chore: update workflow to run on demand #3000
Conversation
|
WalkthroughThe pull request modifies the GitHub Actions workflow configuration for building AWS AMIs using Packer. The key change involves removing the branch specification under the Changes
Poem
Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media? 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (1)
.github/workflows/packer-build-ami.yml (1)
Line range hint
1-42: Consider adding workflow concurrency control.To prevent concurrent AMI builds that might interfere with each other, consider adding a concurrency configuration.
Add this configuration at the workflow level:
name: Packer build AWS AMI's on: workflow_dispatch: + +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: false🧰 Tools
🪛 actionlint (1.7.4)
15-15: the runner of "actions/checkout@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
.github/workflows/packer-build-ami.yml(1 hunks)
⏰ Context from checks skipped due to timeout of 90000ms (1)
- GitHub Check: Analyze (javascript)
🔇 Additional comments (2)
.github/workflows/packer-build-ami.yml (2)
Line range hint
2-3: Verify the security implications of unrestricted manual triggers.Removing the branch restriction from
workflow_dispatchallows manual triggering from any branch. While this provides flexibility, please ensure this aligns with your security requirements for AMI builds.Consider these security aspects:
- Who has permissions to trigger workflows manually?
- Should AMI builds be restricted to specific branches?
- Are there adequate controls in the environment configuration?
🧰 Tools
🪛 actionlint (1.7.4)
15-15: the runner of "actions/checkout@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
17-24: Review the role assumption duration and permissions.The role assumption duration is set to 900 seconds (15 minutes). This follows the principle of least privilege by limiting the credential lifetime.
Run this script to check for any hardcoded AWS credentials or overly permissive IAM configurations:
✅ Verification successful
Role assumption configuration follows security best practices
The role assumption implementation in the workflow is secure and well-configured:
- Uses GitHub secrets for sensitive credentials
- Sets a reasonable session duration of 15 minutes
- Includes a clear session name for audit tracking
- No hardcoded credentials or concerning configurations found
🏁 Scripts executed
The following scripts were executed for the analysis:
Script:
#!/bin/bash # Description: Check for AWS credentials and IAM configurations in the codebase # Search for potential AWS credential patterns echo "Checking for AWS credential patterns..." rg -g '!.git' -i '(aws_access_key|aws_secret_key|arn:aws|AKIA[0-9A-Z]{16})' # Search for IAM role configurations echo "Checking for IAM role configurations..." rg -g '!.git' -i '(assume.*role|iam.*role|role.*arn)'Length of output: 311
Script:
#!/bin/bash # Find and examine the action implementation and workflow files echo "Checking action implementation..." fd "action.yml|action.yaml" --type f --exec cat {} echo -e "\nChecking workflow files..." fd "\.ya?ml$" --type f -p ".github/workflows" --exec cat {} echo -e "\nChecking for role configurations in YAML files..." fd "\.ya?ml$" --type f --exec grep -i -A 5 -B 5 "role" {}Length of output: 93210
Script:
#!/bin/bash # Find and examine the local action implementation echo "Checking action.yml in repository root..." cat action.yml 2>/dev/null || cat action.yaml 2>/dev/null echo -e "\nChecking for role-related files..." fd -t f -e yml -e yaml -e json . --exec grep -l "role" {} || true echo -e "\nChecking for AWS assume role implementations..." fd -t f . --exec grep -l "AssumeRole" {} || trueLength of output: 710
Script:
#!/bin/bash echo "Checking content of role-related files..." echo -e "\nChecking ballerine-playbook.yml..." cat deploy/ansible/ballerine_playbook/ballerine-playbook.yml 2>/dev/null echo -e "\nChecking grants.json..." cat services/workflows-service/src/grants.json 2>/dev/null echo -e "\nChecking for AWS role assumption in workflow file..." cat .github/workflows/packer-build-ami.yml 2>/dev/null echo -e "\nChecking for AWS SDK or role assumption code..." find . -type f -name "*.js" -o -name "*.ts" | xargs grep -l "AWS.STS\|AssumeRole" 2>/dev/null || trueLength of output: 2916
* chore: update workflow to run on demand (#3000) * chore: update workflow to run on demand * fix: indentation issues in the workflow * fix(*): fixed backoffice state for directors with no documents (#3001) --------- Co-authored-by: pratapalakshmi <[email protected]>
Summary by CodeRabbit