GitHub-to-AWS keyless authentication

.github/workflows/deploy.yml

@@ -0,0 +1,35 @@
+---
+name: Deploy and update security.txt
+
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - 'main'
+  schedule:
+    - cron: "0 2 * * 1"
+
+jobs:
+  deploy-to-co-cyber-security-external:
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+      contents: read
+    steps:
+      - name: Checkout repo
+        uses: actions/checkout@v4
+
+      - name: Set up Python 3.8
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.8"
+
+      - name: Set up AWS creds
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: ${{ secrets.ROLE_TO_ASSUME_ARN }}
+          aws-region: eu-west-2
+
+      - name: Run Makefile
+        run: bash deploy.sh
+        shell: bash

deploy.sh

@@ -0,0 +1,21 @@
+#!/bin/bash
+
+# Manage content on the S3 for prod account.
+
+if [[ "$OSTYPE" == "linux-gnu"* ]]; then
+    DATE_NOW=$(date --rfc-3339='seconds')
+    DATE_EXP=$(date -d "+3 months" --rfc-3339='seconds')
+
+    sed -i "s/DATE_NOW/${DATE_NOW}/g" ./security.txt
+    sed -i "s/DATE_EXP/${DATE_EXP}/g" ./security.txt
+
+    mkdir -p ./paas_app/.well-known/
+    cp ./security.txt ./paas_app/security.txt
+    cp ./thanks.txt ./paas_app/thanks.txt
+    cp ./paas_app/security.txt ./paas_app/.well-known/security.txt
+
+    aws s3 cp --recursive paas_app s3://prod-vdp.cabinetoffice.gov.uk-website
+else
+    echo "Due to different output format in date, only Linux is supported"
+    exit 1
+fi

readme.md

@@ -13,5 +13,7 @@ https://vdp.cabinetoffice.gov.uk/.well-known/security.txt
 This is so that we can update the `security.txt` from one place.
 
 ## Deployment
-A [GitHub Action](.github/workflows/deploy.yml) deploys changes to [security.txt](security.txt) in `main` to GOV.UK PaaS.  
-The deployment also occurs every week to update the _expires_ field.
+
+- To make changes in thanks.txt create a new pull request. Once approved GitHub automatically will deploy new file to the AWS where content is being hosted.
+- File security.txt is a template which is being updated and uploaded on every merge to main with new expiration date
+- The deployment also occurs every week to update the _expires_ field.

security.txt

@@ -6,3 +6,9 @@ Contact: https://www.gov.uk/contact/govuk
 Acknowledgments: https://vdp.cabinetoffice.gov.uk/thanks.txt
 
 Hiring: https://www.civilservicejobs.service.gov.uk/
+
+Last-Updated: DATE_NOW
+
+Expires: DATE_EXP
+
+Generated at: https://github.com/alphagov/security.txt