Skip to content

Commit 432518c

Browse files
tmclaughtmclaugh
authored
Merge pull request #2 from ServerlessOpsIO/update/gha-actions
Update/gha actions
2 parents 5aaa016 + e044b44 commit 432518c

File tree

3 files changed

+118
-134
lines changed

3 files changed

+118
-134
lines changed

‎.github/workflows/branch.yaml‎

Lines changed: 98 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,98 @@
1+
name: Branches
2+
3+
on:
4+
workflow_dispatch:
5+
push:
6+
branches-ignore:
7+
- 'main'
8+
9+
jobs:
10+
build:
11+
runs-on: ubuntu-latest
12+
permissions:
13+
id-token: write
14+
contents: read
15+
16+
steps:
17+
- name: Setup job workspace
18+
uses: ServerlessOpsIO/gha-setup-workspace@v1
19+
20+
- name: Assume AWS Credentials
21+
uses: ServerlessOpsIO/gha-assume-aws-credentials@v1
22+
with:
23+
build_aws_account_id: ${{ secrets.AWS_CICD_ACCOUNT_ID }}
24+
25+
- name: Install AWS SAM
26+
uses: aws-actions/setup-sam@v2
27+
28+
- name: Validate artifact (deploy)
29+
run: sam validate --lint -t stackset-deploy-template.yaml
30+
31+
- name: Validate artifact (build)
32+
run: sam validate --lint -t stackset-build-template.yaml
33+
34+
- name: Validate artifact (SAM artifact)
35+
run: sam validate --lint -t stacksets/gha-build/sam-deployment.yaml
36+
37+
- name: Validate artifact (build stackset)
38+
run: sam validate --lint -t stacksets/gha-build/stackset.yaml
39+
40+
- name: Validate artifact (deploy stackset)
41+
run: sam validate --lint -t stacksets/gha-deploy/stackset.yaml
42+
43+
- name: Synethsize StackSet templates
44+
run: |
45+
for _f in $(find . -type f -name 'stackset-*-template.yaml'); do
46+
_dir="$(dirname $_f)/" \
47+
yq \
48+
-i \
49+
'(.. | select(has("localTemplateFile")) | .localTemplateFile) |= load_str(strenv(_dir) + .)' \
50+
$_f;
51+
done
52+
53+
- name: Upload SAM artifact (Management Account / GHA Deploy)
54+
id: upload-sam-gha-template
55+
shell: bash
56+
run: |
57+
sam package \
58+
--template stacksets/gha-deploy/stackset.yaml \
59+
--s3-bucket aws-sam-cli-sourcebucket-225989329251-us-east-1 \
60+
--s3-prefix ${{ env.GITHUB_REPOSITORY_OWNER_PART_SLUG_URL }}/${{ env.GITHUB_REPOSITORY_NAME_PART_SLUG_URL }}/${{ env.GITHUB_REF_SLUG_URL }} \
61+
--region us-east-1 \
62+
--output-template-file packaged-gha-deploy-template.yaml
63+
64+
- name: Upload SAM artifact (Management Account / CFN CR)
65+
id: upload-sam-cfncr-template
66+
shell: bash
67+
run: |
68+
sam package \
69+
--template stacksets/cfn-custom-resource-deploy/stackset.yaml \
70+
--s3-bucket aws-sam-cli-sourcebucket-225989329251-us-east-1 \
71+
--s3-prefix ${{ env.GITHUB_REPOSITORY_OWNER_PART_SLUG_URL }}/${{ env.GITHUB_REPOSITORY_NAME_PART_SLUG_URL }}/${{ env.GITHUB_REF_SLUG_URL }} \
72+
--region us-east-1 \
73+
--output-template-file packaged-cfncr-template.yaml
74+
75+
- name: Upload SAM artifact (Build Account)
76+
id: upload-sam-stackset-build-template
77+
shell: bash
78+
run: |
79+
sam package \
80+
--template stackset-build-template.yaml \
81+
--s3-bucket aws-sam-cli-sourcebucket-225989329251-us-east-1 \
82+
--s3-prefix ${{ env.GITHUB_REPOSITORY_OWNER_PART_SLUG_URL }}/${{ env.GITHUB_REPOSITORY_NAME_PART_SLUG_URL }}/${{ env.GITHUB_REF_SLUG_URL }} \
83+
--region us-east-1 \
84+
--output-template-file packaged-stackset-build-template.yaml
85+
86+
- name: Upload SAM artifact (Deploy Account)
87+
id: upload-sam-stackset-deploy-template
88+
shell: bash
89+
run: |
90+
sam package \
91+
--template stackset-deploy-template.yaml \
92+
--s3-bucket aws-sam-cli-sourcebucket-225989329251-us-east-1 \
93+
--s3-prefix ${{ env.GITHUB_REPOSITORY_OWNER_PART_SLUG_URL }}/${{ env.GITHUB_REPOSITORY_NAME_PART_SLUG_URL }}/${{ env.GITHUB_REF_SLUG_URL }} \
94+
--region us-east-1 \
95+
--output-template-file packaged-stackset-deploy-template.yaml
96+
97+
- name: Store Artifacts
98+
uses: ServerlessOpsIO/gha-store-artifacts@v1

‎.github/workflows/main.yaml‎

Lines changed: 14 additions & 129 deletions
Original file line numberDiff line numberDiff line change
@@ -14,31 +14,8 @@ jobs:
1414
contents: read
1515

1616
steps:
17-
- name: Set extra GitHub environment variables
18-
id: github-env-vars
19-
uses: rlespinasse/github-slug-action@v4
20-
21-
- name: Checkout source
22-
id: checkout-source
23-
uses: actions/checkout@v4
24-
25-
- name: Setup Python
26-
id: install-python
27-
uses: actions/setup-python@v3
28-
with:
29-
python-version: 3.12
30-
cache: pipenv
31-
32-
- name: Install pipenv
33-
id: install-pipenv
34-
shell: bash
35-
run: python -m pip install --upgrade pipenv
36-
37-
38-
- name: Install dependencies
39-
id: install-python-deps
40-
shell: bash
41-
run: pipenv install --dev
17+
- name: Setup job workspace
18+
uses: ServerlessOpsIO/gha-setup-workspace@v1
4219

4320
- name: Assume AWS Credentials
4421
uses: ServerlessOpsIO/gha-assume-aws-credentials@v1
@@ -129,33 +106,10 @@ jobs:
129106
contents: read
130107

131108
steps:
132-
- name: Set extra GitHub environment variables
133-
id: github-env-vars
134-
uses: rlespinasse/github-slug-action@v4
135-
136-
- name: Download artifact
137-
id: download-artifact
138-
uses: actions/download-artifact@v4
139-
with:
140-
name: ${{ env.GITHUB_REPOSITORY_SLUG }}-${{ env.GITHUB_REF_SLUG_URL }}-${{ github.run_number }}-${{ github.sha }}
141-
142-
- name: Setup Python
143-
id: install-python
144-
uses: actions/setup-python@v3
109+
- name: Setup job workspace
110+
uses: ServerlessOpsIO/gha-setup-workspace@v1
145111
with:
146-
python-version: 3.12
147-
cache: pipenv
148-
149-
- name: Install pipenv
150-
id: install-pipenv
151-
shell: bash
152-
run: python -m pip install --upgrade pipenv
153-
154-
155-
- name: Install dependencies
156-
id: install-python-deps
157-
shell: bash
158-
run: pipenv install --dev
112+
checkout_artifact: true
159113

160114
- name: Assume AWS Credentials
161115
uses: ServerlessOpsIO/gha-assume-aws-credentials@v1
@@ -186,33 +140,10 @@ jobs:
186140
contents: read
187141

188142
steps:
189-
- name: Set extra GitHub environment variables
190-
id: github-env-vars
191-
uses: rlespinasse/github-slug-action@v4
192-
193-
- name: Download artifact
194-
id: download-artifact
195-
uses: actions/download-artifact@v4
143+
- name: Setup job workspace
144+
uses: ServerlessOpsIO/gha-setup-workspace@v1
196145
with:
197-
name: ${{ env.GITHUB_REPOSITORY_SLUG }}-${{ env.GITHUB_REF_SLUG_URL }}-${{ github.run_number }}-${{ github.sha }}
198-
199-
- name: Setup Python
200-
id: install-python
201-
uses: actions/setup-python@v3
202-
with:
203-
python-version: 3.12
204-
cache: pipenv
205-
206-
- name: Install pipenv
207-
id: install-pipenv
208-
shell: bash
209-
run: python -m pip install --upgrade pipenv
210-
211-
212-
- name: Install dependencies
213-
id: install-python-deps
214-
shell: bash
215-
run: pipenv install --dev
146+
checkout_artifact: true
216147

217148
- name: Assume AWS Credentials
218149
uses: ServerlessOpsIO/gha-assume-aws-credentials@v1
@@ -243,33 +174,10 @@ jobs:
243174
contents: read
244175

245176
steps:
246-
- name: Set extra GitHub environment variables
247-
id: github-env-vars
248-
uses: rlespinasse/github-slug-action@v4
249-
250-
- name: Download artifact
251-
id: download-artifact
252-
uses: actions/download-artifact@v4
177+
- name: Setup job workspace
178+
uses: ServerlessOpsIO/gha-setup-workspace@v1
253179
with:
254-
name: ${{ env.GITHUB_REPOSITORY_SLUG }}-${{ env.GITHUB_REF_SLUG_URL }}-${{ github.run_number }}-${{ github.sha }}
255-
256-
- name: Setup Python
257-
id: install-python
258-
uses: actions/setup-python@v3
259-
with:
260-
python-version: 3.12
261-
cache: pipenv
262-
263-
- name: Install pipenv
264-
id: install-pipenv
265-
shell: bash
266-
run: python -m pip install --upgrade pipenv
267-
268-
269-
- name: Install dependencies
270-
id: install-python-deps
271-
shell: bash
272-
run: pipenv install --dev
180+
checkout_artifact: true
273181

274182
- name: Assume AWS Credentials
275183
uses: ServerlessOpsIO/gha-assume-aws-credentials@v1
@@ -298,33 +206,10 @@ jobs:
298206
contents: read
299207

300208
steps:
301-
- name: Set extra GitHub environment variables
302-
id: github-env-vars
303-
uses: rlespinasse/github-slug-action@v4
304-
305-
- name: Download artifact
306-
id: download-artifact
307-
uses: actions/download-artifact@v4
308-
with:
309-
name: ${{ env.GITHUB_REPOSITORY_SLUG }}-${{ env.GITHUB_REF_SLUG_URL }}-${{ github.run_number }}-${{ github.sha }}
310-
311-
- name: Setup Python
312-
id: install-python
313-
uses: actions/setup-python@v3
209+
- name: Setup job workspace
210+
uses: ServerlessOpsIO/gha-setup-workspace@v1
314211
with:
315-
python-version: 3.12
316-
cache: pipenv
317-
318-
- name: Install pipenv
319-
id: install-pipenv
320-
shell: bash
321-
run: python -m pip install --upgrade pipenv
322-
323-
324-
- name: Install dependencies
325-
id: install-python-deps
326-
shell: bash
327-
run: pipenv install --dev
212+
checkout_artifact: true
328213

329214
- name: Assume AWS Credentials
330215
uses: ServerlessOpsIO/gha-assume-aws-credentials@v1

‎stacksets/gha-build/stackset.yaml‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -133,14 +133,15 @@ Resources:
133133
- Effect: Allow
134134
Action:
135135
- 'serverlessrepo:CreateApplication'
136+
- 'serverlessrepo:CreateApplicationVersion'
137+
- 'serverlessrepo:CreateCloudFormationTemplate'
138+
- 'serverlessrepo:DeleteApplication'
136139
- 'serverlessrepo:GetApplication'
137140
- 'serverlessrepo:ListApplications'
138-
- 'serverlessrepo:PublishApplication'
139-
- 'serverlessrepo:UpdateApplication'
140-
- 'serverlessrepo:DeleteApplication'
141+
- 'serverlessrepo:ListApplicationVersions'
141142
- 'serverlessrepo:PutApplicationPolicy'
142-
- 'serverlessrepo:CreateApplicationVersion'
143-
- 'serverlessrepo:CreateCloudFormationTemplate'
143+
- 'serverlessrepo:UnshareApplication'
144+
- 'serverlessrepo:UpdateApplication'
144145
Resource: '*'
145146
- PolicyName: STS
146147
PolicyDocument:

0 commit comments

Comments
 (0)