4 ms·
CI shouldn't do deployments, deployment pipelines should run separately when a new release passes CI Of course the general purpose task runner that both run on
by Kinrany 10mo ago
CI shouldn't do deployments, deployment pipelines should run separately when a new release passes CI
Of course the general purpose task runner that both run on does need to support secrets
- Kinrany 10mo agoHmm, I have long assumed that a perfectly executed CI/CD setup would be based on a generic task runner... But maybe not? Only the CI part needs to build; it needs little else and it's the only part of a coherent setup that needs to build.
- arccy 10mo agoyou conveniently ignored the "CD" part of CI/CD
- Kinrany 10mo agoAs mentioned by sibling comments, these two parts are very different. GHA and alternatives are primarily for CI; many people choose to use it solely for CI. For these reasons I did ignore CD.
- regularfry 10mo agoWe're iterating towards GHA for CI, AWS CodeBuild for the CD. At least on AWS projects. Mainly because managing IAM permissions to permit the github runner to do everything the deployment wants is an astonishingly large waste of time. But you need a secret to trigger one from the other.
- jamescrowley 10mo agoYou actually don’t need (long-lived / hard-coded) secrets in this scenario if you use OIDC: https://docs.github.com/en/actions/how-tos/secure-your-work/security-harden-deployments/oidc-in-aws https://docs.github.com/en/actions/how-tos/secure-your-work/...
- everfrustrated 10mo agoAnd even better can scope assuming an AWS IAM role to a specific branch name & workflow filename so only code/workflows that have been through review have access to CD secrets/prod infra. IE no prod access by editing the workflow definition and pushing it to a branch.
- regularfry 10mo agoTechnically yes. It depends on whether you consider the account ID to be a secret or not (AWS say "sensitive but not secret" which doesn't help much). But also it can make sense to treat all environment variables as secrets by default just so you don't accidentally end up putting something somewhere that turns out to have been Wrong.
- Kinrany 10mo agoGP is saying that GHA would need zero information about AWS if CodeBuild used a Github token and listened for GHA runs.
- regularfry 10mo agoThat may be true, but it's not what the link describes.
- Kinrany 10mo agoFair!