Skip to content

Commit 08c55c1

Browse files
cabutlermitcabutlermit
authored
Merge pull request #47 from MITLibraries/dev
Dev-to-Stage: Add ECR Repository for SAP Invoices UI
2 parents 68599cd + bc5f5cf commit 08c55c1

File tree

10 files changed

+238
-24
lines changed

10 files changed

+238
-24
lines changed

‎.github/workflows/tf-shared-workflows.yml‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,8 @@ on:
1010
paths:
1111
- '**/*.tf'
1212

13+
permissions: read-all
14+
1315
jobs:
1416
validate:
1517
name: Validate Terraform
@@ -19,6 +21,6 @@ jobs:
1921
name: Checkov Tests
2022
uses: mitlibraries/.github/.github/workflows/tf-checkov-shared.yml@main
2123

22-
docs-update:
23-
name: Update README
24-
uses: mitlibraries/.github/.github/workflows/tf-docs-gen-shared.yml@main
24+
docs:
25+
name: Terraform Docs
26+
uses: mitlibraries/.github/.github/workflows/tf-docs-shared.yml@main

‎.pre-commit-config.yaml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
repos:
2+
- repo: https://github.com/antonbabenko/pre-commit-terraform
3+
rev: "v1.92.1"
4+
hooks:
5+
- id: terraform_fmt
6+
args:
7+
- --args=-recursive
8+
- id: terraform_validate
9+
- repo: https://github.com/terraform-docs/terraform-docs
10+
rev: "v0.18.0"
11+
hooks:
12+
- id: terraform-docs-go
13+
args: ["markdown", "table", "--config", "./.terraform-docs.yaml", "--recursive", "--output-file", "README.md", "./"]
14+
- repo: https://github.com/bridgecrewio/checkov.git
15+
rev: '3.2.219'
16+
hooks:
17+
- id: checkov
18+
language_version: python3.11
19+
verbose: false

‎.terraform-docs.yaml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
formatter: "" # this is required
2+
3+
settings:
4+
anchor: false
5+
html: false

‎.terraform.lock.hcl‎

Lines changed: 17 additions & 14 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎README.md‎

Lines changed: 43 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,41 @@ This repo builds the ECR (Elastic Container Registry) repositories for container
1010

1111
The only dependency is the ARN of the OpenID Connect Provider (placed in Parameter Store by the [mitlib-tf-workloads-init](https://github.com/MITLibraries/mitlib-tf-workloads-init) repo).
1212

13+
### Pre-Commit Hooks
14+
15+
For proper linting and checking, this repo uses pre-commit hooks. The following should be installed in the local workstation
16+
17+
* [pre-commit](https://pre-commit.com/)
18+
* [terraform cli](https://developer.hashicorp.com/terraform/downloads)
19+
* [terraform-docs](https://terraform-docs.io/)
20+
* [checkov](https://github.com/bridgecrewio/checkov)
21+
22+
After the first checkout locally, run the following command to initialize the pre-commit hooks.
23+
24+
```bash
25+
pre-commit install --hook-type pre-push
26+
```
27+
28+
It is possible to run the pre-commit hooks manually. To run all the pre-commit hooks for this repo, run
29+
30+
```bash
31+
pre-commit run --all-files
32+
```
33+
34+
To run just the checkov checker, run
35+
36+
```bash
37+
pre-commit run checkov
38+
```
39+
40+
To run just the `terraform-docs` hook to update the README, run
41+
42+
```bash
43+
pre-commit run terraform-docs-go
44+
```
45+
46+
See [.pre-commit-config.yaml](./.pre-commit-config.yaml) for other pre-commit hooks that can be run.
47+
1348
## Usage
1449

1550
There is a tight relationship between ECR repositories created here and the associated application repositories in GitHub due to the use of OIDC in the GitHub Actions in those application repositories. Make sure to coordinate any new ECR repositories with the developers building the applications that will be published there.
@@ -61,14 +96,14 @@ then replace all the ssm parameter references for `oidc_arn` with `aws_iam_openi
6196

6297
| Name | Version |
6398
|------|---------|
64-
| terraform | ~> 1.2 |
65-
| aws | ~> 4.0 |
99+
| terraform | ~> 1.5 |
100+
| aws | ~> 5.0 |
66101

67102
## Providers
68103

69104
| Name | Version |
70105
|------|---------|
71-
| aws | 4.37.0 |
106+
| aws | 5.62.0 |
72107

73108
## Modules
74109

@@ -85,6 +120,7 @@ then replace all the ssm parameter references for `oidc_arn` with `aws_iam_openi
85120
| ecr\_patronload | ./modules/ecr | n/a |
86121
| ecr\_ppod | ./modules/ecr | n/a |
87122
| ecr\_sapinvoices | ./modules/ecr | n/a |
123+
| ecr\_sapinvoices\_ui | ./modules/ecr | n/a |
88124
| ecr\_timdex\_browsertrix | ./modules/ecr | n/a |
89125
| ecr\_timdex\_geo | ./modules/ecr | n/a |
90126
| ecr\_timdex\_lambdas | ./modules/ecr | n/a |
@@ -170,6 +206,10 @@ then replace all the ssm parameter references for `oidc_arn` with `aws_iam_openi
170206
| sapinvoices\_makefile | Full contents of the Makefile for the alma-sapinvoices repo (allows devs to push to Dev account only) |
171207
| sapinvoices\_prod\_promote\_workflow | Full contents of the prod-promote.yml for the alma-sapinvoices repo |
172208
| sapinvoices\_stage\_build\_workflow | Full contents of the stage-build.yml for the alma-sapinvoices repo |
209+
| sapinvoices\_ui\_dev\_build\_workflow | Full contents of the dev-build.yml for the alma-sapinvoices-ui repo |
210+
| sapinvoices\_ui\_makefile | Full contents of the Makefile for the alma-sapinvoices-ui repo (allows devs to push to Dev account only) |
211+
| sapinvoices\_ui\_prod\_promote\_workflow | Full contents of the prod-promote.yml for the alma-sapinvoices-ui repo |
212+
| sapinvoices\_ui\_stage\_build\_workflow | Full contents of the stage-build.yml for the alma-sapinvoices-ui repo |
173213
| tim\_dev\_build\_workflow | Full contents of the dev-build.yml for the timdex-index-manager repo |
174214
| tim\_makefile | Full contents of the Makefile for the timdex-index-manager repo (allows devs to push to Dev account only) |
175215
| tim\_prod\_promote\_workflow | Full contents of the prod-promote.yml for the timdex-index-manager repo |

‎almaintegrations-ecrs.tf‎

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -187,6 +187,71 @@ output "sapinvoices_prod_promote_workflow" {
187187
}
188188

189189

190+
################################################################################
191+
## sapinvoices-ui
192+
locals {
193+
ecr_sapinvoices_ui_function_name = "alma-sapinvoices-ui-${var.environment}"
194+
}
195+
module "ecr_sapinvoices_ui" {
196+
source = "./modules/ecr"
197+
repo_name = "alma-sapinvoices-ui"
198+
login_policy_arn = aws_iam_policy.login.arn
199+
oidc_arn = data.aws_ssm_parameter.oidc_arn.value
200+
environment = var.environment
201+
tfoutput_ssm_path = var.tfoutput_ssm_path
202+
tags = {
203+
app-repo = "alma-sapinvoices-ui"
204+
}
205+
}
206+
207+
# Outputs in dev
208+
output "sapinvoices_ui_dev_build_workflow" {
209+
value = var.environment == "prod" || var.environment == "stage" ? null : templatefile("${path.module}/files/dev-build.tpl", {
210+
region = var.aws_region
211+
role = module.ecr_sapinvoices_ui.gha_role
212+
ecr = module.ecr_sapinvoices_ui.repository_name
213+
function = local.ecr_sapinvoices_ui_function_name
214+
}
215+
)
216+
description = "Full contents of the dev-build.yml for the alma-sapinvoices-ui repo"
217+
}
218+
output "sapinvoices_ui_makefile" {
219+
value = var.environment == "prod" || var.environment == "stage" ? null : templatefile("${path.module}/files/makefile.tpl", {
220+
ecr_name = module.ecr_sapinvoices_ui.repository_name
221+
ecr_url = module.ecr_sapinvoices_ui.repository_url
222+
function = local.ecr_sapinvoices_ui_function_name
223+
}
224+
)
225+
description = "Full contents of the Makefile for the alma-sapinvoices-ui repo (allows devs to push to Dev account only)"
226+
}
227+
228+
# Outputs in stage
229+
output "sapinvoices_ui_stage_build_workflow" {
230+
value = var.environment == "prod" || var.environment == "dev" ? null : templatefile("${path.module}/files/stage-build.tpl", {
231+
region = var.aws_region
232+
role = module.ecr_sapinvoices_ui.gha_role
233+
ecr = module.ecr_sapinvoices_ui.repository_name
234+
function = local.ecr_sapinvoices_ui_function_name
235+
}
236+
)
237+
description = "Full contents of the stage-build.yml for the alma-sapinvoices-ui repo"
238+
}
239+
240+
# Outputs after promotion to prod
241+
output "sapinvoices_ui_prod_promote_workflow" {
242+
value = var.environment == "stage" || var.environment == "dev" ? null : templatefile("${path.module}/files/prod-promote.tpl", {
243+
region = var.aws_region
244+
role_stage = "${module.ecr_sapinvoices_ui.repo_name}-gha-stage"
245+
role_prod = "${module.ecr_sapinvoices_ui.repo_name}-gha-prod"
246+
ecr_stage = "${module.ecr_sapinvoices_ui.repo_name}-stage"
247+
ecr_prod = "${module.ecr_sapinvoices_ui.repo_name}-prod"
248+
function = local.ecr_sapinvoices_ui_function_name
249+
}
250+
)
251+
description = "Full contents of the prod-promote.yml for the alma-sapinvoices-ui repo"
252+
}
253+
254+
190255
################################################################################
191256
## bursar transfer app
192257
module "ecr_bursar" {

‎modules/ecr/.terraform.lock.hcl‎

Lines changed: 25 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎modules/ecr/README.md‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
<!-- BEGIN_TF_DOCS -->
2+
## Requirements
3+
4+
| Name | Version |
5+
|------|---------|
6+
| terraform | ~> 1.5 |
7+
| aws | ~> 5.0 |
8+
9+
## Providers
10+
11+
| Name | Version |
12+
|------|---------|
13+
| aws | 5.62.0 |
14+
15+
## Modules
16+
17+
No modules.
18+
19+
## Resources
20+
21+
| Name | Type |
22+
|------|------|
23+
| [aws_ecr_lifecycle_policy.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ecr_lifecycle_policy) | resource |
24+
| [aws_ecr_repository.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ecr_repository) | resource |
25+
| [aws_iam_policy.rw_this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
26+
| [aws_iam_role.gha_this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |
27+
| [aws_iam_role_policy_attachment.gha_ecr_login](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
28+
| [aws_iam_role_policy_attachment.gha_ecr_rw](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
29+
| [aws_ssm_parameter.ecr_repository_name](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ssm_parameter) | resource |
30+
| [aws_ssm_parameter.ecr_repository_url](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ssm_parameter) | resource |
31+
| [aws_ssm_parameter.gha_role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ssm_parameter) | resource |
32+
| [aws_iam_policy_document.gh_trust](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
33+
| [aws_iam_policy_document.rw_this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
34+
35+
## Inputs
36+
37+
| Name | Description | Type | Default | Required |
38+
|------|-------------|------|---------|:--------:|
39+
| environment | The environment (dev, stage, or prod) | `string` | n/a | yes |
40+
| gh\_organization | The name of the GitHub Organization. | `string` | `"MITLibraries"` | no |
41+
| login\_policy\_arn | The ARN of the shared ECR login policy | `string` | n/a | yes |
42+
| oidc\_arn | The ARN of the OIDC profile | `string` | n/a | yes |
43+
| repo\_name | The name used for part of the ECR repo name - should be same as app repo name | `string` | n/a | yes |
44+
| tags | The additional app-repo name | `map(any)` | n/a | yes |
45+
| tfoutput\_ssm\_path | The Parameter Store output path loaded in the root module | `string` | n/a | yes |
46+
47+
## Outputs
48+
49+
| Name | Description |
50+
|------|-------------|
51+
| gha\_role | Github action role used to update the ECR repository |
52+
| repo\_name | The repo\_name that was passed in to the module for naming purposes |
53+
| repository\_name | The name of the ECR repository |
54+
| repository\_url | The URL of the ECR repository |
55+
<!-- END_TF_DOCS -->

‎modules/ecr/versions.tf‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,12 +3,12 @@
33
# Providers themselves are set in the `providers.tf` file.
44

55
terraform {
6-
required_version = "~> 1.2"
6+
required_version = "~> 1.5"
77

88
required_providers {
99
aws = {
1010
source = "hashicorp/aws"
11-
version = "~> 4.0"
11+
version = "~> 5.0"
1212
}
1313
}
1414
}

‎versions.tf‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,12 +3,12 @@
33
# Providers themselves are set in the `providers.tf` file.
44

55
terraform {
6-
required_version = "~> 1.2"
6+
required_version = "~> 1.5"
77

88
required_providers {
99
aws = {
1010
source = "hashicorp/aws"
11-
version = "~> 4.0"
11+
version = "~> 5.0"
1212
}
1313
}
1414
}

0 commit comments

Comments
 (0)