From 7cbe22a43523ba906c82c3709a09121fabfaac8c Mon Sep 17 00:00:00 2001 From: Xavier MALPARTY Date: Wed, 20 Sep 2023 10:45:36 +0700 Subject: [PATCH 01/21] Add VPC Endpoint Gateway for S3 --- templates/addons/aws/modules/vpc/main.tf | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/templates/addons/aws/modules/vpc/main.tf b/templates/addons/aws/modules/vpc/main.tf index f288adba..c678c5df 100644 --- a/templates/addons/aws/modules/vpc/main.tf +++ b/templates/addons/aws/modules/vpc/main.tf @@ -15,3 +15,22 @@ module "vpc" { one_nat_gateway_per_az = false enable_dns_hostnames = true } + +data "aws_route_tables" "private_route_table" { + vpc_id = module.vpc.vpc_id + + filter { + name = "tag:Name" + values = ["${var.env_namespace}-vpc-private"] + } +} + +resource "aws_vpc_endpoint" "s3" { + vpc_id = module.vpc.vpc_id + service_name = "com.amazonaws.${var.region}.s3" + route_table_ids = data.aws_route_tables.private_route_table.ids + + tags = { + Name = "${var.env_namespace}-vpc-endpoint-s3" + } +} From 3e975e186d8047b2645e1825f26221311fe94a58 Mon Sep 17 00:00:00 2001 From: Xavier MALPARTY Date: Wed, 20 Sep 2023 11:08:56 +0700 Subject: [PATCH 02/21] Update infrastructure diagram --- .github/wiki/assets/images/architecture/diagram-complete.svg | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/wiki/assets/images/architecture/diagram-complete.svg b/.github/wiki/assets/images/architecture/diagram-complete.svg index e582dad5..8d2964b0 100644 --- a/.github/wiki/assets/images/architecture/diagram-complete.svg +++ b/.github/wiki/assets/images/architecture/diagram-complete.svg @@ -1 +1 @@ - \ No newline at end of file + From e00fd4552ec58b5356de0c239c22e949ff394ce1 Mon Sep 17 00:00:00 2001 From: Xavier MALPARTY Date: Wed, 20 Sep 2023 14:04:13 +0700 Subject: [PATCH 03/21] Add the region variable to VPC --- src/generators/addons/aws/modules/core/vpc.ts | 1 + templates/addons/aws/modules/vpc/variables.tf | 5 +++++ 2 files changed, 6 insertions(+) diff --git a/src/generators/addons/aws/modules/core/vpc.ts b/src/generators/addons/aws/modules/core/vpc.ts index 0858abe9..5702bc14 100644 --- a/src/generators/addons/aws/modules/core/vpc.ts +++ b/src/generators/addons/aws/modules/core/vpc.ts @@ -20,6 +20,7 @@ const vpcModuleContent = dedent` source = "../modules/vpc" env_namespace = local.env_namespace + region = var.region }`; const applyAwsVpc = async (options: AwsOptions) => { diff --git a/templates/addons/aws/modules/vpc/variables.tf b/templates/addons/aws/modules/vpc/variables.tf index aa8b9f5f..b06ba14d 100644 --- a/templates/addons/aws/modules/vpc/variables.tf +++ b/templates/addons/aws/modules/vpc/variables.tf @@ -2,3 +2,8 @@ variable "env_namespace" { description = "The namespace with environment for the VPCs, used as the prefix for the VPC names, e.g. acme-web-staging" type = string } + +variable "region" { + description = "AWS region" + type = string +} From 99d2e9e224d84bc121b0364705284768da4a8a7a Mon Sep 17 00:00:00 2001 From: Xavier MALPARTY Date: Wed, 20 Sep 2023 14:47:37 +0700 Subject: [PATCH 04/21] Change to a logs VPC Endpoint Gateway --- .../wiki/assets/images/architecture/diagram-complete.svg | 2 +- templates/addons/aws/modules/vpc/main.tf | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/wiki/assets/images/architecture/diagram-complete.svg b/.github/wiki/assets/images/architecture/diagram-complete.svg index 8d2964b0..06b104e3 100644 --- a/.github/wiki/assets/images/architecture/diagram-complete.svg +++ b/.github/wiki/assets/images/architecture/diagram-complete.svg @@ -1 +1 @@ - + diff --git a/templates/addons/aws/modules/vpc/main.tf b/templates/addons/aws/modules/vpc/main.tf index c678c5df..f3762043 100644 --- a/templates/addons/aws/modules/vpc/main.tf +++ b/templates/addons/aws/modules/vpc/main.tf @@ -25,12 +25,12 @@ data "aws_route_tables" "private_route_table" { } } -resource "aws_vpc_endpoint" "s3" { +resource "aws_vpc_endpoint" "logs" { vpc_id = module.vpc.vpc_id - service_name = "com.amazonaws.${var.region}.s3" + service_name = "com.amazonaws.${var.region}.logs" route_table_ids = data.aws_route_tables.private_route_table.ids tags = { - Name = "${var.env_namespace}-vpc-endpoint-s3" + Name = "${var.env_namespace}-vpc-endpoint-logs" } } From 0ba0f44d8ba369240583b34fb6c8f44aa44bbb28 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 10 Nov 2023 03:09:58 +0000 Subject: [PATCH 05/21] Bump ts-jest from 29.0.5 to 29.1.1 Bumps [ts-jest](https://github.com/kulshekhar/ts-jest) from 29.0.5 to 29.1.1. - [Release notes](https://github.com/kulshekhar/ts-jest/releases) - [Changelog](https://github.com/kulshekhar/ts-jest/blob/main/CHANGELOG.md) - [Commits](https://github.com/kulshekhar/ts-jest/compare/v29.0.5...v29.1.1) --- updated-dependencies: - dependency-name: ts-jest dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] --- package-lock.json | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/package-lock.json b/package-lock.json index 4cfe26d7..1886f90f 100644 --- a/package-lock.json +++ b/package-lock.json @@ -11605,9 +11605,9 @@ } }, "node_modules/ts-jest": { - "version": "29.0.5", - "resolved": "https://registry.npmjs.org/ts-jest/-/ts-jest-29.0.5.tgz", - "integrity": "sha512-PL3UciSgIpQ7f6XjVOmbi96vmDHUqAyqDr8YxzopDqX3kfgYtX1cuNeBjP+L9sFXi6nzsGGA6R3fP3DDDJyrxA==", + "version": "29.1.1", + "resolved": "https://registry.npmjs.org/ts-jest/-/ts-jest-29.1.1.tgz", + "integrity": "sha512-D6xjnnbP17cC85nliwGiL+tpoKN0StpgE0TeOjXQTU6MVCfsB4v7aW05CgQ/1OywGb0x/oy9hHFnN+sczTiRaA==", "dev": true, "dependencies": { "bs-logger": "0.x", @@ -11616,7 +11616,7 @@ "json5": "^2.2.3", "lodash.memoize": "4.x", "make-error": "1.x", - "semver": "7.x", + "semver": "^7.5.3", "yargs-parser": "^21.0.1" }, "bin": { @@ -11630,7 +11630,7 @@ "@jest/types": "^29.0.0", "babel-jest": "^29.0.0", "jest": "^29.0.0", - "typescript": ">=4.3" + "typescript": ">=4.3 <6" }, "peerDependenciesMeta": { "@babel/core": { @@ -22239,9 +22239,9 @@ "integrity": "sha512-q5W7tVM71e2xjHZTlgfTDoPF/SmqKG5hddq9SzR49CH2hayqRKJtQ4mtRlSxKaJlR/+9rEM+mnBHf7I2/BQcpQ==" }, "ts-jest": { - "version": "29.0.5", - "resolved": "https://registry.npmjs.org/ts-jest/-/ts-jest-29.0.5.tgz", - "integrity": "sha512-PL3UciSgIpQ7f6XjVOmbi96vmDHUqAyqDr8YxzopDqX3kfgYtX1cuNeBjP+L9sFXi6nzsGGA6R3fP3DDDJyrxA==", + "version": "29.1.1", + "resolved": "https://registry.npmjs.org/ts-jest/-/ts-jest-29.1.1.tgz", + "integrity": "sha512-D6xjnnbP17cC85nliwGiL+tpoKN0StpgE0TeOjXQTU6MVCfsB4v7aW05CgQ/1OywGb0x/oy9hHFnN+sczTiRaA==", "dev": true, "requires": { "bs-logger": "0.x", @@ -22250,7 +22250,7 @@ "json5": "^2.2.3", "lodash.memoize": "4.x", "make-error": "1.x", - "semver": "7.x", + "semver": "^7.5.3", "yargs-parser": "^21.0.1" } }, From fe969b4e3228a3452b04fb4a6b1a34e4a23695ea Mon Sep 17 00:00:00 2001 From: Alex Date: Sat, 18 Nov 2023 22:15:35 +0700 Subject: [PATCH 06/21] [#246] Fix IAM policy definition --- package-lock.json | 4 ++-- .../addons/aws/modules/iam_groups/data.tf | 20 +++++++++---------- .../addons/aws/modules/iam_groups/main.tf | 3 +++ 3 files changed, 15 insertions(+), 12 deletions(-) diff --git a/package-lock.json b/package-lock.json index 4cfe26d7..92392ac4 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,12 +1,12 @@ { "name": "@nimblehq/infra-template", - "version": "2.0.2", + "version": "2.2.0", "lockfileVersion": 2, "requires": true, "packages": { "": { "name": "@nimblehq/infra-template", - "version": "2.0.2", + "version": "2.2.0", "license": "MIT", "dependencies": { "@oclif/core": "^2", diff --git a/templates/addons/aws/modules/iam_groups/data.tf b/templates/addons/aws/modules/iam_groups/data.tf index cb105971..512e5b54 100644 --- a/templates/addons/aws/modules/iam_groups/data.tf +++ b/templates/addons/aws/modules/iam_groups/data.tf @@ -1,10 +1,10 @@ locals { # Comes from https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_examples_aws_my-sec-creds-self-manage.html - # This policy allows users to view and edit their own passwords, access keys, MFA devices, X.509 certificates, SSH keys, and Git credentials. - # In addition, users are required to set up and authenticate using MFA before performing any other operations in AWS. - # It also means this policy does NOT allow users to reset a password while signing in to the AWS Management Console for the first time. + # This policy allows users to view and edit their own passwords, access keys, MFA devices, X.509 certificates, SSH keys, and Git credentials. + # In addition, users are required to set up and authenticate using MFA before performing any other operations in AWS. + # It also means this policy does NOT allow users to reset a password while signing in to the AWS Management Console for the first time. # They must first set up their MFA because allowing users to change their password without MFA can be a security risk. - # + # # The following actions are added to the initial policy from AWS # - iam:GetLoginProfile: allows the IAM user to view their account information on the security page. # - iam:GetAccessKeyLastUsed: allows the IAM user to view the last time their access key was used. @@ -123,13 +123,13 @@ locals { # For the bot account # It must be able to manage policies during terraform apply & create/delete users, permissions, etc. during terraform apply full_iam_access_policy = jsonencode({ - version = "2012-10-17" - statement = [ + Version = "2012-10-17" + Statement = [ { - sid = "AllowManageRoleAndPolicy" - effect = "Allow" - resources = ["arn:aws:iam::*"] - actions = ["iam:*"] + Sid = "AllowManageRoleAndPolicy" + Effect = "Allow" + Resource = ["arn:aws:iam::*"] + Action = ["iam:*"] } ] }) diff --git a/templates/addons/aws/modules/iam_groups/main.tf b/templates/addons/aws/modules/iam_groups/main.tf index efc7be6e..e3e04179 100644 --- a/templates/addons/aws/modules/iam_groups/main.tf +++ b/templates/addons/aws/modules/iam_groups/main.tf @@ -35,7 +35,10 @@ resource "aws_iam_group_policy_attachment" "bot_power_user_access" { policy_arn = data.aws_iam_policy.power_user_access.arn } +# This IAM policy is needed for the bot account to manage IAM users & groups +# tfsec:ignore:aws-iam-no-policy-wildcards resource "aws_iam_group_policy" "bot_full_iam_access" { + name = "AllowFullIamAccess" group = aws_iam_group.bot.name policy = local.full_iam_access_policy } From 92c51564867acae8ee6c9720376e616d6e7ef8e5 Mon Sep 17 00:00:00 2001 From: hoangmirs Date: Thu, 30 Nov 2023 03:05:27 +0000 Subject: [PATCH 07/21] Bump version to 2.3.0 --- package-lock.json | 4 ++-- package.json | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/package-lock.json b/package-lock.json index 4cfe26d7..e762425b 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,12 +1,12 @@ { "name": "@nimblehq/infra-template", - "version": "2.0.2", + "version": "2.3.0", "lockfileVersion": 2, "requires": true, "packages": { "": { "name": "@nimblehq/infra-template", - "version": "2.0.2", + "version": "2.3.0", "license": "MIT", "dependencies": { "@oclif/core": "^2", diff --git a/package.json b/package.json index 4dbe7bf1..3f2745fc 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "@nimblehq/infra-template", - "version": "2.2.0", + "version": "2.3.0", "description": "Nimble Infrastructure Template generator", "author": "Nimblehq", "bin": { From 77c1be56db8ef69d45b826811785ea70dda8b37b Mon Sep 17 00:00:00 2001 From: Hoang Mirs Date: Sun, 22 Oct 2023 12:39:26 +0700 Subject: [PATCH 08/21] [#234] Add Check version workflow --- .github/workflows/check-version.yml | 88 +++++++++++++++++++++++++++++ 1 file changed, 88 insertions(+) create mode 100644 .github/workflows/check-version.yml diff --git a/.github/workflows/check-version.yml b/.github/workflows/check-version.yml new file mode 100644 index 00000000..3d3723e1 --- /dev/null +++ b/.github/workflows/check-version.yml @@ -0,0 +1,88 @@ +name: Check version + +on: + push: + branches: + - develop + pull_request: + +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + +env: + VERSION_FILE: ./package.json + +jobs: + check-version: + name: Run linters + runs-on: ubuntu-latest + permissions: + contents: write + pull-requests: write + steps: + - name: Checkout + uses: actions/checkout@v4 + + - name: Get current version + id: current_version + run: | + currentVersion=$(node -p -e "require('${{ env.VERSION_FILE }}').version") + + echo "version=$currentVersion" >> $GITHUB_OUTPUT + + - name: Get latest version + id: latest_version + uses: pozetroninc/github-action-get-latest-release@v0.7.0 + with: + repository: nimblehq/infrastructure-templates + + - name: Compare versions + id: compare_versions + run: | + if [[ "${{ steps.latest_version.outputs.release }}" != "${{ steps.current_version.outputs.version }}" ]]; then + exit 0 + else + echo "The latest version is the same as the current version." + exit 1 + fi + continue-on-error: true + + - name: Bump version to the next minor version + if: steps.compare_versions.outcome == 'failure' + id: next_version + run: | + delimiter=. + array=($(echo "${{ steps.current_version.outputs.version }}" | tr $delimiter '\n')) + + array[1]=$((array[1]+1)) + array[2]=0 + + nextVersion=$(IFS=$delimiter ; echo "${array[*]}") + echo "version=$nextVersion" >> $GITHUB_OUTPUT + + sed -i "s/\"version\": \".*\"/\"version\": \"$nextVersion\"/" ${{ env.VERSION_FILE }} + + - name: Create a new pull request + uses: peter-evans/create-pull-request@v5 + with: + token: ${{ github.token }} + branch: chore/bump-version-to-${{ steps.next_version.outputs.version }} + delete-branch: true + title: "[Chore] Bump version to ${{ steps.next_version.outputs.version }}" + commit-message: "Bump version to ${{ steps.next_version.outputs.version }}" + draft: false + labels: | + type : chore + body: | + ## What happened 👀 + + Bump version to ${{ steps.next_version.outputs.version }} + + ## Insight 📝 + + Automatically created by the GitHub Actions workflow. + + ## Proof Of Work 📹 + + On the Files changed tab From 165df1cfc2a3a1bec8d8dbebcb5389a0219905c9 Mon Sep 17 00:00:00 2001 From: Hoang Mirs Date: Sun, 22 Oct 2023 12:45:22 +0700 Subject: [PATCH 09/21] [#234] Update version --- .github/workflows/check-version.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/check-version.yml b/.github/workflows/check-version.yml index 3d3723e1..e6984584 100644 --- a/.github/workflows/check-version.yml +++ b/.github/workflows/check-version.yml @@ -64,6 +64,7 @@ jobs: sed -i "s/\"version\": \".*\"/\"version\": \"$nextVersion\"/" ${{ env.VERSION_FILE }} - name: Create a new pull request + if: steps.compare_versions.outcome == 'failure' uses: peter-evans/create-pull-request@v5 with: token: ${{ github.token }} From 7e56000a119b346fdd7ebdda678ff9a680728968 Mon Sep 17 00:00:00 2001 From: Hoang Mirs Date: Sun, 22 Oct 2023 12:52:18 +0700 Subject: [PATCH 10/21] [#234] Test output data --- .github/workflows/check-version.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/workflows/check-version.yml b/.github/workflows/check-version.yml index e6984584..bb84c55b 100644 --- a/.github/workflows/check-version.yml +++ b/.github/workflows/check-version.yml @@ -15,7 +15,7 @@ env: jobs: check-version: - name: Run linters + name: Check version runs-on: ubuntu-latest permissions: contents: write @@ -62,6 +62,7 @@ jobs: echo "version=$nextVersion" >> $GITHUB_OUTPUT sed -i "s/\"version\": \".*\"/\"version\": \"$nextVersion\"/" ${{ env.VERSION_FILE }} + cat ${{ env.VERSION_FILE }} - name: Create a new pull request if: steps.compare_versions.outcome == 'failure' From 7a41c5c2cee7ff0477db6e77356749ed5c0caf00 Mon Sep 17 00:00:00 2001 From: Hoang Mirs Date: Sun, 22 Oct 2023 13:13:37 +0700 Subject: [PATCH 11/21] [#234] Change to push for testing --- .github/workflows/check-version.yml | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/.github/workflows/check-version.yml b/.github/workflows/check-version.yml index bb84c55b..fca7dc1f 100644 --- a/.github/workflows/check-version.yml +++ b/.github/workflows/check-version.yml @@ -4,7 +4,7 @@ on: push: branches: - develop - pull_request: + - feature/gh-234-add-version-management-workflows concurrency: group: ${{ github.workflow }}-${{ github.ref }} @@ -62,9 +62,8 @@ jobs: echo "version=$nextVersion" >> $GITHUB_OUTPUT sed -i "s/\"version\": \".*\"/\"version\": \"$nextVersion\"/" ${{ env.VERSION_FILE }} - cat ${{ env.VERSION_FILE }} - - name: Create a new pull request + - name: Create a new pull request to bump the version if: steps.compare_versions.outcome == 'failure' uses: peter-evans/create-pull-request@v5 with: From 22afb781b3bad652a48b5aa19e3811aa835162a1 Mon Sep 17 00:00:00 2001 From: Hoang Mirs Date: Sun, 22 Oct 2023 13:21:18 +0700 Subject: [PATCH 12/21] [#234] Change to use jq --- .github/workflows/check-version.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/check-version.yml b/.github/workflows/check-version.yml index fca7dc1f..cc5c815d 100644 --- a/.github/workflows/check-version.yml +++ b/.github/workflows/check-version.yml @@ -61,7 +61,7 @@ jobs: nextVersion=$(IFS=$delimiter ; echo "${array[*]}") echo "version=$nextVersion" >> $GITHUB_OUTPUT - sed -i "s/\"version\": \".*\"/\"version\": \"$nextVersion\"/" ${{ env.VERSION_FILE }} + jq ".version = \"$nextVersion\"" ${{ env.VERSION_FILE }} > ${{ env.VERSION_FILE }}.tmp && mv ${{ env.VERSION_FILE }}.tmp ${{ env.VERSION_FILE }} - name: Create a new pull request to bump the version if: steps.compare_versions.outcome == 'failure' @@ -72,7 +72,7 @@ jobs: delete-branch: true title: "[Chore] Bump version to ${{ steps.next_version.outputs.version }}" commit-message: "Bump version to ${{ steps.next_version.outputs.version }}" - draft: false + draft: true labels: | type : chore body: | From cdaf717d68a5bf6a4a21310a6cb74ff5da995138 Mon Sep 17 00:00:00 2001 From: Hoang Mirs Date: Sun, 22 Oct 2023 13:34:55 +0700 Subject: [PATCH 13/21] [#234] Change to use strategy --- .github/workflows/check-version.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/workflows/check-version.yml b/.github/workflows/check-version.yml index cc5c815d..3f649e76 100644 --- a/.github/workflows/check-version.yml +++ b/.github/workflows/check-version.yml @@ -20,6 +20,8 @@ jobs: permissions: contents: write pull-requests: write + strategy: + fail-fast: false steps: - name: Checkout uses: actions/checkout@v4 @@ -46,7 +48,6 @@ jobs: echo "The latest version is the same as the current version." exit 1 fi - continue-on-error: true - name: Bump version to the next minor version if: steps.compare_versions.outcome == 'failure' From 6f1773c0798c94e69e9915c8da4db620d68b39dc Mon Sep 17 00:00:00 2001 From: Hoang Mirs Date: Sun, 22 Oct 2023 13:37:35 +0700 Subject: [PATCH 14/21] [#234] Change to use always --- .github/workflows/check-version.yml | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/.github/workflows/check-version.yml b/.github/workflows/check-version.yml index 3f649e76..665bdc3e 100644 --- a/.github/workflows/check-version.yml +++ b/.github/workflows/check-version.yml @@ -20,8 +20,6 @@ jobs: permissions: contents: write pull-requests: write - strategy: - fail-fast: false steps: - name: Checkout uses: actions/checkout@v4 @@ -50,7 +48,7 @@ jobs: fi - name: Bump version to the next minor version - if: steps.compare_versions.outcome == 'failure' + if: always() && steps.compare_versions.outcome == 'failure' id: next_version run: | delimiter=. @@ -65,7 +63,7 @@ jobs: jq ".version = \"$nextVersion\"" ${{ env.VERSION_FILE }} > ${{ env.VERSION_FILE }}.tmp && mv ${{ env.VERSION_FILE }}.tmp ${{ env.VERSION_FILE }} - name: Create a new pull request to bump the version - if: steps.compare_versions.outcome == 'failure' + if: always() && steps.compare_versions.outcome == 'failure' uses: peter-evans/create-pull-request@v5 with: token: ${{ github.token }} From a1e0bee80d47bdcc91aa9403512f762251b5b231 Mon Sep 17 00:00:00 2001 From: Hoang Mirs Date: Sun, 22 Oct 2023 13:49:11 +0700 Subject: [PATCH 15/21] [#234] Remove test push branch --- .github/workflows/check-version.yml | 2 -- 1 file changed, 2 deletions(-) diff --git a/.github/workflows/check-version.yml b/.github/workflows/check-version.yml index 665bdc3e..8bd8e857 100644 --- a/.github/workflows/check-version.yml +++ b/.github/workflows/check-version.yml @@ -4,7 +4,6 @@ on: push: branches: - develop - - feature/gh-234-add-version-management-workflows concurrency: group: ${{ github.workflow }}-${{ github.ref }} @@ -71,7 +70,6 @@ jobs: delete-branch: true title: "[Chore] Bump version to ${{ steps.next_version.outputs.version }}" commit-message: "Bump version to ${{ steps.next_version.outputs.version }}" - draft: true labels: | type : chore body: | From ce6c904db0111f8b7de40568dabbd4d72b7aa878 Mon Sep 17 00:00:00 2001 From: Hoang Mirs Date: Sun, 22 Oct 2023 13:52:32 +0700 Subject: [PATCH 16/21] [#234] Add release branches pattern --- .github/workflows/check-version.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/check-version.yml b/.github/workflows/check-version.yml index 8bd8e857..5476f40d 100644 --- a/.github/workflows/check-version.yml +++ b/.github/workflows/check-version.yml @@ -4,6 +4,7 @@ on: push: branches: - develop + - release/* concurrency: group: ${{ github.workflow }}-${{ github.ref }} From 2faa8b248bfd81f41ff0a5f7dee1444f23a75396 Mon Sep 17 00:00:00 2001 From: Hoang Mirs Date: Sat, 4 Nov 2023 20:21:29 +0700 Subject: [PATCH 17/21] [#234] Update bump_version workflow --- .github/workflows/bump-version.yml | 132 ++++++++++++++++++++++++++++ .github/workflows/check-version.yml | 87 ------------------ 2 files changed, 132 insertions(+), 87 deletions(-) create mode 100644 .github/workflows/bump-version.yml delete mode 100644 .github/workflows/check-version.yml diff --git a/.github/workflows/bump-version.yml b/.github/workflows/bump-version.yml new file mode 100644 index 00000000..955ae40d --- /dev/null +++ b/.github/workflows/bump-version.yml @@ -0,0 +1,132 @@ +name: Bump version + +on: + push: + branches: + - main + workflow_dispatch: + inputs: + newVersion: + description: Version to bump + required: true + default: auto + type: string + +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + +env: + VERSION_FILE: ./package.json + +jobs: + set-next-version: + name: Set next version automatically + runs-on: ubuntu-latest + if: github.event_name != 'workflow_dispatch' || github.event.inputs.newVersion == 'auto' + outputs: + version: ${{ steps.set-next-version.outputs.version }} + + steps: + - name: Checkout main + uses: actions/checkout@v4 + with: + ref: main + + - name: Get version on main + id: get-main-version + run: | + currentVersion=$(node -p -e "require('${{ env.VERSION_FILE }}').version") + echo "version=$currentVersion" >> $GITHUB_OUTPUT + + - name: Checkout develop + uses: actions/checkout@v4 + with: + ref: develop + + - name: Get version on develop + id: get-develop-version + run: | + currentVersion=$(node -p -e "require('${{ env.VERSION_FILE }}').version") + echo "version=$currentVersion" >> $GITHUB_OUTPUT + + - name: Set next version + id: set-next-version + run: | + function ver { printf "%03d%03d%03d%03d" $(echo "$1" | tr '.' ' '); } + + echo "main version: $(ver ${{ steps.get-main-version.outputs.version }})" + echo "develop version: $(ver ${{ steps.get-develop-version.outputs.version }})" + + if [[ $(ver ${{ steps.get-main-version.outputs.version }}) -gt $(ver ${{ steps.get-develop-version.outputs.version }}) ]]; then + echo "main version is greater than develop version" + + echo "version=${{ steps.get-main-version.outputs.version }}" >> $GITHUB_OUTPUT + else + echo "develop version is greater or equal to main version" + + delimiter=. + array=($(echo "${{ steps.get-develop-version.outputs.version }}" | tr $delimiter '\n')) + + array[1]=$((array[1]+1)) + array[2]=0 + + nextVersion=$(IFS=$delimiter ; echo "${array[*]}") + + echo "version=$nextVersion" >> $GITHUB_OUTPUT + fi + + - name: Print next version + run: | + echo "Next version: ${{ steps.set-next-version.outputs.version }}" + + bump-version: + name: Bump version + runs-on: ubuntu-latest + needs: [set-next-version] + permissions: + contents: write + pull-requests: write + + steps: + - name: Checkout + uses: actions/checkout@v4 + with: + ref: develop + + - name: Set next version + id: next-version + run: | + if [ ${{ github.event_name }} != 'workflow_dispatch' ] || [ ${{ github.event.inputs.newVersion }} == 'auto' ]; then + echo "version=${{ needs.set-next-version.outputs.version }}" >> $GITHUB_OUTPUT + else + echo "version=${{ github.event.inputs.newVersion }}" >> $GITHUB_OUTPUT + fi + + - name: Change version in ${{ env.VERSION_FILE }} + run: | + jq ".version = \"${{ steps.next-version.outputs.version }}\"" ${{ env.VERSION_FILE }} > ${{ env.VERSION_FILE }}.tmp && mv ${{ env.VERSION_FILE }}.tmp ${{ env.VERSION_FILE }} + + - name: Create a new pull request + uses: peter-evans/create-pull-request@v5 + with: + token: ${{ github.token }} + branch: chore/bump-version-to-${{ steps.next-version.outputs.version }} + base: develop + delete-branch: true + title: "[Chore] Bump version to ${{ steps.next-version.outputs.version }}" + commit-message: "Bump version to ${{ steps.next-version.outputs.version }}" + labels: | + type : chore + body: | + ## What happened 👀 + + Bump version to ${{ steps.next-version.outputs.version }} + + ## Insight 📝 + + Automatically created by the GitHub Actions workflow. + + ## Proof Of Work 📹 + + On the Files changed tab diff --git a/.github/workflows/check-version.yml b/.github/workflows/check-version.yml deleted file mode 100644 index 5476f40d..00000000 --- a/.github/workflows/check-version.yml +++ /dev/null @@ -1,87 +0,0 @@ -name: Check version - -on: - push: - branches: - - develop - - release/* - -concurrency: - group: ${{ github.workflow }}-${{ github.ref }} - cancel-in-progress: true - -env: - VERSION_FILE: ./package.json - -jobs: - check-version: - name: Check version - runs-on: ubuntu-latest - permissions: - contents: write - pull-requests: write - steps: - - name: Checkout - uses: actions/checkout@v4 - - - name: Get current version - id: current_version - run: | - currentVersion=$(node -p -e "require('${{ env.VERSION_FILE }}').version") - - echo "version=$currentVersion" >> $GITHUB_OUTPUT - - - name: Get latest version - id: latest_version - uses: pozetroninc/github-action-get-latest-release@v0.7.0 - with: - repository: nimblehq/infrastructure-templates - - - name: Compare versions - id: compare_versions - run: | - if [[ "${{ steps.latest_version.outputs.release }}" != "${{ steps.current_version.outputs.version }}" ]]; then - exit 0 - else - echo "The latest version is the same as the current version." - exit 1 - fi - - - name: Bump version to the next minor version - if: always() && steps.compare_versions.outcome == 'failure' - id: next_version - run: | - delimiter=. - array=($(echo "${{ steps.current_version.outputs.version }}" | tr $delimiter '\n')) - - array[1]=$((array[1]+1)) - array[2]=0 - - nextVersion=$(IFS=$delimiter ; echo "${array[*]}") - echo "version=$nextVersion" >> $GITHUB_OUTPUT - - jq ".version = \"$nextVersion\"" ${{ env.VERSION_FILE }} > ${{ env.VERSION_FILE }}.tmp && mv ${{ env.VERSION_FILE }}.tmp ${{ env.VERSION_FILE }} - - - name: Create a new pull request to bump the version - if: always() && steps.compare_versions.outcome == 'failure' - uses: peter-evans/create-pull-request@v5 - with: - token: ${{ github.token }} - branch: chore/bump-version-to-${{ steps.next_version.outputs.version }} - delete-branch: true - title: "[Chore] Bump version to ${{ steps.next_version.outputs.version }}" - commit-message: "Bump version to ${{ steps.next_version.outputs.version }}" - labels: | - type : chore - body: | - ## What happened 👀 - - Bump version to ${{ steps.next_version.outputs.version }} - - ## Insight 📝 - - Automatically created by the GitHub Actions workflow. - - ## Proof Of Work 📹 - - On the Files changed tab From b3b8817d9f47a84e0f8d53c4ef52068c6463704d Mon Sep 17 00:00:00 2001 From: Hoang Mirs Date: Thu, 9 Nov 2023 11:49:36 +0700 Subject: [PATCH 18/21] [#234] Improve increment-version workflow --- ...bump-version.yml => increment-version.yml} | 21 ++++++++++--------- 1 file changed, 11 insertions(+), 10 deletions(-) rename .github/workflows/{bump-version.yml => increment-version.yml} (86%) diff --git a/.github/workflows/bump-version.yml b/.github/workflows/increment-version.yml similarity index 86% rename from .github/workflows/bump-version.yml rename to .github/workflows/increment-version.yml index 955ae40d..fe37d081 100644 --- a/.github/workflows/bump-version.yml +++ b/.github/workflows/increment-version.yml @@ -1,4 +1,4 @@ -name: Bump version +name: Increment version on: push: @@ -7,7 +7,7 @@ on: workflow_dispatch: inputs: newVersion: - description: Version to bump + description: Version to increment required: true default: auto type: string @@ -52,8 +52,10 @@ jobs: - name: Set next version id: set-next-version + env: + VERSION_DELIMITER: . run: | - function ver { printf "%03d%03d%03d%03d" $(echo "$1" | tr '.' ' '); } + function ver { printf "%03d%03d%03d" $(echo "$1" | tr '${VERSION_DELIMITER}' ' '); } echo "main version: $(ver ${{ steps.get-main-version.outputs.version }})" echo "develop version: $(ver ${{ steps.get-develop-version.outputs.version }})" @@ -65,13 +67,12 @@ jobs: else echo "develop version is greater or equal to main version" - delimiter=. - array=($(echo "${{ steps.get-develop-version.outputs.version }}" | tr $delimiter '\n')) + versionComponents=($(echo "${{ steps.get-develop-version.outputs.version }}" | tr ${VERSION_DELIMITER} '\n')) - array[1]=$((array[1]+1)) - array[2]=0 + versionComponents[1]=$((versionComponents[1]+1)) + versionComponents[2]=0 - nextVersion=$(IFS=$delimiter ; echo "${array[*]}") + nextVersion=$(IFS=${VERSION_DELIMITER} ; echo "${versionComponents[*]}") echo "version=$nextVersion" >> $GITHUB_OUTPUT fi @@ -80,8 +81,8 @@ jobs: run: | echo "Next version: ${{ steps.set-next-version.outputs.version }}" - bump-version: - name: Bump version + increment-version: + name: Increment version runs-on: ubuntu-latest needs: [set-next-version] permissions: From cb35489a87011f43fe2ce9bc1ea4f188a37f493e Mon Sep 17 00:00:00 2001 From: Hoang Mirs Date: Thu, 9 Nov 2023 11:56:42 +0700 Subject: [PATCH 19/21] [#234] Revert the format of int version --- .github/workflows/increment-version.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/increment-version.yml b/.github/workflows/increment-version.yml index fe37d081..e47e1e72 100644 --- a/.github/workflows/increment-version.yml +++ b/.github/workflows/increment-version.yml @@ -55,7 +55,7 @@ jobs: env: VERSION_DELIMITER: . run: | - function ver { printf "%03d%03d%03d" $(echo "$1" | tr '${VERSION_DELIMITER}' ' '); } + function ver { printf "%03d%03d%03d%03d" $(echo "$1" | tr '${VERSION_DELIMITER}' ' '); } echo "main version: $(ver ${{ steps.get-main-version.outputs.version }})" echo "develop version: $(ver ${{ steps.get-develop-version.outputs.version }})" From 44b352adb45982fc0b3db350cd4f5bf186ff2723 Mon Sep 17 00:00:00 2001 From: Hoang Mirs Date: Thu, 30 Nov 2023 10:03:31 +0700 Subject: [PATCH 20/21] [#234] Update package-lock file after changing version --- .github/workflows/increment-version.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/increment-version.yml b/.github/workflows/increment-version.yml index e47e1e72..66b849fd 100644 --- a/.github/workflows/increment-version.yml +++ b/.github/workflows/increment-version.yml @@ -108,6 +108,9 @@ jobs: run: | jq ".version = \"${{ steps.next-version.outputs.version }}\"" ${{ env.VERSION_FILE }} > ${{ env.VERSION_FILE }}.tmp && mv ${{ env.VERSION_FILE }}.tmp ${{ env.VERSION_FILE }} + - name: Update package-lock.json + run: npm install + - name: Create a new pull request uses: peter-evans/create-pull-request@v5 with: From 99a74de1feb8c024a8ab8e439cc96849728d1da0 Mon Sep 17 00:00:00 2001 From: Aleksei Lisikhin Date: Fri, 1 Dec 2023 13:54:14 +0700 Subject: [PATCH 21/21] [#254] Prevent creating the login credential for IAM bot account --- .../aws/modules/core/iamUserAndGroup.ts | 51 ++++++++----------- .../addons/aws/modules/iam_groups/data.tf | 2 +- .../addons/aws/modules/iam_groups/main.tf | 14 ++--- .../addons/aws/modules/iam_groups/outputs.tf | 6 +-- 4 files changed, 33 insertions(+), 40 deletions(-) diff --git a/src/generators/addons/aws/modules/core/iamUserAndGroup.ts b/src/generators/addons/aws/modules/core/iamUserAndGroup.ts index 7b7af950..62111ff7 100644 --- a/src/generators/addons/aws/modules/core/iamUserAndGroup.ts +++ b/src/generators/addons/aws/modules/core/iamUserAndGroup.ts @@ -15,8 +15,8 @@ const iamVariablesContent = dedent` type = list(string) } - variable "iam_bot_emails" { - description = "List of bot emails to provision IAM user account" + variable "iam_infra_service_account_emails" { + description = "List of infra service account emails to provision IAM user account" type = list(string) } @@ -43,35 +43,33 @@ const iamUsersModuleContent = dedent` usernames = var.iam_developer_emails } - module "iam_bot_users" { + module "iam_infra_service_account_users" { source = "../modules/iam_users" - usernames = var.iam_bot_emails + usernames = var.iam_infra_service_account_emails + has_login = false }`; const iamGroupMembershipModuleContent = dedent` - module "iam_admin_group_membership" { + module "iam_group_membership" { source = "../modules/iam_group_membership" - name = "admin-group-membership" - group = module.iam_groups.admin_group - users = var.iam_admin_emails - } - - module "iam_bot_group_membership" { - source = "../modules/iam_group_membership" - - name = "bot-group-membership" - group = module.iam_groups.bot_group - users = var.iam_bot_emails - } - - module "iam_developer_group_membership" { - source = "../modules/iam_group_membership" - - name = "developer-group-membership" - group = module.iam_groups.developer_group - users = var.iam_developer_emails + for_each = { + admin = { group = module.iam_groups.admin_group, users = var.iam_admin_emails }, + infra_service_account = { group = module.iam_groups.infra_service_account_group, users = var.iam_infra_service_account_emails }, + developer = { group = module.iam_groups.developer_group, users = var.iam_developer_emails } + } + + name = "\${each.key}-group-membership" + group = each.value.group + users = each.value.users + + depends_on = [ + module.iam_groups, + module.iam_admin_users, + module.iam_developer_users, + module.iam_infra_service_account_users, + ] }`; const iamOutputsContent = dedent` @@ -83,11 +81,6 @@ const iamOutputsContent = dedent` output "iam_developer_temporary_passwords" { description = "List of first time passwords for developer accounts. Must be changed at first time login and will no longer be valid." value = module.iam_developer_users.temporary_passwords - } - - output "iam_bot_temporary_passwords" { - description = "List of first time passwords for bot accounts. Must be changed at first time login and will no longer be valid." - value = module.iam_bot_users.temporary_passwords }`; const applyAwsIamUserAndGroup = async ({ projectName }: AwsOptions) => { diff --git a/templates/addons/aws/modules/iam_groups/data.tf b/templates/addons/aws/modules/iam_groups/data.tf index 512e5b54..a1e9a593 100644 --- a/templates/addons/aws/modules/iam_groups/data.tf +++ b/templates/addons/aws/modules/iam_groups/data.tf @@ -120,7 +120,7 @@ locals { ] }) - # For the bot account + # For the infra-service-account account # It must be able to manage policies during terraform apply & create/delete users, permissions, etc. during terraform apply full_iam_access_policy = jsonencode({ Version = "2012-10-17" diff --git a/templates/addons/aws/modules/iam_groups/main.tf b/templates/addons/aws/modules/iam_groups/main.tf index e3e04179..e4fc4a0b 100644 --- a/templates/addons/aws/modules/iam_groups/main.tf +++ b/templates/addons/aws/modules/iam_groups/main.tf @@ -4,8 +4,8 @@ resource "aws_iam_group" "admin" { } #tfsec:ignore:aws-iam-enforce-group-mfa -resource "aws_iam_group" "bot" { - name = "Bot-group" +resource "aws_iam_group" "infra-service-account" { + name = "Infra-service-account-group" } #tfsec:ignore:aws-iam-enforce-group-mfa @@ -30,15 +30,15 @@ resource "aws_iam_group_policy_attachment" "developer_power_user_access" { policy_arn = data.aws_iam_policy.power_user_access.arn } -resource "aws_iam_group_policy_attachment" "bot_power_user_access" { - group = aws_iam_group.bot.name +resource "aws_iam_group_policy_attachment" "infra_service_account_power_user_access" { + group = aws_iam_group.infra-service-account.name policy_arn = data.aws_iam_policy.power_user_access.arn } -# This IAM policy is needed for the bot account to manage IAM users & groups +# This IAM policy is needed for the infra-service-account account to manage IAM users & groups # tfsec:ignore:aws-iam-no-policy-wildcards -resource "aws_iam_group_policy" "bot_full_iam_access" { +resource "aws_iam_group_policy" "infra_service_account_full_iam_access" { name = "AllowFullIamAccess" - group = aws_iam_group.bot.name + group = aws_iam_group.infra-service-account.name policy = local.full_iam_access_policy } diff --git a/templates/addons/aws/modules/iam_groups/outputs.tf b/templates/addons/aws/modules/iam_groups/outputs.tf index 95166ff5..d851672d 100644 --- a/templates/addons/aws/modules/iam_groups/outputs.tf +++ b/templates/addons/aws/modules/iam_groups/outputs.tf @@ -8,7 +8,7 @@ output "developer_group" { value = aws_iam_group.developer.name } -output "bot_group" { - description = "IAM Group with bot permissions" - value = aws_iam_group.bot.name +output "infra_service_account_group" { + description = "IAM Group with infra-service-account permissions" + value = aws_iam_group.infra-service-account.name }