Add a GitHub delete action on feature branch delete #42
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
brianz
changed the title
Why --- - Feature branch resources are automatically created, but never deleted. By watching expanding the default pipeline to watch for `delete` events, we can automatically delete feature stacks using `sam delete`. How --- - Watch for `delete` events in GH Pipeline - Add a step to delete the feature stacks. Note that when a `delete` event occurs, `github.ref` is set to `refs/heads/main`. To get the branch that was deleted, we need to look at `github.event.ref`. - Only run tests on the `push` event. Next Steps ---------- - Update SAM CLI to add additional `Allow` permissions to the PipelineExecutionRolePolicy. SAM needs S3 DeleteObject and CloudFormation GetTemplate/DeleteStack in order for this to work. https://github.com/aws/aws-sam-cli/blob/0626f9463f565acebc5b733d16007fd4f666413f/samcli/lib/pipeline/bootstrap/stage_resources.yaml#L211-L273
8 tasks
aahung
reviewed
Aug 30, 2021
|
|
||
| - name: Delete feature branch stack | ||
| env: | ||
| FEATURE_STACK_NAME: {{ '${{ toJSON(github.event.ref) }}' }} |
There was a problem hiding this comment.
I don't have context here, why we need to use toJSON here?
There was a problem hiding this comment.
Good catch...that cast with toJSON isn't needed. I've removed it.
- The `toJSON` call isn't needed in order to set the branch name variable. - Rename variable to be accurate and make it more clear
aahung
approved these changes
Oct 6, 2021
There was a problem hiding this comment.
This works great, thanks!
(hold for merge until aws/aws-sam-cli#3213 is merged and released)
aahung
pushed a commit
to aws/aws-sam-cli
that referenced
this pull request
Oct 7, 2021
* Revert "release: 0.20.0" * chore: Update version to 0.20.1 * Revert "Revert "release: 0.20.0"" (#1377) This reverts commit 2090431. * Add to PipelineExecutionRolePermissions to allow stack deletion Why --- The `PipelineExecutionRole` is assumed by the `PipelineUser` when deploying CI/CD pipelines. This role doesn't have permission to delete stacks via `sam delete`. This means that any stacks created need to be deleted manually. In order to support automated stack deletions for feature branches, this role needs a few extra permissions. This change is needed to support the this PR in the sam pipeline templates: aws/aws-sam-cli-pipeline-init-templates#42 How --- - Add three additional IAM permissions which allow the `sam delete` command to work as expected in `PipelineExecutionRolePermissions`. Next Steps ---------- - After this is merged, [this PR in the Pipeline templates for GitHub Actions](aws/aws-sam-cli-pipeline-init-templates#42) can be merged. * Add BatchDeleteImage to PipelineExecutionRolePermissions Based on PR feedback, allow for this role to delete a list of ImageIds by adding `ecr:BatchDeleteImage` to the Pipeline role.
c2tarun
approved these changes
Oct 21, 2021
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Why
By expanding the GitHub Actions pipeline to watch for
deleteevents,we can automatically delete feature stacks using
sam deletewhen a feature branch is deleted.How
deleteevents in GH Pipeline for feature branchesdeleteevent occurs,
github.refis set torefs/heads/main. To get thebranch that was deleted, we need to look at
github.event.ref.pushevent.Next Steps
Allowpermissions to thePipelineExecutionRolePolicy. SAM needs S3 DeleteObject and
CloudFormation GetTemplate/DeleteStack in order for this to work.
Note: Since the
sam deletecommand will not work until until these permissionsare added, this shouldn't be merged until aws-sam-cli adds those permissions:
https://github.com/aws/aws-sam-cli/blob/0626f9463f565acebc5b733d16007fd4f666413f/samcli/lib/pipeline/bootstrap/stage_resources.yaml#L211-L273
Fixes #41
By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.