deploy-lambda.yml

name: Deploy FileGenie to AWS Lambda

on:
  push:
    branches: [main]
  workflow_dispatch:

permissions:
  contents: read
  id-token: write

env:
  AWS_REGION: us-east-1
  ECR_REPOSITORY: filegenie
  STACK_NAME: filegenie
  DEPLOY_ROLE_ARN: arn:aws:iam::878223348670:role/github-actions-filegenie

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Configure AWS credentials with GitHub OIDC
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ env.DEPLOY_ROLE_ARN }}
          aws-region: ${{ env.AWS_REGION }}

      - name: Login to ECR
        id: ecr
        uses: aws-actions/amazon-ecr-login@v2

      - name: Configure Lambda ECR pull policy
        run: |
          aws ecr set-repository-policy \
            --repository-name "$ECR_REPOSITORY" \
            --policy-text file://ecr-policy.json

      - name: Build and push image
        env:
          REGISTRY: ${{ steps.ecr.outputs.registry }}
        run: |
          docker build -f Dockerfile -t "$REGISTRY/$ECR_REPOSITORY:$GITHUB_SHA" .
          docker push "$REGISTRY/$ECR_REPOSITORY:$GITHUB_SHA"
      - name: Deploy
        env:
          IMAGE_URI: ${{ steps.ecr.outputs.registry }}/${{ env.ECR_REPOSITORY }}:${{ github.sha }}
        run: |
          aws cloudformation deploy \
            --template-file template.ci.yaml \
            --stack-name "$STACK_NAME" \
            --capabilities CAPABILITY_IAM \
            --parameter-overrides ImageUri="$IMAGE_URI" \
            --no-fail-on-empty-changeset

      - name: Show outputs
        run: |
          aws cloudformation describe-stacks \
            --stack-name "$STACK_NAME" \
            --query 'Stacks[0].Outputs' \
            --output table