Skip to content

Commit d6b4791

Browse files
davidcheungdavidcheung
authored
check command for GHA setup requirements (#25)
custom command to check requirements instead, must exit 0 for apply to happen, bumped the minimum version due to use of new feature meaning ran from older zero version it won't pick up the check command
1 parent bbb3abf commit d6b4791

File tree

5 files changed

+96
-45
lines changed

5 files changed

+96
-45
lines changed

‎Makefile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@ circle_ci_setup:
3434
curl -X POST https://circleci.com/api/v1.1/project/github/${GITHUB_ORG}/${GITHUB_REPO}/follow?circle-token=${CIRCLECI_API_KEY}
3535

3636
github_actions_setup:
37-
sh scripts/gha-setup.sh
37+
sh scripts/gha-setup.sh setup
3838

3939
summary:
4040
@echo "zero-deployable-node-backend:"

‎scripts/check.sh‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
#!/bin/bash
2+
set -e
3+
if [[ "${CIVendor}" == "github-actions" ]]; then
4+
sh ./scripts/gha-setup.sh check
5+
elif [[ "${CIVendor}" == "circleci" ]]; then
6+
echo "CircleCI checks successful"
7+
fi

‎scripts/gha-setup.sh‎

Lines changed: 64 additions & 43 deletions
Original file line numberDiff line numberDiff line change
@@ -1,50 +1,71 @@
11
#!/bin/bash
2+
set -e
3+
4+
COMMAND=$1
5+
6+
## Setup variables for checks
7+
GITHUB_ORG=$(echo ${REPOSITORY} | cut -d "/" -f 2)
8+
GITHUB_REPO=$(echo ${REPOSITORY} | cut -d "/" -f 3)
9+
RANDOM_SEED=${randomSeed}
10+
REGION=${region}
211

312
# In order to set project env-vars, we must encrypt secrets
413
# Using gh client allows us to set the secret without installing another
514
# binary just to encrypt the secrets
6-
7-
# Login GH client
8-
# GITHUB_ACCESS_TOKEN is injected when zero apply runs
9-
gh auth login --with-token <<EOF
10-
$GITHUB_ACCESS_TOKEN
15+
setup () {
16+
# Login GH client
17+
# GITHUB_ACCESS_TOKEN is injected when zero apply runs
18+
gh auth login --with-token <<EOF
19+
$GITHUB_ACCESS_TOKEN
1120
EOF
1221

13-
gh auth status
14-
15-
AWS_KEY_PAIR=$(aws secretsmanager get-secret-value --region ${REGION} --secret-id=${PROJECT_NAME}-ci-user-aws-keys${RANDOM_SEED})
16-
AWS_ACCESS_KEY_ID=$(echo ${AWS_KEY_PAIR} | jq -r '.SecretString'| jq -r .access_key_id)
17-
AWS_SECRET_ACCESS_KEY=$(echo ${AWS_KEY_PAIR} | jq -r '.SecretString'| jq -r .secret_key)
18-
19-
## IMPORTANT: Set secret operates on the nearest .git repo even if you specify a different repository
20-
pushd $PROJECT_DIR && \
21-
gh secret set AWS_ACCESS_KEY_ID --repos="$GITHUB_REPO" --body="$AWS_ACCESS_KEY_ID" && \
22-
gh secret set AWS_SECRET_ACCESS_KEY --repos="$GITHUB_REPO" --body="$AWS_SECRET_ACCESS_KEY" && \
23-
popd
24-
25-
## Branch Protect for PRs
26-
## By default we setup Pull-request checks of [lint, unit-test] in `.github/workflows/pull-request.yml`
27-
## And we will enforce both the checks pass before PR can be merged into default branch
28-
DEFAULT_BRANCH=master
29-
curl -XPUT "https://api.github.com/repos/$GITHUB_ORG/$GITHUB_REPO/branches/$DEFAULT_BRANCH/protection" \
30-
--header "Authorization: token $GITHUB_ACCESS_TOKEN" \
31-
--header 'Content-Type: application/json' \
32-
--data '{
33-
"required_status_checks": {
34-
"strict": false,
35-
"contexts": ["unit-test"]
36-
},
37-
"enforce_admins": false,
38-
"required_pull_request_reviews": null,
39-
"restrictions": null
40-
}'
41-
42-
## Rerun github actions workflow, since the first time github action is ran there are no AWS credentials
43-
## so it will always fail, begining of this script we inject the AWS credentials, therefore now we can rerun the workflow
44-
MOST_RECENT_RUN_ID=$(curl -XGET --url "https://api.github.com/repos/${GITHUB_ORG}/${GITHUB_REPO}/actions/runs" \
45-
--header "Authorization: token $GITHUB_ACCESS_TOKEN" --header 'Content-Type: application/json' | jq -r ".workflow_runs[0].id")
46-
## Triggering the rerun
47-
curl -XPOST --url "https://api.github.com/repos/${GITHUB_ORG}/${GITHUB_REPO}/actions/runs/${MOST_RECENT_RUN_ID}/rerun" \
48-
--header "Authorization: token $GITHUB_ACCESS_TOKEN" --header 'Content-Type: application/json'
49-
50-
echo "Github actions environment variables setup successfully."
22+
gh auth status
23+
24+
AWS_KEY_PAIR=$(aws secretsmanager get-secret-value --region ${REGION} --secret-id=${PROJECT_NAME}-ci-user-aws-keys${RANDOM_SEED})
25+
AWS_ACCESS_KEY_ID=$(echo ${AWS_KEY_PAIR} | jq -r '.SecretString'| jq -r .access_key_id)
26+
AWS_SECRET_ACCESS_KEY=$(echo ${AWS_KEY_PAIR} | jq -r '.SecretString'| jq -r .secret_key)
27+
28+
## IMPORTANT: Set secret operates on the nearest .git repo even if you specify a different repository
29+
pushd $PROJECT_DIR && \
30+
gh secret set AWS_ACCESS_KEY_ID --repos="$GITHUB_REPO" --body="$AWS_ACCESS_KEY_ID" && \
31+
gh secret set AWS_SECRET_ACCESS_KEY --repos="$GITHUB_REPO" --body="$AWS_SECRET_ACCESS_KEY" && \
32+
popd
33+
34+
## Branch Protect for PRs
35+
## By default we setup Pull-request checks of [lint, unit-test] in `.github/workflows/pull-request.yml`
36+
## And we will enforce both the checks pass before PR can be merged into default branch
37+
DEFAULT_BRANCH=master
38+
curl -XPUT "https://api.github.com/repos/$GITHUB_ORG/$GITHUB_REPO/branches/$DEFAULT_BRANCH/protection" \
39+
--header "Authorization: token $GITHUB_ACCESS_TOKEN" \
40+
--header 'Content-Type: application/json' \
41+
--data '{
42+
"required_status_checks": {
43+
"strict": false,
44+
"contexts": ["unit-test"]
45+
},
46+
"enforce_admins": false,
47+
"required_pull_request_reviews": null,
48+
"restrictions": null
49+
}'
50+
51+
## Rerun github actions workflow, since the first time github action is ran there are no AWS credentials
52+
## so it will always fail, begining of this script we inject the AWS credentials, therefore now we can rerun the workflow
53+
MOST_RECENT_RUN_ID=$(curl -XGET --url "https://api.github.com/repos/${GITHUB_ORG}/${GITHUB_REPO}/actions/runs" \
54+
--header "Authorization: token $GITHUB_ACCESS_TOKEN" --header 'Content-Type: application/json' | jq -r ".workflow_runs[0].id")
55+
## Triggering the rerun
56+
curl -XPOST --url "https://api.github.com/repos/${GITHUB_ORG}/${GITHUB_REPO}/actions/runs/${MOST_RECENT_RUN_ID}/rerun" \
57+
--header "Authorization: token $GITHUB_ACCESS_TOKEN" --header 'Content-Type: application/json'
58+
59+
echo "Github actions environment variables setup successfully."
60+
}
61+
62+
check () {
63+
# Check if required binaries are installed on user's environment
64+
sh scripts/required-bins.sh gh
65+
# Check github token is able to access this repo
66+
curl -s -XGET "https://api.github.com/repos/$GITHUB_ORG/${GITHUB_REPO}" \
67+
--header "Authorization: token $GITHUB_ACCESS_TOKEN" --header 'Content-Type: application/json' | jq -e ".name == \"${GITHUB_REPO}\""
68+
}
69+
70+
echo "Running command $COMMAND"
71+
$COMMAND

‎scripts/required-bins.sh‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
#!/bin/bash
2+
3+
REQUIRED_BINS=$@
4+
FOUND_BINS=
5+
MISSING_BINS=
6+
EXIT_CODE=0
7+
8+
for ((i = 1; i <= $#; i++ )); do
9+
if command -v ${!i} > /dev/null; then
10+
FOUND_BINS="${FOUND_BINS}${!i} "
11+
else
12+
EXIT_CODE=1
13+
MISSING_BINS="${MISSING_BINS}${!i} "
14+
fi
15+
done
16+
17+
if [[ "$EXIT_CODE" == "0" ]]; then
18+
echo "Successfully found binary(s): $FOUND_BINS";exit $EXIT_CODE
19+
else
20+
echo "Missing binary(s): $MISSING_BINS" >&2 ; exit $EXIT_CODE
21+
fi

‎zero-module.yml‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,9 @@
11
name: zero-deployable-node-backend
22
description: 'zero module for a basic backend service running in kubernetes'
33
author: 'Commit'
4-
zeroVersion: '>= 0.1.0'
4+
zeroVersion: '>= 0.1.1'
5+
commands:
6+
check: sh scripts/check.sh
57

68
dependsOn:
79
- zero-aws-eks-stack

0 commit comments

Comments
 (0)