Skip to content

feat(ci): dispatch GitHub analytics action #2161

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 10 commits into from
Apr 24, 2023
Merged

feat(ci): dispatch GitHub analytics action #2161

Changes from 8 commits
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
f32a3e5
chore: add analytics dispatch dummy job
rubenfonseca Apr 21, 2023
c71a3ef
fix: renamed file
rubenfonseca Apr 21, 2023
a89b426
fix: typo
rubenfonseca Apr 21, 2023
b410b62
chore: actually call the dispatcher
rubenfonseca Apr 21, 2023
71cdbbc
fix: typo
rubenfonseca Apr 21, 2023
af31b19
fix: encode the payload as bsae64
rubenfonseca Apr 21, 2023
5f21dc8
chore: schedule the workflow every hour
rubenfonseca Apr 21, 2023
aa3f4a4
chore: add more permissions
rubenfonseca Apr 21, 2023
ca3374d
fix: remove reusable workflow, add environment
rubenfonseca Apr 24, 2023
f888e69
fix: add new line
rubenfonseca Apr 24, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
32 changes: 31 additions & 1 deletion .github/workflows/reusable_dispatch_analytics.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,10 +3,40 @@ name: Reusable dispatch analytics
on:
workflow_dispatch:

schedule:
- cron: '0 * * * *'

permissions:
id-token: write
actions: read
checks: read
contents: read
deployments: read
issues: read
discussions: read
packages: read
pages: read
pull-requests: read
repository-projects: read
security-events: read
statuses: read

jobs:
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can we run in an environment do secrets are encrypted from forks?

You never know if we ever accidentally make a mistake in the IAM OIDC and allow any repo. This will prevent this attack vector.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done, created a new "analytics" environment and moved the secrets there. I've removed the old secrets too.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please note that the IAM OIDC would not be assumable since there's a condition to only be assumable by this repository too. In any case, it's better this way.

dispatch_token:
concurrency:
group: analytics
runs-on: ubuntu-latest
steps:
- run: echo 'hello world'
- name: Configure AWS credentials
uses: aws-actions/configure-aws-credentials@e1e17a757e536f70e52b5a12b2e8d1d1c60e04ef
with:
aws-region: eu-central-1
role-to-assume: ${{ secrets.AWS_ANALYTICS_ROLE_ARN }}

- name: Invoke Lambda function
run: |
payload=$(echo -n '{"githubToken": "${{ secrets.GITHUB_TOKEN }}"}' | base64)
aws lambda invoke \
--function-name ${{ secrets.AWS_ANALYTICS_DISPATCHER_ARN }} \
--payload "$payload" response.json
cat response.json