ci: add CodeBuild workflow and administrators guide#63
Open
scottschreckengaust wants to merge 7 commits intomainfrom
Open
ci: add CodeBuild workflow and administrators guide#63scottschreckengaust wants to merge 7 commits intomainfrom
scottschreckengaust wants to merge 7 commits intomainfrom
Conversation
Signed-off-by: Scott Schreckengaust <345885+scottschreckengaust@users.noreply.github.com>
scottschreckengaust
force-pushed
the
feat/codebuild-hosted-runner-workflow
branch
from
cb95946 to
371b03a
Compare
Adds a workflow_dispatch-triggered GitHub Actions workflow that runs the full build on AWS CodeBuild via aws-actions/aws-codebuild-run-build (no webhooks). Authenticates via OIDC using aws-actions/configure-aws-credentials, gated by a protected "codebuild" GitHub environment requiring non-self-approval from the @awslabs/agent-plugins-admins team. Adds docs/ADMINISTRATORS_GUIDE.md with: - Copy-pasteable CloudFormation templates for the IAM OIDC role (step 2) and CodeBuild project with S3 artifact bucket (step 3) - GitHub CLI commands for environment setup with team-based reviewers - KMS decrypt permissions for SSE-encrypted SARIF artifacts - Troubleshooting table for common deployment issues Cross-references added to README.md, CONTRIBUTING.md, and MAINTAINERS_GUIDE.md. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
scottschreckengaust
force-pushed
the
feat/codebuild-hosted-runner-workflow
branch
from
371b03a to
b3d2a29
Compare
Signed-off-by: Scott Schreckengaust <345885+scottschreckengaust@users.noreply.github.com>
Add step 2 documenting how to create a fine-grained GitHub PAT with least-privilege permissions (Contents: Read-only) and import it into CodeBuild. Renumber subsequent steps (3-6) and update all cross-references. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Add custom parameter-overrides example and describe-stacks output command to step 3. Add gh secret set / gh variable set commands to step 6. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Add S3 bucket policy enforcing SSL-only access (W51 remediation) - Add cfn_nag suppression metadata with rationale (W11, W28, W32, W35, W84) - Add checkov skip comments with rationale (CKV_AWS_18, CKV_AWS_21, CKV_AWS_158) - Enable build badge on CodeBuild project - Set PrivilegedMode: false explicitly on build environment Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
workflow_dispatch-triggered GitHub Actions workflow (build-codebuild.yml) that runs the full build on AWS CodeBuild viaaws-actions/aws-codebuild-run-build(no webhooks)aws-actions/configure-aws-credentials, gated by a protectedcodebuildGitHub environment requiring non-self-approval from@awslabs/agent-plugins-adminsdocs/ADMINISTRATORS_GUIDE.mdwith:agent-plugins-adminsteam-based reviewersTest plan
workflow_dispatchand confirm approval gate blocks until a non-self reviewer approvesBy submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of the project license.