ci: scope down GitHub Token permissions

.github/workflows/change-file-in-pr.yml

@@ -4,6 +4,9 @@ on:
   pull_request:
     types: [opened, synchronize, reopened, labeled]
 
+permissions:
+  contents: read
+
 jobs:
   check-files-in-directory:
     if: ${{ !contains(github.event.pull_request.labels.*.name, 'Release Not Needed') && !contains(github.event.pull_request.labels.*.name, 'Release PR') }}

.github/workflows/closed-issue-message.yml

@@ -2,6 +2,9 @@ name: Closed Issue Message
 on:
     issues:
        types: [closed]
+permissions:
+  issues: write
+
 jobs:
     auto_comment:
         runs-on: ubuntu-latest

.github/workflows/stale_issues.yml

@@ -5,6 +5,10 @@ on:
   schedule:
   - cron: "0 0 * * *"
 
+permissions:
+  issues: write
+  pull-requests: write
+
 jobs:
   cleanup:
     runs-on: ubuntu-latest

LambdaRuntimeDockerfiles/Infrastructure/src/Infrastructure/Configuration.cs

@@ -29,9 +29,14 @@ internal class Configuration
     public string GitHubOwner { get; } = Environment.GetEnvironmentVariable("AWS_LAMBDA_GITHUB_REPO_OWNER");
     public string GitHubRepository { get; } = Environment.GetEnvironmentVariable("AWS_LAMBDA_GITHUB_REPO_NAME");
     public string GitHubBranch { get; } = Environment.GetEnvironmentVariable("AWS_LAMBDA_GITHUB_REPO_BRANCH");
+
+    public string GitHubOwnerStaging { get; } = Environment.GetEnvironmentVariable("AWS_LAMBDA_GITHUB_REPO_OWNER_STAGING");
+    public string GitHubRepositoryStaging { get; } = Environment.GetEnvironmentVariable("AWS_LAMBDA_GITHUB_REPO_NAME_STAGING");
+    public string GitHubBranchStaging { get; } = Environment.GetEnvironmentVariable("AWS_LAMBDA_GITHUB_REPO_BRANCH_STAGING");
+
     public Ecrs Ecrs { get; } = new Ecrs();
     public const string ProjectRoot = "LambdaRuntimeDockerfiles/Infrastructure/src/Infrastructure";
-    public static readonly string ProjectName = "aws-lambda-container-images";
+    public string ProjectName { get; } = "aws-lambda-container-images";
 
     public readonly FrameworkConfiguration[] Frameworks = new[]
     {

LambdaRuntimeDockerfiles/Infrastructure/src/Infrastructure/PipelineStack.cs

@@ -34,6 +34,10 @@ internal PipelineStack(
         string id,
         Configuration configuration,
         FrameworkConfiguration frameworkConfiguration,
+        string gitHubOwner,
+        string gitHubRepository,
+        string gitHubBranch,
+        string pipelineName,
         IStackProps props = null) : base(scope, id, props)
     {
         var sourceArtifact = new Artifact_();
@@ -47,11 +51,11 @@ internal PipelineStack(
 
         var sourceAction = new GitHubSourceAction(new GitHubSourceActionProps
         {
-            ActionName = configuration.GitHubRepository,
+            ActionName = gitHubRepository,
             Output = sourceArtifact,
-            Owner = configuration.GitHubOwner,
-            Repo = configuration.GitHubRepository,
-            Branch = configuration.GitHubBranch,
+            Owner = gitHubOwner,
+            Repo = gitHubRepository,
+            Branch = gitHubBranch,
             Trigger = GitHubTrigger.WEBHOOK,
             OauthToken = SecretValue.SecretsManager(configuration.GitHubTokenSecretName, new SecretsManagerSecretOptions
             {
@@ -62,7 +66,7 @@ internal PipelineStack(
         var pipeline = new Pipeline(this, "CodePipeline", new PipelineProps
         {
             PipelineType = PipelineType.V2,
-            PipelineName = $"{Configuration.ProjectName}-{frameworkConfiguration.Framework}",
+            PipelineName = pipelineName,
             RestartExecutionOnUpdate = true,
             Stages =
             [
@@ -91,9 +95,9 @@ internal PipelineStack(
             },
             Source = Source.GitHub(new GitHubSourceProps
             {
-                Owner = configuration.GitHubOwner,
-                Repo = configuration.GitHubRepository,
-                BranchOrRef = configuration.GitHubBranch
+                Owner = gitHubOwner,
+                Repo = gitHubRepository,
+                BranchOrRef = gitHubBranch
             }),
             EnvironmentVariables = new Dictionary<string, IBuildEnvironmentVariable>
             {
@@ -130,9 +134,9 @@ internal PipelineStack(
                 },
                 Source = Source.GitHub(new GitHubSourceProps
                 {
-                    Owner = configuration.GitHubOwner,
-                    Repo = configuration.GitHubRepository,
-                    BranchOrRef = configuration.GitHubBranch
+                    Owner = gitHubOwner,
+                    Repo = gitHubRepository,
+                    BranchOrRef = gitHubBranch
                 }),
                 EnvironmentVariables = new Dictionary<string, IBuildEnvironmentVariable>
                 {
@@ -174,9 +178,9 @@ internal PipelineStack(
             },
             Source = Source.GitHub(new GitHubSourceProps
             {
-                Owner = configuration.GitHubOwner,
-                Repo = configuration.GitHubRepository,
-                BranchOrRef = configuration.GitHubBranch
+                Owner = gitHubOwner,
+                Repo = gitHubRepository,
+                BranchOrRef = gitHubBranch
             }),
             EnvironmentVariables = new Dictionary<string, IBuildEnvironmentVariable>
             {
@@ -224,9 +228,9 @@ internal PipelineStack(
             },
             Source = Source.GitHub(new GitHubSourceProps
             {
-                Owner = configuration.GitHubOwner,
-                Repo = configuration.GitHubRepository,
-                BranchOrRef = configuration.GitHubBranch
+                Owner = gitHubOwner,
+                Repo = gitHubRepository,
+                BranchOrRef = gitHubBranch
             }),
             EnvironmentVariables = new Dictionary<string, IBuildEnvironmentVariable>
             {
@@ -338,9 +342,9 @@ internal PipelineStack(
                 },
                 Source = Source.GitHub(new GitHubSourceProps
                 {
-                    Owner = configuration.GitHubOwner,
-                    Repo = configuration.GitHubRepository,
-                    BranchOrRef = configuration.GitHubBranch
+                    Owner = gitHubOwner,
+                    Repo = gitHubRepository,
+                    BranchOrRef = gitHubBranch
                 }),
                 EnvironmentVariables = new Dictionary<string, IBuildEnvironmentVariable>
                 {
@@ -387,9 +391,9 @@ internal PipelineStack(
                 },
                 Source = Source.GitHub(new GitHubSourceProps
                 {
-                    Owner = configuration.GitHubOwner,
-                    Repo = configuration.GitHubRepository,
-                    BranchOrRef = configuration.GitHubBranch
+                    Owner = gitHubOwner,
+                    Repo = gitHubRepository,
+                    BranchOrRef = gitHubBranch
                 }),
                 EnvironmentVariables = new Dictionary<string, IBuildEnvironmentVariable>
                 {
@@ -447,9 +451,9 @@ internal PipelineStack(
                 },
                 Source = Source.GitHub(new GitHubSourceProps
                 {
-                    Owner = configuration.GitHubOwner,
-                    Repo = configuration.GitHubRepository,
-                    BranchOrRef = configuration.GitHubBranch
+                    Owner = gitHubOwner,
+                    Repo = gitHubRepository,
+                    BranchOrRef = gitHubBranch
                 }),
                 EnvironmentVariables = new Dictionary<string, IBuildEnvironmentVariable>
                 {

LambdaRuntimeDockerfiles/Infrastructure/src/Infrastructure/PipelinesStage.cs

@@ -13,13 +13,42 @@ public PipelinesStage(
         string id,
         Configuration configuration,
         IStageProps props = null) : base(scope, id, props)
+    {
+        // Create pipelines for main repository
+        CreatePipelinesForRepository(configuration, 
+            configuration.ProjectName,
+            configuration.GitHubOwner, 
+            configuration.GitHubRepository, 
+            configuration.GitHubBranch);
+
+        // Create pipelines for staging repository
+        CreatePipelinesForRepository(configuration,
+            $"{configuration.ProjectName}-staging",
+            configuration.GitHubOwnerStaging,
+            configuration.GitHubRepositoryStaging,
+            configuration.GitHubBranchStaging);
+    }
+
+    private void CreatePipelinesForRepository(
+        Configuration configuration, 
+        string pipelinePrefix,
+        string gitHubOwner, 
+        string gitHubRepository, 
+        string gitHubBranch)
     {
         for (var i = 0; i < configuration.Frameworks.Length; i++)
         {
+
+            var pipelineName = $"{pipelinePrefix}-{configuration.Frameworks[i].Framework}";
+
             new PipelineStack(this,
-                configuration.Frameworks[i].Framework,
+                $"{pipelinePrefix}-{configuration.Frameworks[i].Framework}",
                 configuration,
                 configuration.Frameworks[i],
+                gitHubOwner,
+                gitHubRepository,
+                gitHubBranch,
+                pipelineName,
                 new StackProps
                 {
                     TerminationProtection = true,

LambdaRuntimeDockerfiles/Infrastructure/src/Infrastructure/Program.cs

@@ -26,7 +26,7 @@ public static void Main(string[] args)
 
         new SelfMutatingPipelineStack(
             app,
-            Configuration.ProjectName,
+            configuration.ProjectName,
             configuration,
             new StackProps
             {

LambdaRuntimeDockerfiles/Infrastructure/src/Infrastructure/SelfMutatingPipelineStack.cs

@@ -65,9 +65,19 @@ internal SelfMutatingPipelineStack(
                 { "AWS_LAMBDA_DOTNET_FRAMEWORK_CHANNEL",
                     new BuildEnvironmentVariable { Type = BuildEnvironmentVariableType.PLAINTEXT, Value =
                     System.Environment.GetEnvironmentVariable("AWS_LAMBDA_DOTNET_FRAMEWORK_CHANNEL") ?? string.Empty } },
+                { "AWS_LAMBDA_GITHUB_REPO_OWNER_STAGING",
+                    new BuildEnvironmentVariable { Type = BuildEnvironmentVariableType.PLAINTEXT, Value =
+                    System.Environment.GetEnvironmentVariable("AWS_LAMBDA_GITHUB_REPO_OWNER_STAGING") ?? string.Empty } },
+                { "AWS_LAMBDA_GITHUB_REPO_NAME_STAGING",
+                    new BuildEnvironmentVariable { Type = BuildEnvironmentVariableType.PLAINTEXT, Value =
+                    System.Environment.GetEnvironmentVariable("AWS_LAMBDA_GITHUB_REPO_NAME_STAGING") ?? string.Empty } },
+                { "AWS_LAMBDA_GITHUB_REPO_BRANCH_STAGING",
+                    new BuildEnvironmentVariable { Type = BuildEnvironmentVariableType.PLAINTEXT, Value =
+                    System.Environment.GetEnvironmentVariable("AWS_LAMBDA_GITHUB_REPO_BRANCH_STAGING") ?? string.Empty } },
             };
 
         // Self mutation
+
         var pipeline = new CodePipeline(this, "SelfMutatingPipeline", new CodePipelineProps
         {
             PipelineName = id,
@@ -114,6 +124,6 @@ internal SelfMutatingPipelineStack(
         });
 
         // Add a stage in the pipeline to deploy the Lambda container pipelines
-        pipeline.AddStage(new PipelinesStage(this, Configuration.ProjectName, configuration));
+        pipeline.AddStage(new PipelinesStage(this, configuration.ProjectName, configuration));
     }
 }

bootstrap.ps1

@@ -23,6 +23,15 @@ param (
     [Parameter(Mandatory = $true, HelpMessage = "GitHub repository branch name.")]
     [string] $GitHubRepoBranch,
 
+    [Parameter(Mandatory = $true, HelpMessage = "GitHub staging repository owner name.")]
+    [string] $GitHubRepoOwnerStaging,
+
+    [Parameter(Mandatory = $true, HelpMessage = "GitHub staging repository name.")]
+    [string] $GitHubRepoNameStaging,
+
+    [Parameter(Mandatory = $true, HelpMessage = "GitHub staging repository branch name.")]
+    [string] $GitHubRepoBranchStaging,
+
     [Parameter(Mandatory = $false, HelpMessage = "ECR URI to store Stage images.")]
     [string] $StageEcr,
 
@@ -44,9 +53,13 @@ $env:AWS_LAMBDA_GITHUB_REPO_OWNER = $GitHubRepoOwner
 $env:AWS_LAMBDA_GITHUB_REPO_NAME = $GitHubRepoName
 $env:AWS_LAMBDA_GITHUB_REPO_BRANCH = $GitHubRepoBranch
 
+$env:AWS_LAMBDA_GITHUB_REPO_OWNER_STAGING = $GitHubRepoOwnerStaging
+$env:AWS_LAMBDA_GITHUB_REPO_NAME_STAGING = $GitHubRepoNameStaging
+$env:AWS_LAMBDA_GITHUB_REPO_BRANCH_STAGING = $GitHubRepoBranchStaging
+
 $env:AWS_LAMBDA_STAGE_ECR = $StageEcr
 $env:AWS_LAMBDA_BETA_ECRS = $BetaEcrs
 $env:AWS_LAMBDA_PROD_ECRS = $ProdEcrs
 
 npx cdk bootstrap --cloudformation-execution-policies arn:aws:iam::aws:policy/AdministratorAccess aws://$PipelineAccountId/$Region
-npx cdk deploy --require-approval never --all
+npx cdk deploy --require-approval never --all