Merge pull request #713 from NHSDigital/feature/made14-NRL-793-perms-pipeline-fixups

[NRL-793] Use tag for current-info version if branch is HEAD

Author: mattdean3-nhs

.github/workflows/update-lambda-permissions.yml

@@ -1,5 +1,5 @@
 name: Update Lambda Permissions
-run-name: Updating permissions on ${{ inputs.stack_name }} using ${{ github.ref }} by ${{ github.actor }}
+run-name: Updating permissions on ${{ inputs.stack_name }} using ${{ github.ref_name }} by ${{ github.actor }}
 
 on:
   workflow_dispatch:

scripts/get-current-info.sh

@@ -3,6 +3,20 @@
 set -o errexit -o nounset -o pipefail
 
 BRANCH_NAME="$(git rev-parse --abbrev-ref HEAD)"
+TAG_NAME="$(git describe --tags || echo "no-tags")"
 SHORT_COMMIT_HASH="$(git rev-parse --short=8 HEAD)"
 
-echo "{ \"version\": \"${BRANCH_NAME}@${SHORT_COMMIT_HASH}\" }"
+if [ "${BRANCH_NAME}" == "HEAD" ]; then
+    NRLF_VERSION="${TAG_NAME}@${SHORT_COMMIT_HASH}"
+else
+    NRLF_VERSION="${BRANCH_NAME}@${SHORT_COMMIT_HASH}"
+fi
+
+cat << EOF
+{
+    "version": "${NRLF_VERSION}",
+    "tag": "${TAG_NAME}",
+    "branch": "${BRANCH_NAME}",
+    "commit": "${SHORT_COMMIT_HASH}"
+}
+EOF

terraform/bootstrap/non-mgmt/terraform-trust-policy.json

@@ -6,7 +6,7 @@
       "Principal": {
         "AWS": "arn:aws:iam::REPLACEME:root"
       },
-      "Action": "sts:AssumeRole",
+      "Action": ["sts:AssumeRole", "sts:TagSession"],
       "Condition": {}
     }
   ]