GitHub Actions + ecspressoでCI/CDパイプラインを構築する

import { Construct } from 'constructs';

import * as iam from 'aws-cdk-lib/aws-iam';

import { Props } from '@bin/main';

export class Iam extends Construct {
  constructor(scope: Construct, id: string, props: Props) {
    super(scope, id);

    const repoName = process.env.GIT_REPO;

    if (repoName) {
      const oidcProvider = new iam.OpenIdConnectProvider(
        this,
        'GitHubOIDCProvider',
        {
          url: 'https://token.actions.githubusercontent.com',
          clientIds: ['sts.amazonaws.com'],
        },
      );

      new iam.Role(this, 'GitHubOIDCRole', {
        roleName: `${props.prefix}-github-oidc-role`,
        assumedBy: new iam.FederatedPrincipal(
          oidcProvider.openIdConnectProviderArn,
          {
            StringEquals: {
              'token.actions.githubusercontent.com:aud': 'sts.amazonaws.com',
            },
            StringLike: {
              'token.actions.githubusercontent.com:sub': [
                `repo:${repoName}:ref:refs/heads/*`,
                `repo:${repoName}:pull_request`,
              ],
            },
          },
          'sts:AssumeRoleWithWebIdentity',
        ),
        managedPolicies: [
          iam.ManagedPolicy.fromAwsManagedPolicyName('AdministratorAccess'),
        ],
      });
    }
  }
}

./cdk.sh deploy:n 

name: cdk workflow

permissions:
  id-token: write
  contents: read

on:
  push:
    branches: [main]
  workflow_dispatch:

env:
  # Github Actionsを実行しているリポジトリ名を取得
  GIT_REPO: ${{ github.repository }}

jobs:
  initialize:
    runs-on: ubuntu-latest
    permissions: read-all
    outputs:
      infra_changed: ${{ steps.filter.outputs.infra }}
    steps:
      - name: Checkout Repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      # infraディレクトリ以下のファイル変更を検知
      - name: Detect File Changes
        uses: dorny/paths-filter@v3
        id: filter
        with:
          base: ${{ github.event.before }}
          filters: |
            infra:
              - 'infra/bin/**'
              - 'infra/lib/**'

  deploy:
    runs-on: ubuntu-latest
    needs: [initialize]
    # infraディレクトリ以下のファイル変更があった場合のみデプロイを実行
    if: |
      github.event_name == 'push' &&
      needs.initialize.outputs.infra_changed == 'true'
    steps:
      - name: Checkout Repository
        uses: actions/checkout@v4

      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: '20'

      - name: npm install
        shell: bash
        run: |
          npm install
        working-directory: infra

      - name: Set Credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ secrets.ROLE_TO_ASSUME }}
          aws-region: ap-northeast-1

      - name: Run CDK Deploy
        run: |
          npm run cdk:diff -- -c isFirst=n
        working-directory: infra

name: ecsoreso workflow

permissions:
  id-token: write
  contents: read

on:
  push:
    branches: [main]
  workflow_dispatch:

env:
  SYS_NAME: ecspresso-demo
  CLUSTER: cluster
  SERVICE: service
  TAG: ${{ github.sha }} # コミットハッシュを取得
  APPLICATION_NAME: ecs-app
  DEPLOYMENT_GROUP_NAME: ecs-deploy-group
  ECR_URI: ${{ secrets.ECR_URI }} # シークレットからECR URIを取得

jobs:
  initialize:
    runs-on: ubuntu-latest
    permissions: read-all
    outputs:
      app_changed: ${{ steps.filter.outputs.app }}
    steps:
      - name: Checkout Repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      # appディレクトリ以下のファイル変更を検知
      - name: Detect File Changes
        uses: dorny/paths-filter@v3
        id: filter
        with:
          base: ${{ github.event.before }}
          filters: |
            app:
              - 'app/main.go'
              - 'app/ecspresso/**'

  deploy:
    runs-on: ubuntu-latest
    needs: [initialize]
    # appディレクトリ以下のファイル変更があった場合のみデプロイを実行
    if: |
      github.event_name == 'push' &&
      needs.initialize.outputs.app_changed == 'true'
    steps:
      - name: Checkout Repository
        uses: actions/checkout@v4

      - name: Set Credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ secrets.ROLE_TO_ASSUME }}
          aws-region: ap-northeast-1

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Setup Go
        uses: actions/setup-go@v5
        with:
          go-version: 1.22.5

      - name: Login to ECR
        uses: aws-actions/amazon-ecr-login@v2

      - name: Build and Push Image
        uses: docker/build-push-action@v5
        with:
          context: ./app
          platforms: linux/arm64
          push: true
          tags: ${{ env.ECR_URI }}:${{ github.sha }}

      - name: Set up ecspresso
        uses: kayac/ecspresso@v2
        with:
          version: latest

      - run: |
          ecspresso deploy --config ecspresso/ecspresso.jsonnet
        working-directory: app

curl -i http://ecspresso-demo-alb-xxxxxxxxxx.ap-northeast-1.elb.amazonaws.com
HTTP/1.1 200 OK
Date: Sat, 07 Dec 2024 12:19:59 GMT
Content-Type: text/plain; charset=UTF-8
Content-Length: 13
Connection: close     

Hello, World!%

package main

import (
	"net/http"

	"github.com/labstack/echo/v4"
)

func main() {
	e := echo.New()

	e.GET("/", func(c echo.Context) error {
		// return c.String(http.StatusOK, "Hello, World!") コメントアウト
		return c.String(http.StatusOK, "Welcome to ecspresso-demo!") // コメントアウト解除
	})

	e.Logger.Fatal(e.Start(":8080"))
}

git add .
git commit -m 'ecspresso demo'
git push origin HEAD

curl -i http://ecspresso-demo-alb-xxxxxxxxxx.ap-northeast-1.elb.amazonaws.com

HTTP/1.1 200 OK
Date: Sat, 07 Dec 2024 13:26:00 GMT
Content-Type: text/plain; charset=UTF-8
Content-Length: 26
Connection: close     

Welcome to ecspresso-demo!%