Skip to content

Commit 27167b3

Browse files
gontzessgontzess
authored
Derive shortened release role names (#86)
## Why The reusable connector release workflow assumes artifact and ECR push roles whose names are derived from repository names. Long connector repository names can exceed the AWS IAM 64-character role-name limit, so the workflow needs to derive the same shortened names that ops creates. ## What this changes Adds a checked-in helper script for deterministic IAM role-name derivation and uses it before AWS role assumption in the standard release jobs. Existing short names are unchanged; over-limit names keep the first 55 characters plus an 8-character SHA-256 prefix. Cross-review follow-up added expanded golden vectors and sets `LC_ALL=C` so bash length and slicing semantics match the Go implementations byte-for-byte. ## Validation - `make test` - `yq "." .github/workflows/release.yaml >/dev/null` - `git diff --check` ## Merge order Merge with `ductone/ops#7767` and `ConductorOne/github-axiomatic-workflows#1` before relying on shortened names for long connector repositories.
1 parent fd88b3f commit 27167b3

4 files changed

Lines changed: 186 additions & 6 deletions

File tree

‎.github/workflows/release.yaml‎

Lines changed: 62 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -204,6 +204,19 @@ jobs:
204204
ref: ${{ needs.determine-workflows-ref.outputs.ref }}
205205
persist-credentials: false
206206

207+
- name: Derive AWS role names
208+
id: role-names
209+
working-directory: _workflows
210+
shell: bash
211+
env:
212+
REPO_OWNER: ${{ github.event.repository.owner.login }}
213+
REPO_NAME: ${{ github.event.repository.name }}
214+
run: |
215+
bash ./scripts/derive-iam-role-name.sh \
216+
--prefix GHA-Artifacts- \
217+
--suffix "${REPO_OWNER}-${REPO_NAME}" \
218+
--output-name gha_artifacts_role_name >> "$GITHUB_OUTPUT"
219+
207220
- name: Set up Go for caller
208221
uses: actions/setup-go@v6
209222
with:
@@ -256,7 +269,7 @@ jobs:
256269
- name: Configure AWS credentials via OIDC
257270
uses: aws-actions/configure-aws-credentials@v5
258271
with:
259-
role-to-assume: arn:aws:iam::025044153841:role/GHA-Artifacts-${{ github.event.repository.owner.login }}-${{ github.event.repository.name }}
272+
role-to-assume: arn:aws:iam::025044153841:role/${{ steps.role-names.outputs.gha_artifacts_role_name }}
260273
aws-region: us-west-2
261274

262275
- name: Run GoReleaser
@@ -472,6 +485,19 @@ jobs:
472485
ref: ${{ needs.determine-workflows-ref.outputs.ref }}
473486
persist-credentials: false
474487

488+
- name: Derive AWS role names
489+
id: role-names
490+
working-directory: _workflows
491+
shell: bash
492+
env:
493+
REPO_OWNER: ${{ github.event.repository.owner.login }}
494+
REPO_NAME: ${{ github.event.repository.name }}
495+
run: |
496+
bash ./scripts/derive-iam-role-name.sh \
497+
--prefix GHA-Artifacts- \
498+
--suffix "${REPO_OWNER}-${REPO_NAME}" \
499+
--output-name gha_artifacts_role_name >> "$GITHUB_OUTPUT"
500+
475501
- name: Set up Go for caller
476502
uses: actions/setup-go@v6
477503
with:
@@ -639,7 +665,7 @@ jobs:
639665
- name: Configure AWS credentials via OIDC
640666
uses: aws-actions/configure-aws-credentials@v5
641667
with:
642-
role-to-assume: arn:aws:iam::025044153841:role/GHA-Artifacts-${{ github.event.repository.owner.login }}-${{ github.event.repository.name }}
668+
role-to-assume: arn:aws:iam::025044153841:role/${{ steps.role-names.outputs.gha_artifacts_role_name }}
643669
aws-region: us-west-2
644670

645671
- name: Calculate S3 directory
@@ -781,6 +807,24 @@ jobs:
781807
ref: ${{ needs.determine-workflows-ref.outputs.ref }}
782808
persist-credentials: false
783809

810+
- name: Derive AWS role names
811+
id: role-names
812+
if: inputs.docker == true || inputs.lambda == true
813+
working-directory: _workflows
814+
shell: bash
815+
env:
816+
REPO_OWNER: ${{ github.event.repository.owner.login }}
817+
REPO_NAME: ${{ github.event.repository.name }}
818+
run: |
819+
bash ./scripts/derive-iam-role-name.sh \
820+
--prefix GHA-Artifacts- \
821+
--suffix "${REPO_OWNER}-${REPO_NAME}" \
822+
--output-name gha_artifacts_role_name >> "$GITHUB_OUTPUT"
823+
bash ./scripts/derive-iam-role-name.sh \
824+
--prefix GitHubActionsECRPushRole- \
825+
--suffix "${REPO_NAME}" \
826+
--output-name ecr_push_role_name >> "$GITHUB_OUTPUT"
827+
784828
- name: Set up Go for caller
785829
if: inputs.docker == true || inputs.lambda == true
786830
uses: actions/setup-go@v6
@@ -875,7 +919,7 @@ jobs:
875919
if: inputs.docker == true
876920
uses: aws-actions/configure-aws-credentials@v5
877921
with:
878-
role-to-assume: arn:aws:iam::025044153841:role/GHA-Artifacts-${{ github.event.repository.owner.login }}-${{ github.event.repository.name }}
922+
role-to-assume: arn:aws:iam::025044153841:role/${{ steps.role-names.outputs.gha_artifacts_role_name }}
879923
aws-region: us-east-1
880924

881925
- name: Login to Public ECR
@@ -899,7 +943,7 @@ jobs:
899943
if: inputs.lambda == true
900944
uses: aws-actions/configure-aws-credentials@v5
901945
with:
902-
role-to-assume: "arn:aws:iam::168442440833:role/GitHubActionsECRPushRole-${{ github.event.repository.name }}"
946+
role-to-assume: "arn:aws:iam::168442440833:role/${{ steps.role-names.outputs.ecr_push_role_name }}"
903947
aws-region: us-west-2
904948

905949
- name: Login to Lambda ECR
@@ -1015,6 +1059,19 @@ jobs:
10151059
ref: ${{ needs.determine-workflows-ref.outputs.ref }}
10161060
persist-credentials: false
10171061

1062+
- name: Derive AWS role names
1063+
id: role-names
1064+
working-directory: _workflows
1065+
shell: bash
1066+
env:
1067+
REPO_OWNER: ${{ github.event.repository.owner.login }}
1068+
REPO_NAME: ${{ github.event.repository.name }}
1069+
run: |
1070+
bash ./scripts/derive-iam-role-name.sh \
1071+
--prefix GHA-Artifacts- \
1072+
--suffix "${REPO_OWNER}-${REPO_NAME}" \
1073+
--output-name gha_artifacts_role_name >> "$GITHUB_OUTPUT"
1074+
10181075
- name: Set up Go for workflows
10191076
uses: actions/setup-go@v6
10201077
with:
@@ -1042,7 +1099,7 @@ jobs:
10421099
- name: Configure AWS credentials via OIDC
10431100
uses: aws-actions/configure-aws-credentials@v5
10441101
with:
1045-
role-to-assume: arn:aws:iam::025044153841:role/GHA-Artifacts-${{ github.event.repository.owner.login }}-${{ github.event.repository.name }}
1102+
role-to-assume: arn:aws:iam::025044153841:role/${{ steps.role-names.outputs.gha_artifacts_role_name }}
10461103
aws-region: us-west-2
10471104

10481105
- name: Create unified checksums file

‎Makefile‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,9 +10,16 @@ protofmt:
1010
@echo "Protobuf formatting complete."
1111

1212
.PHONY: test
13-
test:
13+
test: test-go test-scripts
14+
15+
.PHONY: test-go
16+
test-go:
1417
go test ./cmd/record-release ./cmd/generate-manifest ./cmd/merge-manifests
1518

19+
.PHONY: test-scripts
20+
test-scripts:
21+
bash scripts/test-derive-iam-role-name.sh
22+
1623
.PHONY: workflow-validate
1724
workflow-validate:
1825
yq '.' .github/workflows/release.yaml >/dev/null

‎scripts/derive-iam-role-name.sh‎

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
#!/usr/bin/env bash
2+
set -euo pipefail
3+
export LC_ALL=C
4+
5+
iam_role_name_max_length=64
6+
iam_role_name_hash_length=8
7+
8+
usage() {
9+
echo "usage: derive-iam-role-name.sh --prefix PREFIX --suffix SUFFIX --output-name NAME" >&2
10+
}
11+
12+
prefix=""
13+
suffix=""
14+
output_name="iam_role_name"
15+
16+
while [ "$#" -gt 0 ]; do
17+
case "$1" in
18+
--prefix)
19+
prefix="${2:-}"
20+
shift 2
21+
;;
22+
--suffix)
23+
suffix="${2:-}"
24+
shift 2
25+
;;
26+
--output-name)
27+
output_name="${2:-}"
28+
shift 2
29+
;;
30+
-h | --help)
31+
usage
32+
exit 0
33+
;;
34+
*)
35+
usage
36+
echo "unknown argument: $1" >&2
37+
exit 2
38+
;;
39+
esac
40+
done
41+
42+
if [ -z "$prefix" ] || [ -z "$suffix" ] || [ -z "$output_name" ]; then
43+
usage
44+
echo "prefix, suffix, and output-name are required" >&2
45+
exit 2
46+
fi
47+
48+
if [[ ! "$output_name" =~ ^[A-Za-z_][A-Za-z0-9_]*$ ]]; then
49+
echo "output-name must be a safe GitHub output key" >&2
50+
exit 2
51+
fi
52+
53+
role_name="${prefix}${suffix}"
54+
if [ "${#role_name}" -gt "$iam_role_name_max_length" ]; then
55+
if command -v shasum >/dev/null 2>&1; then
56+
hash_output="$(printf '%s' "$role_name" | shasum -a 256)"
57+
elif command -v sha256sum >/dev/null 2>&1; then
58+
hash_output="$(printf '%s' "$role_name" | sha256sum)"
59+
else
60+
echo "shasum or sha256sum is required" >&2
61+
exit 1
62+
fi
63+
hash="${hash_output%% *}"
64+
hash="${hash:0:$iam_role_name_hash_length}"
65+
keep=$((iam_role_name_max_length - iam_role_name_hash_length - 1))
66+
role_name="${role_name:0:$keep}-${hash}"
67+
fi
68+
69+
printf '%s=%s\n' "$output_name" "$role_name"

‎scripts/test-derive-iam-role-name.sh‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
#!/usr/bin/env bash
2+
set -euo pipefail
3+
4+
script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
5+
script="${script_dir}/derive-iam-role-name.sh"
6+
7+
assert_output() {
8+
local want="$1"
9+
shift
10+
local got
11+
got="$(bash "$script" "$@")"
12+
if [ "$got" != "$want" ]; then
13+
echo "got: $got" >&2
14+
echo "want: $want" >&2
15+
exit 1
16+
fi
17+
}
18+
19+
assert_output \
20+
"gha_artifacts_role_name=GHA-Artifacts-ConductorOne-baton-axiomatic-jira" \
21+
--prefix GHA-Artifacts- \
22+
--suffix ConductorOne-baton-axiomatic-jira \
23+
--output-name gha_artifacts_role_name
24+
25+
assert_output \
26+
"gha_artifacts_role_name=GHA-Artifacts-ConductorOne-baton-axiomatic-github-enter-f6552060" \
27+
--prefix GHA-Artifacts- \
28+
--suffix ConductorOne-baton-axiomatic-github-enterprise-cloud \
29+
--output-name gha_artifacts_role_name
30+
31+
assert_output \
32+
"gha_artifacts_role_name=GHA-Artifacts-ConductorOne-baton-axiomatic-github-enter-571914a9" \
33+
--prefix GHA-Artifacts- \
34+
--suffix ConductorOne-baton-axiomatic-github-enterprise-cloud-extra-long-name \
35+
--output-name gha_artifacts_role_name
36+
37+
assert_output \
38+
"ecr_push_role_name=GitHubActionsECRPushRole-baton-axiomatic-github-enterprise-cloud" \
39+
--prefix GitHubActionsECRPushRole- \
40+
--suffix baton-axiomatic-github-enterprise-cloud \
41+
--output-name ecr_push_role_name
42+
43+
assert_output \
44+
"ecr_push_role_name=GitHubActionsECRPushRole-baton-axiomatic-github-enterpr-302f51c5" \
45+
--prefix GitHubActionsECRPushRole- \
46+
--suffix baton-axiomatic-github-enterprise-cloud-extra \
47+
--output-name ecr_push_role_name

0 commit comments

Comments
 (0)