initial commit

.github/workflows/main-s3.yaml

@@ -0,0 +1,64 @@
+---
+
+# Copyright 2023 Skyscanner Limited.
+
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+
+# http://www.apache.org/licenses/LICENSE-2.0
+
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Tests for S3 Reusable Workflow
+name: Main S3
+
+on:
+  # Triggers the workflow on push or pull request events but only for the "main" branch
+  push:
+    branches: [ "main" ]
+    paths:
+      - '.github/workflows/reusable-s3.yaml'
+      - '.github/workflows/main-s3.yaml'
+  pull_request:
+    branches: [ "main" ]
+    paths:
+      - '.github/workflows/reusable-s3.yaml'
+      - '.github/workflows/main-s3.yaml'
+
+  # Allows you to run this workflow manually from the Actions tab
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  id-token: write
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Make a file to upload
+        run: |
+          mkdir static
+          echo "i am a test file" > static/test.txt
+      - name: Put content into build time artifact
+        uses: actions/upload-artifact@v3
+        with:
+          name: static-content
+          path: static
+
+  reusable-s3-dry-run:
+    uses: ./.github/workflows/reusable-s3.yaml
+    needs: build
+    with:
+      dry-run: true
+
+  reusable-s3:
+    uses: ./.github/workflows/reusable-s3.yaml
+    needs:
+      - build
+      - reusable-s3-dry-run

.github/workflows/reusable-s3.yaml

@@ -0,0 +1,107 @@
+---
+
+# Copyright 2023 Skyscanner Limited.
+
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+
+# http://www.apache.org/licenses/LICENSE-2.0
+
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Reusable Workflow for S3 uploads
+name: Upload to S3
+
+on:
+  workflow_call:
+    inputs:
+      dry-run:
+        required: false
+        type: boolean
+        description: Displays the operations that would be performed without actually running them.
+        default: false
+      artifact-name:
+        required: false
+        type: string
+        description: Name of the artifact to upload.
+        default: static-content
+
+permissions:
+  contents: read
+  id-token: write
+
+env:
+  BUCKET: 'x'
+  ROLE_TO_ASSUME: 'arn:aws:iam::####:role/X'
+  REGION: 'x-x-#'
+
+jobs:
+  bucket-upload:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/github-script@v6
+        id: prepare-aws-role-session-name
+        with:
+          # https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRoleWithWebIdentity.html
+          # RoleSessionName only permits [\w+=,.@-]*
+          script: return "GitHubActions," + context.repo.owner + "@" + context.repo.repo
+          result-encoding: string
+
+      - name: Login AWS
+        uses: aws-actions/configure-aws-credentials@v2.2.0
+        with:
+          role-to-assume: ${{ env.ROLE_TO_ASSUME }}
+          role-session-name: ${{ steps.prepare-aws-role-session-name.outputs.result }}
+          aws-region: ${{ env.REGION }}
+          mask-aws-account-id: 'no'
+          inline-session-policy: >-
+            {
+              "Version": "2012-10-17",
+              "Statement": [
+                {
+                  "Effect": "Allow",
+                  "Action": [
+                    "s3:ListBucket"
+                  ],
+                  "Resource": [
+                    "arn:aws:s3:::${{ env.BUCKET }}"
+                  ]
+                },
+                {
+                  "Effect": "Allow",
+                  "Action": [
+                    "s3:GetObject",
+                    "s3:GetObjectAcl",
+                    "s3:GetObjectVersion",
+                    "s3:PutObject",
+                    "s3:PutObjectAcl"
+                  ],
+                  "Resource": [
+                    "arn:aws:s3:::${{ env.BUCKET }}/${{ github.repository }}/*"
+                  ]
+                }
+              ]
+            }
+
+      
+      - name: "Debug: sts get-caller-identity"
+        run: |
+          aws sts get-caller-identity --output table --color on
+
+      - name: Download artifact
+        uses: actions/download-artifact@v3
+        with:
+          name: ${{ inputs.artifact-name }}
+          path: /tmp/bucket-upload/
+
+      - name: List content to be uploaded
+        run: ls /tmp/bucket-upload/
+
+      - name: Upload to S3 bucket
+        run: |
+          aws s3 cp ${{ inputs.dry-run && '--dryrun' || '' }} --recursive /tmp/bucket-upload/ s3://${{ env.BUCKET }}/${{ github.repository }}

CODE_OF_CONDUCT.md

@@ -0,0 +1,76 @@
+# Contributor Covenant Code of Conduct
+
+## Our Pledge
+
+In the interest of fostering an open and welcoming environment, we as
+contributors and maintainers pledge to make participation in our project and
+our community a harassment-free experience for everyone, regardless of age, body
+size, disability, ethnicity, sex characteristics, gender identity and expression,
+level of experience, education, socio-economic status, nationality, personal
+appearance, race, religion, or sexual identity and orientation.
+
+## Our Standards
+
+Examples of behaviour that contributes to creating a positive environment
+include:
+
+* Using welcoming and inclusive language
+* Being respectful of differing viewpoints and experiences
+* Gracefully accepting constructive criticism
+* Focusing on what is best for the community
+* Showing empathy towards other community members
+
+Examples of unacceptable behaviour by participants include:
+
+* The use of sexualized language or imagery and sexual attention or
+  advances
+* Trolling, insulting/derogatory comments, and personal or political attacks
+* Public or private harassment
+* Publishing others' private information, such as a physical or electronic
+  address, without explicit permission
+* Other conduct which could reasonably be considered inappropriate in a
+  professional setting
+
+## Our Responsibilities
+
+Project maintainers are responsible for clarifying the standards of acceptable
+behaviour and are expected to take appropriate and fair corrective action in
+response to any instances of unacceptable behaviour.
+
+Project maintainers have the right and responsibility to remove, edit, or
+reject comments, commits, code, wiki edits, issues, and other contributions
+that are not aligned to this Code of Conduct, or to ban temporarily or
+permanently any contributor for other behaviours that they deem inappropriate,
+threatening, offensive, or harmful.
+
+## Scope
+
+This Code of Conduct applies within all project spaces, and it also applies when
+an individual is representing the project or its community in public spaces.
+Examples of representing a project or community include using an official
+project e-mail address, posting via an official social media account, or acting
+as an appointed representative at an online or offline event. Representation of
+a project may be further defined and clarified by project maintainers.
+
+## Enforcement
+
+Instances of abusive, harassing, or otherwise unacceptable behaviour may be
+reported by contacting the project team at open-source@skyscanner.net. All
+complaints will be reviewed and investigated and will result in a response that
+is deemed necessary and appropriate to the circumstances. The project team is
+obligated to maintain confidentiality with regard to the reporter of an incident.
+Further details of specific enforcement policies may be posted separately.
+
+Project maintainers who do not follow or enforce the Code of Conduct in good
+faith may face temporary or permanent repercussions as determined by other
+members of the project's leadership.
+
+## Attribution
+
+This Code of Conduct is adapted from the [Contributor Covenant][homepage], version 1.4,
+available at https://www.contributor-covenant.org/version/1/4/code-of-conduct.html
+
+[homepage]: https://www.contributor-covenant.org
+
+For answers to common questions about this code of conduct, see
+https://www.contributor-covenant.org/faq

CONTRIBUTING.md

@@ -0,0 +1,33 @@
+# Contributing to gha-aws-oidc-sample
+
+We're glad you want to make a contribution!
+
+Fork this repository and send in a pull request when you're finished with your changes. Link any relevant issues in too.
+
+Take note of the build status of your pull request, only builds that pass will be accepted. Please also keep to our conventions and style so we can keep this repository as clean as possible.
+
+## License
+
+By contributing your code, you agree to license your contribution under the terms of the APLv2: [LICENSE](LICENSE)
+
+All files are released with the Apache 2.0 license.
+
+If you are adding a new file it should have a header like this:
+
+```
+/**
+ * Copyright <<YEAR>> Skyscanner Limited.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+ ```