sst_workflow.yml

---
name: 🚀 Shared Workflow - SST Deploy

on:
  workflow_call:
    inputs:
      app-env:
        description: 'Application environment'
        required: true
        type: string
      preview:
        description: 'Create or destroy preview env'
        required: false
        type: string
        default: false
      working-directory:
        description: 'Working directory in repo'
        required: false
        type: string
        default: ./
      stack-name:
        description: 'Stack name'
        required: false
        default: ""
        type: string
      yarn-cache:
        description: 'Cache required or not for yarn install'
        type: string
        default: false
      deploy:
        description: 'Default deploy otherwise run diff command to detect changes in stacks'
        type: string
        default: true
      self-hosted:
        description: 'Deploy stack with github self hosted runner or not'
        type: string
        default: true

    secrets:
      token:
        description: 'GitHub Token'
        required: false
      env-vars:
        description: 'Environment-variables to store in .env file'
        required: false
      build-role:
        description: 'Assume role arn'
        required: true

jobs:
  setup:
    runs-on: ubuntu-latest
    outputs:
      runner: ${{ steps.step1.outputs.runner }}
    steps:
      - name: 🕵️ Check branch
        id: step1
        run: |
          if [ ${{ inputs.self-hosted }} == 'true' ]; then
            echo "runner=${{ inputs.app-env }}" >> "$GITHUB_OUTPUT"
          else
            echo "runner=ubuntu-latest" >> "$GITHUB_OUTPUT"
          fi

  sst-deploy:
    needs: [setup]
    runs-on: ${{ needs.setup.outputs.runner }}
    environment:
      name: ${{ (((github.event.action == 'opened' || github.event.action == 'synchronize') && inputs.preview == 'true') || (github.event.pull_request.merged == true && inputs.preview == 'false' && inputs.app-env == 'staging') || (inputs.app-env == 'production' && startsWith(github.ref, 'refs/tags/v'))) && ((inputs.preview == 'true' && (inputs.stack-name != '' && github.head_ref-inputs.stack-name || github.head_ref) || inputs.app-env)) || '' }}
      url: ${{ ((github.event.action == 'opened' && inputs.preview == 'true') || (github.event.action == 'synchronize' && inputs.preview == 'true') || (github.event.pull_request.merged == true && inputs.preview == 'false' && inputs.app-env == 'staging') || (inputs.app-env == 'production' && startsWith(github.ref, 'refs/tags/v'))) && env.API_ENDPOINT_URL }}
    defaults:
      run:
        working-directory: ${{ inputs.working-directory }}

    name: 🚀 Run sst-deploy
    steps:
      - name: 📦 Checkout Repository
        uses: actions/checkout@v7

      - name: 📝 Update environment variable in .env file
        run: |
          if [ -n "${{ secrets.env-vars }}" ]; then
           echo -e "${{ secrets.env-vars }}" > ./.env
          fi

      - name: 🔑 Configure AWS Creds via role
        uses: aws-actions/configure-aws-credentials@v6
        with:
          aws-region: us-west-2
          role-to-assume: ${{ secrets.build-role }}
          role-duration-seconds: 900
          role-skip-session-tagging: true

      - name: 📦 Install yarn
        run: sudo npm install -g yarn

      - name: 📥 Install dependencies
        if: ${{ inputs.yarn-cache != 'true' }}
        run: yarn install --frozen-lockfile

      - name: 📦 Install dependencies with yarn cache
        if: ${{ inputs.yarn-cache == 'true' }}
        uses: ./.github/actions/yarn-nm-install

      - name: 🌿 Set branch name
        run: |
          BRANCH_NAME=$(echo "${{ github.head_ref }}" | cut -d'|' -f2)
          echo "BRANCH_NAME=${BRANCH_NAME}"
          SLUG_BRANCH_NAME=$(echo "${BRANCH_NAME}" | sed 's/[^[:alnum:]]/-/g' | tr -s '-' | tr A-Z a-z)
          echo "SLUG_BRANCH_NAME=${SLUG_BRANCH_NAME}"
          echo "GITHUB_HEAD_REF_SLUG=${SLUG_BRANCH_NAME}" >> $GITHUB_ENV

      - name: 🔍 Check diffrence in deployed and local stacks
        if: ${{ inputs.deploy != 'true' }}
        run: yarn sst diff --stage ${{ inputs.app-env }}

      - name: 🚀 Deploy and get API endpoint
        if: ${{ inputs.deploy == 'true' && ((github.event.action == 'opened' && inputs.preview == 'true') || (github.event.action == 'synchronize' && inputs.preview == 'true') || (github.event.pull_request.merged == true && inputs.preview == 'false' && inputs.app-env == 'staging') || (inputs.app-env == 'production' && startsWith(github.ref, 'refs/tags/v'))) }}
        run: |
          if [[ ${{ inputs.preview }} == true ]]; then
            if [[ -n "${{ inputs.stack-name }}" ]]; then
              yarn sst deploy --stage pr-${{ github.event.number }}-${{ env.GITHUB_HEAD_REF_SLUG }} ${{ inputs.stack-name }} | tee deploy-output.log
            else
              yarn sst deploy --stage pr-${{ github.event.number }}-${{ env.GITHUB_HEAD_REF_SLUG }} | tee deploy-output.log
            fi
          else
            if [[ -n "${{ inputs.stack-name }}" ]]; then
              yarn sst deploy --stage ${{ inputs.app-env }} ${{ inputs.stack-name }} | tee deploy-output.log
            else
              yarn sst deploy --stage ${{ inputs.app-env }} | tee deploy-output.log
            fi
          fi
          api_endpoint=$(cat deploy-output.log | egrep "ApiEndpoint|SiteUrl" | awk '{print $2}')
          echo "API endpoint: $api_endpoint"
          echo "API_ENDPOINT_URL=$api_endpoint" >> $GITHUB_ENV

      - name: 🗑️ Destroy preview env
        if: ${{ ( github.event.action == 'labeled' && github.event.label.name == 'destroy' && inputs.preview == 'true' ) || (github.event.action == 'closed' && inputs.preview == 'true' || github.event.pull_request.merged == true && inputs.preview == 'true' ) }}
        run: yarn sst remove --stage pr-${{ github.event.number }}-${{ env.GITHUB_HEAD_REF_SLUG }}

      - name: 🧹 Cleanup preview env deployment
        if: ${{ ( github.event.action == 'labeled' && github.event.label.name == 'destroy' && inputs.preview == 'true' ) || (github.event.action == 'closed' && inputs.preview == 'true' || github.event.pull_request.merged == true && inputs.preview == 'true' ) }}
        uses: strumwolf/delete-deployment-environment@v4.0.0
        with:
          token: ${{ secrets.token }}
          environment: ${{ github.head_ref }}
...