setup env and secrets

Author: cnuss

.github/workflows/push-main.yml

@@ -31,7 +31,14 @@ jobs:
 
       - uses: aws-actions/configure-aws-credentials@v4
         with:
-          role-to-assume: arn:aws:iam::339712900631:role/OrganizationAccountAccessRole
-          aws-region: us-east-1
+          role-to-assume: ${{ env.AWS_DEPLOY_ROLE}}
+          aws-region: ${{ env.AWS_REGION}}
 
       - run: yarn deploy --stage $NODE_ENV
+        env:
+          GH_APP_URL: ${{ env.GH_APP_URL }}
+          GH_APP_ID: ${{ env.GH_APP_ID }}
+          GH_CLIENT_ID: ${{ env.GH_CLIENT_ID }}
+          GH_CLIENT_SECRET: ${{ secrets.GH_CLIENT_SECRET }}
+          GH_PRIVATE_KEY: ${{ secrets.GH_PRIVATE_KEY }}
+          GH_WEBHOOK_SECRET: ${{ secrets.GH_WEBHOOK_SECRET }}

INSTALLATION.md

@@ -33,3 +33,35 @@ Trust Relationship:
   ]
 }
 ```
+
+## GitHub App
+
+1. Create a GitHub App
+1. Set Homepage URL
+1. Set Callback URL
+1. Enable Request user authorization (OAuth) during installation
+1. Enable Device Flow
+1. Set Webhook URL
+1. Set Webhook Secret
+1. Set Repository Permissions
+   1. Repo Admin R/W?
+   1. Webhooks R/W?
+   1. Single File: saml-to.yml
+1. Set Organization Permissions
+   1. Members R/O
+1. Set Member Permssions
+   1. Email Addresses R/O
+1. Set Events
+   1. Member
+   1. Meta
+   1. Membership
+   1. Organization
+   1. Repository
+   1. Team
+   1. Team Add
+1. Generate a Client Secret
+   1. Copy into GitHub Secrets: NAME: TODO
+1. Generate a Private Key
+   1. Base64 Encode: `cat ~/Downloads/saml-to-self-hosted.2024-02-04.private-key.pem | base64`
+   1. Copy into GitHub Secrets: NAME: TODO
+

github-app.cjs

@@ -0,0 +1,11 @@
+module.exports.GH_APP_URL = process.env[`GH_APP_URL`];
+module.exports.GH_APP_ID = process.env[`GH_APP_ID`];
+module.exports.GH_CLIENT_ID = process.env[`GH_CLIENT_ID`];
+module.exports.GH_APP_SECRETS = JSON.stringify({
+  [`GITHUB_${process.env[`GH_CLIENT_ID`]}`]: process.env[`GH_CLIENT_SECRET`],
+  [`GITHUB_PRIVATE_KEY_${process.env[`GH_APP_ID`]}`]: Buffer.from(
+    process.env[`GH_PRIVATE_KEY`]
+  ).toString(`base64`),
+  [`GITHUB_WEBHOOK_SECRET_${process.env[`GH_APP_ID`]}`]:
+    process.env[`GH_WEBHOOK_SECRET`],
+});

index.js

@@ -33,6 +33,9 @@ provider:
     lambda: true
   environment:
     STAGE: ${self:provider.stage}
+    GITHUB_APP_ID: ${file(github-app.cjs):GH_APP_ID}
+    GITHUB_CLIENT_IDS: ${file(github-app.cjs):GH_CLIENT_ID}
+    GITHUB_APP_URL: ${file(github-app.cjs):GH_APP_URL}
 
 functions:
   github:
@@ -78,11 +81,11 @@ functions:
 
 resources:
   Resources:
-    # Secret:
-    #   Type: AWS::SecretsManager::Secret
-    #   Properties:
-    #     Name: ${self:service}-${self:provider.stage}
-    #     SecretString: ${file(scripts/config.js):SECRETS}
+    GithubSecret:
+      Type: AWS::SecretsManager::Secret
+      Properties:
+        Name: lambda/${self:provider.stage}/github-sls-rest-api
+        SecretString: ${file(github-app.cjs):GH_APP_SECRETS}
 
     # Topic:
     #   Type: AWS::SNS::Topic