Repository navigation
ci: deploy from GitHub Actions through OIDC - #4
Merged
Merged
Conversation
Pull requests that touch the code or the infrastructure run `make plan` with a read-only role and put the plan in the run summary. Merges to main plan and apply with the apply role, which only main can assume. Both roles live in aws-oidc-bootstrap; there are no stored AWS keys. The workflow refuses to run without the ALERT_EMAIL secret, since an empty alert_email would plan the alert subscription away. alert_email is now sensitive, so the address stays out of the public Actions logs.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
First half of roadmap phase 2: deploys run from GitHub Actions instead of a laptop.
What changes
.github/workflows/deploy.yml: pull requests that touchsrc/,infrastructure/,requirements-lambda.txt,Makefileor the workflow itself runmake planand put the plan in the run summary. Onmainthe workflow plans again and applies, stamping the Lambda with the merge commit's SHA.workflow_dispatchre-deploysmain.github-actions-voltcast-plan(read-only, plans with-lock=false). Onlymaincan assumegithub-actions-voltcast-apply. Both roles are inaws-oidc-bootstrap, scoped tovoltcast-*resources. The read list comes from aTF_LOG=debugplan against the live stack. Both policies were checked with the IAM policy simulator (68 allow/deny cases each) and Access Analyzer. The apply role can't create or delete the KMS data key.ALERT_EMAILsecret is missing, because an emptyalert_emailwould plan the alert subscription away.alert_emailis nowsensitive, so the address stays out of the public Actions logs.Config (already set)
Repository variables
AWS_PLAN_ROLE_ARN,AWS_APPLY_ROLE_ARN,AWS_REGION,TF_STATE_BUCKET,TF_STATE_LOCK_TABLE, and theALERT_EMAILsecret.Expected plan on this PR
aws_lambda_function.pipeline: in-place update ofCODE_VERSION, and possibly the code hash if the CI-built zip differs byte-wise from the local build.aws_sns_topic_subscription.email[0]: in-place, sensitivity marking only (value unchanged, no API change).