Skip to content

Commit 97221af

Browse files
sthulbleandrodamascenaSimon Thulbourn
authored
feat(ci): GovCloud Layer Workflow (#5261)
* feat(ci): GovCloud Layer Workflow Signed-off-by: Simon Thulbourn <[email protected]> * add description * Add metadata and checks - checks SHA256 against expected - sets metadata for layer * set correct arch types * remove env prefix from layer name * fix description * verify sha after upload --------- Signed-off-by: Simon Thulbourn <[email protected]> Co-authored-by: Leandro Damascena <[email protected]> Co-authored-by: Simon Thulbourn <sthulb@@users.noreply.github.com>
1 parent 96df2f7 commit 97221af

File tree

1 file changed

+203
-0
lines changed

1 file changed

+203
-0
lines changed

Diff for: ‎.github/workflows/layer_govcloud.yml

+203
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,203 @@
1+
# GovCloud Layer Publish
2+
# ---
3+
# This workflow publishes a specific layer version in an AWS account based on the environment input.
4+
#
5+
# Using a matrix, we pull each architecture and python version of the layer and store them as artifacts
6+
# we upload them to each of the GovCloud AWS accounts.
7+
#
8+
# A number of safety checks are performed to ensure safety.
9+
10+
on:
11+
workflow_dispatch:
12+
inputs:
13+
environment:
14+
description: Deployment environment
15+
type: choice
16+
options:
17+
- Gamma
18+
- Prod
19+
default: Gamma
20+
required: true
21+
version:
22+
description: Layer version to duplicate
23+
type: number
24+
required: true
25+
workflow_call:
26+
inputs:
27+
environment:
28+
description: Deployment environment
29+
type: string
30+
default: Gamma
31+
required: true
32+
version:
33+
description: Layer version to duplicate
34+
type: number
35+
required: true
36+
37+
name: Layer Deployment (GovCloud)
38+
run-name: Layer Deployment (GovCloud) - ${{ inputs.environment }}
39+
40+
jobs:
41+
download:
42+
runs-on: ubuntu-latest
43+
permissions:
44+
id-token: write
45+
contents: read
46+
strategy:
47+
matrix:
48+
layer:
49+
- AWSLambdaPowertoolsPythonV3-python38
50+
- AWSLambdaPowertoolsPythonV3-python39
51+
- AWSLambdaPowertoolsPythonV3-python310
52+
- AWSLambdaPowertoolsPythonV3-python311
53+
- AWSLambdaPowertoolsPythonV3-python312
54+
arch:
55+
- arm64
56+
- x86_64
57+
environment: Prod (Readonly)
58+
steps:
59+
- name: Configure AWS Credentials
60+
uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4.0.2
61+
with:
62+
role-to-assume: ${{ secrets.AWS_IAM_ROLE }}
63+
aws-region: us-east-1
64+
mask-aws-account-id: true
65+
- name: Grab Zip
66+
run: |
67+
aws --region us-east-1 lambda get-layer-version-by-arn --arn arn:aws:lambda:us-east-1:017000801446:layer:${{ matrix.layer }}-${{ matrix.arch }}:${{ inputs.version }} --query 'Content.Location' | xargs curl -L -o ${{ matrix.layer }}_${{ matrix.arch }}.zip
68+
aws --region us-east-1 lambda get-layer-version-by-arn --arn arn:aws:lambda:us-east-1:017000801446:layer:${{ matrix.layer }}-${{ matrix.arch }}:${{ inputs.version }} > ${{ matrix.layer }}_${{ matrix.arch }}.json
69+
- name: Store Zip
70+
uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4.4.0
71+
with:
72+
name: ${{ matrix.layer }}_${{ matrix.arch }}.zip
73+
path: ${{ matrix.layer }}_${{ matrix.arch }}.zip
74+
retention-days: 1
75+
if-no-files-found: error
76+
- name: Store Metadata
77+
uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4.4.0
78+
with:
79+
name: ${{ matrix.layer }}_${{ matrix.arch }}.json
80+
path: ${{ matrix.layer }}_${{ matrix.arch }}.json
81+
retention-days: 1
82+
if-no-files-found: error
83+
84+
copy_east:
85+
name: Copy (East)
86+
needs: download
87+
runs-on: ubuntu-latest
88+
permissions:
89+
id-token: write
90+
contents: read
91+
strategy:
92+
matrix:
93+
layer:
94+
- AWSLambdaPowertoolsPythonV3-python38
95+
- AWSLambdaPowertoolsPythonV3-python39
96+
- AWSLambdaPowertoolsPythonV3-python310
97+
- AWSLambdaPowertoolsPythonV3-python311
98+
- AWSLambdaPowertoolsPythonV3-python312
99+
arch:
100+
- arm64
101+
- x86_64
102+
environment: GovCloud ${{ inputs.environment }} (East)
103+
steps:
104+
- name: Download Zip
105+
uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
106+
with:
107+
name: ${{ matrix.layer }}_${{ matrix.arch }}.zip
108+
- name: Download Metadata
109+
uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
110+
with:
111+
name: ${{ matrix.layer }}_${{ matrix.arch }}.json
112+
- name: Verify Layer Signature
113+
run: |
114+
SHA=$(jq -r '.Content.CodeSha256' ${{ matrix.layer }}_${{ matrix.arch }}.json)
115+
test $(openssl dgst -sha256 -binary ${{ matrix.layer }}_${{ matrix.arch }}.zip | openssl enc -base64) == $SHA && echo "SHA OK: ${SHA}" || exit 1
116+
- name: Configure AWS Credentials
117+
uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4.0.2
118+
with:
119+
role-to-assume: ${{ secrets.AWS_IAM_ROLE }}
120+
aws-region: us-gov-east-1
121+
mask-aws-account-id: true
122+
- name: Create Layer
123+
run: |
124+
aws --region us-gov-east-1 lambda publish-layer-version \
125+
--layer-name ${{ matrix.layer }}-${{ matrix.arch }} \
126+
--zip-file fileb://./${{ matrix.layer }}_${{ matrix.arch }}.zip \
127+
--compatible-runtimes $(jq -r ".CompatibleRuntimes[0]" ${{ matrix.layer }}_${{ matrix.arch }}.json) \
128+
--compatible-architectures $(jq -r ".CompatibleArchitectures[0]" ${{ matrix.layer }}_${{ matrix.arch }}.json) \
129+
--license-info "MIT-0" \
130+
--description "$(jq -r '.Description' ${{ matrix.layer }}_${{ matrix.arch }}.json)" \
131+
--query 'Version' | \
132+
xargs aws --region us-gov-east-1 lambda add-layer-version-permission \
133+
--layer-name ${{ matrix.layer }}-${{ matrix.arch }} \
134+
--statement-id 'PublicLayer' \
135+
--action lambda:GetLayerVersion \
136+
--principal '*' \
137+
--version-number
138+
- name: Verify Layer
139+
run: |
140+
REMOTE_SHA=$(aws --region us-gov-east-1 lambda get-layer-version-by-arn --arn arn:aws:lambda:us-gov-east-1:${{ secrets.AWS_ACCOUNT_ID }}:layer:${{ matrix.layer }}-${{ matrix.arch }}:${{ inputs.version }} --query 'Content.CodeSha256' --output text)
141+
SHA=$(jq -r '.Content.CodeSha256' ${{ matrix.layer }}_${{ matrix.arch }}.json)
142+
test $($REMOTE_SHA == $SHA && echo "SHA OK: ${SHA}" || exit 1
143+
144+
copy_west:
145+
name: Copy (West)
146+
needs: download
147+
runs-on: ubuntu-latest
148+
permissions:
149+
id-token: write
150+
contents: read
151+
strategy:
152+
matrix:
153+
layer:
154+
- AWSLambdaPowertoolsPythonV3-python38
155+
- AWSLambdaPowertoolsPythonV3-python39
156+
- AWSLambdaPowertoolsPythonV3-python310
157+
- AWSLambdaPowertoolsPythonV3-python311
158+
- AWSLambdaPowertoolsPythonV3-python312
159+
arch:
160+
- arm64
161+
- x86_64
162+
environment:
163+
name: GovCloud ${{ inputs.environment }} (West)
164+
steps:
165+
- name: Download Zip
166+
uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
167+
with:
168+
name: ${{ matrix.layer }}_${{ matrix.arch }}.zip
169+
- name: Download Metadata
170+
uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
171+
with:
172+
name: ${{ matrix.layer }}_${{ matrix.arch }}.json
173+
- name: Verify Layer Signature
174+
run: |
175+
SHA=$(jq -r '.Content.CodeSha256' ${{ matrix.layer }}_${{ matrix.arch }}.json)
176+
test $(openssl dgst -sha256 -binary ${{ matrix.layer }}_${{ matrix.arch }}.zip | openssl enc -base64) == $SHA && echo "SHA OK: ${SHA}" || exit 1
177+
- name: Configure AWS Credentials
178+
uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4.0.2
179+
with:
180+
role-to-assume: ${{ secrets.AWS_IAM_ROLE }}
181+
aws-region: us-gov-west-1
182+
mask-aws-account-id: true
183+
- name: Create Layer
184+
run: |
185+
aws --region us-gov-west-1 lambda publish-layer-version \
186+
--layer-name ${{ matrix.layer }}-${{ matrix.arch }} \
187+
--zip-file fileb://./${{ matrix.layer }}_${{ matrix.arch }}.zip \
188+
--compatible-runtimes $(jq -r ".CompatibleRuntimes[0]" ${{ matrix.layer }}_${{ matrix.arch }}.json) \
189+
--compatible-architectures $(jq -r ".CompatibleArchitectures[0]" ${{ matrix.layer }}_${{ matrix.arch }}.json) \
190+
--license-info "MIT-0" \
191+
--description "$(jq -r '.Description' ${{ matrix.layer }}_${{ matrix.arch }}.json)" \
192+
--query 'Version' | \
193+
xargs aws --region us-gov-west-1 lambda add-layer-version-permission \
194+
--layer-name ${{ matrix.layer }}-${{ matrix.arch }} \
195+
--statement-id 'PublicLayer' \
196+
--action lambda:GetLayerVersion \
197+
--principal '*' \
198+
--version-number
199+
- name: Verify Layer
200+
run: |
201+
REMOTE_SHA=$(aws --region us-gov-west-1 lambda get-layer-version-by-arn --arn arn:aws:lambda:us-gov-west-1:${{ secrets.AWS_ACCOUNT_ID }}:layer:${{ matrix.layer }}-${{ matrix.arch }}:${{ inputs.version }} --query 'Content.CodeSha256' --output text)
202+
SHA=$(jq -r '.Content.CodeSha256' ${{ matrix.layer }}_${{ matrix.arch }}.json)
203+
test $($REMOTE_SHA == $SHA && echo "SHA OK: ${SHA}" || exit 1

0 commit comments

Comments
 (0)