|
| 1 | +# GitHub Actions Workflows |
| 2 | + |
| 3 | +## Deploy Workflow |
| 4 | + |
| 5 | +The `deploy.yml` workflow automatically deploys the liquidation bot to AWS ECS using CDK when code is pushed to the `main` branch. |
| 6 | + |
| 7 | +### Required GitHub Secrets |
| 8 | + |
| 9 | +Configure the following secrets in your GitHub repository settings (Settings → Secrets and variables → Actions): |
| 10 | + |
| 11 | +**Required:** |
| 12 | +1. **AWS_ACCESS_KEY_ID** - AWS access key with permissions to deploy CDK stacks |
| 13 | +2. **AWS_SECRET_ACCESS_KEY** - AWS secret access key |
| 14 | +3. **AWS_ACCOUNT_ID** - AWS account ID |
| 15 | +4. **SECRET_NAME** - Name of the AWS Secrets Manager secret (e.g., `mewler-liquidation-bot/config`) |
| 16 | + - The secret must contain `LIQUIDATOR_EOA` and `LIQUIDATOR_PRIVATE_KEY` |
| 17 | + |
| 18 | +**Optional (recommended for security):** |
| 19 | +5. **SECRET_NAME** - Name of the AWS Secrets Manager secret (e.g., `mewler-liquidation-bot/config`) |
| 20 | +6. **GLUEX_API_KEY** - Gluex API key (overrides hardcoded value in app.py) |
| 21 | +7. **GLUEX_UNIQUE_PID** - Gluex unique PID (overrides hardcoded value in app.py) |
| 22 | +8. **MAINNET_RPC_URL** - Mainnet RPC URL (overrides hardcoded value in app.py) |
| 23 | +9. **BASE_RPC_URL** - Base chain RPC URL (overrides hardcoded value in app.py) |
| 24 | +10. **ARBITRUM_RPC_URL** - Arbitrum RPC URL (overrides hardcoded value in app.py) |
| 25 | +11. **SLACK_WEBHOOK_URL** - Slack webhook URL (overrides hardcoded value in app.py) |
| 26 | + |
| 27 | +**Note:** It's recommended to move sensitive values (API keys, RPC URLs with keys) from `cdk/app.py` to GitHub secrets for better security. |
| 28 | + |
| 29 | +### IAM Permissions Required |
| 30 | + |
| 31 | +The AWS credentials need the following permissions: |
| 32 | +- CloudFormation (create/update/delete stacks) |
| 33 | +- ECS (create/update services, task definitions) |
| 34 | +- EC2 (describe VPCs, subnets, security groups) |
| 35 | +- IAM (create roles and policies) |
| 36 | +- ECR (push/pull container images) |
| 37 | +- CloudWatch Logs (create log groups) |
| 38 | +- Secrets Manager (read secrets, if using) |
| 39 | + |
| 40 | +### Workflow Steps |
| 41 | + |
| 42 | +1. Checks out the code |
| 43 | +2. Sets up Python and Node.js |
| 44 | +3. Installs CDK CLI |
| 45 | +4. Configures AWS credentials |
| 46 | +5. Sets up Python virtual environment and installs CDK dependencies |
| 47 | +6. Bootstraps CDK (if needed) |
| 48 | +7. Validates the CDK stack with `cdk synth` |
| 49 | +8. Deploys the stack with `cdk deploy` |
| 50 | + |
| 51 | +### Manual Trigger |
| 52 | + |
| 53 | +The workflow can also be manually triggered from the Actions tab in GitHub. |
| 54 | + |
0 commit comments