/setup-node@v4
    with:
      node-version: ${{ env.NODE_VERSION }}

  - name: Install dependencies
    run: make provision

  - name: Destroy all stacks
    run: make destroy

# --------------------------------------------------------------------------
# Traffic switch — requires production environment approval
# --------------------------------------------------------------------------
traffic-switch:
if: >-
github.event_name == 'workflow_dispatch' &&
github.event.inputs.action == 'traffic-switch'
runs-on: ubuntu-latest
environment: production # Manual approval required
steps:
- uses: actions/checkout@v4

  - name: Configure AWS credentials (OIDC)
    uses: aws-actions/configure-aws-credentials@v4
    with:
      role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
      aws-region: ${{ vars.AWS_REGION }}

  - name: Setup Python
    uses: actions/setup-python@v5
    with:
      python-version: ${{ env.PYTHON_VERSION }}

  - name: Install dependencies
    run: make provision

  - name: Show current state
    run: make traffic-status

  - name: Switch traffic
    run: make traffic-switch

  - name: Verify switch
    run: make traffic-status

# --------------------------------------------------------------------------
# Traffic rollback — requires production environment approval
# --------------------------------------------------------------------------
traffic-rollback:
if: >-
github.event_name == 'workflow_dispatch' &&
github.event.inputs.action == 'traffic-rollback'
runs-on: ubuntu-latest
environment: production
steps:
- uses: actions/checkout@v4

  - name: Configure AWS credentials (OIDC)
    uses: aws-actions/configure-aws-credentials@v4
    with:
      role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
      aws-region: ${{ vars.AWS_REGION }}

  - name: Setup Python
    uses: actions/setup-python@v5
    with:
      python-version: ${{ env.PYTHON_VERSION }}

  - name: Install dependencies
    run: make provision

  - name: Rollback traffic
    run: make traffic-rollback

  - name: Verify rollback
    run: make traffic-status

# --------------------------------------------------------------------------
# Status — no approvals needed
# --------------------------------------------------------------------------
status:
if: >-
github.event_name == 'workflow_dispatch' &&
(github.event.inputs.action == 'status' || github.event.inputs.action == 'traffic-status')
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4

  - name: Configure AWS credentials (OIDC)
    uses: aws-actions/configure-aws-credentials@v4
    with:
      role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
      aws-region: ${{ vars.AWS_REGION }}

  - name: Setup Python
    uses: actions/setup-python@v5
    with:
      python-version: ${{ env.PYTHON_VERSION }}

  - name: Setup Node
    uses: actions/setup-node@v4
    with:
      node-version: ${{ env.NODE_VERSION }}

  - name: Install dependencies
    run: make provision

  - name: Infrastructure status
    run: make status

  - name: Traffic status
    run: make traffic-status