add publish to s3 fips task (#93)

* add publish to s3 fips tasks * fix app_name for release workflow
newrelic · Nov 26, 2024 · 4195368 · 4195368
1 parent 1b3b34f
commit 4195368
Show file tree

Hide file tree

Showing 2 changed files with 77 additions and 0 deletions.
diff --git a/.github/workflows/reusable_on_release.yaml b/.github/workflows/reusable_on_release.yaml
@@ -37,6 +37,21 @@ on:
         type: string
         required: false
         default: ""
+      upload_fips_packages:
+        description: Defines if the FIPS packages should be uploaded to S3
+        type: boolean
+        required: false
+        default: false
+      publish_schema_fips:
+        description: Defines the schema for the publish_action for FIPS packages.
+        type: string
+        required: false
+        default: "ohi-fips"
+      publish_schema_url_fips:
+        description: Defines the schema_url for the publish_action for FIPS packages (it requires publish_schema_fips='custom')
+        type: string
+        required: false
+        default: ""
 
     secrets: # uppercase secrets to match the already defined organization secrets
       OHAI_AWS_ROLE_ARN_PRODUCTION:
@@ -84,6 +99,30 @@ jobs:
           # used for signing package stuff
           gpg_passphrase: ${{ secrets.OHAI_GPG_PASSPHRASE }}
           gpg_private_key_base64: ${{ secrets.OHAI_GPG_PRIVATE_KEY_BASE64 }}
+      - name: Publish to S3 action - fips
+        if: ${{ inputs.upload_fips_packages }}
+        uses: newrelic/infrastructure-publish-action@v1
+        with:
+          # lock enabled
+          disable_lock: false
+          run_id: ${{ github.run_id }}
+          tag: ${{ inputs.tag }}
+          app_name: "nri-${{ inputs.integration }}-fips"
+          repo_name: ${{ github.event.repository.full_name }}
+          access_point_host: "production"
+          schema: ${{ inputs.publish_schema_fips }}
+          schema_url: ${{ inputs.publish_schema_url_fips }}
+          aws_region: "us-east-1"
+          aws_role_arn: ${{ secrets.OHAI_AWS_ROLE_ARN_PRODUCTION }}
+          aws_role_session_name: ${{ secrets.OHAI_AWS_ROLE_SESSION_NAME_PRODUCTION }}
+          aws_access_key_id: ${{ secrets.OHAI_AWS_ACCESS_KEY_ID_PRODUCTION }}
+          aws_secret_access_key: ${{ secrets.OHAI_AWS_SECRET_ACCESS_KEY_PRODUCTION }}
+          aws_s3_bucket_name: "nr-downloads-main"
+          # used for locking in case of concurrent releases
+          aws_s3_lock_bucket_name: "onhost-ci-lock"
+          # used for signing package stuff
+          gpg_passphrase: ${{ secrets.OHAI_GPG_PASSPHRASE }}
+          gpg_private_key_base64: ${{ secrets.OHAI_GPG_PRIVATE_KEY_BASE64 }}
       - name: Test package from prod repo
         if: ${{ inputs.test_package }}
         uses: newrelic/integrations-pkg-test-action/linux@v1

diff --git a/.github/workflows/reusable_pre_release.yaml b/.github/workflows/reusable_pre_release.yaml
@@ -26,6 +26,21 @@ on:
         type: string
         required: false
         default: ""
+      upload_fips_packages:
+        description: Defines if the FIPS packages should be uploaded to S3
+        type: boolean
+        required: false
+        default: false
+      publish_schema_fips:
+        description: Defines the schema for the publish_action for FIPS packages.
+        type: string
+        required: false
+        default: "ohi-fips"
+      publish_schema_url_fips:
+        description: Defines the schema_url for the publish_action for FIPS packages (it requires publish_schema_fips='custom')
+        type: string
+        required: false
+        default: ""
       run_integration_nix:
         required: false
         type: boolean
@@ -214,6 +229,29 @@ jobs:
           # used for signing package stuff
           gpg_passphrase: ${{ secrets.OHAI_GPG_PASSPHRASE }}
           gpg_private_key_base64: ${{ secrets.OHAI_GPG_PRIVATE_KEY_BASE64 }}
+      - name: Publish to S3 action - fips
+        if: ${{ inputs.upload_fips_packages }}
+        uses: newrelic/infrastructure-publish-action@v1
+        with:
+          disable_lock: false
+          run_id: ${{ github.run_id }}
+          tag: ${{ inputs.tag }}
+          app_name: "nri-${{ inputs.integration }}-fips"
+          repo_name: ${{ github.event.repository.full_name }}
+          access_point_host: "staging"
+          schema: ${{ inputs.publish_schema_fips }}
+          schema_url: ${{ inputs.publish_schema_url_fips }}
+          aws_region: "us-east-1"
+          aws_role_arn: ${{ secrets.OHAI_AWS_ROLE_ARN_STAGING }}
+          aws_role_session_name: ${{ secrets.OHAI_AWS_ROLE_SESSION_NAME_STAGING }}
+          aws_access_key_id: ${{ secrets.OHAI_AWS_ACCESS_KEY_ID_STAGING }}
+          aws_secret_access_key: ${{ secrets.OHAI_AWS_SECRET_ACCESS_KEY_STAGING }}
+          aws_s3_bucket_name: "nr-downloads-ohai-staging"
+          aws_s3_lock_bucket_name: "onhost-ci-lock-staging"
+          dest_prefix: ${{ inputs.dest_prefix }}
+          # used for signing package stuff
+          gpg_passphrase: ${{ secrets.OHAI_GPG_PASSPHRASE }}
+          gpg_private_key_base64: ${{ secrets.OHAI_GPG_PRIVATE_KEY_BASE64 }}
       - name: Test package from Staging repo
         if: ${{ inputs.test_package }}
         uses: newrelic/integrations-pkg-test-action/linux@v1