deploy-aws.yml

name: Deploy Scanner to AWS

on:
  workflow_call:
    inputs:
      environment:
        description: 'Deployment environment'
        required: true
        type: string
      provisionedConcurrency:
        description: 'Provisioned concurrency'
        required: true
        type: number
      checkoutBranch:
        description: 'Branch to checkout code from'
        required: true
        type: string

permissions:
  id-token: write
  contents: read

jobs:
  virus-scanner:
    name: virus scanner serverless
    runs-on: ubuntu-latest

    steps:
      - name: Checkout source code from specified checkout branch
        uses: actions/checkout@v3
        with:
          ref: ${{ inputs.checkoutBranch }}

      - name: Setup Node.js
        uses: actions/setup-node@v3
        with:
          node-version-file: '.nvmrc'

      - name: Cache Node.js modules
        uses: actions/cache@v3
        with:
          path: ~/.npm
          key: ${{ runner.OS }}-node-scanner-${{ hashFiles('**/package-lock.json') }}
          restore-keys: |
            ${{ runner.OS }}-node-scanner-
            ${{ runner.OS }}-node-

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v1.7.0
        with:
          role-to-assume: ${{ secrets.AWS_CI_ROLE_TO_ASSUME }}
          aws-region: ${{ secrets.AWS_DEFAULT_REGION }}

      - name: Install node dependencies
        run: npm ci

      - name: Deploy with Serverless Framework
        env:
          ENV: ${{ inputs.environment }}
          CONCURRENCY: ${{ inputs.provisionedConcurrency }}
        run: npm run deploy