carlin 0.19.0

package/dist/deploy/cicd/lambdas/executeTasks.js

@@ -0,0 +1,91 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.executeTasks = exports.shConditionalCommands = void 0;
+const aws_sdk_1 = require("aws-sdk");
+const getProcessEnvVariable_1 = require("./getProcessEnvVariable");
+const ecs = new aws_sdk_1.ECS({ apiVersion: '2014-11-13' });
+const compileCommands = (commands) => {
+    return commands.map((c) => c.replace(/;$/, '')).join(' && ');
+};
+const approvedStatus = 'Approved';
+const rejectedStatus = 'Rejected';
+const successCommands = [
+    `carlin cicd-ecs-task-report --status=${approvedStatus}`,
+];
+const failureCommands = [
+    `carlin cicd-ecs-task-report --status=${rejectedStatus}`,
+];
+const shConditionalCommands = ({ conditionalCommands, }) => {
+    const conditionalCommand = compileCommands(conditionalCommands);
+    const successCommand = compileCommands([
+        'echo "Success Command"',
+        ...successCommands,
+    ]);
+    const failureCommand = compileCommands([
+        'echo "Failure Command"',
+        ...failureCommands,
+    ]);
+    const finallyCommand = compileCommands(['echo "Finally Command"']);
+    return `if ${conditionalCommand}; then ${successCommand}; else ${failureCommand}; fi; ${finallyCommand}`;
+};
+exports.shConditionalCommands = shConditionalCommands;
+const executeTasks = async ({ commands = [], cpu, memory, taskEnvironment = [], tags = [], }) => {
+    const command = compileCommands([
+        /**
+         * https://stackoverflow.com/questions/2853803/how-to-echo-shell-commands-as-they-are-executed/2853811
+         */
+        'set -x',
+        /**
+         * https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task-metadata-endpoint-v3.html
+         */
+        `export ECS_TASK_ARN=$(curl -X GET "\${ECS_CONTAINER_METADATA_URI}/task" | jq ".TaskARN")`,
+        ...commands,
+    ]);
+    const response = await ecs
+        .runTask({
+        taskDefinition: getProcessEnvVariable_1.getProcessEnvVariable('ECS_TASK_DEFINITION'),
+        cluster: getProcessEnvVariable_1.getProcessEnvVariable('ECS_CLUSTER_ARN'),
+        count: 1,
+        launchType: 'FARGATE',
+        networkConfiguration: {
+            awsvpcConfiguration: {
+                subnets: [
+                    getProcessEnvVariable_1.getProcessEnvVariable('VPC_PUBLIC_SUBNET_0'),
+                    getProcessEnvVariable_1.getProcessEnvVariable('VPC_PUBLIC_SUBNET_1'),
+                    getProcessEnvVariable_1.getProcessEnvVariable('VPC_PUBLIC_SUBNET_2'),
+                ],
+                assignPublicIp: 'ENABLED',
+                securityGroups: [getProcessEnvVariable_1.getProcessEnvVariable('VPC_SECURITY_GROUP')],
+            },
+        },
+        overrides: {
+            containerOverrides: [
+                {
+                    command: ['sh', '-cv', command],
+                    name: getProcessEnvVariable_1.getProcessEnvVariable('ECS_CONTAINER_NAME'),
+                    environment: [
+                        {
+                            name: 'CI',
+                            value: 'true',
+                        },
+                        {
+                            name: 'ECS_ENABLE_CONTAINER_METADATA',
+                            value: 'true',
+                        },
+                        {
+                            name: 'ECS_TASK_REPORT_HANDLER_NAME',
+                            value: getProcessEnvVariable_1.getProcessEnvVariable('ECS_TASK_REPORT_HANDLER_NAME'),
+                        },
+                        ...taskEnvironment,
+                    ],
+                },
+            ],
+            cpu,
+            memory,
+        },
+        tags,
+    })
+        .promise();
+    return response;
+};
+exports.executeTasks = executeTasks;

package/dist/deploy/cicd/lambdas/getProcessEnvVariable.js

@@ -0,0 +1,10 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getProcessEnvVariable = void 0;
+const getProcessEnvVariable = (env) => {
+    if (process.env[env]) {
+        return process.env[env];
+    }
+    throw new Error(`process.env.${env} doesn't exist.`);
+};
+exports.getProcessEnvVariable = getProcessEnvVariable;

package/dist/deploy/cicd/lambdas/githubWebhooksApiV1.handler.js

@@ -0,0 +1,143 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.githubWebhooksApiV1Handler = void 0;
+const webhooks_1 = require("@octokit/webhooks");
+const adm_zip_1 = __importDefault(require("adm-zip"));
+const aws_sdk_1 = require("aws-sdk");
+const getTriggerPipelineObjectKey_1 = require("../getTriggerPipelineObjectKey");
+const pipelines_1 = require("../pipelines");
+const executeTasks_1 = require("./executeTasks");
+const getProcessEnvVariable_1 = require("./getProcessEnvVariable");
+const s3 = new aws_sdk_1.S3();
+/**
+ * When this file is saved on S3, a CodePipeline pipeline is started.
+ */
+const putJobDetails = async ({ pipeline, details, }) => {
+    const zip = new adm_zip_1.default();
+    const content = JSON.stringify(details);
+    zip.addFile(pipeline, Buffer.from(content));
+    return s3
+        .putObject({
+        Body: zip.toBuffer(),
+        Bucket: getProcessEnvVariable_1.getProcessEnvVariable('BASE_STACK_BUCKET_NAME'),
+        Key: getTriggerPipelineObjectKey_1.getTriggerPipelinesObjectKey(pipeline),
+    })
+        .promise();
+};
+const githubWebhooksApiV1Handler = async (event, context) => {
+    try {
+        /**
+         * Ends function immediately after callback.
+         */
+        context.callbackWaitsForEmptyEventLoop = false;
+        const { body, headers } = event;
+        if (!body) {
+            throw new Error("event.body doesn't exist.");
+        }
+        const xGitHubDelivery = headers['X-GitHub-Delivery'];
+        const xGitHubEvent = headers['X-GitHub-Event'];
+        const xHubSignature = headers['X-Hub-Signature-256'] || headers['X-Hub-Signature'];
+        if (!xGitHubDelivery) {
+            throw new Error("X-GitHub-Delivery doesn't exist.");
+        }
+        if (!xGitHubEvent) {
+            throw new Error("X-GitHub-Event doesn't exist.");
+        }
+        if (!xHubSignature) {
+            throw new Error("X-Hub-Signature-256 or X-Hub-Signature doesn't exist.");
+        }
+        const webhooks = new webhooks_1.Webhooks({ secret: '123' });
+        const pipelines = JSON.parse(process.env.PIPELINES_JSON || JSON.stringify([]));
+        if (pipelines.includes('pr')) {
+            webhooks.on([
+                'pull_request.opened',
+                'pull_request.reopened',
+                'pull_request.ready_for_review',
+                'pull_request.synchronize',
+            ], async ({ payload }) => {
+                if (payload.pull_request.draft) {
+                    return;
+                }
+                await executeTasks_1.executeTasks({
+                    commands: [
+                        executeTasks_1.shConditionalCommands({
+                            conditionalCommands: pipelines_1.getPrCommands({
+                                branch: payload.pull_request.head.ref,
+                            }),
+                        }),
+                    ],
+                    tags: [
+                        { key: 'Pipeline', value: 'pr' },
+                        { key: 'PullRequest', value: payload.number.toString() },
+                        { key: 'PullRequestTitle', value: payload.pull_request.title },
+                        { key: 'PullRequestUrl', value: payload.pull_request.url },
+                        { key: 'Action', value: payload.action },
+                        { key: 'Branch', value: payload.pull_request.head.ref },
+                    ],
+                });
+            });
+            webhooks.on(['pull_request.closed'], async ({ payload }) => {
+                /**
+                 * https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task-cpu-memory-error.html
+                 */
+                await executeTasks_1.executeTasks({
+                    cpu: '256',
+                    memory: '512',
+                    commands: [
+                        executeTasks_1.shConditionalCommands({
+                            conditionalCommands: pipelines_1.getClosedPrCommands({
+                                branch: payload.pull_request.head.ref,
+                            }),
+                        }),
+                    ],
+                    tags: [
+                        { key: 'Pipeline', value: 'pr' },
+                        { key: 'PullRequest', value: payload.number.toString() },
+                        { key: 'PullRequestTitle', value: payload.pull_request.title },
+                        { key: 'PullRequestUrl', value: payload.pull_request.url },
+                        { key: 'Action', value: payload.action },
+                        { key: 'Branch', value: payload.pull_request.head.ref },
+                    ],
+                });
+            });
+        }
+        if (pipelines.includes('main')) {
+            webhooks.on('push', async (details) => {
+                if (details.payload.ref === 'refs/heads/main') {
+                    await putJobDetails({ pipeline: 'main', details });
+                }
+            });
+        }
+        if (pipelines.includes('tag')) {
+            webhooks.on('push', async (details) => {
+                if (details.payload.ref.startsWith('refs/tags/')) {
+                    await putJobDetails({ pipeline: 'tag', details });
+                }
+            });
+        }
+        webhooks.onError((onErrorEvent) => {
+            console.error('Webhooks on error.');
+            console.error(JSON.stringify(onErrorEvent, null, 2));
+            throw onErrorEvent;
+        });
+        /**
+         * Replace "receive" for "verifyAndReceive" when WebCrypto exist on Node.js
+         * API.
+         */
+        await webhooks.receive({
+            id: xGitHubDelivery,
+            name: xGitHubEvent,
+            // signature: xHubSignature,
+            payload: JSON.parse(body),
+        });
+        return { statusCode: 200, body: JSON.stringify({ ok: true }) };
+    }
+    catch (error) {
+        console.error(error);
+        return { statusCode: error.status || 500, body: error.message };
+    }
+};
+exports.githubWebhooksApiV1Handler = githubWebhooksApiV1Handler;

package/dist/deploy/cicd/lambdas/index.js

@@ -0,0 +1,11 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.pipelinesHandler = exports.githubWebhooksApiV1Handler = exports.ecsTaskReportHandler = exports.cicdApiV1Handler = void 0;
+var cicdApiV1_handler_1 = require("./cicdApiV1.handler");
+Object.defineProperty(exports, "cicdApiV1Handler", { enumerable: true, get: function () { return cicdApiV1_handler_1.cicdApiV1Handler; } });
+var ecsTaskReport_handler_1 = require("./ecsTaskReport.handler");
+Object.defineProperty(exports, "ecsTaskReportHandler", { enumerable: true, get: function () { return ecsTaskReport_handler_1.ecsTaskReportHandler; } });
+var githubWebhooksApiV1_handler_1 = require("./githubWebhooksApiV1.handler");
+Object.defineProperty(exports, "githubWebhooksApiV1Handler", { enumerable: true, get: function () { return githubWebhooksApiV1_handler_1.githubWebhooksApiV1Handler; } });
+var pipelines_handler_1 = require("./pipelines.handler");
+Object.defineProperty(exports, "pipelinesHandler", { enumerable: true, get: function () { return pipelines_handler_1.pipelinesHandler; } });

package/dist/deploy/cicd/lambdas/pipelines.handler.js

@@ -0,0 +1,154 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    Object.defineProperty(o, k2, { enumerable: true, get: function() { return m[k]; } });
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.pipelinesHandler = exports.getJobDetails = exports.getJobDetailsFilename = void 0;
+const adm_zip_1 = __importDefault(require("adm-zip"));
+const aws_sdk_1 = require("aws-sdk");
+const fs = __importStar(require("fs"));
+const pipelines_1 = require("../pipelines");
+const executeTasks_1 = require("./executeTasks");
+const putApprovalResultManualTask_1 = require("./putApprovalResultManualTask");
+const codepipeline = new aws_sdk_1.CodePipeline();
+const getUserParameters = (event) => {
+    const [pipeline, stage] = event['CodePipeline.job'].data.actionConfiguration.configuration.UserParameters.split('&');
+    return { pipeline: pipeline, stage };
+};
+const getJobDetailsFilename = (jobId) => `/tmp/${jobId}.zip`;
+exports.getJobDetailsFilename = getJobDetailsFilename;
+const getJobDetails = async (event) => {
+    const jobId = event['CodePipeline.job'].id;
+    const s3 = new aws_sdk_1.S3({
+        credentials: event['CodePipeline.job'].data.artifactCredentials,
+    });
+    const { bucketName, objectKey } = event['CodePipeline.job'].data.inputArtifacts[0].location.s3Location;
+    const { Body } = await s3
+        .getObject({ Bucket: bucketName, Key: objectKey })
+        .promise();
+    if (!Body) {
+        throw new Error('Cannot retrieve the job description (there is no input artifact).');
+    }
+    const filename = exports.getJobDetailsFilename(jobId);
+    await fs.promises.writeFile(filename, Body, {});
+    const zip = new adm_zip_1.default(filename);
+    const file = zip.readAsText(getUserParameters(event).pipeline);
+    try {
+        return JSON.parse(file);
+    }
+    catch (_a) {
+        throw new Error(`Job details is not a valid json. ${file}`);
+    }
+};
+exports.getJobDetails = getJobDetails;
+const pipelinesHandler = async (event) => {
+    var _a, _b;
+    const jobId = event['CodePipeline.job'].id;
+    let pipelineName;
+    try {
+        const { pipeline } = getUserParameters(event);
+        const gitHubJobDetails = await exports.getJobDetails(event);
+        const { jobDetails } = await codepipeline
+            .getJobDetails({ jobId })
+            .promise();
+        pipelineName = (_b = (_a = jobDetails === null || jobDetails === void 0 ? void 0 : jobDetails.data) === null || _a === void 0 ? void 0 : _a.pipelineContext) === null || _b === void 0 ? void 0 : _b.pipelineName;
+        const executeTasksInput = (() => {
+            const tags = [
+                {
+                    key: 'Pipeline',
+                    value: pipeline,
+                },
+                {
+                    key: 'AfterCommit',
+                    value: gitHubJobDetails.payload.after,
+                },
+            ];
+            const taskEnvironment = [];
+            if (pipelineName) {
+                tags.push({
+                    key: 'PipelineName',
+                    value: pipelineName,
+                });
+                taskEnvironment.push({
+                    name: 'PIPELINE_NAME',
+                    value: pipelineName,
+                });
+            }
+            if (pipeline === 'main') {
+                return {
+                    commands: [
+                        executeTasks_1.shConditionalCommands({
+                            conditionalCommands: pipelines_1.getMainCommands(),
+                        }),
+                    ],
+                    tags,
+                    taskEnvironment,
+                };
+            }
+            if (pipeline === 'tag') {
+                const tag = gitHubJobDetails.payload.ref.split('/')[2];
+                return {
+                    commands: [
+                        executeTasks_1.shConditionalCommands({
+                            conditionalCommands: pipelines_1.getTagCommands({ tag }),
+                        }),
+                    ],
+                    tags: [
+                        ...tags,
+                        {
+                            key: 'Tag',
+                            value: tag,
+                        },
+                    ],
+                    taskEnvironment,
+                };
+            }
+            return undefined;
+        })();
+        if (!executeTasksInput) {
+            throw new Error('executeTasksInputUndefined');
+        }
+        await executeTasks_1.executeTasks(executeTasksInput);
+        await codepipeline.putJobSuccessResult({ jobId }).promise();
+    }
+    catch (error) {
+        if (pipelineName) {
+            await putApprovalResultManualTask_1.putApprovalResultManualTask({
+                pipelineName,
+                /**
+                 * https://docs.aws.amazon.com/codepipeline/latest/APIReference/API_ApprovalResult.html
+                 */
+                result: { status: 'Rejected', summary: error.message.slice(0, 511) },
+            });
+        }
+        await codepipeline
+            .putJobFailureResult({
+            jobId,
+            failureDetails: {
+                type: 'JobFailed',
+                message: error.message.slice(0, 4999),
+            },
+        })
+            .promise();
+    }
+};
+exports.pipelinesHandler = pipelinesHandler;

package/dist/deploy/cicd/lambdas/putApprovalResultManualTask.js

@@ -0,0 +1,52 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.putApprovalResultManualTask = void 0;
+const aws_sdk_1 = require("aws-sdk");
+const config_1 = require("../config");
+const codepipeline = new aws_sdk_1.CodePipeline();
+const FIVE_SECONDS = 5 * 1000;
+const getApprovalActionToken = ({ actionName, stageName, pipelineName, }) => new Promise((resolve, reject) => {
+    setTimeout(() => {
+        codepipeline.getPipelineState({ name: pipelineName }, async (err, { stageStates = [] }) => {
+            var _a;
+            if (err) {
+                return reject(err);
+            }
+            const approvalStageState = stageStates.find((s) => s.stageName === stageName);
+            if (!approvalStageState) {
+                throw new Error('ApprovalStageStateIsUndefined');
+            }
+            const approvalActionState = (_a = approvalStageState.actionStates) === null || _a === void 0 ? void 0 : _a.find((a) => a.actionName === actionName);
+            if (!approvalActionState) {
+                throw new Error('ApprovalActionStateIsUndefined');
+            }
+            const { latestExecution } = approvalActionState;
+            if (latestExecution && latestExecution.status === 'InProgress') {
+                return resolve(latestExecution.token);
+            }
+            try {
+                return resolve(await getApprovalActionToken({
+                    actionName,
+                    stageName,
+                    pipelineName,
+                }));
+            }
+            catch (error) {
+                return reject(error);
+            }
+        });
+    }, FIVE_SECONDS);
+});
+const putApprovalResultManualTask = async ({ pipelineName, result, }) => {
+    const actionName = config_1.PIPELINE_ECS_TASK_EXECUTION_MANUAL_APPROVAL_ACTION_NAME;
+    const stageName = config_1.PIPELINE_ECS_TASK_EXECUTION_STAGE_NAME;
+    const token = await getApprovalActionToken({
+        actionName,
+        stageName,
+        pipelineName,
+    });
+    await codepipeline
+        .putApprovalResult({ pipelineName, stageName, actionName, result, token })
+        .promise();
+};
+exports.putApprovalResultManualTask = putApprovalResultManualTask;