nr-rec-resources/.github/workflows/openshift-oracle-s3-sync.yml at main · bcgov/nr-rec-resources · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
name: OpenShit Oracle S3 Sync

on:
  workflow_dispatch:
  schedule:
    - cron: '0 0 * * *'

permissions:
  id-token: write # This is required for requesting the JWT
  contents: write # This is required for actions/checkout
  packages: write

env:
  AWS_REGION: ca-central-1

jobs:
  sync-s3-credentials:
    runs-on: ubuntu-24.04
    strategy:
      matrix:
        include:
          - short: dev
            env_name: openshift-dev
          - short: prod
            env_name: openshift-prod
    environment: ${{ matrix.env_name }}
    steps:
      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v5
        with:
            role-to-assume: ${{ secrets.AWS_LZA_DEPLOY_ROLE_ARN }}
            role-session-name: openshift-oracle-s3-sync
            aws-region: ${{ env.AWS_REGION }}

      - name: Read S3 Credentials
        id: read-s3-credentials
        shell: bash
        run: |
            AWS_CREDENTIALS=$(aws ssm get-parameter \
            --name "/iam_users/node-api-${{ matrix.short }}-fta-rec-s3-upload-service-account_keys" \
            --with-decryption \
            --query "Parameter.Value" \
            --output text)
            # Extract and mask credentials
            ACCESS_KEY=$(echo $AWS_CREDENTIALS | jq -r '.current.AccessKeyID')
            SECRET_KEY=$(echo $AWS_CREDENTIALS | jq -r '.current.SecretAccessKey')
            echo "AWS_ACCESS_KEY_ID=$ACCESS_KEY" >> $GITHUB_ENV
            echo "AWS_SECRET_ACCESS_KEY=$SECRET_KEY" >> $GITHUB_ENV

      - name: Update OpenShift Secret for ${{ matrix.environment }}
        uses: bcgov/action-oc-runner@v1.3.0
        env:
          DB_PASSWORD: ${{ secrets.dbPassword }} # handle special characters.
        with:
          oc_namespace: ${{ secrets.oc_namespace }}
          oc_token: ${{ secrets.oc_token }}
          oc_server: ${{ vars.oc_server }}
          commands: |
            oc delete secret aws-secrets || true
            oc create secret generic aws-secrets \
              --from-literal=AWS_ACCESS_KEY="${{ env.AWS_ACCESS_KEY_ID }}" \
              --from-literal=AWS_SECRET_KEY="${{ env.AWS_SECRET_ACCESS_KEY }}"