threat-classifier/.github/workflows/deploy.yml at main · ShieldCraft-AI/threat-classifier · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
name: Deploy

on:
  workflow_dispatch:
    inputs:
      environment:
        description: "Deployment environment (dev|staging|prod)"
        type: choice
        required: true
        options:
          - dev
          - staging
          - prod
      upload_artifacts:
        description: "Upload model artifact to S3 before deploy"
        type: boolean
        default: false
      execute_deploy:
        description: "Run cdk deploy after packaging"
        type: boolean
        default: false

permissions:
  contents: read

jobs:
  deploy:
    runs-on: ubuntu-latest
    environment:
      name: ${{ github.event.inputs.environment }}
      url: https://console.aws.amazon.com/sagemaker/home

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.11"

      - name: Install Poetry
        uses: abatilo/actions-poetry@v2
        with:
          poetry-version: "1.8.3"

      - name: Configure Poetry virtualenv
        run: poetry config virtualenvs.in-project true

      - name: Cache Poetry downloads
        uses: actions/cache@v4
        with:
          path: |
            ~/.cache/pypoetry
            ~/.cache/pip
          key: ${{ runner.os }}-poetry-${{ hashFiles('poetry.lock') }}
          restore-keys: |
            ${{ runner.os }}-poetry-

      - name: Cache virtualenv
        uses: actions/cache@v4
        with:
          path: .venv
          key: ${{ runner.os }}-venv-${{ github.event.inputs.environment }}-${{ hashFiles('poetry.lock') }}
          restore-keys: |
            ${{ runner.os }}-venv-${{ github.event.inputs.environment }}-
            ${{ runner.os }}-venv-

      - name: Install dependencies
        run: |
          poetry install --no-interaction --no-ansi

      - name: Package and deploy via workflow
        env:
          THREAT_ENV: ${{ github.event.inputs.environment }}
          THREAT_DEPLOY_CONFIRM: ${{ github.event.inputs.execute_deploy && 'I_UNDERSTAND_THE_COST' || '' }}
        run: |
          args=("deploy")
          if [ "${{ github.event.inputs.upload_artifacts }}" = "true" ]; then
            args+=("--upload")
          fi
          if [ "${{ github.event.inputs.execute_deploy }}" = "true" ]; then
            args+=("--execute")
          fi
          poetry run python scripts/deployment_workflow.py "${args[@]}" --env "${THREAT_ENV}"