search

AlexsLemonade / scpca-portal

Single-cell Pediatric Cancer Atlas Portal is a growing database of uniformly processed single-cell data from pediatric cancer tumors and model systems
https://scpca.alexslemonade.org
BSD 3-Clause "New" or "Revised" License
3 stars 0 forks source link

Address terraform and aws version incompatibility in GHA #964

Open avrohomgottlieb opened 4 days ago

avrohomgottlieb commented 4 days ago

Context

PR https://github.com/AlexsLemonade/scpca-portal/pull/953 merged feature/batch into dev. The changes made in feature/batch included adding new Batch infrastructure as well as adding management commands to submit jobs to Batch. In order to accommodate one of the arguments in one of the Batch resources, we had to update the aws_version in terraform to 5.12.0. The version of terraform that we currently use is 0.12.26.

Problem or idea

While there shouldn't be a problem using aws_version 5.12.0 with terraform version 0.12.26, we encountered an error when the GHA runner attempted to deploy a staging stack. See failed Github Action.

The GHA warning which led to the failure was as follows:

[!WARNING]
Warning: registry.terraform.io: This version of Terraform has an outdated GPG key and is unable to verify new provider releases. Please upgrade Terraform to at least 0.12.31 to receive new provider updates. For details see: https://discuss.hashicorp.com/t/hcsec-2021-12-codecov-security-event-and-hashicorp-gpg-key-exposure/23512

The reason why this error didn't surface before now is because GHA only spins up a terraform instance and makes deploys on merges to dev and main. While my local version of terraform that I installed through homebrew is a newer one (I wasn't able to install 0.12.x on homebrew because it's too old), the documentation that I relied on said that coupling terraform 0.12.x with aws version 5.12.0 shouldn't be a problem. This being said, but it looks like there's a GHA component that I didn't anticipate (the GPG key?) that could be the cause of the error.

Solution or next step

It seems like the clearest way forward would be to upgrade the terraform version. We could either do this as a short term patch, like upgrading to 0.12.31 (as mentioned in the GHA warning), or to go for something more modern (the current version is 1.9.8).

avrohomgottlieb commented 6 hours ago

This issue was closed automatically when a PR linked to it was closed, but we're still investigating the problem.