cdkdeployprgithubaction

package module
v0.0.10 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Mar 1, 2026 License: Apache-2.0 Imports: 4 Imported by: 0

README

@jjrawlins/cdk-deploy-pr-github-action

A projen construct that generates GitHub Actions workflows for AWS CDK deployments.

Features

  • Automated deploy pipeline (deploy.yml) — synth, publish assets, and deploy on push to main
  • Manual dispatch workflow (deploy-dispatch.yml) — deploy any previously published version to any environment
  • Versioned cloud assemblies — publishes cdk.out to GitHub Packages with auto-incrementing versions
  • GitHub Releases — each deploy creates a git tag and GitHub Release tied to the assembly version
  • Multi-stage deployments — parallel or sequential stages with dependsOn ordering
  • GitHub Environments — per-stage environment protection rules, secrets scoping, and deployment approvals
  • Manual approval stages — exclude stages from auto-deploy, only deployable via dispatch
  • Per-stage IAM role overrides — cross-account deployments with per-stage OIDC roles
  • Concurrency groups — prevents concurrent deployments to the same stage
  • Rollback support — redeploy any previous assembly version via the dispatch workflow

Installation

npm install @jjrawlins/cdk-deploy-pr-github-action

Also available on PyPI, NuGet, and Go.

Usage

In your .projenrc.ts:

import { CdkDeployPipeline } from '@jjrawlins/cdk-deploy-pr-github-action';

new CdkDeployPipeline(project, {
  stackPrefix: 'MyApp',
  pkgNamespace: '@my-org',
  iamRoleArn: 'arn:aws:iam::111111111111:role/GitHubActionsOidcRole',
  iamRoleRegion: 'us-east-1',
  stages: [
    {
      name: 'dev',
      env: { account: '222222222222', region: 'us-east-1' },
      environment: 'development',
    },
    {
      name: 'staging',
      env: { account: '333333333333', region: 'us-east-1' },
      environment: 'staging',
      dependsOn: ['dev'],
    },
    {
      name: 'prod',
      env: { account: '444444444444', region: 'us-east-1' },
      environment: 'production',
      dependsOn: ['staging'],
      manualApproval: true, // Only deployable via dispatch
    },
  ],
});

Run npx projen to generate the workflow files.

Generated Workflows

deploy.yml

Triggered on push to main. Jobs:

  1. synth — checks out code, installs dependencies, runs cdk synth, uploads cloud assembly artifact
  2. publish-assets — publishes Lambda/container assets to AWS, versions and publishes the cloud assembly to GitHub Packages, creates a git tag and GitHub Release
  3. deploy-{stage} — one job per non-manual stage, deploys stacks using the cloud assembly artifact
deploy-dispatch.yml

Triggered manually via workflow_dispatch. Inputs:

  • environment — target environment (dropdown of configured stages)
  • version — assembly version to deploy (e.g., 0.0.4)

Downloads the specified assembly version from GitHub Packages and deploys it. This enables:

  • Deploying to manualApproval stages (e.g., production)
  • Rolling back to any previous version
  • Ad-hoc deployments outside the normal CI/CD flow

Options

CdkDeployPipelineOptions
Option Type Default Description
pkgNamespace string required npm scope for assembly packages (e.g., @my-org)
stackPrefix string required Stack name prefix (e.g., MyApp -> MyApp-dev)
iamRoleArn string required Default OIDC role ARN for AWS credential assumption
stages DeployStageOptions[] required Deployment stages
iamRoleRegion string us-east-1 Default AWS region for OIDC credential assumption
nodeVersion string 24.x Node.js version for workflow runners
cdkCommand string npx cdk CDK CLI command prefix
installCommand string yarn install --check-files --frozen-lockfile Package install command
manualDeployment boolean true Generate the dispatch workflow
useGithubPackagesForAssembly boolean true Publish cloud assembly to GitHub Packages
branchName string main Branch that triggers deployments
DeployStageOptions
Option Type Default Description
name string required Stage name (used in job IDs and stack names)
env { account, region } required AWS target environment
environment string stage name GitHub Environment name
iamRoleArn string pipeline default Override OIDC role for this stage
iamRoleRegion string pipeline default Override AWS region for this stage
dependsOn string[] [] Stages that must complete first
stacks string[] ['{stackPrefix}-{name}'] CDK stack names to deploy
manualApproval boolean false Exclude from auto-deploy, dispatch only

Examples

Parallel stages

Stages without dependsOn run in parallel after asset publishing:

stages: [
  { name: 'us-east-1', env: usEast1Env },
  { name: 'eu-west-1', env: euWest1Env },
]
Cross-account with per-stage roles
stages: [
  {
    name: 'dev',
    env: { account: '222222222222', region: 'us-east-1' },
    iamRoleArn: 'arn:aws:iam::222222222222:role/DevDeployRole',
  },
  {
    name: 'prod',
    env: { account: '333333333333', region: 'us-east-1' },
    iamRoleArn: 'arn:aws:iam::333333333333:role/ProdDeployRole',
    manualApproval: true,
  },
]
Rolling back

Each deploy creates a GitHub Release with the assembly version. To roll back:

gh workflow run deploy-dispatch.yml -f environment=production -f version=0.0.3

Prerequisites

  • AWS OIDC identity provider configured for GitHub Actions
  • IAM role with trust policy for GitHub Actions OIDC
  • GitHub Environments configured for deployment protection rules (optional)

License

Apache-2.0

Documentation

Overview

A projen construct that generates GitHub Actions workflows for CDK deployments with GitHub Environments, parallel stages, versioned assemblies, and manual rollback.

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

func NewCdkDeployDispatchWorkflow_Override

func NewCdkDeployDispatchWorkflow_Override(c CdkDeployDispatchWorkflow, project interface{}, options *DeployDispatchInternalOptions)

func NewCdkDeployPipeline_Override

func NewCdkDeployPipeline_Override(c CdkDeployPipeline, project interface{}, options *CdkDeployPipelineOptions)

Types

type AwsEnvironment

type AwsEnvironment struct {
	// AWS account ID.
	Account *string `field:"required" json:"account" yaml:"account"`
	// AWS region.
	Region *string `field:"required" json:"region" yaml:"region"`
}

AWS environment target for a deployment stage.

type CdkDeployDispatchWorkflow

type CdkDeployDispatchWorkflow interface {
}

Generates a workflow_dispatch workflow for manual CDK deployments and rollbacks.

Allows deploying any previously published version of the cloud assembly to any configured environment. This enables: - Manual promotion between environments - Rollback to any previous version - Ad-hoc deployments outside the normal CI/CD flow.

func NewCdkDeployDispatchWorkflow

func NewCdkDeployDispatchWorkflow(project interface{}, options *DeployDispatchInternalOptions) CdkDeployDispatchWorkflow

type CdkDeployPipeline

type CdkDeployPipeline interface {
}

Generates GitHub Actions workflows for CDK deployments.

Creates a `deploy.yml` workflow with: - Synth job to compile and synthesize the CDK app - Asset publish job to upload Lambda/container assets to AWS - Per-stage deploy jobs with GitHub Environments, parallel execution, and concurrency groups

Optionally creates a `deploy-dispatch.yml` workflow for manual deployments and rollbacks.

func NewCdkDeployPipeline

func NewCdkDeployPipeline(project interface{}, options *CdkDeployPipelineOptions) CdkDeployPipeline

type CdkDeployPipelineOptions

type CdkDeployPipelineOptions struct {
	// Default OIDC role ARN for AWS credential assumption.
	IamRoleArn *string `field:"required" json:"iamRoleArn" yaml:"iamRoleArn"`
	// npm scope for versioned cloud assembly packages (e.g., '@defiance-digital').
	PkgNamespace *string `field:"required" json:"pkgNamespace" yaml:"pkgNamespace"`
	// Stack name prefix.
	//
	// Stage names are appended with a dash (e.g., 'MyApp' -> 'MyApp-Production')
	StackPrefix *string `field:"required" json:"stackPrefix" yaml:"stackPrefix"`
	// Deployment stages in declaration order.
	Stages *[]*DeployStageOptions `field:"required" json:"stages" yaml:"stages"`
	// Branch that triggers deployments on push.
	// Default: 'main'.
	//
	BranchName *string `field:"optional" json:"branchName" yaml:"branchName"`
	// CDK CLI command prefix.
	// Default: 'npx cdk'.
	//
	CdkCommand *string `field:"optional" json:"cdkCommand" yaml:"cdkCommand"`
	// Default AWS region for OIDC credential assumption.
	// Default: 'us-east-1'.
	//
	IamRoleRegion *string `field:"optional" json:"iamRoleRegion" yaml:"iamRoleRegion"`
	// Package install command.
	// Default: 'yarn install --check-files --frozen-lockfile'.
	//
	InstallCommand *string `field:"optional" json:"installCommand" yaml:"installCommand"`
	// Generate a workflow_dispatch workflow for manual deployments and rollbacks.
	// Default: true.
	//
	ManualDeployment *bool `field:"optional" json:"manualDeployment" yaml:"manualDeployment"`
	// Node.js version for workflow runners.
	// Default: '24.x'
	//
	NodeVersion *string `field:"optional" json:"nodeVersion" yaml:"nodeVersion"`
	// Version and publish cloud assembly to GitHub Packages for rollback support.
	// Default: true.
	//
	UseGithubPackagesForAssembly *bool `field:"optional" json:"useGithubPackagesForAssembly" yaml:"useGithubPackagesForAssembly"`
	// Working directory for the CDK app, relative to the repository root.
	//
	// Useful for monorepos where infrastructure lives in a subdirectory (e.g., 'infra').
	//
	// When set, all workflow run steps will use `defaults.run.working-directory`
	// and artifact paths will be adjusted accordingly.
	// Default: - repository root.
	//
	WorkingDirectory *string `field:"optional" json:"workingDirectory" yaml:"workingDirectory"`
}

Configuration for the CDK deploy pipeline.

type DeployDispatchInternalOptions

type DeployDispatchInternalOptions struct {
	AppName          *string                `field:"required" json:"appName" yaml:"appName"`
	CdkCommand       *string                `field:"required" json:"cdkCommand" yaml:"cdkCommand"`
	IamRoleArn       *string                `field:"required" json:"iamRoleArn" yaml:"iamRoleArn"`
	IamRoleRegion    *string                `field:"required" json:"iamRoleRegion" yaml:"iamRoleRegion"`
	InstallCommand   *string                `field:"required" json:"installCommand" yaml:"installCommand"`
	NodeVersion      *string                `field:"required" json:"nodeVersion" yaml:"nodeVersion"`
	PkgNamespace     *string                `field:"required" json:"pkgNamespace" yaml:"pkgNamespace"`
	StackPrefix      *string                `field:"required" json:"stackPrefix" yaml:"stackPrefix"`
	Stages           *[]*DeployStageOptions `field:"required" json:"stages" yaml:"stages"`
	WorkingDirectory *string                `field:"optional" json:"workingDirectory" yaml:"workingDirectory"`
}

Internal helper to build deploy dispatch workflow options from pipeline options.

Exported for use by CdkDeployDispatchWorkflow.

type DeployStageOptions

type DeployStageOptions struct {
	// AWS target environment (account + region).
	Env *AwsEnvironment `field:"required" json:"env" yaml:"env"`
	// Stage name (used as suffix in job IDs and stack names, e.g., 'Sandbox', 'Production').
	Name *string `field:"required" json:"name" yaml:"name"`
	// Stage names that must complete successfully before this stage runs.
	//
	// Stages with no dependsOn run in parallel after the publish-assets job.
	//
	// Example:
	//   ['Sandbox', 'Dev'] // waits for both before deploying
	//
	// Default: - depends only on publish-assets (runs as soon as assets are ready).
	//
	DependsOn *[]*string `field:"optional" json:"dependsOn" yaml:"dependsOn"`
	// GitHub Environment name for protection rules, secrets scoping, and deployment approvals.
	// Default: - uses the stage name.
	//
	Environment *string `field:"optional" json:"environment" yaml:"environment"`
	// Override the default OIDC role ARN for this stage.
	//
	// Useful for cross-account deployments where each account has its own role.
	IamRoleArn *string `field:"optional" json:"iamRoleArn" yaml:"iamRoleArn"`
	// Override the default AWS region for OIDC credential assumption.
	// Default: - uses the pipeline-level iamRoleRegion or the stage env.region
	//
	IamRoleRegion *string `field:"optional" json:"iamRoleRegion" yaml:"iamRoleRegion"`
	// When true, this stage is excluded from the automatic deploy.yml pipeline and can only be deployed via the deploy-dispatch.yml workflow.
	//
	// Auto-deploy stages cannot depend on manual-approval stages.
	// Default: false.
	//
	ManualApproval *bool `field:"optional" json:"manualApproval" yaml:"manualApproval"`
	// Specific CDK stack names to deploy in this stage.
	// Default: - ['{stackPrefix}-{stageName}'].
	//
	Stacks *[]*string `field:"optional" json:"stacks" yaml:"stacks"`
}

Configuration for a single deployment stage.

Directories

Path Synopsis
Package jsii contains the functionaility needed for jsii packages to initialize their dependencies and themselves.
Package jsii contains the functionaility needed for jsii packages to initialize their dependencies and themselves.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL