diff --git a/.circleci/config.yml b/.circleci/config.yml deleted file mode 100644 index 850e0d6..0000000 --- a/.circleci/config.yml +++ /dev/null @@ -1,55 +0,0 @@ -version: '2.1' -jobs: - lint: - docker: - - image: cimg/python:3.8.9 - steps: - - checkout - - run: - name: 'Install tools' - command: | - pip install pre-commit - - run: - name: 'Run pre-commit' - command: | - pre-commit run --all-files --show-diff-on-failure - deploy: - docker: - - image: cimg/python:3.8.9 - steps: - - checkout - - run: - name: 'Install tools' - command: | - pip install sceptre - pip install awscli - - run: - name: 'Setup AWS config' - command: | - mkdir -p ~/.aws - echo -e "[default]\nregion=eu-west-1\nsource_profile=default\nrole_arn=arn:aws:iam::743644221192:role/sceptre-ci-service-access-ServiceRole-JRZISD8SPDZV" > ~/.aws/config - echo -e "[default]\nregion=eu-west-1\naws_access_key_id=$CI_SERVICE_AWS_ACCESS_KEY_ID\naws_secret_access_key=$CI_SERVICE_AWS_SECRET_ACCESS_KEY" > ~/.aws/credentials - - run: - name: 'Run sceptre' - command: | - sceptre launch prod --yes -workflows: - check: - jobs: - - lint: - filters: - branches: - only: /^pull\/.*/ - merge: - jobs: - - lint: - filters: - branches: - only: master - - deploy: - context: aws.582448526747.ci-service-access - requires: - - lint - filters: - branches: - only: master diff --git a/.github/workflows/action.yaml b/.github/workflows/action.yaml new file mode 100644 index 0000000..e9a98dc --- /dev/null +++ b/.github/workflows/action.yaml @@ -0,0 +1,40 @@ +name: "workflow" +on: + push: + branches: + - master + pull_request: + branches: + - "*" +jobs: + pre-commit: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + - name: Set up Python + uses: actions/setup-python@v5 + with: + python-version: 3.10 + - uses: pre-commit/action@v3.0.0 + deploy: + runs-on: ubuntu-latest + if: ${{ github.ref == 'refs/heads/master' }} + needs: [ 'pre-commit' ] + permissions: + id-token: write + contents: read + steps: + - name: 'Checkout' + uses: actions/checkout@v4 + - name: Assume AWS Role + uses: aws-actions/configure-aws-credentials@v4 + with: + aws-region: eu-west-1 + role-to-assume: arn:aws:iam::743644221192:role/gh-oidc-sceptre-aws + role-session-name: GitHubActions-${{ github.repository_owner }}-${{ github.event.repository.name }}-${{ github.run_id }} + role-duration-seconds: 1800 + - name: 'Sceptre Deploy' + uses: Sceptre/github-ci-action@v2.3.0 + with: + sceptre_version: '4.3.0' + sceptre_subcommand: 'launch prod --prune --yes' diff --git a/README.md b/README.md index 4f7baed..6fa9bd0 100644 --- a/README.md +++ b/README.md @@ -16,7 +16,7 @@ execute the validations by running `pre-commit run --all-files`. ## Continuous Integration We have setup CI to deploy CloudFormation templates in this project -on mergees to master. +on merges to master. ## Workflow The workflow to provision AWS resources is done using pull requests. diff --git a/config/prod/gh-oidc-sceptre-aws.yaml b/config/prod/gh-oidc-sceptre-aws.yaml index 360fd60..b7e9f81 100644 --- a/config/prod/gh-oidc-sceptre-aws.yaml +++ b/config/prod/gh-oidc-sceptre-aws.yaml @@ -1,10 +1,8 @@ template: path: github-oidc-provider.j2 stack_name: gh-oidc-sceptre-aws -Dependencies: - - prod/github-oidc-provider.yaml parameters: - ProviderRoleName: gh-oidc-sage-sceptre-aws + ProviderRoleName: gh-oidc-sceptre-aws ProviderArn: !stack_output_external github-oidc-provider::ProviderArn ManagedPolicyArns: - "arn:aws:iam::aws:policy/AdministratorAccess" diff --git a/config/prod/github-oidc-provider.yaml b/config/prod/github-oidc-provider.yaml deleted file mode 100644 index 5596ad9..0000000 --- a/config/prod/github-oidc-provider.yaml +++ /dev/null @@ -1,8 +0,0 @@ -template: - path: oidc-provider.yaml -stack_name: oidc-provider -parameters: - ThumbprintList: - - "6938fd4d98bab03faadb97b34396831e3780aea1" - - "1c58a3a8518e8759bf075b76b750d4f2df264fcd" - Url: "https://token.actions.githubusercontent.com" diff --git a/templates/oidc-provider.yaml b/templates/oidc-provider.yaml deleted file mode 100644 index 9b3f310..0000000 --- a/templates/oidc-provider.yaml +++ /dev/null @@ -1,29 +0,0 @@ -AWSTemplateFormatVersion: 2010-09-09 -Description: Configure an AWS OIDC provider -Parameters: - ClientIdList: - Type: List - Description: >- - A list of client IDs (also known as audiences) that are associated with - the specified IAM OIDC provider resource object - Default: "sts.amazonaws.com" - ThumbprintList: - Type: List - Description: >- - A list of certificate thumbprints that are associated with the specified - IAM OIDC provider resource object - Url: - Type: String - Description: "The URL that the IAM OIDC provider resource object is associated with" -Resources: - Provider: - Type: AWS::IAM::OIDCProvider - Properties: - ClientIdList: !Ref ClientIdList - ThumbprintList: !Ref ThumbprintList - Url: !Ref Url -Outputs: - ProviderArn: - Value: !Ref Provider - Export: - Name: !Sub '${AWS::StackName}-ProviderArn'