OpenShit Oracle S3 Sync #153
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: OpenShit Oracle S3 Sync | |
| on: | |
| workflow_dispatch: | |
| schedule: | |
| - cron: '0 0 * * *' | |
| permissions: | |
| id-token: write # This is required for requesting the JWT | |
| contents: write # This is required for actions/checkout | |
| packages: write | |
| env: | |
| AWS_REGION: ca-central-1 | |
| jobs: | |
| sync-s3-credentials: | |
| runs-on: ubuntu-24.04 | |
| strategy: | |
| matrix: | |
| include: | |
| - short: dev | |
| env_name: openshift-dev | |
| - short: prod | |
| env_name: openshift-prod | |
| environment: ${{ matrix.env_name }} | |
| steps: | |
| - name: Configure AWS Credentials | |
| uses: aws-actions/configure-aws-credentials@v4 | |
| with: | |
| role-to-assume: ${{ secrets.AWS_DEPLOY_ROLE_ARN }} | |
| role-session-name: openshift-oracle-s3-sync | |
| aws-region: ${{ env.AWS_REGION }} | |
| - name: Read S3 Credentials | |
| id: read-s3-credentials | |
| shell: bash | |
| run: | | |
| AWS_CREDENTIALS=$(aws ssm get-parameter \ | |
| --name "/iam_users/node-api-${{ matrix.short }}-fta-rec-s3-upload-service-account_keys" \ | |
| --with-decryption \ | |
| --query "Parameter.Value" \ | |
| --output text) | |
| # Extract and mask credentials | |
| ACCESS_KEY=$(echo $AWS_CREDENTIALS | jq -r '.current.AccessKeyID') | |
| SECRET_KEY=$(echo $AWS_CREDENTIALS | jq -r '.current.SecretAccessKey') | |
| echo "AWS_ACCESS_KEY_ID=$ACCESS_KEY" >> $GITHUB_ENV | |
| echo "AWS_SECRET_ACCESS_KEY=$SECRET_KEY" >> $GITHUB_ENV | |
| - name: Update OpenShift Secret for ${{ matrix.environment }} | |
| uses: bcgov/[email protected] | |
| env: | |
| DB_PASSWORD: ${{ secrets.dbPassword }} # handle special characters. | |
| with: | |
| oc_namespace: ${{ secrets.oc_namespace }} | |
| oc_token: ${{ secrets.oc_token }} | |
| oc_server: ${{ vars.oc_server }} | |
| commands: | | |
| oc delete secret aws-secrets || true | |
| oc create secret generic aws-secrets \ | |
| --from-literal=AWS_ACCESS_KEY="${{ env.AWS_ACCESS_KEY_ID }}" \ | |
| --from-literal=AWS_SECRET_KEY="${{ env.AWS_SECRET_ACCESS_KEY }}" |