Skip to content

Commit 63aed9a

Browse files
zhelezovartemzhelezovartem
authored
add ci job to upload Kosli cli Lambda layer (#395)
* add workflow to upload Kosli cli lambda layers * fix parameters * ci: pin ubuntu version * test * fix script name * fix bash * add upload-layer job to the release pipeline and for now to the main pipeline, just for the test * remove the wrong parameter * ci: install aws cli v2 * use v2.11.2 tag * add more regions * upload kosli-cli layer v2.11.5 * cleanup * map layer arn instead of just version
1 parent 1dc2266 commit 63aed9a

File tree

5 files changed

+208
-118
lines changed

5 files changed

+208
-118
lines changed

‎.github/workflows/main.yml‎

Lines changed: 19 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ name: Main
33
on:
44
push:
55
branches:
6-
- '**'
6+
- "**"
77

88
concurrency:
99
group: ${{ github.workflow }}-${{ github.ref }}
@@ -16,29 +16,27 @@ jobs:
1616
trail_name: ${{ steps.prep.outputs.trail_name }}
1717
trail_template_file: ${{ steps.prep.outputs.trail_template_file }}
1818
steps:
19+
- uses: actions/checkout@v4
1920

20-
- uses: actions/checkout@v4
21+
- name: Prepare
22+
id: prep
23+
run: |
24+
TAG=$(echo $GITHUB_SHA | head -c7)
25+
echo "TAG=${TAG}" >> ${GITHUB_ENV}
26+
echo "tag=$TAG" >> $GITHUB_OUTPUT
2127
22-
- name: Prepare
23-
id: prep
24-
run: |
25-
TAG=$(echo $GITHUB_SHA | head -c7)
26-
echo "TAG=${TAG}" >> ${GITHUB_ENV}
27-
echo "tag=$TAG" >> $GITHUB_OUTPUT
28-
29-
if [ "${GITHUB_REF}" == refs/tags/* ]; then
30-
TRAIL_NAME=${GITHUB_REF##refs/tags/}
31-
TRAIL_TEMPLATE_FILE=release-flow-template.yml
32-
else
33-
TRAIL_NAME=$(echo $GITHUB_SHA | head -c 7)
34-
TRAIL_TEMPLATE_FILE=main-flow-template.yml
35-
fi
36-
echo "TRAIL_NAME=${TRAIL_NAME}" >> $GITHUB_ENV
37-
echo "trail_name=$TRAIL_NAME" >> $GITHUB_OUTPUT
38-
39-
echo "TRAIL_TEMPLATE_FILE=${TRAIL_TEMPLATE_FILE}" >> $GITHUB_ENV
40-
echo "trail_template_file=$TRAIL_TEMPLATE_FILE" >> $GITHUB_OUTPUT
28+
if [ "${GITHUB_REF}" == refs/tags/* ]; then
29+
TRAIL_NAME=${GITHUB_REF##refs/tags/}
30+
TRAIL_TEMPLATE_FILE=release-flow-template.yml
31+
else
32+
TRAIL_NAME=$(echo $GITHUB_SHA | head -c 7)
33+
TRAIL_TEMPLATE_FILE=main-flow-template.yml
34+
fi
35+
echo "TRAIL_NAME=${TRAIL_NAME}" >> $GITHUB_ENV
36+
echo "trail_name=$TRAIL_NAME" >> $GITHUB_OUTPUT
4137
38+
echo "TRAIL_TEMPLATE_FILE=${TRAIL_TEMPLATE_FILE}" >> $GITHUB_ENV
39+
echo "trail_template_file=$TRAIL_TEMPLATE_FILE" >> $GITHUB_OUTPUT
4240
4341
init-kosli:
4442
needs: [pre-build]
@@ -52,7 +50,6 @@ jobs:
5250
kosli_api_token: ${{ secrets.KOSLI_PUBLIC_API_TOKEN }}
5351
pr_github_token: ${{ secrets.GITHUB_TOKEN }}
5452

55-
5653
test:
5754
needs: [pre-build, init-kosli]
5855
uses: ./.github/workflows/test.yml

‎.github/workflows/release.yml‎

Lines changed: 56 additions & 50 deletions
Original file line numberDiff line numberDiff line change
@@ -2,10 +2,10 @@ name: release
22

33
on:
44
push:
5-
tags:
6-
- 'v*'
5+
tags:
6+
- "v*"
77

8-
env:
8+
env:
99
GO_VERSION: 1.22.0
1010

1111
concurrency:
@@ -19,48 +19,47 @@ jobs:
1919
trail_name: ${{ steps.prep.outputs.trail_name }}
2020
trail_template_file: ${{ steps.prep.outputs.trail_template_file }}
2121
steps:
22-
23-
- uses: actions/checkout@v4
24-
25-
- name: Get tag
26-
id: tag
27-
uses: dawidd6/action-get-tag@v1
28-
29-
- name: Prepare
30-
id: prep
31-
run: |
32-
echo "TRAIL_NAME=${{ steps.tag.outputs.tag }}" >> $GITHUB_STATE
33-
echo "trail_name=${{ steps.tag.outputs.tag }}" >> $GITHUB_OUTPUT
34-
35-
echo "TRAIL_TEMPLATE_FILE=release-flow-template.yml" >> $GITHUB_STATE
36-
echo "trail_template_file=release-flow-template.yml" >> $GITHUB_OUTPUT
37-
22+
- uses: actions/checkout@v4
23+
24+
- name: Get tag
25+
id: tag
26+
uses: dawidd6/action-get-tag@v1
27+
28+
- name: Prepare
29+
id: prep
30+
run: |
31+
echo "TRAIL_NAME=${{ steps.tag.outputs.tag }}" >> $GITHUB_STATE
32+
echo "trail_name=${{ steps.tag.outputs.tag }}" >> $GITHUB_OUTPUT
33+
34+
echo "TRAIL_TEMPLATE_FILE=release-flow-template.yml" >> $GITHUB_STATE
35+
echo "trail_template_file=release-flow-template.yml" >> $GITHUB_OUTPUT
36+
3837
init-kosli:
39-
needs: [pre-build]
40-
uses: ./.github/workflows/init_kosli.yml
41-
with:
42-
FLOW_NAME: cli-release
43-
TRAIL_NAME: ${{ needs.pre-build.outputs.trail_name }}
44-
FLOW_TEMPLATE_FILE: ${{ needs.pre-build.outputs.trail_template_file }}
45-
KOSLI_ORG: kosli-public
46-
secrets:
47-
kosli_api_token: ${{ secrets.KOSLI_PUBLIC_API_TOKEN }}
48-
pr_github_token: ${{ secrets.GITHUB_TOKEN }}
38+
needs: [pre-build]
39+
uses: ./.github/workflows/init_kosli.yml
40+
with:
41+
FLOW_NAME: cli-release
42+
TRAIL_NAME: ${{ needs.pre-build.outputs.trail_name }}
43+
FLOW_TEMPLATE_FILE: ${{ needs.pre-build.outputs.trail_template_file }}
44+
KOSLI_ORG: kosli-public
45+
secrets:
46+
kosli_api_token: ${{ secrets.KOSLI_PUBLIC_API_TOKEN }}
47+
pr_github_token: ${{ secrets.GITHUB_TOKEN }}
4948

5049
never-alone-trail:
51-
needs: [pre-build, init-kosli]
52-
uses: ./.github/workflows/never_alone_trail.yml
53-
with:
54-
FLOW_NAME: cli-release-never-alone
55-
TRAIL_NAME: ${{ needs.pre-build.outputs.trail_name }}
56-
SOURCE_FLOW_NAME: cli
57-
ATTESTATION_NAME: never-alone-data
58-
PARENT_FLOW_NAME: cli-release
59-
PARENT_TRAIL_NAME: ${{ needs.pre-build.outputs.trail_name }}
60-
KOSLI_ORG: kosli-public
61-
secrets:
62-
kosli_api_token: ${{ secrets.KOSLI_PUBLIC_API_TOKEN }}
63-
pr_github_token: ${{ secrets.GITHUB_TOKEN }}
50+
needs: [pre-build, init-kosli]
51+
uses: ./.github/workflows/never_alone_trail.yml
52+
with:
53+
FLOW_NAME: cli-release-never-alone
54+
TRAIL_NAME: ${{ needs.pre-build.outputs.trail_name }}
55+
SOURCE_FLOW_NAME: cli
56+
ATTESTATION_NAME: never-alone-data
57+
PARENT_FLOW_NAME: cli-release
58+
PARENT_TRAIL_NAME: ${{ needs.pre-build.outputs.trail_name }}
59+
KOSLI_ORG: kosli-public
60+
secrets:
61+
kosli_api_token: ${{ secrets.KOSLI_PUBLIC_API_TOKEN }}
62+
pr_github_token: ${{ secrets.GITHUB_TOKEN }}
6463

6564
test:
6665
needs: [pre-build, init-kosli]
@@ -131,13 +130,13 @@ jobs:
131130
env:
132131
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
133132
FURY_TOKEN: ${{ secrets.FURY_TOKEN }}
134-
133+
135134
- uses: actions/upload-artifact@v4
136135
with:
137136
name: dist
138137
path: dist
139138
retention-days: 1
140-
139+
141140
- name: Prepare artifacts list
142141
id: prepare-artifacts-list
143142
run: |
@@ -151,12 +150,11 @@ jobs:
151150
.
152151
end
153152
)][]' dist/artifacts.json)
154-
153+
155154
echo "artifacts<<nEOFn" >> $GITHUB_OUTPUT
156155
echo "${ARTIFACTS}" >> $GITHUB_OUTPUT
157156
echo "nEOFn" >> $GITHUB_OUTPUT
158157
159-
160158
binary-provenance:
161159
needs: [goreleaser, pre-build]
162160
name: Artifacts Binary Provenance
@@ -183,7 +181,7 @@ jobs:
183181
env:
184182
# the personal access token should have "repo" & "workflow" scopes
185183
COMMITTER_TOKEN: ${{ secrets.COMMITTER_TOKEN }}
186-
184+
187185
docs-gen:
188186
needs: [goreleaser, pre-build]
189187
runs-on: ubuntu-latest
@@ -197,14 +195,14 @@ jobs:
197195
uses: actions/setup-go@v5
198196
with:
199197
go-version: ${{ env.GO_VERSION }}
200-
198+
201199
- name: Generate docs
202200
env:
203201
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
204202
# legacy-ref should happen first as it has the side effect of deleting generated files outside the legacy_ref
205-
run: |
203+
run: |
206204
make legacy-ref-docs
207-
make cli-docs
205+
make cli-docs
208206
209207
- name: Generate json
210208
run: |
@@ -243,3 +241,11 @@ jobs:
243241
repository: kosli-dev/terraform-aws-kosli-reporter
244242
event-type: upload-package
245243
client-payload: '{"kosli_cli_tag": "${{ needs.pre-build.outputs.tag }}"}'
244+
245+
environment-reporter-upload-layer:
246+
needs: [pre-build, goreleaser]
247+
uses: ./.github/workflows/upload-cli-layer.yml
248+
with:
249+
tag: ${{ needs.pre-build.outputs.tag }}
250+
AWS_ACCOUNT_ID: 585008075785
251+
AWS_REGION: eu-central-1

‎.github/workflows/upload-cli-layer.yml‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
name: Upload Kosli cli lambda layer
2+
3+
on:
4+
workflow_call:
5+
inputs:
6+
tag:
7+
required: true
8+
type: string
9+
AWS_ACCOUNT_ID:
10+
required: true
11+
type: string
12+
AWS_REGION:
13+
required: true
14+
type: string
15+
16+
jobs:
17+
upload-layer:
18+
runs-on: ubuntu-24.04
19+
permissions:
20+
id-token: write
21+
contents: write
22+
steps:
23+
- uses: actions/checkout@v4
24+
25+
- name: Configure AWS credentials
26+
uses: aws-actions/configure-aws-credentials@v4
27+
with:
28+
role-to-assume: arn:aws:iam::${{ inputs.AWS_ACCOUNT_ID }}:role/cli
29+
aws-region: ${{ inputs.AWS_REGION }}
30+
role-duration-seconds: 2400
31+
role-session-name: ${{ github.event.repository.name }}
32+
33+
- name: Upload reporter lambda package
34+
id: upload-reporter-lambda-package
35+
env:
36+
TAG: ${{ inputs.tag }}
37+
AWS_ACCOUNT_ID: ${{ inputs.AWS_ACCOUNT_ID }}
38+
run: ./bin/upload_cli_layer.sh

‎.github/workflows/upload-reporter-package.yml‎

Lines changed: 0 additions & 46 deletions
This file was deleted.

0 commit comments

Comments
 (0)