Skip to content

Commit 363e5f2

Browse files
Hirose-Sebastian-TaikaiHirose-Sebastian-Taikai
committed
feat: Add comprehensive CI/CD pipeline and deployment automation
- Add GitHub Actions workflow for multi-environment deployment (main/deploy branches) - Create interactive setup scripts for AWS IAM roles and OIDC configuration - create_role.sh: Bash script for Linux/macOS/Windows Git Bash - create_role.ps1: PowerShell script for Windows - Add environment-specific deployment scripts - deploy-env.sh: Local deployment for development/production - deploy-env.ps1: PowerShell version for local deployment - Configure SAM CLI for multi-environment deployment - samconfig.toml: Environment-specific deployment parameters - template.yaml: CloudFormation template with environment parameters - Add GitHub Secrets setup documentation (GITHUB_SECRETS_SETUP.md) - Configure Git attributes for cross-platform compatibility - Update requirements.txt and VS Code settings - Implement branch-based environment mapping: - main branch → production environment - deploy branch → development environment - Add robust tool detection and installation for AWS CLI, SAM CLI, GitHub CLI - Support multiple authentication methods (OIDC, SSO, access keys) - Fix SAM CLI detection to prioritize sam.cmd on Windows
1 parent 2082d3d commit 363e5f2

11 files changed

Lines changed: 2970 additions & 7 deletions

‎.gitattributes‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
# シェルスクリプトは常にLFを使用
2+
*.sh text eol=lf
3+
4+
# PowerShellスクリプトは常にCRLFを使用
5+
*.ps1 text eol=crlf
6+
7+
# その他のテキストファイル
8+
*.txt text eol=lf
9+
*.md text eol=lf
10+
*.yml text eol=lf
11+
*.yaml text eol=lf
12+
*.json text eol=lf
13+
*.py text eol=lf
14+
*.js text eol=lf
15+
*.ts text eol=lf
16+
*.html text eol=lf
17+
*.css text eol=lf
18+
*.xml text eol=lf
19+
20+
# バイナリファイル
21+
*.png binary
22+
*.jpg binary
23+
*.jpeg binary
24+
*.gif binary
25+
*.ico binary
26+
*.pdf binary
27+
*.zip binary
28+
*.tar binary
29+
*.gz binary
30+
*.exe binary
31+
*.dll binary
32+
*.so binary
33+
*.dylib binary

‎.github/workflows/deploy.yml‎

Lines changed: 79 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
name: Deploy to AWS CloudFormation
2+
3+
on:
4+
push:
5+
branches:
6+
- main
7+
- deploy
8+
9+
env:
10+
AWS_REGION: ap-northeast-1
11+
PROJECT_NAME: LambdaFramework
12+
13+
permissions:
14+
id-token: write
15+
contents: read
16+
17+
jobs:
18+
deploy:
19+
runs-on: ubuntu-latest
20+
21+
# ブランチに基づいてデプロイ設定を決定
22+
strategy:
23+
matrix:
24+
branch: [main, deploy]
25+
include:
26+
- branch: main
27+
stack_name: lambda-framework-prod
28+
s3_bucket: cn-seba-aws-sam-cli-managed-default-samclisourcebucket
29+
environment: production
30+
aws_role_arn: ${{ secrets.AWS_ROLE_ARN_PROD }}
31+
aws_region: ap-northeast-1
32+
- branch: deploy
33+
stack_name: lambda-framework-dev
34+
s3_bucket: cn-seba-aws-sam-cli-managed-default-samclisourcebucket
35+
environment: development
36+
aws_role_arn: ${{ secrets.AWS_ROLE_ARN_DEV }}
37+
aws_region: ap-northeast-1
38+
39+
steps:
40+
- name: Checkout code
41+
uses: actions/checkout@v4
42+
43+
- name: Set up Python
44+
uses: actions/setup-python@v4
45+
with:
46+
python-version: '3.10'
47+
48+
- name: Install dependencies
49+
run: |
50+
python -m pip install --upgrade pip
51+
pip install -r requirements.txt
52+
53+
- name: Validate SAM template
54+
run: |
55+
sam validate
56+
57+
- name: Configure AWS credentials
58+
uses: aws-actions/configure-aws-credentials@v4
59+
with:
60+
role-to-assume: ${{ matrix.aws_role_arn }}
61+
aws-region: ${{ matrix.aws_region }}
62+
63+
- name: Deploy with SAM
64+
run: |
65+
sam build
66+
sam deploy --no-confirm-changeset --no-fail-on-empty-changeset \
67+
--stack-name ${{ matrix.stack_name }} \
68+
--s3-bucket ${{ matrix.s3_bucket }} \
69+
--parameter-overrides ProjectName=${{ env.PROJECT_NAME }} Environment=${{ matrix.environment }}
70+
env:
71+
SAM_CLI_TELEMETRY: 0
72+
73+
- name: Deploy status
74+
if: always()
75+
run: |
76+
echo "Deployment completed for branch: ${{ github.ref }}"
77+
echo "Stack name: ${{ matrix.stack_name }}"
78+
echo "Environment: ${{ matrix.environment }}"
79+
echo "Commit: ${{ github.sha }}"

‎.vscode/settings.json‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
{
2+
"cfn-lint.executablePath": "cfn-lint",
3+
"cfn-lint.enable": true,
4+
"yaml.validate": true,
5+
"yaml.schemas": {
6+
"https://raw.githubusercontent.com/aws/aws-sam-cli/master/samcli/local/schema/schema.json": "template.yaml"
7+
}
8+
}

‎GITHUB_SECRETS_SETUP.md‎

Lines changed: 122 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,122 @@
1+
# GitHub Secrets設定ガイド
2+
3+
## 必要なGitHub Secrets
4+
5+
### 開発環境用
6+
- **`AWS_ROLE_ARN_DEV`**: 開発環境用のIAMロールARN
7+
- 例: `arn:aws:iam::123456789012:role/LambdaFramework-github-actions-role-dev`
8+
9+
### 本番環境用
10+
- **`AWS_ROLE_ARN_PROD`**: 本番環境用のIAMロールARN
11+
- 例: `arn:aws:iam::987654321098:role/LambdaFramework-github-actions-role-prod`
12+
13+
## 設定手順
14+
15+
### 1. GitHub Secretsの設定
16+
17+
1. GitHubリポジトリの **Settings** → **Secrets and variables** → **Actions** に移動
18+
2. **New repository secret** をクリック
19+
3. 以下のSecretsを追加:
20+
21+
```
22+
Name: AWS_ROLE_ARN_DEV
23+
Value: arn:aws:iam::<DEV_ACCOUNT_ID>:role/<DEV_ROLE_NAME>
24+
25+
Name: AWS_ROLE_ARN_PROD
26+
Value: arn:aws:iam::<PROD_ACCOUNT_ID>:role/<PROD_ROLE_NAME>
27+
```
28+
29+
### 2. IAMロールの作成
30+
31+
各AWSアカウントで以下のIAMロールを作成:
32+
33+
#### 開発環境用IAMロール
34+
```json
35+
{
36+
"Version": "2012-10-17",
37+
"Statement": [
38+
{
39+
"Effect": "Allow",
40+
"Action": [
41+
"cloudformation:*",
42+
"lambda:*",
43+
"s3:*",
44+
"iam:*",
45+
"logs:*"
46+
],
47+
"Resource": "*"
48+
}
49+
]
50+
}
51+
```
52+
53+
#### 本番環境用IAMロール
54+
```json
55+
{
56+
"Version": "2012-10-17",
57+
"Statement": [
58+
{
59+
"Effect": "Allow",
60+
"Action": [
61+
"cloudformation:*",
62+
"lambda:*",
63+
"s3:*",
64+
"iam:*",
65+
"logs:*"
66+
],
67+
"Resource": "*"
68+
}
69+
]
70+
}
71+
```
72+
73+
### 3. OIDCプロバイダーの設定
74+
75+
各AWSアカウントでGitHub Actions用のOIDCプロバイダーを設定:
76+
77+
```bash
78+
# 開発環境
79+
aws iam create-open-id-connect-provider \
80+
--url https://token.actions.githubusercontent.com \
81+
--client-id-list sts.amazonaws.com \
82+
--thumbprint-list 6938fd4d98bab03faadb97b34396831e3780aea1
83+
84+
# 本番環境
85+
aws iam create-open-id-connect-provider \
86+
--url https://token.actions.githubusercontent.com \
87+
--client-id-list sts.amazonaws.com \
88+
--thumbprint-list 6938fd4d98bab03faadb97b34396831e3780aea1
89+
```
90+
91+
## デプロイ先の確認
92+
93+
| ブランチ | AWSアカウント | スタック名 | 環境 |
94+
|---------|-------------|-----------|------|
95+
| `main` | 本番アカウント | `lambda-framework-prod` | production |
96+
| `deploy` | 開発アカウント | `lambda-framework-dev` | development |
97+
98+
## ローカルデプロイ
99+
100+
### Bash版
101+
```bash
102+
# 開発環境（デフォルトAWS Profile）
103+
./deploy-env.sh development
104+
105+
# 開発環境（指定AWS Profile）
106+
./deploy-env.sh development dev-profile
107+
108+
# 本番環境（指定AWS Profile）
109+
./deploy-env.sh production prod-profile
110+
```
111+
112+
### PowerShell版
113+
```powershell
114+
# 開発環境（デフォルトAWS Profile）
115+
.\deploy-env.ps1 development
116+
117+
# 開発環境（指定AWS Profile）
118+
.\deploy-env.ps1 development dev-profile
119+
120+
# 本番環境（指定AWS Profile）
121+
.\deploy-env.ps1 production prod-profile
122+
```

0 commit comments

Comments
 (0)