codebuild_release.yml

---
Description: >-
  Codebuild project to build and publish Python docker images.

Metadata:
  Author: https://github.com/johnpreston

Parameters:
  RepositoryOrganization:
    Type: String

  RepositoryProvider:
    Type: String
    AllowedValues:
      - GitHub
      - CodeCommit
    Default: GitHub
  RepositoryName:
    Type: String

  BuildLogsRetentionDays:
    Type: Number
    AllowedValues: [1, 3, 5, 7, 14, 30, 60, 90, 120, 150, 180, 365, 400, 545, 731, 1827, 3653]
    Default: 14

  ReferenceBranchName:
    Type: String
    Default: main

  DockerBuildspecFile:
    Type: String
    Default: buildspec.yml

  PublicEcrRegistryUrl:
    Type: String

Mappings:
  RepoUrlPrefixes:
    GitHub:
      Prefix: https://github.com/

Conditions:
  UseGitHub: !Equals [ !Ref RepositoryProvider, 'GitHub']
  UseCodeCommit: !Equals [ !Ref RepositoryProvider, 'CodeCommit']

Resources:
  BuildLogsGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: !Sub 'codebuild/pr-builds/${RepositoryName}'
      RetentionInDays: !Ref BuildLogsRetentionDays
  CodeBuildRole:
    Type: AWS::IAM::Role
    Properties:
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/ReadOnlyAccess
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
        - arn:aws:iam::aws:policy/ResourceGroupsandTagEditorReadOnlyAccess
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Action:
              - sts:AssumeRole
            Effect: Allow
            Principal:
              Service:
                - !Sub 'codebuild.${AWS::URLSuffix}'
      Policies:
        - PolicyName: CodeBuildAccess
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Sid: CloudWatchLogs
                Effect: Allow
                Action:
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                Resource:
                  - !Sub '${BuildLogsGroup.Arn}'
              - Sid: CodeBuildReportsAccess
                Effect: Allow
                Resource:
                  - !Sub 'arn:${AWS::Partition}:codebuild:${AWS::Region}:${AWS::AccountId}:report-group/*'
                Action:
                  - codebuild:UpdateReportGroup
                  - codebuild:CreateReportGroup
                  - codebuild:CreateReport
                  - codebuild:UpdateReport
                  - codebuild:BatchPut*
              - Sid: CodeBuildBatch
                Effect: Allow
                Resource:
                  - !Sub 'arn:${AWS::Partition}:codebuild:${AWS::Region}:${AWS::AccountId}:*'
                Action:
                  - codebuild:StartBuild
                  - codebuild:RetryBuild
              - Sid: ECRAuthAndGetFromAny
                Effect: Allow
                Resource:
                  - "*"
                Action:
                  - "ecr:GetAuthorizationToken"
                  - "ecr:BatchGetImage"
                  - "ecr:BatchCheckLayerAvailability"
                  - "ecr:GetDownloadUrlForLayer"
              - Sid: ECRPublishToAnyPrivateRepo
                Effect: Allow
                Resource:
                  - !Sub "arn:${AWS::Partition}:ecr:${AWS::Region}:${AWS::AccountId}:repository/*"
                Action:
                  - "ecr:InitiateLayerUpload"
                  - "ecr:UploadLayerPart"
                  - "ecr:CompleteLayerUpload"
                  - "ecr:PutImage"

              - Sid: PublicEcrAuth
                Effect: Allow
                Resource:
                  - "*"
                Action:
                  - "ecr-public:GetAuthorizationToken"
                  - "sts:GetServiceBearerToken"
                  - "ecr-public:BatchCheckLayerAvailability"
                  - "ecr-public:GetRepositoryPolicy"
                  - "ecr-public:DescribeRepositories"
                  - "ecr-public:DescribeRegistries"
                  - "ecr-public:DescribeImages"
                  - "ecr-public:DescribeImageTags"
                  - "ecr-public:GetRepositoryCatalogData"
                  - "ecr-public:GetRegistryCatalogData"
              - Sid: PublicEcrPublish
                Effect: Allow
                Resource:
                  - "*"
                Action:
                  - "ecr-public:InitiateLayerUpload"
                  - "ecr-public:UploadLayerPart"
                  - "ecr-public:CompleteLayerUpload"
                  - "ecr-public:PutImage"

  DockerImagesBuild:
    Type: AWS::CodeBuild::Project
    Properties:
      ServiceRole: !GetAtt 'CodeBuildRole.Arn'
      Description: Build and publish docker images with python runtime
      LogsConfig:
        CloudWatchLogs:
          GroupName: !Ref BuildLogsGroup
          Status: ENABLED
          StreamName: !Ref RepositoryName
      BadgeEnabled: True
      Artifacts:
        Type: NO_ARTIFACTS
      # BuildBatchConfig:
      #   CombineArtifacts: False
      #   Restrictions:
      #     ComputeTypesAllowed:
      #       - BUILD_GENERAL1_SMALL
      #       - BUILD_GENERAL1_MEDIUM
      #       - BUILD_GENERAL1_LARGE
      #     MaximumBuildsAllowed: 10
      #   ServiceRole: !GetAtt 'CodeBuildRole.Arn'
      #   TimeoutInMins: 60
      Environment:
        EnvironmentVariables:
          - Name: PUBLIC_REGISTRY
            Value: !Ref PublicEcrRegistryUrl
            Type: PLAINTEXT
        ComputeType: BUILD_GENERAL1_SMALL
        Image: aws/codebuild/standard:5.0
        Type: LINUX_CONTAINER
        PrivilegedMode: True
      Source:
        Type: GITHUB
        ReportBuildStatus: True
        Location: !If
          - UseGitHub
          - !Sub 'https://github.com/${RepositoryOrganization}/${RepositoryName}'
          - !Sub 'https://codecommit.${AWS::Region}.${AWS::URLSuffix}'
        InsecureSsl: False
        BuildSpec: !Ref DockerBuildspecFile
      Triggers:
        Webhook: True
        # BuildType: BUILD_BATCH
        FilterGroups:
          - - Type: EVENT
              Pattern: "PULL_REQUEST_MERGED"
              ExcludeMatchedPattern: False
            - Type: HEAD_REF
              Pattern: '^refs/heads/.*$'
              ExcludeMatchedPattern: False
            - Type: BASE_REF
              Pattern: !Sub '^refs/heads/${ReferenceBranchName}$'
              ExcludeMatchedPattern: False
          - - Type: EVENT
              Pattern: "PUSH"
              ExcludeMatchedPattern: False
            - Type: HEAD_REF
              Pattern: !Sub '^refs/tags/v.*$'
              ExcludeMatchedPattern: False