From faf3af8a78602483e000d527dc5b2b09b7869505 Mon Sep 17 00:00:00 2001 From: Cristian Magherusan-Stanciu Date: Tue, 6 Oct 2026 21:55:42 +0200 Subject: [PATCH] fix(ci): resolve AWS_REGION at job level in the AWS deploy workflows Workflow-level env is evaluated before a job's environment binding, so an environment-scoped AWS_REGION was invisible and prod deployed to the repo-level region or the us-east-1 fallback. Set it per environment-bound job, as destroy-fargate-dev.yml and cleanup-staging.yml already do. --- .github/workflows/deploy-aws-fargate.yml | 6 +++++- .github/workflows/deploy-aws-lambda.yml | 11 ++++++++++- 2 files changed, 15 insertions(+), 2 deletions(-) diff --git a/.github/workflows/deploy-aws-fargate.yml b/.github/workflows/deploy-aws-fargate.yml index f4b1533cf..68935718f 100644 --- a/.github/workflows/deploy-aws-fargate.yml +++ b/.github/workflows/deploy-aws-fargate.yml @@ -59,7 +59,6 @@ on: required: true env: - AWS_REGION: ${{ vars.AWS_REGION || 'us-east-1' }} TF_VERSION: '1.10.0' FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true @@ -142,6 +141,11 @@ jobs: outputs: alb_url: ${{ steps.outputs.outputs.alb_url }} service_name: ${{ steps.outputs.outputs.service_name }} + # Set at job level, not workflow level: workflow-level `env:` is resolved + # before this job's `environment:` is in scope, so an environment-scoped + # AWS_REGION variable would be invisible there. Matches cleanup-staging.yml. + env: + AWS_REGION: ${{ vars.AWS_REGION || 'us-east-1' }} environment: name: aws-fargate-${{ needs.prepare.outputs.target_environment }} url: ${{ steps.outputs.outputs.alb_url }} diff --git a/.github/workflows/deploy-aws-lambda.yml b/.github/workflows/deploy-aws-lambda.yml index ab56596aa..12042e324 100644 --- a/.github/workflows/deploy-aws-lambda.yml +++ b/.github/workflows/deploy-aws-lambda.yml @@ -83,7 +83,6 @@ on: required: true env: - AWS_REGION: ${{ vars.AWS_REGION || 'us-east-1' }} TF_VERSION: '1.10.0' FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true @@ -232,6 +231,11 @@ jobs: # all share one value — producing wrong email links in customer # mailboxes. Per CR review on PR #368. environment: ${{ needs.prepare.outputs.target_environment }} + # Set at job level, not workflow level: workflow-level `env:` is resolved + # before this job's `environment:` is in scope, so an environment-scoped + # AWS_REGION variable would be invisible there. Matches cleanup-staging.yml. + env: + AWS_REGION: ${{ vars.AWS_REGION || 'us-east-1' }} outputs: function_url: ${{ steps.outputs.outputs.function_url }} function_name: ${{ steps.outputs.outputs.function_name }} @@ -378,6 +382,11 @@ jobs: # Bind to the same named environment as build-and-deploy so that # vars.AWS_ROLE_TO_ASSUME resolves to the per-environment scoped value. environment: ${{ needs.prepare.outputs.target_environment }} + # Set at job level, not workflow level: workflow-level `env:` is resolved + # before this job's `environment:` is in scope, so an environment-scoped + # AWS_REGION variable would be invisible there. Matches cleanup-staging.yml. + env: + AWS_REGION: ${{ vars.AWS_REGION || 'us-east-1' }} steps: - name: Configure AWS credentials