Skip to content
Deploy Cloud CA

Merge pull request #35 from serverless-ca/update-ca #74

Sign in to view logs

Merge pull request #35 from serverless-ca/update-ca

Merge pull request #35 from serverless-ca/update-ca #74

Workflow file for this run

.github/workflows/deploy.yml at 45b6875
name: Deploy Cloud CA
on:
workflow_dispatch:
push:
paths:
- "**/*.py"
- "**/*.tf"
- ".github/workflows/deploy.yml"
branches:
- main
env:
TF_VAR_cloud_app_sso_arn: ${{ secrets.CLOUD_APP_SSO_ARN }} # delete if not needed
TF_VAR_cloud_app_user_arn: ${{ secrets.CLOUD_APP_USER_ARN }} # delete if not needed
TF_VAR_elb_service_role_arn: ${{ secrets.ELB_SERVICE_ROLE_ARN }} # delete if not needed
permissions:
contents: read
jobs:
terraform_validate:
name: Terraform validate
runs-on: ubuntu-latest
permissions:
id-token: write
contents: read
checks: write
steps:
- name: Harden the runner (Audit all outbound calls)
uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
with:
egress-policy: audit
- name: Terraform setup
uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3.1.2
with:
terraform_version: 1.12.2
- name: Checkout
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
- name: Terraform format
run: terraform fmt -check -recursive
- name: Terraform init
run: terraform init -get -backend=false -input=false
- name: Terraform validate
run: terraform validate
secret_scan:
name: Secret scan
runs-on: ubuntu-latest
steps:
- name: Harden the runner (Audit all outbound calls)
uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
with:
egress-policy: audit
- name: Checkout code
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
- name: Install GitLeaks
run: |
wget https://github.com/gitleaks/gitleaks/releases/download/v8.16.1/gitleaks_8.16.1_linux_x64.tar.gz && \
tar -xf gitleaks_8.16.1_linux_x64.tar.gz
sudo mv gitleaks /usr/local/bin/gitleaks && \
sudo chmod +x /usr/local/bin/gitleaks
- name: Run GitLeaks Scan
run: |
gitleaks detect --source . -v
terraform_plan_apply:
name: Terraform plan & apply
runs-on: ubuntu-latest
environment: 'cloudca'
needs:
- terraform_validate
- secret_scan
permissions:
id-token: write
contents: read
pull-requests: read
checks: write
steps:
- name: Harden the runner (Audit all outbound calls)
uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
with:
egress-policy: audit
- name: Terraform setup
uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3.1.2
with:
terraform_version: 1.12.2
- name: Checkout
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
- name: Set up Python 3.14
id: setup_python
uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
with:
python-version: '3.14'
- name: Display Python version
run: python -c "import sys; print(sys.version)"
- name: Install virtualenv
run: pip install virtualenv
- name: Configure AWS Credentials
uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4.0.2
with:
role-to-assume: ${{ secrets.AWS_DEPLOY_ROLE_ARN}}
aws-region: ${{ secrets.AWS_REGION }}
- name: Terraform initialise
run: >
terraform init
-backend-config=bucket=${{ secrets.TERRAFORM_STATE_BUCKET}}
-backend-config=key=${{ secrets.TERRAFORM_STATE_KEY}}
-backend-config=region=${{ secrets.TERRAFORM_STATE_REGION}}
- name: Cache built python modules
uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
with:
key: modules_terraform-aws-ca-lambda_build_${{ hashFiles('./.terraform/modules/certificate_authority/modules/terraform-aws-ca-lambda/lambda_code/**') }}_${{ hashFiles('./.terraform/modules/certificate_authority/modules/terraform-aws-ca-lambda/utils/**') }}_${{ github.job }}_py${{ steps.setup_python.outputs.python-version }}
path: ./.terraform/modules/certificate_authority/modules/terraform-aws-ca-lambda/build
- name: Terraform plan
run: terraform plan -out tfplan
- name: Terraform apply
run: terraform apply -auto-approve tfplan
start_ca:
name: Start CA
runs-on: ubuntu-latest
needs:
- terraform_plan_apply
permissions:
id-token: write
contents: read
checks: write
steps:
- name: Harden the runner (Audit all outbound calls)
uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
with:
egress-policy: audit
- name: checkout
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
- name: Set up Python 3.14
uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
with:
python-version: "3.14"
- name: Display Python version
run: python -c "import sys; print(sys.version)"
- name: Install dependencies
run: |
pip install -r scripts/requirements.txt
- name: Configure AWS Credentials - Dev
uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4.0.2
with:
role-to-assume: ${{ secrets.AWS_DEPLOY_ROLE_ARN}}
aws-region: ${{ secrets.AWS_REGION }}
- name: Start CA
run: |
python scripts/start_ca_step_function.py
integration_tests:
name: Integration Tests
runs-on: ubuntu-latest
needs: start_ca
permissions:
id-token: write
contents: read
checks: write
steps:
- name: Harden the runner (Audit all outbound calls)
uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
with:
egress-policy: audit
- name: Checkout
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
- name: Set up Python 3.14
uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
with:
python-version: "3.14"
- name: Install dependencies
run: |
pip install -r requirements-dev.txt
- name: Configure AWS Credentials - Dev
uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4.0.2
with:
role-to-assume: ${{ secrets.AWS_DEPLOY_ROLE_ARN}}
aws-region: ${{ secrets.AWS_REGION }}
- name: Integration tests
run: |
pytest -v tests