Skip to content

Latest commit

 

History

History
192 lines (154 loc) · 17.5 KB

README.md

File metadata and controls

192 lines (154 loc) · 17.5 KB
Raw

Module - GitHub App web hook

This module is treated as internal module, breaking changes will not trigger a major release bump.

This module creates an API gateway endpoint and lambda function to handle GitHub App webhook events.

Usages

Usage examples are available in the root module. By default the root module will assume local zip files containing the lambda distribution are available. See the download lambda module for more information.

Lambda Function

The Lambda function is written in TypeScript and requires Node 12.x and yarn. Sources are located in [./lambdas/webhook].

Install

cd lambdas/webhook
yarn install

Test

Test are implemented with Jest, calls to AWS and GitHub are mocked.

yarn run test

Package

To compile all TypeScript/JavaScript sources in a single file ncc is used.

yarn run dist

Requirements

Name Version
terraform >= 1.3.0
aws ~> 4.0

Providers

Name Version
aws ~> 4.0

Modules

No modules.

Resources

Name Type
aws_apigatewayv2_api.webhook resource
aws_apigatewayv2_integration.webhook resource
aws_apigatewayv2_route.webhook resource
aws_apigatewayv2_stage.webhook resource
aws_cloudwatch_log_group.webhook resource
aws_iam_role.webhook_lambda resource
aws_iam_role_policy.webhook_logging resource
aws_iam_role_policy.webhook_sqs resource
aws_iam_role_policy.webhook_ssm resource
aws_iam_role_policy.webhook_workflow_job_sqs resource
aws_iam_role_policy_attachment.webhook_vpc_execution_role resource
aws_lambda_function.webhook resource
aws_lambda_permission.webhook resource
aws_iam_policy_document.lambda_assume_role_policy data source

Inputs

Name Description Type Default Required
aws_partition (optional) partition for the base arn if not 'aws' string "aws" no
environment A name that identifies the environment, used as prefix and for tagging. string null no
github_app_parameters Parameter Store for GitHub App Parameters. 
object({
    webhook_secret = map(string)
  })
 n/a yes
kms_key_arn Optional CMK Key ARN to be used for Parameter Store. string null no
lambda_architecture AWS Lambda architecture. Lambda functions using Graviton processors ('arm64') tend to have better price/performance than 'x86_64' functions. string "arm64" no
lambda_runtime AWS Lambda runtime. string "nodejs18.x" no
lambda_s3_bucket S3 bucket from which to specify lambda functions. This is an alternative to providing local files directly. string null no
lambda_security_group_ids List of security group IDs associated with the Lambda function. list(string) [] no
lambda_subnet_ids List of subnets in which the action runners will be launched, the subnets needs to be subnets in the vpc_id. list(string) [] no
lambda_timeout Time out of the lambda in seconds. number 10 no
lambda_zip File location of the lambda zip file. string null no
log_level Logging level for lambda logging. Valid values are 'silly', 'trace', 'debug', 'info', 'warn', 'error', 'fatal'. string "info" no
log_type Logging format for lambda logging. Valid values are 'json', 'pretty', 'hidden'. string null no
logging_kms_key_id Specifies the kms key id to encrypt the logs with string null no
logging_retention_in_days Specifies the number of days you want to retain log events for the lambda log group. Possible values are: 0, 1, 3, 5, 7, 14, 30, 60, 90, 120, 150, 180, 365, 400, 545, 731, 1827, and 3653. number 7 no
prefix The prefix used for naming resources string "github-actions" no
repository_white_list List of repositories allowed to use the github app list(string) [] no
role_path The path that will be added to the role; if not set, the environment name will be used. string null no
role_permissions_boundary Permissions boundary that will be added to the created role for the lambda. string null no
runner_config SQS queue to publish accepted build events based on the runner type. 
map(object({
    arn  = string
    id   = string
    fifo = bool
    matcherConfig = object({
      labelMatchers = list(list(string))
      exactMatch    = bool
    })
  }))
 n/a yes
sqs_workflow_job_queue SQS queue to monitor github events. 
object({
    id  = string
    arn = string
  })
 null no
tags Map of tags that will be added to created resources. By default resources will be tagged with name and environment. map(string) {} no
webhook_lambda_apigateway_access_log_settings Access log settings for webhook API gateway. 
object({
    destination_arn = string
    format          = string
  })
 null no
webhook_lambda_s3_key S3 key for webhook lambda function. Required if using S3 bucket to specify lambdas. string null no
webhook_lambda_s3_object_version S3 object version for webhook lambda function. Useful if S3 versioning is enabled on source bucket. string null no

Outputs

Name Description
endpoint_relative_path n/a
gateway n/a
lambda n/a
lambda_log_group n/a
role n/a

Requirements

Name Version
terraform >= 1.3.0
aws ~> 4.0

Providers

Name Version
aws ~> 4.0

Modules

No modules.

Resources

Name Type
aws_apigatewayv2_api.webhook resource
aws_apigatewayv2_integration.webhook resource
aws_apigatewayv2_route.webhook resource
aws_apigatewayv2_stage.webhook resource
aws_cloudwatch_log_group.webhook resource
aws_iam_role.webhook_lambda resource
aws_iam_role_policy.webhook_logging resource
aws_iam_role_policy.webhook_sqs resource
aws_iam_role_policy.webhook_ssm resource
aws_iam_role_policy.webhook_workflow_job_sqs resource
aws_iam_role_policy_attachment.webhook_vpc_execution_role resource
aws_lambda_function.webhook resource
aws_lambda_permission.webhook resource
aws_iam_policy_document.lambda_assume_role_policy data source

Inputs

Name Description Type Default Required
aws_partition (optional) partition for the base arn if not 'aws' string "aws" no
environment A name that identifies the environment, used as prefix and for tagging. string null no
github_app_parameters Parameter Store for GitHub App Parameters. 
object({
    webhook_secret = map(string)
  })
 n/a yes
kms_key_arn Optional CMK Key ARN to be used for Parameter Store. string null no
lambda_architecture AWS Lambda architecture. Lambda functions using Graviton processors ('arm64') tend to have better price/performance than 'x86_64' functions. string "arm64" no
lambda_runtime AWS Lambda runtime. string "nodejs18.x" no
lambda_s3_bucket S3 bucket from which to specify lambda functions. This is an alternative to providing local files directly. string null no
lambda_security_group_ids List of security group IDs associated with the Lambda function. list(string) [] no
lambda_subnet_ids List of subnets in which the action runners will be launched, the subnets needs to be subnets in the vpc_id. list(string) [] no
lambda_timeout Time out of the lambda in seconds. number 10 no
lambda_zip File location of the lambda zip file. string null no
log_level Logging level for lambda logging. Valid values are 'silly', 'trace', 'debug', 'info', 'warn', 'error', 'fatal'. string "info" no
log_type Logging format for lambda logging. Valid values are 'json', 'pretty', 'hidden'. string null no
logging_kms_key_id Specifies the kms key id to encrypt the logs with string null no
logging_retention_in_days Specifies the number of days you want to retain log events for the lambda log group. Possible values are: 0, 1, 3, 5, 7, 14, 30, 60, 90, 120, 150, 180, 365, 400, 545, 731, 1827, and 3653. number 7 no
prefix The prefix used for naming resources string "github-actions" no
repository_white_list List of repositories allowed to use the github app list(string) [] no
role_path The path that will be added to the role; if not set, the environment name will be used. string null no
role_permissions_boundary Permissions boundary that will be added to the created role for the lambda. string null no
runner_config SQS queue to publish accepted build events based on the runner type. 
map(object({
    arn  = string
    id   = string
    fifo = bool
    matcherConfig = object({
      labelMatchers = list(list(string))
      exactMatch    = bool
    })
  }))
 n/a yes
sqs_workflow_job_queue SQS queue to monitor github events. 
object({
    id  = string
    arn = string
  })
 null no
tags Map of tags that will be added to created resources. By default resources will be tagged with name and environment. map(string) {} no
webhook_lambda_apigateway_access_log_settings Access log settings for webhook API gateway. 
object({
    destination_arn = string
    format          = string
  })
 null no
webhook_lambda_s3_key S3 key for webhook lambda function. Required if using S3 bucket to specify lambdas. string null no
webhook_lambda_s3_object_version S3 object version for webhook lambda function. Useful if S3 versioning is enabled on source bucket. string null no

Outputs

Name Description
endpoint_relative_path n/a
gateway n/a
lambda n/a
lambda_log_group n/a
role n/a