Skip to content

Plfm 9092 #1467

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
brucehoff merged 25 commits into from
Sep 17, 2025
Merged

Plfm 9092 #1467

Changes from all commits
Commits
Show all changes
25 commits
Select commit Hold shift + click to select a range
c55cf2d
Run nessus script installation daily, not hourly
brucehoff Nov 7, 2024
da1dfef
Merge branch 'master' of https://github.com/Sage-Bionetworks-IT/organ…
brucehoff Nov 14, 2024
5b04ff6
Merge branch 'master' of https://github.com/Sage-Bionetworks-IT/organ…
brucehoff Nov 16, 2024
3b977ee
Merge branch 'master' of https://github.com/Sage-Bionetworks-IT/organ…
brucehoff Dec 18, 2024
7eba7ec
Merge branch 'master' of https://github.com/Sage-Bionetworks-IT/organ…
brucehoff Dec 19, 2024
2a39c53
Merge branch 'master' of https://github.com/Sage-Bionetworks-IT/organ…
brucehoff Jan 9, 2025
ddc45d7
Merge branch 'master' of https://github.com/Sage-Bionetworks-IT/organ…
brucehoff Jan 16, 2025
dedce36
Merge branch 'master' of https://github.com/Sage-Bionetworks-IT/organ…
brucehoff Jan 25, 2025
81c6261
Merge branch 'master' of https://github.com/Sage-Bionetworks-IT/organ…
brucehoff Mar 8, 2025
0bb1257
Merge branch 'master' of https://github.com/Sage-Bionetworks-IT/organ…
brucehoff Apr 5, 2025
e3e4379
Merge branch 'master' of https://github.com/Sage-Bionetworks-IT/organ…
brucehoff Apr 24, 2025
ef16296
Merge branch 'master' of https://github.com/Sage-Bionetworks-IT/organ…
brucehoff May 8, 2025
e968c04
Merge branch 'master' of https://github.com/Sage-Bionetworks-IT/organ…
brucehoff May 15, 2025
2425330
Merge branch 'master' of https://github.com/Sage-Bionetworks-IT/organ…
brucehoff Jun 5, 2025
88f9cc9
Merge branch 'master' of https://github.com/Sage-Bionetworks-IT/organ…
brucehoff Jul 1, 2025
6b52705
Merge remote-tracking branch 'upstream/master'
brucehoff Jul 9, 2025
89fad2d
Merge branch 'master' of https://github.com/Sage-Bionetworks-IT/organ…
brucehoff Jul 9, 2025
73fcb5c
Merge branch 'master' of https://github.com/Sage-Bionetworks-IT/organ…
brucehoff Jul 11, 2025
43f17dc
Merge branch 'master' of https://github.com/Sage-Bionetworks-IT/organ…
brucehoff Jul 28, 2025
c2f44d1
Merge branch 'master' of https://github.com/Sage-Bionetworks-IT/organ…
brucehoff Aug 13, 2025
c35cf31
Merge branch 'master' of https://github.com/Sage-Bionetworks-IT/organ…
brucehoff Aug 25, 2025
1ee5012
Merge branch 'master' of https://github.com/Sage-Bionetworks-IT/organ…
brucehoff Aug 25, 2025
f36f051
Merge branch 'master' of https://github.com/Sage-Bionetworks-IT/organ…
brucehoff Aug 26, 2025
5f185ef
Merge branch 'master' of https://github.com/Sage-Bionetworks-IT/organ…
brucehoff Sep 16, 2025
f81ef23
PLFM-9092: OIDC integration allowing developer forks of Synapse repo …
brucehoff Sep 16, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
38 changes: 38 additions & 0 deletions org-formation/650-identity-providers/_tasks.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -166,6 +166,44 @@ GithubOidcSageBionetworksSynapse:
- !Ref SynapseProdAccount
Region: us-east-1

GithubOidcSageBionetworksSynapseBuild:
Type: update-stacks
DependsOn: GithubOidcSageBionetworks
Template: https://raw.githubusercontent.com/Sage-Bionetworks/aws-infra/v0.10.4/templates/IAM/github-oidc-provider.j2
StackName: !Sub ${resourcePrefix}-${appName}-sage-bionetworks-synapse-build
Parameters:
ProviderArn: !CopyValue [ !Sub '${resourcePrefix}-${appName}-ProviderArn' ]
ProviderRoleName: !Sub ${resourcePrefix}-${appName}-sage-bionetworks-synapse-build
ManagedPolicyArns:
- "arn:aws:iam::aws:policy/AdministratorAccess"
TemplatingContext:
Repositories:
- owner: "Sage-Bionetworks"
name: "Synapse-Repository-Services"
branches: ["*"]
- owner: "brucehoff"
Copy link
Member

@ConsoleCatzirl ConsoleCatzirl Sep 17, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do developers need to deploy from their forks? Could each developer have a branch on the origin repo instead?

Also, I don't know much about the platform build process, but if these are all deploying to the same EC2 then I worry about developers breaking the build with parallel deploys, or one failed build blocking all other developers.

Copy link
Contributor Author

@brucehoff brucehoff Sep 17, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@ConsoleCatzirl Great questions. The goal is NOT to deploy infrastructure (though there are AWS elements deployed along the way) but rather to run a build in AWS CodePipeline. I.e. the GitHub workflow-based builds, run in developer's forks prior to opening a PR, will be run in CodePipeline instead of on the old Jenkins server. With that understanding here are the answers to your questions:

Do developers need to deploy from their forks?

Developers will we running builds on their forks prior to creating pull requests. To do this, the GitHub workflow needs to create a CodePipeline and also to run a private copy of the Synapse back end, using the Synapse Stack Builder. So developers will be "deploying from their forks" only those AWS elements needed to run their builds.

Could each developer have a branch on the origin repo instead?

The use is for running builds prior to creating a PR or merging into the origin (upstream ) repo'.

if these are all deploying to the same EC2...

Each of the parallel builds will use private/dedicated AWS elements (a dedicated CodePipeline and a dedicated copy of the Synapse back end). Using dedicated copies of the Synapse back end is the team's approach to running builds today.

Copy link
Member

@ConsoleCatzirl ConsoleCatzirl Sep 17, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ah, thanks, this makes a lot more sense knowing that it's running a build in CodePipeline.

name: "Synapse-Repository-Services"
branches: ["*"]
- owner: "SandhraSokhal"
name: "Synapse-Repository-Services"
branches: ["*"]
- owner: "marcomarasca"
name: "Synapse-Repository-Services"
branches: ["*"]
- owner: "john-hill"
name: "Synapse-Repository-Services"
branches: ["*"]
- owner: "xschildw"
name: "Synapse-Repository-Services"
branches: ["*"]
- owner: "nickgros"
name: "Synapse-Repository-Services"
branches: ["*"]
DefaultOrganizationBinding:
Account:
- !Ref SynapseDevAccount
Region: us-east-1

GithubOidcSageBionetworksSynapseOpsDev:
Type: update-stacks
DependsOn: GithubOidcSageBionetworks
Expand Down