Skip to content

Commit e3c2779

Browse files
saidsefsaidsef
authored
Updated CI workflows (#6)
1 parent 406585e commit e3c2779

File tree

9 files changed

+243
-15
lines changed

9 files changed

+243
-15
lines changed

‎.github/workflows/ci.yaml

Lines changed: 31 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -12,19 +12,40 @@ jobs:
1212
validate:
1313
name: Validate
1414
runs-on: ubuntu-latest
15+
strategy:
16+
fail-fast: true
17+
matrix:
18+
tf-version: ["1.0.11", "1.1.9", "1.2.9", "1.3.6", "latest"]
1519
steps:
1620
- name: Checkout code
1721
uses: actions/checkout@v3
1822
- name: Setup Terraform
1923
uses: hashicorp/setup-terraform@v2
2024
with:
21-
terraform_version: 1.1.9
22-
- name: Initialise with no backend
23-
run: terraform init -backend=false
24-
- name: Check formatting
25-
run: terraform fmt -check -recursive
26-
- name: Validate the configuration
27-
run: terraform validate
25+
terraform_version: ${{ matrix.tf-version }}
26+
- name: Terraform Init
27+
run: |
28+
terraform init -backend=false -upgrade -reconfigure
29+
- name: Terraform FMT
30+
run: |
31+
terraform fmt -check -recursive
32+
- name: Terraform Validate
33+
run: |
34+
terraform validate
35+
- name: Terraform Version / Providers
36+
run: |
37+
terraform version
38+
terraform providers
39+
- name: Exmaple Complete Validate
40+
run: |
41+
cd exmaples/complete
42+
terraform init -backend=false -upgrade -reconfigure
43+
terraform validate
44+
# - name: Exmaple Remote Validate
45+
# run: |
46+
# cd exmaples/remote
47+
# terraform init -backend=false -upgrade -reconfigure
48+
# terraform validate
2849

2950
tflint:
3051
name: tflint
@@ -57,6 +78,9 @@ jobs:
5778
uses: actions/checkout@v3
5879
- name: tfsec
5980
uses: aquasecurity/tfsec-action@v1.0.2
81+
with:
82+
additional_args: "--force-all-dirs --concise-output --code-theme=dark"
83+
version: "latest"
6084

6185
caller-identity-check:
6286
if: ${{ github.event_name == 'pull_request' }}

‎README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ This Terraform module enables you to configure GitLab Actions as an AWS IAM OIDC
77

88
- AWS Account(s) and credentials
99
- GitLab repository
10-
- Terraform >= 1.1.x
10+
- Terraform >= 1.0.x
1111
- Profit?
1212

1313
## Deployment / Usage

‎TERRAFORM.md

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2,15 +2,15 @@
22

33
| Name | Version |
44
|------|---------|
5-
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | ~> 1.1 |
6-
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | ~> 4 |
7-
| <a name="requirement_tls"></a> [tls](#requirement\_tls) | ~> 4 |
5+
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | ~> 1.0 |
6+
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 4 |
7+
| <a name="requirement_tls"></a> [tls](#requirement\_tls) | >= 4 |
88

99
## Providers
1010

1111
| Name | Version |
1212
|------|---------|
13-
| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.40.0 |
13+
| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.46.0 |
1414
| <a name="provider_tls"></a> [tls](#provider\_tls) | 4.0.4 |
1515

1616
## Modules

‎exmaples/remote/README.md

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
## Requirements
2+
3+
No requirements.
4+
5+
## Providers
6+
7+
No providers.
8+
9+
## Modules
10+
11+
| Name | Source | Version |
12+
|------|--------|---------|
13+
| <a name="module_gitlab_oidc"></a> [gitlab\_oidc](#module\_gitlab\_oidc) | saidsef/gitlab-oidc/aws | >= 1 |
14+
15+
## Resources
16+
17+
No resources.
18+
19+
## Inputs
20+
21+
| Name | Description | Type | Default | Required |
22+
|------|-------------|------|---------|:--------:|
23+
| <a name="input_attach_admin_policy"></a> [attach\_admin\_policy](#input\_attach\_admin\_policy) | Enable attachment of the AdministratorAccess policy | `bool` | `false` | no |
24+
| <a name="input_attach_read_only_policy"></a> [attach\_read\_only\_policy](#input\_attach\_read\_only\_policy) | Enable attachment of the ReadOnly policy | `bool` | `true` | no |
25+
| <a name="input_create_oidc_provider"></a> [create\_oidc\_provider](#input\_create\_oidc\_provider) | Enable creation of the GitLab OIDC provider | `bool` | `true` | no |
26+
| <a name="input_enabled"></a> [enabled](#input\_enabled) | Enable creation of resources | `bool` | `true` | no |
27+
| <a name="input_force_detach_policies"></a> [force\_detach\_policies](#input\_force\_detach\_policies) | Force detachment of policies attached to the IAM role | `string` | `false` | no |
28+
| <a name="input_gitlab_organisation"></a> [gitlab\_organisation](#input\_gitlab\_organisation) | GitLab organisation name | `string` | `"saidsef"` | no |
29+
| <a name="input_gitlab_repositories"></a> [gitlab\_repositories](#input\_gitlab\_repositories) | List of GitLab repository name(s) and branche names or patterns | <pre>list(object({<br> name = string<br> branches = list(string)<br> }))</pre> | <pre>[<br> {<br> "branches": null,<br> "name": null<br> }<br>]</pre> | no |
30+
| <a name="input_iam_role_name"></a> [iam\_role\_name](#input\_iam\_role\_name) | Name of the IAM role | `string` | `"gitlab-runner"` | no |
31+
| <a name="input_iam_role_path"></a> [iam\_role\_path](#input\_iam\_role\_path) | Path to the IAM role | `string` | `"/"` | no |
32+
| <a name="input_iam_role_permissions_boundary"></a> [iam\_role\_permissions\_boundary](#input\_iam\_role\_permissions\_boundary) | ARN of the permissions boundary to be used by the IAM role | `string` | `""` | no |
33+
| <a name="input_iam_role_policy_arns"></a> [iam\_role\_policy\_arns](#input\_iam\_role\_policy\_arns) | List of IAM policy ARNs to attach to the IAM role | `list(string)` | `[]` | no |
34+
| <a name="input_max_session_duration"></a> [max\_session\_duration](#input\_max\_session\_duration) | Maximum session duration in seconds | `number` | `3600` | no |
35+
| <a name="input_region"></a> [region](#input\_region) | AWS Region name | `string` | `"eu-west-1"` | no |
36+
| <a name="input_tags"></a> [tags](#input\_tags) | Map of tags to be applied to all resources | `map(string)` | `{}` | no |
37+
| <a name="input_url"></a> [url](#input\_url) | URL of identity provider | `string` | `"gitlab.com"` | no |
38+
39+
## Outputs
40+
41+
| Name | Description |
42+
|------|-------------|
43+
| <a name="output_role_arn"></a> [role\_arn](#output\_role\_arn) | AWS action role ARN |
44+
| <a name="output_thumbprint"></a> [thumbprint](#output\_thumbprint) | GitLab certificates thumbprint |

‎exmaples/remote/main.tf

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
provider "aws" {
2+
region = var.region
3+
}
4+
5+
module "gitlab_oidc" {
6+
source = "saidsef/gitlab-oidc/aws"
7+
version = ">= 1"
8+
9+
attach_admin_policy = true
10+
attach_read_only_policy = true
11+
create_oidc_provider = true
12+
enabled = true
13+
force_detach_policies = false
14+
gitlab_organisation = var.gitlab_organisation
15+
gitlab_repositories = [{ name = "terraform-aws-gitlab-oidc", branches = ["main", "pr-*", "*pull*", "*"] }]
16+
iam_role_name = "gitlab-runner"
17+
iam_role_path = "/"
18+
iam_role_permissions_boundary = ""
19+
iam_role_policy_arns = []
20+
max_session_duration = 3600
21+
tags = {}
22+
url = "gitlab.com"
23+
}

‎exmaples/remote/outputs.tf

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
output "role_arn" {
2+
description = "AWS action role ARN"
3+
sensitive = false
4+
value = module.gitlab_oidc.role_arn
5+
}
6+
7+
output "thumbprint" {
8+
description = "GitLab certificates thumbprint"
9+
value = module.gitlab_oidc.thumbprint
10+
sensitive = false
11+
}

‎exmaples/remote/terraform.tfvars

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
attach_admin_policy = false
2+
attach_read_only_policy = true
3+
create_oidc_provider = true
4+
enabled = true
5+
force_detach_policies = false
6+
gitlab_organisation = "saidsef"
7+
gitlab_repositories = [
8+
{
9+
"branches" : null,
10+
"name" : null
11+
}
12+
]
13+
iam_role_name = "gitlab-runner"
14+
iam_role_path = "/"
15+
iam_role_permissions_boundary = ""
16+
iam_role_policy_arns = []
17+
max_session_duration = 3600
18+
region = "eu-west-1"
19+
tags = {}
20+
url = "gitlab.com"

‎exmaples/remote/variables.tf

Lines changed: 106 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,106 @@
1+
variable "region" {
2+
default = "eu-west-1"
3+
description = "AWS Region name"
4+
type = string
5+
}
6+
7+
variable "attach_admin_policy" {
8+
default = false
9+
description = "Enable attachment of the AdministratorAccess policy"
10+
type = bool
11+
}
12+
13+
variable "attach_read_only_policy" {
14+
default = true
15+
description = "Enable attachment of the ReadOnly policy"
16+
type = bool
17+
}
18+
19+
variable "create_oidc_provider" {
20+
default = true
21+
description = "Enable creation of the GitLab OIDC provider"
22+
type = bool
23+
}
24+
25+
variable "enabled" {
26+
default = true
27+
description = "Enable creation of resources"
28+
type = bool
29+
}
30+
31+
variable "force_detach_policies" {
32+
default = false
33+
description = "Force detachment of policies attached to the IAM role"
34+
type = string
35+
}
36+
37+
variable "gitlab_organisation" {
38+
default = "saidsef"
39+
description = "GitLab organisation name"
40+
type = string
41+
}
42+
43+
variable "gitlab_repositories" {
44+
type = list(object({
45+
name = string
46+
branches = list(string)
47+
}))
48+
default = [{
49+
branches = null
50+
name = null
51+
}]
52+
description = "List of GitLab repository name(s) and branche names or patterns"
53+
}
54+
55+
variable "iam_role_name" {
56+
default = "gitlab-runner"
57+
description = "Name of the IAM role"
58+
type = string
59+
}
60+
61+
variable "iam_role_path" {
62+
default = "/"
63+
description = "Path to the IAM role"
64+
type = string
65+
sensitive = false
66+
}
67+
68+
variable "iam_role_permissions_boundary" {
69+
default = ""
70+
description = "ARN of the permissions boundary to be used by the IAM role"
71+
type = string
72+
sensitive = false
73+
}
74+
75+
variable "iam_role_policy_arns" {
76+
default = []
77+
description = "List of IAM policy ARNs to attach to the IAM role"
78+
type = list(string)
79+
sensitive = false
80+
}
81+
82+
variable "max_session_duration" {
83+
default = 3600
84+
description = "Maximum session duration in seconds"
85+
type = number
86+
sensitive = false
87+
88+
validation {
89+
condition = var.max_session_duration >= 3600 && var.max_session_duration <= 43200
90+
error_message = "Session duration must be between 3600 and 43200 seconds."
91+
}
92+
}
93+
94+
variable "url" {
95+
type = string
96+
description = "URL of identity provider"
97+
default = "gitlab.com"
98+
sensitive = false
99+
}
100+
101+
variable "tags" {
102+
default = {}
103+
description = "Map of tags to be applied to all resources"
104+
type = map(string)
105+
sensitive = false
106+
}

‎versions.tf

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2,14 +2,14 @@ terraform {
22
required_providers {
33
aws = {
44
source = "hashicorp/aws"
5-
version = "~> 4"
5+
version = ">= 4"
66
}
77

88
tls = {
99
source = "hashicorp/tls"
10-
version = "~> 4"
10+
version = ">= 4"
1111
}
1212
}
1313

14-
required_version = "~> 1.1"
14+
required_version = "~> 1.0"
1515
}

0 commit comments

Comments
 (0)