aws-cdk-github-oidc 0.0.5 → 0.0.9
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/.jsii +8 -4
- package/README.md +4 -2
- package/lib/provider.js +3 -4
- package/lib/role.js +1 -1
- package/package.json +8 -2
package/.jsii
CHANGED
|
@@ -192,7 +192,7 @@
|
|
|
192
192
|
},
|
|
193
193
|
"name": "aws-cdk-github-oidc",
|
|
194
194
|
"readme": {
|
|
195
|
-
"markdown": "# AWS CDK Github OpenID Connect\n\nAWS [CDK](https://aws.amazon.com/cdk/) constructs that define:\n- Github Actions as OpenID Connect Identity Provider into AWS IAM\n- IAM Roles that can be assumed by Github Actions workflows\n\nThese constructs allows you to harden your AWS deployment security by removing the need to create long-
|
|
195
|
+
"markdown": "# AWS CDK Github OpenID Connect\n\n![cdk-support](https://img.shields.io/badge/cdk-%20typescript%20|%20python%20-informational \"TypeScript | Python\")\n\nAWS [CDK](https://aws.amazon.com/cdk/) constructs that define:\n- Github Actions as OpenID Connect Identity Provider into AWS IAM\n- IAM Roles that can be assumed by Github Actions workflows\n\nThese constructs allows you to harden your AWS deployment security by removing the need to create long-term access keys for Github Actions and instead use OpenID Connect to Authenticate your Github Action workflow with AWS IAM.\n\n## Background information\n\n![github-aws-oidc](/assets/github-aws-oidc.svg \"Github OIDC with AWS\")\n\n- [GitHub Actions: Secure cloud deployments with OpenID Connect](https://github.blog/changelog/2021-10-27-github-actions-secure-cloud-deployments-with-openid-connect/) on Github Changelog Blog.\n- [Security hardening your deployments](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments) on Github Docs.\n- [Assuming a role with `aws-actions/configure-aws-credentials`](https://github.com/aws-actions/configure-aws-credentials#assuming-a-role).\n- Shout-out to [Richard H. Boyd](https://twitter.com/rchrdbyd) for helping me to debug Github OIDC setup with AWS IAM and his [Deploying to AWS with Github Actions](https://www.githubuniverse.com/2021/session/692586/deploying-to-aws-with-github-actions)-talk.\n- Shout-out to [Aidan W Steele](https://twitter.com/__steele) and his blog post [AWS federation comes to GitHub Actions](https://awsteele.com/blog/2021/09/15/aws-federation-comes-to-github-actions.html) for being the original inspiration for this.\n\n\n<br/>\n\n## Getting started\n\n```shell\nnpm i -D aws-cdk-github-oidc\n```\n\n<br/>\n\n### OpenID Connect Identity Provider trust for AWS IAM\n\nTo create a new Github OIDC provider into AWS IAM:\n```ts\nimport { GithubActionsIdentityProvider } from 'aws-cdk-github-oidc';\n\nconst provider = new GithubActionsIdentityProvider(scope, 'GithubProvider');\n```\n\nIn the background this creates an OIDC provider trust configuration into AWS IAM with an [issuer URL of `https://token.actions.githubusercontent.com`](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-amazon-web-services#adding-the-identity-provider-to-aws), audiences (client IDs) configured as `['sts.amazonaws.com']` (which matches the [`aws-actions/configure-aws-credentials`](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-amazon-web-services#adding-the-identity-provider-to-aws) implementation) and the thumbprint as Github's `a031c46782e6e6c662c2c87c76da9aa62ccabd8e`\n\n<br/>\n\n### Retrieving a reference to an existing Github OIDC provider configuration\n\nRemember, **there can be only one (Github OIDC provider per AWS Account)**, so to retrieve a reference to existing Github OIDC provider use `fromAccount` static method:\n```ts\nimport { GithubActionsIdentityProvider } from 'aws-cdk-github-oidc';\n\nconst provider = GithubActionsIdentityProvider.fromAccount(scope, 'GithubProvider');\n```\n\n<br/>\n\n### Defining a role for Github Actions workflow to assume\n\n```ts\nimport { GithubActionsRole } from 'aws-cdk-github-oidc';\n\nconst uploadRole = new GithubActionsRole(scope, 'UploadRole', {\n provider: provider, // reference into the OIDC provider\n owner: 'octo-org', // your repository owner (organization or user) name\n repo: 'octo-repo', // your repository name (without the owner name)\n filter: 'ref:refs/tags/v*', // jwt sub suffix filter, defaults to '*'\n});\n\n// use it like any other role, for example grant S3 bucket write access:\nmyBucket.grantWrite(uploadRole);\n```\n\nYou may pass in any `iam.RoleProps` into the construct's props, except `assumedBy` which will be defined by this construct (CDK will fail if you do):\n```ts\nconst deployRole = new GithubActionsRole(scope, 'DeployRole', {\n provider: provider,\n owner: 'octo-org',\n repo: 'octo-repo',\n roleName: 'MyDeployRole',\n description: 'This role deploys stuff to AWS',\n maxSessionDuration: cdk.Duration.hours(2),\n});\n\n// You may also use various \"add*\" policy methods!\n// \"AdministratorAccess\" not really a good idea, just for an example here:\ndeployRole.addManagedPolicy(iam.ManagedPolicy.fromAwsManagedPolicyName('AdministratorAccess'));\n```\n\n<br/>\n\n#### Subject Filter\n\nBy default the value of `filter` property will be `'*'` which means any workflow (from given repository) from any branch, tag, environment or pull request can assume this role. To further stricten the OIDC trust policy on the role, you may adjust the subject filter as seen on the [examples in Github Docs](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect#configuring-the-oidc-trust-with-the-cloud); For example:\n\n| `filter` value | Descrition |\n| :----------------------------- | :--------------------------------------- |\n| `'ref:refs/tags/v*'` | Allow only tags with prefix of `v` |\n| `'ref:refs/heads/demo-branch'` | Allow only from branch `demo-branch` |\n| `'pull_request'` | Allow only from pull request |\n| `'environment:Production'` | Allow only from `Production` environment |\n\n<br/>\n\n### Github Actions Workflow\n\nTo actually utilize this in your Github Actions workflow, use [aws-actions/configure-aws-credentials](https://github.com/aws-actions/configure-aws-credentials) to [assume a role](https://github.com/aws-actions/configure-aws-credentials#assuming-a-role).\n\nAt the moment you must use the `master` version (until AWS releases a new tag):\n\n```yaml\njobs:\n deploy:\n name: Upload to Amazon S3\n runs-on: ubuntu-latest\n permissions:\n id-token: write # needed to interact with GitHub's OIDC Token endpoint.\n contents: read\n steps:\n - name: Checkout\n uses: actions/checkout@v2\n\n - name: Configure AWS credentials\n uses: aws-actions/configure-aws-credentials@master\n with:\n role-to-assume: arn:aws:iam::111111111111:role/MyUploadRole\n #role-session-name: MySessionName # Optional\n aws-region: us-east-1\n\n - name: Copy files to the test website with the AWS CLI\n run: |\n aws s3 sync . s3://my-s3-test-website-bucket\n```\n\n<br/>\n\n### Development Status\n\nThese constructs are fresh out from the oven, since [Github just announced](https://github.blog/changelog/2021-10-27-github-actions-secure-cloud-deployments-with-openid-connect/) the OpenID Connect feature as generally available. I've been playing around with the feature for few days, but the constructs themselves haven't yet been widely used.\n\nThese constructs will stay in `v0.x.x` for a while, to allow easier bug fixing & breaking changes _if absolutely needed_. Once bugs are fixed (if any), the constructs will be published with `v1` major version and will be marked as stable.\n\nCurrently only TypeScript and Python versions provided, but before going to stable, I'll probably others (supported by JSII) depending on the amount of work required - so no promises!\n"
|
|
196
196
|
},
|
|
197
197
|
"repository": {
|
|
198
198
|
"type": "git",
|
|
@@ -202,6 +202,10 @@
|
|
|
202
202
|
"targets": {
|
|
203
203
|
"js": {
|
|
204
204
|
"npm": "aws-cdk-github-oidc"
|
|
205
|
+
},
|
|
206
|
+
"python": {
|
|
207
|
+
"distName": "aws-cdk-github-oidc",
|
|
208
|
+
"module": "aws_cdk_github_oidc"
|
|
205
209
|
}
|
|
206
210
|
},
|
|
207
211
|
"types": {
|
|
@@ -224,7 +228,7 @@
|
|
|
224
228
|
},
|
|
225
229
|
"locationInModule": {
|
|
226
230
|
"filename": "src/provider.ts",
|
|
227
|
-
"line":
|
|
231
|
+
"line": 51
|
|
228
232
|
},
|
|
229
233
|
"parameters": [
|
|
230
234
|
{
|
|
@@ -706,6 +710,6 @@
|
|
|
706
710
|
"symbolId": "src/iam-role-props:RoleProps"
|
|
707
711
|
}
|
|
708
712
|
},
|
|
709
|
-
"version": "0.0.
|
|
710
|
-
"fingerprint": "
|
|
713
|
+
"version": "0.0.9",
|
|
714
|
+
"fingerprint": "kymtSmuyi3tKWbvGr8wavzbM5Lz+3JBcjdONgUrE5G8="
|
|
711
715
|
}
|
package/README.md
CHANGED
|
@@ -1,10 +1,12 @@
|
|
|
1
1
|
# AWS CDK Github OpenID Connect
|
|
2
2
|
|
|
3
|
+
|
|
4
|
+
|
|
3
5
|
AWS [CDK](https://aws.amazon.com/cdk/) constructs that define:
|
|
4
6
|
- Github Actions as OpenID Connect Identity Provider into AWS IAM
|
|
5
7
|
- IAM Roles that can be assumed by Github Actions workflows
|
|
6
8
|
|
|
7
|
-
These constructs allows you to harden your AWS deployment security by removing the need to create long-
|
|
9
|
+
These constructs allows you to harden your AWS deployment security by removing the need to create long-term access keys for Github Actions and instead use OpenID Connect to Authenticate your Github Action workflow with AWS IAM.
|
|
8
10
|
|
|
9
11
|
## Background information
|
|
10
12
|
|
|
@@ -136,4 +138,4 @@ These constructs are fresh out from the oven, since [Github just announced](http
|
|
|
136
138
|
|
|
137
139
|
These constructs will stay in `v0.x.x` for a while, to allow easier bug fixing & breaking changes _if absolutely needed_. Once bugs are fixed (if any), the constructs will be published with `v1` major version and will be marked as stable.
|
|
138
140
|
|
|
139
|
-
Currently only TypeScript
|
|
141
|
+
Currently only TypeScript and Python versions provided, but before going to stable, I'll probably others (supported by JSII) depending on the amount of work required - so no promises!
|
package/lib/provider.js
CHANGED
|
@@ -51,13 +51,12 @@ class GithubActionsIdentityProvider extends iam.OpenIdConnectProvider {
|
|
|
51
51
|
static fromAccount(scope, id) {
|
|
52
52
|
const accountId = cdk.Stack.of(scope).account;
|
|
53
53
|
const providerArn = `arn:aws:iam::${accountId}:oidc-provider/${GithubActionsIdentityProvider.issuer}`;
|
|
54
|
-
|
|
55
|
-
return provider;
|
|
54
|
+
return iam.OpenIdConnectProvider.fromOpenIdConnectProviderArn(scope, id, providerArn);
|
|
56
55
|
}
|
|
57
56
|
}
|
|
58
57
|
exports.GithubActionsIdentityProvider = GithubActionsIdentityProvider;
|
|
59
58
|
_a = JSII_RTTI_SYMBOL_1;
|
|
60
|
-
GithubActionsIdentityProvider[_a] = { fqn: "aws-cdk-github-oidc.GithubActionsIdentityProvider", version: "0.0.
|
|
59
|
+
GithubActionsIdentityProvider[_a] = { fqn: "aws-cdk-github-oidc.GithubActionsIdentityProvider", version: "0.0.9" };
|
|
61
60
|
/**
|
|
62
61
|
* @experimental
|
|
63
62
|
*/
|
|
@@ -66,4 +65,4 @@ GithubActionsIdentityProvider.issuer = 'token.actions.githubusercontent.com';
|
|
|
66
65
|
* @experimental
|
|
67
66
|
*/
|
|
68
67
|
GithubActionsIdentityProvider.thumbprint = 'a031c46782e6e6c662c2c87c76da9aa62ccabd8e';
|
|
69
|
-
//# sourceMappingURL=data:application/json;base64,
|
|
68
|
+
//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicHJvdmlkZXIuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi9zcmMvcHJvdmlkZXIudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7QUFBQSx3Q0FBd0M7QUFDeEMscUNBQXFDOzs7Ozs7Ozs7QUFNckMsTUFBYSw2QkFBOEIsU0FBUSxHQUFHLENBQUMscUJBQXFCOzs7Ozs7Ozs7Ozs7O0lBYTFFLFlBQVksS0FBb0IsRUFBRSxFQUFVO1FBQzFDLEtBQUssQ0FBQyxLQUFLLEVBQUUsRUFBRSxFQUFFO1lBQ2YsR0FBRyxFQUFFLFdBQVcsNkJBQTZCLENBQUMsTUFBTSxFQUFFO1lBQ3RELFdBQVcsRUFBRSxDQUFDLDZCQUE2QixDQUFDLFVBQVUsQ0FBQztZQUN2RCxTQUFTLEVBQUUsQ0FBQyxtQkFBbUIsQ0FBQztTQUNqQyxDQUFDLENBQUM7SUFDTCxDQUFDOzs7Ozs7Ozs7Ozs7Ozs7O0lBYk0sTUFBTSxDQUFDLFdBQVcsQ0FBQyxLQUFvQixFQUFFLEVBQVU7UUFDeEQsTUFBTSxTQUFTLEdBQUcsR0FBRyxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUMsS0FBSyxDQUFDLENBQUMsT0FBTyxDQUFDO1FBQzlDLE1BQU0sV0FBVyxHQUFHLGdCQUFnQixTQUFTLGtCQUFrQiw2QkFBNkIsQ0FBQyxNQUFNLEVBQUUsQ0FBQztRQUN0RyxPQUFPLEdBQUcsQ0FBQyxxQkFBcUIsQ0FBQyw0QkFBNEIsQ0FBQyxLQUFLLEVBQUUsRUFBRSxFQUFFLFdBQVcsQ0FBQyxDQUFDO0lBQ3hGLENBQUM7O0FBVkgsc0VBb0JDOzs7Ozs7QUFsQndCLG9DQUFNLEdBQVcscUNBQXFDLENBQUM7Ozs7QUFDdkQsd0NBQVUsR0FBVywwQ0FBMEMsQ0FBQyIsInNvdXJjZXNDb250ZW50IjpbImltcG9ydCAqIGFzIGlhbSBmcm9tICdAYXdzLWNkay9hd3MtaWFtJztcbmltcG9ydCAqIGFzIGNkayBmcm9tICdAYXdzLWNkay9jb3JlJztcblxuICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgXG5leHBvcnQgaW50ZXJmYWNlIElHaXRodWJBY3Rpb25zSWRlbnRpdHlQcm92aWRlciBleHRlbmRzIGlhbS5JT3BlbklkQ29ubmVjdFByb3ZpZGVyIHt9XG5cbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBcbmV4cG9ydCBjbGFzcyBHaXRodWJBY3Rpb25zSWRlbnRpdHlQcm92aWRlciBleHRlbmRzIGlhbS5PcGVuSWRDb25uZWN0UHJvdmlkZXIgaW1wbGVtZW50cyBJR2l0aHViQWN0aW9uc0lkZW50aXR5UHJvdmlkZXIge1xuXG4gIHB1YmxpYyBzdGF0aWMgcmVhZG9ubHkgaXNzdWVyOiBzdHJpbmcgPSAndG9rZW4uYWN0aW9ucy5naXRodWJ1c2VyY29udGVudC5jb20nO1xuICBwdWJsaWMgc3RhdGljIHJlYWRvbmx5IHRodW1icHJpbnQ6IHN0cmluZyA9ICdhMDMxYzQ2NzgyZTZlNmM2NjJjMmM4N2M3NmRhOWFhNjJjY2FiZDhlJztcblxuICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgXG4gIHB1YmxpYyBzdGF0aWMgZnJvbUFjY291bnQoc2NvcGU6IGNkay5Db25zdHJ1Y3QsIGlkOiBzdHJpbmcpOiBJR2l0aHViQWN0aW9uc0lkZW50aXR5UHJvdmlkZXIge1xuICAgIGNvbnN0IGFjY291bnRJZCA9IGNkay5TdGFjay5vZihzY29wZSkuYWNjb3VudDtcbiAgICBjb25zdCBwcm92aWRlckFybiA9IGBhcm46YXdzOmlhbTo6JHthY2NvdW50SWR9Om9pZGMtcHJvdmlkZXIvJHtHaXRodWJBY3Rpb25zSWRlbnRpdHlQcm92aWRlci5pc3N1ZXJ9YDtcbiAgICByZXR1cm4gaWFtLk9wZW5JZENvbm5lY3RQcm92aWRlci5mcm9tT3BlbklkQ29ubmVjdFByb3ZpZGVyQXJuKHNjb3BlLCBpZCwgcHJvdmlkZXJBcm4pO1xuICB9XG5cbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgXG4gIGNvbnN0cnVjdG9yKHNjb3BlOiBjZGsuQ29uc3RydWN0LCBpZDogc3RyaW5nKSB7XG4gICAgc3VwZXIoc2NvcGUsIGlkLCB7XG4gICAgICB1cmw6IGBodHRwczovLyR7R2l0aHViQWN0aW9uc0lkZW50aXR5UHJvdmlkZXIuaXNzdWVyfWAsXG4gICAgICB0aHVtYnByaW50czogW0dpdGh1YkFjdGlvbnNJZGVudGl0eVByb3ZpZGVyLnRodW1icHJpbnRdLFxuICAgICAgY2xpZW50SWRzOiBbJ3N0cy5hbWF6b25hd3MuY29tJ10sXG4gICAgfSk7XG4gIH1cbn1cbiJdfQ==
|
package/lib/role.js
CHANGED
|
@@ -103,5 +103,5 @@ class GithubActionsRole extends iam.Role {
|
|
|
103
103
|
}
|
|
104
104
|
exports.GithubActionsRole = GithubActionsRole;
|
|
105
105
|
_a = JSII_RTTI_SYMBOL_1;
|
|
106
|
-
GithubActionsRole[_a] = { fqn: "aws-cdk-github-oidc.GithubActionsRole", version: "0.0.
|
|
106
|
+
GithubActionsRole[_a] = { fqn: "aws-cdk-github-oidc.GithubActionsRole", version: "0.0.9" };
|
|
107
107
|
//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicm9sZS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3NyYy9yb2xlLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7Ozs7O0FBQUEsd0NBQXdDO0FBQ3hDLHFDQUFxQztBQUVyQyxpREFBaUQ7QUFDakQseUNBQTJGOzs7Ozs7Ozs7Ozs7Ozs7Ozs7OztBQXNCM0YsTUFBYSxpQkFBa0IsU0FBUSxHQUFHLENBQUMsSUFBSTs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7SUFzQzdDLFlBQVksS0FBb0IsRUFBRSxFQUFVLEVBQUUsS0FBNkI7UUFFekUsTUFBTSxFQUFFLFFBQVEsRUFBRSxLQUFLLEVBQUUsSUFBSSxFQUFFLEdBQUcsS0FBSyxDQUFDO1FBRXhDLHNCQUFzQjtRQUN0QixpQkFBaUIsQ0FBQyxhQUFhLENBQUMsS0FBSyxFQUFFLEtBQUssQ0FBQyxDQUFDO1FBQzlDLGlCQUFpQixDQUFDLFlBQVksQ0FBQyxLQUFLLEVBQUUsSUFBSSxDQUFDLENBQUM7UUFFNUMsaUJBQWlCO1FBQ2pCLE1BQU0sT0FBTyxHQUFHLGlCQUFpQixDQUFDLGFBQWEsQ0FBQyxLQUFLLENBQUMsQ0FBQztRQUN2RCxNQUFNLFNBQVMsR0FBRyxpQkFBaUIsQ0FBQyxnQkFBZ0IsQ0FBQyxLQUFLLENBQUMsQ0FBQztRQUU1RCwrQkFBK0I7UUFDL0IsS0FBSyxDQUFDLEtBQUssRUFBRSxFQUFFLEVBQUU7WUFDZixHQUFHLFNBQVM7WUFDWixTQUFTLEVBQUUsSUFBSSxHQUFHLENBQUMsb0JBQW9CLENBQUMsUUFBUSxDQUFDLHdCQUF3QixFQUFFO2dCQUN6RSxVQUFVLEVBQUU7b0JBQ1Ysb0RBQW9EO29CQUNwRCxDQUFDLEdBQUcsd0NBQTZCLENBQUMsTUFBTSxNQUFNLENBQUMsRUFBRSxPQUFPO2lCQUN6RDtnQkFDRCxZQUFZLEVBQUU7b0JBQ1osdUVBQXVFO29CQUN2RSwwS0FBMEs7b0JBQzFLLENBQUMsR0FBRyx3Q0FBNkIsQ0FBQyxNQUFNLE1BQU0sQ0FBQyxFQUFFLG1CQUFtQjtpQkFDckU7YUFDRixDQUFDO1NBQ0gsQ0FBQyxDQUFDO0lBRUwsQ0FBQztJQWhFRDs7OztPQUlHO0lBQ0ssTUFBTSxDQUFDLGdCQUFnQixDQUFDLEtBQTZCO1FBQzNELE1BQU0sWUFBWSxHQUFRLEtBQUssQ0FBQztRQUNoQyxPQUFPLFlBQVksQ0FBQyxRQUFRLENBQUM7UUFDN0IsT0FBTyxZQUFZLENBQUMsS0FBSyxDQUFDO1FBQzFCLE9BQU8sWUFBWSxDQUFDLElBQUksQ0FBQztRQUN6QixPQUFPLFlBQVksQ0FBQyxNQUFNLENBQUM7UUFDM0IsT0FBTyxZQUFZLENBQUM7SUFDdEIsQ0FBQztJQUVELDhEQUE4RDtJQUN0RCxNQUFNLENBQUMsYUFBYSxDQUFDLEtBQW9CLEVBQUUsS0FBYTtRQUM5RCxJQUFJLHNCQUFtQixDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsS0FBSyxJQUFJLEVBQUU7WUFDNUMsR0FBRyxDQUFDLFdBQVcsQ0FBQyxFQUFFLENBQUMsS0FBSyxDQUFDLENBQUMsUUFBUSxDQUFDLG9DQUFvQyxLQUFLLDBLQUEwSyxDQUFDLENBQUM7U0FDelA7SUFDSCxDQUFDO0lBRUQsNERBQTREO0lBQ3BELE1BQU0sQ0FBQyxZQUFZLENBQUMsS0FBb0IsRUFBRSxJQUFZO1FBQzVELElBQUksSUFBSSxLQUFLLEVBQUUsRUFBRTtZQUNmLEdBQUcsQ0FBQyxXQUFXLENBQUMsRUFBRSxDQUFDLEtBQUssQ0FBQyxDQUFDLFFBQVEsQ0FBQyxtQ0FBbUMsSUFBSSw2QkFBNkIsQ0FBQyxDQUFDO1NBQzFHO0lBQ0gsQ0FBQztJQUVELG9EQUFvRDtJQUM1QyxNQUFNLENBQUMsYUFBYSxDQUFDLEtBQTBCO1FBQ3JELE1BQU0sRUFBRSxLQUFLLEVBQUUsSUFBSSxFQUFFLE1BQU0sR0FBRyxHQUFHLEVBQUUsR0FBRyxLQUFLLENBQUM7UUFDNUMsT0FBTyxRQUFRLEtBQUssSUFBSSxJQUFJLElBQUksTUFBTSxFQUFFLENBQUM7SUFDM0MsQ0FBQzs7QUFsQ0gsOENBbUVDIiwic291cmNlc0NvbnRlbnQiOlsiaW1wb3J0ICogYXMgaWFtIGZyb20gJ0Bhd3MtY2RrL2F3cy1pYW0nO1xuaW1wb3J0ICogYXMgY2RrIGZyb20gJ0Bhd3MtY2RrL2NvcmUnO1xuaW1wb3J0IHsgUm9sZVByb3BzIH0gZnJvbSAnLi9pYW0tcm9sZS1wcm9wcyc7XG5pbXBvcnQgZ2l0aHViVXNlcm5hbWVSZWdleCBmcm9tICcuL293bmVyLXJlZ2V4cCc7XG5pbXBvcnQgeyBHaXRodWJBY3Rpb25zSWRlbnRpdHlQcm92aWRlciwgSUdpdGh1YkFjdGlvbnNJZGVudGl0eVByb3ZpZGVyIH0gZnJvbSAnLi9wcm92aWRlcic7XG5cbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgXG5leHBvcnQgaW50ZXJmYWNlIEdpdGh1YkNvbmZpZ3VyYXRpb24ge1xuXG4gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBcbiAgcmVhZG9ubHkgcHJvdmlkZXI6IElHaXRodWJBY3Rpb25zSWRlbnRpdHlQcm92aWRlcjtcblxuICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgXG4gIHJlYWRvbmx5IG93bmVyOiBzdHJpbmc7XG5cbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBcbiAgcmVhZG9ubHkgcmVwbzogc3RyaW5nO1xuXG4gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgXG4gIHJlYWRvbmx5IGZpbHRlcj86IHN0cmluZztcbn1cblxuICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBcbmV4cG9ydCBpbnRlcmZhY2UgR2l0aHViQWN0aW9uc1JvbGVQcm9wcyBleHRlbmRzIEdpdGh1YkNvbmZpZ3VyYXRpb24sIFJvbGVQcm9wcyB7fVxuXG4gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBcbmV4cG9ydCBjbGFzcyBHaXRodWJBY3Rpb25zUm9sZSBleHRlbmRzIGlhbS5Sb2xlIHtcblxuICAvKipcbiAgICogRXh0cmFjdHMgcHJvcHMgZ2l2ZW4gZm9yIHRoZSBjcmVhdGVkIElBTSBSb2xlIENvbnN0cnVjdC5cbiAgICogQHBhcmFtIHByb3BzIGZvciB0aGUgR2l0aHViQWN0aW9uc1JvbGVcbiAgICogQHJldHVybnMgZm9yIHRoZSBJQU0gUm9sZVxuICAgKi9cbiAgcHJpdmF0ZSBzdGF0aWMgZXh0cmFjdFJvbGVQcm9wcyhwcm9wczogR2l0aHViQWN0aW9uc1JvbGVQcm9wcyk6IGlhbS5Sb2xlUHJvcHMge1xuICAgIGNvbnN0IGV4dHJhY3RQcm9wcyA9IDxhbnk+cHJvcHM7XG4gICAgZGVsZXRlIGV4dHJhY3RQcm9wcy5wcm92aWRlcjtcbiAgICBkZWxldGUgZXh0cmFjdFByb3BzLm93bmVyO1xuICAgIGRlbGV0ZSBleHRyYWN0UHJvcHMucmVwbztcbiAgICBkZWxldGUgZXh0cmFjdFByb3BzLmZpbHRlcjtcbiAgICByZXR1cm4gZXh0cmFjdFByb3BzO1xuICB9XG5cbiAgLyoqIFZhbGlkYXRlcyB0aGUgR2l0aHViIG93bmVyIChvcmdhbml6YXRpb24gb3IgdXNlcikgbmFtZS4gKi9cbiAgcHJpdmF0ZSBzdGF0aWMgdmFsaWRhdGVPd25lcihzY29wZTogY2RrLkNvbnN0cnVjdCwgb3duZXI6IHN0cmluZyk6IHZvaWQge1xuICAgIGlmIChnaXRodWJVc2VybmFtZVJlZ2V4LnRlc3Qob3duZXIpICE9PSB0cnVlKSB7XG4gICAgICBjZGsuQW5ub3RhdGlvbnMub2Yoc2NvcGUpLmFkZEVycm9yKGBJbnZhbGlkIEdpdGh1YiBSZXBvc2l0b3J5IE93bmVyIFwiJHtvd25lcn1cIi4gTXVzdCBvbmx5IGNvbnRhaW4gYWxwaGFudW1lcmljIGNoYXJhY3RlcnMgb3IgaHlwaGVucywgY2Fubm90IGhhdmUgbXVsdGlwbGUgY29uc2VjdXRpdmUgaHlwaGVucywgY2Fubm90IGJlZ2luIG9yIGVuZCB3aXRoIGEgaHlwZW4gYW5kIG1heGltdW0gbGVuZ2h0IGlzIDM5IGNoYXJhY3RlcnMuYCk7XG4gICAgfVxuICB9XG5cbiAgLyoqIFZhbGlkYXRlcyB0aGUgR2l0aHViIHJlcG9zaXRvcnkgbmFtZSAod2l0aG91dCBvd25lcikuICovXG4gIHByaXZhdGUgc3RhdGljIHZhbGlkYXRlUmVwbyhzY29wZTogY2RrLkNvbnN0cnVjdCwgcmVwbzogc3RyaW5nKTogdm9pZCB7XG4gICAgaWYgKHJlcG8gPT09ICcnKSB7XG4gICAgICBjZGsuQW5ub3RhdGlvbnMub2Yoc2NvcGUpLmFkZEVycm9yKGBJbnZhbGlkIEdpdGh1YiBSZXBvc2l0b3J5IE5hbWUgXCIke3JlcG99XCIuIE1heSBub3QgYmUgZW1wdHkgc3RyaW5nLmApO1xuICAgIH1cbiAgfVxuXG4gIC8qKiBGb3JtYXRzIHRoZSBgc3ViYCB2YWx1ZSB1c2VkIGluIHRydXN0IHBvbGljeS4gKi9cbiAgcHJpdmF0ZSBzdGF0aWMgZm9ybWF0U3ViamVjdChwcm9wczogR2l0aHViQ29uZmlndXJhdGlvbik6IHN0cmluZyB7XG4gICAgY29uc3QgeyBvd25lciwgcmVwbywgZmlsdGVyID0gJyonIH0gPSBwcm9wcztcbiAgICByZXR1cm4gYHJlcG86JHtvd25lcn0vJHtyZXBvfToke2ZpbHRlcn1gO1xuICB9XG5cblxuICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgXG4gIGNvbnN0cnVjdG9yKHNjb3BlOiBjZGsuQ29uc3RydWN0LCBpZDogc3RyaW5nLCBwcm9wczogR2l0aHViQWN0aW9uc1JvbGVQcm9wcykge1xuXG4gICAgY29uc3QgeyBwcm92aWRlciwgb3duZXIsIHJlcG8gfSA9IHByb3BzO1xuXG4gICAgLy8gUGVyZm9ybSB2YWxpZGF0aW9uc1xuICAgIEdpdGh1YkFjdGlvbnNSb2xlLnZhbGlkYXRlT3duZXIoc2NvcGUsIG93bmVyKTtcbiAgICBHaXRodWJBY3Rpb25zUm9sZS52YWxpZGF0ZVJlcG8oc2NvcGUsIHJlcG8pO1xuXG4gICAgLy8gUHJlcGFyZSB2YWx1ZXNcbiAgICBjb25zdCBzdWJqZWN0ID0gR2l0aHViQWN0aW9uc1JvbGUuZm9ybWF0U3ViamVjdChwcm9wcyk7XG4gICAgY29uc3Qgcm9sZVByb3BzID0gR2l0aHViQWN0aW9uc1JvbGUuZXh0cmFjdFJvbGVQcm9wcyhwcm9wcyk7XG5cbiAgICAvLyBUaGUgYWN0dWFsIElBTSBSb2xlIGNyZWF0aW9uXG4gICAgc3VwZXIoc2NvcGUsIGlkLCB7XG4gICAgICAuLi5yb2xlUHJvcHMsXG4gICAgICBhc3N1bWVkQnk6IG5ldyBpYW0uV2ViSWRlbnRpdHlQcmluY2lwYWwocHJvdmlkZXIub3BlbklkQ29ubmVjdFByb3ZpZGVyQXJuLCB7XG4gICAgICAgIFN0cmluZ0xpa2U6IHtcbiAgICAgICAgICAvLyBPbmx5IGFsbG93IHNwZWNpZmllZCBzdWJqZWN0cyB0byBhc3N1bWUgdGhpcyByb2xlXG4gICAgICAgICAgW2Ake0dpdGh1YkFjdGlvbnNJZGVudGl0eVByb3ZpZGVyLmlzc3Vlcn06c3ViYF06IHN1YmplY3QsXG4gICAgICAgIH0sXG4gICAgICAgIFN0cmluZ0VxdWFsczoge1xuICAgICAgICAgIC8vIEF1ZGllbmNlIGlzIGFsd2F5cyBzdHMuYW1hem9uYXdzLmNvbSB3aXRoIEFXUyBvZmZpY2lhbCBHaXRodWIgQWN0aW9uXG4gICAgICAgICAgLy8gaHR0cHM6Ly9kb2NzLmdpdGh1Yi5jb20vZW4vYWN0aW9ucy9kZXBsb3ltZW50L3NlY3VyaXR5LWhhcmRlbmluZy15b3VyLWRlcGxveW1lbnRzL2NvbmZpZ3VyaW5nLW9wZW5pZC1jb25uZWN0LWluLWFtYXpvbi13ZWItc2VydmljZXMjYWRkaW5nLXRoZS1pZGVudGl0eS1wcm92aWRlci10by1hd3NcbiAgICAgICAgICBbYCR7R2l0aHViQWN0aW9uc0lkZW50aXR5UHJvdmlkZXIuaXNzdWVyfTphdWRgXTogJ3N0cy5hbWF6b25hd3MuY29tJyxcbiAgICAgICAgfSxcbiAgICAgIH0pLFxuICAgIH0pO1xuXG4gIH1cbn1cblxuIl19
|
package/package.json
CHANGED
|
@@ -21,6 +21,7 @@
|
|
|
21
21
|
"eslint": "npx projen eslint",
|
|
22
22
|
"compat": "npx projen compat",
|
|
23
23
|
"publish:npm": "npx projen publish:npm",
|
|
24
|
+
"publish:pypi": "npx projen publish:pypi",
|
|
24
25
|
"docgen": "npx projen docgen",
|
|
25
26
|
"release": "npx projen release",
|
|
26
27
|
"upgrade": "npx projen upgrade",
|
|
@@ -74,7 +75,7 @@
|
|
|
74
75
|
],
|
|
75
76
|
"main": "lib/index.js",
|
|
76
77
|
"license": "Apache-2.0",
|
|
77
|
-
"version": "0.0.
|
|
78
|
+
"version": "0.0.9",
|
|
78
79
|
"jest": {
|
|
79
80
|
"testMatch": [
|
|
80
81
|
"**/__tests__/**/*.ts?(x)",
|
|
@@ -118,7 +119,12 @@
|
|
|
118
119
|
"stability": "experimental",
|
|
119
120
|
"jsii": {
|
|
120
121
|
"outdir": "dist",
|
|
121
|
-
"targets": {
|
|
122
|
+
"targets": {
|
|
123
|
+
"python": {
|
|
124
|
+
"distName": "aws-cdk-github-oidc",
|
|
125
|
+
"module": "aws_cdk_github_oidc"
|
|
126
|
+
}
|
|
127
|
+
},
|
|
122
128
|
"tsc": {
|
|
123
129
|
"outDir": "lib",
|
|
124
130
|
"rootDir": "src"
|