reusable_deploy_v3_layer_stack.yml

name: Deploy CDK Layer v3 stack

# PROCESS
#
# 1. Split what AWS regions support ARM vs regions that Lambda support ARM
# 2. We build the Lambda layer for 3.10 to 3.14 Python runtime and both x86_64 and arm64 (see `matrix` section)
# 3. Deploy previously built layer for each AWS commercial region
# 4. Export all published Layers as JSON
# 5. Deploy Canaries to every deployed region to test whether Powertools can be imported etc.

# USAGE
#
# NOTE: meant to be used with ./.github/workflows/publish_v3_layer.yml
#
# beta:
#   needs: build-layer
#   # lower privilege propagated from parent workflow (release.yml)
#   permissions:
#     id-token: write
#     contents: read
#     pages: write             # docs will be updated with latest Layer ARNs
#     pull-requests: write     # creation-action will create a PR with Layer ARN updates
#   uses: ./.github/workflows/reusable_deploy_v3_layer_stack.yml
#   secrets: inherit
#   with:
#     stage: "BETA"
#     environment: "layer-beta"
#     source_code_artifact_name: code.zip
#     source_code_integrity_hash: sha256string

on:
  workflow_call:
    inputs:
      stage:
        description: "Deployment stage (BETA, PROD)"
        required: true
        type: string
      environment:
        description: "GitHub Environment to use for encrypted secrets"
        required: true
        type: string
      source_code_artifact_name:
        description: "Artifact name to restore sealed source code"
        type: string
        required: true
      source_code_integrity_hash:
        description: "Sealed source code integrity hash"
        type: string
        required: true

permissions:
  contents: read

env:
  RELEASE_COMMIT: ${{ github.sha }}  # it gets propagated from the caller for security reasons

jobs:
  deploy-cdk-stack:
    runs-on: ubuntu-latest
    environment: ${{ inputs.environment }}
    # lower privilege propagated from parent workflow (publish_v3_layer.yml)
    permissions:
      id-token: write
      pull-requests: none
      contents: read
      pages: none
    defaults:
      run:
        working-directory: ./layer_v3
    strategy:
      fail-fast: false
      matrix:
        # To get a list of current regions, use:
        # aws ec2 describe-regions --all-regions --query "Regions[].RegionName" --output text | tr "\t" "\n" | sort
        region: ["af-south-1", "ap-east-1", "ap-northeast-1", "ap-northeast-2", "ap-northeast-3",
                 "ap-south-1", "ap-south-2", "ap-southeast-1", "ap-southeast-2", "ap-southeast-3",
                 "ap-southeast-4", "ap-southeast-5", "ap-southeast-7", "ca-central-1", "ca-west-1", "eu-central-1", "eu-central-2",
                 "eu-north-1", "eu-south-1", "eu-south-2", "eu-west-1", "eu-west-2", "eu-west-3",
                 "il-central-1", "mx-central-1", "sa-east-1", "us-east-1",
                 "us-east-2", "us-west-1", "us-west-2"]
        python-version: ["3.10","3.11","3.12","3.13","3.14"]
        include:
          - region: "af-south-1"
            has_arm64_support: "true"
          - region: "ap-east-1"
            has_arm64_support: "true"
          - region: "ap-northeast-1"
            has_arm64_support: "true"
          - region: "ap-northeast-2"
            has_arm64_support: "true"
          - region: "ap-northeast-3"
            has_arm64_support: "true"
          - region: "ap-south-1"
            has_arm64_support: "true"
          - region: "ap-south-2"
            has_arm64_support: "true"
          - region: "ap-southeast-1"
            has_arm64_support: "true"
          - region: "ap-southeast-2"
            has_arm64_support: "true"
          - region: "ap-southeast-3"
            has_arm64_support: "true"
          - region: "ap-southeast-4"
            has_arm64_support: "true"
          - region: "ap-southeast-5"
            has_arm64_support: "true"
          - region: "ap-southeast-7"
            has_arm64_support: "true"
          - region: "ca-central-1"
            has_arm64_support: "true"
          - region: "ca-west-1"
            has_arm64_support: "true"
          - region: "eu-central-1"
            has_arm64_support: "true"
          - region: "eu-central-2"
            has_arm64_support: "true"
          - region: "eu-north-1"
            has_arm64_support: "true"
          - region: "eu-south-1"
            has_arm64_support: "true"
          - region: "eu-south-2"
            has_arm64_support: "true"
          - region: "eu-west-1"
            has_arm64_support: "true"
          - region: "eu-west-2"
            has_arm64_support: "true"
          - region: "eu-west-3"
            has_arm64_support: "true"
          - region: "il-central-1"
            has_arm64_support: "true"
          - region: "mx-central-1"
            has_arm64_support: "true"
          - region: "sa-east-1"
            has_arm64_support: "true"
          - region: "us-east-1"
            has_arm64_support: "true"
          - region: "us-east-2"
            has_arm64_support: "true"
          - region: "us-west-1"
            has_arm64_support: "true"
          - region: "us-west-2"
            has_arm64_support: "true"
    steps:
      - name: checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
        with:
          ref: ${{ env.RELEASE_COMMIT }}

      - name: Restore sealed source code
        uses: ./.github/actions/seal-restore
        with:
          integrity_hash: ${{ inputs.source_code_integrity_hash }}
          artifact_name: ${{ inputs.source_code_artifact_name }}

      - name: Set up uv
        uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
        with:
          version: "0.12.19"
          enable-cache: true
      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@e1253824e5c10ff9df46874f81ed3ec929e19cfd # v6.3.0
        with:
          aws-region: ${{ matrix.region }}
          role-to-assume: ${{ secrets.AWS_LAYERS_ROLE_ARN }}
          mask-aws-account-id: true
      - name: Setup Node.js
        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
        with:
          node-version: "18.20.4"
      - name: Setup python
        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: ${{ matrix.python-version }}
      - name: Install dependencies
        run: uv sync --locked --no-build
      - name: install cdk and deps
        working-directory: ./
        run: |
          npm ci
          npx cdk --version
      - name: Download artifact
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: cdk-layer-artifact-py${{ matrix.python-version }}
          path: layer_v3
      - name: unzip artefact
        run: unzip cdk.py${{ matrix.python-version }}.out.zip
      - name: Define constants
        id: constants
        run: |
          PYTHON_VERSION=$(echo ${{ matrix.python-version }} | tr -d '.')
          echo "PYTHON_VERSION=${PYTHON_VERSION}" >> "$GITHUB_OUTPUT"
          LAYER_VERSION=${{ matrix.region }}-$PYTHON_VERSION-layer-version.txt
          echo "LAYER_VERSION=${LAYER_VERSION}" >> "$GITHUB_OUTPUT"
      - name: CDK Deploy Layer
        run: uv run --locked --no-build npx cdk deploy --app cdk.out --context region=${{ matrix.region }} --parameters HasARM64Support=${{ matrix.has_arm64_support }} "LayerV3Stack-python${{steps.constants.outputs.PYTHON_VERSION}}" --require-approval never --verbose --outputs-file cdk-outputs.json
      - name: Store latest Layer ARN
        if: ${{ inputs.stage == 'PROD' }}
        run: |
          mkdir cdk-layer-stack
          jq -r -c ".[\"LayerV3Stack-python${{steps.constants.outputs.PYTHON_VERSION}}\"].LatestLayerArn" cdk-outputs.json > cdk-layer-stack/${{steps.constants.outputs.LAYER_VERSION}}
          jq -r -c ".[\"LayerV3Stack-python${{steps.constants.outputs.PYTHON_VERSION}}\"].LatestLayerArm64Arn" cdk-outputs.json >> cdk-layer-stack/${{steps.constants.outputs.LAYER_VERSION}}
          cat cdk-layer-stack/${{steps.constants.outputs.LAYER_VERSION}}
      - name: Save Layer ARN artifact
        if: ${{ inputs.stage == 'PROD' }}
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: cdk-layer-stack-${{ matrix.region }}-${{ matrix.python-version }}
          path: ./layer_v3/cdk-layer-stack/* # NOTE: upload-artifact does not inherit working-directory setting.
          if-no-files-found: error
          retention-days: 1
      - name: CDK Deploy Canary
        run: uv run --locked --no-build npx cdk deploy --app cdk.out --context region=${{ matrix.region }} --parameters DeployStage="${{ inputs.stage }}" --parameters HasARM64Support=${{ matrix.has_arm64_support }} "CanaryV3Stack-python${{steps.constants.outputs.PYTHON_VERSION}}" --require-approval never --verbose