Develop

.ci/Dockerfile

@@ -1,5 +1,5 @@
 #syntax=docker/dockerfile:1.2
-FROM node:14 as build
+FROM node:16 as build
 WORKDIR /lambda
 RUN apt-get update \
         && apt-get install -y zip \

.editorconfig

@@ -1,2 +1,13 @@
+# EditorConfig is awesome: https://EditorConfig.org
+
+# top-most EditorConfig file
+root = true
+
 [*]
+indent_style = space
+indent_size = 2
+tab_width = 2
 end_of_line = lf
+charset = utf-8
+trim_trailing_whitespace = true
+insert_final_newline = true

.github/dependabot.yml

@@ -26,8 +26,3 @@ updates:
     directory: "/modules/runners/lambdas/runners"
     schedule:
       interval: "weekly"
-
-  - package-ecosystem: "npm"
-    directory: "/.release"
-    schedule:
-      interval: "weekly"

.github/workflows/auto-approve-dependabot.yml

@@ -14,6 +14,6 @@ jobs:
     if: github.actor == 'dependabot[bot]' || github.actor == 'dependabot-preview[bot]'
     runs-on: ubuntu-latest
     steps:
-      - uses: hmarr/auto-approve-action@v2.2.1
+      - uses: hmarr/auto-approve-action@v3.1.0
         with:
           github-token: "${{ secrets.GITHUB_TOKEN }}"

.github/workflows/lambda-runner-binaries-syncer.yml

@@ -2,7 +2,7 @@ name: Lambda Syncer
 on:
   push:
     branches:
-      - develop
+      - main
   pull_request:
     paths:
       - .github/workflows/lambda-runner-binaries-syncer.yml
@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        node: [14, 16]
+        node: [16]
     container:
       image: node:${{ matrix.node }}
     defaults:

.github/workflows/lambda-runners.yml

@@ -2,7 +2,7 @@ name: Lambda Runners
 on:
   push:
     branches:
-      - develop
+      - main
   pull_request:
     paths:
       - .github/workflows/lambda-runners.yml
@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        node: [14, 16]
+        node: [16]
     container:
       image: node:${{ matrix.node }}
     defaults:

.github/workflows/lambda-webhook.yml

@@ -2,7 +2,7 @@ name: Lambda Webhook
 on:
   push:
     branches:
-      - develop
+      - main
   pull_request:
     paths:
       - .github/workflows/lambda-webhook.yml
@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        node: [14, 16]
+        node: [16]
     container:
       image: node:${{ matrix.node }}
     defaults:

.github/workflows/packer-build.yml

@@ -3,19 +3,18 @@ on:
   push:
     branches:
       - main
-      - develop
   pull_request:
     paths:
       - "images/**"
       - ".github/workflows/packer-build.yml"
       - "module/runners/templates/**"
 
-env:  
+env:
   AWS_REGION: eu-west-1
 
 jobs:
   verify_packer:
-    name: Verify packer    
+    name: Verify packer
     runs-on: ubuntu-latest
     container:
       image: hashicorp/packer:1.7.8
@@ -28,12 +27,12 @@ jobs:
     steps:
       - name: "Checkout"
         uses: actions/checkout@v3
-      
+
       - name: packer init
         run: packer init .
 
       - name: check packer formatting
-        run: packer fmt -recursive -check=true .        
+        run: packer fmt -recursive -check=true .
 
       - name: packer validate
         run: packer validate .

.github/workflows/release.yml

@@ -4,23 +4,25 @@ on:
   push:
     branches:
       - main
-      - develop
-  workflow_dispatch:
+      - v1
 
 jobs:
   prepare:
     name: Create dist
     runs-on: ubuntu-latest
-    container: node:14
+    container: node:16
     strategy:
       matrix:
         lambda: ["modules/webhook/lambdas/webhook", "modules/runner-binaries-syncer/lambdas/runner-binaries-syncer", "modules/runners/lambdas/runners"]
+    permissions:
+      contents: read
+      actions: write
     steps:
       - name: Extract lambda name
         id: lambda
         env:
           LAMBDA: ${{ matrix.lambda }}
-        run: echo ::set-output name=name::${LAMBDA##*/}
+        run: echo "name=${LAMBDA##*/}" >> $GITHUB_OUTPUT
       - uses: actions/checkout@v3
       - name: Add zip
         run: apt update && apt install zip
@@ -38,65 +40,52 @@ jobs:
     runs-on: ubuntu-latest
     needs:
       prepare
+    outputs:
+      releases_created: ${{ steps.release.outputs.releases_created }}
+      tag_name: ${{ steps.release.outputs.tag_name }}
     steps:
-      - uses: actions/checkout@v3
-        with:
-          fetch-depth: 0
-          persist-credentials: false
-      - uses: actions/download-artifact@v3
-        with:
-          name: webhook
-          path: artifacts
-      - uses: actions/download-artifact@v3
-        with:
-          name: runners
-          path: artifacts
-      - uses: actions/download-artifact@v3
-        with:
-          name: runner-binaries-syncer
-          path: artifacts
-
       - name: Get installation token
-        uses: npalm/action-app-token@v1.0.0
-        id: app-token
+        uses: philips-software/app-token-action@v1.1.2
+        id: token
         with:
-          appId: ${{ secrets.FOREST_RELEASER_APP_ID }}
-          appPrivateKeyBase64: ${{ secrets.FOREST_RELEASER_APP_PRIVATE_KEY_BASE64 }}
-          appInstallationType: repo
-          appInstallationValue: ${{ github.repository }}
+          app_id: ${{ secrets.FOREST_RELEASER_APP_ID }}
+          app_base64_private_key: ${{ secrets.FOREST_RELEASER_APP_PRIVATE_KEY_BASE64 }}
+          auth_type: installation
 
-      - name: Dry run release
-        if: github.event_name != 'pull_request'
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # Read only token
-        run: |
-          cp .release/* .
-          yarn
-          yarn release -d --repositoryUrl https://x-access-token:[email protected]/$GITHUB_REPOSITORY.git
+
+      - name: Extract branch name
+        id: branch
+        shell: bash
+        run: echo "name=${GITHUB_REF#refs/heads/}" >> $GITHUB_OUTPUT
 
       - name: Release
-        if: github.event_name != 'pull_request' && contains('refs/heads/main', github.ref)
-        env:
-          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
-        run: |
-          cp .release/* .
-          yarn
-          yarn release --repositoryUrl https://x-access-token:[email protected]/$GITHUB_REPOSITORY.git
-
-  provenance:
-    name: Generate provenance
-    runs-on: ubuntu-20.04
-    needs: 
-      release
-    if: startsWith(github.ref, 'refs/tags/')
+        id: release
+        uses: google-github-actions/release-please-action@5c07f8be172b1f6e90f9c35baf8184461b91b85f # ratchet:google-github-actions/release-please-action@v3
+        with:
+          default-branch: ${{ steps.branch.outputs.name }}
+          release-type: terraform-module
+          token: ${{ steps.token.outputs.token }}
+
+  assets:
+    name: upload assets
+    if: ${{ needs.release.outputs.releases_created }}
+    needs: release
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        asset: ["webhook", "runner-binaries-syncer", "runners"]
+    permissions:
+      contents: write
+      actions: read
 
     steps:
-      - name: Generate provenance for release
-        uses: philips-labs/[email protected]
+      - uses: actions/checkout@v3
+      - uses: actions/download-artifact@v3
         with:
-          artifact_path: release-assets
-          output_path: 'build.provenance'
-          tag_name: "${{ github.ref_name }}"
-        env:
-          GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
+          name: ${{ matrix.asset }}
 
+      - name: Upload Release Asset
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run:
+          gh release upload ${{ needs.release.outputs.tag_name }} ${{ matrix.asset }}.zip

.github/workflows/semantic-check.yml

@@ -18,7 +18,7 @@ jobs:
     steps:
       - uses: actions/checkout@v3
 
-      - uses: amannn/action-semantic-pull-request@v4
+      - uses: amannn/action-semantic-pull-request@v5
         name: Check PR for Semantic Commit Message
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/stale.yml

@@ -12,7 +12,7 @@ jobs:
   stale:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/stale@v5
+      - uses: actions/stale@v6
         with:
           stale-issue-message: >
             This issue has been automatically marked as stale because it has not had
@@ -25,3 +25,4 @@ jobs:
           days-before-stale: 30
           days-before-close: 10
           close-issue-label: "abandoned"
+          exempt-issue-labels: "stale:exempt"

.github/workflows/terraform.yml

@@ -3,7 +3,6 @@ on:
   push:
     branches:
       - main
-      - develop
   pull_request:
     paths-ignore:
       - "modules/*/lambdas/**"

.pre-commit-config.yaml

@@ -1,11 +1,11 @@
 repos:
-  - repo: git://github.com/antonbabenko/pre-commit-terraform
+  - repo: https://github.com/antonbabenko/pre-commit-terraform
     rev: v1.52.0
     hooks:
       - id: terraform_fmt
       - id: terraform_tflint
       - id: terraform_docs
-  - repo: git://github.com/pre-commit/pre-commit-hooks
+  - repo: https://github.com/pre-commit/pre-commit-hooks
     rev: v4.0.1
     hooks:
       - id: check-merge-conflict