deploy-aws-lambda.yml

name: Deploy to AWS Lambda

on:
  push:
    branches: [main]
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  id-token: write
  contents: read

jobs:
  deploy:
    name: Deploy Lambda Function
    runs-on: ubuntu-latest
    environment: production

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'
          cache: 'npm'

      - name: Install dependencies
        run: npm ci --production

      - name: Build
        run: npm run build --if-present

      - name: Create deployment package
        run: |
          cd dist
          zip -r ../function.zip .
          cd ..
          zip -ur function.zip node_modules

      - name: Configure AWS credentials (OIDC)
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
          aws-region: ${{ vars.AWS_REGION || 'us-east-1' }}

      - name: Deploy to Lambda
        run: |
          aws lambda update-function-code \
            --function-name ${{ secrets.LAMBDA_FUNCTION_NAME }} \
            --zip-file fileb://function.zip

      - name: Wait for update
        run: |
          aws lambda wait function-updated \
            --function-name ${{ secrets.LAMBDA_FUNCTION_NAME }}

      - name: Publish new version
        id: publish
        run: |
          VERSION=$(aws lambda publish-version \
            --function-name ${{ secrets.LAMBDA_FUNCTION_NAME }} \
            --query 'Version' --output text)
          echo "version=$VERSION" >> $GITHUB_OUTPUT

      # Optional: Update alias to point to new version
      # - name: Update alias
      #   run: |
      #     aws lambda update-alias \
      #       --function-name ${{ secrets.LAMBDA_FUNCTION_NAME }} \
      #       --name production \
      #       --function-version ${{ steps.publish.outputs.version }}

  # Alternative: Deploy with SAM
  # deploy-sam:
  #   name: Deploy with SAM
  #   runs-on: ubuntu-latest
  #   environment: production
  #   steps:
  #     - uses: actions/checkout@v4
  #     - uses: aws-actions/setup-sam@v2
  #     - uses: aws-actions/configure-aws-credentials@v4
  #       with:
  #         role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
  #         aws-region: us-east-1
  #     - run: sam build
  #     - run: sam deploy --no-confirm-changeset --no-fail-on-empty-changeset

  # Alternative: Deploy with Serverless Framework
  # deploy-serverless:
  #   name: Deploy with Serverless
  #   runs-on: ubuntu-latest
  #   environment: production
  #   steps:
  #     - uses: actions/checkout@v4
  #     - uses: actions/setup-node@v4
  #       with:
  #         node-version: '20'
  #         cache: 'npm'
  #     - run: npm ci
  #     - run: npx serverless deploy --stage production
  #       env:
  #         AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
  #         AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}

# Required secrets:
# - AWS_ROLE_ARN: ARN of the IAM role to assume (for OIDC)
# - LAMBDA_FUNCTION_NAME: Name of the Lambda function
#
# Optional variables:
# - AWS_REGION: AWS region (defaults to us-east-1)
#
# IAM Role Permissions Policy:
# {
#   "Version": "2012-10-17",
#   "Statement": [
#     {
#       "Effect": "Allow",
#       "Action": [
#         "lambda:UpdateFunctionCode",
#         "lambda:PublishVersion",
#         "lambda:UpdateAlias",
#         "lambda:GetFunction"
#       ],
#       "Resource": "arn:aws:lambda:REGION:ACCOUNT_ID:function:FUNCTION_NAME"
#     }
#   ]
# }