Hackpod Group 2: CI with ECR

[manishapriya94]

This team will be in charge of making sure the source code builds, a docker image gets generated, and uploaded to Amazon ECR.

Tasks

• [x] Configure AWS using OIDC, check out the action: aws-actions/configure-aws-credentials
• [x] Checkout Amplify Repo (we do this so that you can start to build the Amplify app from this repo)
• [x] Build the Amplify app
• [x] Create a docker image (Use this Dockerfile )
• [x] Upload to ECR

Bonus Points

• [ ] Lint the CloudFormation template (templates/), check out the action: scottbrenner/cfn-lint-action
• [ ] Perform static analysis against the CloudFormation template, check out the action: stelligent/cfn_nag@master
• [ ] Scan the docker image in ECR, check out the action: alexjurkiewicz/ecr-scan-image for inspiration
• [ ] Create build summary output from scans

Completed CI Workflow Example

[corycalahan]

For ease of reference, some references used during the session included:

• Starting point: https://github.com/ProgramEquity/amplify/issues/536
• GitHub - Variables
  • e.g. GitHub - Default Environment Variables for $GITHUB_ variable references
• GitHub - Using encrypted secrets in a workflow
• Docker - Dockerfile reference
• aws-actions/amazon-ecr-login for $ECR_ variable references within env:

Hurdle encountered:

• Collaboration permissions on a repository (where individuals were sent invites) to inspect items such as Variables and Secrets from https://github.com/ProgramEquity/amplify/issues/537 during Group 2's breakout session: Access permissions on GitHub

[SAUMILDHANKAR]

Hackpod Group 2: Meeting Notes

• Group 2 received Iam credentials from Group 1.
• Group 1 created a new repo: https://github.com/ProgramEquity/actions-hackpod-2023-04-19
• Group 2 member introductions.
  • Travis (leading the session)
  • Rachel (keeping track of time)
  • Saumil (taking notes)
• Group 2 issue to follow along with: https://github.com/ProgramEquity/amplify/issues/538
• For Group 2, we created a new branch hackpod-group2 in repo
• Travis added a commit to add a step in CI.yml file for adding AWS credentials.
  • Key points:
  • changed vars to secret for ROLE-TO-ASSUME with a dollar sign and added vars for AWS_REGION
  • ran the action and had an error: credentials could not be loaded
  • tried running workflow in main branch which was succesful.
  • fixed the error using main.yml by copying permissions, id-token and contents.
• Abir shared knowledge on various steps in CI.yml file for docker containerization of Amplify app which involves creating a VM instance.
  • Step to clone amplify repo
  • Step to login to ECR registry
  • Built a docker image of our repo and passed it to AWS ECR using this step
  • More specifically, docker build creates an image and docker push sends it to AWS ECR
  • Joey raised a question regarding $GitHub_workspace
  • $GitHub_workspace (a dynamic path) is like working directory for your github actions, try using run echo to see more
  • Cool tip: when you are watching a file in GitHub press . to open VS code in browser, another way to do it is change github.com in the url to gitHub.dev
• Travis added final commit and ran CI.yml workflow which was succesful.
• Checked ECR registry in AWS to see our repo image.
• Finally, the PR was approved.