Skip to content

Add optional subnet and security group IDs inputs for preview deployment #57

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
tomarnebra wants to merge 11 commits into
base: main
Choose a base branch
from
Open

Add optional subnet and security group IDs inputs for preview deployment #57

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
11 commits
Select commit Hold shift + click to select a range
0d3944b
Add optional subnet and security group IDs inputs for ECS Express dep…
tomarnebra Jul 2, 2026
2371f2a
Enhance ECS Express deployment with subnet and security group ID vali…
tomarnebra Jul 3, 2026
cde6654
Update sg description to be consistent with validation
tomarnebra Jul 3, 2026
dd6f347
validating both inputs and emitting a clearer error message to help c…
tomarnebra Jul 3, 2026
7a02200
validating both inputs and emitting a clearer error message
tomarnebra Jul 3, 2026
856ae9b
Apply suggestions from code review
tomarnebra Jul 3, 2026
8f674a5
Apply suggestions from code review: compact JSON
tomarnebra Jul 3, 2026
8e5d747
Apply suggestions from code review
tomarnebra Jul 3, 2026
551beb1
Apply suggestions from code review
tomarnebra Jul 3, 2026
07e2ed7
Add optional subnet and security group IDs inputs for ECS Express dep…
tomarnebra Jul 3, 2026
f4c89b3
Merge branch 'vpc-option-preview-deployment' of github.com:nsbno/plat…
tomarnebra Jul 3, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
46 changes: 46 additions & 0 deletions .github/actions/deployment/preview/deploy-ecs-express-service/action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,6 +33,14 @@ inputs:
description: 'Custom environment variables as JSON object, e.g. {"NAME":"VALUE"}'
required: false
default: '{}'
subnet-ids:
description: 'JSON array of subnet IDs for the service, e.g. ["subnet-abc"]. Must be provided together with security-group-ids.'
required: false
default: ''
Comment on lines +36 to +39
security-group-ids:
description: 'JSON array of security group IDs for the service, e.g. ["sg-abc"]. Must be provided together with subnet-ids.'
required: false
Comment thread
tomarnebra marked this conversation as resolved.
default: ''
Comment thread
Copilot marked this conversation as resolved.
Comment on lines +40 to +43

outputs:
service-url:
Expand Down Expand Up @@ -145,6 +153,8 @@ runs:
ENV_VARS_CONFIG: ${{ steps.prepare-env-vars.outputs.env_vars_config }}
PLAINTEXT_ENV_VARS: ${{ steps.prepare-env-vars.outputs.plaintext_env_vars }}
HEALTH_CHECK_ENDPOINT: ${{ inputs.health-endpoint }}
SUBNET_IDS: ${{ inputs.subnet-ids }}
SECURITY_GROUP_IDS: ${{ inputs.security-group-ids }}
run: |
secrets="$(jq -c '[to_entries[] | {name: .key, valueFrom: .value}]' <<< "$ENV_VARS_CONFIG")"
plaintext="$(jq -c '[to_entries[] | {name: .key, value: .value}]' <<< "$PLAINTEXT_ENV_VARS")"
Expand All @@ -170,6 +180,22 @@ runs:
infrastructureRoleArn="${{ steps.set-service-variables.outputs.infrastructure_role_arn }}"
taskRoleArn="${{ steps.set-service-variables.outputs.task_tole_arn }}"
echo "Deploying Preview: ${{ steps.set-service-variables.outputs.service_name }} ($executionRoleArn, $infrastructureRoleArn, $taskRoleArn)..."

NETWORK_ARGS=()
if [ -n "$SECURITY_GROUP_IDS" ] && [ -z "$SUBNET_IDS" ]; then
echo "Error: subnet-ids must be set when security-group-ids are provided."
exit 1
fi
Comment on lines +184 to +188
if [ -n "$SUBNET_IDS" ]; then
jq -e 'type == "array" and length > 0 and all(.[]; type == "string")' >/dev/null 2>&1 <<<"$SUBNET_IDS" || { echo 'Error: subnet-ids must be a non-empty JSON array of strings, e.g. ["subnet-abc"]'; exit 1; }
if [ -z "$SECURITY_GROUP_IDS" ]; then
echo "Error: security-group-ids must be set when subnet-ids are provided."
exit 1
fi
jq -e 'type == "array" and length > 0 and all(.[]; type == "string")' >/dev/null 2>&1 <<<"$SECURITY_GROUP_IDS" || { echo 'Error: security-group-ids must be a non-empty JSON array of strings, e.g. ["sg-abc"]'; exit 1; }
NETWORK_CONFIG=$(jq -cn --argjson subnets "$SUBNET_IDS" --argjson sgs "$SECURITY_GROUP_IDS" '{subnets: $subnets, securityGroups: $sgs}')
Comment thread
tomarnebra marked this conversation as resolved.
NETWORK_ARGS=(--network-configuration "$NETWORK_CONFIG")
fi
Comment thread
Copilot marked this conversation as resolved.
Comment thread
tomarnebra marked this conversation as resolved.

aws ecs create-express-gateway-service \
--service-name "${{ steps.set-service-variables.outputs.service_name }}" \
Expand All @@ -179,6 +205,7 @@ runs:
--primary-container "$primary_container" \
--health-check-path "$HEALTH_CHECK_ENDPOINT" \
--scaling-target '{"minTaskCount": 1, "maxTaskCount": 1}' \
"${NETWORK_ARGS[@]}" \
--region "${{ inputs.aws-region }}"

serviceArn="arn:aws:ecs:${{ inputs.aws-region }}:${{ inputs.aws-account-id }}:service/default/${{ steps.set-service-variables.outputs.service_name }}"
Expand All @@ -193,6 +220,8 @@ runs:
ENV_VARS_CONFIG: ${{ steps.prepare-env-vars.outputs.env_vars_config }}
PLAINTEXT_ENV_VARS: ${{ steps.prepare-env-vars.outputs.plaintext_env_vars }}
HEALTH_CHECK_ENDPOINT: ${{ inputs.health-endpoint }}
SUBNET_IDS: ${{ inputs.subnet-ids }}
SECURITY_GROUP_IDS: ${{ inputs.security-group-ids }}
run: |
secrets="$(jq -c '[to_entries[] | {name: .key, valueFrom: .value}]' <<< "$ENV_VARS_CONFIG")"
plaintext="$(jq -c '[to_entries[] | {name: .key, value: .value}]' <<< "$PLAINTEXT_ENV_VARS")"
Expand All @@ -214,13 +243,30 @@ runs:
SERVICE_ARN="${{ steps.check-service.outputs.service_arn }}"
echo "Updating Preview: ${{ steps.set-service-variables.outputs.service_name }} ($SERVICE_ARN)..."

NETWORK_ARGS=()
if [ -n "$SECURITY_GROUP_IDS" ] && [ -z "$SUBNET_IDS" ]; then
echo "Error: subnet-ids must be set when security-group-ids are provided."
exit 1
fi
if [ -n "$SUBNET_IDS" ]; then
jq -e 'type == "array" and length > 0 and all(.[]; type == "string")' >/dev/null 2>&1 <<<"$SUBNET_IDS" || { echo 'Error: subnet-ids must be a non-empty JSON array of strings, e.g. ["subnet-abc"]'; exit 1; }
if [ -z "$SECURITY_GROUP_IDS" ]; then
echo "Error: security-group-ids must be set when subnet-ids are provided."
exit 1
fi
jq -e 'type == "array" and length > 0 and all(.[]; type == "string")' >/dev/null 2>&1 <<<"$SECURITY_GROUP_IDS" || { echo 'Error: security-group-ids must be a non-empty JSON array of strings, e.g. ["sg-abc"]'; exit 1; }
NETWORK_CONFIG=$(jq -cn --argjson subnets "$SUBNET_IDS" --argjson sgs "$SECURITY_GROUP_IDS" '{subnets: $subnets, securityGroups: $sgs}')
Comment thread
tomarnebra marked this conversation as resolved.
NETWORK_ARGS=(--network-configuration "$NETWORK_CONFIG")
fi
Comment thread
Copilot marked this conversation as resolved.
Comment thread
Copilot marked this conversation as resolved.
Comment thread
tomarnebra marked this conversation as resolved.

aws ecs update-express-gateway-service \
--service-arn "$SERVICE_ARN" \
--execution-role-arn "$executionRoleArn" \
--task-role-arn "$taskRoleArn" \
--primary-container "$primary_container" \
--health-check-path "$HEALTH_CHECK_ENDPOINT" \
--scaling-target '{"minTaskCount": 1, "maxTaskCount": 1}' \
"${NETWORK_ARGS[@]}" \
--region "${{ inputs.aws-region }}"

echo "Update started! $SERVICE_ARN"
Expand Down
14 changes: 13 additions & 1 deletion .github/workflows/deployment.preview.on-comment.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,6 +36,16 @@ on:
type: string
default: '/'
required: false
subnet-ids:
description: 'JSON array of subnet IDs for the ECS Express service, e.g. ["subnet-abc"]. Must be provided together with security-group-ids.'
required: false
type: string
default: ''
security-group-ids:
description: 'JSON array of security group IDs for the ECS Express service, e.g. ["sg-abc"]. Must be provided together with subnet-ids.'
required: false
type: string
default: ''

jobs:
trigger:
Expand Down Expand Up @@ -66,7 +76,7 @@ jobs:

preview:
needs: trigger
uses: nsbno/platform-actions/.github/workflows/deployment.preview.yml@v2
uses: nsbno/platform-actions/.github/workflows/deployment.preview.yml@vpc-option-preview-deployment
with:
health-endpoint: ${{ inputs.health-endpoint }}
use-ecs-express-mode: ${{ inputs.use-ecs-express-mode }}
Expand All @@ -78,6 +88,8 @@ jobs:
skip-static-files-deployment: ${{ inputs.skip-static-files-deployment }}
s3-static-files-path: ${{ inputs.s3-static-files-path }}
custom-env-variables: ${{ inputs.custom-env-variables }}
subnet-ids: ${{ inputs.subnet-ids }}
security-group-ids: ${{ inputs.security-group-ids }}

comment-handler:
needs: [ trigger, preview ]
Expand Down
14 changes: 13 additions & 1 deletion .github/workflows/deployment.preview.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -60,6 +60,16 @@ on:
type: string
default: '/'
required: false
subnet-ids:
description: 'JSON array of subnet IDs for the ECS Express service, e.g. ["subnet-abc"]. Must be provided together with security-group-ids.'
required: false
type: string
default: ''
security-group-ids:
description: 'JSON array of security group IDs for the ECS Express service, e.g. ["sg-abc"]. Must be provided together with subnet-ids.'
required: false
type: string
default: ''

permissions:
contents: read
Expand Down Expand Up @@ -165,7 +175,7 @@ jobs:
- name: Deploy Preview (ECS)
if: ${{ inputs.use-ecs-express-mode == true && (inputs.only-on-preview-comment == false || steps.check-comments.outputs.continue == 'true') }}
id: deploy-ecs
uses: nsbno/platform-actions/.github/actions/deployment/preview/deploy-ecs-express-service@v2
uses: nsbno/platform-actions/.github/actions/deployment/preview/deploy-ecs-express-service@vpc-option-preview-deployment
with:
health-endpoint: ${{ inputs.health-endpoint }}
service-name: ${{ steps.deployment-info.outputs.ecs-service-name }}
Expand All @@ -176,6 +186,8 @@ jobs:
aws-region: ${{ vars.AWS_REGION }}
git-event-number: ${{ inputs.git-event-number }}
custom-env-variables: ${{ inputs.custom-env-variables }}
subnet-ids: ${{ inputs.subnet-ids }}
security-group-ids: ${{ inputs.security-group-ids }}

- name: Push Mapping to DynamoDB and Comment domain name
if: ${{ inputs.only-on-preview-comment == false || steps.check-comments.outputs.continue == 'true' }}
Expand Down