AWS CodePipeline Trigger

Trigger AWS CodePipeline from GitHub Actions and have the possibility to wait for the execution result

Releasing

1. Push changes to a branch (no need to merge to master first)
2. Create a GitHub release targeting that branch with a semver tag (e.g. v2.3.0)
3. The publish workflow runs automatically: builds the ncc bundle and force-pushes it back to the tag

The committed dist/ is plain tsc - the publish workflow is what produces the bundled dist that consumers actually run. Do not manually commit ncc output.

Development

npm ci
npm run format:check
npm run typecheck
npm run lint
npm run build
npm test

CI runs the same steps (see ci-checks.yml).

TypeScript 7 (@typescript/native) provides tsc and is used for npm run typecheck. typescript itself is aliased to @typescript/typescript6 because typescript-eslint, ts-jest and ncc need the JS compiler API, which TypeScript 7 does not offer. Drop the alias once typescript-eslint supports TypeScript 7.

Intro

If you want to control the deployment from GitHub Actions, but have specific parts of your deployment running on AWS CodePipeline, then this Action might be useful for you. With this action you can also wait for AWS CodePipeline to finish successfully and do other things after the successful CodePipeline execution. If AWS CodePipeline fails, the GitHub Action fails with it, so that further steps are not executed.

Setup

To configure AWS credentials in GitHub Actions, use configure-aws-credentials. The

user or role you login to needs the following permissions:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "codepipeline:StartPipelineExecution",
        "codepipeline:GetPipeline",
        "codepipeline:GetPipelineExecution",
        "codepipeline:ListPipelineExecutions"
      ],
      "Resource": [
        "arn:aws:codepipeline:${AWS::Region}:${AWS::AccountId}:${PipelineName}"
      ]
    },
    {
      "Effect": "Allow",
      "Action": ["codebuild:ListBuildsForProject", "codebuild:BatchGetBuilds"],
      "Resource": [
        "arn:aws:codebuild:${AWS::Region}:${AWS::AccountId}:project/${CodeBuildProjectName}"
      ]
    },
    {
      "Effect": "Allow",
      "Action": ["logs:GetLogEvents"],
      "Resource": [
        "arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/codebuild/${CodeBuildProjectName}:*"
      ]
    }
  ]
}

codepipeline:GetPipelineExecution and codepipeline:ListPipelineExecutions are only necessary, if you set wait: true, otherwise the GitHub Action Workflow continues without checking the pipeline state.

Furthermore, if you have set wait: true and follow-codebuild: true then aws-codepipeline-trigger is able to forward the outputs of the CodeBuild Actions inside of the CodePipeline. To make use of this feature, the following permissions must be set as well:

• codepipeline:GetPipeline
• codebuild:ListBuildsForProject
• codebuild:BatchGetBuilds
• logs:GetLogEvents

for all the CodeBuild Projects that are part of the pipeline, which is triggered.

CURRENT RESTRICTIONS: If you have multiple CodeBuilds running in parallel in the same stage aws-codepipeline-trigger picks up the first active CodeBuild and forwards it's output, ignoring everything else until it's completed.

The GitHub Action could look like this:

- name: configure AWS creds
  uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1
  with:
    aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
    aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
    aws-session-token: ${{ secrets.AWS_SESSION_TOKEN }}
    aws-region: eu-central-1
- name: Start CodePipeline
  uses: moia-oss/aws-codepipeline-trigger@v2.2.0
  with:
    pipeline: my-pipeline
    wait: true # optional (default: false)
    follow-codebuild: true # optional (default: false)

How you provide the secrets is up to you. Check the configure-aws-credentials docs for the different possibilities.

Advanced Example

Because of the wait feature you can wait for the AWS CodePipeline to finish successfully and trigger another AWS CodePipeline in another account afterwards. For example if the CodePipeline in the production environment should only be run if the CodePipeline on integration finished successfully:

jobs:
  deploy-int:
    name: Deploy to INT
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
      - name: configure AWS creds
        uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1
        with:
          aws-access-key-id: ${{ secrets.INT_AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.INT_AWS_SECRET_ACCESS_KEY }}
          aws-session-token: ${{ secrets.INT_AWS_SESSION_TOKEN }}
          aws-region: eu-central-1
      - name: Start CodePipeline
        uses: moia-oss/aws-codepipeline-trigger@v2.2.0
        with:
          pipeline: my-pipeline-int
          wait: true
          follow-codebuild: true
  deploy-prd:
    name: Deploy to PRD
    needs: deploy-int
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
      - name: configure AWS creds
        uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1
        with:
          aws-access-key-id: ${{ secrets.PRD_AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.PRD_AWS_SECRET_ACCESS_KEY }}
          aws-session-token: ${{ secrets.PRD_AWS_SESSION_TOKEN }}
          aws-region: eu-central-1
      - name: Start CodePipeline
        uses: moia-oss/aws-codepipeline-trigger@v2.2.0
        with:
          pipeline: my-pipeline-prd
          wait: true
          follow-codebuild: true