sample-sgea/.github/workflows/ci.yml at main · aws-samples/sample-sgea · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
# SGEA CI: unit tests, then export + verify every profile (terraform fmt/validate, cdk synth, sgea check).
# No AWS credentials: verify is credential-free (placeholder VPC context for the CDK synth).
#
# Actions are pinned by full commit SHA (the tag in the trailing comment is the release the SHA was taken from).
# When upgrading, re-resolve the SHA with: git ls-remote https://github.com/<owner>/<action> refs/tags/<tag>
name: ci

on:
  push:
    branches: [main]
  pull_request:

permissions:
  contents: read

env:
  PIP_DISABLE_PIP_VERSION_CHECK: "1"
  TERRAFORM_VERSION: "1.17.0"

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
        with:
          persist-credentials: false
      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0  # v7.1.0
        with:
          python-version: "3.15"
      - run: pip install -e ".[dev]"
      - run: pytest -q

  verify:
    needs: test
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        profile:
          - dod-il2.commercial
          - dod-il4.govcloud
          - dod-il5.govcloud
          - fedramp-high.govcloud
          - fedramp-low.commercial
          - fedramp-moderate-hipaa.commercial
          - fedramp-moderate-hitrust.commercial
          - fedramp-moderate-part11.commercial
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
        with:
          persist-credentials: false
      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0  # v7.1.0
        with:
          python-version: "3.15"
      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1  # v7.1.0
        with:
          node-version: "24"
      - uses: hashicorp/setup-terraform@dfe3c3f87815947d99a8997f908cb6525fc44e9e  # v4.0.1
        with:
          terraform_version: ${{ env.TERRAFORM_VERSION }}
          terraform_wrapper: false
      - run: python -m venv /tmp/venv && /tmp/venv/bin/pip install -q -e .
      - name: Export and verify
        env:
          PROFILE: ${{ matrix.profile }}
        run: |
          # Scaffold baselines (FedRAMP High, DoD IL2/IL4/IL5) need --allow-unverified; the output is marked as such.
          /tmp/venv/bin/sgea export --profile "profiles/${PROFILE}.json" --out out --allow-unverified
          for d in out/*/; do /tmp/venv/bin/sgea verify --out "$d" || exit 1; done

  snippets:
    # Tenant code snippets (docs/operations/tenant-requirements.md): each language must build.
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0  # v7.1.0
        with:
          python-version: "3.15"
      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1  # v7.1.0
        with:
          node-version: "24"
      - name: Python
        run: cd examples/tenant-snippets/python && pip install -q -r requirements.txt pytest==9.1.1 && python -m pytest -q
      - name: Node.js
        run: cd examples/tenant-snippets/node && npm ci --silent && npm run build
      - name: .NET
        run: cd examples/tenant-snippets/dotnet && dotnet build -c Release
      - name: Java
        run: cd examples/tenant-snippets/java && mvn -q -B compile