Skip to content

Commit 47c01af

Browse files
csantanaprcsantanapr
authored
Merge pull request #4 from gitops-bridge-dev/update-gh-actions
update gh actions
2 parents 8a34715 + a62bc2e commit 47c01af

File tree

4 files changed

+184
-38
lines changed

4 files changed

+184
-38
lines changed

‎.github/workflows/deploy-pulumi.yaml

+53-19
Original file line numberDiff line numberDiff line change
@@ -2,44 +2,78 @@ name: Pulumi Deploy
22
on:
33
push:
44
branches:
5-
- main
5+
- live
66
paths:
77
- pulumi/**
8-
env:
9-
PULUMI_ACCESS_TOKEN: ${{ secrets.PULUMI_ACCESS_TOKEN }}
10-
GITHUB_TOKEN: ${{ secrets.PULUMI_GITHUB_TOKEN }}
8+
workflow_dispatch: null
119

1210
jobs:
1311
preview:
1412
runs-on: ubuntu-latest
1513
strategy:
1614
fail-fast: false
17-
# This IAM Matrix should have a name with the stack name and an iamRole
18-
# with access to deploy AWS resources in you account. The easiest method is attaching AdministratorAccess Policy to role.
15+
# This IAM Matrix should have a name with the stack name, awsAccountID, and iamRole
16+
# with access to deploy AWS resources in you account. The easiest method is attaching AdministratorAccess Policy to role
1917
# See https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-amazon-web-services for details on implementing OIDC with Github Actions
2018
matrix:
21-
arrays: [
22-
stack: {name: "hub", iamRole: "arn:aws:iam::753080021511:role/pulumi-github-actions"},
23-
stack: {name: "dev", iamRole: "arn:aws:iam::753080021511:role/pulumi-github-actions"},
24-
stack: {name: "prod", iamRole: "arn:aws:iam::753080021511:role/pulumi-github-actions"},
19+
arrays: [
20+
stack: {name: "hub", awsAccountID: "AWS_ACCOUNT_ID", iamRole: "AWS_DEPLOY_ROLE"},
21+
stack: {name: "dev", awsAccountID: "AWS_ACCOUNT_ID", iamRole: "AWS_DEPLOY_ROLE"},
22+
stack: {name: "prod", awsAccountID: "AWS_ACCOUNT_ID", iamRole: "AWS_DEPLOY_ROLE"},
2523
]
2624
permissions:
2725
id-token: write
2826
contents: read
29-
name: Deploy
27+
name: Pulumi Deploy ${{ matrix.arrays.stack.name }}
3028
steps:
31-
- uses: actions/checkout@v2
32-
- name: configure aws credentials
33-
uses: aws-actions/configure-aws-credentials@v2
29+
- name: Checkout 🛎️
30+
uses: actions/checkout@v4
31+
32+
- name: Configure AWS Credentials
33+
uses: aws-actions/configure-aws-credentials@v4
3434
with:
35-
role-to-assume: ${{ matrix.arrays.stack.iamRole }}
36-
aws-region: us-east-2
37-
- run: |
35+
aws-region: ${{ secrets.AWS_DEFAULT_REGION }}
36+
## the following creates an ARN based on the values entered into github secrets
37+
role-to-assume: arn:aws:iam::${{ secrets[matrix.arrays.stack.awsAccountID] }}:role/${{ secrets[matrix.arrays.stack.iamRole] }}
38+
role-session-name: myGitHubActions
39+
40+
- name: 📦️ Pulumi Install 📦️
41+
uses: pulumi/actions@v5
42+
43+
# - name: Overrides Pulumi Config 🔨
44+
# working-directory: pulumi
45+
# env:
46+
# PULUMI_ACCESS_TOKEN: ${{ secrets.PULUMI_ACCESS_TOKEN }}
47+
# run: |
48+
# pulumi stack select ${{ matrix.arrays.stack.name }}
49+
# pulumi config set githubOrg ${GITHUB_REPOSITORY_OWNER}
50+
# pulumi config set githubRepo $(echo "${GITHUB_REPOSITORY}" | cut -d '/' -f2)
51+
# pulumi config set veleroBucketPrefix ${{ secrets.VELERO_BACKUP_BUCKET }}
52+
# if [ ${{ matrix.arrays.stack.name }} != "hub" ]; then
53+
# pulumi config set hubStackName ${{ secrets.PULUMI_ACCOUNT }}/${{ secrets.PULUMI_PROJECT }}/hub
54+
# fi
55+
# cat stacks/Pulumi.${{ matrix.arrays.stack.name }}.yaml
56+
57+
- name: Setup Node LTS ✨
58+
uses: actions/setup-node@v4
59+
with:
60+
node-version: lts/*
61+
# cache: npm
62+
# cache-dependency-path: pulumi/src/package-lock.json
63+
64+
- name: Installing dependencies 📦️
65+
run: |
3866
cd ./pulumi
3967
npm install
40-
- uses: pulumi/actions@v3
68+
69+
- name: Deploy infrastructure 🚀
70+
uses: pulumi/actions@v5
4171
with:
42-
color: auto
4372
command: up
4473
work-dir: ./pulumi
4574
stack-name: ${{ matrix.arrays.stack.name }}
75+
comment-on-summary: true
76+
diff: true
77+
env:
78+
PULUMI_ACCESS_TOKEN: ${{ secrets.PULUMI_ACCESS_TOKEN }}
79+
GITHUB_TOKEN: ${{ secrets.PULUMI_GITHUB_TOKEN }}

‎.github/workflows/destroy-pulumi.yaml

+75
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
1+
name: Pulumi Destroy
2+
on:
3+
workflow_dispatch: null
4+
5+
jobs:
6+
preview:
7+
runs-on: ubuntu-latest
8+
strategy:
9+
fail-fast: false
10+
# This IAM Matrix should have a name with the stack name, awsAccountID, and iamRole
11+
# with access to deploy AWS resources in you account. The easiest method is attaching AdministratorAccess Policy to role
12+
# See https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-amazon-web-services for details on implementing OIDC with Github Actions
13+
matrix:
14+
arrays: [
15+
stack: {name: "hub", awsAccountID: "AWS_ACCOUNT_ID", iamRole: "AWS_DEPLOY_ROLE"},
16+
stack: {name: "dev", awsAccountID: "AWS_ACCOUNT_ID", iamRole: "AWS_DEPLOY_ROLE"},
17+
stack: {name: "prod", awsAccountID: "AWS_ACCOUNT_ID", iamRole: "AWS_DEPLOY_ROLE"},
18+
]
19+
permissions:
20+
id-token: write
21+
contents: read
22+
name: Pulumi Destroy ${{ matrix.arrays.stack.name }}
23+
steps:
24+
- name: Checkout 🛎️
25+
uses: actions/checkout@v4
26+
27+
- name: Configure AWS Credentials
28+
uses: aws-actions/configure-aws-credentials@v4
29+
with:
30+
aws-region: ${{ secrets.AWS_DEFAULT_REGION }}
31+
## the following creates an ARN based on the values entered into github secrets
32+
role-to-assume: arn:aws:iam::${{ secrets[matrix.arrays.stack.awsAccountID] }}:role/${{ secrets[matrix.arrays.stack.iamRole] }}
33+
role-session-name: myGitHubActions
34+
35+
- name: 📦️ Pulumi Install 📦️
36+
uses: pulumi/actions@v5
37+
38+
# - name: Overrides Pulumi Config 🔨
39+
# working-directory: pulumi
40+
# env:
41+
# PULUMI_ACCESS_TOKEN: ${{ secrets.PULUMI_ACCESS_TOKEN }}
42+
# run: |
43+
# pulumi stack select ${{ matrix.arrays.stack.name }}
44+
# pulumi config set githubOrg ${GITHUB_REPOSITORY_OWNER}
45+
# pulumi config set githubRepo $(echo "${GITHUB_REPOSITORY}" | cut -d '/' -f2)
46+
# pulumi config set veleroBucketPrefix ${{ secrets.VELERO_BACKUP_BUCKET }}
47+
# if [ ${{ matrix.arrays.stack.name }} != "hub" ]; then
48+
# pulumi config set hubStackName ${{ secrets.PULUMI_ACCOUNT }}/${{ secrets.PULUMI_PROJECT }}/hub
49+
# fi
50+
# cat stacks/Pulumi.${{ matrix.arrays.stack.name }}.yaml
51+
52+
- name: Setup Node LTS ✨
53+
uses: actions/setup-node@v4
54+
with:
55+
node-version: lts/*
56+
# cache: npm
57+
# cache-dependency-path: pulumi/src/package-lock.json
58+
59+
- name: Installing dependencies 📦️
60+
run: |
61+
cd ./pulumi
62+
npm install
63+
64+
- name: Destroy infrastructure 🚀
65+
uses: pulumi/actions@v5
66+
with:
67+
command: destroy
68+
work-dir: ./pulumi
69+
stack-name: ${{ matrix.arrays.stack.name }}
70+
comment-on-summary: true
71+
diff: true
72+
env:
73+
PULUMI_ACCESS_TOKEN: ${{ secrets.PULUMI_ACCESS_TOKEN }}
74+
GITHUB_TOKEN: ${{ secrets.PULUMI_GITHUB_TOKEN }}
75+
PULUMI_K8S_DELETE_UNREACHABLE: true

‎.github/workflows/pr-pulumi.yaml

+55-19
Original file line numberDiff line numberDiff line change
@@ -1,41 +1,77 @@
1-
name: Pulumi Prototype Preview
1+
name: Pulumi Preview
22
on:
3-
- pull_request
4-
env:
5-
PULUMI_ACCESS_TOKEN: ${{ secrets.PULUMI_ACCESS_TOKEN }}
6-
GITHUB_TOKEN: ${{ secrets.PULUMI_GITHUB_TOKEN }}
3+
pull_request:
4+
paths:
5+
- pulumi/**
6+
workflow_dispatch: null
77

88
jobs:
99
preview:
1010
runs-on: ubuntu-latest
1111
strategy:
1212
fail-fast: false
13-
# This IAM Matrix should have a name with the stack name and an iamRole
13+
# This IAM Matrix should have a name with the stack name, awsAccountID, and iamRole
1414
# with access to deploy AWS resources in you account. The easiest method is attaching AdministratorAccess Policy to role
1515
# See https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-amazon-web-services for details on implementing OIDC with Github Actions
1616
matrix:
17-
arrays: [
18-
stack: {name: "hub", iamRole: "arn:aws:iam::753080021511:role/pulumi-github-actions"},
19-
stack: {name: "dev", iamRole: "arn:aws:iam::753080021511:role/pulumi-github-actions"},
20-
stack: {name: "prod", iamRole: "arn:aws:iam::753080021511:role/pulumi-github-actions"},
17+
arrays: [
18+
stack: {name: "hub", awsAccountID: "AWS_ACCOUNT_ID", iamRole: "AWS_DEPLOY_ROLE"},
19+
stack: {name: "dev", awsAccountID: "AWS_ACCOUNT_ID", iamRole: "AWS_DEPLOY_ROLE"},
20+
stack: {name: "prod", awsAccountID: "AWS_ACCOUNT_ID", iamRole: "AWS_DEPLOY_ROLE"},
2121
]
2222
permissions:
2323
id-token: write
2424
contents: read
25-
name: Deploy
25+
name: Pulumi Preview ${{ matrix.arrays.stack.name }}
2626
steps:
27-
- uses: actions/checkout@v2
28-
- name: configure aws credentials
29-
uses: aws-actions/configure-aws-credentials@v2
27+
- name: Checkout 🛎️
28+
uses: actions/checkout@v4
29+
30+
- name: Configure AWS Credentials
31+
uses: aws-actions/configure-aws-credentials@v4
3032
with:
31-
role-to-assume: ${{ matrix.arrays.stack.iamRole }}
32-
aws-region: us-east-2
33-
- run: |
33+
aws-region: ${{ secrets.AWS_DEFAULT_REGION }}
34+
## the following creates an ARN based on the values entered into github secrets
35+
role-to-assume: arn:aws:iam::${{ secrets[matrix.arrays.stack.awsAccountID] }}:role/${{ secrets[matrix.arrays.stack.iamRole] }}
36+
role-session-name: myGitHubActions
37+
38+
- name: 📦️ Pulumi Install 📦️
39+
uses: pulumi/actions@v5
40+
41+
# - name: Overrides Pulumi Config 🔨
42+
# working-directory: pulumi
43+
# env:
44+
# PULUMI_ACCESS_TOKEN: ${{ secrets.PULUMI_ACCESS_TOKEN }}
45+
# run: |
46+
# pulumi stack select ${{ matrix.arrays.stack.name }}
47+
# pulumi config set githubOrg ${GITHUB_REPOSITORY_OWNER}
48+
# pulumi config set githubRepo $(echo "${GITHUB_REPOSITORY}" | cut -d '/' -f2)
49+
# pulumi config set veleroBucketPrefix ${{ secrets.VELERO_BACKUP_BUCKET }}
50+
# if [ ${{ matrix.arrays.stack.name }} != "hub" ]; then
51+
# pulumi config set hubStackName ${{ secrets.PULUMI_ACCOUNT }}/${{ secrets.PULUMI_PROJECT }}/hub
52+
# fi
53+
# cat stacks/Pulumi.${{ matrix.arrays.stack.name }}.yaml
54+
55+
- name: Setup Node LTS ✨
56+
uses: actions/setup-node@v4
57+
with:
58+
node-version: lts/*
59+
# cache: npm
60+
# cache-dependency-path: pulumi/src/package-lock.json
61+
62+
- name: Installing dependencies 📦️
63+
run: |
3464
cd ./pulumi
3565
npm install
36-
- uses: pulumi/actions@v3
66+
67+
- name: Preview infrastructure 🚀
68+
uses: pulumi/actions@v5
3769
with:
38-
color: auto
3970
command: preview
4071
work-dir: ./pulumi
4172
stack-name: ${{ matrix.arrays.stack.name }}
73+
comment-on-summary: true
74+
diff: true
75+
env:
76+
PULUMI_ACCESS_TOKEN: ${{ secrets.PULUMI_ACCESS_TOKEN }}
77+
GITHUB_TOKEN: ${{ secrets.PULUMI_GITHUB_TOKEN }}

‎pulumi/Pulumi.yaml

+1
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
11
name: gitopscon-2024-na-demo
22
runtime: nodejs
33
description: GitOpsCon 2024 North America Demo Project
4+

0 commit comments

Comments
 (0)