Skip to content

Commit 14f1ed3

Browse files
timbru31timbru31
authored
Merge pull request #82 from lara-learning/feat/oidc-gh-envs
refactor: use OIDC for AWS deployments, split secrets into GitHub env…
2 parents 22bb3b5 + 5075886 commit 14f1ed3

8 files changed

+4526
-4676
lines changed

‎.github/workflows/merge-to-master.yml

+4-4
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,11 @@
11
########################################################
2-
# Action to run on pullrequest merge to main #
2+
# Action to run on pullrequest merge to main #
33
# Staging build and deployment #
44
########################################################
55
name: Action on Pullrequest push to main
6-
on:
6+
on:
77
push:
8-
branches:
8+
branches:
99
- 'main'
1010

1111
jobs:
@@ -18,7 +18,7 @@ jobs:
1818
with:
1919
environmentName: staging
2020
debug: 'true'
21-
mode: ""
21+
mode: ''
2222
secrets: inherit
2323

2424
deploy:

‎.github/workflows/reusable-build-job.yml

+10-26
Original file line numberDiff line numberDiff line change
@@ -20,58 +20,42 @@ jobs:
2020
build:
2121
runs-on: ubuntu-latest
2222
name: build-job
23+
environment: ${{ inputs.environmentName }}
2324
env:
24-
ENVIRONMENT_NAME: ${{ inputs.environmentName }}
2525
DEBUG: ${{ inputs.debug }}
2626
MODE: ${{ inputs.mode }}
2727
AUTH_HEADER: ${{ secrets.AUTH_HEADER }}
2828
MICROSOFT_TENANT_ID: ${{ secrets.MICROSOFT_TENANT_ID }}
29+
MICROSOFT_CLIENT_ID: ${{ secrets.MICROSOFT_CLIENT_ID }}
2930
SUPPORT_MAIL: ${{ secrets.SUPPORT_MAIL }}
3031
URL_ORIGIN: ${{ secrets.URL_ORIGIN }}
3132
COMPANY_ABBREVIATION: ${{ secrets.COMPANY_ABBREVIATION }}
3233
OLD_COMPANY_NAME: ${{ secrets.OLD_COMPANY_NAME }}
3334
NEW_COMPANY_NAME: ${{ secrets.NEW_COMPANY_NAME }}
3435
AVATAR_URL: ${{ secrets.AVATAR_URL }}
3536
LARA_VERSION: ${{ github.ref_name }}
37+
FRONTEND_URL: ${{ secrets.FRONTEND_URL }}
38+
BACKEND_URL: ${{ secrets.BACKEND_URL }}
3639
steps:
3740
- uses: actions/checkout@v4
38-
- uses: actions/setup-node@v3
41+
42+
- uses: actions/setup-node@v4
3943
with:
40-
node-version: '18'
41-
- uses: actions/cache@v3
44+
node-version-file: '.nvmrc'
45+
46+
- uses: actions/cache@v4
4247
with:
4348
path: |
4449
node_modules
4550
packages/*/node_modules
4651
.yarn
4752
key: ${{ runner.os }}-modules-${{ hashFiles('**/yarn.lock') }}-in-${{ github.ref_name }}
48-
##############
49-
# Set BACKEND_URL env varibale this way, so not all variables have to be passed to the reusable workflow
50-
- name: Set production BE Url
51-
if: env.ENVIRONMENT_NAME == 'production'
52-
run: |
53-
echo "BACKEND_URL=${{ secrets.PRODUCTION_BE_URL }}" >> $GITHUB_ENV
54-
- name: Set staging BE Url
55-
if: env.ENVIRONMENT_NAME == 'staging'
56-
run: |
57-
echo "BACKEND_URL=${{ secrets.STAGING_BE_URL }}" >> $GITHUB_ENV
58-
59-
##############
60-
# Set MICROSOFT CLIENT_ID env variable this way, so not all variables have to be passed to the reusable workflow
61-
- name: Set production MICROSOFT CLIENT_ID
62-
if: env.ENVIRONMENT_NAME == 'production'
63-
run: |
64-
echo "MICROSOFT_CLIENT_ID=${{ secrets.PROD_MICROSOFT_CLIENT_ID }}" >> $GITHUB_ENV
65-
- name: Set staging MICROSOFT CLIENT_ID
66-
if: env.ENVIRONMENT_NAME == 'staging'
67-
run: |
68-
echo "MICROSOFT_CLIENT_ID=${{ secrets.STAGING_MICROSOFT_CLIENT_ID }}" >> $GITHUB_ENV
6953

7054
##############
7155
- name: Compile and build
7256
run: yarn clean && yarn compile && yarn build
7357
- name: Upload dist and lib
74-
uses: actions/upload-artifact@v3
58+
uses: actions/upload-artifact@v4
7559
with:
7660
name: dist-and-lib
7761
path: |

‎.github/workflows/reusable-deploy-job.yml

+15-27
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@ on:
1919
jobs:
2020
deploy:
2121
runs-on: ubuntu-latest
22+
environment: ${{ inputs.target }}
2223
name: deploy-job
2324
env:
2425
ALEXA_SKILL_STAGE: ${{ inputs.alexaSkillStage }}
@@ -30,6 +31,7 @@ jobs:
3031
AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
3132
AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
3233
MICROSOFT_TENANT_ID: ${{ secrets.MICROSOFT_TENANT_ID }}
34+
MICROSOFT_CLIENT_ID: ${{ secrets.MICROSOFT_CLIENT_ID }}
3335
LARA_SECRET: ${{ secrets.LARA_SECRET }}
3436
SES_EMAIL: ${{ secrets.SES_EMAIL }}
3537
SUPPORT_MAIL: ${{ secrets.SUPPORT_MAIL }}
@@ -40,52 +42,38 @@ jobs:
4042
AVATAR_URL: ${{ secrets.AVATAR_URL }}
4143
LARA_VERSION: ${{ github.ref_name }}
4244
SES_REGION: ${{ secrets.SES_REGION }}
45+
FRONTEND_URL: ${{ secrets.FRONTEND_URL }}
46+
BACKEND_URL: ${{ secrets.BACKEND_URL }}
4347

4448
steps:
4549
- uses: actions/checkout@v4
4650

47-
- uses: actions/setup-node@v3
51+
- uses: actions/setup-node@v4
4852
with:
49-
node-version: '18'
53+
node-version-file: '.nvmrc'
5054

51-
- uses: actions/cache@v3
55+
- uses: actions/cache@v4
5256
with:
5357
path: |
5458
node_modules
5559
packages/*/node_modules
5660
.yarn
5761
key: ${{ runner.os }}-modules-${{ hashFiles('**/yarn.lock') }}-in-${{ github.ref_name }}
62+
5863
- run: npm i -g serverless
5964

6065
- name: Download built dist and lib
61-
uses: actions/download-artifact@v3
66+
uses: actions/download-artifact@v4
6267
with:
6368
name: dist-and-lib
6469
path: packages
6570

66-
# Set FRONTEND_URL & BACKEND_URL env varibale this way, so not all variables have to be passed to the reusable workflow
67-
- name: Set production FE & BE Url
68-
if: inputs.target == 'production'
69-
run: |
70-
echo "FRONTEND_URL=${{ secrets.PRODUCTION_FE_URL }}" >> $GITHUB_ENV
71-
echo "BACKEND_URL=${{ secrets.PRODUCTION_BE_URL }}" >> $GITHUB_ENV
72-
73-
- name: Set staging FE & BE Url
74-
if: inputs.target == 'staging'
75-
run: |
76-
echo "FRONTEND_URL=${{ secrets.STAGING_FE_URL }}" >> $GITHUB_ENV
77-
echo "BACKEND_URL=${{ secrets.STAGING_BE_URL }}" >> $GITHUB_ENV
78-
79-
##############
80-
# Set MICROSOFT CLIENT_ID env variable this way, so not all variables have to be passed to the reusable workflow
81-
- name: Set production MICROSOFT CLIENT_ID
82-
if: env.ENVIRONMENT_NAME == 'production'
83-
run: |
84-
echo "MICROSOFT_CLIENT_ID=${{ secrets.PROD_MICROSOFT_CLIENT_ID }}" >> $GITHUB_ENV
85-
- name: Set staging MICROSOFT CLIENT_ID
86-
if: env.ENVIRONMENT_NAME == 'staging'
87-
run: |
88-
echo "MICROSOFT_CLIENT_ID=${{ secrets.STAGING_MICROSOFT_CLIENT_ID }}" >> $GITHUB_ENV
71+
- name: Configure AWS Credentials for China region audience
72+
uses: aws-actions/configure-aws-credentials@v4
73+
with:
74+
audience: sts.amazonaws.com.cn
75+
aws-region: eu-central-1
76+
role-to-assume: arn:aws-cn:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/github-deploy-user
8977

9078
- name: Deploy Frontend
9179
run: serverless s3sync bucket --bucket ${{ secrets.COMPANY_ABBREVIATION }}-lara-frontend-${{ inputs.target }}

‎.github/workflows/reusable-e2e-test-job.yml

+8-4
Original file line numberDiff line numberDiff line change
@@ -10,27 +10,31 @@ jobs:
1010
e2e:
1111
name: e2e-job
1212
runs-on: ubuntu-latest
13+
environment: staging
1314
container: mcr.microsoft.com/playwright:focal
1415
env:
1516
USER_ID: ${{ secrets.TEST_TRAINEE_ID }}
16-
URL: ${{ secrets.STAGING_FE_URL }}
17+
URL: ${{ secrets.FRONTEND_URL }}
1718
BASICAUTHENTICATION_USERNAME: ${{ secrets.BASICAUTHENTICATION_USERNAME }}
1819
BASICAUTHENTICATION_PASSWORD: ${{ secrets.BASICAUTHENTICATION_PASSWORD }}
1920
ENVIRONMENT_NAME: staging
2021
steps:
2122
- uses: actions/checkout@v4
22-
- uses: actions/cache@v3
23+
24+
- uses: actions/cache@v4
2325
with:
2426
path: |
25-
node_modules
27+
node_modules
2628
packages/*/node_modules
2729
.yarn
2830
key: ${{ runner.os }}-modules-${{ hashFiles('**/yarn.lock') }}-in-${{ github.ref_name }}
31+
2932
- name: Download built dist and lib
30-
uses: actions/download-artifact@v3
33+
uses: actions/download-artifact@v4
3134
with:
3235
name: dist-and-lib
3336
path: packages
37+
3438
- run: |
3539
cd packages/e2e
3640
unset NODE_OPTIONS

‎.github/workflows/reusable-install-job.yml

+5-3
Original file line numberDiff line numberDiff line change
@@ -12,10 +12,12 @@ jobs:
1212
runs-on: ubuntu-latest
1313
steps:
1414
- uses: actions/checkout@v4
15-
- uses: actions/setup-node@v3
15+
16+
- uses: actions/setup-node@v4
1617
with:
17-
node-version: '18'
18-
- uses: actions/cache@v3
18+
node-version-file: '.nvmrc'
19+
20+
- uses: actions/cache@v4
1921
with:
2022
path: |
2123
node_modules

‎.github/workflows/reusable-test-job.yml

+27-16
Original file line numberDiff line numberDiff line change
@@ -12,10 +12,12 @@ jobs:
1212
runs-on: ubuntu-latest
1313
steps:
1414
- uses: actions/checkout@v4
15-
- uses: actions/setup-node@v3
15+
16+
- uses: actions/setup-node@v4
1617
with:
17-
node-version: '18'
18-
- uses: actions/cache@v3
18+
node-version-file: '.nvmrc'
19+
20+
- uses: actions/cache@v4
1921
with:
2022
path: |
2123
node_modules
@@ -29,10 +31,12 @@ jobs:
2931
runs-on: ubuntu-latest
3032
steps:
3133
- uses: actions/checkout@v4
32-
- uses: actions/setup-node@v3
34+
35+
- uses: actions/setup-node@v4
3336
with:
34-
node-version: '18'
35-
- uses: actions/cache@v3
37+
node-version-file: '.nvmrc'
38+
39+
- uses: actions/cache@v4
3640
with:
3741
path: |
3842
node_modules
@@ -46,10 +50,12 @@ jobs:
4650
runs-on: ubuntu-latest
4751
steps:
4852
- uses: actions/checkout@v4
49-
- uses: actions/setup-node@v3
53+
54+
- uses: actions/setup-node@v4
5055
with:
51-
node-version: '18'
52-
- uses: actions/cache@v3
56+
node-version-file: '.nvmrc'
57+
58+
- uses: actions/cache@v4
5359
with:
5460
path: |
5561
node_modules
@@ -63,18 +69,21 @@ jobs:
6369
runs-on: ubuntu-latest
6470
steps:
6571
- uses: actions/checkout@v4
66-
- uses: actions/setup-node@v3
72+
73+
- uses: actions/setup-node@v4
6774
with:
68-
node-version: '18'
69-
- uses: actions/cache@v3
75+
node-version-file: '.nvmrc'
76+
77+
- uses: actions/cache@v4
7078
with:
7179
path: |
7280
node_modules
7381
packages/*/node_modules
7482
.yarn
7583
key: ${{ runner.os }}-modules-${{ hashFiles('**/yarn.lock') }}-in-${{ github.ref_name }}
84+
7685
- name: Download built dist and lib
77-
uses: actions/download-artifact@v3
86+
uses: actions/download-artifact@v4
7887
with:
7988
name: dist-and-lib
8089
path: packages
@@ -85,10 +94,12 @@ jobs:
8594
runs-on: ubuntu-latest
8695
steps:
8796
- uses: actions/checkout@v4
88-
- uses: actions/setup-node@v3
97+
98+
- uses: actions/setup-node@v4
8999
with:
90-
node-version: '18'
91-
- uses: actions/cache@v3
100+
node-version-file: '.nvmrc'
101+
102+
- uses: actions/cache@v4
92103
with:
93104
path: |
94105
node_modules

‎packages/authorizer/src/handler.ts

+6-2
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,10 @@
1-
import { APIGatewayAuthorizerHandler, CustomAuthorizerResult } from 'aws-lambda'
1+
import { APIGatewayAuthorizerHandler, CustomAuthorizerResult, StatementEffect } from 'aws-lambda'
22

3-
const generatePolicy = (principalId: string, effect: string, resource: string): CustomAuthorizerResult | undefined => {
3+
const generatePolicy = (
4+
principalId: string,
5+
effect: StatementEffect,
6+
resource: string
7+
): CustomAuthorizerResult | undefined => {
48
if (!effect || !resource) {
59
return
610
}

0 commit comments

Comments
 (0)