Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

feat(ci): ability to call this workflow from other repositories #17

Merged
merged 5 commits into from
Sep 7, 2023
Merged

feat(ci): ability to call this workflow from other repositories #17

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
198edd3
feat(aws): migrate away from static AWS IAM credentials (#1)
obs-gh-colinhutchinson Sep 5, 2023
5718faf
Update infrastructure/main.tf
obs-gh-colinhutchinson Sep 5, 2023
7d86946
fix(ci): adjust some names to remove release, and setup permissions f…
obs-gh-colinhutchinson Sep 5, 2023
789d1e8
fix(ci): point back to the correct github org
obs-gh-colinhutchinson Sep 7, 2023
01981e7
Merge branch 'main' into feat/ci-workflow
obs-gh-colinhutchinson Sep 7, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
34 changes: 21 additions & 13 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,10 @@
name: Run AWS Spec Tests

permissions:
contents: write
id-token: write
packages: write

on:
pull_request:
branches:
Expand All @@ -24,6 +29,8 @@ on:
required: true
OBSERVE_DOMAIN:
required: false
AWS_ROLE_ARN:
required: true

env:
USER: gha-${{ github.run_id }}
Expand Down Expand Up @@ -112,17 +119,17 @@ jobs:
determine-provider:
runs-on: ubuntu-latest
outputs:
providers: ${{steps.set-providers.outputs.providers}}

providers: ${{ steps.set-providers.outputs.providers }}
steps:
- id: set-providers
run: |
if [[ "${{ github.event_name }}" == "pull_request" || "${{ github.event_name }}" == "push" ]]; then
if [[ "${{ inputs.test_type }}" == "" ]]; then
echo "providers=[\"cloudformation\", \"terraform\"]" >> $GITHUB_ENV
echo "providers=[\"cloudformation\", \"terraform\"]" >> $GITHUB_OUTPUT
else
echo "providers=[\"${{ github.event.inputs.test_type }}\"]" >> $GITHUB_ENV
echo "providers=[\"${{ github.event.inputs.test_type }}\"]" >> $GITHUB_OUTPUT
echo "providers=[\"${{ inputs.test_type }}\"]" >> $GITHUB_ENV
echo "providers=[\"${{ inputs.test_type }}\"]" >> $GITHUB_OUTPUT
fi

test:
Expand All @@ -146,23 +153,24 @@ jobs:
provider: ${{fromJson(needs.determine-provider.outputs.providers)}}

steps:

- name: Checkout
uses: actions/checkout@v3
with:
repository: ${{ github.repository_owner }}/${{ env.AWS_TEST_KITCHEN_REPO }}
submodules: true

- name: Checkout Terraform SHA
if: matrix.provider == 'terraform' && github.event.inputs.terraform_sha != ''
if: matrix.provider == 'terraform' && inputs.code_sha != ''
run: |
cd terraform-aws-collection
git checkout ${{ github.event.inputs.terraform_sha }}
git checkout ${{ inputs.code_sha }}

- name: Checkout CloudFormation SHA
if: matrix.provider == 'cloudformation' && github.event.inputs.cloudformation_sha != ''
if: matrix.provider == 'cloudformation' && inputs.code_sha != ''
run: |
cd cloudformation-aws-collection
git checkout ${{ github.event.inputs.cloudformation_sha }}
git checkout ${{ inputs.code_sha }}

- name: Login to GitHub Container Registry
uses: docker/login-action@v2
Expand All @@ -176,7 +184,7 @@ jobs:

- name: Metadata for Docker Image
id: docker_metadata
if: ${{ inputs.test_type == '' }}
if: ${{ inputs.test_type == null }}
uses: docker/metadata-action@v4
with:
images: ghcr.io/${{ github.repository_owner }}/${{ env.AWS_TEST_KITCHEN_REPO }}
Expand All @@ -186,7 +194,7 @@ jobs:
type=raw,value=latest,enable={{is_default_branch}}

- name: Build docker image (from cache)
if: ${{ inputs.test_type == '' }}
if: ${{ inputs.test_type == null }}
uses: docker/build-push-action@v4
with:
context: .
Expand All @@ -202,7 +210,7 @@ jobs:
cache-to: type=gha,mode=max

- name: Pull Docker image
if: ${{ inputs.test_type != '' }}
if: ${{ inputs.test_type != null }}
run: docker pull $IMAGE_NAME

- name: Check AWS Quota
Expand Down Expand Up @@ -239,7 +247,7 @@ jobs:
push:
runs-on: ubuntu-latest
needs: [permission_check, build, test]
if: ${{ inputs.test_type == '' }} && needs.permission_check.outputs.can-write == 'true' && github.event_name == 'push' && github.ref == 'refs/heads/main'
if: needs.permission_check.outputs.can-write == 'true' && github.ref == 'refs/heads/main' && github.repository == 'observeinc/aws-test-kitchen'
permissions:
contents: write
packages: write
Expand Down
10 changes: 5 additions & 5 deletions infrastructure/main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,8 +34,8 @@ data "aws_iam_policy_document" "github_actions_assume_role" {
}
}

resource "aws_iam_role" "github_actions_release" {
name = "${local.repository}-gha-release"
resource "aws_iam_role" "github_actions_ci" {
name = "${local.repository}-gha-ci"

assume_role_policy = data.aws_iam_policy_document.github_actions_assume_role.json

Expand All @@ -46,12 +46,12 @@ resource "aws_iam_role" "github_actions_release" {
}

resource "aws_iam_role_policy_attachment" "admin_policy_attachment" {
role = aws_iam_role.github_actions_release.name
role = aws_iam_role.github_actions_ci.name
policy_arn = "arn:aws:iam::aws:policy/AdministratorAccess"
}

resource "github_actions_secret" "aws_release_role" {
resource "github_actions_secret" "aws_ci_role" {
repository = local.repository
secret_name = "AWS_ROLE_ARN"
plaintext_value = aws_iam_role.github_actions_release.arn
plaintext_value = aws_iam_role.github_actions_ci.arn
}