Deploy via GitHub Actions

MCE-3 Order: #3 Datalake Formation Has Dependencies

Updated 1 month, 2 weeks ago

Purpose

Deploy the CDK app through GitHub Actions with OIDC. Production path for a GitHub-hosted lake repo.

Lake Scope Contract (ci must be github_actions).
CDK Application (includes DeployStack).
Starter .github/workflows/deploy.yml — copy from the clone; do not invent a second pipeline. Template: https://github.com/FeatureFactory-io/ops-lake-starter/blob/main/.github/workflows/deploy.yml.
Skill GitHub Actions CI/CD → Recipe.

ci is gitlab_ci. Do not create deploy.yml "just in case".

Keep starter .github/workflows/deploy.yml.
Chicken-and-egg: laptop, same region as the contract: cdk bootstrap then cdk deploy OpsLakeDeploy (or --all) once. Read DeployRoleArn from stack outputs. GitHub → Settings → Secrets and variables → Actions → New repository secret AWS_DEPLOY_ROLE_ARN. Also OPSLAKE_GITHUB_PAT (repo, read:org). Never GITHUB_*. After that, never cdk deploy a shared env from a laptop.
permissions: id-token: write. Assume the deploy role via aws-actions/configure-aws-credentials. No AWS_ACCESS_KEY_ID.
Jobs: pytest → cdk deploy --all --require-approval never. Print DeployRoleArn, GithubWebhookUrl, StreamlitMartUrl to the job summary. IAM simulate Streamlit task-role S3 read.
OIDC trust both repo:{org}/{lake_repo}:* and repo:{org}@*/{lake_repo}@*:*. A main push AssumeRoleWithWebIdentity must succeed (check the Actions log).
After first GHA deploy, record URLs/ARNs in docs/deploy-manifest.yaml. Org webhook registration is the next human step (activity Stand Up Serverless Ingestion) — deploy does not by itself land events.

Pipeline + populate-lake. Shared-env resources appear only after this workflow runs on main.

Lock the lake's scope and stand the AWS estate up as code so every later step lands on the same …

Agent: Data Platform Engineer Role Owns Datalake Formation: Scope Contract → Python CDK (DeployStack + …

Execute by Workflow Order execute-by-step-labels
GitHub OIDC Trust Both Sub Shapes github-oidc-trust-both-sub-shapes
Infrastructure as Code First infrastructure-as-code-first
Never Name GitHub Actions Secrets GITHUB_* never-name-gha-secrets-github-prefix

CDK Application (Infrastructure Stacks) Document Required
Produced by: Model the Data Lake as CDK Stacks
Lake Scope Contract Document Required
Produced by: Scope Sources, Org, and Environment
OIDC Deploy Role (GitHub Actions) Document Required
Produced by: Model the Data Lake as CDK Stacks