Repository: cdklabs/cdk-pipelines-github
Pull request #868 (2024-02-06 08:05:53)

fix: make existingGitHubActionsProvider aware of AWS partitions
Replace hard coded 'aws' partition with a reference to the `AWS::Partition` in the current stack. This makes `GitHubActionRole` work for e.g. `aws-cn` too.

There are more work that needs to be done to get full aws-cn support (see #820), but this is a general fix and so could be merged independently.

kaizencc: Looks like the build is failing + some additional context.

I _think_ this is okay because the OIDC provider construct is meant to be deployed with traditional `cdk deploy`. However, the CDK stacks that are deployed via the pipeline do not get the traditional treatment. Instead, we are currently resolving a few magic strings:

https://github.com/cdklabs/cdk-pipelines-github/blob/6a913cd66b37f1f502e0ce78d016680b168782be/src/pipeline.ts#L604-L610

One of which is a hardcoded partition. Again, I think the changes here is fine, but it might be worth a full deploy just to check.
mbergkvist: I got the following error messages from the failing build

> Files were changed during build (see build log). If this was triggered from a fork, you will need to update your branch.

I've rebased the branch to the main branch, can we see if this makes the GH action pass?
kaizencc: Hi @mbergkvist I believe the remedy here is for you to run `yarn build` locally and push the result
mbergkvist: @kaizencc I get the following error now when building locally

> [2024-02-09T06:49:00.369] [ERROR] jsii/package-info - Unable to find a JSII dependency named "aws-cdk-lib" as "^2.80.0". If you meant to include a non-JSII dependency, try adding it to bundledDependencies instead.

I'm following the steps in the pipeline

```shell
yarn install --check-files
npx projen build
```

Also trying `yarn build`, but I get the same error regardless. Not sure what I'm missing here? 🤷 
kaizencc: A couple of things @mbergkvist 

- this means that your aws-cdk-lib file is older than 2.80.0. you need to run `yarn install` or `npx projen` to update.
- i would do this for you but you've cut a PR from a org-level repository `mbsoftworks` so I do not have permissions. next time, I'd appreciate it if you contribute via your personal fork.
- what you're missing is a one line `API.md` update. If you'd like, I can open the same PR with the correct file diff, but then you wouldn't get direct credit for the PR. up to you though.
mbergkvist: @kaizencc I did `yarn install` and `npx projen build` but it was still failing. But something must've been broken locally, I did a clean checkout of the repo and now the build works as expected 🤷‍♂️ 

The PR is updated with the changes in `API.md`.

Thanks for your support and patience!

Patch:
diff --git a/API.md b/API.md
index 64d61fa..5240d66 100644
--- a/API.md
+++ b/API.md
@@ -743,7 +743,7 @@ You can do this manually in the console, or create a separate stack that uses th
 You must `cdk deploy` once (with your normal AWS credentials) to have this role created for you.
 
 You can then make note of the role arn in the stack output and send it into the Github Workflow app via
-the `gitHubActionRoleArn` property. The role arn will be `arn:aws:iam::<accountId>:role/GithubActionRole`.
+the `gitHubActionRoleArn` property. The role arn will be `arn:<partition>:iam::<accountId>:role/GithubActionRole`.
 
 > [https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-amazon-web-services](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-amazon-web-services)
 
diff --git a/src/oidc-provider.ts b/src/oidc-provider.ts
index fc3c4b5..c253b20 100644
--- a/src/oidc-provider.ts
+++ b/src/oidc-provider.ts
@@ -77,7 +77,7 @@ export interface GitHubActionRoleProps {
  * You must `cdk deploy` once (with your normal AWS credentials) to have this role created for you.
  *
  * You can then make note of the role arn in the stack output and send it into the Github Workflow app via
- * the `gitHubActionRoleArn` property. The role arn will be `arn:aws:iam::<accountId>:role/GithubActionRole`.
+ * the `gitHubActionRoleArn` property. The role arn will be `arn:<partition>:iam::<accountId>:role/GithubActionRole`.
  *
  * @see https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-amazon-web-services
  */
@@ -91,7 +91,7 @@ export class GitHubActionRole extends Construct {
     return iam.OpenIdConnectProvider.fromOpenIdConnectProviderArn(
       scope,
       'GitHubActionProvider',
-      `arn:aws:iam::${Aws.ACCOUNT_ID}:oidc-provider/token.actions.githubusercontent.com`,
+      `arn:${Aws.PARTITION}:iam::${Aws.ACCOUNT_ID}:oidc-provider/token.actions.githubusercontent.com`,
     );
   }
 
@@ -174,4 +174,4 @@ function formatRepos(repos: string[]) {
     formattedRepos.push(`repo:${repo}:*`);
   }
   return formattedRepos;
-}
\ No newline at end of file
+}


Test patch:
diff --git a/test/oidc-provider.test.ts b/test/oidc-provider.test.ts
index 297cf3e..56ea204 100644
--- a/test/oidc-provider.test.ts
+++ b/test/oidc-provider.test.ts
@@ -119,7 +119,11 @@ describe('GithubActionRole construct', () => {
                 'Fn::Join': [
                   '',
                   [
-                    'arn:aws:iam::',
+                    'arn:',
+                    {
+                      Ref: 'AWS::Partition',
+                    },
+                    ':iam::',
                     {
                       Ref: 'AWS::AccountId',
                     },