Skip to content
Deploy RSA CA with public CRL

Deploy RSA CA with public CRL #101

Sign in to view logs

Deploy RSA CA with public CRL

Deploy RSA CA with public CRL #101

Workflow file for this run

.github/workflows/rsa_public_crl.yml at 847d6c8
name: Deploy RSA CA with public CRL
on:
workflow_dispatch:
push:
paths:
- "**/*.py"
- "**/*.tf"
- "**/*.txt"
- ".github/workflows/rsa_public_crl.yml"
branches:
- main
env:
TF_VAR_hosted_zone_domain: ${{ secrets.HOSTED_ZONE_DOMAIN }}
jobs:
terraform_validate:
name: Terraform validate
runs-on: ubuntu-latest
permissions:
id-token: write
contents: read
checks: write
steps:
- name: Terraform setup
uses: hashicorp/setup-terraform@v3
with:
terraform_version: 1.6.1
- name: Checkout
uses: actions/checkout@v4
- name: Terraform format
run: terraform fmt -check -recursive
- name: Terraform init
working-directory: ./examples/rsa-public-crl
run: terraform init -get -backend=false
- name: Terraform validate
working-directory: ./examples/rsa-public-crl
run: terraform validate
secret_scan:
name: Secret scan
runs-on: ubuntu-latest
steps:
- name: Checkout code
uses: actions/checkout@v4
- name: Install GitLeaks
run: |
wget https://github.com/gitleaks/gitleaks/releases/download/v8.16.1/gitleaks_8.16.1_linux_x64.tar.gz && \
tar -xf gitleaks_8.16.1_linux_x64.tar.gz
sudo mv gitleaks /usr/local/bin/gitleaks && \
sudo chmod +x /usr/local/bin/gitleaks
- name: Run GitLeaks Scan
run: |
gitleaks detect --source . -v
terraform_plan_apply:
name: Terraform plan & apply
runs-on: ubuntu-latest
environment: 'rsa'
needs:
- terraform_validate
- secret_scan
defaults:
run:
working-directory: ./examples/rsa-public-crl
permissions:
id-token: write
contents: read
pull-requests: read
checks: write
steps:
- name: Terraform setup
uses: hashicorp/setup-terraform@v3
with:
terraform_version: 1.6.1
- name: checkout
uses: actions/checkout@v4
- name: Set up Python 3.12
id: setup_python
uses: actions/setup-python@v5
with:
python-version: '3.12'
- name: Display Python version
run: python -c "import sys; print(sys.version)"
- name: Install virtualenv
run: pip install virtualenv
- name: Configure AWS Credentials
uses: aws-actions/configure-aws-credentials@v4
with:
role-to-assume: ${{ secrets.RSA_AWS_DEPLOY_ROLE_ARN}}
aws-region: ${{ secrets.AWS_REGION }}
- name: Terraform initialise
run: >
terraform init
-backend-config=bucket=${{ secrets.RSA_TERRAFORM_STATE_BUCKET}}
-backend-config=key=${{ secrets.TERRAFORM_STATE_KEY}}
-backend-config=region=${{ secrets.TERRAFORM_STATE_REGION}}
- name: cache built python modules
uses: actions/cache@v4
with:
key: modules_terraform-aws-ca-lambda_build_${{ hashFiles('./modules/terraform-aws-ca-lambda/lambda_code/**') }}_${{ hashFiles('./modules/terraform-aws-ca-lambda/utils/**') }}_${{ github.job }}_py${{ steps.setup_python.outputs.python-version }}
path: ./modules/terraform-aws-ca-lambda/build
- name: terraform plan
run: terraform plan -out tfplan
- name: terraform apply
run: terraform apply -auto-approve tfplan
delete_dynamo_db_items:
# deletes Certificate Authority - only use for testing
name: Delete all DynamoDB items
runs-on: ubuntu-latest
environment: 'rsa'
needs:
- terraform_plan_apply
permissions:
id-token: write
contents: read
checks: write
steps:
- name: checkout
uses: actions/checkout@v4
- name: Set up Python 3.12
uses: actions/setup-python@v5
with:
python-version: "3.12"
- name: Display Python version
run: python -c "import sys; print(sys.version)"
- name: Install dependencies
run: |
pip install -r scripts/requirements.txt
- name: Configure AWS Credentials - Dev
uses: aws-actions/configure-aws-credentials@v4
with:
role-to-assume: ${{ secrets.RSA_AWS_DEPLOY_ROLE_ARN}}
aws-region: ${{ secrets.AWS_REGION }}
- name: Delete all DynamoDB items
run: |
python scripts/delete_db_table_items.py
start_ca:
name: Start CA
runs-on: ubuntu-latest
environment: 'rsa'
needs:
- delete_dynamo_db_items
permissions:
id-token: write
contents: read
checks: write
steps:
- name: checkout
uses: actions/checkout@v4
- name: Set up Python 3.12
uses: actions/setup-python@v5
with:
python-version: "3.12"
- name: Display Python version
run: python -c "import sys; print(sys.version)"
- name: Install dependencies
run: |
pip install -r scripts/requirements.txt
- name: Configure AWS Credentials - Dev
uses: aws-actions/configure-aws-credentials@v4
with:
role-to-assume: ${{ secrets.RSA_AWS_DEPLOY_ROLE_ARN}}
aws-region: ${{ secrets.AWS_REGION }}
- name: Start CA
run: |
python scripts/start_ca_step_function.py
integration_tests:
name: Integration Tests
runs-on: ubuntu-latest
environment: 'rsa'
needs: start_ca
permissions:
id-token: write
contents: read
checks: write
steps:
- name: Checkout
uses: actions/checkout@v4
- name: Set up Python 3.12
uses: actions/setup-python@v5
with:
python-version: "3.12"
- name: Install dependencies
run: |
pip install -r requirements-dev.txt
- name: Configure AWS Credentials - Dev
uses: aws-actions/configure-aws-credentials@v4
with:
role-to-assume: ${{ secrets.RSA_AWS_DEPLOY_ROLE_ARN}}
aws-region: ${{ secrets.AWS_REGION }}
- name: Integration tests
run: |
pytest -v tests