undp · Nolski · Jul 15, 2025 · Apr 24, 2025 · Apr 24, 2025 · Apr 24, 2025
diff --git a/.github/workflows/deployment-demo.yml b/.github/workflows/deployment-demo.yml
@@ -0,0 +1,178 @@
+name: Carbon Registry Demo Deployment
+on:
+  push:
+    branches:
+      - "main"
+    paths:
+      - web/**
+      - backend/**
+      - .github/workflows/deployment*
+
+jobs:
+  changes:
+    name: Deploy Pre Check
+    runs-on: ubuntu-latest
+    outputs:
+      backend-changes: ${{ steps.changes.outputs.backend-changes }}
+      all-changes: ${{ steps.changes.outputs.all-changes }}
+      workflows-changes: ${{ steps.changes.outputs.workflows-changes }}
+      frontend-changes: ${{ steps.changes.outputs.frontend-changes }}
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          fetch-depth: 0
+          ref: ${{ github.event.inputs.branch_name || github.ref }}
+      - name: Use Node.js ${{ matrix.node-version }}
+        uses: actions/setup-node@v3
+        with:
+          node-version: ${{ matrix.node-version }}
+      - name: Determine changed services
+        id: changes
+        run: |
+          CHANGED_FILES=$(git diff --name-only HEAD^ HEAD)
+
+          if echo "$CHANGED_FILES" | grep -q "docker-"; then
+            echo "All changes detected."
+            echo "all-changes=true" >> $GITHUB_OUTPUT
+          else
+            echo "No All changes detected."
+            echo "all-changes=false" >> $GITHUB_OUTPUT
+          fi
+
+          if echo "$CHANGED_FILES" | grep -q ".github/workflows/"; then
+            echo "Workflow changes detected."
+            echo "workflows-changes=true" >> $GITHUB_OUTPUT
+          else
+            echo "No Workflow changes detected."
+            echo "workflows-changes=false" >> $GITHUB_OUTPUT
+          fi
+
+          if echo "$CHANGED_FILES" | grep -q "web/"; then
+            echo "Frontend changes detected."
+            echo "frontend-changes=true" >> $GITHUB_OUTPUT
+          else
+            echo "No Frontend changes detected."
+            echo "frontend-changes=false" >> $GITHUB_OUTPUT
+          fi
+
+          if echo "$CHANGED_FILES" | grep -q "backend/"; then
+            echo "Backend changes detected."
+            echo "backend-changes=true" >> $GITHUB_OUTPUT
+          else
+            echo "No Backend changes detected."
+            echo "backend-changes=false" >> $GITHUB_OUTPUT
+          fi
+
+  deploy_frontend:
@@ -1,2 +1,4 @@
 name: Carbon Registry Demo Deployment
+permissions:
+  contents: read
 on:
@@ -1,2 +1,4 @@
 name: Carbon Registry Demo Deployment
+permissions:
+  contents: read
 on:
+    name: Carbon Registry Frontend Deploy
+    needs: changes
+    if: needs.changes.outputs.frontend-changes == 'true' || needs.changes.outputs.workflows-changes == 'true' || needs.changes.outputs.all-changes == 'true'
+    runs-on: ubuntu-latest
+    concurrency:
+      group: ${{ github.workflow }}-${{ github.ref }}-'frontend'
+      cancel-in-progress: true
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+      - name: Check Docker variable changes
+        run: |
+          echo "docker-compose file Change...."
+          git diff HEAD~ -- HEAD -z ./docker-compose*
+      - name: Cache modules
+        uses: actions/cache@v3
+        id: yarn-cache
+        with:
+          path: node_modules
+          key: ${{ runner.os }}-yarn-${{ hashFiles('**/yarn.lock') }}
+          restore-keys: ${{ runner.os }}-yarn-
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@v1
+        with:
+          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          aws-region: us-east-1
+      - name: Use Node.js ${{ matrix.node-version }}
+        uses: actions/setup-node@v3
+        with:
+          node-version: ${{ matrix.node-version }}
+      - name: Login to Amazon ECR
+        id: login-ecr
+        uses: aws-actions/amazon-ecr-login@v1
+      - name: Build, tag, and push the image to Amazon ECR
+        id: build-image
+        env:
+          ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
+          ECR_REPOSITORY: carbon-web
+          IMAGE_TAG: ${{ github.head_ref || github.ref_name }}
+        run: |
+          # Build a docker container and push it to ECR 
+          docker build -t $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG -f web/Dockerfile . --build-arg PORT=3030 --build-arg VITE_APP_BACKEND=http://localhost:3000 --build-arg VITE_APP_COUNTRY_NAME="CountryX" --build-arg VITE_APP_REGISTRY_NAME="CountryXRegistry" --build-arg VITE_APP_MAP_TYPE="Mapbox" --build-arg VITE_APP_MAPBOXGL_ACCESS_TOKEN=${{ secrets.MAPBOXGL_ACCESS_TOKEN }} --build-arg VITE_APP_MAXIMUM_FILE_SIZE=5242880 --build-arg COUNTRY_FLAG_URL="https://carbon-common-dev.s3.amazonaws.com/flag.png" 
+          echo "Pushing image to ECR..."
+          docker push $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG
+          echo "::set-output name=image::$ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG"
+      - name: Deploy docker image to Amazon EC2
+        if: github.ref == 'refs/heads/main'
+        env:
+          ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
+          ECR_REPOSITORY: carbon-web
+          IMAGE_TAG: ${{ github.head_ref || github.ref_name }}
+          PRIVATE_KEY: ${{ secrets.AWS_SSH_KEY_PRIVATE_DEMO }}
+          HOSTNAME: ${{secrets.HOST_IP_DEMO }}
+          USER_NAME: ec2-user
+        run: |
+          echo "$PRIVATE_KEY" > private_key && chmod 600 private_key
+          ssh -o StrictHostKeyChecking=no -i private_key ${USER_NAME}@${HOSTNAME} '
+            carbon/prod_frontend_deploy.sh '
+
+  deploy_backend:
@@ -1,2 +1,4 @@
 name: Carbon Registry Demo Deployment
+permissions:
+  contents: read
 on:
@@ -1,2 +1,4 @@
 name: Carbon Registry Demo Deployment
+permissions:
+  contents: read
 on:
+    name: Carbon Registry Backend Deploy
+    needs: changes
+    if: needs.changes.outputs.backend-changes == 'true' || needs.changes.outputs.workflows-changes == 'true' || needs.changes.outputs.all-changes == 'true'
+    runs-on: ubuntu-latest
+    concurrency:
+      group: ${{ github.workflow }}-${{ github.ref }}-'backend'
+      cancel-in-progress: true
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+      - name: Check Docker variable changes
+        run: |
+          echo "docker-compose file Change...."
+          git diff HEAD~ -- HEAD -z ./docker-compose*
+      - name: Use Node.js ${{ matrix.node-version }}
+        uses: actions/setup-node@v3
+        with:
+          node-version: ${{ matrix.node-version }}
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@v1
+        with:
+          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          aws-region: us-east-1
+      - name: Login to Amazon ECR
+        id: login-ecr
+        uses: aws-actions/amazon-ecr-login@v1
+      - name: Build, tag, and push the image to Amazon ECR
+        id: build-image
+        env:
+          ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
+          ECR_REPOSITORY: carbon-services
+          IMAGE_TAG: ${{ github.head_ref || github.ref_name }}
+        run: |
+          # Build a docker container and push it to ECR 
+          docker build -t $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG -f backend/services/Dockerfile .
+          echo "Pushing image to ECR..."
+          docker push $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG
+          echo "::set-output name=image::$ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG"
+      - name: Deploy docker image to Amazon EC2
+        if: github.ref == 'refs/heads/main'
+        env:
+          PRIVATE_KEY: ${{ secrets.AWS_SSH_KEY_PRIVATE_DEMO }}
+          HOSTNAME: ${{secrets.HOST_IP_DEMO }}
+          USER_NAME: ec2-user
+        run: |
+          echo "$PRIVATE_KEY" > private_key && chmod 600 private_key
+          ssh -o StrictHostKeyChecking=no -i private_key ${USER_NAME}@${HOSTNAME} '
+           carbon/prod_backend_deploy.sh '
@@ -1,2 +1,4 @@
 name: Carbon Registry Demo Deployment
+permissions:
+  contents: read
 on:
@@ -1,2 +1,4 @@
 name: Carbon Registry Demo Deployment
+permissions:
+  contents: read
 on:
diff --git a/.github/workflows/deployment-test.yml b/.github/workflows/deployment-test.yml
@@ -0,0 +1,178 @@
+name: Carbon Registry Test Deployment
+on:
+  push:
+    branches:
+      - '*'
+    paths:
+      - web/**
+      - backend/**
+      - .github/workflows/deployment*
+
+jobs:
+  changes:
+    name: Deploy Pre Check
+    runs-on: ubuntu-latest
+    outputs:
+      backend-changes: ${{ steps.changes.outputs.backend-changes }}
+      all-changes: ${{ steps.changes.outputs.all-changes }}
+      workflows-changes: ${{ steps.changes.outputs.workflows-changes }}
+      frontend-changes: ${{ steps.changes.outputs.frontend-changes }}
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          fetch-depth: 0
+          ref: ${{ github.event.inputs.branch_name || github.ref }}
+      - name: Use Node.js ${{ matrix.node-version }}
+        uses: actions/setup-node@v3
+        with:
+          node-version: ${{ matrix.node-version }}
+      - name: Determine changed services
+        id: changes
+        run: |
+          CHANGED_FILES=$(git diff --name-only HEAD^ HEAD)
+
+          if echo "$CHANGED_FILES" | grep -q "docker-"; then
+            echo "All changes detected."
+            echo "all-changes=true" >> $GITHUB_OUTPUT
+          else
+            echo "No All changes detected."
+            echo "all-changes=false" >> $GITHUB_OUTPUT
+          fi
+
+          if echo "$CHANGED_FILES" | grep -q ".github/workflows/"; then
+            echo "Workflow changes detected."
+            echo "workflows-changes=true" >> $GITHUB_OUTPUT
+          else
+            echo "No Workflow changes detected."
+            echo "workflows-changes=false" >> $GITHUB_OUTPUT
+          fi
+
+          if echo "$CHANGED_FILES" | grep -q "web/"; then
+            echo "Frontend changes detected."
+            echo "frontend-changes=true" >> $GITHUB_OUTPUT
+          else
+            echo "No Frontend changes detected."
+            echo "frontend-changes=false" >> $GITHUB_OUTPUT
+          fi
+
+          if echo "$CHANGED_FILES" | grep -q "backend/"; then
+            echo "Backend changes detected."
+            echo "backend-changes=true" >> $GITHUB_OUTPUT
+          else
+            echo "No Backend changes detected."
+            echo "backend-changes=false" >> $GITHUB_OUTPUT
+          fi
+
+  deploy_frontend:
@@ -1,2 +1,6 @@
 name: Carbon Registry Test Deployment
+permissions:
+  contents: read
+  packages: write
+  id-token: write
 on:
@@ -1,2 +1,6 @@
 name: Carbon Registry Test Deployment
+permissions:
+  contents: read
+  packages: write
+  id-token: write
 on:
+    name: Carbon Registry Frontend Deploy
+    needs: changes
+    if: needs.changes.outputs.frontend-changes == 'true' || needs.changes.outputs.workflows-changes == 'true' || needs.changes.outputs.all-changes == 'true'
+    runs-on: ubuntu-latest
+    concurrency:
+      group: ${{ github.workflow }}-${{ github.ref }}-'frontend'
+      cancel-in-progress: true
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+      - name: Check Docker variable changes
+        run: |
+          echo "docker-compose file Change...."
+          git diff HEAD~ -- HEAD -z ./docker-compose*
+      - name: Cache modules
+        uses: actions/cache@v3
+        id: yarn-cache
+        with:
+          path: node_modules
+          key: ${{ runner.os }}-yarn-${{ hashFiles('**/yarn.lock') }}
+          restore-keys: ${{ runner.os }}-yarn-
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@v1
+        with:
+          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          aws-region: us-east-1
+      - name: Use Node.js ${{ matrix.node-version }}
+        uses: actions/setup-node@v3
+        with:
+          node-version: ${{ matrix.node-version }}
+      - name: Login to Amazon ECR
+        id: login-ecr
+        uses: aws-actions/amazon-ecr-login@v1
+      - name: Build, tag, and push the image to Amazon ECR
+        id: build-image
+        env:
+          ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
+          ECR_REPOSITORY: carbon-web
+          IMAGE_TAG: ${{ github.head_ref || github.ref_name }}
+        run: |
+          # Build a docker container and push it to ECR 
+          docker build -t $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG -f web/Dockerfile . --build-arg PORT=3030 --build-arg VITE_APP_BACKEND=http://localhost:3000 --build-arg VITE_APP_COUNTRY_NAME="CountryX" --build-arg VITE_APP_REGISTRY_NAME="CountryXRegistry" --build-arg VITE_APP_MAP_TYPE="Mapbox" --build-arg VITE_APP_MAPBOXGL_ACCESS_TOKEN=${{ secrets.MAPBOXGL_ACCESS_TOKEN }} --build-arg VITE_APP_MAXIMUM_FILE_SIZE=5242880 --build-arg COUNTRY_FLAG_URL="https://carbon-common-dev.s3.amazonaws.com/flag.png" 
+          echo "Pushing image to ECR..."
+          docker push $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG
+          echo "::set-output name=image::$ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG"
+      - name: Deploy docker image to Amazon EC2
+        if: github.ref == 'refs/heads/develop'
+        env:
+          ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
+          ECR_REPOSITORY: carbon-web
+          IMAGE_TAG: ${{ github.head_ref || github.ref_name }}
+          PRIVATE_KEY: ${{ secrets.AWS_SSH_KEY_PRIVATE_TEST }}
+          HOSTNAME: ${{secrets.HOST_IP_TEST }}
+          USER_NAME: ec2-user
+        run: |
+          echo "$PRIVATE_KEY" > private_key && chmod 600 private_key
+          ssh -o StrictHostKeyChecking=no -i private_key ${USER_NAME}@${HOSTNAME} '
+            carbon/dev_frontend_deploy.sh '
+
+  deploy_backend:
@@ -1,2 +1,4 @@
 name: Carbon Registry Test Deployment
+permissions:
+  contents: read
 on:
@@ -1,2 +1,4 @@
 name: Carbon Registry Test Deployment
+permissions:
+  contents: read
 on:
+    name: Carbon Registry Backend Deploy
+    needs: changes
+    if: needs.changes.outputs.backend-changes == 'true' || needs.changes.outputs.workflows-changes == 'true' || needs.changes.outputs.all-changes == 'true'
+    runs-on: ubuntu-latest
+    concurrency:
+      group: ${{ github.workflow }}-${{ github.ref }}-'backend'
+      cancel-in-progress: true
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+      - name: Check Docker variable changes
+        run: |
+          echo "docker-compose file Change...."
+          git diff HEAD~ -- HEAD -z ./docker-compose*
+      - name: Use Node.js ${{ matrix.node-version }}
+        uses: actions/setup-node@v3
+        with:
+          node-version: ${{ matrix.node-version }}
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@v1
+        with:
+          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          aws-region: us-east-1
+      - name: Login to Amazon ECR
+        id: login-ecr
+        uses: aws-actions/amazon-ecr-login@v1
+      - name: Build, tag, and push the image to Amazon ECR
+        id: build-image
+        env:
+          ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
+          ECR_REPOSITORY: carbon-services
+          IMAGE_TAG: ${{ github.head_ref || github.ref_name }}
+        run: |
+          # Build a docker container and push it to ECR 
+          docker build -t $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG -f backend/services/Dockerfile .
+          echo "Pushing image to ECR..."
+          docker push $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG
+          echo "::set-output name=image::$ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG"
+      - name: Deploy docker image to Amazon EC2
+        if: github.ref == 'refs/heads/develop'
+        env:
+          PRIVATE_KEY: ${{ secrets.AWS_SSH_KEY_PRIVATE_TEST }}
+          HOSTNAME: ${{secrets.HOST_IP_TEST }}
+          USER_NAME: ec2-user
+        run: |
+          echo "$PRIVATE_KEY" > private_key && chmod 600 private_key
+          ssh -o StrictHostKeyChecking=no -i private_key ${USER_NAME}@${HOSTNAME} '
+            carbon/dev_backend_deploy.sh '
@@ -1,2 +1,5 @@
 name: Carbon Registry Test Deployment
+permissions:
+  contents: read
+  id-token: write
 on:
@@ -1,2 +1,5 @@
 name: Carbon Registry Test Deployment
+permissions:
+  contents: read
+  id-token: write
 on: