feat: release automation

.github/workflows/release.yaml

@@ -0,0 +1,52 @@
+name: Release
+
+on:
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      id-token: write
+      pull-requests: write
+
+    steps:
+    - name: checkout
+      uses: actions/checkout@v2
+
+    - name: build
+      run: make sam-build-all
+
+    - name: Setup AWS credentials
+      uses: aws-actions/configure-aws-credentials@v2
+      with:
+        role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
+        aws-region: us-west-2
+
+    - name: github pre-release
+      id: prerelease
+      if: github.event_name == 'push'
+      uses: ahmadnassri/action-semantic-release@v2
+      with:
+        config: ${{ github.workspace }}/.releaserc.json
+      env:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+    - name: github full release
+      id: fullrelease
+      if: github.event_name == 'workflow_dispatch'
+      uses: ahmadnassri/action-semantic-release@v2
+      with:
+        config: ${{ github.workspace }}/.releaserc-release.json
+      env:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+    - name: aws sam release
+      run: make sam-package-all-regions
+      env:
+        VERSION: ${{ steps.prerelease.outputs.release-version }}
+

.github/workflows/sam-lint.yaml

@@ -1,3 +1,5 @@
+name: Run Lint
+
 on:
   push:
     branches:

.gitignore

@@ -2,3 +2,11 @@
 .aws-sam/
 .*.swp
 build/
+
+.terraform
+terraform.tfstate
+*.tfstate*
+terraform.tfvars
+tfplan
+
+.terraform.lock.hcl

.releaserc-release.json

@@ -0,0 +1,9 @@
+{
+  "branches": ["main"],
+  "plugins": [
+    "@semantic-release/commit-analyzer",
+    "@semantic-release/release-notes-generator",
+    "@semantic-release/changelog",
+    "@semantic-release/github"
+  ]
+}

.releaserc.json

@@ -0,0 +1,22 @@
+{
+  "branches": [
+    {
+        "name": "release", 
+        "channel": false, 
+        "prerelease": false, 
+        "type": "maintenance"
+    },
+    {
+        "name": "main", 
+        "channel": "beta",
+        "prerelease": "beta"
+    }
+  ],
+  "plugins": [
+    "@semantic-release/commit-analyzer",
+    "@semantic-release/release-notes-generator",
+    "@semantic-release/changelog",
+    "@semantic-release/github"
+  ]
+}
+

Makefile

@@ -2,6 +2,10 @@ SHELL := /bin/bash
 .DEFAULT_GOAL := help
 .ONESHELL:
 
+REGIONS := us-west-1 us-east-1
+S3_BUCKET_PREFIX ?= colin-observeinc
+VERSION ?= unreleased
+
 define check_var
 	@if [ -z "$($1)" ]; then
 		echo >&2 "Please set the $1 variable";
@@ -41,28 +45,56 @@ sam-lint-all:
 		APP=$$dir $(MAKE) sam-lint || exit 1;
 	done
 
+.PHONY: sam-build-all
+## sam-build-all: build assets for all SAM applications across all regions
+sam-build-all:
+	@ for app in $(SUBDIR); do \
+		for region in $(REGIONS); do \
+			APP=$$app AWS_REGION=$$region $(MAKE) sam-build || exit 1; \
+		done \
+	done
+
 ## sam-build: build assets
 sam-build:
 	$(call check_var,APP)
 	$(call check_var,AWS_REGION)
-	cd apps/$(APP) && sam build --region $(AWS_REGION)
+	cd apps/$(APP) && sam build --region $(AWS_REGION) --build-dir .aws-sam/build/$(AWS_REGION)
 
-## sam-package: package cloudformation templates and push assets to S3
-sam-package: sam-build
-	$(call check_var,AWS_REGION)
-	sam package --template apps/$(APP)/.aws-sam/build/template.yaml --output-template-file apps/$(APP)/.aws-sam/build/packaged.yaml --region $(AWS_REGION) --debug --resolve-s3
 
 ## sam-publish: publish serverless repo app
 sam-publish: sam-package
 	$(call check_var,AWS_REGION)
-	sam publish --template-file apps/$(APP)/.aws-sam/build/packaged.yaml --region $(AWS_REGION)
+	sam publish \
+	    --template-file apps/$(APP)/.aws-sam/build/$(AWS_REGION)/packaged.yaml \
+	    --region $(AWS_REGION)
 
 ## sam-package-all: package all cloudformation templates and push assets to S3
 sam-package-all:
 	for dir in $(SUBDIR); do
 		APP=$$dir $(MAKE) sam-package || exit 1;
 	done
 
+## sam-package: package cloudformation templates and push assets to S3
+sam-package: sam-build
+	$(call check_var,APP)
+	$(call check_var,AWS_REGION)
+	sam package \
+	    --template-file apps/$(APP)/.aws-sam/build/$(AWS_REGION)/template.yaml \
+	    --output-template-file apps/$(APP)/.aws-sam/build/$(AWS_REGION)/packaged.yaml \
+	    --s3-bucket $(S3_BUCKET_PREFIX)-$(AWS_REGION) \
+	    --s3-prefix apps/$(APP)/$(VERSION) \
+	    --region $(AWS_REGION) \
+	    --debug
+
+.PHONY: sam-package-all-regions
+## sam-package-all-regions: Packages and uploads all SAM applications to S3 in multiple regions
+sam-package-all-regions:
+	@ for app in $(SUBDIR); do \
+		for region in $(REGIONS); do \
+			APP=$$app AWS_REGION=$$region $(MAKE) sam-package || exit 1; \
+		done \
+	done
+
 ## sam-publish-all: publish all apps
 sam-publish-all:
 	for dir in $(SUBDIR); do
@@ -79,3 +111,4 @@ build-Forwarder:
 	APP=forwarder $(MAKE) build-App
 
 .PHONY: help go-lint go-lint-all go-test sam-lint sam-lint-all sam-build sam-package sam-publish sam-package-all sam-publish-all build-App build-Forwarder
+

infrastructure/backend.tf

@@ -0,0 +1,7 @@
+terraform {
+  backend "s3" {
+    bucket = "observeinc-terraform-state"
+    region = "us-west-2"
+    key    = "github.com/observeinc/colin-aws-sam-testing"
+  }
+}

infrastructure/main.tf

@@ -0,0 +1,57 @@
+locals {
+  organization = "observeinc"
+  repository   = "colin-aws-sam-testing"
+}
+
+data "aws_iam_openid_connect_provider" "github_actions" {
+  url = "https://token.actions.githubusercontent.com"
+}
+
+locals {
+  oidc_claim_prefix = trimprefix(data.aws_iam_openid_connect_provider.github_actions.url, "https://")
+}
+
+data "aws_iam_policy_document" "github_actions_assume_role" {
+  statement {
+    actions = ["sts:AssumeRoleWithWebIdentity"]
+
+    principals {
+      type        = "Federated"
+      identifiers = [data.aws_iam_openid_connect_provider.github_actions.arn]
+    }
+
+    condition {
+      test     = "StringLike"
+      variable = "${local.oidc_claim_prefix}:sub"
+      values   = ["repo:${local.organization}/${local.repository}:*"]
+    }
+
+    condition {
+      test     = "StringEquals"
+      variable = "${local.oidc_claim_prefix}:aud"
+      values   = ["sts.amazonaws.com"]
+    }
+  }
+}
+
+resource "aws_iam_role" "github_actions_ci" {
+  name = "${local.repository}-gha-ci"
+
+  assume_role_policy = data.aws_iam_policy_document.github_actions_assume_role.json
+
+  tags = {
+    Principal  = "GitHub Actions"
+    Repository = "${local.organization}/${local.repository}"
+  }
+}
+
+resource "aws_iam_role_policy_attachment" "admin_policy_attachment" {
+  role       = aws_iam_role.github_actions_ci.name
+  policy_arn = "arn:aws:iam::aws:policy/AdministratorAccess"
+}
+
+resource "github_actions_secret" "aws_ci_role" {
+  repository      = local.repository
+  secret_name     = "AWS_ROLE_ARN"
+  plaintext_value = aws_iam_role.github_actions_ci.arn
+}

infrastructure/providers.tf

@@ -0,0 +1,3 @@
+provider "github" {
+  owner = local.organization
+}

infrastructure/versions.tf

@@ -0,0 +1,15 @@
+terraform {
+  required_version = ">= 1.1.0"
+
+  required_providers {
+    github = {
+      source  = "integrations/github"
+      version = "~> 5"
+    }
+
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 5"
+    }
+  }
+}