change

marcoacierno · marcoacierno · commit 6f167f56e819 · 2025-01-04T17:04:06.000+01:00
change

change

change

change

change

pdates

updates
diff --git a/.editorconfig b/.editorconfig
@@ -30,5 +30,5 @@ indent_size = 2
 [Makefile]
 indent_style = tab
 
-[*.tf]
+[{*.tf,*.tofu}]
 indent_size = 2
diff --git a/.github/workflows/build-backend.yml b/.github/workflows/build-backend.yml
@@ -8,7 +8,7 @@ on:
 jobs:
   build:
     name: Build
-    runs-on: [self-hosted]
+    runs-on: [self-hosted, arm64-fargate]
     steps:
       - uses: actions/checkout@v4
         with:
diff --git a/.github/workflows/build-frontend.yml b/.github/workflows/build-frontend.yml
@@ -4,11 +4,14 @@ on:
       githash:
         required: true
         type: string
+      tf_environment:
+        required: true
+        type: string
 
 jobs:
   build:
     name: Build
-    runs-on: [self-hosted]
+    runs-on: [self-hosted, arm64-fargate]
     steps:
       - uses: actions/checkout@v4
         with:
@@ -30,13 +33,13 @@ jobs:
       - name: Get vars
         id: vars
         run: |
-          cms_hostname=$(aws ssm get-parameter --output text --query Parameter.Value --with-decryption --name /pythonit/${{ env.TF_WORKSPACE }}/pycon-frontend/cms-hostname)
+          cms_hostname=$(aws ssm get-parameter --output text --query Parameter.Value --with-decryption --name /pythonit/${{ inputs.tf_environment }}/pycon-frontend/cms-hostname)
           echo "CMS_HOSTNAME=$cms_hostname" >> "$GITHUB_OUTPUT"
 
-          conference_code=$(aws ssm get-parameter --output text --query Parameter.Value --with-decryption --name /pythonit/${{ env.TF_WORKSPACE }}/pycon-frontend/conference-code)
+          conference_code=$(aws ssm get-parameter --output text --query Parameter.Value --with-decryption --name /pythonit/${{ inputs.tf_environment }}/pycon-frontend/conference-code)
           echo "CONFERENCE_CODE=$conference_code" >> "$GITHUB_OUTPUT"
 
-          sentry_auth_token=$(aws ssm get-parameter --output text --query Parameter.Value --with-decryption --name /pythonit/${{ env.TF_WORKSPACE }}/common/sentry-auth-token)
+          sentry_auth_token=$(aws ssm get-parameter --output text --query Parameter.Value --with-decryption --name /pythonit/${{ inputs.tf_environment }}/common/sentry-auth-token)
           echo "::add-mask::$sentry_auth_token"
           echo "SENTRY_AUTH_TOKEN=$sentry_auth_token" >> "$GITHUB_OUTPUT"
       - name: Build and push
@@ -47,7 +50,7 @@ jobs:
           builder: ${{ steps.buildx.outputs.name }}
           provenance: false
           push: true
-          tags: ${{ secrets.AWS_ACCOUNT_ID }}.dkr.ecr.eu-central-1.amazonaws.com/pythonit/${{ fromJSON('["pastaporto", "production"]')[github.ref == 'refs/heads/main'] }}-pycon-frontend:${{ inputs.githash }}
+          tags: ${{ secrets.AWS_ACCOUNT_ID }}.dkr.ecr.eu-central-1.amazonaws.com/pythonit/${{ inputs.tf_environment }}-pycon-frontend:${{ inputs.githash }}
           cache-from: type=local,src=/tmp/.buildx-cache
           cache-to: type=local,dest=/tmp/.buildx-cache
           platforms: linux/arm64
diff --git a/.github/workflows/build-pretix.yml b/.github/workflows/build-pretix.yml
@@ -8,7 +8,7 @@ on:
 jobs:
   build:
     name: Build pretix
-    runs-on: [self-hosted]
+    runs-on: [self-hosted, arm64-fargate]
     steps:
       - uses: actions/checkout@v4
         with:
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
@@ -186,6 +186,7 @@ jobs:
     uses: ./.github/workflows/build-frontend.yml
     with:
       githash: ${{ needs.check-frontend-build.outputs.githash }}
+      tf_environment: ${{ fromJSON('["pastaporto", "production"]')[github.ref == 'refs/heads/main'] }}
     secrets: inherit
     if: always() && needs.check-frontend-build.outputs.image_exists == 0 && !cancelled() && !failure() && !contains(needs.*.result, 'failure') && !contains(needs.*.result, 'cancelled')
 
diff --git a/.gitignore b/.gitignore
@@ -138,3 +138,4 @@ backend/__pypackages__/
 backend/custom_admin/.astro/
 backend/custom_admin/core.*
 core.*
+**/.archive_files/*.zip
diff --git a/backend/Dockerfile b/backend/Dockerfile
@@ -87,3 +87,4 @@ RUN mkdir -p assets && .venv/bin/python manage.py collectstatic --noinput
 
 ENTRYPOINT ["/home/app/.venv/bin/gunicorn"]
 CMD [ "pycon.wsgi" ]
+#test
diff --git a/backend/README.md b/backend/README.md
@@ -63,3 +63,4 @@ And for the admin go to:
 http://localhost:8000/admin
 
 You should be able to login with the user we create a few moments ago.
+#testchange
diff --git a/infrastructure/tools/.terraform.lock.hcl b/infrastructure/tools/.terraform.lock.hcl
diff --git a/infrastructure/tools/.tool-versions b/infrastructure/tools/.tool-versions
@@ -0,0 +1 @@
+opentofu 1.8.8
diff --git a/infrastructure/tools/github_repo.tf b/infrastructure/tools/github_repo.tf
@@ -0,0 +1,3 @@
+data "github_repository" "pycon" {
+  full_name = "pythonitalia/pycon"
+}
diff --git a/infrastructure/tools/github_runner_lambda.tf b/infrastructure/tools/github_runner_lambda.tf
@@ -0,0 +1,62 @@
+data "aws_iam_policy_document" "github_runner_assume_role" {
+  statement {
+    effect = "Allow"
+
+    principals {
+      type        = "Service"
+      identifiers = ["lambda.amazonaws.com"]
+    }
+
+    actions = ["sts:AssumeRole"]
+  }
+}
+
+resource "aws_iam_role" "github_runner_iam" {
+  name               = "github_runner_iam"
+  assume_role_policy = data.aws_iam_policy_document.github_runner_assume_role.json
+}
+
+resource "aws_iam_role_policy" "github_runner_lambda_policy" {
+  name = "github_runner_lambda_policy"
+  role = aws_iam_role.github_runner_iam.id
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Effect   = "Allow"
+        Action   = [
+          "logs:CreateLogGroup",
+          "logs:CreateLogStream",
+          "logs:PutLogEvents"
+        ]
+        Resource = "*"
+      }
+    ]
+  })
+}
+
+data "archive_file" "github_runner_webhook_artifact" {
+  type        = "zip"
+  source_file = "${path.root}/lambdas/github_runner_webhook.py"
+  output_path = "${path.root}/.archive_files/github_runner_webhook.zip"
+}
+
+resource "aws_lambda_function" "github_runner_webhook" {
+  function_name = "github_runner_webhook"
+  role          = aws_iam_role.github_runner_iam.arn
+  handler       = "github_runner_webhook.handler"
+  runtime = "python3.13"
+  filename         = data.archive_file.github_runner_webhook_artifact.output_path
+  source_code_hash = data.archive_file.github_runner_webhook_artifact.output_base64sha256
+  environment {
+    variables = {
+      WEBHOOK_SECRET = random_password.webhook_secret.result
+    }
+  }
+}
+
+resource "aws_lambda_function_url" "github_runner_webhook" {
+  function_name      = aws_lambda_function.github_runner_webhook.function_name
+  authorization_type = "NONE"
+}
diff --git a/infrastructure/tools/github_webhook.tf b/infrastructure/tools/github_webhook.tf
@@ -0,0 +1,17 @@
+resource "random_password" "webhook_secret" {
+  length           = 64
+  special          = true
+  override_special = "!#$%&*()-_=+[]{}<>:?"
+}
+
+resource "github_repository_webhook" "github_runner_notify" {
+  repository = data.github_repository.pycon.name
+  events = ["workflow_job"]
+  active = true
+
+  configuration {
+    url          = aws_lambda_function_url.github_runner_webhook.function_url
+    secret = random_password.webhook_secret.result
+    content_type = "json"
+  }
+}
diff --git a/infrastructure/tools/lambdas/github_runner_webhook.py b/infrastructure/tools/lambdas/github_runner_webhook.py
@@ -0,0 +1,71 @@
+import json
+import os
+import hashlib
+import hmac
+
+WEBHOOK_SECRET = os.environ["WEBHOOK_SECRET"]
+
+
+def handler(event, context):
+    body = event.get("body").encode("utf-8")
+
+    if not verify_signature(
+        body, WEBHOOK_SECRET, event["headers"]["x-hub-signature-256"]
+    ):
+        return {"statusCode": 401, "body": ""}
+
+    github_event = event["headers"]["x-github-event"]
+    body = json.loads(body)
+
+    match github_event:
+        case "workflow_job":
+            handle_workflow_job(body, context)
+        case _:
+            ...
+
+    return {"statusCode": 200, "body": ""}
+
+
+def handle_workflow_job(body, context):
+    action = body["action"]
+
+    if action != "queued":
+        return
+
+    workflow_job = body["workflow_job"]
+    workflow_name = workflow_job["workflow_name"]
+
+    if workflow_name != "Deploy":
+        return
+
+    labels = workflow_job["labels"]
+    if labels != ["self-hosted", "arm64-fargate"]:
+        return
+
+    print("Handling workflow job - start?")
+    print("Body:", body)
+    print("Context:", context)
+
+
+def verify_signature(payload_body, secret_token, signature_header):
+    """Verify that the payload was sent from GitHub by validating SHA256.
+
+    Raise and return 403 if not authorized.
+
+    Args:
+        payload_body: original request body to verify (request.body())
+        secret_token: GitHub app webhook token (WEBHOOK_SECRET)
+        signature_header: header received from GitHub (x-hub-signature-256)
+    """
+    if not signature_header:
+        return False
+
+    hash_object = hmac.new(
+        secret_token.encode("utf-8"), msg=payload_body, digestmod=hashlib.sha256
+    )
+    expected_signature = "sha256=" + hash_object.hexdigest()
+
+    if not hmac.compare_digest(expected_signature, signature_header):
+        return False
+
+    return True
diff --git a/infrastructure/tools/main.tf b/infrastructure/tools/main.tf
@@ -0,0 +1,26 @@
+terraform {
+  required_providers {
+    aws = {
+      source                = "hashicorp/aws"
+      version               = "5.82.2"
+    }
+    github = {
+      source  = "integrations/github"
+      version = "~> 6.0"
+    }
+  }
+
+  backend "s3" {
+    bucket = "xujw087uco-infrastructure-tools-opentofu"
+    key    = "opentofu.tfstate"
+    region = "eu-central-1"
+  }
+}
+
+provider "aws" {
+  region = "eu-central-1"
+}
+
+provider "github" {
+  owner = "pythonitalia"
+}
diff --git a/infrastructure/tools/runners-cluster.tf b/infrastructure/tools/runners-cluster.tf
@@ -0,0 +1,3 @@
+resource "aws_ecs_cluster" "cluster" {
+  name = "github-actions-runners"
+}

Original file line number	Diff line number	Diff line change
`@@ -87,3 +87,4 @@ RUN mkdir -p assets && .venv/bin/python manage.py collectstatic --noinput`
`87`	`87`
`88`	`88`	`ENTRYPOINT ["/home/app/.venv/bin/gunicorn"]`
`89`	`89`	`CMD [ "pycon.wsgi" ]`
	`90`	`+#test`
Original file line number	Diff line number	Diff line change
`@@ -63,3 +63,4 @@ And for the admin go to:`
`63`	`63`	`http://localhost:8000/admin`
`64`	`64`
`65`	`65`	`You should be able to login with the user we create a few moments ago.`
	`66`	`+#testchange`