@bifravst/ci 1.0.0 → 2.0.1

package/README.md

@@ -1,4 +1,4 @@
-# `hello.nrfcloud.com` CI [![npm version](https://img.shields.io/npm/v/@bifravst/ci.svg)](https://www.npmjs.com/package/@bifravst/ci)
+# Bifravst CI [![npm version](https://img.shields.io/npm/v/@bifravst/ci.svg)](https://www.npmjs.com/package/@bifravst/ci)
 
 [![GitHub Actions](https://github.com/bifravst/ci/workflows/Test%20and%20Release/badge.svg)](https://github.com/bifravst/ci/actions/workflows/test-and-release.yaml)
 [![semantic-release](https://img.shields.io/badge/%20%20%F0%9F%93%A6%F0%9F%9A%80-semantic--release-e10079.svg)](https://github.com/semantic-release/semantic-release)

package/dist/ContinuousDeployment.d.ts

@@ -0,0 +1,12 @@
+import { aws_iam as IAM } from 'aws-cdk-lib';
+import { Construct } from 'constructs';
+export declare class ContinuousDeployment extends Construct {
+    readonly role: IAM.IRole;
+    constructor(parent: Construct, { repository: { owner, repo }, gitHubOICDProviderArn, }: {
+        repository: {
+            owner: string;
+            repo: string;
+        };
+        gitHubOICDProviderArn: string;
+    });
+}

package/dist/ContinuousDeployment.js

@@ -0,0 +1,23 @@
+import { Duration, aws_iam as IAM, Stack } from 'aws-cdk-lib';
+import { Construct } from 'constructs';
+export class ContinuousDeployment extends Construct {
+    role;
+    constructor(parent, { repository: { owner, repo }, gitHubOICDProviderArn, }) {
+        super(parent, 'cd');
+        const gitHubOIDC = IAM.OpenIdConnectProvider.fromOpenIdConnectProviderArn(this, 'gitHubOICDProvider', gitHubOICDProviderArn);
+        this.role = new IAM.Role(this, 'ghRole', {
+            roleName: `${Stack.of(this).stackName}-cd`,
+            assumedBy: new IAM.WebIdentityPrincipal(gitHubOIDC.openIdConnectProviderArn, {
+                StringEquals: {
+                    [`token.actions.githubusercontent.com:sub`]: `repo:${owner}/${repo}:environment:production`,
+                    [`token.actions.githubusercontent.com:aud`]: 'sts.amazonaws.com',
+                },
+            }),
+            description: `This role is used by GitHub Actions to deploy ${Stack.of(this).stackName}`,
+            maxSessionDuration: Duration.hours(1),
+            managedPolicies: [
+                IAM.ManagedPolicy.fromAwsManagedPolicyName('AdministratorAccess'),
+            ],
+        });
+    }
+}

package/dist/index.d.ts

@@ -0,0 +1,3 @@
+export * from './ContinuousDeployment.js';
+export * from './RepoPermission.js';
+export * from './ensureGitHubOIDCProvider.js';

package/dist/index.js

@@ -0,0 +1,3 @@
+export * from './ContinuousDeployment.js';
+export * from './RepoPermission.js';
+export * from './ensureGitHubOIDCProvider.js';

package/package.json

@@ -1,12 +1,12 @@
 {
   "name": "@bifravst/ci",
-  "version": "1.0.0",
+  "version": "2.0.1",
   "description": "Sets up the permissions in our CI account for all repositories in this account to be able to use it for CI runs.",
   "exports": {
-    "./*": {
+    ".": {
       "import": {
-        "types": "./dist/*.d.ts",
-        "default": "./dist/*.js"
+        "types": "./dist/index.d.ts",
+        "default": "./dist/index.js"
       }
     }
   },
@@ -34,14 +34,14 @@
   "author": "Nordic Semiconductor ASA | nordicsemi.no",
   "license": "BSD-3-Clause",
   "devDependencies": {
-    "@bifravst/eslint-config-typescript": "6.0.19",
+    "@bifravst/eslint-config-typescript": "6.0.22",
     "@bifravst/prettier-config": "1.0.0",
     "@commitlint/config-conventional": "19.1.0",
     "@nordicsemiconductor/from-env": "3.0.1",
     "@octokit/rest": "20.1.0",
-    "aws-cdk": "2.135.0",
-    "aws-cdk-lib": "2.135.0",
-    "cdk": "2.135.0",
+    "aws-cdk": "2.137.0",
+    "aws-cdk-lib": "2.137.0",
+    "cdk": "2.137.0",
     "check-node-version": "4.2.1",
     "commitlint": "19.2.1",
     "constructs": "10.3.0",
@@ -95,7 +95,7 @@
   ],
   "prettier": "@bifravst/prettier-config",
   "peerDependencies": {
-    "@aws-sdk/client-iam": "^3.549.0",
+    "@aws-sdk/client-iam": "^3.552.0",
     "chalk": "^5.3.0"
   }
 }