alpha-engine-predictor/.github/workflows/deploy.yml at main · cipher813/alpha-engine-predictor · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
name: Deploy

on:
  # No path filter — every main commit rebuilds the Lambda so the baked
  # GIT_SHA stamp matches origin/main HEAD. The inference/preflight drift
  # probe (PR #44) hard-fails the weekday pipeline when Lambda SHA != main
  # HEAD, so any non-image PR (IAM, docs, tests, infra shell) that didn't
  # retrigger this workflow would silently reform drift and halt tomorrow's
  # 13:05 UTC run. ~3-5 min of Docker rebuild per merge is the right
  # trade-off vs pipeline halts the next morning. Mirrors alpha-engine-data
  # deploy-infrastructure.yml pattern (PR #86).
  push:
    branches: [main]
  workflow_dispatch:

concurrency:
  group: deploy-main
  cancel-in-progress: false

permissions:
  id-token: write
  contents: read

jobs:
  deploy:
    name: Build + deploy inference Lambda
    runs-on: ubuntu-latest
    timeout-minutes: 20

    steps:
      - name: Checkout predictor repo
        uses: actions/checkout@v4
        with:
          path: alpha-engine-predictor

      # deploy.sh stages predictor.yaml from cipher813/alpha-engine-config
      # into the build context. The real config is gitignored in this repo,
      # so a fresh GitHub runner has none of it — without this step the
      # Dockerfile's `COPY config/ config/` would ship an image missing
      # predictor.yaml and every invocation would FileNotFoundError at
      # import. Fine-grained PAT with read-only Contents access on
      # alpha-engine-config is stored as ALPHA_ENGINE_CONFIG_TOKEN.
      - name: Checkout alpha-engine-config
        uses: actions/checkout@v4
        with:
          repository: cipher813/alpha-engine-config
          path: alpha-engine-config
          token: ${{ secrets.ALPHA_ENGINE_CONFIG_TOKEN }}

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Configure AWS credentials via OIDC
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::711398986525:role/github-actions-lambda-deploy
          aws-region: us-east-1

      - name: Login to Amazon ECR
        uses: aws-actions/amazon-ecr-login@v2

      - name: Deploy inference Lambda (alpha-engine-predictor-inference)
        working-directory: alpha-engine-predictor
        env:
          # deploy.sh defaults CONFIG_REPO_DIR to $(dirname $(pwd))/
          # alpha-engine-config — exactly where the checkout step above
          # placed it.
          CONFIG_REPO_DIR: ${{ github.workspace }}/alpha-engine-config
        run: bash infrastructure/deploy.sh

      - name: Report deployed version
        run: |
          echo "Deployed commit: ${{ github.sha }}"
          aws lambda get-function \
            --function-name alpha-engine-predictor-inference \
            --query "Configuration.[LastModified,CodeSha256]" \
            --output text

      - name: Append to system-wide deploy changelog
        if: always()
        uses: cipher813/alpha-engine-docs/.github/actions/append-changelog@main
        with:
          deploy_status: ${{ job.status == 'success' && 'success' || 'failure' }}
          deploy_workflow: deploy.yml