changing CD to use role instead of SA and also change nightly build n…

…ame (#85) This PR makes following changes: Fixes CD Job to use Role instead of Service Account Changes the nightly build name to just have Date in YYMMDD
hypermodeinc · Jan 8, 2024 · b419266 · b419266
1 parent 7e4c4d1
commit b419266
Showing 1 changed file with 14 additions and 11 deletions.
diff --git a/.github/workflows/cd-dgraph.yml b/.github/workflows/cd-dgraph.yml
@@ -16,6 +16,9 @@ on:
         type: string
   schedule:
     - cron: '0 0 * * *' # nightly
+permissions:
+  id-token: write
+  contents: read
 env:
   GOPRIVATE: "github.com/dgraph-io/*,github.com/gohypermode/*"
 jobs:
@@ -53,24 +56,24 @@ jobs:
           echo "dgraph git sha "$DGRAPH_GIT_SHA
           echo "DGRAPH_GIT_SHA=$DGRAPH_GIT_SHA" >> $GITHUB_ENV
       - name: Fetch date
-        run: echo "NIGHTLY_BUILD_TIME=$(date +'%Y-%m-%dT%H:%M:%S')" >> $GITHUB_ENV
+        run: echo "NIGHTLY_BUILD_TIME=$(date +'%Y-%m-%d')" >> $GITHUB_ENV
       - name: Make Dgraph Linux Build
         run: make dgraph DGRAPH_VERSION='nightly-${{ env.NIGHTLY_BUILD_TIME }}'
       - name: Make Dgraph Docker Image
         run: |
           make docker-image DGRAPH_VERSION='nightly-${{ env.NIGHTLY_BUILD_TIME }}-${{ env.DGRAPH_GIT_SHA }}' IMAGE_REPOSITORY='hypermode/dgraph-private'
-          docker tag hypermode/dgraph-private:nightly-${{ env.NIGHTLY_BUILD_TIME }}-${{ env.DGRAPH_GIT_SHA }} ${{ secrets.AWS_ACCOUNT_ID }}.dkr.ecr.${{ secrets.AWS_REGION }}.amazonaws.com/hypermode/dgraph-private:nightly-${{ env.NIGHTLY_BUILD_TIME }}-${{ env.DGRAPH_GIT_SHA }}
+          docker tag hypermode/dgraph-private:nightly-${{ env.NIGHTLY_BUILD_TIME }}-${{ env.DGRAPH_GIT_SHA }} ${{ vars.AWS_ACCOUNT_ID }}.dkr.ecr.${{ vars.AWS_REGION }}.amazonaws.com/hypermode/dgraph-private:nightly-${{ env.NIGHTLY_BUILD_TIME }}-${{ env.DGRAPH_GIT_SHA }}
       - name: Configure AWS credentials
         uses: aws-actions/configure-aws-credentials@v1
         with:
-          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
-          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-          aws-region: ${{ secrets.AWS_REGION }}
+          role-to-assume: '${{ vars.AWS_ROLE }}'
+          role-session-name: CD_DGRAPH_PRIVATE
+          aws-region: '${{ vars.AWS_REGION }}'
       - name: Login to Amazon ECR
         uses: aws-actions/amazon-ecr-login@v1
       - name: Push Images to ECR
         run: |
-          docker push ${{ secrets.AWS_ACCOUNT_ID }}.dkr.ecr.${{ secrets.AWS_REGION }}.amazonaws.com/hypermode/dgraph-private:nightly-${{ env.NIGHTLY_BUILD_TIME }}-${{ env.DGRAPH_GIT_SHA }}
+          docker push ${{ vars.AWS_ACCOUNT_ID }}.dkr.ecr.${{ vars.AWS_REGION }}.amazonaws.com/hypermode/dgraph-private:nightly-${{ env.NIGHTLY_BUILD_TIME }}-${{ env.DGRAPH_GIT_SHA }}
   dgraph-build-workflow-dispatch:
     if: ${{ github.event_name == 'workflow_dispatch' }}
     environment: '${{ github.event.inputs.environment }}'
@@ -126,15 +129,15 @@ jobs:
       - name: Make Dgraph Docker Image
         run: |
           make docker-image DGRAPH_VERSION=${{ env.DGRAPH_RELEASE_VERSION }}-${{ env.DGRAPH_GIT_SHA }} IMAGE_REPOSITORY='hypermode/dgraph-private'
-          docker tag hypermode/dgraph-private:${{ env.DGRAPH_RELEASE_VERSION }}-${{ env.DGRAPH_GIT_SHA }} ${{ secrets.AWS_ACCOUNT_ID }}.dkr.ecr.${{ secrets.AWS_REGION }}.amazonaws.com/hypermode/dgraph-private:${{ env.DGRAPH_RELEASE_VERSION }}-${{ env.DGRAPH_GIT_SHA }}
+          docker tag hypermode/dgraph-private:${{ env.DGRAPH_RELEASE_VERSION }}-${{ env.DGRAPH_GIT_SHA }} ${{ vars.AWS_ACCOUNT_ID }}.dkr.ecr.${{ vars.AWS_REGION }}.amazonaws.com/hypermode/dgraph-private:${{ env.DGRAPH_RELEASE_VERSION }}-${{ env.DGRAPH_GIT_SHA }}
       - name: Configure AWS credentials
         uses: aws-actions/configure-aws-credentials@v1
         with:
-          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
-          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-          aws-region: ${{ secrets.AWS_REGION }}
+          role-to-assume: '${{ vars.AWS_ROLE }}'
+          role-session-name: CD_DGRAPH_PRIVATE
+          aws-region: '${{ vars.AWS_REGION }}'
       - name: Login to Amazon ECR
         uses: aws-actions/amazon-ecr-login@v1
       - name: Push Images to ECR
         run: |
-          docker push ${{ secrets.AWS_ACCOUNT_ID }}.dkr.ecr.${{ secrets.AWS_REGION }}.amazonaws.com/hypermode/dgraph-private:${{ env.DGRAPH_RELEASE_VERSION }}-${{ env.DGRAPH_GIT_SHA }}
+          docker push ${{ vars.AWS_ACCOUNT_ID }}.dkr.ecr.${{ vars.AWS_REGION }}.amazonaws.com/hypermode/dgraph-private:${{ env.DGRAPH_RELEASE_VERSION }}-${{ env.DGRAPH_GIT_SHA }}