deploy-lambda-function.yaml

name: Deploy Lambda Function

on:
  workflow_call:
    secrets:
      ACCOUNT_ID:
        required: true

permissions:
  contents: read
  packages: read
  id-token: write

jobs:
  deploy-lambda:
    runs-on: ubuntu-latest
    env:
      ACCOUNT_ID: ${{ secrets.ACCOUNT_ID }}

    steps:
      - uses: actions/checkout@v3

      - name: Log in to GitHub Container Registry
        uses: docker/login-action@v2
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Set image tags
        id: meta
        run: |
          if [[ "${GITHUB_REF}" == refs/tags/* ]]; then
            VERSION="${GITHUB_REF#refs/tags/}"
            echo "[+] Current tags: ${VERSION}, latest"
            echo "tags=${VERSION},latest" >> $GITHUB_OUTPUT
          else
            echo "[+] Current tag: latest"
            echo "tags=latest" >> $GITHUB_OUTPUT
          fi

      - name: Pull Lambda container image
        run: |
          TAGS="${{ steps.meta.outputs.tags }}"
          PRIMARY_TAG=$(echo "$TAGS" | cut -d',' -f1)

          docker pull ghcr.io/bblue530/repovault_lambda:$PRIMARY_TAG

      - name: Configure AWS credentials via OIDC
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::${{ secrets.ACCOUNT_ID }}:role/repovault-github-ci-cd-deploy-upload-oidc-role
          aws-region: eu-north-1

      - name: Push image to ECR and Update Lambda
        run: |
          TAGS="${{ steps.meta.outputs.tags }}"
          PRIMARY_TAG=$(echo "$TAGS" | cut -d',' -f1)
          IFS=',' read -ra TAG_ARRAY <<< "$TAGS"

          aws ecr describe-repositories --repository-names repovault_lambda || \
            aws ecr create-repository --repository-name repovault_lambda

          docker login \
            --username AWS \
            --password $(aws ecr get-login-password --region eu-north-1) \
            $ACCOUNT_ID.dkr.ecr.eu-north-1.amazonaws.com

          for TAG in "${TAG_ARRAY[@]}"; do
            echo "[+] Tagging and pushing: $TAG"

            docker tag \
              ghcr.io/bblue530/repovault_lambda:$PRIMARY_TAG \
              $ACCOUNT_ID.dkr.ecr.eu-north-1.amazonaws.com/repovault_lambda:$TAG

            docker push \
              $ACCOUNT_ID.dkr.ecr.eu-north-1.amazonaws.com/repovault_lambda:$TAG
          done

          aws lambda update-function-code \
          --function-name repovault_lambda \
          --image-uri $ACCOUNT_ID.dkr.ecr.eu-north-1.amazonaws.com/repovault_lambda:$PRIMARY_TAG