ci: deploy to CDN from GitHub Actions via OIDC - #1392
Open
abueide wants to merge 3 commits into
Open
Conversation
Un-reverts #1391 - architects are still evaluating whether GHA can deploy to S3 under a new proposal, so Buildkite is the safe path for now. Auth is redesigned from the original #1382 draft: that version fetched a Buildkite cluster secret (`analytics-next-cdn-release`) that was never actually provisioned, then did a plain `aws sts assume-role` relying on a Segment-fleet ambient identity (`SEGMENT_CONTEXTS`) that doesn't exist on Twilio's Buildkite agents. This version instead follows Twilio's documented OIDC pattern (buildkite-agent oidc request-token + sts assume-role-with-web-identity) - no ambient identity or cluster secret dependency. The upload role (arn:aws:iam::812113486725:role/ajs-private-assets-upload, owned by cdp-infra) and PROD_BUCKET are confirmed real values, recovered from the last successful legacy Buildkite build. The remaining env vars (STAGE_BUCKET, *_CDN_OAI, *_CUSTOM_DOMAIN_OAI, *_SHADOW) are placeholders pending a chamber read. Still blocked on: - cdp-infra adding a trust statement to ajs-private-assets-upload for Twilio Buildkite's OIDC issuer, scoped to this pipeline/branch - BUILDKITE_API_TOKEN repo secret (write_builds on cdp-analytics-next) - filling in the remaining chamber-sourced env vars above cdp-analytics-next's leftover GitHub webhook (build_branches/ build_pull_requests) has already been disabled directly via the Buildkite API, so this trigger step is now the only thing that can start a build there.
|
Codecov Report✅ All modified and coverable lines are covered by tests. Please upload reports for the commit 2b51410 to get more accurate results. Additional details and impacted files@@ Coverage Diff @@
## master #1392 +/- ##
=======================================
Coverage 91.59% 91.59%
=======================================
Files 127 127
Lines 4142 4142
Branches 1033 1033
=======================================
Hits 3794 3794
Misses 348 348
☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
ADR approved GHA + OIDC directly for CDN deploy, per GitHub's documented pattern: https://docs.github.com/en/actions/how-tos/secure-your-work/security-harden-deployments/oidc-in-aws Removes .buildkite/pipeline.yml and the Buildkite-API trigger step added in this branch's earlier commits. Adds a deploy-cdn job to publish.yml that assumes ajs-private-assets-upload directly via aws-actions/configure-aws-credentials (no Buildkite, no cluster secrets, no BUILDKITE_API_TOKEN needed) and runs the existing release:cdn script. Scoped to the same `production` GitHub Environment that already manually-gates npm publish, so both share one approval gate. Still blocked on: - cdp-infra reviewing/applying the paired trust-policy PRs (terracode-all-accounts#1650, terracode-platform#93) - filling in the remaining chamber-sourced env var placeholders (STAGE_BUCKET, *_CDN_OAI, *_CUSTOM_DOMAIN_OAI, *_SHADOW) cdp-analytics-next's Buildkite pipeline is left disabled (webhook already turned off) rather than deleted outright, in case it's still wanted as a reference - no further action needed there.
Follow-up to the previous commit - the .buildkite/pipeline.yml deletion landed but this file's changes didn't get staged.
abueide
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Update: this PR originally restored the Buildkite CDN pipeline (reverting #1391). The ADR for CDN deploy has since been approved for GitHub Actions + OIDC directly instead, per GitHub's documented pattern:
https://docs.github.com/en/actions/how-tos/secure-your-work/security-harden-deployments/oidc-in-aws
So this now removes
.buildkite/pipeline.ymlagain and adds adeploy-cdnjob topublish.ymlthat assumesajs-private-assets-uploaddirectly viaaws-actions/configure-aws-credentials(OIDC) - no Buildkite, no cluster secrets, noBUILDKITE_API_TOKENneeded.Design
deploy-cdnruns afterpublish(npm), gated on the sameproductionGitHub Environment that already manually-approves npm publish - one approval covers both.packages/browserrelease:cdnscript unchanged (yarn . build && NODE_ENV=production bash scripts/release.sh && NODE_ENV=stage bash scripts/release.sh) - only how AWS credentials are obtained has changed.Confirmed values
arn:aws:iam::812113486725:role/ajs-private-assets-upload(accountplat, owned by cdp-infra)PROD_BUCKET:segment-ajs-renderer-compiled-production- confirmed viachamber read analytics-next prod_bucketStill blocked on
plataccount and trusts it onajs-private-assets-upload, scoped torepo:segmentio/analytics-next:environment:production)STAGE_BUCKET/*_CDN_OAI/*_CUSTOM_DOMAIN_OAI/*_SHADOWplaceholders fromchamber read analytics-next <key>Already done (outside this PR)
cdp-analytics-next's leftover GitHub webhook (which was auto-triggering broken Buildkite builds on every push) was disabled directly via the Buildkite API. That pipeline is left disabled rather than deleted, in case it's useful as a reference, but nothing further is planned for it.Test plan