Skip to content

Commit 7d71544

Browse files
collins-wcollins-w
committed
feat: add an deployment workflow to AWS
1 parent efede36 commit 7d71544

File tree

3 files changed

+195
-0
lines changed

3 files changed

+195
-0
lines changed

‎.github/actions/oidc/action.yaml‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
---
2+
name: AWS OIDC Credentials via Role Assume Chaining
3+
description: Retrieve AWS credentials by chaining role assumes
4+
inputs:
5+
role-for-oidc:
6+
description: The role that should be used for GitHub OIDC authentication
7+
required: true
8+
role-to-assume:
9+
description: The role that should be finally assumed
10+
required: true
11+
role-session-name:
12+
description: The session name that should be used when assuming roles
13+
required: true
14+
default: github-actions
15+
role-duration-seconds:
16+
description: duration of the credentials validity
17+
required: true
18+
default: 3600
19+
aws-region:
20+
description: The AWS region
21+
required: false
22+
default: us-east-1
23+
24+
runs:
25+
using: composite
26+
steps:
27+
- name: assume oidc role
28+
uses: aws-actions/configure-aws-credentials@ececac1a45f3b08a01d2dd070d28d111c5fe6722 # v4.1.0
29+
with:
30+
aws-region: us-east-1
31+
role-to-assume: ${{ inputs.role-for-oidc }}
32+
role-session-name: ${{ inputs.role-session-name }}
33+
role-duration-seconds: 900
34+
- name: assume target role
35+
uses: aws-actions/configure-aws-credentials@ececac1a45f3b08a01d2dd070d28d111c5fe6722 # v4.1.0
36+
id: assume-target-role
37+
with:
38+
aws-access-key-id: ${{ env.AWS_ACCESS_KEY_ID }}
39+
aws-secret-access-key: ${{ env.AWS_SECRET_ACCESS_KEY }}
40+
aws-session-token: ${{ env.AWS_SESSION_TOKEN }}
41+
aws-region: ${{ inputs.aws-region }}
42+
role-chaining: true
43+
role-to-assume: ${{ inputs.role-to-assume }}
44+
role-session-name: ${{ inputs.role-session-name }}
45+
role-duration-seconds: ${{ inputs.role-duration-seconds }}

‎.github/actions/prepare/action.yml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,9 +17,28 @@ runs:
1717
uses: dtolnay/rust-toolchain@1.86.0 # v1.86.0
1818
with:
1919
components: ${{ (inputs.components != '') && format('{0}, rustfmt, clippy', inputs.components) || 'rustfmt, clippy' }}
20+
2021
- name: Install libsodium
2122
run: sudo apt-get update && sudo apt-get install -y libsodium-dev
2223
shell: bash
24+
2325
- name: Restore cargo dependencies from cache
2426
uses: Swatinem/rust-cache@f0deed1e0edfc6a9be95417288c0e1099b1eeec3 # v2.7.7
2527
id: cache
28+
29+
- uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
30+
with:
31+
run_install: false
32+
33+
- name: Use node@22
34+
uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # v4.0.2
35+
with:
36+
node-version: 22.18.0
37+
cache: 'pnpm'
38+
39+
- name: Build launchtube plugin example
40+
run: |
41+
cd examples/launchtube-plugin-example/launchtube
42+
pnpm install
43+
pnpm run build
44+
cd ..

‎.github/workflows/ecs-deployment.yml‎

Lines changed: 131 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,131 @@
1+
2+
name: ECS Build
3+
4+
on:
5+
# release:
6+
# types: [published]
7+
push:
8+
branches: [aws-deployment]
9+
10+
permissions:
11+
contents: read
12+
actions: read
13+
14+
jobs:
15+
build-and-push:
16+
runs-on: ubuntu-latest
17+
permissions:
18+
id-token: write
19+
contents: read
20+
packages: write
21+
attestations: write
22+
security-events: write
23+
env:
24+
REGISTRY: ${{ secrets.SOLUTIONS_ACCOUNT_ID }}.dkr.ecr.us-east-1.amazonaws.com
25+
ROLE_FOR_OIDC: 'arn:aws:iam::${{ secrets.ROOT_ACCOUNT_ID }}:role/github-actions-solutions-account-openzeppelin-relayer-oidc-role'
26+
ROLE_TO_ASSUME: 'arn:aws:iam::${{ secrets.SOLUTIONS_ACCOUNT_ID }}:role/GithubOIDCOpenzeppelinRelayerRole'
27+
steps:
28+
- name: Harden the runner (Audit all outbound calls)
29+
uses: step-security/harden-runner@4d991eb9b905ef189e4c376166672c3f2f230481 # v2.11.0
30+
with:
31+
egress-policy: audit
32+
33+
- uses: actions/create-github-app-token@af35edadc00be37caa72ed9f3e6d5f7801bfdf09 # v1.11.7
34+
id: gh-app-token
35+
with:
36+
app-id: ${{ vars.GH_APP_ID }}
37+
private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
38+
39+
- name: Checkout Repo
40+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
41+
with:
42+
token: ${{ steps.gh-app-token.outputs.token }}
43+
fetch-depth: 0
44+
45+
- name: Prepare pre-requisites
46+
uses: ./.github/actions/prepare
47+
with:
48+
token: ${{ steps.gh-app-token.outputs.token }}
49+
50+
- name: Create launchtube fund and sequence accounts
51+
run: |
52+
cargo run --example create_key -- \
53+
--password "$KEYSTORE_PASSPHRASE_FUND" \
54+
--output-dir config/keys \
55+
--filename launchtube-fund.json
56+
57+
cargo run --example create_key -- \
58+
--password "$KEYSTORE_PASSPHRASE_SEQ_001" \
59+
--output-dir config/keys \
60+
--filename launchtube-seq-001.json
61+
62+
cargo run --example create_key -- \
63+
--password "$KEYSTORE_PASSPHRASE_SEQ_002" \
64+
--output-dir config/keys \
65+
--filename launchtube-seq-002.json
66+
67+
env:
68+
KEYSTORE_PASSPHRASE_FUND: ${{ secrets.KEYSTORE_PASSPHRASE_FUND }}
69+
KEYSTORE_PASSPHRASE_SEQ_001: ${{ secrets.KEYSTORE_PASSPHRASE_SEQ_001 }}
70+
KEYSTORE_PASSPHRASE_SEQ_002: ${{ secrets.KEYSTORE_PASSPHRASE_SEQ_002 }}
71+
72+
- name: Set up QEMU
73+
uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
74+
with:
75+
platforms: 'arm64'
76+
77+
- name: Set up Docker Buildx
78+
uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2
79+
80+
- name: Set up AWS credentials via OIDC and role chaining
81+
uses: ./.github/actions/oidc
82+
with:
83+
role-for-oidc: ${{ env.ROLE_FOR_OIDC }}
84+
role-to-assume: ${{ env.ROLE_TO_ASSUME }}
85+
86+
- name: Login to Amazon ECR
87+
uses: aws-actions/amazon-ecr-login@062b18b96a7aff071d4dc91bc00c4c1a7945b076 # v2.0.1
88+
89+
- name: Build and push Docker image
90+
uses: docker/build-push-action@471d1dc4e07e5cdedd4c2171150001c434f0b7a4 # v6.15.0
91+
id: push
92+
with:
93+
context: .
94+
platforms: linux/amd64,linux/arm64
95+
push: true
96+
tags: |
97+
${{ env.REGISTRY }}/openzeppelin-layer:latest
98+
${{ env.REGISTRY }}/openzeppelin-layer:${{ github.sha }}
99+
cache-from: type=gha
100+
cache-to: type=gha,mode=max
101+
102+
# deploy:
103+
# runs-on: ubuntu-latest
104+
# needs: build-and-push
105+
# env:
106+
# ROLE_FOR_OIDC: 'arn:aws:iam::${{ secrets.ROOT_ACCOUNT_ID }}:role/github-actions-research-account-oidc-role'
107+
# ROLE_TO_ASSUME: 'arn:aws:iam::${{ secrets.RESEARCH_ACCOUNT_ID }}:role/GithubOIDCResearchAccountRole'
108+
# ECS_CLUSTER: 'openzeppelin-layer-cluster'
109+
# ECS_SERVICE: 'openzeppelin-layer-service'
110+
# AWS_REGION: ${{ vars.AWS_REGION }}
111+
# permissions:
112+
# contents: read
113+
# id-token: write
114+
# steps:
115+
# - name: Harden the runner (Audit all outbound calls)
116+
# uses: step-security/harden-runner@4d991eb9b905ef189e4c376166672c3f2f230481 # v2.11.0
117+
# with:
118+
# egress-policy: audit
119+
120+
# - name: Checkout code
121+
# uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
122+
123+
# - name: Set up AWS credentials via OIDC and role chaining
124+
# uses: ./.github/actions/oidc
125+
# with:
126+
# role-for-oidc: ${{ env.ROLE_FOR_OIDC }}
127+
# role-to-assume: ${{ env.ROLE_TO_ASSUME }}
128+
129+
# - name: AWS ECS force new deployment
130+
# run: |
131+
# aws ecs update-service --cluster $ECS_CLUSTER --service $ECS_SERVICE --force-new-deployment --region $AWS_REGION

0 commit comments

Comments
 (0)