feat: initial commit

.github/workflows/release.yml

@@ -0,0 +1,53 @@
+name: Release
+
+on:
+  push:
+    branches:
+      - main
+
+jobs:
+  release:
+    name: Release
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v3
+
+      - name: Use Node.js 20.x
+        uses: actions/setup-node@v3
+        with:
+          node-version: 20
+
+      - name: Cache node modules
+        uses: actions/cache@v3
+        env:
+          cache-name: cache-node-modules
+        with:
+          path: ~/.npm
+          key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ hashFiles('**/package-lock.json') }}
+          restore-keys: |
+            ${{ runner.os }}-build-${{ env.cache-name }}-
+            ${{ runner.os }}-build-
+            ${{ runner.os }}-
+
+      - name: Install Dependencies
+        run: npm ci
+
+      - name: Biome CI
+        run: npm run biome-ci
+
+      - name: Build
+        run: npm run build
+
+      - name: Semantic Release
+        uses: cycjimmy/semantic-release-action@v3
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+          HUSKY: 0
+        id: semantic
+        with:
+          semantic_version: 19.0.5
+          extra_plugins: |
+            @semantic-release/[email protected]
+            @semantic-release/[email protected]

.gitignore

@@ -0,0 +1,3 @@
+/index.js
+/cdk.out
+/node_modules

.lefthook/commit-msg/commitlint.sh

@@ -0,0 +1 @@
+echo $(head -n1 $1) | npx commitlint --color

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2023 Soliant Consulting
+
+Permission is hereby granted, free of charge, to any person obtaining a
+copy of this software and associated documentation files (the "Software"),
+to deal in the Software without restriction, including without limitation
+the rights to use, copy, modify, merge, publish, distribute, sublicense,
+and/or sell copies of the Software, and to permit persons to whom the
+Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+DEALINGS IN THE SOFTWARE.

biome.json

@@ -0,0 +1,26 @@
+{
+    "$schema": "https://biomejs.dev/schemas/1.5.2/schema.json",
+    "organizeImports": {
+        "enabled": true
+    },
+    "files": {
+        "include": [
+            "biome.json",
+            "cdk.json",
+            "release.config.cjs",
+            "commitlint.config.cjs",
+            "index.ts"
+        ]
+    },
+    "linter": {
+        "enabled": true,
+        "rules": {
+            "recommended": true
+        }
+    },
+    "formatter": {
+        "indentStyle": "space",
+        "indentWidth": 4,
+        "lineWidth": 100
+    }
+}

cdk.json

@@ -0,0 +1,3 @@
+{
+    "app": "node index.js"
+}

commitlint.config.cjs

@@ -0,0 +1 @@
+module.exports = { extends: ["@commitlint/config-conventional"] };

index.ts

@@ -0,0 +1,67 @@
+import * as cdk from "aws-cdk-lib";
+import * as iam from "aws-cdk-lib/aws-iam";
+import { Construct } from "constructs";
+
+type BitbucketStackProps = cdk.StackProps & {
+    readonly repositoryUuid: string;
+    readonly bitbucketAudience: string;
+    readonly bitbucketDomain: string;
+};
+
+export class BitbucketStack extends cdk.Stack {
+    constructor(scope: Construct, id: string, props: BitbucketStackProps) {
+        super(scope, id, props);
+
+        const bitbucketProvider = new iam.OpenIdConnectProvider(this, "BitbucketProvider", {
+            url: `https://${props.bitbucketDomain}`,
+            clientIds: [props.bitbucketAudience],
+        });
+
+        const conditions: iam.Conditions = {
+            StringEquals: {
+                [`${props.bitbucketDomain}:aud`]: props.bitbucketAudience,
+            },
+            StringLike: {
+                [`${props.bitbucketDomain}:sub`]: `${props.repositoryUuid}:*`,
+            },
+        };
+
+        const role = new iam.Role(this, "BitbucketDeployRole", {
+            assumedBy: new iam.WebIdentityPrincipal(
+                bitbucketProvider.openIdConnectProviderArn,
+                conditions,
+            ),
+            managedPolicies: [iam.ManagedPolicy.fromAwsManagedPolicyName("AdministratorAccess")],
+            description:
+                "This role is used via Bitbucket pipelines to deploy with AWS CDK or Terraform on the customers AWS account",
+            maxSessionDuration: cdk.Duration.hours(2),
+        });
+
+        new cdk.CfnOutput(this, "RoleArn", {
+            value: role.roleArn,
+        });
+    }
+}
+
+const app = new cdk.App();
+const stackSuffix = app.node.tryGetContext("stackSuffix");
+const repositoryUuid = app.node.tryGetContext("repositoryUuid");
+
+if (typeof stackSuffix !== "string") {
+    console.error("Missing stackSuffix context variable");
+    process.exit(1);
+}
+
+if (typeof repositoryUuid !== "string") {
+    console.error("Missing repositoryUuid context variable");
+    process.exit(1);
+}
+
+new BitbucketStack(app, `BitbucketOpenIDConnect-${stackSuffix}`, {
+    repositoryUuid,
+    bitbucketDomain:
+        "api.bitbucket.org/2.0/workspaces/soliantconsulting/pipelines-config/identity/oidc",
+    bitbucketAudience: "ari:cloud:bitbucket::workspace/edf547a3-8e06-4217-abd8-7b9139a21e2c",
+});
+
+app.synth();

lefthook.yml

@@ -0,0 +1,10 @@
+pre-commit:
+  commands:
+    check:
+      glob: "*.{js,ts,cjs,mjs,d.cts,d.mts,jsx,tsx,json,jsonc}"
+      run: npx biome check --apply --no-errors-on-unmatched --files-ignore-unknown=true {staged_files} && git update-index --again
+
+commit-msg:
+  scripts:
+    "commitlint.sh":
+      runner: bash