CLI #6
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CLI | |
| # Build and smoke-test every target on pull requests and pushes, using the Redis | |
| # version pinned in .redis_version. | |
| on: | |
| pull_request: | |
| branches: [unstable, "release/*"] | |
| push: | |
| branches: [unstable, "release/*"] | |
| workflow_dispatch: | |
| workflow_call: | |
| jobs: | |
| populate-env-vars: | |
| runs-on: ubuntu-latest | |
| outputs: | |
| BUILD_TARGETS: ${{ steps.parse.outputs.BUILD_TARGETS }} | |
| release_tag: ${{ steps.v.outputs.release_tag }} | |
| steps: | |
| - uses: actions/checkout@v5 | |
| - name: Parse env file | |
| id: parse | |
| uses: ./.github/actions/parse-env-file | |
| - id: v | |
| run: echo "release_tag=$(cat .redis_version)" >> "$GITHUB_OUTPUT" | |
| build-n-test: | |
| needs: populate-env-vars | |
| uses: ./.github/workflows/build-n-test.yml | |
| with: | |
| release_tag: ${{ needs.populate-env-vars.outputs.release_tag }} | |
| build_targets: ${{ needs.populate-env-vars.outputs.BUILD_TARGETS }} | |
| # DIAGNOSTIC: verify the production S3 IAM role can be assumed via OIDC from | |
| # the dispatched ref (e.g. release/8.8). This exercises the role's trust policy | |
| # `sub` condition (repo:<repo>:ref:refs/heads/<branch>); it publishes nothing. | |
| # Manual dispatch only so it never runs on regular PR/push CI. Start with: | |
| # gh workflow run cli.yml --ref release/8.8 | |
| assume-prod-role: | |
| if: github.event_name == 'workflow_dispatch' | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| id-token: write # required to request the GitHub OIDC token | |
| steps: | |
| - name: Show ref (this becomes the OIDC sub claim) | |
| run: echo "Dispatched on ref=${{ github.ref }} sha=${{ github.sha }}" | |
| - name: Assume prod IAM role via OIDC | |
| uses: aws-actions/configure-aws-credentials@v6 | |
| with: | |
| role-to-assume: ${{ secrets.CLI_S3_IAM_ARN }} | |
| aws-region: ${{ secrets.CLI_S3_REGION }} | |
| role-session-name: gha-test-assume-prod-${{ github.run_id }} | |
| - name: Verify the assumed identity | |
| run: aws sts get-caller-identity |