Skip to content

Commit fb17f36

Browse files
cabutlermitcabutlermit
committed
Dependency Updates
Why these changes are being introduced: Add pre-commit configuration along with version updates for the main repo as well as the embedded module. How this addresses that need: * Add pre-commit configuration files * Update Terraform and AWS Provider versions in the embedded module * Update the Terraform and AWS Provider versions in the main code * Update terraform.lock.hcl file with `terraform init -upgrade` * Update the shared workflow for pre-commit configurations Side effects of this change: None.
1 parent 4d0f220 commit fb17f36

File tree

9 files changed

+173
-24
lines changed

9 files changed

+173
-24
lines changed

‎.github/workflows/tf-shared-workflows.yml‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,8 @@ on:
1010
paths:
1111
- '**/*.tf'
1212

13+
permissions: read-all
14+
1315
jobs:
1416
validate:
1517
name: Validate Terraform
@@ -19,6 +21,6 @@ jobs:
1921
name: Checkov Tests
2022
uses: mitlibraries/.github/.github/workflows/tf-checkov-shared.yml@main
2123

22-
docs-update:
23-
name: Update README
24-
uses: mitlibraries/.github/.github/workflows/tf-docs-gen-shared.yml@main
24+
docs:
25+
name: Terraform Docs
26+
uses: mitlibraries/.github/.github/workflows/tf-docs-shared.yml@main

‎.pre-commit-config.yaml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
repos:
2+
- repo: https://github.com/antonbabenko/pre-commit-terraform
3+
rev: "v1.92.1"
4+
hooks:
5+
- id: terraform_fmt
6+
args:
7+
- --args=-recursive
8+
- id: terraform_validate
9+
- repo: https://github.com/terraform-docs/terraform-docs
10+
rev: "v0.18.0"
11+
hooks:
12+
- id: terraform-docs-go
13+
args: ["markdown", "table", "--config", "./.terraform-docs.yaml", "--recursive", "--output-file", "README.md", "./"]
14+
- repo: https://github.com/bridgecrewio/checkov.git
15+
rev: '3.2.219'
16+
hooks:
17+
- id: checkov
18+
language_version: python3.11
19+
verbose: false

‎.terraform-docs.yaml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
formatter: "" # this is required
2+
3+
settings:
4+
anchor: false
5+
html: false

‎.terraform.lock.hcl‎

Lines changed: 17 additions & 14 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎README.md‎

Lines changed: 43 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,41 @@ This repo builds the ECR (Elastic Container Registry) repositories for container
1010

1111
The only dependency is the ARN of the OpenID Connect Provider (placed in Parameter Store by the [mitlib-tf-workloads-init](https://github.com/MITLibraries/mitlib-tf-workloads-init) repo).
1212

13+
### Pre-Commit Hooks
14+
15+
For proper linting and checking, this repo uses pre-commit hooks. The following should be installed in the local workstation
16+
17+
* [pre-commit](https://pre-commit.com/)
18+
* [terraform cli](https://developer.hashicorp.com/terraform/downloads)
19+
* [terraform-docs](https://terraform-docs.io/)
20+
* [checkov](https://github.com/bridgecrewio/checkov)
21+
22+
After the first checkout locally, run the following command to initialize the pre-commit hooks.
23+
24+
```bash
25+
pre-commit install --hook-type pre-push
26+
```
27+
28+
It is possible to run the pre-commit hooks manually. To run all the pre-commit hooks for this repo, run
29+
30+
```bash
31+
pre-commit run --all-files
32+
```
33+
34+
To run just the checkov checker, run
35+
36+
```bash
37+
pre-commit run checkov
38+
```
39+
40+
To run just the `terraform-docs` hook to update the README, run
41+
42+
```bash
43+
pre-commit run terraform-docs-go
44+
```
45+
46+
See [.pre-commit-config.yaml](./.pre-commit-config.yaml) for other pre-commit hooks that can be run.
47+
1348
## Usage
1449

1550
There is a tight relationship between ECR repositories created here and the associated application repositories in GitHub due to the use of OIDC in the GitHub Actions in those application repositories. Make sure to coordinate any new ECR repositories with the developers building the applications that will be published there.
@@ -61,14 +96,14 @@ then replace all the ssm parameter references for `oidc_arn` with `aws_iam_openi
6196

6297
| Name | Version |
6398
|------|---------|
64-
| terraform | ~> 1.2 |
65-
| aws | ~> 4.0 |
99+
| terraform | ~> 1.5 |
100+
| aws | ~> 5.0 |
66101

67102
## Providers
68103

69104
| Name | Version |
70105
|------|---------|
71-
| aws | 4.37.0 |
106+
| aws | 5.62.0 |
72107

73108
## Modules
74109

@@ -85,6 +120,7 @@ then replace all the ssm parameter references for `oidc_arn` with `aws_iam_openi
85120
| ecr\_patronload | ./modules/ecr | n/a |
86121
| ecr\_ppod | ./modules/ecr | n/a |
87122
| ecr\_sapinvoices | ./modules/ecr | n/a |
123+
| ecr\_sapinvoices\_ui | ./modules/ecr | n/a |
88124
| ecr\_timdex\_browsertrix | ./modules/ecr | n/a |
89125
| ecr\_timdex\_geo | ./modules/ecr | n/a |
90126
| ecr\_timdex\_lambdas | ./modules/ecr | n/a |
@@ -170,6 +206,10 @@ then replace all the ssm parameter references for `oidc_arn` with `aws_iam_openi
170206
| sapinvoices\_makefile | Full contents of the Makefile for the alma-sapinvoices repo (allows devs to push to Dev account only) |
171207
| sapinvoices\_prod\_promote\_workflow | Full contents of the prod-promote.yml for the alma-sapinvoices repo |
172208
| sapinvoices\_stage\_build\_workflow | Full contents of the stage-build.yml for the alma-sapinvoices repo |
209+
| sapinvoices\_ui\_dev\_build\_workflow | Full contents of the dev-build.yml for the alma-sapinvoices-ui repo |
210+
| sapinvoices\_ui\_makefile | Full contents of the Makefile for the alma-sapinvoices-ui repo (allows devs to push to Dev account only) |
211+
| sapinvoices\_ui\_prod\_promote\_workflow | Full contents of the prod-promote.yml for the alma-sapinvoices-ui repo |
212+
| sapinvoices\_ui\_stage\_build\_workflow | Full contents of the stage-build.yml for the alma-sapinvoices-ui repo |
173213
| tim\_dev\_build\_workflow | Full contents of the dev-build.yml for the timdex-index-manager repo |
174214
| tim\_makefile | Full contents of the Makefile for the timdex-index-manager repo (allows devs to push to Dev account only) |
175215
| tim\_prod\_promote\_workflow | Full contents of the prod-promote.yml for the timdex-index-manager repo |

‎modules/ecr/.terraform.lock.hcl‎

Lines changed: 25 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎modules/ecr/README.md‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
<!-- BEGIN_TF_DOCS -->
2+
## Requirements
3+
4+
| Name | Version |
5+
|------|---------|
6+
| terraform | ~> 1.5 |
7+
| aws | ~> 5.0 |
8+
9+
## Providers
10+
11+
| Name | Version |
12+
|------|---------|
13+
| aws | 5.62.0 |
14+
15+
## Modules
16+
17+
No modules.
18+
19+
## Resources
20+
21+
| Name | Type |
22+
|------|------|
23+
| [aws_ecr_lifecycle_policy.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ecr_lifecycle_policy) | resource |
24+
| [aws_ecr_repository.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ecr_repository) | resource |
25+
| [aws_iam_policy.rw_this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
26+
| [aws_iam_role.gha_this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |
27+
| [aws_iam_role_policy_attachment.gha_ecr_login](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
28+
| [aws_iam_role_policy_attachment.gha_ecr_rw](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
29+
| [aws_ssm_parameter.ecr_repository_name](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ssm_parameter) | resource |
30+
| [aws_ssm_parameter.ecr_repository_url](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ssm_parameter) | resource |
31+
| [aws_ssm_parameter.gha_role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ssm_parameter) | resource |
32+
| [aws_iam_policy_document.gh_trust](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
33+
| [aws_iam_policy_document.rw_this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
34+
35+
## Inputs
36+
37+
| Name | Description | Type | Default | Required |
38+
|------|-------------|------|---------|:--------:|
39+
| environment | The environment (dev, stage, or prod) | `string` | n/a | yes |
40+
| gh\_organization | The name of the GitHub Organization. | `string` | `"MITLibraries"` | no |
41+
| login\_policy\_arn | The ARN of the shared ECR login policy | `string` | n/a | yes |
42+
| oidc\_arn | The ARN of the OIDC profile | `string` | n/a | yes |
43+
| repo\_name | The name used for part of the ECR repo name - should be same as app repo name | `string` | n/a | yes |
44+
| tags | The additional app-repo name | `map(any)` | n/a | yes |
45+
| tfoutput\_ssm\_path | The Parameter Store output path loaded in the root module | `string` | n/a | yes |
46+
47+
## Outputs
48+
49+
| Name | Description |
50+
|------|-------------|
51+
| gha\_role | Github action role used to update the ECR repository |
52+
| repo\_name | The repo\_name that was passed in to the module for naming purposes |
53+
| repository\_name | The name of the ECR repository |
54+
| repository\_url | The URL of the ECR repository |
55+
<!-- END_TF_DOCS -->

‎modules/ecr/versions.tf‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,12 +3,12 @@
33
# Providers themselves are set in the `providers.tf` file.
44

55
terraform {
6-
required_version = "~> 1.2"
6+
required_version = "~> 1.5"
77

88
required_providers {
99
aws = {
1010
source = "hashicorp/aws"
11-
version = "~> 4.0"
11+
version = "~> 5.0"
1212
}
1313
}
1414
}

‎versions.tf‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,12 +3,12 @@
33
# Providers themselves are set in the `providers.tf` file.
44

55
terraform {
6-
required_version = "~> 1.2"
6+
required_version = "~> 1.5"
77

88
required_providers {
99
aws = {
1010
source = "hashicorp/aws"
11-
version = "~> 4.0"
11+
version = "~> 5.0"
1212
}
1313
}
1414
}

0 commit comments

Comments
 (0)