From 1b98187830f926347ee8cc750cb2e6b5ffd2f24b Mon Sep 17 00:00:00 2001 From: aboyko Date: Thu, 9 Nov 2023 14:56:02 -0500 Subject: [PATCH] GHA: Use aws-actions/configure-credentials --- .github/workflows/akamai-test.yml | 2 - .../workflows/eclipse-ls-extensions-build.yml | 29 ++-- .../gh-hosted-eclipse-distro-build.yml | 127 +++++++----------- 3 files changed, 59 insertions(+), 99 deletions(-) diff --git a/.github/workflows/akamai-test.yml b/.github/workflows/akamai-test.yml index a9afb21ca..a1e87af11 100644 --- a/.github/workflows/akamai-test.yml +++ b/.github/workflows/akamai-test.yml @@ -41,8 +41,6 @@ jobs: akamai-upload-via-script: name: Upload to Akamai via Script runs-on: ubuntu-latest - permissions: - id-token: write # This is required for requesting the JWT steps: - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 with: diff --git a/.github/workflows/eclipse-ls-extensions-build.yml b/.github/workflows/eclipse-ls-extensions-build.yml index 378fcee45..4bb29ad23 100644 --- a/.github/workflows/eclipse-ls-extensions-build.yml +++ b/.github/workflows/eclipse-ls-extensions-build.yml @@ -77,25 +77,16 @@ jobs: else ./mvnw --batch-mode clean install -P${{ inputs.eclipse_profile }} -P${{ inputs.build_type }} $sts4_ls_version_param -Pgitactions -Pgpg.sign -Dmaven.test.skip=true -Dhttpclient.retry-max=20 -Declipse.p2.mirrors=false -Dtycho.localArtifacts=ignore fi - - name: Cloudgate S3 Setup - id: cloudgate-setup - env: - AWS_ACCESS_KEY_ID: ${{ secrets.TOOLS_CLOUDGATE_ACCESS_KEY }} - AWS_SECRET_ACCESS_KEY: ${{ secrets.TOOLS_CLOUDGATE_SECRET_KEY }} - TOOLS_CLOUDGATE_ACCOUNT_ID: ${{ secrets.TOOLS_CLOUDGATE_ACCOUNT_ID }} - TOOLS_CLOUDGATE_USER: ${{ secrets.TOOLS_CLOUDGATE_USER }} - AWS_DEFAULT_REGION: us-east-1 - run: | - export $(printf "AWS_ACCESS_KEY_ID=%s AWS_SECRET_ACCESS_KEY=%s AWS_SESSION_TOKEN=%s" \ - $(aws sts assume-role \ - --role-arn arn:aws:iam::${{ secrets.TOOLS_CLOUDGATE_ACCOUNT_ID }}:role/${{ secrets.TOOLS_CLOUDGATE_USER }} \ - --role-session-name ${{ github.run_id }} \ - --query "Credentials.[AccessKeyId,SecretAccessKey,SessionToken]" \ - --output text)) - echo "AWS_ACCESS_KEY_ID=$AWS_ACCESS_KEY_ID" >> $GITHUB_ENV - echo "AWS_SECRET_ACCESS_KEY=$AWS_SECRET_ACCESS_KEY" >> $GITHUB_ENV - echo "AWS_SESSION_TOKEN=$AWS_SESSION_TOKEN" >> $GITHUB_ENV - echo "AWS_DEFAULT_REGION=$AWS_DEFAULT_REGION" >> $GITHUB_ENV + - name: Cloudgate S3 Configuration + uses: aws-actions/configure-aws-credentials@010d0da01d0b5a38af31e9c3470dbfdabdecca3a + with: + aws-access-key-id: ${{ secrets.TOOLS_CLOUDGATE_ACCESS_KEY }} + aws-secret-access-key: ${{ secrets.TOOLS_CLOUDGATE_SECRET_KEY }} + role-to-assume: arn:aws:iam::${{ secrets.TOOLS_CLOUDGATE_ACCOUNT_ID }}:role/${{ secrets.TOOLS_CLOUDGATE_USER }} + role-session-name: ${{ github.run_id }} + aws-region: us-east-1 + role-duration-seconds: 900 + role-skip-session-tagging: true - name: Upload P2 Repo to Akamai run: | dist_path=`cat ${{ github.workspace }}/eclipse-language-servers/org.springframework.tooling.ls.integration.repository/target/s3-p2-repo-dist-path.txt` diff --git a/.github/workflows/gh-hosted-eclipse-distro-build.yml b/.github/workflows/gh-hosted-eclipse-distro-build.yml index 3011a52b4..e767ae6e3 100644 --- a/.github/workflows/gh-hosted-eclipse-distro-build.yml +++ b/.github/workflows/gh-hosted-eclipse-distro-build.yml @@ -67,32 +67,30 @@ jobs: fi cd eclipse-distribution ./mvnw --batch-mode -U clean install -P${{ inputs.eclipse_profile }} -P${{ inputs.build_type }} $sts4_ls_version_param $p2_qualifier_param -Pgitactions -Pgpg.sign -Dmaven.repo.local=~/.m2/repository-signed -Dhttpclient.retry-max=20 -Dmaven.test.skip=true -Declipse.p2.mirrors=false -Dtycho.localArtifacts=ignore -Dp2.replaceQualifier=true -Dorg.eclipse.ecf.provider.filetransfer.httpclient.retrieve.readTimeout=1200000 -Dorg.eclipse.equinox.p2.transport.ecf.retry=5 -Dskip.eclipserun.proxies=false -Dtycho.equinox.resolver.uses=true - - name: Cloudgate S3 Setup - id: cloudgate-setup - env: - AWS_ACCESS_KEY_ID: ${{ secrets.TOOLS_CLOUDGATE_ACCESS_KEY }} - AWS_SECRET_ACCESS_KEY: ${{ secrets.TOOLS_CLOUDGATE_SECRET_KEY }} - TOOLS_CLOUDGATE_ACCOUNT_ID: ${{ secrets.TOOLS_CLOUDGATE_ACCOUNT_ID }} - TOOLS_CLOUDGATE_USER: ${{ secrets.TOOLS_CLOUDGATE_USER }} - AWS_DEFAULT_REGION: us-east-1 - run: | - export $(printf "AWS_ACCESS_KEY_ID=%s AWS_SECRET_ACCESS_KEY=%s AWS_SESSION_TOKEN=%s" \ - $(aws sts assume-role \ - --role-arn arn:aws:iam::${{ secrets.TOOLS_CLOUDGATE_ACCOUNT_ID }}:role/${{ secrets.TOOLS_CLOUDGATE_USER }} \ - --role-session-name ${{ github.run_id }} \ - --query "Credentials.[AccessKeyId,SecretAccessKey,SessionToken]" \ - --output text)) - echo "AWS_ACCESS_KEY_ID=$AWS_ACCESS_KEY_ID" >> $GITHUB_ENV - echo "AWS_SECRET_ACCESS_KEY=$AWS_SECRET_ACCESS_KEY" >> $GITHUB_ENV - echo "AWS_SESSION_TOKEN=$AWS_SESSION_TOKEN" >> $GITHUB_ENV - echo "AWS_DEFAULT_REGION=$AWS_DEFAULT_REGION" >> $GITHUB_ENV + - name: Cloudgate S3 Configuration + uses: aws-actions/configure-aws-credentials@010d0da01d0b5a38af31e9c3470dbfdabdecca3a + with: + aws-access-key-id: ${{ secrets.TOOLS_CLOUDGATE_ACCESS_KEY }} + aws-secret-access-key: ${{ secrets.TOOLS_CLOUDGATE_SECRET_KEY }} + role-to-assume: arn:aws:iam::${{ secrets.TOOLS_CLOUDGATE_ACCOUNT_ID }}:role/${{ secrets.TOOLS_CLOUDGATE_USER }} + role-session-name: ${{ github.run_id }} + aws-region: us-east-1 + role-duration-seconds: 900 + role-skip-session-tagging: true - name: Upload P2 Repo Build Artifacts run: | cd eclipse-distribution/org.springframework.boot.ide.product.${{ inputs.eclipse_profile }}/target dist_path=`cat s3-p2-repo-dist-path.txt` echo "Dist path: ${dist_path}" - aws s3 rm s3://dist.springsource.com/${dist_path}/ --recursive --dryrun - aws s3 cp ./repository/ s3://dist.springsource.com/${dist_path}/ --recursive --acl public-read --dryrun + aws s3 rm s3://dist.springsource.com/${dist_path}/ --recursive + aws s3 cp ./repository/ s3://dist.springsource.com/${dist_path}/ --recursive --acl public-read + - name: Upload P2 Repo Build Artifacts (Akamai) + run: | + cd eclipse-distribution/org.springframework.boot.ide.product.${{ inputs.eclipse_profile }}/target + dist_path=`cat s3-p2-repo-dist-path.txt` + echo "Dist path: ${dist_path}" + aws s3 rm s3://tools-spring-io/${dist_path}/ --recursive + aws s3 cp ./repository/ s3://tools-spring-io/${dist_path}/ --recursive --acl public-read - name: Upload Linux Distro Build Artifacts run: | cd eclipse-distribution/org.springframework.boot.ide.product.${{ inputs.eclipse_profile }}/target/products @@ -147,25 +145,16 @@ jobs: with: sparse-checkout: | .github - - name: Cloudgate S3 Setup - id: cloudgate-setup - env: - AWS_ACCESS_KEY_ID: ${{ secrets.TOOLS_CLOUDGATE_ACCESS_KEY }} - AWS_SECRET_ACCESS_KEY: ${{ secrets.TOOLS_CLOUDGATE_SECRET_KEY }} - TOOLS_CLOUDGATE_ACCOUNT_ID: ${{ secrets.TOOLS_CLOUDGATE_ACCOUNT_ID }} - TOOLS_CLOUDGATE_USER: ${{ secrets.TOOLS_CLOUDGATE_USER }} - AWS_DEFAULT_REGION: us-east-1 - run: | - export $(printf "AWS_ACCESS_KEY_ID=%s AWS_SECRET_ACCESS_KEY=%s AWS_SESSION_TOKEN=%s" \ - $(aws sts assume-role \ - --role-arn arn:aws:iam::${{ secrets.TOOLS_CLOUDGATE_ACCOUNT_ID }}:role/${{ secrets.TOOLS_CLOUDGATE_USER }} \ - --role-session-name ${{ github.run_id }} \ - --query "Credentials.[AccessKeyId,SecretAccessKey,SessionToken]" \ - --output text)) - echo "AWS_ACCESS_KEY_ID=$AWS_ACCESS_KEY_ID" >> $GITHUB_ENV - echo "AWS_SECRET_ACCESS_KEY=$AWS_SECRET_ACCESS_KEY" >> $GITHUB_ENV - echo "AWS_SESSION_TOKEN=$AWS_SESSION_TOKEN" >> $GITHUB_ENV - echo "AWS_DEFAULT_REGION=$AWS_DEFAULT_REGION" >> $GITHUB_ENV + - name: Cloudgate S3 Configuration + uses: aws-actions/configure-aws-credentials@010d0da01d0b5a38af31e9c3470dbfdabdecca3a + with: + aws-access-key-id: ${{ secrets.TOOLS_CLOUDGATE_ACCESS_KEY }} + aws-secret-access-key: ${{ secrets.TOOLS_CLOUDGATE_SECRET_KEY }} + role-to-assume: arn:aws:iam::${{ secrets.TOOLS_CLOUDGATE_ACCOUNT_ID }}:role/${{ secrets.TOOLS_CLOUDGATE_USER }} + role-session-name: ${{ github.run_id }} + aws-region: us-east-1 + role-duration-seconds: 900 + role-skip-session-tagging: true - name: Download Win Zips from S3 for Signing run: | rm -f spring-tool-suite-4*win*.zip* @@ -245,25 +234,16 @@ jobs: run: | python3 -m pip install setuptools npm install -g appdmg - - name: Cloudgate S3 Setup - id: cloudgate-setup - env: - AWS_ACCESS_KEY_ID: ${{ secrets.TOOLS_CLOUDGATE_ACCESS_KEY }} - AWS_SECRET_ACCESS_KEY: ${{ secrets.TOOLS_CLOUDGATE_SECRET_KEY }} - TOOLS_CLOUDGATE_ACCOUNT_ID: ${{ secrets.TOOLS_CLOUDGATE_ACCOUNT_ID }} - TOOLS_CLOUDGATE_USER: ${{ secrets.TOOLS_CLOUDGATE_USER }} - AWS_DEFAULT_REGION: us-east-1 - run: | - export $(printf "AWS_ACCESS_KEY_ID=%s AWS_SECRET_ACCESS_KEY=%s AWS_SESSION_TOKEN=%s" \ - $(aws sts assume-role \ - --role-arn arn:aws:iam::${{ secrets.TOOLS_CLOUDGATE_ACCOUNT_ID }}:role/${{ secrets.TOOLS_CLOUDGATE_USER }} \ - --role-session-name ${{ github.run_id }} \ - --query "Credentials.[AccessKeyId,SecretAccessKey,SessionToken]" \ - --output text)) - echo "AWS_ACCESS_KEY_ID=$AWS_ACCESS_KEY_ID" >> $GITHUB_ENV - echo "AWS_SECRET_ACCESS_KEY=$AWS_SECRET_ACCESS_KEY" >> $GITHUB_ENV - echo "AWS_SESSION_TOKEN=$AWS_SESSION_TOKEN" >> $GITHUB_ENV - echo "AWS_DEFAULT_REGION=$AWS_DEFAULT_REGION" >> $GITHUB_ENV + - name: Cloudgate S3 Configuration + uses: aws-actions/configure-aws-credentials@010d0da01d0b5a38af31e9c3470dbfdabdecca3a + with: + aws-access-key-id: ${{ secrets.TOOLS_CLOUDGATE_ACCESS_KEY }} + aws-secret-access-key: ${{ secrets.TOOLS_CLOUDGATE_SECRET_KEY }} + role-to-assume: arn:aws:iam::${{ secrets.TOOLS_CLOUDGATE_ACCOUNT_ID }}:role/${{ secrets.TOOLS_CLOUDGATE_USER }} + role-session-name: ${{ github.run_id }} + aws-region: us-east-1 + role-duration-seconds: 900 + role-skip-session-tagging: true - name: Download OSX tar.gz files from S3 for Signing/Notarization run: | rm -rf *macosx* @@ -330,25 +310,16 @@ jobs: - uses: actions/download-artifact@cbed621e49e4c01b044d60f6c80ea4ed6328b281 with: name: s3-dist-path-${{ needs.eclipse-distro-build.outputs.id }} - - name: Cloudgate S3 Setup - id: cloudgate-setup - env: - AWS_ACCESS_KEY_ID: ${{ secrets.TOOLS_CLOUDGATE_ACCESS_KEY }} - AWS_SECRET_ACCESS_KEY: ${{ secrets.TOOLS_CLOUDGATE_SECRET_KEY }} - TOOLS_CLOUDGATE_ACCOUNT_ID: ${{ secrets.TOOLS_CLOUDGATE_ACCOUNT_ID }} - TOOLS_CLOUDGATE_USER: ${{ secrets.TOOLS_CLOUDGATE_USER }} - AWS_DEFAULT_REGION: us-east-1 - run: | - export $(printf "AWS_ACCESS_KEY_ID=%s AWS_SECRET_ACCESS_KEY=%s AWS_SESSION_TOKEN=%s" \ - $(aws sts assume-role \ - --role-arn arn:aws:iam::${{ secrets.TOOLS_CLOUDGATE_ACCOUNT_ID }}:role/${{ secrets.TOOLS_CLOUDGATE_USER }} \ - --role-session-name ${{ github.run_id }} \ - --query "Credentials.[AccessKeyId,SecretAccessKey,SessionToken]" \ - --output text)) - echo "AWS_ACCESS_KEY_ID=$AWS_ACCESS_KEY_ID" >> $GITHUB_ENV - echo "AWS_SECRET_ACCESS_KEY=$AWS_SECRET_ACCESS_KEY" >> $GITHUB_ENV - echo "AWS_SESSION_TOKEN=$AWS_SESSION_TOKEN" >> $GITHUB_ENV - echo "AWS_DEFAULT_REGION=$AWS_DEFAULT_REGION" >> $GITHUB_ENV + - name: Cloudgate S3 Configuration + uses: aws-actions/configure-aws-credentials@010d0da01d0b5a38af31e9c3470dbfdabdecca3a + with: + aws-access-key-id: ${{ secrets.TOOLS_CLOUDGATE_ACCESS_KEY }} + aws-secret-access-key: ${{ secrets.TOOLS_CLOUDGATE_SECRET_KEY }} + role-to-assume: arn:aws:iam::${{ secrets.TOOLS_CLOUDGATE_ACCOUNT_ID }}:role/${{ secrets.TOOLS_CLOUDGATE_USER }} + role-session-name: ${{ github.run_id }} + aws-region: us-east-1 + role-duration-seconds: 900 + role-skip-session-tagging: true - name: Clear S3 Caches for Distros if: ${{ inputs.build_type != 'snapshot' }} env: