create-qpq-app 0.1.20 → 0.1.21
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "create-qpq-app",
|
|
3
|
-
"version": "0.1.
|
|
3
|
+
"version": "0.1.21",
|
|
4
4
|
"description": "Scaffold a new quidproquo app: npx create-qpq-app my-app",
|
|
5
5
|
"main": "./lib/commonjs/index.js",
|
|
6
6
|
"module": "./lib/esm/index.js",
|
|
@@ -55,7 +55,7 @@
|
|
|
55
55
|
},
|
|
56
56
|
"devDependencies": {
|
|
57
57
|
"@types/node": "^22.13.13",
|
|
58
|
-
"quidproquo-tsconfig": "0.1.
|
|
58
|
+
"quidproquo-tsconfig": "0.1.21"
|
|
59
59
|
},
|
|
60
60
|
"bin": {
|
|
61
61
|
"create-qpq-app": "./lib/commonjs/bin/createQpqApp.js"
|
|
@@ -7,7 +7,7 @@ description: The IAM role GitHub Actions assumes through OIDC to deploy an app e
|
|
|
7
7
|
|
|
8
8
|
Declares the **IAM role a GitHub Actions workflow assumes** (via OpenID Connect, no stored keys) to deploy this app's environment. It is a bootstrap setting: declared once in `bootstrap.qpq.ts`, deployed by the bootstrap stack.
|
|
9
9
|
|
|
10
|
-
- **On AWS:** creates `github-actions-deploy-<app>-<environment>` with a two-hour session and only what a deploy needs: `sts:AssumeRole` on the CDK bootstrap roles (deploy, file-publishing, image-publishing, lookup) in every region the app deploys to, read and write on this app's S3 buckets (`*-<app>-*-<environment>`, where the built views and federated remotes are synced), and read on the `/cdk-bootstrap/*` and `/qpq/*` SSM parameters. CloudFormation applies the stacks as the bootstrap exec role, so the deploy identity never holds the permissions of what it deploys. Its trust policy allows `sts:AssumeRoleWithWebIdentity` from the account's `token.actions.githubusercontent.com` provider when the token's audience is `sts.amazonaws.com` and its subject is the repository's immutable-id form `repo:<owner>@<ownerId>/<name>@<repositoryId>:environment:<githubEnvironment>`. The name form `repo:<owner>/<name>:...` is trusted only when no ids are given or `trustNameForm` is set, since a name can be re-earned by whoever next owns it and an id cannot. The role ARN is a stack output. The provider itself is one per account and comes from [`defineAccountGithubOidcProvider`](./account-github-oidc-provider.md) in the account config.
|
|
10
|
+
- **On AWS:** creates `github-actions-deploy-<app>-<environment>` with a two-hour session and only what a deploy needs: `sts:AssumeRole` on the CDK bootstrap roles (deploy, file-publishing, image-publishing, lookup) in every region the app deploys to, read and write on this app's S3 buckets (`*-<app>-*-<environment>`, where the built views and federated remotes are synced), and read on the `/cdk-bootstrap/*` and `/qpq/*` SSM parameters. CloudFormation applies the stacks as the bootstrap exec role, so the deploy identity never holds the permissions of what it deploys. Its trust policy allows `sts:AssumeRoleWithWebIdentity` from the account's `token.actions.githubusercontent.com` provider when the token's audience is `sts.amazonaws.com` and its subject is the repository's immutable-id form `repo:<owner>@<ownerId>/<name>@<repositoryId>:environment:<githubEnvironment>`. The name form `repo:<owner>/<name>:...` is trusted only when no ids are given or `trustNameForm` is set, since a name can be re-earned by whoever next owns it and an id cannot. GitHub only issues the id form for repositories switched to immutable subjects (new repositories, or `gh api -X PUT repos/<owner>/<name>/actions/oidc/customization/sub -F use_default=false -F use_immutable_subject=true` for older ones); switch the repository before deploying an id-only role. The role ARN is a stack output. The provider itself is one per account and comes from [`defineAccountGithubOidcProvider`](./account-github-oidc-provider.md) in the account config.
|
|
11
11
|
|
|
12
12
|
```typescript
|
|
13
13
|
import { defineAwsGithubDeployRole } from 'quidproquo-config-aws';
|
|
@@ -39,7 +39,7 @@ function defineAwsGithubDeployRole(
|
|
|
39
39
|
| `ownerId` | `number` | – | The owner's numeric GitHub id. `gh api repos/<owner>/<name> --jq .owner.id`. With `repositoryId`, also trusts the immutable-id subject form. |
|
|
40
40
|
| `repositoryId` | `number` | – | The repository's numeric GitHub id. `gh api repos/<owner>/<name> --jq .id`. |
|
|
41
41
|
| `githubEnvironment` | `string` | the deploy environment | The GitHub Environment the deploy job declares (`environment:` on the job). A job without it is refused by STS. |
|
|
42
|
-
| `trustNameForm` | `boolean` | `true` without ids, else `false` | Also trust the name-form subject.
|
|
42
|
+
| `trustNameForm` | `boolean` | `true` without ids, else `false` | Also trust the name-form subject. Only for a repository not yet switched to immutable subjects. |
|
|
43
43
|
|
|
44
44
|
## Locking it down further
|
|
45
45
|
|