Skip to content

Commit 861c06d

Browse files
edersonbrilhanteedersonbrilhante
committed
chore(scale-set): restack docs and workflow changes
1 parent fb0c043 commit 861c06d

23 files changed

Lines changed: 166 additions & 1240 deletions

File tree

‎.github/dependabot.yml‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -100,6 +100,22 @@ updates:
100100
allow:
101101
- dependency-name: "ghcr.io/ministackorg/ministack"
102102

103+
- package-ecosystem: "docker"
104+
directory: "/lambdas/services/scale-set"
105+
schedule:
106+
interval: "weekly"
107+
cooldown:
108+
default-days: 7
109+
labels:
110+
- "dependencies"
111+
- "docker"
112+
commit-message:
113+
prefix: "chore(scale-set)"
114+
# Keep the service runtime aligned with the supported Node.js major.
115+
ignore:
116+
- dependency-name: "node"
117+
update-types: ["version-update:semver-major"]
118+
103119
- package-ecosystem: "pip"
104120
directory: "/.github/workflows/mkdocs"
105121
schedule:

‎.github/workflows/lambda.yml‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,21 +32,56 @@ jobs:
3232
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
3333
with:
3434
persist-credentials: false
35+
3536
- name: Install dependencies
3637
run: yarn install --frozen-lockfile
38+
3739
- name: Run prettier
3840
run: yarn format-check
41+
3942
- name: Run linter
4043
run: yarn lint
44+
4145
- name: Run tests
4246
id: test
4347
run: yarn test
48+
4449
- name: Build distribution
4550
run: yarn build
51+
4652
- name: Upload coverage report
4753
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
4854
if: ${{ failure() }}
4955
with:
5056
name: coverage-reports
5157
path: ./**/coverage
5258
retention-days: 5
59+
60+
scale-set-container:
61+
name: Build scale-set service container
62+
runs-on: ubuntu-latest
63+
steps:
64+
- name: Harden the runner (Audit all outbound calls)
65+
uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
66+
with:
67+
egress-policy: audit
68+
69+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
70+
with:
71+
persist-credentials: false
72+
73+
- name: Set up QEMU
74+
uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
75+
76+
- name: Set up Docker Buildx
77+
uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
78+
79+
- name: Build scale-set service image
80+
uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
81+
with:
82+
context: .
83+
file: ./lambdas/services/scale-set/Dockerfile
84+
platforms: linux/amd64,linux/arm64
85+
push: false
86+
cache-from: type=gha,scope=scale-set-service
87+
cache-to: type=gha,mode=max,scope=scale-set-service

‎.github/workflows/ministack.yml‎

Lines changed: 1 addition & 63 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,6 @@ on:
1111
- "policies/**"
1212
- "examples/**"
1313
- "modules/**"
14-
- "lambdas/**"
1514
pull_request:
1615
paths:
1716
- ".github/workflows/ministack.yml"
@@ -20,7 +19,6 @@ on:
2019
- "policies/**"
2120
- "examples/**"
2221
- "modules/**"
23-
- "lambdas/**"
2422
workflow_dispatch:
2523

2624
concurrency:
@@ -75,7 +73,7 @@ jobs:
7573
- termination-watcher
7674
services:
7775
ministack:
78-
image: ghcr.io/ministackorg/ministack:1.5.10@sha256:706b2b83c6be7e4f4dbb6a0dc28ffdebb500c6c80b64cf7938f45040fb2158e8
76+
image: ghcr.io/ministackorg/ministack:1.5.7@sha256:37361b9ef886463d5632d5a4b2d114da4b7a5c5793f52f07dbc72579f2fd9207
7977
ports:
8078
- 4566:4566
8179
env:
@@ -133,63 +131,3 @@ jobs:
133131
IAC_BINARY: ${{ matrix.iac.binary }}
134132
IAC_LOCK_FILE: ${{ matrix.iac.lockfile }}
135133
run: tests/ministack/run-example.sh destroy "$EXAMPLE"
136-
integration_smoke:
137-
name: Run webhook and pool lifecycle smoke test against MiniStack
138-
runs-on: ubuntu-latest
139-
timeout-minutes: 30
140-
services:
141-
ministack:
142-
image: ghcr.io/ministackorg/ministack:1.5.10@sha256:706b2b83c6be7e4f4dbb6a0dc28ffdebb500c6c80b64cf7938f45040fb2158e8
143-
ports:
144-
- 4566:4566
145-
options: --add-host=host.docker.internal:host-gateway
146-
env:
147-
MINISTACK_ACCOUNT_ID: "000000000000"
148-
MINISTACK_REGION: eu-west-1
149-
steps:
150-
- name: Harden the runner (Audit all outbound calls)
151-
uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
152-
with:
153-
egress-policy: audit
154-
155-
- name: Checkout
156-
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
157-
with:
158-
persist-credentials: false
159-
160-
- name: Setup Node.js
161-
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
162-
with:
163-
node-version-file: lambdas/.nvmrc
164-
package-manager-cache: false
165-
166-
- name: Setup Terraform
167-
uses: hashicorp/setup-terraform@dfe3c3f87815947d99a8997f908cb6525fc44e9e # v4.0.1
168-
with:
169-
terraform_version: latest
170-
terraform_wrapper: false
171-
172-
- name: Install Lambda dependencies
173-
working-directory: lambdas
174-
run: yarn install --frozen-lockfile
175-
176-
- name: Build smoke-test Lambda distributions
177-
working-directory: lambdas
178-
run: |
179-
yarn workspace @aws-github-runner/webhook dist
180-
yarn workspace @aws-github-runner/control-plane dist
181-
182-
- name: Start MockServer
183-
id: mockserver
184-
uses: mock-server/setup-mockserver@24612c2ccef1f83d587f331ed77cc5cef441e0b1 # v1.0.0
185-
with:
186-
version: '7.6.0@sha256:80b3b1a26f3553d0c81a3f3896b5b7274c17b2a2e52f0fd2b28e246bc9efa290'
187-
port: '1080'
188-
startup-timeout: '60'
189-
190-
- name: Run webhook and pool lifecycle smoke test
191-
env:
192-
MINISTACK_GITHUB_MOCK_HOST: host.docker.internal
193-
MINISTACK_GITHUB_MOCK_PORT: "1080"
194-
MINISTACK_GITHUB_MOCK_URL: ${{ steps.mockserver.outputs.url }}
195-
run: sh tests/ministack/run-smoke.sh

‎.github/workflows/release.yml‎

Lines changed: 70 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,7 @@
11
name: Release build
2+
env:
3+
SCALE_SET_IMAGE: ghcr.io/${{ github.repository_owner }}/terraform-aws-github-runner-scale-set-service
4+
25
on:
36
push:
47
branches:
@@ -21,6 +24,8 @@ jobs:
2124
actions: write # for release-please-action to trigger other workflows
2225
id-token: write # for actions/attest-build-provenance to generate attestations
2326
attestations: write # for actions/attest-build-provenance to write attestations
27+
artifact-metadata: write # for publishing linked container attestations
28+
packages: write # for publishing the scale-set service image to GHCR
2429
environment: release
2530
steps:
2631
- name: Harden the runner (Audit all outbound calls)
@@ -32,53 +37,113 @@ jobs:
3237
with:
3338
node-version: 24
3439
package-manager-cache: false
40+
3541
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
3642
with:
3743
persist-credentials: false
44+
3845
- name: Build dist
3946
working-directory: lambdas
4047
run: yarn install --frozen-lockfile && yarn run test && yarn dist
48+
4149
- name: Get installation token
4250
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
4351
id: token
4452
with:
4553
app-id: ${{ vars.RELEASER_APP_ID }}
4654
private-key: ${{ secrets.RELEASER_APP_PRIVATE_KEY }}
55+
4756
- name: Extract branch name
4857
id: branch
4958
shell: bash
5059
run: echo "name=${GITHUB_REF#refs/heads/}" >> $GITHUB_OUTPUT
60+
5161
- name: Release
5262
id: release
5363
uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5.0.0
5464
with:
5565
target-branch: ${{ steps.branch.outputs.name }}
5666
release-type: terraform-module
5767
token: ${{ steps.token.outputs.token }}
68+
69+
- name: Set up QEMU
70+
if: ${{ steps.release.outputs.releases_created == 'true' }}
71+
uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
72+
73+
- name: Set up Docker Buildx
74+
if: ${{ steps.release.outputs.releases_created == 'true' }}
75+
uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
76+
77+
- name: Log in to the GitHub Container Registry
78+
if: ${{ steps.release.outputs.releases_created == 'true' }}
79+
uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
80+
with:
81+
registry: ghcr.io
82+
username: ${{ github.actor }}
83+
password: ${{ secrets.GITHUB_TOKEN }}
84+
85+
- name: Build and publish scale-set service image
86+
if: ${{ steps.release.outputs.releases_created == 'true' }}
87+
id: scale-set-image
88+
uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
89+
with:
90+
context: .
91+
file: ./lambdas/services/scale-set/Dockerfile
92+
platforms: linux/amd64,linux/arm64
93+
push: true
94+
tags: |
95+
${{ env.SCALE_SET_IMAGE }}:${{ steps.release.outputs.tag_name }}
96+
${{ env.SCALE_SET_IMAGE }}:latest
97+
labels: |
98+
org.opencontainers.image.source=${{ github.server_url }}/${{ github.repository }}
99+
org.opencontainers.image.revision=${{ github.sha }}
100+
org.opencontainers.image.version=${{ steps.release.outputs.tag_name }}
101+
sbom: true
102+
provenance: mode=max
103+
cache-from: type=gha,scope=scale-set-service
104+
cache-to: type=gha,mode=max,scope=scale-set-service
105+
106+
- name: Attest scale-set service image
107+
if: ${{ steps.release.outputs.releases_created == 'true' }}
108+
id: scale-set-image-attest
109+
uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
110+
with:
111+
subject-name: ${{ env.SCALE_SET_IMAGE }}
112+
subject-digest: ${{ steps.scale-set-image.outputs.digest }}
113+
push-to-registry: true
114+
58115
- name: Attest
59116
if: ${{ steps.release.outputs.releases_created == 'true' }}
60117
id: attest
61118
uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
62119
with:
63120
subject-path: '${{ github.workspace }}/lambdas/functions/**/*.zip'
121+
64122
- name: Update release notes with attestation
65123
if: ${{ steps.release.outputs.releases_created == 'true' }}
66124
env:
67125
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
68-
VERSION: ${{ github.event.inputs.version }}
69126
TAG_NAME: ${{ steps.release.outputs.tag_name }}
70127
ATTESTATION_URL: ${{ steps.attest.outputs.attestation-url }}
128+
CONTAINER_ATTESTATION_URL: ${{ steps.scale-set-image-attest.outputs.attestation-url }}
129+
CONTAINER_IMAGE: ${{ env.SCALE_SET_IMAGE }}
130+
CONTAINER_DIGEST: ${{ steps.scale-set-image.outputs.digest }}
71131
REPOSITORY: ${{ github.repository }}
72132
run: |
73-
version="${VERSION}"
74133
tag_name="${TAG_NAME}"
75134
attestation_url="${ATTESTATION_URL}"
135+
container_attestation_url="${CONTAINER_ATTESTATION_URL}"
136+
container_image="${CONTAINER_IMAGE}"
137+
container_digest="${CONTAINER_DIGEST}"
76138
repository="${REPOSITORY}"
77-
gh release view $version --json body -q '.body' > new-release-notes.md
139+
gh release view "$tag_name" --json body -q '.body' > new-release-notes.md
78140
echo "## Attestation" >> new-release-notes.md
79141
echo "Attestation url: $attestation_url" >> new-release-notes.md
80142
echo "Verify the artifacts by running \`gh attestation verify <name_of_artifact> --repo ${repository}\`" >> new-release-notes.md
81-
gh release edit $tag_name -F new-release-notes.md -t $tag_name
143+
echo "Scale-set service image: \`${container_image}@${container_digest}\`" >> new-release-notes.md
144+
echo "Container attestation url: $container_attestation_url" >> new-release-notes.md
145+
gh release edit "$tag_name" -F new-release-notes.md -t "$tag_name"
146+
82147
- name: Upload release assets
83148
if: ${{ steps.release.outputs.releases_created == 'true' }}
84149
env:
@@ -89,6 +154,7 @@ jobs:
89154
for f in $(find . -name '*.zip'); do
90155
gh release upload $tag_name $f
91156
done
157+
92158
- name: Attach attestation
93159
if: ${{ steps.release.outputs.releases_created == 'true' }}
94160
env:

‎docs/security.md‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,14 @@ The examples are using standard AMI's for different operating systems. Instances
1414

1515
## Attestation
1616

17-
The module is released using GitHub actions and the lambda artifacts are attached to the release as attachment. During the release attestations are created. The attestations are created by the release pipeline. You find a link to the attestation in the GitHub release. The attestation only provides provenance information about the release. The attestations are not a security guarantee. We recommend you to verify the attestation after downloading the lambda artifacts.
17+
The module is released using GitHub Actions and the Lambda artifacts are attached to the release. The release pipeline creates provenance attestations for those artifacts. You can find a link to the attestation in the GitHub release. The attestation only provides provenance information about the release; it is not a security guarantee. We recommend verifying the attestation after downloading the Lambda artifacts.
18+
19+
Releases also publish the multi-architecture scale-set service image to the GitHub Container Registry with an SBOM, build provenance, and a registry attestation. The convenience image default follows the latest module release. Production deployments should override it with the immutable image digest printed in the release notes, then verify that image with:
20+
21+
```bash
22+
gh attestation verify \
23+
oci://ghcr.io/github-aws-runners/terraform-aws-github-runner-scale-set-service@sha256:<digest> \
24+
--repo github-aws-runners/terraform-aws-github-runner
25+
```
1826

1927
--8<-- "SECURITY.md:mkdocsrunners"

0 commit comments

Comments
 (0)