infrastructure-env #33

	name: infrastructure-env

	env:
	NODE_VERSION: 20
	OIDC_ROLE_ARN: arn:aws:iam::${{ vars.AWS_ACCOUNT_ID }}:role/saas-github-oidc-provider-role

	permissions:
	id-token: write
	contents: read

	on:
	workflow_run:
	workflows: ["ci"]
	branches: [main]
	types:
	- completed

	workflow_dispatch:
	inputs:
	environment:
	description: 'Environment to deploy: [dev]'
	type: environment
	required: true
	default: 'dev'

	concurrency: ${{ github.workflow }}-${{ github.ref }}

	jobs:
	changes:
	runs-on: ubuntu-latest
	outputs:
	infrastructure: ${{ steps.filter.outputs.infrastructure }}
	steps:
	- uses: actions/checkout@v4
	with:
	fetch-depth: 0
	- uses: dorny/paths-filter@v3
	id: filter
	with:
	base: main
	filters: \|
	infrastructure:
	- '.github/workflows/infrastructure.yml'
	- 'infrastructure/src/env/**'
	- '!*/.md'

	dev:
	if: ${{ needs.changes.outputs.infrastructure == 'true' }}
	needs: [changes]
	runs-on: ubuntu-latest
	environment: dev
	steps:
	- uses: actions/checkout@v4
	with:
	fetch-depth: 0
	- uses: actions/setup-node@v4
	with:
	node-version: ${{ env.NODE_VERSION }}

	- name: Install
	run: npm ci

	- name: Build
	working-directory: ./infrastructure
	run: \|
	npm run lint
	npm run build

	- name: Assume OIDC Role
	uses: aws-actions/configure-aws-credentials@v4
	with:
	role-session-name: dev-gh-infrastructure-deploy-session
	role-to-assume: ${{ env.OIDC_ROLE_ARN }}
	aws-region: ${{ vars.AWS_REGION }}

	- name: Synth
	working-directory: ./infrastructure
	run: npx cdk synth Dev* --require-approval never

	- name: Deploy
	working-directory: ./infrastructure
	run: npx cdk deploy Dev* --require-approval never

Provide feedback