Move Lambda Vars to Parameter Store #941

mcaulifn · 2021-06-25T18:40:34Z

With the addition of #898 , the environment variable size for the scale-up lambda could exceed the 4kb size limit. This reduces the size by moving variables to Parameter Store as SecureStrings. Custom CMK can still be used for encrypting variables in the paramater store (ssm).

Moves GitHub auth variables to Parameter Store
Removes KMS from runners and webhook submodule
Fixes outstanding lint

Fixes #587

Mirgration Directions

When using a CMK by setting the variable kms_key_id, a small update is required. Replace this variable by the ARN of the CMK by setting kms_key_arn.

* fix(scale): Refactor Runner Type and Owner * `environment` should not be optional

* fix(scale): Refactor Runner Type and Owner * `environment` should not be optional * feat(runners): Support Multiple Instance Types * Correcting failed launch logic * Updating tests * Test for all launch templates failing * Marking `instance_type` as deprecated

…s#738 (philips-labs#902) close philips-labs#738

* fix: scale down runners * fix: scale down runners

* chore: upgrade dependencies for lambda's * fix auth-app to 3.4.0, issues philips-labs#904 addresses the issue

* Add test for ssm module * Fixing lint

…aws-github-runner into mcaulifn/ssm

mcaulifn · 2021-06-25T19:29:20Z

@npalm Got another one for you 🚀

npalm · 2021-06-30T05:50:53Z

@mcaulifn short update, planned to check your PR this afternoon

npalm

@mcaulifn thanks for taking the time to contribute to this module!!! I have a few somments. The change is not working at the moment since some policies to retrieve the parameters from SSM by the Lambda are missing.

npalm · 2021-06-30T12:36:50Z

modules/runners/ssm.tf

+resource "aws_ssm_parameter" "github_app_key_base64" {
+  name  = "/actions_runner/${var.environment}/github_app_key_base64"
+  type  = "SecureString"
+  value = var.github_app.key_base64


Can you add the attibute key_id with no default null, not sure if that will work. This still give the users of the module to use their own keys (CMK) instead of amazon provided. Same comments for other SSM parameters.

Added kms_key_id back in. There is no option to not encrypt though.

modules/runners/lambdas/runners/src/scale-runners/gh-auth.test.ts

npalm · 2021-06-30T14:34:24Z

modules/runners/ssm.tf

@@ -0,0 +1,23 @@
+resource "aws_ssm_parameter" "github_app_client_id" {
+  name  = "/actions_runner/${var.environment}/github_app_client_id"


The naming pattern you use here does not match policy set to the runner which allows to get parameters named like "arn:aws:ssm:${var.aws_region}:${data.aws_caller_identity.current.account_id}:parameter/${var.environment}-*". So testing the setup results in an erros once the lambda tries to get the parameter

ERROR AccessDeniedException: User: arn:aws:sts::123456789:assumed-role/default-action-scale-up-lambda-role/default-scale-up is not authorized to perform: ssm:GetParameter on resource: arn:aws:ssm:eu-west-1:123456789:parameter/actions_runner/default/github_app_id

Seems policies for the scale up / down lambda needs to be adjusted.

The paramater in SSM that is used to create the runner is expecting environment-instanceId in the name. Changing this is not an option since users of the module that build there own user_data script releies on this name, aka the name.

I will add it to the policy. Not looking to change the existing pattern.

npalm · 2021-06-30T16:54:18Z

modules/runners/policies-runner.tf

-      arn_ssm_parameters = "arn:aws:ssm:${var.aws_region}:${data.aws_caller_identity.current.account_id}:parameter/${var.environment}-*"
+      arns = [
+        "arn:aws:ssm:${var.aws_region}:${data.aws_caller_identity.current.account_id}:parameter/${var.environment}-*",
+        "arn:aws:ssm:${var.aws_region}:${data.aws_caller_identity.current.account_id}:parameter/${var.environment}/*"


Having a second thougt, this change grants the runner instance role to read any parameter in SSM. The runner should only able to read the token generated for the instance. So suggest we only grant the runner access to environment-*. I will refactor this later in even a more clear path that only gives access to this token. We should avoid that a process in the runner could call the aws api and fetch the token to start acting as the app.

With updating this policy you change only the policies attached to runner. I think it is better to create a new template, for example lambda-ssm-parameter-policies.json. Which you grant read access to the pramaters in the path environment/github_app/* So it clear that the lambda can act on behalf of the app.

Sounds good. I'll draft up something a bit more limiting.

Looks like there is already a lambda policy template that has SSM permissions.

mcaulifn · 2021-07-01T11:47:51Z

@npalm I still need to deploy this in test. Hoping today or Tuesday.

npalm · 2021-07-01T11:56:18Z

@npalm I still need to deploy this in test. Hoping today or Tuesday.

Take your time, I have no option to check a deployment before Tuesday. Great work!

npalm · 2021-07-07T11:55:02Z

Ready to check?

Bumps [aws-sdk](https://github.com/aws/aws-sdk-js) from 2.863.0 to 2.888.0. - [Release notes](https://github.com/aws/aws-sdk-js/releases) - [Changelog](https://github.com/aws/aws-sdk-js/blob/master/CHANGELOG.md) - [Commits](aws/aws-sdk-js@v2.863.0...v2.888.0) Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

) Bumps [eslint](https://github.com/eslint/eslint) from 7.28.0 to 7.29.0. - [Release notes](https://github.com/eslint/eslint/releases) - [Changelog](https://github.com/eslint/eslint/blob/master/CHANGELOG.md) - [Commits](eslint/eslint@v7.28.0...v7.29.0) --- updated-dependencies: - dependency-name: eslint dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

npalm · 2021-07-14T18:48:41Z

thanks, will test asap

npalm

Great work so far. I have tested a basic upgrade.

Scaling up works fine with an AWS manabed key.
Scaling down looks broken. I got a message like: Orphan runner 'i-123' cannot be removed.

terraform-aws-github-runner/modules/runners/lambdas/runners/src/scale-runners/scale-down.ts

Line 184 in 68635dd

if (orphanEc2Runner) {

So this means the runner was removed in an earlier scale down attempt. Runner is removed from github but instance still running in AWS. most likely a permission issue.
Not tested the CMK yet. but will fail since there is no permission to decrypt.
Are you aware that also the webhook is using KMS to store the github app secret?
Right now by default the standard SSM policy is attached to the runner, this grant access to all SSM parameters. Looks like we have to see how we can make this stricter

npalm · 2021-07-14T20:58:33Z

modules/runners/scale-down.tf

@@ -82,10 +63,49 @@ resource "aws_iam_role" "scale_down" {
  tags                 = local.tags
 }

+data "aws_iam_policy_document" "scale_down" {


Please can you define the policy_x.json file to define the policy. Load the policies with templatefile. We have choosen this approach so we can use the standard json notation of aws policies

Moving this to a policy file may make the CMK permissions more complicated. I'll play around with it.

Let me know if you need a couple of complex examples for inspiraction.

npalm · 2021-07-14T21:00:02Z

modules/runners/scale-down.tf

+    actions = [
+      "ssm:GetParameter"
+    ]
+    resources = [


In general the policy looks good, and works for a AWS managed key. But once using a CMK also the decrypt action for the key should be granted to the lambda., see also .https://docs.aws.amazon.com/kms/latest/developerguide/services-parameter-store.html.

Good catch - will add this to the policy.

npalm · 2021-07-14T21:00:50Z

modules/runners/scale-up.tf


-  policy = templatefile("${path.module}/policies/lambda-scale-up.json", {


Please can you revert back to the templatefile?

modules/runners/scale-up.tf

mcaulifn · 2021-07-15T16:18:22Z

Are you aware that also the webhook is using KMS to store the github app secret?

Did you want me to do that in a separate PR or this PR?

Right now by default the standard SSM policy is attached to the runner, this grant access to all SSM parameters. Looks like we have to see how we can make this stricter

The policy limits to those parameters prefaced with ${var.environment}-*. The new parameters are /actions_runner/${var.environment}/github_blah. I don't think there will be unnecessary permissions for the runners here.

npalm · 2021-07-15T16:49:01Z

Are you aware that also the webhook is using KMS to store the github app secret?

Did you want me to do that in a separate PR or this PR?

Right now by default the standard SSM policy is attached to the runner, this grant access to all SSM parameters. Looks like we have to see how we can make this stricter

The policy limits to those parameters prefaced with ${var.environment}-*. The new parameters are /actions_runner/${var.environment}/github_blah. I don't think there will be unnecessary permissions for the runners here.

Since we trying to remove KMS in this PR, I prefer to remove the webhook as well. So would prefer al in one PR.
And the moment the user enabled ssm

terraform-aws-github-runner/modules/runners/policies-runner.tf

Line 17 in 68635dd

resource "aws_iam_role_policy_attachment" "runner_session_manager_aws_managed" {

the attaced policy grant access to all parameters. This we can address in a seprate PR. But think the scope of the standard policy it so wide.

mcaulifn · 2021-07-16T19:05:06Z

I think I got all the changes. I tested with and without a CMK defined.

npalm · 2021-07-21T07:03:29Z

I think I got all the changes. I tested with and without a CMK defined.

Thanks, sorry for the late response, will do my best to check the PR in the next days

npalm

Test default example including upgrade (withou CMK). All works like a charm.

npalm

@mcaulifn thanks for all the hard work. I think your change is the way forward but find some issues that I would like to addres or need at least a bit more of thinking.

SSM parameters

The new introduced paramaters are defined on root level of the runner. And the lambda's are doing a looking up based on convention. The whole module is designed in such way that it is also possible to use the sub modules complete seperate. When users of the module are using the module via the submodules, they also are required to create the SSM parameters as weel. Same holds for the SQS queue. What we could do is move the parameters to a submodule to do the constuction work

Removal of CMK

Currently the runner is managoing by default a CMK. For this change we have to update the README as well.

Migrations paths

No migration is required which I really like. But I have tested several ipdates. Swapping between runner managed key (aws default) and CMK creates some raise conditon. SSM parameters are not correctly updated. I have made some changes to ssm..tf

locals {
  default_key_ssm = "alias/aws/ssm"
}

resource "aws_ssm_parameter" "github_app_client_id" {
  name   = "/actions_runner/${var.environment}/github_app_client_id"
  type   = "SecureString"
  value  = var.github_app.client_id
  key_id = var.kms_key_id == null ? local.default_key_ssm : var.kms_key_id
}

# Same for the orther resources

With this changes SSM parameters are correctly stored.

SSM sessions

I will create a seperate PR for decreasing the privileges to the runner instances for SSM sessions.

Would be great if you can make some time to chck my remakrts. Oterwise I can merge the PR to a branch and fix the left overs in next week. Please let me know what you preferences is.

mcaulifn · 2021-07-26T20:36:41Z

@npalm I'll get these sorted tomorrow.

I'm curious about the migrations though. I had migrated between no key and key and didn't have any issues so I'm surprised you did.

npalm · 2021-07-26T20:38:52Z

@npalm I'll get these sorted tomorrow.

I'm curious about the migrations though. I had migrated between no key and key and didn't have any issues so I'm surprised you did.

Problem occurs when moving back to no key. Once looking up the resources in SSM the key was still there. Therefore I added explicit the aws alias key for SSM. And set the parameter overwrite to true

mcaulifn · 2021-07-28T14:51:52Z

Deployed to test using CMK. @npalm Should be good to go

npalm

Just 2 small findings Great work!

modules/ssm/ssm.tf

kms.tf

mcaulifn · 2021-07-29T13:15:48Z

@npalm Deployed using CMK then migrated to default key.

npalm · 2021-07-30T07:05:38Z

LGTM, will test asap. So summarising: users using the module should update their config with the cmk arn instead of the id.

npalm · 2021-08-04T06:41:42Z

Will do a bit more testing before merging. But expect no required changes

npalm

@mcaulifn thanks for all the refactoring work!

* fix(scale): Refactor Runner Type and Owner (#871) * fix(scale): Refactor Runner Type and Owner * `environment` should not be optional * feat: support multiple instance types (#898) * fix(scale): Refactor Runner Type and Owner * `environment` should not be optional * feat(runners): Support Multiple Instance Types * Correcting failed launch logic * Updating tests * Test for all launch templates failing * Marking `instance_type` as deprecated * docs: fix lambda_security_group_ids incorrect description #738 (#902) close #738 * fix: scale down runners (#905) * fix: scale down runners * fix: scale down runners * chore: group upgrade lambda dependencies (#906) * chore: upgrade dependencies for lambda's * fix auth-app to 3.4.0, issues #904 addresses the issue * feat(runner): Move Lambda Vars to Parameter Store * Add test for ssm module (#1) * Add test for ssm module * Fixing lint * Removing KMS/GH Auth from scale-down * Add SSM permissions to runner policy * Allow custom key_id * Fixing for loop * Move SSM policy to Lambdas * Fixing function call * chore: Bump aws-sdk (#752) (#909) Bumps [aws-sdk](https://github.com/aws/aws-sdk-js) from 2.863.0 to 2.888.0. - [Release notes](https://github.com/aws/aws-sdk-js/releases) - [Changelog](https://github.com/aws/aws-sdk-js/blob/master/CHANGELOG.md) - [Commits](aws/aws-sdk-js@v2.863.0...v2.888.0) Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore: Bump aws-sdk (#752) (#908) Bumps [aws-sdk](https://github.com/aws/aws-sdk-js) from 2.863.0 to 2.888.0. - [Release notes](https://github.com/aws/aws-sdk-js/releases) - [Changelog](https://github.com/aws/aws-sdk-js/blob/master/CHANGELOG.md) - [Commits](aws/aws-sdk-js@v2.863.0...v2.888.0) Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore: Bump aws-sdk (#752) (#887) Bumps [aws-sdk](https://github.com/aws/aws-sdk-js) from 2.863.0 to 2.888.0. - [Release notes](https://github.com/aws/aws-sdk-js/releases) - [Changelog](https://github.com/aws/aws-sdk-js/blob/master/CHANGELOG.md) - [Commits](aws/aws-sdk-js@v2.863.0...v2.888.0) Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore: Bump aws-sdk (#752) (#885) Bumps [aws-sdk](https://github.com/aws/aws-sdk-js) from 2.863.0 to 2.888.0. - [Release notes](https://github.com/aws/aws-sdk-js/releases) - [Changelog](https://github.com/aws/aws-sdk-js/blob/master/CHANGELOG.md) - [Commits](aws/aws-sdk-js@v2.863.0...v2.888.0) Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore: Bump aws-sdk (#752) (#889) Bumps [aws-sdk](https://github.com/aws/aws-sdk-js) from 2.863.0 to 2.888.0. - [Release notes](https://github.com/aws/aws-sdk-js/releases) - [Changelog](https://github.com/aws/aws-sdk-js/blob/master/CHANGELOG.md) - [Commits](aws/aws-sdk-js@v2.863.0...v2.888.0) Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore: Bump aws-sdk (#752) (#892) Bumps [aws-sdk](https://github.com/aws/aws-sdk-js) from 2.863.0 to 2.888.0. - [Release notes](https://github.com/aws/aws-sdk-js/releases) - [Changelog](https://github.com/aws/aws-sdk-js/blob/master/CHANGELOG.md) - [Commits](aws/aws-sdk-js@v2.863.0...v2.888.0) Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore: Bump aws-sdk (#752) (#907) Bumps [aws-sdk](https://github.com/aws/aws-sdk-js) from 2.863.0 to 2.888.0. - [Release notes](https://github.com/aws/aws-sdk-js/releases) - [Changelog](https://github.com/aws/aws-sdk-js/blob/master/CHANGELOG.md) - [Commits](aws/aws-sdk-js@v2.863.0...v2.888.0) Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore: Bump aws-sdk (#752) (#864) Bumps [aws-sdk](https://github.com/aws/aws-sdk-js) from 2.863.0 to 2.888.0. - [Release notes](https://github.com/aws/aws-sdk-js/releases) - [Changelog](https://github.com/aws/aws-sdk-js/blob/master/CHANGELOG.md) - [Commits](aws/aws-sdk-js@v2.863.0...v2.888.0) Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore: Bump eslint in /modules/webhook/lambdas/webhook (#918) Bumps [eslint](https://github.com/eslint/eslint) from 7.28.0 to 7.29.0. - [Release notes](https://github.com/eslint/eslint/releases) - [Changelog](https://github.com/eslint/eslint/blob/master/CHANGELOG.md) - [Commits](eslint/eslint@v7.28.0...v7.29.0) --- updated-dependencies: - dependency-name: eslint dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore: Bump typescript (#929) Bumps [typescript](https://github.com/Microsoft/TypeScript) from 4.3.3 to 4.3.4. - [Release notes](https://github.com/Microsoft/TypeScript/releases) - [Commits](microsoft/TypeScript@v4.3.3...v4.3.4) --- updated-dependencies: - dependency-name: typescript dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore: Bump @typescript-eslint/eslint-plugin (#928) Bumps [@typescript-eslint/eslint-plugin](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin) from 4.27.0 to 4.28.0. - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/master/packages/eslint-plugin/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v4.28.0/packages/eslint-plugin) --- updated-dependencies: - dependency-name: "@typescript-eslint/eslint-plugin" dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore: Bump typescript in /modules/webhook/lambdas/webhook (#926) Bumps [typescript](https://github.com/Microsoft/TypeScript) from 4.3.3 to 4.3.4. - [Release notes](https://github.com/Microsoft/TypeScript/releases) - [Commits](microsoft/TypeScript@v4.3.3...v4.3.4) --- updated-dependencies: - dependency-name: typescript dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * feat: Added support for white listing of repositories (#915) * add white listing of repositories Signed-off-by: ravenolf <[email protected]> * fix variable naming Signed-off-by: ravenolf <[email protected]> * add unit test * update docs * add successful unit test Co-authored-by: ravenolf <[email protected]> * Need `,` after list item * Move Lambda Policy to data resource * Addressing PR comments, fixing lint * Refactoring Parameters to SSM Module * Fixing rebase * Using only key ARN as input value Co-authored-by: Niek Palm <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Sofiane Benahmed <[email protected]> Co-authored-by: ravenolf <[email protected]>

## [0.16.0](v0.15.1...v0.16.0) (2021-08-05) ### Features * make delay of webhook event configurable ([#990](#990)) ([92a0d8a](92a0d8a)) * Store lambda secrets paramaters in Paramater Store ([#941](#941)) ([c6badbf](c6badbf)), closes [#871](#871) [#898](#898) [#738](#738) [#902](#902) [#738](#738) [#905](#905) [#906](#906) [#904](#904) [#1](#1) [#752](#752) [#909](#909) [#752](#752) [#908](#908) [#752](#752) [#887](#887) [#752](#752) [#885](#885) [#752](#752) [#889](#889) [#752](#752) [#892](#892) [#752](#752) [#907](#907) [#752](#752) [#864](#864) [#918](#918) ### Bug Fixes * change module exports and upgrade vercel to latest release ([#1005](#1005)) ([f8f8981](f8f8981)) * reduce permission required for session manager ([#1018](#1018)) ([09476eb](09476eb))

* chore: Bump aws-sdk (#752) (#909) Bumps [aws-sdk](https://github.com/aws/aws-sdk-js) from 2.863.0 to 2.888.0. - [Release notes](https://github.com/aws/aws-sdk-js/releases) - [Changelog](https://github.com/aws/aws-sdk-js/blob/master/CHANGELOG.md) - [Commits](aws/aws-sdk-js@v2.863.0...v2.888.0) Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore: Bump aws-sdk (#752) (#908) Bumps [aws-sdk](https://github.com/aws/aws-sdk-js) from 2.863.0 to 2.888.0. - [Release notes](https://github.com/aws/aws-sdk-js/releases) - [Changelog](https://github.com/aws/aws-sdk-js/blob/master/CHANGELOG.md) - [Commits](aws/aws-sdk-js@v2.863.0...v2.888.0) Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore: Bump aws-sdk (#752) (#887) Bumps [aws-sdk](https://github.com/aws/aws-sdk-js) from 2.863.0 to 2.888.0. - [Release notes](https://github.com/aws/aws-sdk-js/releases) - [Changelog](https://github.com/aws/aws-sdk-js/blob/master/CHANGELOG.md) - [Commits](aws/aws-sdk-js@v2.863.0...v2.888.0) Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore: Bump aws-sdk (#752) (#885) Bumps [aws-sdk](https://github.com/aws/aws-sdk-js) from 2.863.0 to 2.888.0. - [Release notes](https://github.com/aws/aws-sdk-js/releases) - [Changelog](https://github.com/aws/aws-sdk-js/blob/master/CHANGELOG.md) - [Commits](aws/aws-sdk-js@v2.863.0...v2.888.0) Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore: Bump aws-sdk (#752) (#889) Bumps [aws-sdk](https://github.com/aws/aws-sdk-js) from 2.863.0 to 2.888.0. - [Release notes](https://github.com/aws/aws-sdk-js/releases) - [Changelog](https://github.com/aws/aws-sdk-js/blob/master/CHANGELOG.md) - [Commits](aws/aws-sdk-js@v2.863.0...v2.888.0) Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore: Bump aws-sdk (#752) (#892) Bumps [aws-sdk](https://github.com/aws/aws-sdk-js) from 2.863.0 to 2.888.0. - [Release notes](https://github.com/aws/aws-sdk-js/releases) - [Changelog](https://github.com/aws/aws-sdk-js/blob/master/CHANGELOG.md) - [Commits](aws/aws-sdk-js@v2.863.0...v2.888.0) Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore: Bump aws-sdk (#752) (#907) Bumps [aws-sdk](https://github.com/aws/aws-sdk-js) from 2.863.0 to 2.888.0. - [Release notes](https://github.com/aws/aws-sdk-js/releases) - [Changelog](https://github.com/aws/aws-sdk-js/blob/master/CHANGELOG.md) - [Commits](aws/aws-sdk-js@v2.863.0...v2.888.0) Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore: Bump aws-sdk (#752) (#864) Bumps [aws-sdk](https://github.com/aws/aws-sdk-js) from 2.863.0 to 2.888.0. - [Release notes](https://github.com/aws/aws-sdk-js/releases) - [Changelog](https://github.com/aws/aws-sdk-js/blob/master/CHANGELOG.md) - [Commits](aws/aws-sdk-js@v2.863.0...v2.888.0) Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore: Bump eslint in /modules/webhook/lambdas/webhook (#918) Bumps [eslint](https://github.com/eslint/eslint) from 7.28.0 to 7.29.0. - [Release notes](https://github.com/eslint/eslint/releases) - [Changelog](https://github.com/eslint/eslint/blob/master/CHANGELOG.md) - [Commits](eslint/eslint@v7.28.0...v7.29.0) --- updated-dependencies: - dependency-name: eslint dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore: Bump typescript (#929) Bumps [typescript](https://github.com/Microsoft/TypeScript) from 4.3.3 to 4.3.4. - [Release notes](https://github.com/Microsoft/TypeScript/releases) - [Commits](microsoft/TypeScript@v4.3.3...v4.3.4) --- updated-dependencies: - dependency-name: typescript dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore: Bump @typescript-eslint/eslint-plugin (#928) Bumps [@typescript-eslint/eslint-plugin](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin) from 4.27.0 to 4.28.0. - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/master/packages/eslint-plugin/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v4.28.0/packages/eslint-plugin) --- updated-dependencies: - dependency-name: "@typescript-eslint/eslint-plugin" dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore: Bump typescript in /modules/webhook/lambdas/webhook (#926) Bumps [typescript](https://github.com/Microsoft/TypeScript) from 4.3.3 to 4.3.4. - [Release notes](https://github.com/Microsoft/TypeScript/releases) - [Commits](microsoft/TypeScript@v4.3.3...v4.3.4) --- updated-dependencies: - dependency-name: typescript dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * feat: Added support for white listing of repositories (#915) * add white listing of repositories Signed-off-by: ravenolf <[email protected]> * fix variable naming Signed-off-by: ravenolf <[email protected]> * add unit test * update docs * add successful unit test Co-authored-by: ravenolf <[email protected]> * chore(examples): Upgrade default example to terraform 1.x.x * chore(doc): Remove org level admin permission #801 Org level admin permissions for the app are not required any more, removed from docs. * feat: make delay of webhook event configurable (#990) * fix: change module exports and upgrade vercel to latest release (#1005) * bugfix: change module exports and upgrade vercel to latest release * bugfix: webhook.verify is now asynchronous * fix: reduce permission required for session manager (#1018) * feat: Store lambda secrets paramaters in Paramater Store (#941) * fix(scale): Refactor Runner Type and Owner (#871) * fix(scale): Refactor Runner Type and Owner * `environment` should not be optional * feat: support multiple instance types (#898) * fix(scale): Refactor Runner Type and Owner * `environment` should not be optional * feat(runners): Support Multiple Instance Types * Correcting failed launch logic * Updating tests * Test for all launch templates failing * Marking `instance_type` as deprecated * docs: fix lambda_security_group_ids incorrect description #738 (#902) close #738 * fix: scale down runners (#905) * fix: scale down runners * fix: scale down runners * chore: group upgrade lambda dependencies (#906) * chore: upgrade dependencies for lambda's * fix auth-app to 3.4.0, issues #904 addresses the issue * feat(runner): Move Lambda Vars to Parameter Store * Add test for ssm module (#1) * Add test for ssm module * Fixing lint * Removing KMS/GH Auth from scale-down * Add SSM permissions to runner policy * Allow custom key_id * Fixing for loop * Move SSM policy to Lambdas * Fixing function call * chore: Bump aws-sdk (#752) (#909) Bumps [aws-sdk](https://github.com/aws/aws-sdk-js) from 2.863.0 to 2.888.0. - [Release notes](https://github.com/aws/aws-sdk-js/releases) - [Changelog](https://github.com/aws/aws-sdk-js/blob/master/CHANGELOG.md) - [Commits](aws/aws-sdk-js@v2.863.0...v2.888.0) Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore: Bump aws-sdk (#752) (#908) Bumps [aws-sdk](https://github.com/aws/aws-sdk-js) from 2.863.0 to 2.888.0. - [Release notes](https://github.com/aws/aws-sdk-js/releases) - [Changelog](https://github.com/aws/aws-sdk-js/blob/master/CHANGELOG.md) - [Commits](aws/aws-sdk-js@v2.863.0...v2.888.0) Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore: Bump aws-sdk (#752) (#887) Bumps [aws-sdk](https://github.com/aws/aws-sdk-js) from 2.863.0 to 2.888.0. - [Release notes](https://github.com/aws/aws-sdk-js/releases) - [Changelog](https://github.com/aws/aws-sdk-js/blob/master/CHANGELOG.md) - [Commits](aws/aws-sdk-js@v2.863.0...v2.888.0) Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore: Bump aws-sdk (#752) (#885) Bumps [aws-sdk](https://github.com/aws/aws-sdk-js) from 2.863.0 to 2.888.0. - [Release notes](https://github.com/aws/aws-sdk-js/releases) - [Changelog](https://github.com/aws/aws-sdk-js/blob/master/CHANGELOG.md) - [Commits](aws/aws-sdk-js@v2.863.0...v2.888.0) Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore: Bump aws-sdk (#752) (#889) Bumps [aws-sdk](https://github.com/aws/aws-sdk-js) from 2.863.0 to 2.888.0. - [Release notes](https://github.com/aws/aws-sdk-js/releases) - [Changelog](https://github.com/aws/aws-sdk-js/blob/master/CHANGELOG.md) - [Commits](aws/aws-sdk-js@v2.863.0...v2.888.0) Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore: Bump aws-sdk (#752) (#892) Bumps [aws-sdk](https://github.com/aws/aws-sdk-js) from 2.863.0 to 2.888.0. - [Release notes](https://github.com/aws/aws-sdk-js/releases) - [Changelog](https://github.com/aws/aws-sdk-js/blob/master/CHANGELOG.md) - [Commits](aws/aws-sdk-js@v2.863.0...v2.888.0) Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore: Bump aws-sdk (#752) (#907) Bumps [aws-sdk](https://github.com/aws/aws-sdk-js) from 2.863.0 to 2.888.0. - [Release notes](https://github.com/aws/aws-sdk-js/releases) - [Changelog](https://github.com/aws/aws-sdk-js/blob/master/CHANGELOG.md) - [Commits](aws/aws-sdk-js@v2.863.0...v2.888.0) Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore: Bump aws-sdk (#752) (#864) Bumps [aws-sdk](https://github.com/aws/aws-sdk-js) from 2.863.0 to 2.888.0. - [Release notes](https://github.com/aws/aws-sdk-js/releases) - [Changelog](https://github.com/aws/aws-sdk-js/blob/master/CHANGELOG.md) - [Commits](aws/aws-sdk-js@v2.863.0...v2.888.0) Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore: Bump eslint in /modules/webhook/lambdas/webhook (#918) Bumps [eslint](https://github.com/eslint/eslint) from 7.28.0 to 7.29.0. - [Release notes](https://github.com/eslint/eslint/releases) - [Changelog](https://github.com/eslint/eslint/blob/master/CHANGELOG.md) - [Commits](eslint/eslint@v7.28.0...v7.29.0) --- updated-dependencies: - dependency-name: eslint dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore: Bump typescript (#929) Bumps [typescript](https://github.com/Microsoft/TypeScript) from 4.3.3 to 4.3.4. - [Release notes](https://github.com/Microsoft/TypeScript/releases) - [Commits](microsoft/TypeScript@v4.3.3...v4.3.4) --- updated-dependencies: - dependency-name: typescript dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore: Bump @typescript-eslint/eslint-plugin (#928) Bumps [@typescript-eslint/eslint-plugin](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin) from 4.27.0 to 4.28.0. - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/master/packages/eslint-plugin/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v4.28.0/packages/eslint-plugin) --- updated-dependencies: - dependency-name: "@typescript-eslint/eslint-plugin" dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore: Bump typescript in /modules/webhook/lambdas/webhook (#926) Bumps [typescript](https://github.com/Microsoft/TypeScript) from 4.3.3 to 4.3.4. - [Release notes](https://github.com/Microsoft/TypeScript/releases) - [Commits](microsoft/TypeScript@v4.3.3...v4.3.4) --- updated-dependencies: - dependency-name: typescript dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * feat: Added support for white listing of repositories (#915) * add white listing of repositories Signed-off-by: ravenolf <[email protected]> * fix variable naming Signed-off-by: ravenolf <[email protected]> * add unit test * update docs * add successful unit test Co-authored-by: ravenolf <[email protected]> * Need `,` after list item * Move Lambda Policy to data resource * Addressing PR comments, fixing lint * Refactoring Parameters to SSM Module * Fixing rebase * Using only key ARN as input value Co-authored-by: Niek Palm <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Sofiane Benahmed <[email protected]> Co-authored-by: ravenolf <[email protected]> * feat: Adding support for new workflow_job event. (#1019) Added support for new workflow_job event, the check_run event will remain for backwards compatibility * chore: Bump @types/node in /modules/webhook/lambdas/webhook Bumps [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) from 15.14.7 to 16.4.12. - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) --- updated-dependencies: - dependency-name: "@types/node" dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <[email protected]> * chore: Bump tar from 4.4.13 to 4.4.15 in /.release Bumps [tar](https://github.com/npm/node-tar) from 4.4.13 to 4.4.15. - [Release notes](https://github.com/npm/node-tar/releases) - [Changelog](https://github.com/npm/node-tar/blob/main/CHANGELOG.md) - [Commits](isaacs/node-tar@v4.4.13...v4.4.15) --- updated-dependencies: - dependency-name: tar dependency-type: indirect ... Signed-off-by: dependabot[bot] <[email protected]> * chore: Bump jest-mock-extended in /modules/runners/lambdas/runners Bumps [jest-mock-extended](https://github.com/marchaos/jest-mock-extended) from 1.0.18 to 2.0.1. - [Release notes](https://github.com/marchaos/jest-mock-extended/releases) - [Commits](https://github.com/marchaos/jest-mock-extended/commits) --- updated-dependencies: - dependency-name: jest-mock-extended dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <[email protected]> * chore: Bump @types/node Bumps [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) from 15.14.7 to 16.4.12. - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) --- updated-dependencies: - dependency-name: "@types/node" dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <[email protected]> * fix: handle situation of no prereleases correctly, and propagate lambda error to caller. * chore (doc): small improvements * fix: wait for scaleDown to have finished before calling callback Wait for scaleDown to have executed before returning to the caller that no error occurred. * chore: code consistency and improvements - use question mark after field name i.s.o. Type | undefined - use more functional approach i.s.o. for-loops - import all items from a single dependency on a single line - remove unused imports - add missing return type to function - change payload type from any to string * fix: tests were not always correct or incomplete or duplicate - add test for terminateRunner - removed duplicate tests for scale-down - use assertions consistently -> ".not" changed to ".not.toBeCalled()" - set process.env.ENABLE_ORGANIZATION_RUNNERS before calling scaleDown, and assert the right call to have been called - remove "Once" from the paginate mock, as it is called more than once - fix inconsistent asserts for both repo and org functions in the scaleUp tests - remove expectedRunnerParams field overriding when they are already overridden to same value at a higher level - add test for all launches failing in the repo level tests - add test for decryption failing in hte websocket handler - add checking of the payload to the SQS request - change the X-Github-Event to "check_run" to really test what was intended to be tested * fix: use consistent reporting back to caller * chore(release): 0.15.1 [skip ci] * apply patch for broken scale up lambda [#980](#980) ([b957e26](b957e26)) * Update CHANGELOG * fix: CONTRIBUTION.md should refer develop iso master branch * Cleanup * Incorporate review comments and fix build issue * Update modules/runners/README.md Co-authored-by: Gertjan Maas <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Sofiane Benahmed <[email protected]> Co-authored-by: ravenolf <[email protected]> Co-authored-by: Niek Palm <[email protected]> Co-authored-by: Niek Palm <[email protected]> Co-authored-by: PatrickMennen <[email protected]> Co-authored-by: Nathaniel McAuliffe <[email protected]> Co-authored-by: semantic-release-bot <[email protected]> Co-authored-by: Gertjan Maas <[email protected]>

dimisjim · 2021-08-13T17:24:54Z

Hey there,

so basically after these changes, there is no longer the option to have the secrets not encrypted?

mcaulifn · 2021-08-16T20:14:14Z

@dimisjim Yes, that is correct.

mcaulifn and others added 9 commits June 17, 2021 13:15

fix(scale): Refactor Runner Type and Owner (philips-labs#871)

736a854

* fix(scale): Refactor Runner Type and Owner * `environment` should not be optional

docs: fix lambda_security_group_ids incorrect description philips-lab…

a768687

…s#738 (philips-labs#902) close philips-labs#738

fix: scale down runners (philips-labs#905)

5b5ee3b

* fix: scale down runners * fix: scale down runners

chore: group upgrade lambda dependencies (philips-labs#906)

8746249

* chore: upgrade dependencies for lambda's * fix auth-app to 3.4.0, issues philips-labs#904 addresses the issue

feat(runner): Move Lambda Vars to Parameter Store

7bda880

Add test for ssm module (#1)

333eae7

* Add test for ssm module * Fixing lint

Removing KMS/GH Auth from scale-down

65535fb

Merge branch 'mcaulifn/ssm' of https://github.com/mcaulifn/terraform-…

b460a1a

…aws-github-runner into mcaulifn/ssm

npalm requested changes Jun 30, 2021

View reviewed changes

mcaulifn added 3 commits June 30, 2021 11:19

Add SSM permissions to runner policy

aecc383

Allow custom key_id

c84ae6c

Fixing for loop

d2b61f1

npalm reviewed Jun 30, 2021

View reviewed changes

mcaulifn added 2 commits June 30, 2021 20:30

Move SSM policy to Lambdas

8f34d71

Fixing function call

7d44ac8

dependabot bot added 9 commits July 7, 2021 14:18

npalm requested changes Jul 15, 2021

View reviewed changes

Addressing PR comments, fixing lint

0c9aff5

npalm reviewed Jul 26, 2021

View reviewed changes

npalm requested changes Jul 26, 2021

View reviewed changes

mcaulifn added 3 commits July 27, 2021 15:18

Refactoring Parameters to SSM Module

3104d34

Merge branch 'develop' into mcaulifn/ssm

7c09270

Fixing rebase

4ea2a17

mcaulifn mentioned this pull request Jul 28, 2021

Feature: Adding support for new workflow_job event. #1019

Merged

npalm requested changes Jul 28, 2021

View reviewed changes

modules/ssm/ssm.tf Outdated Show resolved Hide resolved

kms.tf Outdated Show resolved Hide resolved

Using only key ARN as input value

19199e3

npalm approved these changes Aug 4, 2021

View reviewed changes

npalm merged commit 86e7912 into philips-labs:develop Aug 4, 2021

mcaulifn deleted the mcaulifn/ssm branch August 16, 2021 14:01

mcaulifn mentioned this pull request Aug 31, 2021

Scale-Up Lambda: Signing Error? #914

Closed

		@@ -0,0 +1,23 @@
		resource "aws_ssm_parameter" "github_app_client_id" {
		name = "/actions_runner/${var.environment}/github_app_client_id"


		policy = templatefile("${path.module}/policies/lambda-scale-up.json", {

Move Lambda Vars to Parameter Store #941

Move Lambda Vars to Parameter Store #941

Conversation

mcaulifn commented Jun 25, 2021 • edited by npalm Loading

Mirgration Directions

mcaulifn commented Jun 25, 2021

npalm commented Jun 30, 2021

npalm left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

mcaulifn commented Jul 1, 2021 • edited Loading

npalm commented Jul 1, 2021

npalm commented Jul 7, 2021

npalm commented Jul 14, 2021

npalm left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

mcaulifn commented Jul 15, 2021 • edited Loading

npalm commented Jul 15, 2021

mcaulifn commented Jul 16, 2021

npalm commented Jul 21, 2021

npalm left a comment

Choose a reason for hiding this comment

npalm left a comment

Choose a reason for hiding this comment

SSM parameters

Removal of CMK

Migrations paths

SSM sessions

mcaulifn commented Jul 26, 2021

npalm commented Jul 26, 2021

mcaulifn commented Jul 28, 2021

npalm left a comment

Choose a reason for hiding this comment

mcaulifn commented Jul 29, 2021

npalm commented Jul 30, 2021

npalm commented Aug 4, 2021

npalm left a comment

Choose a reason for hiding this comment

dimisjim commented Aug 13, 2021

mcaulifn commented Aug 16, 2021

mcaulifn commented Jun 25, 2021 •

edited by npalm

Loading

mcaulifn commented Jul 1, 2021 •

edited

Loading

mcaulifn commented Jul 15, 2021 •

edited

Loading