Skip to content

Commit 86d16dd

Browse files
chrisnschrisns
authored
Merge pull request #395 from co-cddo/chore/role-chaining
fix(ci-lease): role-chaining=true on lease-account assume
2 parents 98cd41e + de62f83 commit 86d16dd

16 files changed

Lines changed: 395 additions & 1 deletion

‎.github/workflows/scenario-ai-contact-centre.yml‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
name: Scenario / ai-contact-centre
2+
3+
on:
4+
pull_request:
5+
paths:
6+
- 'cloudformation/scenarios/ai-contact-centre/**'
7+
- '.github/workflows/scenario-ci.yml'
8+
- '.github/workflows/scenario-ai-contact-centre.yml'
9+
- 'scripts/isb/**'
10+
- 'tests/smoke/**'
11+
workflow_dispatch:
12+
13+
concurrency:
14+
group: scenario-ai-contact-centre-${{ github.ref }}
15+
cancel-in-progress: true
16+
17+
permissions:
18+
id-token: write
19+
contents: read
20+
21+
jobs:
22+
smoke:
23+
uses: ./.github/workflows/scenario-ci.yml
24+
with:
25+
scenario: ai-contact-centre
26+
secrets: inherit

‎.github/workflows/scenario-bops-planning.yml‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
name: Scenario / bops-planning
2+
3+
on:
4+
pull_request:
5+
paths:
6+
- 'cloudformation/scenarios/bops-planning/**'
7+
- '.github/workflows/scenario-ci.yml'
8+
- '.github/workflows/scenario-bops-planning.yml'
9+
- 'scripts/isb/**'
10+
- 'tests/smoke/**'
11+
workflow_dispatch:
12+
13+
concurrency:
14+
group: scenario-bops-planning-${{ github.ref }}
15+
cancel-in-progress: true
16+
17+
permissions:
18+
id-token: write
19+
contents: read
20+
21+
jobs:
22+
smoke:
23+
uses: ./.github/workflows/scenario-ci.yml
24+
with:
25+
scenario: bops-planning
26+
secrets: inherit

‎.github/workflows/scenario-ci.yml‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -91,14 +91,18 @@ jobs:
9191
--template '${{ inputs.lease_template }}' \
9292
--user-email '${{ inputs.ci_lease_email }}'
9393
94-
# Now assume the in-lease CIDeployRole using the account_id we just got.
94+
# Now assume the in-lease CIDeployRole. role-chaining=true tells
95+
# configure-aws-credentials to sigv4-sign from the already-loaded
96+
# hub creds (sts:AssumeRole) instead of trying OIDC against the
97+
# leased account (which has no OIDC provider).
9598
- uses: aws-actions/configure-aws-credentials@v6
9699
id: lease-creds
97100
with:
98101
role-to-assume: arn:aws:iam::${{ steps.lease.outputs.account_id }}:role/InnovationSandbox-ndx-CIDeployRole
99102
role-session-name: scenario-ci-deploy-${{ github.run_id }}
100103
aws-region: us-east-1
101104
role-duration-seconds: 21600
105+
role-chaining: true
102106

103107
- name: Deploy scenario stack
104108
id: deploy

‎.github/workflows/scenario-digital-planning-register.yml‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
name: Scenario / digital-planning-register
2+
3+
on:
4+
pull_request:
5+
paths:
6+
- 'cloudformation/scenarios/digital-planning-register/**'
7+
- '.github/workflows/scenario-ci.yml'
8+
- '.github/workflows/scenario-digital-planning-register.yml'
9+
- 'scripts/isb/**'
10+
- 'tests/smoke/**'
11+
workflow_dispatch:
12+
13+
concurrency:
14+
group: scenario-digital-planning-register-${{ github.ref }}
15+
cancel-in-progress: true
16+
17+
permissions:
18+
id-token: write
19+
contents: read
20+
21+
jobs:
22+
smoke:
23+
uses: ./.github/workflows/scenario-ci.yml
24+
with:
25+
scenario: digital-planning-register
26+
secrets: inherit

‎.github/workflows/scenario-fixmystreet.yml‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
name: Scenario / fixmystreet
2+
3+
on:
4+
pull_request:
5+
paths:
6+
- 'cloudformation/scenarios/fixmystreet/**'
7+
- '.github/workflows/scenario-ci.yml'
8+
- '.github/workflows/scenario-fixmystreet.yml'
9+
- 'scripts/isb/**'
10+
- 'tests/smoke/**'
11+
workflow_dispatch:
12+
13+
concurrency:
14+
group: scenario-fixmystreet-${{ github.ref }}
15+
cancel-in-progress: true
16+
17+
permissions:
18+
id-token: write
19+
contents: read
20+
21+
jobs:
22+
smoke:
23+
uses: ./.github/workflows/scenario-ci.yml
24+
with:
25+
scenario: fixmystreet
26+
secrets: inherit

‎.github/workflows/scenario-foi-redaction.yml‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
name: Scenario / foi-redaction
2+
3+
on:
4+
pull_request:
5+
paths:
6+
- 'cloudformation/scenarios/foi-redaction/**'
7+
- '.github/workflows/scenario-ci.yml'
8+
- '.github/workflows/scenario-foi-redaction.yml'
9+
- 'scripts/isb/**'
10+
- 'tests/smoke/**'
11+
workflow_dispatch:
12+
13+
concurrency:
14+
group: scenario-foi-redaction-${{ github.ref }}
15+
cancel-in-progress: true
16+
17+
permissions:
18+
id-token: write
19+
contents: read
20+
21+
jobs:
22+
smoke:
23+
uses: ./.github/workflows/scenario-ci.yml
24+
with:
25+
scenario: foi-redaction
26+
secrets: inherit

‎.github/workflows/scenario-localgov-drupal.yml‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
name: Scenario / localgov-drupal
2+
3+
on:
4+
pull_request:
5+
paths:
6+
- 'cloudformation/scenarios/localgov-drupal/**'
7+
- '.github/workflows/scenario-ci.yml'
8+
- '.github/workflows/scenario-localgov-drupal.yml'
9+
- 'scripts/isb/**'
10+
- 'tests/smoke/**'
11+
workflow_dispatch:
12+
13+
concurrency:
14+
group: scenario-localgov-drupal-${{ github.ref }}
15+
cancel-in-progress: true
16+
17+
permissions:
18+
id-token: write
19+
contents: read
20+
21+
jobs:
22+
smoke:
23+
uses: ./.github/workflows/scenario-ci.yml
24+
with:
25+
scenario: localgov-drupal
26+
secrets: inherit

‎.github/workflows/scenario-localgov-ims.yml‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
name: Scenario / localgov-ims
2+
3+
on:
4+
pull_request:
5+
paths:
6+
- 'cloudformation/scenarios/localgov-ims/**'
7+
- '.github/workflows/scenario-ci.yml'
8+
- '.github/workflows/scenario-localgov-ims.yml'
9+
- 'scripts/isb/**'
10+
- 'tests/smoke/**'
11+
workflow_dispatch:
12+
13+
concurrency:
14+
group: scenario-localgov-ims-${{ github.ref }}
15+
cancel-in-progress: true
16+
17+
permissions:
18+
id-token: write
19+
contents: read
20+
21+
jobs:
22+
smoke:
23+
uses: ./.github/workflows/scenario-ci.yml
24+
with:
25+
scenario: localgov-ims
26+
secrets: inherit

‎.github/workflows/scenario-minute.yml‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
name: Scenario / minute
2+
3+
on:
4+
pull_request:
5+
paths:
6+
- 'cloudformation/scenarios/minute/**'
7+
- '.github/workflows/scenario-ci.yml'
8+
- '.github/workflows/scenario-minute.yml'
9+
- 'scripts/isb/**'
10+
- 'tests/smoke/**'
11+
workflow_dispatch:
12+
13+
concurrency:
14+
group: scenario-minute-${{ github.ref }}
15+
cancel-in-progress: true
16+
17+
permissions:
18+
id-token: write
19+
contents: read
20+
21+
jobs:
22+
smoke:
23+
uses: ./.github/workflows/scenario-ci.yml
24+
with:
25+
scenario: minute
26+
secrets: inherit

‎.github/workflows/scenario-paperless-ngx.yml‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
name: Scenario / paperless-ngx
2+
3+
on:
4+
pull_request:
5+
paths:
6+
- 'cloudformation/scenarios/paperless-ngx/**'
7+
- '.github/workflows/scenario-ci.yml'
8+
- '.github/workflows/scenario-paperless-ngx.yml'
9+
- 'scripts/isb/**'
10+
- 'tests/smoke/**'
11+
workflow_dispatch:
12+
13+
concurrency:
14+
group: scenario-paperless-ngx-${{ github.ref }}
15+
cancel-in-progress: true
16+
17+
permissions:
18+
id-token: write
19+
contents: read
20+
21+
jobs:
22+
smoke:
23+
uses: ./.github/workflows/scenario-ci.yml
24+
with:
25+
scenario: paperless-ngx
26+
secrets: inherit

0 commit comments

Comments
 (0)