feat: add site-deploy reusable workflow (Astro → ECR → ECS) - #47
Merged
Conversation
Extracts the near-identical deploy.yml from site-lentago-dev, site-icecreamtofightwith-com, and site-pondviewlane-com into a single reusable workflow_call definition. Parameterises exactly what differs across the three callers: ECR repo, ECS cluster/service, AWS region, OIDC role ARN, Node version, git fetch depth, an optional pre_build_command (for icecream's Python content sync), and optional build_env_vars (for pondview's PUBLIC_ASK_ENDPOINT). Preserves the deploy-main concurrency group, :latest + :sha tags, force-new-deployment, and the ecs wait services-stable call unchanged. Adds two capabilities that are cheap to centralise here: - Trivy image scan (informational, exit-code 0 — visibility without blocking) - actions/attest-build-provenance for SLSA Build L3 attestation (building in a reusable workflow satisfies L3 vs L2 for caller-hosted workflows); attestation is controllable via the `attest` boolean input (default true) All third-party action refs are SHA-pinned per repo convention. Callers migrate one repo at a time; no caller repos are modified in this PR. Closes #38 is intentionally omitted — the issue stays open until all three site repos have migrated. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
References #38.
Extracts the near-identical
deploy.ymlfromsite-lentago-dev,site-icecreamtofightwith-com, andsite-pondviewlane-cominto a singlesite-deploy.ymlworkflow_calldefinition in this repo. Callers migrate one repo at a time; no caller repos are modified here.What changed
New file:
.github/workflows/site-deploy.ymlParameterises exactly what differs across the three current callers:
ecr_repo,ecs_cluster,ecs_service,role_arnaws_regionus-east-1node_version20; pondview uses24fetch_depth1; pondview needs0for StarlightlastUpdatedpre_build_commandpython3 sync_recipes.pybeforenpm run buildbuild_env_varsKEY=VALUEpairs for build-time env; pondview usesPUBLIC_ASK_ENDPOINTattesttrueDeploy behaviour is unchanged from the three originals: same
:latest+:<sha>ECR tags, same--force-new-deployment, sameaws ecs wait services-stable.Two new capabilities added where centralising makes them essentially free:
exit-code: 0), CRITICAL/HIGH unfixed findings only. Reports in the job log without blocking the deploy, giving visibility without introducing a new breakage vector on live sites.actions/attest-build-provenance— building inside a reusable workflow (hosted in a repo callers cannot modify) satisfies SLSA Build L3 vs L2 for caller-hosted workflows. Attestation stored in GitHub's Sigstore-backed store; verify withgh attestation verify oci://<registry>/<ecr_repo>@<digest> --owner lentago. Controllable viaattestinput (defaulttrue).All third-party action refs are SHA-pinned per repo convention.
Updated:
README.md— fullsite-deploy.ymlsection with permissions table, minimum caller example (@v1.1.0), full input reference, and per-site examples for icecream and pondview.Updated:
CLAUDE.md— workflow table row added.What's not in this PR
Closes #38is intentionally omitted — issue stays open until all three sites have migrated and their inlinedeploy.ymlfiles are removed.Caller migration checklist (for follow-up PRs)
Each site needs a PR that:
.github/workflows/deploy.ymlwith a thin caller thatuses: lentago/shared-workflows/.github/workflows/site-deploy.yml@v1.1.0attestations: writeandpackages: readin the caller job permissionswith:inputs (see README examples)🤖 Generated with Claude Code