@bifravst/ci 1.0.0

package/LICENSE

@@ -0,0 +1,29 @@
+BSD 3-Clause License
+
+Copyright (c) 2023-2024, Nordic Semiconductor ASA | nordicsemi.no
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+
+1. Redistributions of source code must retain the above copyright notice, this
+   list of conditions and the following disclaimer.
+
+2. Redistributions in binary form must reproduce the above copyright notice,
+   this list of conditions and the following disclaimer in the documentation
+   and/or other materials provided with the distribution.
+
+3. Neither the name of the copyright holder nor the names of its
+   contributors may be used to endorse or promote products derived from
+   this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

package/README.md

@@ -0,0 +1,22 @@
+# `hello.nrfcloud.com` CI [![npm version](https://img.shields.io/npm/v/@bifravst/ci.svg)](https://www.npmjs.com/package/@bifravst/ci)
+
+[![GitHub Actions](https://github.com/bifravst/ci/workflows/Test%20and%20Release/badge.svg)](https://github.com/bifravst/ci/actions/workflows/test-and-release.yaml)
+[![semantic-release](https://img.shields.io/badge/%20%20%F0%9F%93%A6%F0%9F%9A%80-semantic--release-e10079.svg)](https://github.com/semantic-release/semantic-release)
+[![Renovate](https://img.shields.io/badge/renovate-enabled-brightgreen.svg)](https://renovatebot.com)
+[![@commitlint/config-conventional](https://img.shields.io/badge/%40commitlint-config--conventional-brightgreen)](https://github.com/conventional-changelog/commitlint/tree/master/@commitlint/config-conventional)
+[![code style: prettier](https://img.shields.io/badge/code_style-prettier-ff69b4.svg)](https://github.com/prettier/prettier/)
+[![ESLint: TypeScript](https://img.shields.io/badge/ESLint-TypeScript-blue.svg)](https://github.com/typescript-eslint/typescript-eslint)
+
+Sets up the permissions in our AWS CI account for the repositories in this
+GitHub organization that are supposed to have access so they are be able to use
+it for CI runs.
+
+The allowed list of repositories is managed via the [`repos.txt`](./repos.txt)
+file.
+
+> [!CAUTION]  
+> Do not run this against the production account, but against the CI account.
+
+```bash
+npx cdk deploy
+```

package/dist/CIApp.d.ts

@@ -0,0 +1,5 @@
+import { App } from 'aws-cdk-lib';
+import { CIStack } from './CIStack.js';
+export declare class CIApp extends App {
+    constructor(name: string, args: ConstructorParameters<typeof CIStack>[2]);
+}

package/dist/CIApp.js

@@ -0,0 +1,8 @@
+import { App } from 'aws-cdk-lib';
+import { CIStack } from './CIStack.js';
+export class CIApp extends App {
+    constructor(name, args) {
+        super();
+        new CIStack(this, name, args);
+    }
+}

package/dist/CIStack.d.ts

@@ -0,0 +1,8 @@
+import { App, Stack } from 'aws-cdk-lib';
+import type { Repos } from './listRepos.js';
+export declare class CIStack extends Stack {
+    constructor(parent: App, name: string, { repos, gitHubOICDProviderArn, }: {
+        gitHubOICDProviderArn: string;
+        repos: Repos;
+    });
+}

package/dist/CIStack.js

@@ -0,0 +1,18 @@
+import { App, CfnOutput, Stack } from 'aws-cdk-lib';
+import { RepoPermission } from './RepoPermission.js';
+export class CIStack extends Stack {
+    constructor(parent, name, { repos, gitHubOICDProviderArn, }) {
+        super(parent, name);
+        for (const { id, owner, name: repo } of repos) {
+            const perm = new RepoPermission(this, repo, {
+                repository: { id, owner, name: repo },
+                gitHubOICDProviderArn,
+            });
+            new CfnOutput(this, `${id}:ciRoleArn`, {
+                exportName: `${name}:${id}:ciRoleArn`,
+                description: `Role ARN to use for running continuous integration tests using GitHub Actions in the repository ${owner}/${repo} (${id})`,
+                value: perm.role.roleArn,
+            });
+        }
+    }
+}

package/dist/RepoPermission.d.ts

@@ -0,0 +1,10 @@
+import { aws_iam as IAM } from 'aws-cdk-lib';
+import { Construct } from 'constructs';
+import type { Repository } from './listRepos.js';
+export declare class RepoPermission extends Construct {
+    readonly role: IAM.IRole;
+    constructor(parent: Construct, id: string, { repository, gitHubOICDProviderArn, }: {
+        repository: Repository;
+        gitHubOICDProviderArn: string;
+    });
+}

package/dist/RepoPermission.js

@@ -0,0 +1,26 @@
+import { Duration, aws_iam as IAM, Stack } from 'aws-cdk-lib';
+import { Construct } from 'constructs';
+import { sanitize } from './sanitize.js';
+export class RepoPermission extends Construct {
+    role;
+    constructor(parent, id, { repository, gitHubOICDProviderArn, }) {
+        super(parent, id);
+        const gitHubOIDC = IAM.OpenIdConnectProvider.fromOpenIdConnectProviderArn(this, 'gitHubOICDProvider', gitHubOICDProviderArn);
+        this.role = new IAM.Role(this, 'ghRole', {
+            roleName: `${Stack.of(this).stackName}-${sanitize(repository.name)}`,
+            assumedBy: new IAM.WebIdentityPrincipal(gitHubOIDC.openIdConnectProviderArn, {
+                StringEquals: {
+                    [`token.actions.githubusercontent.com:aud`]: 'sts.amazonaws.com',
+                },
+                StringLike: {
+                    [`token.actions.githubusercontent.com:sub`]: `repo:${repository.owner}/${repository.name}:*`,
+                },
+            }),
+            description: `This role is used by GitHub Actions to run Continuous Integration Tests ${Stack.of(this).stackName} in the repository ${repository.owner}/${repository.name} (${repository.id}).`,
+            maxSessionDuration: Duration.hours(1),
+            managedPolicies: [
+                IAM.ManagedPolicy.fromAwsManagedPolicyName('AdministratorAccess'),
+            ],
+        });
+    }
+}

package/dist/ci.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/ci.js

@@ -0,0 +1,20 @@
+import { IAMClient } from '@aws-sdk/client-iam';
+import { ensureGitHubOIDCProvider } from './ensureGitHubOIDCProvider.js';
+import { fromEnv } from '@nordicsemiconductor/from-env';
+import { CIApp } from './CIApp.js';
+import { listRepos } from './listRepos.js';
+import { loadRepoList } from './loadRepoList.js';
+const { token } = fromEnv({
+    token: 'GITHUB_TOKEN',
+})(process.env);
+const repos = await listRepos(token, await loadRepoList(process.env.REPOS_LIST ?? './repos.txt'));
+for (const repo of repos) {
+    console.debug(`Setting up permissions for ${repo.name} (${repo.id})...`);
+}
+const iam = new IAMClient({});
+new CIApp(process.env.STACK_NAME ?? 'bifravst-ci', {
+    gitHubOICDProviderArn: await ensureGitHubOIDCProvider({
+        iam,
+    }),
+    repos,
+});

package/dist/ensureGitHubOIDCProvider.d.ts

@@ -0,0 +1,7 @@
+import { IAMClient } from '@aws-sdk/client-iam';
+/**
+ * Returns the ARN of the OpenID Connect provider for GitHub of the account.
+ */
+export declare const ensureGitHubOIDCProvider: ({ iam, }: {
+    iam: IAMClient;
+}) => Promise<string>;

package/dist/ensureGitHubOIDCProvider.js

@@ -0,0 +1,37 @@
+import { CreateOpenIDConnectProviderCommand, GetOpenIDConnectProviderCommand, IAMClient, ListOpenIDConnectProvidersCommand, } from '@aws-sdk/client-iam';
+import chalk from 'chalk';
+/**
+ * Returns the ARN of the OpenID Connect provider for GitHub of the account.
+ */
+export const ensureGitHubOIDCProvider = async ({ iam, }) => {
+    const { OpenIDConnectProviderList } = await iam.send(new ListOpenIDConnectProvidersCommand({}));
+    const maybeGithubProvider = (await Promise.all(OpenIDConnectProviderList?.map(async ({ Arn }) => iam
+        .send(new GetOpenIDConnectProviderCommand({
+        OpenIDConnectProviderArn: Arn,
+    }))
+        .then((provider) => ({ Arn, provider }))) ?? [])).find(({ provider: { Url } }) => Url === 'token.actions.githubusercontent.com');
+    if (maybeGithubProvider?.Arn !== undefined) {
+        console.debug(chalk.green(`OIDC provider for GitHub exists: ${maybeGithubProvider.Arn}`));
+        return maybeGithubProvider.Arn;
+    }
+    console.log(chalk.yellow(`OIDC provider for GitHub does not exist. Creating ...`));
+    const provider = await iam.send(new CreateOpenIDConnectProviderCommand({
+        Url: `https://token.actions.githubusercontent.com`,
+        ClientIDList: ['sts.amazonaws.com'],
+        /**
+         * Starting July 6, 2023, AWS began securing communication with
+         * GitHub’s OIDC identity provider (IdP) using our library of
+         * trusted root Certificate Authorities instead of using a
+         * certificate thumbprint to verify the IdP’s server certificate.
+         * This approach ensures that your GitHub OIDC configuration behaves
+         * correctly without disruption during future certificate rotations
+         * and changes. With this new validation approach in place, your
+         * legacy thumbprint(s) will remain in your configuration but will
+         * no longer be needed for validation purposes.
+         */
+        ThumbprintList: ['6938fd4d98bab03faadb97b34396831e3780aea1'],
+    }));
+    if (provider.OpenIDConnectProviderArn === undefined)
+        throw new Error(`Failed to create OpenID Connect Provider for GitHub!`);
+    return provider.OpenIDConnectProviderArn;
+};

package/dist/listRepos.d.ts

@@ -0,0 +1,7 @@
+export type Repository = {
+    owner: string;
+    name: string;
+    id: number;
+};
+export type Repos = Array<Repository>;
+export declare const listRepos: (token: string, repos: Array<Omit<Repository, 'id'>>) => Promise<Array<Repository>>;

package/dist/listRepos.js

@@ -0,0 +1,17 @@
+import { Octokit } from '@octokit/rest';
+export const listRepos = async (token, repos) => {
+    const client = new Octokit({
+        auth: token,
+    });
+    return (await Promise.all(repos.map(async (repo) => client.repos.get({
+        repo: repo.name,
+        owner: repo.owner,
+    }))))
+        .map((res) => res.data)
+        .filter((repo) => repo.archived !== true)
+        .map((repo) => ({
+        id: repo.id,
+        name: repo.name,
+        owner: repo.full_name.split('/')[0],
+    }));
+};

package/dist/loadRepoList.d.ts

@@ -0,0 +1,2 @@
+import type { Repository } from './listRepos.js';
+export declare const loadRepoList: (location: string) => Promise<Array<Omit<Repository, 'id'>>>;

package/dist/loadRepoList.js

@@ -0,0 +1,9 @@
+import { readFile } from 'node:fs/promises';
+export const loadRepoList = async (location) => (await readFile(location, 'utf-8'))
+    .trim()
+    .split('\n')
+    .filter((s) => !s.startsWith('#'))
+    .map((s) => {
+    const [owner, name] = s.split('/');
+    return { owner, name };
+});

package/dist/loadRepoList.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/loadRepoList.spec.js

@@ -0,0 +1,18 @@
+import { describe, it } from 'node:test';
+import assert from 'node:assert/strict';
+import { loadRepoList } from './loadRepoList.js';
+import path from 'node:path';
+void describe('loadRepoList()', () => {
+    void it('should load the list of repos', async () => {
+        assert.deepEqual(await loadRepoList(path.join(process.cwd(), 'cdk', 'test', 'repos.txt')), [
+            {
+                name: 'ci',
+                owner: 'bifravst',
+            },
+            {
+                name: 'aws-cdk-ecr-helpers',
+                owner: 'bifravst',
+            },
+        ]);
+    });
+});

package/dist/sanitize.d.ts

@@ -0,0 +1 @@
+export declare const sanitize: (s: string) => string;

package/dist/sanitize.js

@@ -0,0 +1 @@
+export const sanitize = (s) => s.replace(/[^a-z0-9-]/g, '');

package/package.json

@@ -0,0 +1,101 @@
+{
+  "name": "@bifravst/ci",
+  "version": "1.0.0",
+  "description": "Sets up the permissions in our CI account for all repositories in this account to be able to use it for CI runs.",
+  "exports": {
+    "./*": {
+      "import": {
+        "types": "./dist/*.d.ts",
+        "default": "./dist/*.js"
+      }
+    }
+  },
+  "type": "module",
+  "scripts": {
+    "prepare": "husky && check-node-version --package",
+    "test": "npx globstar -- npx tsx --test --test-reporter spec \"!(node_modules)/**/*.spec.ts\"",
+    "prepublishOnly": "npx tsc --noEmit false --outDir ./dist -d"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/bifravst/ci.git"
+  },
+  "bugs": {
+    "url": "https://github.com/bifravst/ci/issues"
+  },
+  "homepage": "https://github.com/bifravst/ci#readme",
+  "keywords": [
+    "nordicsemiconductor",
+    "cellular-iot",
+    "bifravst",
+    "aws",
+    "cdk"
+  ],
+  "author": "Nordic Semiconductor ASA | nordicsemi.no",
+  "license": "BSD-3-Clause",
+  "devDependencies": {
+    "@bifravst/eslint-config-typescript": "6.0.19",
+    "@bifravst/prettier-config": "1.0.0",
+    "@commitlint/config-conventional": "19.1.0",
+    "@nordicsemiconductor/from-env": "3.0.1",
+    "@octokit/rest": "20.1.0",
+    "aws-cdk": "2.135.0",
+    "aws-cdk-lib": "2.135.0",
+    "cdk": "2.135.0",
+    "check-node-version": "4.2.1",
+    "commitlint": "19.2.1",
+    "constructs": "10.3.0",
+    "globstar": "1.0.0",
+    "husky": "9.0.11",
+    "tsx": "4.7.2"
+  },
+  "lint-staged": {
+    "*.{md,json,yaml,yml}": [
+      "prettier --write"
+    ],
+    "*.{ts,tsx}": [
+      "prettier --write",
+      "eslint"
+    ]
+  },
+  "engines": {
+    "node": ">=20",
+    "npm": ">=9"
+  },
+  "release": {
+    "branches": [
+      "saga",
+      {
+        "name": "!(saga)",
+        "prerelease": true
+      }
+    ],
+    "remoteTags": true,
+    "plugins": [
+      "@semantic-release/commit-analyzer",
+      "@semantic-release/release-notes-generator",
+      "@semantic-release/npm",
+      [
+        "@semantic-release/github",
+        {
+          "successComment": false,
+          "failTitle": false
+        }
+      ]
+    ]
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "files": [
+    "package-lock.json",
+    "dist",
+    "LICENSE",
+    "README.md"
+  ],
+  "prettier": "@bifravst/prettier-config",
+  "peerDependencies": {
+    "@aws-sdk/client-iam": "^3.549.0",
+    "chalk": "^5.3.0"
+  }
+}