Skip to content

Commit c804dc5

Browse files
authored
feat: updates for 2025-11-01 (#34)
* feat: updates for 2025-11-01 * feat: add deployment job to ci.yml * fix: incorporate review comments
1 parent adb7820 commit c804dc5

File tree

16 files changed

+1036
-62
lines changed

16 files changed

+1036
-62
lines changed

.github/dependabot.yml

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
version: 2
2+
updates:
3+
- package-ecosystem: "npm"
4+
directory: "/"
5+
schedule:
6+
interval: "weekly"
7+
open-pull-requests-limit: 2
8+
versioning-strategy: "auto"
9+
groups:
10+
all-dependencies:
11+
patterns:
12+
- "*"
13+
commit-message:
14+
prefix: "chore"
15+
prefix-development: "chore"
16+
include: "scope"
17+
18+
- package-ecosystem: "pip"
19+
directory: "/"
20+
schedule:
21+
interval: "weekly"
22+
open-pull-requests-limit: 2
23+
versioning-strategy: "auto"
24+
groups:
25+
all-dependencies:
26+
patterns:
27+
- "*"
28+
commit-message:
29+
prefix: "chore"
30+
prefix-development: "chore"
31+
include: "scope"
32+
33+
- package-ecosystem: "github-actions"
34+
directory: "/"
35+
schedule:
36+
interval: "weekly"
37+
open-pull-requests-limit: 5
38+

.github/workflows/ci.yml

Lines changed: 108 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,108 @@
1+
name: CI
2+
3+
on:
4+
push:
5+
branches:
6+
- main
7+
pull_request:
8+
workflow_dispatch:
9+
10+
# Required for AWS OIDC authentication
11+
permissions:
12+
id-token: write
13+
contents: read
14+
15+
jobs:
16+
test:
17+
runs-on: ubuntu-latest
18+
19+
steps:
20+
- name: Checkout code
21+
uses: actions/checkout@v5
22+
23+
- name: Set up Node.js
24+
uses: actions/setup-node@v6
25+
with:
26+
node-version: '22'
27+
28+
- name: Install uv
29+
uses: astral-sh/setup-uv@v7
30+
31+
- name: Install Python dependencies
32+
run: uv sync
33+
34+
- name: Install Node dependencies
35+
run: npm install
36+
37+
- name: Run pre-commit
38+
run: uv run pre-commit run --all-files
39+
40+
- name: Synthesize CDK stack
41+
env:
42+
AWS_ACCESS_KEY_ID: AKIAIOSFODNN7EXAMPLE
43+
AWS_SECRET_ACCESS_KEY: wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
44+
AWS_REGION: us-east-1
45+
AWS_DEFAULT_REGION: us-east-1
46+
DATA_ACCESS_ROLE_ARN: arn:aws:iam::123456789012:role/DummyDataAccessRole
47+
48+
run: uv run npx cdk synth --all
49+
50+
# Example deployment job - demonstrates how to deploy using GitHub environments
51+
# To use:
52+
# 1. Create a GitHub environment (Settings > Environments)
53+
# 2. Configure environment variables in that environment
54+
# 3. Set up AWS OIDC provider and IAM role with trust relationship to GitHub
55+
# 4. Customize as needed
56+
deploy:
57+
if: github.event_name == 'workflow_dispatch'
58+
needs: test
59+
runs-on: ubuntu-latest
60+
61+
# Reference your GitHub environment here
62+
# This pulls in environment-specific variables and protection rules
63+
environment:
64+
name: production # Change to your environment name
65+
url: ${{ steps.deploy.outputs.url }} # Optional: link to deployed application
66+
67+
steps:
68+
- name: Checkout code
69+
uses: actions/checkout@v5
70+
71+
- name: Set up Node.js
72+
uses: actions/setup-node@v6
73+
with:
74+
node-version-file: '.nvmrc'
75+
76+
- name: Install uv
77+
uses: astral-sh/setup-uv@v7
78+
79+
- name: Install Python dependencies
80+
run: uv sync
81+
82+
- name: Install Node dependencies
83+
run: npm install
84+
85+
- name: Configure AWS credentials from OIDC
86+
uses: aws-actions/configure-aws-credentials@v4
87+
with:
88+
# This role ARN should be stored as an environment variable in GitHub
89+
# The role must have a trust policy allowing GitHub OIDC authentication
90+
role-to-assume: ${{ vars.AWS_DEPLOYMENT_ROLE_ARN }}
91+
aws-region: ${{ vars.AWS_REGION }}
92+
# Optional: role session name for CloudTrail auditing
93+
role-session-name: GitHubActions-${{ github.run_id }}
94+
95+
- name: Deploy CDK stack
96+
id: deploy
97+
env:
98+
# Pull additional configuration from GitHub environment variables
99+
# These should be set in Settings > Environments > [environment-name] > Variables
100+
DATA_ACCESS_ROLE_ARN: ${{ vars.DATA_ACCESS_ROLE_ARN }}
101+
# Add any other environment-specific variables here
102+
# PROJECT_ID: ${{ vars.PROJECT_ID }}
103+
# STAGE: ${{ vars.STAGE }}
104+
run: |
105+
uv run npx cdk deploy --all --require-approval never
106+
107+
# Optional: capture and output deployment URLs
108+
# echo "url=https://your-api-url.com" >> $GITHUB_OUTPUT

.gitignore

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -168,3 +168,4 @@ node_modules/
168168
.pgdata
169169

170170
.ruff_cache/
171+
.envrc

.nvmrc

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
22.20.0

.pre-commit-config.yaml

Lines changed: 5 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,20 +1,17 @@
11
repos:
2-
- repo: https://github.com/PyCQA/isort
3-
rev: 5.13.2
2+
- repo: https://github.com/tsvikas/sync-with-uv
3+
rev: v0.4.0
44
hooks:
5-
- id: isort
6-
language_version: python
7-
args: ["-m", "3","--trailing-comma", "-l", "88"]
8-
5+
- id: sync-with-uv
96
- repo: https://github.com/astral-sh/ruff-pre-commit
10-
rev: v0.4.4
7+
rev: v0.14.3
118
hooks:
129
- id: ruff
1310
args: ["--fix"]
1411
- id: ruff-format
1512

1613
- repo: https://github.com/pre-commit/mirrors-mypy
17-
rev: v1.10.0
14+
rev: v1.18.2
1815
hooks:
1916
- id: mypy
2017
language_version: python

.python-version

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
3.12

README.md

Lines changed: 68 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -6,59 +6,111 @@ Template repository to deploy [eoapi](https://eoapi.dev) on AWS using the [eoapi
66

77
- python >=3.9
88
- docker
9-
- node >=14
9+
- node >=18
1010
- AWS credentials environment variables configured to point to an account.
1111
- **Optional** a `config.yaml` file to override the default deployment settings defined in `config.py`.
1212

1313
## Installation
1414

15-
Install python dependencies with
15+
Install python dependencies with `uv`
1616

17-
```
18-
python -m venv .venv
19-
source .venv/bin/activate
20-
python -m pip install -r requirements.txt
17+
```bash
18+
uv sync
2119
```
2220

2321
And node dependencies with
2422

25-
```
23+
```bash
2624
npm install
2725
```
2826

2927
Verify that the `cdk` CLI is available. Since `aws-cdk` is installed as a local dependency, you can use the `npx` node package runner tool, that comes with `npm`.
3028

31-
```
29+
```bash
3230
npx cdk --version
3331
```
32+
3433
## Deployment
3534

36-
First, synthesize the app
35+
### Configuration
36+
37+
You can configure your eoAPI deployment using either environment variables (defined manually or in a `.env` file) or a configuration yaml file (see [config.py](./infrastructure/config.py) for more details on all of the configurable parameters.
38+
39+
Feel free to add or subtract from these configuration parameters to suit your needs!
3740

41+
To start you can copy [config.yaml.example](./config.yaml.example) to config.yaml:
42+
43+
```bash
44+
cp config.yaml.example config.yaml
3845
```
39-
npx cdk synth --all
46+
47+
Then update the values according to your preferences.
48+
Be sure to set `project_id` to something recognizable and to look closely at all of the components that you are including with each setting.
49+
50+
### AWS credentials
51+
52+
For the deployment steps to work, you will need to have your environment configured with your AWS account credentials.
53+
There are lots of ways to do this so choose whatever method you want to define `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, `AWS_REGION`, dtc.
54+
55+
### Synthesize the CDK Stack
56+
57+
You can test your deployment configuration without deploying any actual resources to AWS by using the `cdk synth` command.
58+
59+
```bash
60+
uv run npx cdk synth --all
4061
```
4162

4263
Then, deploy
4364

65+
```bash
66+
uv run npx cdk deploy --all --require-approval never
4467
```
45-
npx cdk deploy --all --require-approval never
46-
```
68+
69+
## GitHub Actions
70+
71+
The repository includes a CI workflow (`.github/workflows/ci.yml`) that runs on every push to `main` and on all pull requests. The workflow:
72+
73+
1. Sets up the build environment with Node.js 22 and Python (via `uv`)
74+
2. Installs all project dependencies (both Python and Node)
75+
3. Runs pre-commit hooks to check code quality and formatting
76+
4. Synthesizes the CDK stack to validate the infrastructure-as-code configuration
77+
78+
This ensures that all code changes pass quality checks and that the CDK stack can be successfully synthesized before merging.
79+
80+
### Automated Deployment
81+
82+
The workflow also includes an example `deploy` job that demonstrates how to automatically deploy your eoAPI stack to AWS using GitHub Actions. This job showcases:
83+
84+
- **AWS OIDC authentication** - Secure, keyless authentication using GitHub's OIDC provider
85+
- **GitHub Environments** - Pulling deployment configuration from environment-specific variables
86+
- **Protection rules** - Leveraging GitHub's environment protection features (approvals, branch restrictions)
87+
88+
> [!NOTE]
89+
> This deployment job is a basic starting point and can be triggered manually via `workflow_dispatch`. You should tailor it to match your specific deployment strategy, such as:
90+
>
91+
> - Adding multiple environments (staging, production, etc.)
92+
> - Implementing deployment approval workflows
93+
> - Adding post-deployment validation or smoke tests
94+
> - Customizing environment variables for different stages
95+
> - Integrating with monitoring or notification systems
96+
97+
To set up AWS OIDC authentication for GitHub Actions, refer to the [AWS documentation on configuring OIDC with GitHub](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_create_oidc.html) and the [GitHub documentation for Configuring OpenID Connect in AWS](https://docs.github.com/en/actions/how-tos/secure-your-work/security-harden-deployments/oidc-in-aws).
4798

4899
## Docker
49100

50101
Before deploying the application on the cloud, you can start by exploring it with a local *Docker* deployment
51102

52-
```
103+
```bash
53104
docker compose up
54105
```
55106

56107
Once the applications are *up*, you'll need to add STAC **Collections** and **Items** to the PgSTAC database. If you don't have, you can use the follow the [MAXAR open data demo](https://github.com/vincentsarago/MAXAR_opendata_to_pgstac) (or get inspired by the other [demos](https://github.com/developmentseed/eoAPI/tree/main/demo)).
57108

58109
Then you can start exploring your dataset with:
59110

60-
- the STAC Metadata service [http://localhost:8081](http://localhost:8081)
61-
- the Raster service [http://localhost:8082](http://localhost:8082)
62-
- the browser UI [http://localhost:8085](http://localhost:8085)
111+
- the STAC Metadata service [http://localhost:8081](http://localhost:8081)
112+
- the Raster service [http://localhost:8082](http://localhost:8082)
113+
- the Vector service [http://localhost:8083](http://localhost:8083)
114+
- the browser UI [http://localhost:8085](http://localhost:8085)
63115

64116
If you've added a vector dataset to the `public` schema in the Postgres database, they will be available through the **Vector** service at [http://localhost:8083](http://localhost:8083).

config.yaml.example

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
1-
project_id: "eoapi-yo"
2-
stage: "production"
1+
project_id: "eoapi"
2+
stage: "test"
33
tags: {owner: user_a}
44

55
# Ingest Options
@@ -12,7 +12,7 @@ db_allocated_storage: 5
1212
public_db_subnet: False
1313

1414
# VPC Options
15-
nat_gateway_count: 4
15+
nat_gateway_count: 0
1616

1717
# Bastion Host Options
1818
bastion_host: True

docker-compose.yml

Lines changed: 8 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -14,12 +14,8 @@ services:
1414
- database
1515

1616
stac:
17-
# Note:
18-
# the official ghcr.io/stac-utils/stac-fastapi-pgstac image uses python 3.8 and uvicorn
19-
# which is why here we use a custom Dockerfile using python 3.11 and gunicorn
20-
build:
21-
context: .
22-
dockerfile: dockerfiles/Dockerfile.stac
17+
platform: linux/amd64
18+
image: ghcr.io/stac-utils/stac-fastapi-pgstac:6.0.2
2319
ports:
2420
- "${MY_DOCKER_IP:-127.0.0.1}:8081:8081"
2521
environment:
@@ -46,7 +42,7 @@ services:
4642
- DB_MAX_CONN_SIZE=10
4743
depends_on:
4844
- database
49-
command: bash -c "bash /tmp/scripts/wait-for-it.sh -t 120 -h database -p 5432 && /start.sh"
45+
command: bash -c "bash /tmp/scripts/wait-for-it.sh -t 120 -h database -p 5432 && uvicorn stac_fastapi.pgstac.app:app --host 0.0.0.0 --port 8081 --workers 1"
5046
volumes:
5147
- ./dockerfiles/scripts:/tmp/scripts
5248

@@ -95,12 +91,12 @@ services:
9591
- AWS_SECRET_ACCESS_KEY=${AWS_SECRET_ACCESS_KEY}
9692
depends_on:
9793
- database
98-
command: bash -c "bash /tmp/scripts/wait-for-it.sh -t 120 -h database -p 5432 && gunicorn -k uvicorn.workers.UvicornWorker titiler.pgstac.main:app --bind 0.0.0.0:8082 --workers 1"
94+
command: bash -c "bash /tmp/scripts/wait-for-it.sh -t 120 -h database -p 5432 && uvicorn titiler.pgstac.main:app --host 0.0.0.0 --port 8082 --workers 5"
9995
volumes:
10096
- ./dockerfiles/scripts:/tmp/scripts
10197

10298
vector:
103-
image: ghcr.io/developmentseed/tipg:0.6.3
99+
image: ghcr.io/developmentseed/tipg:1.2.1
104100
ports:
105101
- "${MY_DOCKER_IP:-127.0.0.1}:8083:8083"
106102
environment:
@@ -121,14 +117,15 @@ services:
121117
- POSTGRES_PORT=5432
122118
- DB_MIN_CONN_SIZE=1
123119
- DB_MAX_CONN_SIZE=10
124-
command: bash -c "bash /tmp/scripts/wait-for-it.sh -t 120 -h database -p 5432 && /start.sh"
120+
command:
121+
bash -c "bash /tmp/scripts/wait-for-it.sh database:5432 --timeout=30 && uvicorn tipg.main:app --host 0.0.0.0 --port 8081 --workers 5"
125122
depends_on:
126123
- database
127124
volumes:
128125
- ./dockerfiles/scripts:/tmp/scripts
129126

130127
database:
131-
image: ghcr.io/stac-utils/pgstac:v0.8.5
128+
image: ghcr.io/stac-utils/pgstac:v0.9.8
132129
environment:
133130
- POSTGRES_USER=username
134131
- POSTGRES_PASSWORD=password

dockerfiles/Dockerfile.stac

Lines changed: 0 additions & 10 deletions
This file was deleted.

0 commit comments

Comments
 (0)