fix: implemented suggested changes

Author: neatbyte-vnobis

.adiorc.js

@@ -31,10 +31,10 @@ module.exports = {
             "buffer",
             "fs",
             "readline",
+            "stream",
             "util",
             "events",
             "crypto",
-            "aws-sdk",
             "url",
             "worker_threads",
             "~tests",

.eslintrc.js

@@ -45,7 +45,18 @@ module.exports = {
         "jest/no-conditional-expect": 0,
         "jest/no-commented-out-tests": 0,
         "jest/no-disabled-tests": 0,
-        "lodash/import-scope": [2, "method"]
+        "lodash/import-scope": [2, "method"],
+        "no-restricted-imports": [
+            "error",
+            {
+                patterns: [
+                    {
+                        group: ["@aws-sdk/*"],
+                        message: "Please use @webiny/aws-sdk instead."
+                    }
+                ]
+            }
+        ]
     },
     settings: {
         react: {

.github/workflows/cleanup.yml

@@ -2,6 +2,7 @@
 name: Cloud infrastructure Cleanup
 
 on:
+  workflow_dispatch:
   repository_dispatch:
     types: [cleanup-infrastructure]
   schedule:
@@ -10,13 +11,19 @@ on:
 jobs:
   aws-nuke:
     runs-on: ubuntu-latest
-    env:
-      AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
-      AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+    permissions:
+      id-token: write
     container:
       image: rebuy/aws-nuke
       options: --user root -v ${{ github.workspace }}:/workspace
     steps:
+      - name: Configure AWS Credentials
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: arn:aws:iam::726952677045:role/GitHubActionsWebinyJs
+          aws-region: eu-central-1
+
+      # We need this step because of the `aws-nuke.yml` config which is stored in our repo.
       - uses: actions/checkout@v3
 
       - name: Run AWS Nuke
@@ -29,21 +36,7 @@ jobs:
           --max-wait-retries 100
           --access-key-id ${{ env.AWS_ACCESS_KEY_ID }}
           --secret-access-key ${{ env.AWS_SECRET_ACCESS_KEY }}
-
-  aws-eventbridge-cleanup:
-    runs-on: ubuntu-latest
-    env:
-      AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
-      AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-    steps:
-      - uses: actions/setup-node@v3
-        with:
-          node-version: 18
-
-      - uses: actions/checkout@v3
-
-      - name: Install dependencies
-        run: yarn --immutable
+          --session-token ${{ env.AWS_SESSION_TOKEN }}
 
   aws-cloudfront-functions-cleanup:
     runs-on: ubuntu-latest

.github/workflows/cleanup/aws-nuke.yml

@@ -14,6 +14,8 @@ accounts:
     filters:
       S3Bucket:
         - "s3://webiny-ci"
+      IAMRole:
+        - "GitHubActionsWebinyJs"
 
 resource-types:
   # These resource types will be destroyed.

.github/workflows/devPush.yml

@@ -131,6 +131,8 @@ jobs:
   jest-tests:
     name: ${{ matrix.package.cmd }}
     needs: [init, build]
+    permissions:
+      id-token: write
     strategy:
       fail-fast: false
       matrix:
@@ -139,12 +141,16 @@ jobs:
         package: ${{ fromJson(needs.init.outputs.jest-packages) }}
     runs-on: ${{ matrix.os }}
     env:
-      AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
-      AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
       AWS_ELASTIC_SEARCH_DOMAIN_NAME: ${{ secrets.AWS_ELASTIC_SEARCH_DOMAIN_NAME }}
       ELASTIC_SEARCH_ENDPOINT: ${{ secrets.ELASTIC_SEARCH_ENDPOINT }}
       ELASTIC_SEARCH_INDEX_PREFIX: ${{ matrix.package.id }}
     steps:
+      - name: Configure AWS Credentials
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: arn:aws:iam::726952677045:role/GitHubActionsWebinyJs
+          aws-region: eu-central-1
+
       - uses: actions/setup-node@v3
         with:
           node-version: ${{ matrix.node }}
@@ -199,19 +205,25 @@ jobs:
   e2e-wby-cms-ddb-project-setup:
     name: E2E (DDB) - Project setup
     needs: e2e-wby-cms-ddb-init
+    permissions:
+      id-token: write
     runs-on: ubuntu-latest
     outputs:
       cypress-config: ${{ steps.save-cypress-config.outputs.cypress-config }}
     environment: next
     env:
-      AWS_ACCESS_KEY_ID: ${{ secrets.DEPLOY_WEBINY_PROJECT_AWS_ACCESS_KEY_ID }}
-      AWS_SECRET_ACCESS_KEY: ${{ secrets.DEPLOY_WEBINY_PROJECT_AWS_SECRET_ACCESS_KEY }}
       CYPRESS_MAILOSAUR_API_KEY: ${{ secrets.CYPRESS_MAILOSAUR_API_KEY }}
       PULUMI_CONFIG_PASSPHRASE: ${{ secrets.PULUMI_CONFIG_PASSPHRASE }}
       PULUMI_SECRETS_PROVIDER: ${{ secrets.PULUMI_SECRETS_PROVIDER }}
       WEBINY_PULUMI_BACKEND: ${{ secrets.WEBINY_PULUMI_BACKEND }}${{ needs.e2e-wby-cms-ddb-init.outputs.ts }}_ddb
       YARN_ENABLE_IMMUTABLE_INSTALLS: false
     steps:
+      - name: Configure AWS Credentials
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: arn:aws:iam::726952677045:role/GitHubActionsWebinyJs
+          aws-region: eu-central-1
+
       - uses: actions/setup-node@v3
         with:
           node-version: 18
@@ -330,7 +342,7 @@ jobs:
         working-directory: xyz/test-project
         run: yarn webiny deploy apps/website --env dev
 
-      # Generates a new cypress.json config.
+      # Generates a new cypress-tests/cypress.config.ts config.
       - name: Create Cypress config
         working-directory: dev
         run: yarn setup-cypress --projectFolder ../xyz/test-project
@@ -340,15 +352,17 @@ jobs:
       - name: Save Cypress config
         id: save-cypress-config
         working-directory: dev
-        run: echo "cypress-config=$(cat cypress.json | tr -d ' \t\n\r')" >> $GITHUB_OUTPUT
+        run: echo "cypress-config=$(cat cypress-tests/cypress.config.ts | tr -d '\t\n\r')" >> $GITHUB_OUTPUT
 
       - name: Cypress - run installation wizard test
-        working-directory: dev
-        run: yarn cypress run --browser chrome --spec "cypress/integration/adminInstallation/**/*.spec.js"
+        working-directory: dev/cypress-tests
+        run: yarn cypress run --browser chrome --spec "cypress/e2e/adminInstallation/**/*.cy.js"
 
   e2e-wby-cms-ddb-cypress-tests:
     name: ${{ matrix.cypress-folder }} (ddb, ${{ matrix.os }}, Node v${{ matrix.node }})
     needs: [e2e-wby-cms-ddb-init, e2e-wby-cms-ddb-project-setup]
+    permissions:
+      id-token: write
     strategy:
       fail-fast: false
       matrix:
@@ -358,14 +372,18 @@ jobs:
     runs-on: ubuntu-latest
     environment: next
     env:
-      AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
-      AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
       CYPRESS_MAILOSAUR_API_KEY: ${{ secrets.CYPRESS_MAILOSAUR_API_KEY }}
       PULUMI_CONFIG_PASSPHRASE: ${{ secrets.PULUMI_CONFIG_PASSPHRASE }}
       PULUMI_SECRETS_PROVIDER: ${{ secrets.PULUMI_SECRETS_PROVIDER }}
       WEBINY_PULUMI_BACKEND: ${{ secrets.WEBINY_PULUMI_BACKEND }}${{ needs.e2e-wby-cms-ddb-init.outputs.ts }}_ddb
       YARN_ENABLE_IMMUTABLE_INSTALLS: false
     steps:
+      - name: Configure AWS Credentials
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: arn:aws:iam::726952677045:role/GitHubActionsWebinyJs
+          aws-region: eu-central-1
+
       - uses: actions/checkout@v3
         with:
           path: dev
@@ -390,10 +408,10 @@ jobs:
 
       - name: Set up Cypress config
         working-directory: dev
-        run: echo '${{ needs.e2e-wby-cms-ddb-project-setup.outputs.cypress-config }}' > cypress.json
+        run: echo '${{ needs.e2e-wby-cms-ddb-project-setup.outputs.cypress-config }}' > cypress-tests/cypress.config.ts
 
       - name: Cypress - run "${{ matrix.cypress-folder }}" tests
-        working-directory: dev
+        working-directory: dev/cypress-tests
         timeout-minutes: 40
         run: yarn cypress run --browser chrome --spec "${{ matrix.cypress-folder }}"
 
@@ -426,13 +444,13 @@ jobs:
   e2e-wby-cms-ddb-es-project-setup:
     name: E2E (DDB+ES) - Project setup
     needs: e2e-wby-cms-ddb-es-init
+    permissions:
+      id-token: write
     runs-on: ubuntu-latest
     outputs:
       cypress-config: ${{ steps.save-cypress-config.outputs.cypress-config }}
     environment: next
     env:
-      AWS_ACCESS_KEY_ID: ${{ secrets.DEPLOY_WEBINY_PROJECT_AWS_ACCESS_KEY_ID }}
-      AWS_SECRET_ACCESS_KEY: ${{ secrets.DEPLOY_WEBINY_PROJECT_AWS_SECRET_ACCESS_KEY }}
       AWS_ELASTIC_SEARCH_DOMAIN_NAME: ${{ secrets.AWS_ELASTIC_SEARCH_DOMAIN_NAME }}
       CYPRESS_MAILOSAUR_API_KEY: ${{ secrets.CYPRESS_MAILOSAUR_API_KEY }}
       ELASTIC_SEARCH_ENDPOINT: ${{ secrets.ELASTIC_SEARCH_ENDPOINT }}
@@ -442,6 +460,12 @@ jobs:
       WEBINY_PULUMI_BACKEND: ${{ secrets.WEBINY_PULUMI_BACKEND }}${{ needs.e2e-wby-cms-ddb-es-init.outputs.ts }}_ddb-es
       YARN_ENABLE_IMMUTABLE_INSTALLS: false
     steps:
+      - name: Configure AWS Credentials
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: arn:aws:iam::726952677045:role/GitHubActionsWebinyJs
+          aws-region: eu-central-1
+
       - uses: actions/setup-node@v3
         with:
           node-version: 18
@@ -560,7 +584,7 @@ jobs:
         working-directory: xyz/test-project
         run: yarn webiny deploy apps/website --env dev
 
-      # Generates a new cypress.json config.
+      # Generates a new cypress-tests/cypress.config.ts config.
       - name: Create Cypress config
         working-directory: dev
         run: yarn setup-cypress --projectFolder ../xyz/test-project
@@ -570,15 +594,17 @@ jobs:
       - name: Save Cypress config
         id: save-cypress-config
         working-directory: dev
-        run: echo "cypress-config=$(cat cypress.json | tr -d ' \t\n\r')" >> $GITHUB_OUTPUT
+        run: echo "cypress-config=$(cat cypress-tests/cypress.config.ts | tr -d '\t\n\r')" >> $GITHUB_OUTPUT
 
       - name: Cypress - run installation wizard test
-        working-directory: dev
-        run: yarn cypress run --browser chrome --spec "cypress/integration/adminInstallation/**/*.spec.js"
+        working-directory: dev/cypress-tests
+        run: yarn cypress run --browser chrome --spec "cypress/e2e/adminInstallation/**/*.cy.js"
 
   e2e-wby-cms-ddb-es-cypress-tests:
     name: ${{ matrix.cypress-folder }} (ddb+es, ${{ matrix.os }}, Node v${{ matrix.node }})
     needs: [e2e-wby-cms-ddb-es-init, e2e-wby-cms-ddb-es-project-setup]
+    permissions:
+      id-token: write
     strategy:
       fail-fast: false
       matrix:
@@ -588,9 +614,7 @@ jobs:
     runs-on: ubuntu-latest
     environment: next
     env:
-      AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
       AWS_ELASTIC_SEARCH_DOMAIN_NAME: ${{ secrets.AWS_ELASTIC_SEARCH_DOMAIN_NAME }}
-      AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
       CYPRESS_MAILOSAUR_API_KEY: ${{ secrets.CYPRESS_MAILOSAUR_API_KEY }}
       ELASTIC_SEARCH_ENDPOINT: ${{ secrets.ELASTIC_SEARCH_ENDPOINT }}
       ELASTIC_SEARCH_INDEX_PREFIX: ${{ needs.e2e-wby-cms-ddb-es-init.outputs.ts }}_
@@ -599,6 +623,12 @@ jobs:
       WEBINY_PULUMI_BACKEND: ${{ secrets.WEBINY_PULUMI_BACKEND }}${{ needs.e2e-wby-cms-ddb-es-init.outputs.ts }}_ddb-es
       YARN_ENABLE_IMMUTABLE_INSTALLS: false
     steps:
+      - name: Configure AWS Credentials
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: arn:aws:iam::726952677045:role/GitHubActionsWebinyJs
+          aws-region: eu-central-1
+
       - uses: actions/checkout@v3
         with:
           path: dev
@@ -623,9 +653,9 @@ jobs:
 
       - name: Set up Cypress config
         working-directory: dev
-        run: echo '${{ needs.e2e-wby-cms-ddb-es-project-setup.outputs.cypress-config }}' > cypress.json
+        run: echo '${{ needs.e2e-wby-cms-ddb-es-project-setup.outputs.cypress-config }}' > cypress-tests/cypress.config.ts
 
       - name: Cypress - run "${{ matrix.cypress-folder }}" tests
-        working-directory: dev
+        working-directory: dev/cypress-tests
         timeout-minutes: 40
         run: yarn cypress run --browser chrome --spec "${{ matrix.cypress-folder }}"