CI: inline AWS image taging script

The pipeline had been using a single script from
https://github.com/cloudfoundry/bosh-stemcells-ci/, namely
`tasks/light-aws/tag-aws-ami-light.{sh,yml}` to apply tags to AWS images
in order to mark them as published.

This commit inlines the files
`tasks/light-aws/tag-aws-ami-light.{sh,yml}` as
`ci/tasks/aws-tag-image/{run.sh,task.sh}` with some small cleanups.

Author: aramprice

ci/pipelines/stemcells-windows.yml

@@ -139,11 +139,6 @@ resources:
     - ci/docker/Dockerfile
     username: bosh-admin-bot
     password: ((github_public_repo_token))
-- name: bosh-stemcells-ci
-  type: git
-  source:
-    branch: master
-    uri: https://github.com/cloudfoundry/bosh-stemcells-ci
 - name: golang-release
   type: git
   source:
@@ -2188,7 +2183,6 @@ jobs:
         passed: [promote]
       - get: aws-govcloud-tested
         passed: [promote]
-      - get: bosh-stemcells-ci
       - get: stemcell-builder
         passed: [promote]
       - get: version
@@ -2249,7 +2243,7 @@ jobs:
     file: bosh-windows-stemcell-builder-ci/ci/tasks/set-stemcell-version/task.yml
     image: bosh-windows-stemcell-builder-ci-image
   - task: tag-published-aws-ami-light-stemcells
-    file: bosh-stemcells-ci/tasks/light-aws/tag-aws-ami-light.yml
+    file: bosh-windows-stemcell-builder-ci/ci/tasks/aws-tag-image/task.yml
     image: bosh-windows-stemcell-builder-ci-image
     input_mapping:
       candidate-aws-light-stemcell: final-stemcell
@@ -2259,7 +2253,7 @@ jobs:
       AWS_SECRET_ACCESS_KEY: ((aws-stemcells_aws_access_key.password))
       GREP_PATTERN: grep -v 'gov-\|cn-'
   - task: tag-gov-published-aws-ami-light-stemcells
-    file: bosh-stemcells-ci/tasks/light-aws/tag-aws-ami-light.yml
+    file: bosh-windows-stemcell-builder-ci/ci/tasks/aws-tag-image/task.yml
     image: bosh-windows-stemcell-builder-ci-image
     input_mapping:
       candidate-aws-light-stemcell: final-stemcell

ci/tasks/aws-tag-image/run.sh

@@ -0,0 +1,38 @@
+#!/usr/bin/env bash
+set -eu -o pipefail
+
+if [ -n "${AWS_ROLE_ARN}" ]; then
+  aws configure --profile creds_account set aws_access_key_id "${AWS_ACCESS_KEY_ID}"
+  aws configure --profile creds_account set aws_secret_access_key "${AWS_SECRET_ACCESS_KEY}"
+  aws configure --profile resource_account set source_profile "creds_account"
+  aws configure --profile resource_account set role_arn "${AWS_ROLE_ARN}"
+  unset AWS_ACCESS_KEY_ID
+  unset AWS_SECRET_ACCESS_KEY
+  export AWS_PROFILE=resource_account
+fi
+
+set -x
+
+cd candidate-aws-light-stemcell
+
+tar -xzf ./*.tgz stemcell.MF
+AMI_LIST=$(grep ami- stemcell.MF | tr -d ' ')
+if [ -n "${GREP_PATTERN}" ]; then
+  AMI_LIST=$(echo "${AMI_LIST}" | eval "${GREP_PATTERN}")
+fi
+OS=$(grep "operating_system" stemcell.MF | cut -f2 -d: | tr -d ' ')
+VERSION=$(grep "^version" stemcell.MF | cut -f2 -d: | tr -d ' ' | tr -d "'")
+
+for AMI_LINE in ${AMI_LIST}; do
+  AMI_REGION=$(echo "${AMI_LINE}" | cut -f1 -d:)
+  AMI_ID=$(echo "${AMI_LINE}" | cut -f2 -d:)
+
+  TAGS="[
+    { \"Key\": \"published\", \"Value\": \"true\" },
+    { \"Key\": \"name\"     , \"Value\": \"${OS}-${VERSION}\" },
+    { \"Key\": \"distro\"   , \"Value\": \"${OS}\" },
+    { \"Key\": \"version\"  , \"Value\": \"${VERSION}\" }
+  ]"
+
+  aws ec2 create-tags --resources "${AMI_ID}" --region "${AMI_REGION}" --tags "${TAGS}"
+done

ci/tasks/aws-tag-image/task.yml

@@ -0,0 +1,15 @@
+---
+platform: linux
+
+inputs:
+  - name: bosh-windows-stemcell-builder-ci
+  - name: candidate-aws-light-stemcell
+
+run:
+  path: bosh-windows-stemcell-builder-ci/ci/tasks/aws-tag-image/run.sh
+
+params:
+  AWS_ROLE_ARN:
+  AWS_ACCESS_KEY_ID:
+  AWS_SECRET_ACCESS_KEY:
+  GREP_PATTERN: