Add GitHub OIDC authentication for review app deployments by whi-tw · Pull Request #1958 · govuk-forms/forms-deploy

whi-tw · 2026-01-22T10:55:55Z

What problem does this pull request solve?

Trello card: https://trello.com/c/UIEQ97bl/792-stop-using-self-hosted-runners-on-github

Add GitHub Actions OIDC identity provider in the integration account and create per-repository IAM roles for forms-admin, forms-runner, and forms-product-page. These roles allow GitHub-hosted runners to authenticate to AWS and deploy review apps.

The IAM roles are scoped to pull_request events only and have permissions limited to the resources needed for review app deployments (ECS services, task definitions, ECR, S3 state files, and application autoscaling).

The old codebuild-hosted-runner configuration is still in place for the transition. Once the app repos have been updated and this has been verified working, we can then remove the codebuild parts and just use public runners.

EDIT: switched over to allowing github to trigger a codebuild project, and having codebuild do the terraform stuff. This gives a better permission boundary and limits bad actors' ability do do stuff.

Kept both implementations as separate commits for comparison.

Things to consider when reviewing

Ensure that you consider the wider context.
Does it work when run on your machine?
Is it clear what the code is doing?
Do the commit messages explain why the changes were made?
Are there all the unit tests needed?
Has all relevant documentation been updated?

Reminders

If you've made changes to the deployer role (files in modules/deployer-access):

Remember to run make <environment> forms/account apply on the relevant environments (dev, staging, user-research, and/or prod)
Check the #govuk-forms-deployment-notifications Slack channel to ensure the apply-forms-terraform-<environment> pipelines have run successfully

Copilot

Pull request overview

This PR adds GitHub Actions OIDC authentication to enable GitHub-hosted runners to deploy review apps in the integration environment. It creates an OIDC identity provider in AWS and configures per-repository IAM roles for forms-admin, forms-runner, and forms-product-page with permissions scoped specifically to review app deployments via pull_request events.

Changes:

Added GitHub OIDC provider configuration in the integration account
Created IAM roles for GitHub Actions workflows with permissions for ECS, ECR, S3, and autoscaling
Added outputs to expose the OIDC provider ARN and GitHub Actions role ARNs

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

File	Description
infra/deployments/integration/account/github-auth.tf	Creates the GitHub OIDC provider for authentication
infra/deployments/integration/account/outputs.tf	Exports the GitHub OIDC provider ARN for use by review deployment
infra/deployments/integration/review/github_actions_oidc.tf	Defines IAM roles and policies for GitHub Actions to deploy review apps
infra/deployments/integration/review/outputs.tf	Exports the GitHub Actions role ARNs

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot

Pull request overview

Copilot reviewed 10 out of 10 changed files in this pull request and generated 3 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot

Pull request overview

Copilot reviewed 10 out of 10 changed files in this pull request and generated 3 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

sarahseewhy

Looks grand! Thanks for the detailed commit descriptions, that was helpful.

Copilot

Pull request overview

Copilot reviewed 10 out of 10 changed files in this pull request and generated 3 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot

Pull request overview

Copilot reviewed 10 out of 10 changed files in this pull request and generated 1 comment.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot

Pull request overview

Copilot reviewed 12 out of 12 changed files in this pull request and generated 5 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot

Pull request overview

Copilot reviewed 12 out of 12 changed files in this pull request and generated 2 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot

Pull request overview

Copilot reviewed 12 out of 12 changed files in this pull request and generated 3 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Add GitHub Actions OIDC identity provider in the integration account.

Instead of giving GitHub Actions direct access to deploy review apps to ECS, we set up CodeBuild projects that GitHub Actions can trigger via OIDC. This reduces the permissions granted to GitHub Actions, as they no longer need direct access to ECS, ECR, and other resources. The configuration for self-hosted runners will be removed in a future PR once we're confident the new setup is working correctly.

These will be called from the application repositories' PR workflows. It's easier to maintain these in one place in the deploy repo, since they contain a lot of AWS-specific logic that is common across all applications.

Copilot

Pull request overview

Copilot reviewed 12 out of 12 changed files in this pull request and generated 2 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot AI review requested due to automatic review settings January 22, 2026 10:55

github-actions Bot requested review from cadmiumcat and sarahseewhy January 22, 2026 10:56

Copilot started reviewing on behalf of whi-tw January 22, 2026 10:56 View session

This was referenced Jan 22, 2026

Stop using Codebuild review-apps runner govuk-forms/forms-runner#1853

Closed

Use AWS credentials to deploy review apps govuk-forms/forms-runner#1854

Merged

Copilot AI reviewed Jan 22, 2026

View reviewed changes

Comment thread infra/deployments/integration/account/github-auth.tf

Comment thread infra/deployments/integration/review/github_actions_oidc.tf Outdated

whi-tw force-pushed the whi-tw/allow-github-hosted-runner-deploy-review-apps branch from e120964 to 7d50b62 Compare January 22, 2026 11:14

Copilot AI review requested due to automatic review settings January 22, 2026 11:17

whi-tw force-pushed the whi-tw/allow-github-hosted-runner-deploy-review-apps branch from 7d50b62 to 5928f55 Compare January 22, 2026 11:17

Copilot started reviewing on behalf of whi-tw January 22, 2026 11:17 View session

whi-tw mentioned this pull request Jan 22, 2026

Use AWS credentials to deploy review apps govuk-forms/forms-admin#2507

Merged

Copilot AI reviewed Jan 22, 2026

View reviewed changes

whi-tw mentioned this pull request Jan 22, 2026

Use AWS credentials to deploy review apps govuk-forms/forms-product-page#1030

Merged

whi-tw force-pushed the whi-tw/allow-github-hosted-runner-deploy-review-apps branch from 5928f55 to 039a9ad Compare January 22, 2026 11:54

theseanything reviewed Jan 22, 2026

View reviewed changes

Comment thread infra/deployments/integration/review/github_actions_oidc.tf Outdated

whi-tw requested review from Copilot and theseanything January 23, 2026 10:06

whi-tw force-pushed the whi-tw/allow-github-hosted-runner-deploy-review-apps branch from 039a9ad to 7c4ad50 Compare January 23, 2026 11:46

Copilot started reviewing on behalf of whi-tw January 23, 2026 11:47 View session

Copilot AI reviewed Jan 23, 2026

View reviewed changes

Comment thread infra/deployments/integration/review/github_actions_oidc.tf Outdated

Comment thread infra/deployments/integration/review/review-app-codebuild/inputs.tf Outdated

Comment thread infra/deployments/integration/review/review-app-codebuild/main.tf

whi-tw force-pushed the whi-tw/allow-github-hosted-runner-deploy-review-apps branch 2 times, most recently from 3d65d7b to f8f2138 Compare January 23, 2026 15:57

Copilot AI review requested due to automatic review settings January 23, 2026 15:57

Copilot started reviewing on behalf of whi-tw January 23, 2026 15:57 View session

Copilot AI reviewed Jan 23, 2026

View reviewed changes

Comment thread infra/deployments/integration/review/review-app-codebuild/main.tf

Comment thread infra/deployments/integration/review/github_actions_codebuild.tf

Comment thread infra/deployments/integration/review/github_actions_codebuild.tf

whi-tw force-pushed the whi-tw/allow-github-hosted-runner-deploy-review-apps branch from f8f2138 to cff1352 Compare January 23, 2026 16:29

sarahseewhy reviewed Mar 2, 2026

View reviewed changes

Comment thread infra/deployments/integration/review/github_actions_oidc.tf Outdated

sarahseewhy previously approved these changes Mar 2, 2026

View reviewed changes

Copilot AI review requested due to automatic review settings March 9, 2026 09:41

whi-tw force-pushed the whi-tw/allow-github-hosted-runner-deploy-review-apps branch from a2cb897 to 518eaca Compare March 19, 2026 10:08

Copilot AI reviewed Mar 19, 2026

View reviewed changes

Comment thread infra/deployments/integration/review/review-app-codebuild/buildspec-deploy.yml Outdated

Comment thread infra/deployments/integration/review/review-app-codebuild/buildspec-destroy.yml Outdated

Comment thread infra/deployments/integration/review/review-app-codebuild/main.tf Outdated

whi-tw force-pushed the whi-tw/allow-github-hosted-runner-deploy-review-apps branch from 518eaca to 9dca17e Compare March 19, 2026 10:17

Copilot AI review requested due to automatic review settings March 19, 2026 10:23

whi-tw force-pushed the whi-tw/allow-github-hosted-runner-deploy-review-apps branch from 9dca17e to 2adeb72 Compare March 19, 2026 10:23

Copilot AI reviewed Mar 19, 2026

View reviewed changes

Comment thread infra/deployments/integration/review/review-app-codebuild/main.tf Outdated

Copilot AI review requested due to automatic review settings March 19, 2026 10:58

Copilot AI reviewed Mar 19, 2026

View reviewed changes

Copilot AI review requested due to automatic review settings March 19, 2026 11:23

whi-tw force-pushed the whi-tw/allow-github-hosted-runner-deploy-review-apps branch 2 times, most recently from 160db33 to 6aaf305 Compare March 19, 2026 11:24

Copilot AI reviewed Mar 19, 2026

View reviewed changes

Comment thread .github/workflows/reusable-review_apps_on_pr_change.yml

Comment thread .github/workflows/reusable-review_apps_on_pr_change.yml

whi-tw force-pushed the whi-tw/allow-github-hosted-runner-deploy-review-apps branch from 6aaf305 to d4f4c45 Compare March 19, 2026 11:34

Copilot AI review requested due to automatic review settings March 19, 2026 11:37

whi-tw force-pushed the whi-tw/allow-github-hosted-runner-deploy-review-apps branch from d4f4c45 to ded38bb Compare March 19, 2026 11:37

Copilot AI reviewed Mar 19, 2026

View reviewed changes

Comment thread .github/workflows/reusable-review_apps_on_pr_change.yml Outdated

Comment thread .github/workflows/reusable-review_apps_on_pr_change.yml Outdated

Comment thread .github/workflows/reusable-review_apps_on_pr_change.yml

whi-tw force-pushed the whi-tw/allow-github-hosted-runner-deploy-review-apps branch from ded38bb to c5c4c72 Compare March 19, 2026 11:47

Add GitHub OIDC config for review app deployments

1f68bbc

Add GitHub Actions OIDC identity provider in the integration account.

Copilot AI review requested due to automatic review settings March 19, 2026 11:56

whi-tw force-pushed the whi-tw/allow-github-hosted-runner-deploy-review-apps branch from c5c4c72 to 925876e Compare March 19, 2026 11:56

whi-tw added 2 commits March 19, 2026 11:58

Add reusable workflows for review app C_UD operations

04a92d3

These will be called from the application repositories' PR workflows. It's easier to maintain these in one place in the deploy repo, since they contain a lot of AWS-specific logic that is common across all applications.

whi-tw force-pushed the whi-tw/allow-github-hosted-runner-deploy-review-apps branch from 925876e to 04a92d3 Compare March 19, 2026 11:58

Copilot AI reviewed Mar 19, 2026

View reviewed changes

Comment thread .github/workflows/reusable-review_apps_on_pr_change.yml

Comment thread infra/deployments/integration/review/review-app-codebuild/main.tf

whi-tw requested a review from cadmiumcat March 19, 2026 12:12

cadmiumcat approved these changes Mar 19, 2026

View reviewed changes

whi-tw added this pull request to the merge queue Mar 19, 2026

Merged via the queue into main with commit fae25cf Mar 19, 2026
19 checks passed

whi-tw deleted the whi-tw/allow-github-hosted-runner-deploy-review-apps branch March 19, 2026 12:29

Conversation

whi-tw commented Jan 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What problem does this pull request solve?

Things to consider when reviewing

Reminders

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

sarahseewhy left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

whi-tw commented Jan 22, 2026 •

edited

Loading