GitHub ActionsでAWS CloudFormationをデプロイしてみよう

name: Provision VPC Stack
on:
  workflow_dispatch:
    inputs:
      environment: 
        type: choice
        description: Provision target
        options: 
        - poc
        required: true
        default: poc

env:
  ENVIRONMENT: ${{ github.event.inputs.environment }}
  AWS_REGION: ap-northeast-1
  AWS_ROLE_ARN: {YOUR_GITHUB_ACTTIONS_ROLE_ARN}}

jobs:
  lint:
    name: Lint CloudFormation Template
    runs-on: self-hosted

    permissions:
      id-token: write
      contents: read

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Run cfn-lint
        run: |
          cfn-lint cloudformation/vpc.yaml --format junit --output-file cfn-lint-report.xml
        continue-on-error: true

      - name: Upload lint results
        uses: actions/upload-artifact@v4
        if: always()
        with:
          name: cfn-lint-results
          path: cfn-lint-report.xml

  validate:
    name: Validate CloudFormation Template
    runs-on: self-hosted

    permissions:
      id-token: write
      contents: read

    needs: lint
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ env.AWS_ROLE_ARN }}
          aws-region: ${{ env.AWS_REGION }}

      - name: Validate CloudFormation template
        run: |
          aws cloudformation validate-template \
            --template-body file://cloudformation/vpc.yaml

      - name: Display validation result
        run: |
          echo "### CloudFormation Validation ✅" >> $GITHUB_STEP_SUMMARY
          echo "Template validation successful" >> $GITHUB_STEP_SUMMARY

  deploy:
    name: Deploy VPC Stack
    runs-on: self-hosted
    needs: validate
    
    environment:
      name: ${{ github.event.inputs.environment }}

    permissions:
      id-token: write
      contents: read

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ env.AWS_ROLE_ARN }}
          aws-region: ${{ env.AWS_REGION }}

      - name: Verify AWS credentials
        run: aws sts get-caller-identity

      - name: Set stack name
        id: stack-info
        run: |
          STACK_NAME="provision-${{ env.ENVIRONMENT }}-vpc"
          echo "stack-name=${STACK_NAME}" >> $GITHUB_OUTPUT
          echo "Stack name: ${STACK_NAME}"

      - name: Deploy CloudFormation Stack
        env:
          STACK_NAME: ${{ steps.stack-info.outputs.stack-name }}
        run: |
          echo "Deploying CloudFormation stack: ${STACK_NAME}"
          
          aws cloudformation deploy \
            --stack-name ${STACK_NAME} \
            --template-file cloudformation/vpc.yaml \
            --parameter-overrides \
              Environment=${{ env.ENVIRONMENT }} \
              Subsystem=common \
              Usage=vpc \
            --tags \
              Environment=${{ env.ENVIRONMENT }} \
              ManagedBy=GitHub-Actions \
              Repository=${{ github.repository }} \
              DeployedBy=${{ github.actor }} \
            --no-fail-on-empty-changeset
          
          echo "Deployment completed!"

      - name: Get Stack Outputs
        id: stack-outputs
        env:
          STACK_NAME: ${{ steps.stack-info.outputs.stack-name }}
        run: |
          VPC_ID=$(aws cloudformation describe-stacks \
            --stack-name ${STACK_NAME} \
            --query 'Stacks[0].Outputs[?OutputKey==`VpcId`].OutputValue' \
            --output text 2>/dev/null || echo "Not available")
          
          VPC_CIDR=$(aws cloudformation describe-stacks \
            --stack-name ${STACK_NAME} \
            --query 'Stacks[0].Outputs[?OutputKey==`VpcCidr`].OutputValue' \
            --output text 2>/dev/null || echo "Not available")
          
          echo "vpc-id=${VPC_ID}" >> $GITHUB_OUTPUT
          echo "vpc-cidr=${VPC_CIDR}" >> $GITHUB_OUTPUT

      - name: Create Deployment Summary
        env:
          STACK_NAME: ${{ steps.stack-info.outputs.stack-name }}
          VPC_ID: ${{ steps.stack-outputs.outputs.vpc-id }}
          VPC_CIDR: ${{ steps.stack-outputs.outputs.vpc-cidr }}
        run: |
          echo "## 🚀 Deployment Summary" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "| Property | Value |" >> $GITHUB_STEP_SUMMARY
          echo "|----------|-------|" >> $GITHUB_STEP_SUMMARY
          echo "| Stack Name | \`${STACK_NAME}\` |" >> $GITHUB_STEP_SUMMARY
          echo "| VPC ID | \`${VPC_ID}\` |" >> $GITHUB_STEP_SUMMARY
          echo "| CIDR Block | \`${VPC_CIDR}\` |" >> $GITHUB_STEP_SUMMARY
          echo "| Environment | \`${{ env.ENVIRONMENT }}\` |" >> $GITHUB_STEP_SUMMARY
          echo "| Region | \`${{ env.AWS_REGION }}\` |" >> $GITHUB_STEP_SUMMARY

      - name: Cleanup
        if: always()
        run: rm -f /tmp/awscreds