如何通过GitHub Actions OIDC功能在GitHub Actions中使用无服务器框架

问题描述

我已经回答了这个问题How can I connect GitHub actions with AWS deployments without using a secret key?。

但是，我正在尝试更进一步，使用Serverless分发lambda函数。

到目前为止我已尝试的内容。

name: For Production

on:
  push:
    branches: [main]
jobs:
  build:
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read

    strategy:
      matrix:
        node-version: [16.x]
        # See supported Node.js release schedule at https://nodejs.org/en/about/releases/

    steps:
      - uses: actions/checkout@v2
      - name: Use Node.js ${{ matrix.node-version }}
        uses: actions/setup-node@v2
        with:
          node-version: ${{ matrix.node-version }}
          cache: 'npm'
          cache-dependency-path: ./backend-operations/package-lock.json
      - name: Create env file
        run: |
          touch ./backend-operations/.env
          echo JWKS_URI=${{secrets.JWKS_URI}} >> ./backend-operations/.env
          echo AUDIENCE=${{ secrets.AUDIENCE }} >> ./backend-operations/.env
          echo TOKEN_ISSUER=${{ secrets.TOKEN_ISSUER }} >> ./backend-operations/.env
      - run: npm ci
        working-directory: ./backend-operations
      - run: npm run build --if-present
        working-directory: ./backend-operations
      - run: npm test
        working-directory: ./backend-operations
      - name: Install Serverless Framework
        run: npm install -g serverless
      - name: Configure AWS
        run: |
          sleep 5 # Need to have a delay to acquire this
          export AWS_ROLE_ARN=arn:aws:iam::xxxxxxx:role/my-role
          export AWS_WEB_IDENTITY_TOKEN_FILE=/tmp/awscreds
          export AWS_DEFAULT_REGION=ap-southeast-1

          echo AWS_WEB_IDENTITY_TOKEN_FILE=$AWS_WEB_IDENTITY_TOKEN_FILE >> $GITHUB_ENV
          echo AWS_ROLE_ARN=$AWS_ROLE_ARN >> $GITHUB_ENV
          echo AWS_DEFAULT_REGION=$AWS_DEFAULT_REGION >> $GITHUB_ENV

          curl -H "Authorization: bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN"
            "$ACTIONS_ID_TOKEN_REQUEST_URL&audience=githubactions"
            | jq -r '.value' > $AWS_WEB_IDENTITY_TOKEN_FILE

          sls deploy --stage prod --verbose
        working-directory: './backend-operations'

      # - name: Deploy to AWS
      #   run: serverless deploy --stage prod --verbose
      #   working-directory: './backend-operations'
      - name: Upload coverage to Codecov
        uses: codecov/codecov-action@v1
        with:
          token: ${{secrets.CODECOV_SECRET_TOKEN}}

推荐答案

我使用aws-actions/configure-aws-credentialsGitHub操作解决了这个问题，因为它设置了临时访问键和环境ID。因此，从现在开始无需创建AWS Programmticv密钥。

注意：-GitHub OIDC的最新更新已更改其域名->；https://token.actions.githubusercontent.com

# This workflow will do a clean install of node dependencies, cache/restore them, build the source code and run tests across different versions of node
# For more information see: https://help.github.com/actions/language-and-framework-guides/using-nodejs-with-github-actions

name: Production-Deployment

on:
  push:
    branches: [main]
jobs:
  build:
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read

    strategy:
      matrix:
        node-version: [16.x]
        # See supported Node.js release schedule at https://nodejs.org/en/about/releases/

    steps:
      - uses: actions/checkout@v2
      - name: Use Node.js ${{ matrix.node-version }}
        uses: actions/setup-node@v2
        with:
          node-version: ${{ matrix.node-version }}
          cache: 'npm'
          cache-dependency-path: ./backend-operations/package-lock.json
      - name: Create env file
        run: |
          touch ./backend-operations/.env
          echo JWKS_URI=${{secrets.JWKS_URI}} >> ./backend-operations/.env
          echo AUDIENCE=${{ secrets.AUDIENCE }} >> ./backend-operations/.env
          echo TOKEN_ISSUER=${{ secrets.TOKEN_ISSUER }} >> ./backend-operations/.env
      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@master
        with:
          aws-region: ap-southeast-1
          role-to-assume: ${{secrets.ROLE_ARN}}
      - run: npm ci
        working-directory: ./backend-operations
      - run: npm run build --if-present
        working-directory: ./backend-operations
      - run: npm test
        working-directory: ./backend-operations
      - name: Install Serverless Framework
        run: npm install -g serverless
      - name: Serverless Authentication
        run: sls config credentials --provider aws --key ${{ env.AWS_ACCESS_KEY_ID }} --secret ${{ env.AWS_SECRET_ACCESS_KEY }}
      - name: Deploy to AWS
        run: serverless deploy --stage prod --verbose
        working-directory: './backend-operations'
      - name: Upload coverage to Codecov
        uses: codecov/codecov-action@v1
        with:
          token: ${{secrets.CODECOV_SECRET_TOKEN}}

这篇关于如何通过GitHub Actions OIDC功能在GitHub Actions中使用无服务器框架的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持！