Skip to content

Commit 0381711

Browse files
gontzessgontzess
committed
Derive shortened release role names
1 parent fd88b3f commit 0381711

4 files changed

Lines changed: 173 additions & 6 deletions

File tree

‎.github/workflows/release.yaml‎

Lines changed: 62 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -204,6 +204,19 @@ jobs:
204204
ref: ${{ needs.determine-workflows-ref.outputs.ref }}
205205
persist-credentials: false
206206

207+
- name: Derive AWS role names
208+
id: role-names
209+
working-directory: _workflows
210+
shell: bash
211+
env:
212+
REPO_OWNER: ${{ github.event.repository.owner.login }}
213+
REPO_NAME: ${{ github.event.repository.name }}
214+
run: |
215+
bash ./scripts/derive-iam-role-name.sh \
216+
--prefix GHA-Artifacts- \
217+
--suffix "${REPO_OWNER}-${REPO_NAME}" \
218+
--output-name gha_artifacts_role_name >> "$GITHUB_OUTPUT"
219+
207220
- name: Set up Go for caller
208221
uses: actions/setup-go@v6
209222
with:
@@ -256,7 +269,7 @@ jobs:
256269
- name: Configure AWS credentials via OIDC
257270
uses: aws-actions/configure-aws-credentials@v5
258271
with:
259-
role-to-assume: arn:aws:iam::025044153841:role/GHA-Artifacts-${{ github.event.repository.owner.login }}-${{ github.event.repository.name }}
272+
role-to-assume: arn:aws:iam::025044153841:role/${{ steps.role-names.outputs.gha_artifacts_role_name }}
260273
aws-region: us-west-2
261274

262275
- name: Run GoReleaser
@@ -472,6 +485,19 @@ jobs:
472485
ref: ${{ needs.determine-workflows-ref.outputs.ref }}
473486
persist-credentials: false
474487

488+
- name: Derive AWS role names
489+
id: role-names
490+
working-directory: _workflows
491+
shell: bash
492+
env:
493+
REPO_OWNER: ${{ github.event.repository.owner.login }}
494+
REPO_NAME: ${{ github.event.repository.name }}
495+
run: |
496+
bash ./scripts/derive-iam-role-name.sh \
497+
--prefix GHA-Artifacts- \
498+
--suffix "${REPO_OWNER}-${REPO_NAME}" \
499+
--output-name gha_artifacts_role_name >> "$GITHUB_OUTPUT"
500+
475501
- name: Set up Go for caller
476502
uses: actions/setup-go@v6
477503
with:
@@ -639,7 +665,7 @@ jobs:
639665
- name: Configure AWS credentials via OIDC
640666
uses: aws-actions/configure-aws-credentials@v5
641667
with:
642-
role-to-assume: arn:aws:iam::025044153841:role/GHA-Artifacts-${{ github.event.repository.owner.login }}-${{ github.event.repository.name }}
668+
role-to-assume: arn:aws:iam::025044153841:role/${{ steps.role-names.outputs.gha_artifacts_role_name }}
643669
aws-region: us-west-2
644670

645671
- name: Calculate S3 directory
@@ -781,6 +807,24 @@ jobs:
781807
ref: ${{ needs.determine-workflows-ref.outputs.ref }}
782808
persist-credentials: false
783809

810+
- name: Derive AWS role names
811+
id: role-names
812+
if: inputs.docker == true || inputs.lambda == true
813+
working-directory: _workflows
814+
shell: bash
815+
env:
816+
REPO_OWNER: ${{ github.event.repository.owner.login }}
817+
REPO_NAME: ${{ github.event.repository.name }}
818+
run: |
819+
bash ./scripts/derive-iam-role-name.sh \
820+
--prefix GHA-Artifacts- \
821+
--suffix "${REPO_OWNER}-${REPO_NAME}" \
822+
--output-name gha_artifacts_role_name >> "$GITHUB_OUTPUT"
823+
bash ./scripts/derive-iam-role-name.sh \
824+
--prefix GitHubActionsECRPushRole- \
825+
--suffix "${REPO_NAME}" \
826+
--output-name ecr_push_role_name >> "$GITHUB_OUTPUT"
827+
784828
- name: Set up Go for caller
785829
if: inputs.docker == true || inputs.lambda == true
786830
uses: actions/setup-go@v6
@@ -875,7 +919,7 @@ jobs:
875919
if: inputs.docker == true
876920
uses: aws-actions/configure-aws-credentials@v5
877921
with:
878-
role-to-assume: arn:aws:iam::025044153841:role/GHA-Artifacts-${{ github.event.repository.owner.login }}-${{ github.event.repository.name }}
922+
role-to-assume: arn:aws:iam::025044153841:role/${{ steps.role-names.outputs.gha_artifacts_role_name }}
879923
aws-region: us-east-1
880924

881925
- name: Login to Public ECR
@@ -899,7 +943,7 @@ jobs:
899943
if: inputs.lambda == true
900944
uses: aws-actions/configure-aws-credentials@v5
901945
with:
902-
role-to-assume: "arn:aws:iam::168442440833:role/GitHubActionsECRPushRole-${{ github.event.repository.name }}"
946+
role-to-assume: "arn:aws:iam::168442440833:role/${{ steps.role-names.outputs.ecr_push_role_name }}"
903947
aws-region: us-west-2
904948

905949
- name: Login to Lambda ECR
@@ -1015,6 +1059,19 @@ jobs:
10151059
ref: ${{ needs.determine-workflows-ref.outputs.ref }}
10161060
persist-credentials: false
10171061

1062+
- name: Derive AWS role names
1063+
id: role-names
1064+
working-directory: _workflows
1065+
shell: bash
1066+
env:
1067+
REPO_OWNER: ${{ github.event.repository.owner.login }}
1068+
REPO_NAME: ${{ github.event.repository.name }}
1069+
run: |
1070+
bash ./scripts/derive-iam-role-name.sh \
1071+
--prefix GHA-Artifacts- \
1072+
--suffix "${REPO_OWNER}-${REPO_NAME}" \
1073+
--output-name gha_artifacts_role_name >> "$GITHUB_OUTPUT"
1074+
10181075
- name: Set up Go for workflows
10191076
uses: actions/setup-go@v6
10201077
with:
@@ -1042,7 +1099,7 @@ jobs:
10421099
- name: Configure AWS credentials via OIDC
10431100
uses: aws-actions/configure-aws-credentials@v5
10441101
with:
1045-
role-to-assume: arn:aws:iam::025044153841:role/GHA-Artifacts-${{ github.event.repository.owner.login }}-${{ github.event.repository.name }}
1102+
role-to-assume: arn:aws:iam::025044153841:role/${{ steps.role-names.outputs.gha_artifacts_role_name }}
10461103
aws-region: us-west-2
10471104

10481105
- name: Create unified checksums file

‎Makefile‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,9 +10,16 @@ protofmt:
1010
@echo "Protobuf formatting complete."
1111

1212
.PHONY: test
13-
test:
13+
test: test-go test-scripts
14+
15+
.PHONY: test-go
16+
test-go:
1417
go test ./cmd/record-release ./cmd/generate-manifest ./cmd/merge-manifests
1518

19+
.PHONY: test-scripts
20+
test-scripts:
21+
bash scripts/test-derive-iam-role-name.sh
22+
1623
.PHONY: workflow-validate
1724
workflow-validate:
1825
yq '.' .github/workflows/release.yaml >/dev/null

‎scripts/derive-iam-role-name.sh‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
#!/usr/bin/env bash
2+
set -euo pipefail
3+
4+
iam_role_name_max_length=64
5+
iam_role_name_hash_length=8
6+
7+
usage() {
8+
echo "usage: derive-iam-role-name.sh --prefix PREFIX --suffix SUFFIX --output-name NAME" >&2
9+
}
10+
11+
prefix=""
12+
suffix=""
13+
output_name="iam_role_name"
14+
15+
while [ "$#" -gt 0 ]; do
16+
case "$1" in
17+
--prefix)
18+
prefix="${2:-}"
19+
shift 2
20+
;;
21+
--suffix)
22+
suffix="${2:-}"
23+
shift 2
24+
;;
25+
--output-name)
26+
output_name="${2:-}"
27+
shift 2
28+
;;
29+
-h | --help)
30+
usage
31+
exit 0
32+
;;
33+
*)
34+
usage
35+
echo "unknown argument: $1" >&2
36+
exit 2
37+
;;
38+
esac
39+
done
40+
41+
if [ -z "$prefix" ] || [ -z "$suffix" ] || [ -z "$output_name" ]; then
42+
usage
43+
echo "prefix, suffix, and output-name are required" >&2
44+
exit 2
45+
fi
46+
47+
if [[ ! "$output_name" =~ ^[A-Za-z_][A-Za-z0-9_]*$ ]]; then
48+
echo "output-name must be a safe GitHub output key" >&2
49+
exit 2
50+
fi
51+
52+
role_name="${prefix}${suffix}"
53+
if [ "${#role_name}" -gt "$iam_role_name_max_length" ]; then
54+
if command -v shasum >/dev/null 2>&1; then
55+
hash_output="$(printf '%s' "$role_name" | shasum -a 256)"
56+
elif command -v sha256sum >/dev/null 2>&1; then
57+
hash_output="$(printf '%s' "$role_name" | sha256sum)"
58+
else
59+
echo "shasum or sha256sum is required" >&2
60+
exit 1
61+
fi
62+
hash="${hash_output%% *}"
63+
hash="${hash:0:$iam_role_name_hash_length}"
64+
keep=$((iam_role_name_max_length - iam_role_name_hash_length - 1))
65+
role_name="${role_name:0:$keep}-${hash}"
66+
fi
67+
68+
printf '%s=%s\n' "$output_name" "$role_name"

‎scripts/test-derive-iam-role-name.sh‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
#!/usr/bin/env bash
2+
set -euo pipefail
3+
4+
script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
5+
script="${script_dir}/derive-iam-role-name.sh"
6+
7+
assert_output() {
8+
local want="$1"
9+
shift
10+
local got
11+
got="$(bash "$script" "$@")"
12+
if [ "$got" != "$want" ]; then
13+
echo "got: $got" >&2
14+
echo "want: $want" >&2
15+
exit 1
16+
fi
17+
}
18+
19+
assert_output \
20+
"gha_artifacts_role_name=GHA-Artifacts-ConductorOne-baton-axiomatic-jira" \
21+
--prefix GHA-Artifacts- \
22+
--suffix ConductorOne-baton-axiomatic-jira \
23+
--output-name gha_artifacts_role_name
24+
25+
assert_output \
26+
"gha_artifacts_role_name=GHA-Artifacts-ConductorOne-baton-axiomatic-github-enter-f6552060" \
27+
--prefix GHA-Artifacts- \
28+
--suffix ConductorOne-baton-axiomatic-github-enterprise-cloud \
29+
--output-name gha_artifacts_role_name
30+
31+
assert_output \
32+
"ecr_push_role_name=GitHubActionsECRPushRole-baton-axiomatic-github-enterprise-cloud" \
33+
--prefix GitHubActionsECRPushRole- \
34+
--suffix baton-axiomatic-github-enterprise-cloud \
35+
--output-name ecr_push_role_name

0 commit comments

Comments
 (0)