code-build-runner/code-build.cf.yaml at main · francis-a/code-build-runner · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
AWSTemplateFormatVersion: '2010-09-09'
Transform: 'AWS::Serverless-2016-10-31'
Description: CodeBuild pipeline for running ARM based GitHub action tests

Parameters:
  GitHubOrgName:
    Description: GitHub org name
    Type: String

  GitHubProjectName:
    Description: GitHub project name
    Type: String

  GitHubOAuthToken:
    Description: OAuth token used by AWS CodeBuild to connect to GitHub
    NoEcho: true
    Type: String

Resources:

  CodeBuildSourceCredential:
    Type: AWS::CodeBuild::SourceCredential
    Properties:
      AuthType: PERSONAL_ACCESS_TOKEN
      ServerType: GITHUB
      Token: !Ref GitHubOAuthToken

  CodeBuildProject:
    Type: AWS::CodeBuild::Project
    Properties:
      Name: !Ref GitHubProjectName
      Artifacts:
        Type: NO_ARTIFACTS
      BadgeEnabled: true
      Environment:
        ComputeType: BUILD_GENERAL1_MEDIUM
        Image: 'aws/codebuild/amazonlinux-aarch64-standard:3.0'
        Type: ARM_CONTAINER
      ServiceRole: !GetAtt CodeBuildProjectRole.Arn
      Source:
        Type: GITHUB
        ReportBuildStatus: true
        Location: !Sub https://github.com/${GitHubOrgName}/${GitHubProjectName}.git
        Auth:
          Resource: !Ref CodeBuildSourceCredential
          Type: OAUTH
      Triggers:
        Webhook: true
        FilterGroups:
          - - Type: EVENT
              Pattern: WORKFLOW_JOB_QUEUED

  CodeBuildProjectRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Action:
              - sts:AssumeRole
            Effect: Allow
            Principal:
              Service:
                - codebuild.amazonaws.com
        Version: '2012-10-17'
      Path: /service-role/
      Policies:
        - PolicyName: CICodeBuildRolePolicy
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Action:
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                Effect: Allow
                Resource:
                  - !Sub arn:${AWS::Partition}:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/codebuild/*