From d45fb479f70ff9f23664c297533a38c356d8e13e Mon Sep 17 00:00:00 2001 From: Eoghan Kennedy Date: Thu, 27 Aug 2026 16:17:19 +0100 Subject: [PATCH] Fix production website deployment target --- .github-env-master | 5 ++--- .github-env-test | 3 --- .github/workflows/push.yml | 17 +++++++++-------- .github/workflows/test.yml | 21 +-------------------- README.md | 6 +++--- tools/upload-to-s3-root.sh | 5 +++-- 6 files changed, 18 insertions(+), 39 deletions(-) diff --git a/.github-env-master b/.github-env-master index 49a79f0..b0744bd 100644 --- a/.github-env-master +++ b/.github-env-master @@ -1,5 +1,4 @@ -AWS_STATIC_SITE_URL=production-mlplatform-org -CF_DIST_ID_STATIC_LO=E2U7UQCLK7G1EJ -CLOUDFRONT_ADD_SECURITY_HEADERS_ARN=arn:aws:lambda:us-east-1:841045539419:function:cloudfront-add-security-headers:1 +AWS_STATIC_SITE_URL=mlplatform-org-prod-site +CF_DIST_ID_STATIC_LO=E2QIA4CS9AW6Z5 JEKYLL_ENV=production SITE_URL=production.mlplatform.org diff --git a/.github-env-test b/.github-env-test index 6a0b817..898da12 100644 --- a/.github-env-test +++ b/.github-env-test @@ -1,5 +1,2 @@ -AWS_STATIC_SITE_URL=mlplatform-org-prod-site -CF_DIST_ID_STATIC_LO=E2QIA4CS9AW6Z5 -CLOUDFRONT_ADD_SECURITY_HEADERS_ARN=arn:aws:lambda:us-east-1:841045539419:function:cloudfront-add-security-headers:1 JEKYLL_ENV=production SITE_URL=www.mlplatform-prev.org diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index 6c52d10..daf658b 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -29,8 +29,8 @@ jobs: - name: Configure AWS credentials uses: aws-actions/configure-aws-credentials@v4 with: - role-to-assume: arn:aws:iam::841045539419:role/github-actions-oidc-role - aws-region: us-east-1 + role-to-assume: arn:aws:iam::544678973306:role/Proj-github-actions-oidc-role + aws-region: eu-west-1 - name: Initialise environment run: | @@ -56,11 +56,12 @@ jobs: - name: Upload to S3 run: ./tools/upload-to-s3-root.sh - - name: Set up Lambda redirect - run: ./tools/set-up-lambda-redirect.sh ${{ github.workspace }}/website - - - name: Set up security headers - run: pipenv run python ./tools/lambda-security-headers.py - - name: Invalidate CloudFront cache run: ./tools/invalidate-cloudfront.sh + + - name: Verify deployed TOSA index + run: | + curl --fail --silent --show-error --location \ + "https://${SITE_URL}/tosa/tosa_spec.html" \ + --output /tmp/live-tosa-spec.html + cmp "${SITE_URL}/tosa/tosa_spec.html" /tmp/live-tosa-spec.html diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 9036789..eff8d43 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -1,10 +1,9 @@ -name: TestDeployment +name: TestBuild on: workflow_dispatch: permissions: - id-token: write # Required to request the OIDC token contents: read # Required to check out the code # Cancel in-progress jobs or runs for the current workflow @@ -24,12 +23,6 @@ jobs: with: path: website - - name: Configure AWS credentials - uses: aws-actions/configure-aws-credentials@v4 - with: - role-to-assume: arn:aws:iam::544678973306:role/Proj-github-actions-oidc-role - aws-region: eu-west-1 - - name: Initialise environment run: | cat ".github-env-test" >> $GITHUB_ENV @@ -50,15 +43,3 @@ jobs: # - name: Check routing rules # run: pipenv run ./tools/test-routing-rules.sh - - - name: Upload to S3 - run: ./tools/upload-to-s3-root.sh - - # - name: Set up Lambda redirect - # run: ./tools/set-up-lambda-redirect.sh ${{ github.workspace }}/website - - # - name: Set up security headers - # run: pipenv run python ./tools/lambda-security-headers.py - - - name: Invalidate CloudFront cache - run: ./tools/invalidate-cloudfront.sh diff --git a/README.md b/README.md index 4e5d989..4a9c8ec 100644 --- a/README.md +++ b/README.md @@ -75,13 +75,13 @@ For the Audience, select sts.amazonaws.com. Click Next. -Attach Permissions: On the "Add permissions" page, search for and add the policies your workflow needs (e.g., AmazonS3FullAccess, AmazonEC2FullAccess). Note that AdministratorAccess is permissible but may be too broad. +Attach a dedicated least-privilege policy for this deployment. The workflow needs permission to list the production bucket and to get, put, and delete objects in it. It also needs permission to create and read invalidations for the production CloudFront distribution. It does not need EC2 or administrator access. -Security Best Practice: Always follow the principle of least privilege. It's better to create a custom policy with only the exact permissions your workflow needs, rather than using broad "FullAccess" policies. +Restrict the role's OIDC trust policy to this repository and the `master` branch using the GitHub token subject `repo:MLPlatformWebsite/website:ref:refs/heads/master`. Do not grant every repository in the organisation access to the deployment role. Click Next. -Name your role: github-actions-oidc-role. +Give the role a deployment-specific name. Review and Create: Review the details and click Create role. diff --git a/tools/upload-to-s3-root.sh b/tools/upload-to-s3-root.sh index c8ea1cb..5d30bdf 100755 --- a/tools/upload-to-s3-root.sh +++ b/tools/upload-to-s3-root.sh @@ -7,9 +7,10 @@ ls -l "$GITHUB_WORKSPACE/website/$SITE_URL" cd "$GITHUB_WORKSPACE/website/$SITE_URL" || exit 1 # Sync HTML files with different cache settings. Using "no-cache" does *NOT* mean that the file is not # cached - it just forces the browser to do a quick check upstream to make sure that the page is valid. -aws s3 sync --exclude "*" --include "*.html" --cache-control "no-cache, max-age=86400" ./ "s3://$AWS_STATIC_SITE_URL" --delete --no-progress | tee "/tmp/$GITHUB_SHA.tmp" +# Preserve incident backups because they are operational recovery data, not generated site content. +aws s3 sync --exclude "*" --include "*.html" --exclude "incident-backup/*" --cache-control "no-cache, max-age=86400" ./ "s3://$AWS_STATIC_SITE_URL" --delete --no-progress | tee "/tmp/$GITHUB_SHA.tmp" # Sync non-HTML files with "normal" cache settings. -aws s3 sync --include "*" --exclude "*.html" --cache-control "public, max-age=86400" ./ "s3://$AWS_STATIC_SITE_URL" --delete --no-progress | tee -a "/tmp/$GITHUB_SHA.tmp" +aws s3 sync --include "*" --exclude "*.html" --exclude "incident-backup/*" --cache-control "public, max-age=86400" ./ "s3://$AWS_STATIC_SITE_URL" --delete --no-progress | tee -a "/tmp/$GITHUB_SHA.tmp" # Run the metadata script to keep the search service happy about modification dates # for blogs and news. cd $DIR