Add oropouche to supported pathogen repos

[joverlee521]

Description of proposed changes

Prompted by @miparedes on Slack
https://bedfordlab.slack.com/archives/C07EY1N0MSL/p1724882490042239

Checklist

• Checks pass

[joverlee521]

Confirmed output from Terraform plan

Terraform will perform the following actions:

  # aws_iam_policy.NextstrainPathogen["oropouche"] will be created
  + resource "aws_iam_policy" "NextstrainPathogen" {
      + arn         = (known after apply)
      + description = "Provides permissions to upload datasets, workflow files, etc. for a Nextstrain pathogen"
      + id          = (known after apply)
      + name        = "NextstrainPathogen@oropouche"
      + name_prefix = (known after apply)
      + path        = "/"
      + policy      = jsonencode(
            {
              + Statement = [
                  + {
                      + Action    = [
                          + "s3:ListBucket",
                          + "s3:ListBucketVersions",
                          + "s3:GetBucketLocation",
                          + "s3:GetBucketVersioning",
                        ]
                      + Condition = {
                          + StringLike = {
                              + "s3:prefix" = [
                                  + "oropouche.json",
                                  + "oropouche_*.json",
                                  + "files/workflows/oropouche/*",
                                  + "files/datasets/oropouche/*",
                                ]
                            }
                        }
                      + Effect    = "Allow"
                      + Resource  = [
                          + "arn:aws:s3:::nextstrain-data",
                          + "arn:aws:s3:::nextstrain-staging",
                        ]
                      + Sid       = "List"
                    },
                  + {
                      + Action    = [
                          + "s3:ListBucket",
                          + "s3:ListBucketVersions",
                          + "s3:GetBucketLocation",
                          + "s3:GetBucketVersioning",
                        ]
                      + Condition = {
                          + StringLike = {
                              + "s3:prefix" = [
                                  + "trial_*_oropouche.json",
                                  + "trial_*_oropouche_*.json",
                                ]
                            }
                        }
                      + Effect    = "Allow"
                      + Resource  = [
                          + "arn:aws:s3:::nextstrain-staging",
                        ]
                      + Sid       = "ListStagingTrials"
                    },
                  + {
                      + Action    = [
                          + "s3:ListBucket",
                          + "s3:ListBucketVersions",
                          + "s3:GetBucketLocation",
                          + "s3:GetBucketVersioning",
                        ]
                      + Condition = {
                          + StringLike = {
                              + "s3:prefix" = [
                                  + "files/workflows/oropouche/*",
                                  + "files/datasets/oropouche/*",
                                ]
                            }
                        }
                      + Effect    = "Allow"
                      + Resource  = [
                          + "arn:aws:s3:::nextstrain-data-private",
                        ]
                      + Sid       = "ListPrivate"
                    },
                  + {
                      + Action   = [
                          + "s3:GetObject",
                          + "s3:GetObjectTagging",
                          + "s3:GetObjectVersion",
                          + "s3:GetObjectVersionTagging",
                          + "s3:PutObject",
                          + "s3:PutObjectTagging",
                          + "s3:DeleteObject",
                        ]
                      + Effect   = "Allow"
                      + Resource = [
                          + "arn:aws:s3:::nextstrain-data/oropouche.json",
                          + "arn:aws:s3:::nextstrain-data/oropouche_*.json",
                          + "arn:aws:s3:::nextstrain-staging/oropouche.json",
                          + "arn:aws:s3:::nextstrain-staging/oropouche_*.json",
                          + "arn:aws:s3:::nextstrain-staging/trial_*_oropouche.json",
                          + "arn:aws:s3:::nextstrain-staging/trial_*_oropouche_*.json",
                          + "arn:aws:s3:::nextstrain-data/files/workflows/oropouche/*",
                          + "arn:aws:s3:::nextstrain-data/files/datasets/oropouche/*",
                          + "arn:aws:s3:::nextstrain-data-private/files/workflows/oropouche/*",
                          + "arn:aws:s3:::nextstrain-data-private/files/datasets/oropouche/*",
                          + "arn:aws:s3:::nextstrain-staging/files/workflows/oropouche/*",
                          + "arn:aws:s3:::nextstrain-staging/files/datasets/oropouche/*",
                        ]
                      + Sid      = "ReadWrite"
                    },
                  + {
                      + Action   = [
                          + "cloudfront:ListDistributions",
                        ]
                      + Effect   = "Allow"
                      + Resource = "*"
                      + Sid      = "CloudFrontList"
                    },
                  + {
                      + Action   = [
                          + "cloudfront:CreateInvalidation",
                          + "cloudfront:GetInvalidation",
                        ]
                      + Effect   = "Allow"
                      + Resource = [
                          + "arn:aws:cloudfront::827581582529:distribution/E3LB0EWZKCCV",
                          + "arn:aws:cloudfront::827581582529:distribution/E3L83FTHWUN0BV",
                        ]
                      + Sid      = "CloudFrontReadWrite"
                    },
                ]
              + Version   = "2012-10-17"
            }
        )
      + policy_id   = (known after apply)
      + tags_all    = (known after apply)
    }

  # aws_iam_role.GitHubActionsRoleNextstrainBatchJobs will be updated in-place
  ~ resource "aws_iam_role" "GitHubActionsRoleNextstrainBatchJobs" {
      ~ assume_role_policy    = jsonencode(
          ~ {
              ~ Statement = [
                  ~ {
                      ~ Condition = {
                          ~ StringLike = {
                              ~ "token.actions.githubusercontent.com:sub" = [
                                    # (8 unchanged elements hidden)
                                    "repo:nextstrain/ncov-ingest:*:job_workflow_ref:nextstrain/.github/.github/workflows/pathogen-repo-build.yaml@*",
                                  + "repo:nextstrain/oropouche:*:job_workflow_ref:nextstrain/.github/.github/workflows/pathogen-repo-build.yaml@*",
                                    "repo:nextstrain/rabies:*:job_workflow_ref:nextstrain/.github/.github/workflows/pathogen-repo-build.yaml@*",
                                    # (5 unchanged elements hidden)
                                ]
                                # (1 unchanged attribute hidden)
                            }
                        }
                        # (3 unchanged attributes hidden)
                    },
                ]
                # (1 unchanged attribute hidden)
            }
        )
        id                    = "GitHubActionsRoleNextstrainBatchJobs"
        name                  = "GitHubActionsRoleNextstrainBatchJobs"
        tags                  = {}
        # (11 unchanged attributes hidden)
    }

  # aws_iam_role.GitHubActionsRoleNextstrainRepo["oropouche"] will be created
  + resource "aws_iam_role" "GitHubActionsRoleNextstrainRepo" {
      + arn                   = (known after apply)
      + assume_role_policy    = jsonencode(
            {
              + Statement = [
                  + {
                      + Action    = "sts:AssumeRoleWithWebIdentity"
                      + Condition = {
                          + StringLike = {
                              + "token.actions.githubusercontent.com:aud" = "sts.amazonaws.com"
                              + "token.actions.githubusercontent.com:sub" = "repo:nextstrain/oropouche:*:job_workflow_ref:nextstrain/.github/.github/workflows/pathogen-repo-build.yaml@*"
                            }
                        }
                      + Effect    = "Allow"
                      + Principal = {
                          + Federated = "arn:aws:iam::827581582529:oidc-provider/token.actions.githubusercontent.com"
                        }
                    },
                ]
              + Version   = "2012-10-17"
            }
        )
      + create_date           = (known after apply)
      + description           = "Provides permissions to upload datasets, workflow files, etc. for a Nextstrain pathogen to select repos and select GitHub Actions OIDC workflows."
      + force_detach_policies = false
      + id                    = (known after apply)
      + managed_policy_arns   = (known after apply)
      + max_session_duration  = 43200
      + name                  = "GitHubActionsRoleNextstrainRepo@oropouche"
      + name_prefix           = (known after apply)
      + path                  = "/"
      + role_last_used        = (known after apply)
      + tags_all              = (known after apply)
      + unique_id             = (known after apply)

      + inline_policy {
            name   = null
            # (1 unchanged attribute hidden)
        }
    }

  # github_actions_repository_oidc_subject_claim_customization_template.nextstrain["oropouche"] will be created
  + resource "github_actions_repository_oidc_subject_claim_customization_template" "nextstrain" {
      + id                 = (known after apply)
      + include_claim_keys = [
          + "repo",
          + "context",
          + "job_workflow_ref",
        ]
      + repository         = "oropouche"
      + use_default        = false
    }

  # github_repository_topics.pathogen["oropouche"] will be created
  + resource "github_repository_topics" "pathogen" {
      + id         = (known after apply)
      + repository = "oropouche"
      + topics     = [
          + "nextstrain",
          + "pathogen",
        ]
    }

Plan: 4 to add, 1 to change, 0 to destroy.

[joverlee521]

Deployed Terraform changes.