REFACTOR: Optimized Catagory IDs INput Validation

2026-08-17 01:17:08 +03:00
parent 56a2992206
commit b77afbfed6
4 changed files with 82 additions and 41 deletions
@@ -0,0 +1,52 @@
+name: Deploy Infrastructure
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - "infrastructure/**"
+      - ".gitea/workflows/infrastructure-deploy.yml"
+
+# Pulumi state isn't safe to update concurrently; serialize runs and let a
+# newer push supersede one still queued (not one already applying).
+concurrency:
+  group: pulumi-thamanyah-main
+  cancel-in-progress: false
+
+env:
+  AWS_REGION: us-east-1
+
+jobs:
+  pulumi-up:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      # Broad infra-provisioning credentials, distinct from the narrowly
+      # scoped gitea-ci-user used by the app deploy workflows (ECR push +
+      # ecs:UpdateService only). Pulumi needs to create/update IAM, RDS,
+      # ECS, CloudFront, etc., so this identity is intentionally wider.
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          aws-access-key-id: ${{ secrets.PULUMI_AWS_ACCESS_KEY_ID }}
+          aws-secret-access-key: ${{ secrets.PULUMI_AWS_SECRET_ACCESS_KEY }}
+          aws-region: ${{ env.AWS_REGION }}
+
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version-file: infrastructure/go.mod
+
+      # Stack name assumes the runner is logged into the same Pulumi Cloud
+      # org as `pulumi.yaml`'s default; if PULUMI_ACCESS_TOKEN's org differs,
+      # qualify this as "<org>/main" instead.
+      - name: Pulumi up
+        uses: pulumi/actions@v6
+        with:
+          command: up
+          stack-name: main
+          work-dir: infrastructure
+        env:
+          PULUMI_ACCESS_TOKEN: ${{ secrets.PULUMI_ACCESS_TOKEN }}