{"id":5415,"date":"2023-07-07T20:49:51","date_gmt":"2023-07-07T20:49:51","guid":{"rendered":"https:\/\/staging.elixirrdigital.com\/us\/?p=5415"},"modified":"2025-03-17T12:14:54","modified_gmt":"2025-03-17T12:14:54","slug":"using-github-actions-to-deploy-to-aws","status":"publish","type":"post","link":"https:\/\/staging.elixirrdigital.com\/us\/2023\/07\/07\/using-github-actions-to-deploy-to-aws\/","title":{"rendered":"Using GitHub Actions to Deploy to AWS"},"content":{"rendered":"

GitHub Actions allows developers to automate workflows and tasks associated with building, testing, and deploying their applications. <\/span><\/p>\n

\n

1. Introduction to GitHub Actions<\/h2>\n

GitHub Actions<\/a>\u00a0allows developers to automate workflows and tasks associated with building, testing, and deploying their applications.\u00a0Workflows<\/a>\u00a0can be customized to fit the specific needs of the project and can be triggered by events such as\u00a0pull requests<\/a>,\u00a0commits<\/a>, or\u00a0releases<\/a>. GitHub Actions is designed to be code-centric, which means that workflows are defined within the repository itself.<\/p>\n

 <\/p>\n

With GitHub Actions, you can integrate your code with, e.g.,\u00a0Amazon Web Services<\/a>(AWS) to streamline your development process. Integrating GitHub Enterprise with AWS using GitHub Actions can help you automate your infrastructure deployment and improve your overall development workflow.<\/p>\n

The following example is conducted inside the repository that is described in the\u00a0blog<\/a>.<\/p>\n

 <\/p>\n

Workflows must be stored in the .github\/workflows directory of the repository. Workflow files are stored with the .yml extension.<\/p>\n

 <\/p>\n

\"\"<\/p>\n<\/div>\n

 <\/p>\n

1.1 GitHub Events, Context, Basic Syntax<\/strong><\/p>\n

Workflow is a pipeline that will get triggered on a certain event. The event is defined in the beginning of the workflow code.<\/p>\n

For example, we have a \u2018create_branch.yml\u2019 workflow which gets triggered on a \u2018create\u2019 event, in other words, it gets created if a new branch or tag is created.<\/p>\n

Another example would be \u2018pr_opened.yml\u2019 which gets triggered when there is a new pull request opened or synchronized (this event occurs when we push an update to the branch which is associated with the already opened pull request) towards \u2018development\u2019, \u2018stage\u2019 or \u2018production\u2019 branches.<\/p>\n

GitHub Context<\/a>\u00a0is used to access metadata which GitHub stores during the workflow execution. That means that we can access certain data such as base branch, commit id, event etc.<\/p>\n

For example, if you see<\/p>\n

\n
${{ github.base_ref }}<\/pre>\n
in the code, that expression is accessing context to get the information about which branch is the base branch of this event. In other words, if the event is \u2018pull_request\u2019 \u2013 then the base branch is the branch that is getting merged into the environment branch. In our case that would be the feature branch.<\/h4>\n<\/div>\n
\"\"<\/p>\n
GitHub workflows use specific syntax to access information such as variables, secrets, contexts etc. If we want to access a\u00a0secret<\/a>, we will type:<\/p>\n
\n
${{ secrets.SECRET_NAME }}<\/pre>\n<\/div>\n
or for\u00a0variables<\/a>:<\/h4>\n
${{ vars.VARIABLE_NAME }}<\/pre>\n
To expand understanding of the workflow syntax, please refer to the documentation\u00a0here<\/a>.<\/p>\n
1.2 Example Description<\/strong><\/p>\n
In our example, we have two workflows \u2013 \u201cCreate Branch Workflow\u201d and \u201cPR Opened Workflow\u201d.<\/p>\n
\u201cCreate Branch Workflow\u201d is based on the repository level restriction, while \u201cPR Opened Workflow\u201d is our deployment link to AWS.<\/p>\n
Our repository setup has three environment branches \u2013 \u2018development\u2019, \u2018stage\u2019, \u2018production\u2019. We have one AWS account, that is why you will see that we are deleting\u00a0CloudFormation stacks<\/a>\u00a0created from \u2018development\u2019 and \u2018stage\u2019 environments; those deployments serve as test deployments, while deployments from \u2018production\u2019 environment serve as an official deployment.<\/p>\n
Ideally, we would have separate AWS accounts for each of the environments, but this example will serve its purpose to show how to use GitHub Actions for flexible repository-level restriction and integration with AWS by using AWS CLI and GitHub Marketplace.<\/p>\n
GitHub Marketplace<\/a>\u00a0is a platform where you can find apps (actions) which can be integrated in the workflow. Action provides an out-of-the-box solution which can streamline and improve workflow.<\/p>\n
Besides workflows, branches contain\u00a0CloudFormation template<\/a>\u00a0called \u2018s3_bucket.yml\u2019 that looks like this:<\/p>\n
\"\"<\/p>\n
This template, when deployed, creates an\u00a0S3<\/a>\u00a0bucket. The purpose of this template is to showcase AWS integration with GitHub Enterprise, so it is not necessary to describe it for this blog.<\/p>\n
1.3 create_branch.yml<\/strong><\/p>\n
This is a GitHub workflow that is triggered whenever a new branch is created in the repository. The workflow is designed to validate the branch name and ensure that it adheres to a specific naming convention.<\/p>\n
\"\"<\/p>\n
The workflow consists of a single job called \u201ccreate-branch\u201d that runs on the latest version of the Ubuntu operating system. The job includes two steps:<\/p>\n
    \n
  1. Checkout Repository: This step uses the \u201cactions\/checkout\u201d action to check out the repository and ensure that the latest changes are available for subsequent steps. The step uses the \u201cGITHUB_TOKEN\u201d secret to authenticate with the GitHub API (Application Programming Interface). This is a default secret token which does not need to be created manually.<\/li>\n
  2. Validate branch name: This step validates the name of the newly created branch to ensure that it starts with the prefix \u201cfeature\/\u201d. If the branch name does not start with this prefix, the step deletes the branch and generates an error message. If the branch name is valid, the step generates a success message.<\/li>\n<\/ol>\n
    The \u201cif\u201d statement at the beginning of the job ensures that the job is only executed if the event that triggered the workflow is a branch creation event. If the event is not a branch creation event, the job is skipped.<\/p>\n
    This basic workflow helps to ensure that all new branches in the repository adhere to a specific naming convention, which can help to improve consistency and organization in the development process. This is an example of how we can use GitHub workflow to enforce developers to adhere to the non-native rules.<\/p>\n
    1.3.1 Workflow Results<\/u><\/p>\n
    This workflow should be successful if user creates a new branch called \u201cfeature\/description\u201d where \u2018description\u2019 part can be anything \u2013 the only important thing is the \u201cfeature\/\u201d portion.<\/p>\n
    That implies that the workflow should fail if user creates a new branch which does not start with \u201cfeature\/\u201d.<\/p>\n
    Let\u2019s test the use case in which workflow should be\u00a0successful<\/strong>.<\/p>\n
    \"\"<\/p>\n
    Firstly, we should create a feature branch named \u201cfeature\/my-branch\u201d.<\/p>\n
    \"\"<\/p>\n
     <\/p>\n
    Then the workflow should get triggered.<\/p>\n
    \"\"<\/p>\n
     <\/p>\n
    The workflow ran successfully without any errors.<\/p>\n
    Now, let\u2019s test the use case in which workflow should fail.<\/p>\n
    \"\"<\/p>\n
    Creating branch called \u2018my-branch\u2019 \u2013 notice that we did not put \u201cfeature\/\u201d prefix.<\/p>\n
    \"\"<\/p>\n
    The workflow is triggered.<\/p>\n
    \"\"<\/p>\n
    The workflow returned an error and deleted the branch.<\/p>\n
    1.4 pr_opened.yml<\/strong><\/p>\n
    This is a GitHub workflow that is triggered whenever a new pull request is opened. In this case, the workflow will run when a pull request is opened or synchronized on one of the specified branches: development, stage, or production. The workflow is designated to validate the CloudFormation template, deploy to the AWS account and delete the\u00a0CloudFormation<\/a>\u00a0stack if the target branch is not \u2018production\u2019.<\/p>\n
    \"\"<\/p>\n
    We will go through the code – section by section.<\/p>\n
    \"\"<\/p>\n
    This section defines the event that will trigger the workflow. In this case, the workflow will run when a pull request is opened or synchronized on one of the specified branches: development, stage, or production.<\/p>\n
    \"\"<\/p>\n
    This section defines the required permissions for the workflow to run. The id-token permission is set to write, which allows the workflow to create or delete branch heads, and the contents permission is set to write, which allows the workflow to create or update files in the repository.<\/p>\n
    \"\"<\/p>\n
    This section defines the job that will run when the workflow is triggered. The build job runs on a\u00a0ubuntu-latest<\/a>\u00a0machine and in a specific\u00a0GitHub environment<\/a>\u00a0based on the \u201cgithub.base_ref\u201d. The \u201cgithub.base_ref\u201d variable is set to the base branch of the pull request.<\/p>\n
    \"\"<\/p>\n
    This step checks out the head branch of the pull request using the \u201cactions\/checkout\u201d action. It uses the GITHUB_TOKEN secret to authenticate with GitHub and fetches the entire commit history (fetch-depth: 0).<\/p>\n
    \"\"<\/p>\n
    This step configures the AWS credentials using the \u201caws-actions\/configure-aws-credentials\u201d action. It specifies the AWS region, the role to assume, and the duration of the assumed role.<\/p>\n
    \"\"<\/p>\n
    This step validates a CloudFormation template using AWS CLI. It uses the \u201caws cloudformation validate-template\u201d command to validate the template named \u201cs3_bucket.yml\u201d.<\/p>\n
    \"\"<\/p>\n
    This step deploys the CloudFormation template using the \u201caws-actions\/aws-cloudformation-github-deploy\u201d action. It specifies the name of the CloudFormation stack, the template file, and the parameter overrides. The if statement ensures that this step only runs if the previous step was successful.<\/p>\n
    \"\"<\/p>\n
    This step waits for 30 seconds before proceeding to the next step, this gives us just enough time to check CloudFormation logs and validate that everything is created as expected.<\/p>\n
    \"\"<\/p>\n
    This step will delete the CloudFormation stack if the infrastructure was not deployed from \u2018production\u2019. That is because if we deploy from either \u2018development\u2019 or \u2018stage\u2019 that is just for testing, while if we deploy from \u2018production\u2019, that should be permanent change.<\/p>\n
    1.4.1 Workflow Results<\/u><\/p>\n
    This workflow will get triggered when a new pull request is created towards the environment branch. Let\u2019s test that.<\/p>\n
    \"\"<\/p>\n
    Creating a new pull request from \u201cfeature\/new-feature\u201d to \u201cdevelopment\u201d.<\/p>\n
    \"\"<\/p>\n
     <\/p>\n
    This is how the pull request looks initially. Notice that merging is blocked because the check (workflow job) is required to pass successfully, and we also need a review from code owner (Marin in this case).<\/p>\n
    \"\"<\/p>\n
    While the workflow is running, we can look at CloudFormation to check if our stack is created and deleted as defined in the code. We can see that everything is running as expected and that the stack is deleted.<\/p>\n
    \"\"<\/p>\n
    We can see that the workflow is executed successfully, therefore Marin will approve the pull request.<\/p>\n
    \"\"<\/p>\n
    After Marin approved the pull request, we can merge \u201cfeature\/new-branch\u201d to \u201cdevelopment\u201d branch.<\/p>\n
    2. Conclusion<\/h2>\n
    In conclusion, we have covered basic example of using GH Actions in GH Enterprise to manage simple infrastructure on AWS. That includes using GH Actions to deploy CloudFormation template to AWS.<\/p>\n
    I hope this blog has given you a good overview of GitHub Enterprise and its capabilities. Whether you are a developer or project owner, you should now feel more confident about exploring GH Enterprise world and leveraging its advanced features.<\/p>\n
    Nevertheless, the features covered in this blog are not all functionalities of GH Enterprise, so we encourage you to explore it as it provides a variety of flexible solutions that will help your organization.<\/p>\n
    Rest assured that our dedicated\u00a0DevSecOps<\/a>\u00a0team is here to support you every step of the way. Whether it\u2019s designing, managing, or building infrastructures within GitHub Enterprise, we have you covered. Don\u2019t hesitate to reach out to us or share your thoughts\u00a0here<\/a>. We\u2019re always ready to provide assistance and help you succeed!<\/p>\n
     <\/p>\n","protected":false},"excerpt":{"rendered":"
    GitHub Actions allows developers to automate workflows and tasks associated with building, testing, and deploying their applications. 1. Introduction to GitHub Actions GitHub Actions\u00a0allows developers to automate workflows and tasks…<\/p>\n","protected":false},"author":7,"featured_media":5443,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[35],"tags":[],"related_service":[48,91],"related_industry":[],"class_list":["post-5415","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-dev-sec-ops"],"acf":[],"card":"
    \n            
    \n            \"\"        <\/div>\n        
    \n        
    \n                                                    
    \n                    Blog                <\/p>\n                        \n        
    \n            Using GitHub Actions to Deploy to AWS\n        <\/h2>\n    <\/a>        <\/div>\n                    
    \n                                    
    \n                        GitHub Actions allows developers to automate workflows and tasks associated with building, testing, and deploying their applications. 1. Introduction to GitHub Actions GitHub Actions\u00a0allows developers to automate workflows and tasks…                    <\/p>\n                                                                    
    \n                                                    
    \n                                07 July 2023                            <\/p>\n                                                                            
    \n                                                                                            
    \n                DevOps            <\/div>\n                                
    \n                IT Services            <\/div>\n                                                                                                            <\/div>\n                                            <\/div>\n                                            <\/div>\n            <\/div>\n<\/article>\n","_links":{"self":[{"href":"https:\/\/staging.elixirrdigital.com\/us\/wp-json\/wp\/v2\/posts\/5415","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/staging.elixirrdigital.com\/us\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/staging.elixirrdigital.com\/us\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/staging.elixirrdigital.com\/us\/wp-json\/wp\/v2\/users\/7"}],"replies":[{"embeddable":true,"href":"https:\/\/staging.elixirrdigital.com\/us\/wp-json\/wp\/v2\/comments?post=5415"}],"version-history":[{"count":0,"href":"https:\/\/staging.elixirrdigital.com\/us\/wp-json\/wp\/v2\/posts\/5415\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/staging.elixirrdigital.com\/us\/wp-json\/wp\/v2\/media\/5443"}],"wp:attachment":[{"href":"https:\/\/staging.elixirrdigital.com\/us\/wp-json\/wp\/v2\/media?parent=5415"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/staging.elixirrdigital.com\/us\/wp-json\/wp\/v2\/categories?post=5415"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/staging.elixirrdigital.com\/us\/wp-json\/wp\/v2\/tags?post=5415"},{"taxonomy":"related_service","embeddable":true,"href":"https:\/\/staging.elixirrdigital.com\/us\/wp-json\/wp\/v2\/related_service?post=5415"},{"taxonomy":"related_industry","embeddable":true,"href":"https:\/\/staging.elixirrdigital.com\/us\/wp-json\/wp\/v2\/related_industry?post=5415"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}