Add GitHub CI AWS bootstrap stack#60
Conversation
Qodo reviews are paused for this user.Troubleshooting steps vary by plan Learn more → On a Teams plan? Using GitHub Enterprise Server, GitLab Self-Managed, or Bitbucket Data Center? |
📝 WalkthroughWalkthroughThis PR implements Issue ChangesGitHub CI Bootstrap Stack
Estimated code review effort🎯 4 (Complex) | ⏱️ ~60 minutes Possibly related issues
Possibly related PRs
Suggested labels
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
1 new issue
|
![qltysh[bot]](https://avatars.githubusercontent.com/in/890766?s=60&v=4){kind=small}
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
2 issues found across 15 files
Confidence score: 2/5
- There is a concrete high-impact dependency gap in
pulumi/github-ci-bootstrap/requirements.txt:pulumi_awsis required via theinframodule but not installed, which is likely to cause bootstrap/runtime failures. docs/github-ci-bootstrap-stack.mdincludes a shell expansion timing issue where${PULUMI_BACKEND_URL}will not use the inline temporary assignment, so documented setup commands may fail for users following the guide.- Given the high severity/high confidence of the missing package issue (8/10, 8/10), this looks risky to merge until corrected.
- Pay close attention to
pulumi/github-ci-bootstrap/requirements.txtanddocs/github-ci-bootstrap-stack.md- dependency installation and backend login command behavior need validation.
Architecture diagram
sequenceDiagram
participant Admin as Admin (local CLI)
participant Pulumi as Pulumi CLI (github-ci-bootstrap)
participant AWS as AWS Account
participant OIDC as GitHub OIDC Provider
participant SM as Secrets Manager
participant IAM as IAM Roles
Note over Admin,IAM: NEW: One-time bootstrap flow (no Pulumi Cloud/ESC)
Admin->>Pulumi: pulumi up (admin AWS profile)
Pulumi->>AWS: aws sts get-caller-identity (verify account)
AWS-->>Pulumi: Account 891377212104 (test) / 933245420672 (prod)
Pulumi->>OIDC: Create/Adopt OIDC provider for token.actions.githubusercontent.com
OIDC-->>Pulumi: OIDC provider ARN
Pulumi->>SM: Create secret containers (/bootstrap-infrastructure/ci/{suffix})
SM-->>Pulumi: Secret ARN/ID
alt writeSecretValues enabled (default)
Pulumi->>SM: Write encrypted CI JSON payloads (role ARNs, backend URL, etc.)
SM-->>Pulumi: Secret version ID
else writeSecretValues disabled
Note over Pulumi,SM: Manual put-secret-value later
end
Pulumi->>IAM: Create GitHubCiConfigRead-{suffix} role (trust: OIDC + repo subject + workflow)
Pulumi->>IAM: Create GitHubCiPreview-{env} role (read-only, no Secrets Manager Get)
Pulumi->>IAM: Create GitHubCiApply-{env} role (mutation, no AdministratorAccess)
Pulumi->>IAM: Create GitHubCiDrift-{env} role (same as preview)
alt environment == "test"
Pulumi->>IAM: Create OperationsAlertTriage-{env} role (SQS only)
IAM-->>Pulumi: Operations alert triage role ARN
end
IAM-->>Pulumi: All role ARNs
Pulumi-->>Admin: Stack outputs (githubVariables, role ARNs, secret IDs)
Note over Admin,Pulumi: Post-apply: capture and set GitHub variables
Admin->>Admin: Set GitHub repo variables from githubVariables output
Note over Admin,IAM: Normal CI usage (separate flow)
participant GH as GitHub Actions (later)
GH->>OIDC: Request token with job_workflow_ref + repo subject
OIDC-->>GH: JWT (aud: sts.amazonaws.com)
GH->>IAM: Assume GitHubCiConfigRead-{suffix} role
alt subject matches + workflow ref matches
IAM-->>GH: Temp credentials (read secret only)
GH->>SM: GetSecretValue (CI config payload)
SM-->>GH: JSON with deployment role ARNs
GH->>IAM: Assume GitHubCiPreview/Apply/Drift-{env} role
alt subject matches + workflow ref matches
IAM-->>GH: Temp credentials (scoped permissions)
else mismatch
IAM-->>GH: Access denied
end
else mismatch
IAM-->>GH: Access denied
end
Reply with feedback, questions, or to request a fix.
Re-trigger cubic
dmytrocraft
force-pushed
the
codex/issue59-github-ci-bootstrap-stack
branch
2 times, most recently
from
c07aa14 to
ceac5f8
Compare
dmytrocraft
force-pushed
the
codex/issue59-github-ci-bootstrap-stack
branch
from
ceac5f8 to
157ff21
Compare
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
|
@coderabbitai review |
✅ Actions performedReview triggered.
|
dmytrocraft
force-pushed
the
codex/issue59-github-ci-bootstrap-stack
branch
from
157ff21 to
7b0e7e8
Compare
|
@coderabbitai review |
✅ Actions performedReview triggered.
|
|
Status update for Issue 59 bootstrap PR:
Current head: CI status: all repo-fixable checks are green. The only failing checks are |
There was a problem hiding this comment.
1 issue found across 5 files (changes from recent commits).
Tip: Review your code locally with the cubic CLI to iterate faster.
Re-trigger cubic
There was a problem hiding this comment.
0 issues found across 3 files (changes from recent commits).
Requires human review: Auto-approval blocked by 1 unresolved issue from previous reviews.
Re-trigger cubic
There was a problem hiding this comment.
1 issue found across 2 files (changes from recent commits).
Tip: Review your code locally with the cubic CLI to iterate faster.
Re-trigger cubic
There was a problem hiding this comment.
1 issue found across 1 file (changes from recent commits).
Tip: Review your code locally with the cubic CLI to iterate faster.
Re-trigger cubic
|
You're iterating quickly on this pull request. To help protect your rate limits, cubic has paused automatic reviews on new pushes for now—when you're ready for another review, comment |
2 participants
Pull Request
Description
Adds a separate one-time Pulumi project at
pulumi/github-ci-bootstrapfor bootstrapping AWS-only GitHub CI access without Pulumi Cloud or Pulumi ESC.The stack creates/adopts the GitHub OIDC provider, fixed AWS Secrets Manager CI config containers, one config-read role per CI suffix, dedicated preview/apply/drift roles, and the test-account operations alert triage role. By default it writes the non-static-credential CI JSON payloads into Secrets Manager as encrypted Pulumi secret values.
Related Issue
Closes #59. Stacked on #57 because it reuses the AWS Secrets Manager CI loader and config components introduced there.
Motivation and Context
PR #57 is blocked because the GitHub Actions OIDC roles and CI config secrets do not exist in AWS yet. This PR provides the isolated admin-once bootstrap path so the normal CI roles can stay least-privilege instead of giving GitHub AdministratorAccess.
How Has This Been Tested?
uv run pytest tests/unit/test_components.py -quv run pytest tests/pulumi/test_project_structure.py tests/pulumi/test_delivery_contracts.py -quv run ruff check pulumi/infra/ci_bootstrap.py pulumi/infra/ci_config.py pulumi/github-ci-bootstrap/__main__.py tests/unit/test_components.py tests/pulumi/test_project_structure.py tests/pulumi/test_delivery_contracts.pyuv run ruff format --check pulumi/infra/ci_bootstrap.py pulumi/infra/ci_config.py pulumi/github-ci-bootstrap/__main__.py tests/unit/test_components.py tests/pulumi/test_project_structure.py tests/pulumi/test_delivery_contracts.pyuv run ty check pulumi/github-ci-bootstrap/__main__.pymake test-yamlmake test-actionlintmake test-secretsgit diff --checkScreenshots (if appropriate)
N/A
Types of changes
Checklist
Summary by cubic
Adds a standalone Pulumi project at
pulumi/github-ci-bootstrapto bootstrap AWS-only GitHub CI without Pulumi Cloud/ESC and routes PR deployment commands to that project. Tightens GitHub OIDC trust to the repository subject plus allowed workflow names and refreshes Well‑Architected evidence.New Features
GitHubCiPreview-*,GitHubCiApply-*,GitHubCiDrift-*, and testOperationsAlertTriage-*; writes CI JSON payloads by default (togglegithub-ci-bootstrap:writeSecretValues); optional Pulumi backend/secrets provider; resource protection/import viagithub-ci-bootstrap:protectResources;CiConfigurationnow takesCiConfigurationArgsand exports created secrets.workflowclaim, with an explicit workflow-ref allowlist fallback; includesenvironment:testtrust; validates managed policy sizes; policy pack allowlists bootstrap/test wildcard IAM managed policies.pulumi/github-ci-bootstrapviaPULUMI_DIRwith safe path validation; Pulumi plan manifest paths must stay under the repo; non‑prod decrypt/lock fallback retries a guarded direct apply without policy checks; rotates AWS CI config payloads; relaxes self-check merge-state; AWS docs verifier sends request headers; env validator checksPULUMI_DIR; Dockerfile verifies Pulumi/AWS CLIs andpulumi_aws; addspulumi-aws>=7,<8.Migration
testandprodwith admin AWS profiles:pulumi -C pulumi/github-ci-bootstrap up --stack <stack>.githubVariables; verify role ARNs, secret IDs, and secret version IDs.aws secretsmanager put-secret-value.Written for commit 5dfcc08. Summary will update on new commits.
Summary by CodeRabbit
Release Notes
New Features
Documentation
Chores