Skip to content
This repository was archived by the owner on Jun 30, 2021. It is now read-only.

Commit d61044c

Browse files
hongluhonglu
authored
Add CICD templates (#3)
1 parent 8de4049 commit d61044c

File tree

4 files changed

+246
-1
lines changed

4 files changed

+246
-1
lines changed

‎Makefile‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,13 @@ PACKAGE_BUCKET ?= <bucket>
1515

1616
# Stack name used when deploying the app for manual testing
1717
APP_STACK_NAME ?= aws-serverless-codepipeline-serverlessrepo-publish
18+
# GitHub owner.
19+
GITHUB_OWNER ?= awslabs
20+
# GitHub repo.
21+
GITHUB_REPO ?= aws-serverless-codepipeline-serverlessrepo-publish
22+
# Stack name used when deploying the app for manual testing
23+
# Name of stack that creates the CI/CD pipeline for testing and publishing this app
24+
CICD_STACK_NAME ?= cicd-$(GITHUB_REPO)
1825

1926
PYTHON := $(shell /usr/bin/which python$(PY_VERSION))
2027

@@ -27,6 +34,9 @@ init:
2734
$(PYTHON) -m pip install pipenv --user
2835
pipenv sync --dev
2936

37+
init-cicd:
38+
pipenv run sam deploy --template-file $(TEMPLATE_DIR)/cicd.yml --stack-name $(CICD_STACK_NAME) --parameter-overrides GitHubOwner="$(GITHUB_OWNER)" GitHubRepo="$(GITHUB_REPO)" --capabilities CAPABILITY_IAM
39+
3040
compile-app:
3141
mkdir -p $(BUILD_DIR)
3242
pipenv run flake8 app

‎buildspec.yml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
version: 0.2
2+
phases:
3+
install:
4+
commands:
5+
- make init
6+
build:
7+
commands:
8+
- make
9+
artifacts:
10+
files:
11+
- dist/packaged-app.yml
12+
discard-paths: yes

‎sam/app.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ Resources:
66
Type: AWS::Serverless::Function
77
Properties:
88
CodeUri: app/
9-
Handler: handlers.handle_request
9+
Handler: handlers.publish
1010
Runtime: python3.6
1111
Tracing: Active
1212
MemorySize: 512

‎sam/cicd.yml‎

Lines changed: 223 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,223 @@
1+
AWSTemplateFormatVersion: '2010-09-09'
2+
Transform: 'AWS::Serverless-2016-10-31'
3+
Description: >
4+
This template sets up the CI/CD infrastructure for a GitHub-based serverless application that is published to the AWS Serverless Application Repository. It includes
5+
6+
1. a CI CodeBuild project that verifies changes pushed to any GitHub branch (used as automated approval check of PRs).
7+
2. a CD CodePipeline that triggers on changes to the publish branch, runs automated tests, and publishes a new version of the app to the AWS Serverless Application Repository.
8+
9+
Parameters:
10+
GitHubOwner:
11+
Description: GitHub username owning the repo
12+
Type: String
13+
GitHubRepo:
14+
Description: GitHub repo name
15+
Type: String
16+
GitHubOAuthToken:
17+
Description: Name of SSM Parameter holding OAuth token used by CodePipeline to connect to GitHub
18+
# TODO: Convert to SecureString once CFN supports it
19+
Type: 'AWS::SSM::Parameter::Value<String>'
20+
NoEcho: true
21+
Default: GitHubOAuthToken
22+
23+
GitHubPublishBranch:
24+
Description: Branch that should trigger the pipeline to test and publish to the Serverless Application Repository.
25+
Type: String
26+
Default: master
27+
28+
Resources:
29+
# CodeBuild project that triggers on any branch push and runs automated checks (used as automated approval check of PRs).
30+
CICodeBuildProject:
31+
Type: AWS::CodeBuild::Project
32+
Properties:
33+
ServiceRole: !GetAtt CICodeBuildRole.Arn
34+
BadgeEnabled: true
35+
Source:
36+
Type: GITHUB
37+
Location: !Sub https://github.com/${GitHubOwner}/${GitHubRepo}.git
38+
GitCloneDepth: 1
39+
ReportBuildStatus: true
40+
Auth:
41+
Type: OAUTH
42+
Triggers:
43+
Webhook: true
44+
Artifacts:
45+
Type: NO_ARTIFACTS
46+
Environment:
47+
ComputeType: BUILD_GENERAL1_SMALL
48+
Image: aws/codebuild/python:3.6.5
49+
Type: LINUX_CONTAINER
50+
EnvironmentVariables:
51+
- Name: PACKAGE_BUCKET
52+
Value: !Ref ArtifactBucket
53+
- Name: AWS_DEFAULT_REGION
54+
Value: !Sub ${AWS::Region}
55+
CICodeBuildRole:
56+
Type: AWS::IAM::Role
57+
Properties:
58+
AssumeRolePolicyDocument:
59+
Version: "2012-10-17"
60+
Statement:
61+
- Effect: Allow
62+
Principal:
63+
Service:
64+
- "codebuild.amazonaws.com"
65+
Action:
66+
- "sts:AssumeRole"
67+
Path: /service-role/
68+
Policies:
69+
- PolicyName: CICodeBuildRolePolicy
70+
PolicyDocument:
71+
Version: "2012-10-17"
72+
Statement:
73+
- Effect: Allow
74+
Action:
75+
- "logs:CreateLogGroup"
76+
- "logs:CreateLogStream"
77+
- "logs:PutLogEvents"
78+
Resource:
79+
- !Sub arn:${AWS::Partition}:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/codebuild/*
80+
- Effect: Allow
81+
Action:
82+
- "s3:PutObject"
83+
- "s3:GetObject"
84+
- "s3:GetObjectVersion"
85+
- "s3:ListBucket"
86+
Resource:
87+
- !Sub arn:${AWS::Partition}:s3:::${ArtifactBucket}
88+
- !Sub arn:${AWS::Partition}:s3:::${ArtifactBucket}/*
89+
90+
# CD Pipeline for testing and publishing new versions of an app to the serverless application repository
91+
PublishPipeline:
92+
Type: AWS::CodePipeline::Pipeline
93+
Properties:
94+
ArtifactStore:
95+
Location: !Ref ArtifactBucket
96+
Type: S3
97+
RoleArn: !GetAtt PublishPipelineRole.Arn
98+
Stages:
99+
- Name: Source
100+
Actions:
101+
- Name: ApplicationSource
102+
ActionTypeId:
103+
Category: Source
104+
Owner: ThirdParty
105+
Provider: GitHub
106+
Version: "1"
107+
Configuration:
108+
Owner: !Ref GitHubOwner
109+
OAuthToken: !Ref GitHubOAuthToken
110+
Repo: !Ref GitHubRepo
111+
Branch: !Ref GitHubPublishBranch
112+
PollForSourceChanges: false
113+
OutputArtifacts:
114+
- Name: SourceArtifact
115+
- Name: Build
116+
Actions:
117+
- Name: ApplicationPackage
118+
ActionTypeId:
119+
Category: Build
120+
Owner: AWS
121+
Provider: CodeBuild
122+
Version: "1"
123+
Configuration:
124+
ProjectName: !Ref PublishCodeBuildProject
125+
InputArtifacts:
126+
- Name: SourceArtifact
127+
OutputArtifacts:
128+
- Name: BuildArtifact
129+
# TODO: publish new version to the repo
130+
# - Name: Publish
131+
ArtifactBucket:
132+
Type: AWS::S3::Bucket
133+
Properties:
134+
LifecycleConfiguration:
135+
Rules:
136+
- ExpirationInDays: 30
137+
Status: Enabled
138+
PublishPipelineRole:
139+
Type: AWS::IAM::Role
140+
Properties:
141+
AssumeRolePolicyDocument:
142+
Version: "2012-10-17"
143+
Statement:
144+
- Effect: Allow
145+
Principal:
146+
Service:
147+
- "codepipeline.amazonaws.com"
148+
Action:
149+
- "sts:AssumeRole"
150+
Policies:
151+
- PolicyName: PublishPipelineRolePolicy
152+
PolicyDocument:
153+
Version: "2012-10-17"
154+
Statement:
155+
- Effect: Allow
156+
Action:
157+
- "s3:DeleteObject"
158+
- "s3:GetObject"
159+
- "s3:GetObjectVersion"
160+
- "s3:ListBucket"
161+
- "s3:PutObject"
162+
- "s3:GetBucketPolicy"
163+
Resource:
164+
- !Sub arn:${AWS::Partition}:s3:::${ArtifactBucket}
165+
- !Sub arn:${AWS::Partition}:s3:::${ArtifactBucket}/*
166+
- Effect: Allow
167+
Action:
168+
- "codebuild:StartBuild"
169+
- "codebuild:BatchGetBuilds"
170+
Resource:
171+
- !GetAtt PublishCodeBuildProject.Arn
172+
- !Sub arn:${AWS::Partition}:codebuild:${AWS::Region}:${AWS::AccountId}:build/${PublishCodeBuildProject}:*
173+
PublishCodeBuildProject:
174+
Type: AWS::CodeBuild::Project
175+
Properties:
176+
ServiceRole: !GetAtt PublishCodeBuildRole.Arn
177+
Source:
178+
Type: CODEPIPELINE
179+
Artifacts:
180+
Type: CODEPIPELINE
181+
Environment:
182+
ComputeType: BUILD_GENERAL1_SMALL
183+
Image: aws/codebuild/python:3.6.5
184+
Type: LINUX_CONTAINER
185+
EnvironmentVariables:
186+
- Name: PACKAGE_BUCKET
187+
Value: !Ref ArtifactBucket
188+
- Name: AWS_DEFAULT_REGION
189+
Value: !Sub ${AWS::Region}
190+
PublishCodeBuildRole:
191+
Type: AWS::IAM::Role
192+
Properties:
193+
AssumeRolePolicyDocument:
194+
Version: "2012-10-17"
195+
Statement:
196+
- Effect: Allow
197+
Principal:
198+
Service:
199+
- "codebuild.amazonaws.com"
200+
Action:
201+
- "sts:AssumeRole"
202+
Path: /service-role/
203+
Policies:
204+
- PolicyName: PublishCodeBuildRolePolicy
205+
PolicyDocument:
206+
Version: "2012-10-17"
207+
Statement:
208+
- Effect: Allow
209+
Action:
210+
- "logs:CreateLogGroup"
211+
- "logs:CreateLogStream"
212+
- "logs:PutLogEvents"
213+
Resource:
214+
- !Sub arn:${AWS::Partition}:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/codebuild/*
215+
- Effect: Allow
216+
Action:
217+
- "s3:PutObject"
218+
- "s3:GetObject"
219+
- "s3:GetObjectVersion"
220+
- "s3:ListBucket"
221+
Resource:
222+
- !Sub arn:${AWS::Partition}:s3:::${ArtifactBucket}
223+
- !Sub arn:${AWS::Partition}:s3:::${ArtifactBucket}/*

0 commit comments

Comments
 (0)