cdkdeployprgithubaction

package module
v0.0.15 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Mar 4, 2026 License: Apache-2.0 Imports: 4 Imported by: 0

README

@jjrawlins/cdk-deploy-pr-github-action

A projen construct that generates GitHub Actions workflows for AWS CDK deployments.

Features

  • Automated deploy pipeline (deploy.yml) — synth, publish assets, and deploy on push to main
  • Manual dispatch workflow (deploy-dispatch.yml) — deploy any previously published version to any environment
  • Versioned cloud assemblies — publishes cdk.out to GitHub Packages with auto-incrementing versions
  • GitHub Releases — each deploy creates a git tag and GitHub Release tied to the assembly version
  • Multi-stage deployments — parallel or sequential stages with dependsOn ordering
  • GitHub Environments — per-stage environment protection rules, secrets scoping, and deployment approvals
  • Manual approval stages — exclude stages from auto-deploy, only deployable via dispatch
  • Per-stage IAM role overrides — cross-account deployments with per-stage OIDC roles
  • Concurrency groups — prevents concurrent deployments to the same stage
  • Rollback support — redeploy any previous assembly version via the dispatch workflow

Installation

npm install @jjrawlins/cdk-deploy-pr-github-action

Also available on PyPI, NuGet, and Go.

Usage

In your .projenrc.ts:

import { CdkDeployPipeline } from '@jjrawlins/cdk-deploy-pr-github-action';

new CdkDeployPipeline(project, {
  stackPrefix: 'MyApp',
  pkgNamespace: '@my-org',
  iamRoleArn: 'arn:aws:iam::111111111111:role/GitHubActionsOidcRole',
  iamRoleRegion: 'us-east-1',
  stages: [
    {
      name: 'dev',
      env: { account: '222222222222', region: 'us-east-1' },
      environment: 'development',
    },
    {
      name: 'staging',
      env: { account: '333333333333', region: 'us-east-1' },
      environment: 'staging',
      dependsOn: ['dev'],
    },
    {
      name: 'prod',
      env: { account: '444444444444', region: 'us-east-1' },
      environment: 'production',
      dependsOn: ['staging'],
      manualApproval: true, // Only deployable via dispatch
    },
  ],
});

Run npx projen to generate the workflow files.

Generated Workflows

deploy.yml

Triggered on push to main. Jobs:

  1. synth — checks out code, installs dependencies, runs cdk synth, uploads cloud assembly artifact
  2. publish-assets — publishes Lambda/container assets to AWS, versions and publishes the cloud assembly to GitHub Packages, creates a git tag and GitHub Release
  3. deploy-{stage} — one job per non-manual stage, deploys stacks using the cloud assembly artifact
deploy-dispatch.yml

Triggered manually via workflow_dispatch. Inputs:

  • environment — target environment (dropdown of configured stages)
  • version — assembly version to deploy (e.g., 0.0.4)

Downloads the specified assembly version from GitHub Packages and deploys it. This enables:

  • Deploying to manualApproval stages (e.g., production)
  • Rolling back to any previous version
  • Ad-hoc deployments outside the normal CI/CD flow

Options

CdkDeployPipelineOptions
Option Type Default Description
pkgNamespace string required npm scope for assembly packages (e.g., @my-org)
stackPrefix string required Stack name prefix (e.g., MyApp -> MyApp-dev)
iamRoleArn string required Default OIDC role ARN for AWS credential assumption
stages DeployStageOptions[] required Deployment stages
iamRoleRegion string us-east-1 Default AWS region for OIDC credential assumption
nodeVersion string 24.x Node.js version for workflow runners
cdkCommand string npx cdk CDK CLI command prefix
installCommand string yarn install --check-files --frozen-lockfile Package install command
manualDeployment boolean true Generate the dispatch workflow
useGithubPackagesForAssembly boolean true Publish cloud assembly to GitHub Packages
branchName string main Branch that triggers deployments
workingDirectory string Subdirectory where the CDK app lives (e.g., infra). Sets defaults.run.working-directory on all jobs and adjusts artifact paths.
preGitHubSteps any Steps to run before deploy (after install/download, before AWS creds). Static array or factory ({ stage, workingDirectory }) => steps[]. Applied to deploy jobs only.
postGitHubSteps any Steps to run after deploy. Static array or factory ({ stage, workingDirectory }) => steps[]. Applied to deploy jobs only.
DeployStageOptions
Option Type Default Description
name string required Stage name (used in job IDs and stack names)
env { account, region } required AWS target environment
environment string stage name GitHub Environment name
iamRoleArn string pipeline default Override OIDC role for this stage
iamRoleRegion string pipeline default Override AWS region for this stage
dependsOn string[] [] Stages that must complete first
stacks string[] ['{stackPrefix}-{name}'] CDK stack names to deploy
manualApproval boolean false Exclude from auto-deploy, dispatch only

Examples

Parallel stages

Stages without dependsOn run in parallel after asset publishing:

stages: [
  { name: 'us-east-1', env: usEast1Env },
  { name: 'eu-west-1', env: euWest1Env },
]
Cross-account with per-stage roles
stages: [
  {
    name: 'dev',
    env: { account: '222222222222', region: 'us-east-1' },
    iamRoleArn: 'arn:aws:iam::222222222222:role/DevDeployRole',
  },
  {
    name: 'prod',
    env: { account: '333333333333', region: 'us-east-1' },
    iamRoleArn: 'arn:aws:iam::333333333333:role/ProdDeployRole',
    manualApproval: true,
  },
]
Rolling back

Each deploy creates a GitHub Release with the assembly version. To roll back:

gh workflow run deploy-dispatch.yml -f environment=production -f version=0.0.3
Monorepo support

If your CDK app lives in a subdirectory, use the workingDirectory option:

new CdkDeployPipeline(project, {
  stackPrefix: 'MyApp',
  pkgNamespace: '@my-org',
  iamRoleArn: 'arn:aws:iam::111111111111:role/GitHubActionsOidcRole',
  workingDirectory: 'infra',
  stages: [
    { name: 'dev', env: devEnv, environment: 'development' },
    { name: 'prod', env: prodEnv, environment: 'production', manualApproval: true },
  ],
});

This sets defaults.run.working-directory: infra on all workflow jobs and adjusts artifact upload/download paths to infra/cdk.out/.

Pre/post workflow steps

Use preGitHubSteps and postGitHubSteps to run custom steps before and after deployments. These are applied to deploy jobs only (not synth or publish-assets). Useful for building source code, sending Slack notifications, or running health checks.

new CdkDeployPipeline(project, {
  stackPrefix: 'MyApp',
  pkgNamespace: '@my-org',
  iamRoleArn: 'arn:aws:iam::111111111111:role/GitHubActionsOidcRole',
  workingDirectory: 'infra',
  stages: [
    { name: 'dev', env: devEnv, environment: 'development' },
  ],
  preGitHubSteps: ({ stage, workingDirectory }) => [
    // Build at project root (overrides working-directory default)
    { name: 'Build app', run: 'npm run build', 'working-directory': '.' },
  ],
  postGitHubSteps: ({ stage }) => [
    { name: 'Notify Slack', uses: 'slackapi/slack-github-action@v2', with: { /* ... */ } },
  ],
});

Pre/post steps are also passed through to deploy-dispatch.yml so dispatch deployments get the same hooks.

Deploy jobs include step IDs creds (AWS Credentials) and deploy (Deploy step) that post-steps can reference via ${{ steps.deploy.outcome }}.

Note: When workingDirectory is set, all run: steps inherit that directory by default. To run a step at the repository root, add working-directory: '.' to that step.

Prerequisites

  • AWS OIDC identity provider configured for GitHub Actions
  • IAM role with trust policy for GitHub Actions OIDC
  • GitHub Environments configured for deployment protection rules (optional)

License

Apache-2.0

Documentation

Overview

A projen construct that generates GitHub Actions workflows for CDK deployments with GitHub Environments, parallel stages, versioned assemblies, and manual rollback.

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

func NewCdkDeployDispatchWorkflow_Override

func NewCdkDeployDispatchWorkflow_Override(c CdkDeployDispatchWorkflow, project interface{}, options *DeployDispatchInternalOptions)

func NewCdkDeployPipeline_Override

func NewCdkDeployPipeline_Override(c CdkDeployPipeline, project interface{}, options *CdkDeployPipelineOptions)

Types

type AwsEnvironment

type AwsEnvironment struct {
	// AWS account ID.
	Account *string `field:"required" json:"account" yaml:"account"`
	// AWS region.
	Region *string `field:"required" json:"region" yaml:"region"`
}

AWS environment target for a deployment stage.

type CdkDeployDispatchWorkflow

type CdkDeployDispatchWorkflow interface {
}

Generates a workflow_dispatch workflow for manual CDK deployments and rollbacks.

Allows deploying any previously published version of the cloud assembly to any configured environment. This enables: - Manual promotion between environments - Rollback to any previous version - Ad-hoc deployments outside the normal CI/CD flow.

func NewCdkDeployDispatchWorkflow

func NewCdkDeployDispatchWorkflow(project interface{}, options *DeployDispatchInternalOptions) CdkDeployDispatchWorkflow

type CdkDeployPipeline

type CdkDeployPipeline interface {
}

Generates GitHub Actions workflows for CDK deployments.

Creates a `deploy.yml` workflow with: - Synth job to compile and synthesize the CDK app - Asset publish job to upload Lambda/container assets to AWS - Per-stage deploy jobs with GitHub Environments, parallel execution, and concurrency groups

Optionally creates a `deploy-dispatch.yml` workflow for manual deployments and rollbacks.

func NewCdkDeployPipeline

func NewCdkDeployPipeline(project interface{}, options *CdkDeployPipelineOptions) CdkDeployPipeline

type CdkDeployPipelineOptions

type CdkDeployPipelineOptions struct {
	// Default OIDC role ARN for AWS credential assumption.
	IamRoleArn *string `field:"required" json:"iamRoleArn" yaml:"iamRoleArn"`
	// npm scope for versioned cloud assembly packages (e.g., '@defiance-digital').
	PkgNamespace *string `field:"required" json:"pkgNamespace" yaml:"pkgNamespace"`
	// Stack name prefix.
	//
	// Stage names are appended with a dash (e.g., 'MyApp' -> 'MyApp-Production')
	StackPrefix *string `field:"required" json:"stackPrefix" yaml:"stackPrefix"`
	// Deployment stages in declaration order.
	Stages *[]*DeployStageOptions `field:"required" json:"stages" yaml:"stages"`
	// Branch that triggers deployments on push.
	// Default: 'main'.
	//
	BranchName *string `field:"optional" json:"branchName" yaml:"branchName"`
	// CDK CLI command prefix.
	// Default: 'npx cdk'.
	//
	CdkCommand *string `field:"optional" json:"cdkCommand" yaml:"cdkCommand"`
	// Default AWS region for OIDC credential assumption.
	// Default: 'us-east-1'.
	//
	IamRoleRegion *string `field:"optional" json:"iamRoleRegion" yaml:"iamRoleRegion"`
	// Package install command.
	// Default: 'yarn install --check-files --frozen-lockfile'.
	//
	InstallCommand *string `field:"optional" json:"installCommand" yaml:"installCommand"`
	// Generate a workflow_dispatch workflow for manual deployments and rollbacks.
	// Default: true.
	//
	ManualDeployment *bool `field:"optional" json:"manualDeployment" yaml:"manualDeployment"`
	// Node.js version for workflow runners.
	// Default: '24.x'
	//
	NodeVersion *string `field:"optional" json:"nodeVersion" yaml:"nodeVersion"`
	// Additional GitHub Actions steps to run after deploy completes.
	//
	// Only applied to deploy jobs (not synth or publish-assets).
	// Accepts a static array of steps, or a factory function receiving context:
	// `(ctx: { stage: string; workingDirectory?: string }) => GitHubStep[]`
	//
	// When `workingDirectory` is set, all `run:` steps inherit that directory.
	// To run a step at the repository root, add `working-directory: '.'` to that step.
	PostGitHubSteps interface{} `field:"optional" json:"postGitHubSteps" yaml:"postGitHubSteps"`
	// Additional GitHub Actions steps to run before deploy (after install/artifact download, before AWS creds).
	//
	// Only applied to deploy jobs (not synth or publish-assets).
	// Accepts a static array of steps, or a factory function receiving context:
	// `(ctx: { stage: string; workingDirectory?: string }) => GitHubStep[]`
	//
	// When `workingDirectory` is set, all `run:` steps inherit that directory.
	// To run a step at the repository root, add `working-directory: '.'` to that step.
	PreGitHubSteps interface{} `field:"optional" json:"preGitHubSteps" yaml:"preGitHubSteps"`
	// Version and publish cloud assembly to GitHub Packages for rollback support.
	// Default: true.
	//
	UseGithubPackagesForAssembly *bool `field:"optional" json:"useGithubPackagesForAssembly" yaml:"useGithubPackagesForAssembly"`
	// Working directory for the CDK app, relative to the repository root.
	//
	// Useful for monorepos where infrastructure lives in a subdirectory (e.g., 'infra').
	//
	// When set, all workflow run steps will use `defaults.run.working-directory`
	// and artifact paths will be adjusted accordingly.
	// Default: - repository root.
	//
	WorkingDirectory *string `field:"optional" json:"workingDirectory" yaml:"workingDirectory"`
}

Configuration for the CDK deploy pipeline.

type DeployDispatchInternalOptions

type DeployDispatchInternalOptions struct {
	AppName          *string                `field:"required" json:"appName" yaml:"appName"`
	CdkCommand       *string                `field:"required" json:"cdkCommand" yaml:"cdkCommand"`
	IamRoleArn       *string                `field:"required" json:"iamRoleArn" yaml:"iamRoleArn"`
	IamRoleRegion    *string                `field:"required" json:"iamRoleRegion" yaml:"iamRoleRegion"`
	InstallCommand   *string                `field:"required" json:"installCommand" yaml:"installCommand"`
	NodeVersion      *string                `field:"required" json:"nodeVersion" yaml:"nodeVersion"`
	PkgNamespace     *string                `field:"required" json:"pkgNamespace" yaml:"pkgNamespace"`
	StackPrefix      *string                `field:"required" json:"stackPrefix" yaml:"stackPrefix"`
	Stages           *[]*DeployStageOptions `field:"required" json:"stages" yaml:"stages"`
	PostGitHubSteps  interface{}            `field:"optional" json:"postGitHubSteps" yaml:"postGitHubSteps"`
	PreGitHubSteps   interface{}            `field:"optional" json:"preGitHubSteps" yaml:"preGitHubSteps"`
	WorkingDirectory *string                `field:"optional" json:"workingDirectory" yaml:"workingDirectory"`
}

Internal helper to build deploy dispatch workflow options from pipeline options.

Exported for use by CdkDeployDispatchWorkflow.

type DeployStageOptions

type DeployStageOptions struct {
	// AWS target environment (account + region).
	Env *AwsEnvironment `field:"required" json:"env" yaml:"env"`
	// Stage name (used as suffix in job IDs and stack names, e.g., 'Sandbox', 'Production').
	Name *string `field:"required" json:"name" yaml:"name"`
	// Stage names that must complete successfully before this stage runs.
	//
	// Stages with no dependsOn run in parallel after the publish-assets job.
	//
	// Example:
	//   ['Sandbox', 'Dev'] // waits for both before deploying
	//
	// Default: - depends only on publish-assets (runs as soon as assets are ready).
	//
	DependsOn *[]*string `field:"optional" json:"dependsOn" yaml:"dependsOn"`
	// GitHub Environment name for protection rules, secrets scoping, and deployment approvals.
	// Default: - uses the stage name.
	//
	Environment *string `field:"optional" json:"environment" yaml:"environment"`
	// Override the default OIDC role ARN for this stage.
	//
	// Useful for cross-account deployments where each account has its own role.
	IamRoleArn *string `field:"optional" json:"iamRoleArn" yaml:"iamRoleArn"`
	// Override the default AWS region for OIDC credential assumption.
	// Default: - uses the pipeline-level iamRoleRegion or the stage env.region
	//
	IamRoleRegion *string `field:"optional" json:"iamRoleRegion" yaml:"iamRoleRegion"`
	// When true, this stage is excluded from the automatic deploy.yml pipeline and can only be deployed via the deploy-dispatch.yml workflow.
	//
	// Auto-deploy stages cannot depend on manual-approval stages.
	// Default: false.
	//
	ManualApproval *bool `field:"optional" json:"manualApproval" yaml:"manualApproval"`
	// Specific CDK stack names to deploy in this stage.
	// Default: - ['{stackPrefix}-{stageName}'].
	//
	Stacks *[]*string `field:"optional" json:"stacks" yaml:"stacks"`
}

Configuration for a single deployment stage.

Directories

Path Synopsis
Package jsii contains the functionaility needed for jsii packages to initialize their dependencies and themselves.
Package jsii contains the functionaility needed for jsii packages to initialize their dependencies and themselves.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL