Skip to content

Commit 7c07105

Browse files
josecorellajosecorella
authored
chore(CI): migrate CB CI jobs to GHA (#424)
1 parent d3e702e commit 7c07105

5 files changed

Lines changed: 186 additions & 1 deletion

File tree

‎.github/workflows/ci_static-analysis.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@ name: static analysis
33

44
on:
55
pull_request:
6+
branches: [ master ]
67
push:
78
# Run once a day
89
schedule:

‎.github/workflows/ci_tests.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ jobs:
2222
# x86 builds are only meaningful for Windows
2323
- os: windows-latest
2424
architecture: x86
25-
- os: macos-12
25+
- os: macos-13
2626
architecture: x64
2727
python:
2828
- 3.8

‎.github/workflows/python-examples.yml‎

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
name: Python Examples Tests
2+
3+
on:
4+
push:
5+
branches: [ master ]
6+
pull_request:
7+
branches: [ master ]
8+
9+
jobs:
10+
examples:
11+
runs-on: ubuntu-22.04
12+
strategy:
13+
fail-fast: false
14+
matrix:
15+
python-version: ['3.8', '3.9', '3.10', '3.11', '3.12']
16+
include:
17+
- python-version: '3.8'
18+
tox-env: 'py38-examples'
19+
- python-version: '3.9'
20+
tox-env: 'py39-examples'
21+
- python-version: '3.10'
22+
tox-env: 'py310-examples'
23+
- python-version: '3.11'
24+
tox-env: 'py311-examples'
25+
- python-version: '3.12'
26+
tox-env: 'py312-examples'
27+
permissions:
28+
id-token: write
29+
contents: read
30+
env:
31+
TOXENV: ${{ matrix.tox-env }}
32+
AWS_ENCRYPTION_SDK_PYTHON_INTEGRATION_TEST_AWS_KMS_KEY_ID: >-
33+
arn:aws:kms:us-west-2:658956600833:key/b3537ef1-d8dc-4780-9f5a-55776cbb2f7f
34+
AWS_ENCRYPTION_SDK_PYTHON_INTEGRATION_TEST_AWS_KMS_KEY_ID_2: >-
35+
arn:aws:kms:eu-central-1:658956600833:key/75414c93-5285-4b57-99c9-30c1cf0a22c2
36+
AWS_ENCRYPTION_SDK_PYTHON_INTEGRATION_TEST_AWS_KMS_MRK_KEY_ID_1: >-
37+
arn:aws:kms:us-east-1:658956600833:key/mrk-80bd8ecdcd4342aebd84b7dc9da498a7
38+
39+
steps:
40+
- uses: actions/checkout@v3
41+
42+
- name: Configure AWS Credentials for Tests
43+
uses: aws-actions/configure-aws-credentials@v4
44+
with:
45+
aws-region: us-west-2
46+
role-to-assume: arn:aws:iam::370957321024:role/GitHub-CI-ESDK-CLI-Role-us-west-2
47+
role-session-name: CLITests
48+
49+
- name: Set up Python ${{ matrix.python-version }}
50+
uses: actions/setup-python@v4
51+
with:
52+
python-version: ${{ matrix.python-version }}
53+
54+
- name: Install dependencies
55+
run: |
56+
python -m pip install --upgrade pip
57+
pip install "tox < 4.0"
58+
59+
# Python no longer bundles setuptools starting in 3.12
60+
- name: Install python version specific dependencies
61+
if: matrix.python-version == '3.12'
62+
run: |
63+
pip install -r dev_requirements/ci-requirements.txt
64+
65+
- name: Run examples tests with tox
66+
run: tox

‎.github/workflows/python-integration.yml‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
name: Python Integration Tests
2+
3+
on:
4+
push:
5+
branches: [ master ]
6+
pull_request:
7+
branches: [ master ]
8+
9+
jobs:
10+
integration:
11+
runs-on: ubuntu-22.04
12+
strategy:
13+
fail-fast: false
14+
matrix:
15+
python-version: ['3.8', '3.9', '3.10', '3.11', '3.12']
16+
include:
17+
- python-version: '3.8'
18+
tox-env: 'py38-integ'
19+
- python-version: '3.9'
20+
tox-env: 'py39-integ'
21+
- python-version: '3.10'
22+
tox-env: 'py310-integ'
23+
- python-version: '3.11'
24+
tox-env: 'py311-integ'
25+
- python-version: '3.12'
26+
tox-env: 'py312-integ'
27+
permissions:
28+
id-token: write
29+
contents: read
30+
env:
31+
TOXENV: ${{ matrix.tox-env }}
32+
AWS_ENCRYPTION_SDK_PYTHON_INTEGRATION_TEST_AWS_KMS_KEY_ID: >-
33+
arn:aws:kms:us-west-2:658956600833:key/b3537ef1-d8dc-4780-9f5a-55776cbb2f7f
34+
AWS_ENCRYPTION_SDK_PYTHON_INTEGRATION_TEST_AWS_KMS_MRK_KEY_ID_1: >-
35+
arn:aws:kms:us-east-1:658956600833:key/mrk-80bd8ecdcd4342aebd84b7dc9da498a7
36+
37+
steps:
38+
- uses: actions/checkout@v3
39+
40+
- name: Configure AWS Credentials for Tests
41+
uses: aws-actions/configure-aws-credentials@v4
42+
with:
43+
aws-region: us-west-2
44+
role-to-assume: arn:aws:iam::370957321024:role/GitHub-CI-ESDK-CLI-Role-us-west-2
45+
role-session-name: CLITests
46+
47+
- name: Set up Python ${{ matrix.python-version }}
48+
uses: actions/setup-python@v4
49+
with:
50+
python-version: ${{ matrix.python-version }}
51+
52+
- name: Install dependencies
53+
run: |
54+
python -m pip install --upgrade pip
55+
pip install "tox < 4.0"
56+
57+
# Python no longer bundles setuptools starting in 3.12
58+
- name: Install python version specific dependencies
59+
if: matrix.python-version == '3.12'
60+
run: |
61+
pip install -r dev_requirements/ci-requirements.txt
62+
63+
- name: Run integration tests with tox
64+
run: tox

‎cfn.yml‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
AWSTemplateFormatVersion: "2010-09-09"
2+
Description: "DDB Table and IAM Managed Policies/Role for AWS KMS Hierarchical Keyring Testing"
3+
4+
Parameters:
5+
ProjectName:
6+
Type: String
7+
Description: A prefix that will be applied to any names
8+
Default: ESDK-CLI
9+
GitHubRepo:
10+
Type: String
11+
Description: GitHub Repo that invokes CI
12+
Default: aws/aws-encryption-sdk-cli
13+
14+
Resources:
15+
GitHubCIRole:
16+
Type: 'AWS::IAM::Role'
17+
Properties:
18+
RoleName: !Sub "GitHub-CI-${ProjectName}-Role-${AWS::Region}"
19+
Description: "Access KMS Resources for CI from GitHub"
20+
ManagedPolicyArns:
21+
- "arn:aws:iam::370957321024:policy/KMS-Public-CMK-EncryptDecrypt-Key-Access"
22+
AssumeRolePolicyDocument: !Sub |
23+
{
24+
"Version": "2012-10-17",
25+
"Statement": [
26+
{
27+
"Effect": "Allow",
28+
"Principal": { "Federated": "arn:aws:iam::${AWS::AccountId}:oidc-provider/token.actions.githubusercontent.com" },
29+
"Action": "sts:AssumeRoleWithWebIdentity",
30+
"Condition": {
31+
"StringEquals": {
32+
"token.actions.githubusercontent.com:aud": "sts.amazonaws.com"
33+
},
34+
"StringLike": {
35+
"token.actions.githubusercontent.com:sub": "repo:${GitHubRepo}:*"
36+
}
37+
}
38+
},
39+
{
40+
"Effect": "Allow",
41+
"Principal": {
42+
"AWS": "*"
43+
},
44+
"Action": "sts:AssumeRole",
45+
"Condition": {
46+
"StringEquals": {
47+
"aws:PrincipalArn": [
48+
"arn:aws:iam::${AWS::AccountId}:role/ToolsDevelopment"
49+
]
50+
}
51+
}
52+
}
53+
]
54+
}

0 commit comments

Comments
 (0)