Skip to content

Commit d62d3b9

Browse files
imlachimlach
authored
Merge pull request #1 from fac/add-repository-skeleton
Add initial Dockerfile and skeleton for ssosync lambda
2 parents a871f4d + bd2d784 commit d62d3b9

File tree

6 files changed

+176
-0
lines changed

6 files changed

+176
-0
lines changed

‎.github/workflows/check-build.yml‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
name: Confirm successful image build
2+
on:
3+
pull_request:
4+
branches-ignore:
5+
- master
6+
jobs:
7+
build:
8+
runs-on: ubuntu-latest
9+
10+
steps:
11+
- uses: actions/checkout@v1
12+
13+
- name: Configure AWS Credentials
14+
uses: aws-actions/configure-aws-credentials@v1-node16
15+
with:
16+
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
17+
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
18+
aws-region: eu-west-1
19+
role-to-assume: arn:aws:iam::486229364833:role/allow_ecr_push_pull_access
20+
role-duration-seconds: 1200
21+
22+
23+
- name: Login to Amazon ECR
24+
id: login-ecr
25+
uses: aws-actions/amazon-ecr-login@v1
26+
27+
- name: Build
28+
env:
29+
ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
30+
ECR_REPOSITORY: ssosync
31+
IMAGE_TAG: ${{ github.sha }}
32+
run: |
33+
docker build -t "${ECR_REGISTRY}/${ECR_REPOSITORY}:${IMAGE_TAG}" -t "${ECR_REGISTRY}/${ECR_REPOSITORY}:latest" .
34+
docker push "${ECR_REGISTRY}/${ECR_REPOSITORY}:${IMAGE_TAG}"
35+
docker push "${ECR_REGISTRY}/${ECR_REPOSITORY}:latest"
36+
- name: Logout of Amazon ECR
37+
if: always()
38+
run: docker logout ${{ steps.login-ecr.outputs.registry }}

‎.github/workflows/linter.yml‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
---
2+
###########################
3+
###########################
4+
## Linter GitHub Actions ##
5+
###########################
6+
###########################
7+
name: Lint Code Base
8+
9+
#
10+
# Documentation:
11+
# https://help.github.com/en/articles/workflow-syntax-for-github-actions
12+
#
13+
14+
#############################
15+
# Start the job on all push #
16+
#############################
17+
on:
18+
push:
19+
branches-ignore: [master]
20+
# Remove the line above to run when pushing to master
21+
22+
###############
23+
# Set the Job #
24+
###############
25+
jobs:
26+
build:
27+
# Name the Job
28+
name: Lint Code Base
29+
# Set the agent to run on
30+
runs-on: ubuntu-latest
31+
32+
##################
33+
# Load all steps #
34+
##################
35+
steps:
36+
##########################
37+
# Checkout the code base #
38+
##########################
39+
- name: Checkout Code
40+
uses: actions/checkout@v2
41+
with:
42+
# Full git history is needed to get a proper list of changed files within `super-linter`
43+
fetch-depth: 0
44+
45+
################################
46+
# Run Linter against code base #
47+
################################
48+
- name: Lint Code Base
49+
uses: docker://ghcr.io/github/super-linter:slim-v4
50+
env:
51+
VALIDATE_ALL_CODEBASE: false
52+
DEFAULT_BRANCH: master
53+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

‎.github/workflows/main.yml‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
name: Build and push SSOSync image to ECR
2+
on:
3+
push:
4+
branches:
5+
- master
6+
7+
jobs:
8+
build:
9+
runs-on: ubuntu-latest
10+
11+
steps:
12+
- uses: actions/checkout@v1
13+
14+
- name: Configure AWS Credentials
15+
uses: aws-actions/configure-aws-credentials@v1-node16
16+
with:
17+
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
18+
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
19+
aws-region: eu-west-1
20+
role-to-assume: arn:aws:iam::486229364833:role/allow_ecr_push_pull_access
21+
role-duration-seconds: 1200
22+
23+
24+
- name: Login to Amazon ECR
25+
id: login-ecr
26+
uses: aws-actions/amazon-ecr-login@v1
27+
28+
- name: Build, tag, and push image to Amazon ECR
29+
env:
30+
ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
31+
ECR_REPOSITORY: ssosync
32+
IMAGE_TAG: ${{ github.sha }}
33+
run: |
34+
docker build -t "${ECR_REGISTRY}/${ECR_REPOSITORY}:${IMAGE_TAG}" -t "${ECR_REGISTRY}/${ECR_REPOSITORY}:latest" .
35+
docker push "${ECR_REGISTRY}/${ECR_REPOSITORY}:${IMAGE_TAG}"
36+
docker push "${ECR_REGISTRY}/${ECR_REPOSITORY}:latest"
37+
- name: Logout of Amazon ECR
38+
if: always()
39+
run: docker logout ${{ steps.login-ecr.outputs.registry }}
40+

‎.github/workflows/reviewdog.yml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
name: reviewdog
2+
on: [pull_request]
3+
jobs:
4+
actionlint:
5+
name: runner / actionlint
6+
runs-on: ubuntu-latest
7+
steps:
8+
- uses: actions/checkout@v2
9+
- name: actionlint
10+
uses: reviewdog/action-actionlint@v1.22.0
11+
with:
12+
fail_on_error: true
13+
reporter: github-pr-review

‎Dockerfile‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
FROM alpine:3.17.2
2+
3+
ARG SSOSYNC_VERSION=v2.0.2
4+
5+
# Install awscli and jq
6+
RUN apk add --no-cache aws-cli=1.25.97-r0 jq=1.6-r2 && \
7+
rm -rf /var/cache/apk/
8+
9+
# Download SSOSync binary
10+
RUN mkdir -p downloads && \
11+
wget -q https://github.com/awslabs/ssosync/releases/download/${SSOSYNC_VERSION}/ssosync_Linux_x86_64.tar.gz -P downloads/ && \
12+
tar xzvf downloads/ssosync_Linux_x86_64.tar.gz -C downloads/ && \
13+
mv downloads/ssosync /usr/local/bin/ && \
14+
rm -rf downloads
15+
16+
# Copy over custom scripts and ensure scripts are exectutable
17+
COPY bin/* /usr/local/bin/
18+
RUN chmod +x /usr/local/bin/*
19+
20+
21+
ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]

‎bin/entrypoint.sh‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
#!/bin/sh
2+
# shellcheck shell=sh
3+
# https://github.com/koalaman/shellcheck/wiki/SC1008
4+
set -e
5+
6+
# Load Google secrets at runtime.
7+
# Stored with the command `aws secretsmanager create-secret --name "ops/ssosync/googlecredentials" --secret-binary $(base64 -i credentials.json)`
8+
aws secretsmanager get-secret-value --region "eu-west-1" --secret-id "ops/ssosync/googlecredentials" --output "json" | jq -r ".SecretBinary" | base64 -d > credentials.json
9+
10+
# Run SSO Sync, the rest of the config is pulled in through environment variables.
11+
/usr/local/bin/ssosync

0 commit comments

Comments
 (0)