Merge branch dev -> homolog - Criado Automatico

.github/scripts/assert_project_configured.sh

@@ -0,0 +1,45 @@
+#!/usr/bin/env bash
+# Blocks CD deploy while this repo still looks like the clean_mss_template starter.
+set -euo pipefail
+
+REPO_NAME="${GITHUB_REPOSITORY##*/}"
+
+FORBIDDEN_REPO_NAMES=(
+  "clean_mss_template"
+)
+
+FORBIDDEN_STACK_PREFIX="CleanMssTemplate"
+FORBIDDEN_PROJECT_TAG="Template"
+
+failed=0
+
+for name in "${FORBIDDEN_REPO_NAMES[@]}"; do
+  if [[ "$REPO_NAME" == "$name" ]]; then
+    echo "::error::Repository is still named '${name}'. Rename it before enabling CD deploy."
+    failed=1
+  fi
+done
+
+if [[ "${GITHUB_REPOSITORY}" == "Maua-Dev/clean_mss_template" ]]; then
+  echo "::error::Refusing to deploy the upstream template repository itself."
+  failed=1
+fi
+
+if grep -qE "STACK_NAME=${FORBIDDEN_STACK_PREFIX}" .github/workflows/CD.yml; then
+  echo "::error::Change STACK_NAME prefix in .github/workflows/CD.yml (still '${FORBIDDEN_STACK_PREFIX}')."
+  failed=1
+fi
+
+if grep -qE "['\"]project['\"]: ['\"]${FORBIDDEN_PROJECT_TAG}['\"]" iac/app.py; then
+  echo "::error::Change the project tag in iac/app.py (still '${FORBIDDEN_PROJECT_TAG}')."
+  failed=1
+fi
+
+if [[ "$failed" -ne 0 ]]; then
+  echo ""
+  echo "CD deploy is blocked until the template identity is customized."
+  echo "No AWS resources will be created."
+  exit 1
+fi
+
+echo "Template identity looks customized. Deploy may proceed."

.github/workflows/CD.yml

@@ -1,9 +1,87 @@
-
 name: CD
 
 on:
   push:
     branches:
-      - main
+      - dev
+      - homolog
+      - prod
 
   workflow_dispatch:
+
+jobs:
+  deployGuard:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Assert project is no longer the unmodified template
+        run: bash .github/scripts/assert_project_configured.sh
+        env:
+          GITHUB_REPOSITORY: ${{ github.repository }}
+
+  testApp:
+    needs: [deployGuard]
+    uses: maua-dev/ci_workflows_reusable/.github/workflows/pytest_ci_313.yml@V1.3
+
+  cdkSynth:
+    needs: [deployGuard]
+    uses: ./.github/workflows/cdk_synth_ci.yml
+
+  DeployToAWS:
+    needs: [deployGuard, testApp, cdkSynth]
+    environment:
+      name: ${{ github.ref_name }}
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+      contents: read
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.13"
+
+      - name: Set AWS Account ID
+        run: |
+          if [[ "${{ github.ref_name }}" == "dev" ]]; then
+            echo "AWS_ACCOUNT_ID=${{ secrets.AWS_ACCOUNT_ID_DEV }}" >> $GITHUB_ENV
+          elif [[ "${{ github.ref_name }}" == "homolog" ]]; then
+            echo "AWS_ACCOUNT_ID=${{ secrets.AWS_ACCOUNT_ID_HOML }}" >> $GITHUB_ENV
+          elif [[ "${{ github.ref_name }}" == "prod" ]]; then
+            echo "AWS_ACCOUNT_ID=${{ secrets.AWS_ACCOUNT_ID_PROD }}" >> $GITHUB_ENV
+          else
+            echo "Invalid branch name: ${{ github.ref_name }}" && exit 1
+          fi
+
+      - name: Setup AWS Credentials
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          aws-region: ${{ vars.AWS_REGION }}
+          role-to-assume: arn:aws:iam::${{ env.AWS_ACCOUNT_ID }}:role/GithubActionsRole
+          role-session-name: github-action
+
+      - name: Setting stage and stack name
+        run: |
+          echo "STACK_NAME=EpepStackBack${{ github.ref_name }}" >> $GITHUB_ENV
+
+      - name: Installing Dependencies
+        run: |
+          npm install -g aws-cdk
+          pip install -r requirements-app.txt
+          pip install -r iac/requirements-infra.txt
+
+      - name: DeployWithCDK
+        working-directory: iac
+        run: |
+          cdk synth "$STACK_NAME"
+          cdk deploy "$STACK_NAME" --require-approval never
+        env:
+          AWS_REGION: ${{ vars.AWS_REGION }}
+          AWS_ACCOUNT_ID: ${{ env.AWS_ACCOUNT_ID }}
+          STACK_NAME: ${{ env.STACK_NAME }}
+          STAGE: ${{ github.ref_name }}
+          GITHUB_REF_NAME: ${{ github.ref_name }}
+          MSS_NAME: ${{ github.event.repository.name }}
+          GRAPH_MICROSOFT_ENDPOINT: ${{ vars.GRAPH_MICROSOFT_ENDPOINT }}

.github/workflows/CI.yml

@@ -7,4 +7,14 @@ on:
 
 jobs:
   testApp:
-    uses: maua-dev/ci_workflows_reusable/.github/workflows/pytest_ci.yml@V1.0
+    uses: maua-dev/ci_workflows_reusable/.github/workflows/pytest_ci_313.yml@V1.3
+
+  cdkSynth:
+    if: >
+      github.event_name != 'pull_request' &&
+      (github.ref_name == 'dev' ||
+       github.ref_name == 'homolog' ||
+       github.ref_name == 'prod' ||
+       startsWith(github.ref_name, 'feature/infra') ||
+       startsWith(github.ref_name, 'infra/'))
+    uses: ./.github/workflows/cdk_synth_ci.yml

.github/workflows/cdk_synth_ci.yml

@@ -0,0 +1,37 @@
+name: CDK Synth
+
+on:
+  workflow_call:
+
+jobs:
+  cdkSynth:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.13"
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "20"
+
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install -r requirements-app.txt
+          pip install -r iac/requirements-infra.txt
+          npm install -g aws-cdk
+
+      - name: CDK synth
+        working-directory: iac
+        run: cdk synth
+        env:
+          AWS_REGION: sa-east-1
+          AWS_ACCOUNT_ID: "000000000000"
+          STACK_NAME: EpepStackBackCi
+          STAGE: ci
+          GITHUB_REF_NAME: ci
+          MSS_NAME: epep_api
+          GRAPH_MICROSOFT_ENDPOINT: https://graph.microsoft.com/v1.0/me

.gitignore

@@ -133,4 +133,6 @@ dmypy.json
 
 /.vscode/
 /.idea/
+.DS_Store
 iac/local/docker/dynamodb/shared-local-instance.db
+iac/local/docker/minio/

iac/.gitignore

@@ -5,6 +5,7 @@ __pycache__
 .venv
 *.egg-info
 lambda_layer_out_temp/
+build/
 
 # CDK asset staging directory
 .cdk.staging

iac/README.md

@@ -34,7 +34,7 @@ If you are a Windows platform, you would activate the virtualenv like this:
 Once the virtualenv is activated, you can install the required dependencies.
 
 ```
-$ pip install -r requirements.txt
+$ pip install -r requirements-infra.txt
 ```
 
 At this point you can now synthesize the CloudFormation template for this code.
@@ -44,7 +44,7 @@ $ cdk synth
 ```
 
 To add additional dependencies, for example other CDK libraries, just add
-them to your `setup.py` file and rerun the `pip install -r requirements.txt`
+them to your `setup.py` file and rerun the `pip install -r requirements-infra.txt`
 command.
 
 ## Useful commands

iac/adjust_layer_directory.py

@@ -1,37 +1,60 @@
 import os
 import shutil
+import subprocess
 from pathlib import Path
-import sys
 
-IAC_DIRECTORY_NAME = "iac"
-SOURCE_DIRECTORY_NAME = "src"
-LAMBDA_LAYER_PREFIX = os.path.join("python", "src")
-
-
-def adjust_layer_directory(shared_dir_name: str, destination: str):
-    # Get the root directory of the source directory
-    root_directory = Path(__file__).parent.parent
-    iac_directory = os.path.join(root_directory, IAC_DIRECTORY_NAME)
-
-    print(f"Root directory: {root_directory}")
-    print(f"Root direcotry files: {os.listdir(root_directory)}")
-    print(f"IaC directory: {iac_directory}")
-    print(f"IaC directory files: {os.listdir(iac_directory)}")
-
-
-    # Get the destination and source directory
-    destination_directory = os.path.join(root_directory, IAC_DIRECTORY_NAME, destination)
-    source_directory = os.path.join(root_directory, SOURCE_DIRECTORY_NAME, shared_dir_name)
-
-    # Delete the destination directory if it exists
-    if os.path.exists(destination_directory):
-        shutil.rmtree(destination_directory)
-
-    # Copy the source directory to the destination directory
-    shutil.copytree(source_directory, os.path.join(destination_directory, LAMBDA_LAYER_PREFIX, shared_dir_name))
-    print(
-        f"Copying files from {source_directory} to {os.path.join(destination_directory, LAMBDA_LAYER_PREFIX, shared_dir_name)}")
-
-
-if __name__ == '__main__':
-    adjust_layer_directory(shared_dir_name="shared", destination="lambda_layer_out_temp")
+BUILD_DIRECTORY = "build"
+PYTHON_TOP_LEVEL_DIR = os.path.join(BUILD_DIRECTORY, "python")
+REQUIREMENTS_FILE = "requirements-app.txt"
+
+PROJECT_ROOT = Path(__file__).parent.parent
+SHARED_CODE_SOURCE = os.path.join(PROJECT_ROOT, "src", "shared")
+
+
+def adjust_layer_directory():
+    """
+    Prepara um diretório 'build' para uma Lambda Layer do AWS CDK.
+
+    A função junta o código local compartilhado e as dependências externas (pip)
+    na estrutura de pastas que a Lambda espera (/python).
+    """
+    if os.path.exists(BUILD_DIRECTORY):
+        shutil.rmtree(BUILD_DIRECTORY)
+
+    shared_code_intermediate_dir = os.path.join(PYTHON_TOP_LEVEL_DIR, "src")
+    os.makedirs(shared_code_intermediate_dir)
+
+    print(f"Copiando código de: {SHARED_CODE_SOURCE}")
+    shared_code_dest = os.path.join(
+        shared_code_intermediate_dir,
+        os.path.basename(SHARED_CODE_SOURCE),
+    )
+    shutil.copytree(SHARED_CODE_SOURCE, shared_code_dest)
+
+    requirements_path = os.path.join(PROJECT_ROOT, REQUIREMENTS_FILE)
+    if os.path.exists(requirements_path):
+        subprocess.check_call(
+            [
+                "pip",
+                "install",
+                "-r",
+                requirements_path,
+                "-t",
+                PYTHON_TOP_LEVEL_DIR,
+                "--no-cache-dir",
+                "--platform",
+                "manylinux2014_x86_64",
+                "--python-version",
+                "3.13",
+                "--only-binary=:all:",
+            ]
+        )
+    else:
+        print(
+            f"Aviso: Arquivo '{requirements_path}' não encontrado. "
+            "Nenhuma dependência externa será instalada."
+        )
+
+
+if __name__ == "__main__":
+    adjust_layer_directory()