From 4b70c872100f3015770f733a38f595fb09dc9cd6 Mon Sep 17 00:00:00 2001
From: Luca Comellini <luca.com@gmail.com>
Date: Fri, 7 Apr 2023 15:20:15 -0700
Subject: [PATCH] Use OIDC to login to AWS

---
 .github/workflows/build-oss.yml  | 48 +++++++++++++++++++-------------
 .github/workflows/build-plus.yml | 12 ++++++--
 2 files changed, 38 insertions(+), 22 deletions(-)

diff --git a/.github/workflows/build-oss.yml b/.github/workflows/build-oss.yml
index abd6527c98..627019470b 100644
--- a/.github/workflows/build-oss.yml
+++ b/.github/workflows/build-oss.yml
@@ -23,6 +23,11 @@ defaults:
 jobs:
   build:
     runs-on: ubuntu-22.04
+    permissions:
+      contents: read # for docker/build-push-action to read repo content
+      security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
+      id-token: write # for OIDC login to AWS ECR
+      packages: write # for docker/build-push-action to push to GHCR
     outputs:
       version: ${{ steps.meta.outputs.version }}
       image_digest: ${{ steps.build-push.outputs.digest }}
@@ -63,12 +68,17 @@ jobs:
           password: ${{ secrets.GITHUB_TOKEN }}
         if: github.event_name != 'pull_request'
 
+      - name: Configure AWS Credentials
+        uses: aws-actions/configure-aws-credentials@e1e17a757e536f70e52b5a12b2e8d1d1c60e04ef # v2.0.0
+        with:
+          aws-region: us-east-1
+          role-to-assume: ${{ secrets.AWS_ROLE_PUBLIC_ECR }}
+        if: github.event_name != 'pull_request'
+
       - name: Login to Public ECR
         uses: docker/login-action@f4ef78c080cd8ba55a85445d5b36e214a81df20a # v2.1.0
         with:
           registry: public.ecr.aws
-          username: ${{ secrets.AWS_ACCESS_KEY_ID }}
-          password: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
         if: github.event_name != 'pull_request'
 
       - name: Login to Quay.io
@@ -123,7 +133,7 @@ jobs:
         id: build-push
         with:
           file: build/Dockerfile
-          context: '.'
+          context: "."
           cache-from: type=gha,scope=${{ inputs.image }}
           cache-to: type=gha,scope=${{ inputs.image }},mode=max
           target: goreleaser
@@ -145,32 +155,32 @@ jobs:
         continue-on-error: true
         with:
           image-ref: nginx/nginx-ingress:${{ steps.meta.outputs.version }}
-          format: 'sarif'
-          output: 'trivy-results-${{ inputs.image }}.sarif'
-          ignore-unfixed: 'true'
+          format: "sarif"
+          output: "trivy-results-${{ inputs.image }}.sarif"
+          ignore-unfixed: "true"
 
       - name: Upload Trivy scan results to GitHub Security tab
         uses: github/codeql-action/upload-sarif@d186a2a36cc67bfa1b860e6170d37fb9634742c7 # v2.2.11
         continue-on-error: true
         with:
-          sarif_file: 'trivy-results-${{ inputs.image }}.sarif'
+          sarif_file: "trivy-results-${{ inputs.image }}.sarif"
 
       - name: Upload Scan Results
         uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v3.1.2
         continue-on-error: true
         with:
-          name: 'trivy-results-${{ inputs.image }}.sarif'
-          path: 'trivy-results-${{ inputs.image }}.sarif'
+          name: "trivy-results-${{ inputs.image }}.sarif"
+          path: "trivy-results-${{ inputs.image }}.sarif"
         if: always()
 
   send-notification:
-        name: Send Notification
-        needs: build
-        uses: ./.github/workflows/updates-notification.yml
-        with:
-          sha_long: ${{ inputs.sha_long }}
-          tag: ${{ inputs.tag }}
-          version: ${{ needs.build.outputs.version }}
-          image_digest: ${{ needs.build.outputs.image_digest }}
-        secrets: inherit
-        if: ${{ inputs.tag != '' }}
+    name: Send Notification
+    needs: build
+    uses: ./.github/workflows/updates-notification.yml
+    with:
+      sha_long: ${{ inputs.sha_long }}
+      tag: ${{ inputs.tag }}
+      version: ${{ needs.build.outputs.version }}
+      image_digest: ${{ needs.build.outputs.image_digest }}
+    secrets: inherit
+    if: ${{ inputs.tag != '' }}
diff --git a/.github/workflows/build-plus.yml b/.github/workflows/build-plus.yml
index a5b5f6d98b..1eed6bf527 100644
--- a/.github/workflows/build-plus.yml
+++ b/.github/workflows/build-plus.yml
@@ -28,6 +28,7 @@ jobs:
       permissions:
         contents: read  # for docker/build-push-action to read repo content
         security-events: write  # for github/codeql-action/upload-sarif to upload SARIF results
+        id-token: write # for OIDC login to AWS
       runs-on: ubuntu-22.04
       steps:
       - name: Checkout Repository
@@ -58,13 +59,18 @@ jobs:
           password: ${{ secrets.GCR_JSON_KEY }}
         if: github.event_name != 'pull_request'
 
+      - name: Configure AWS Credentials
+        uses: aws-actions/configure-aws-credentials@e1e17a757e536f70e52b5a12b2e8d1d1c60e04ef # v2.0.0
+        with:
+          aws-region: us-east-1
+          role-to-assume: ${{ secrets.AWS_ROLE_MARKETPLACE }}
+        if: startsWith(github.ref, 'refs/tags/') && contains(inputs.target, 'aws')
+
       - name: Login to ECR
         uses: docker/login-action@f4ef78c080cd8ba55a85445d5b36e214a81df20a # v2.1.0
         with:
           registry: 709825985650.dkr.ecr.us-east-1.amazonaws.com
-          username: ${{ secrets.AWS_ACCESS_KEY_ID }}
-          password: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-        if: startsWith(github.ref, 'refs/tags/')
+        if: startsWith(github.ref, 'refs/tags/') && contains(inputs.target, 'aws')
 
       - name: Docker meta
         id: meta