diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index 7102479..fd24150 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -1,6 +1,6 @@ repos: - repo: https://github.com/antonbabenko/pre-commit-terraform - rev: "v1.99.3" + rev: "v1.100.0" hooks: - id: terraform_fmt args: @@ -12,8 +12,7 @@ repos: - id: terraform-docs-go args: ["markdown", "table", "--config", "./.terraform-docs.yaml", "--recursive", "--output-file", "README.md", "./"] - repo: https://github.com/bridgecrewio/checkov.git - rev: '3.2.437' + rev: '3.2.461' hooks: - id: checkov - language_version: python3.12 verbose: false diff --git a/.terraform.lock.hcl b/.terraform.lock.hcl index 44626cf..cdc1668 100644 --- a/.terraform.lock.hcl +++ b/.terraform.lock.hcl @@ -2,25 +2,24 @@ # Manual edits may be lost in future updates. provider "registry.terraform.io/hashicorp/aws" { - version = "5.62.0" + version = "5.100.0" constraints = "~> 5.0" hashes = [ - "h1:8tevkFG+ea/sNZYiQ2GQ02hknPcWBukxkrpjRCodQC0=", - "h1:X3LAZdkVhb/77gTlhPwKYCA9oblBCSu866fZDDOojPY=", - "zh:1f366cbcda72fb123015439a42ab19f96e10ce4edb404273f4e1b7e06da20b73", - "zh:25f098454a34b483279e0382b24b4f42e51c067222c6e797eda5d3ec33b9beb1", - "zh:4b59d48b527e3cefd73f196853bfc265b3e1e57b55c1c8a2d12ff6e3534b4f07", - "zh:7bb88c1ca95e2b3f0f1fe8636925133b9813fc5b137cc467ba6a233ddf4b360e", - "zh:8a93dece40e816c92647e762839d0370e9cad2aa21dc4ca95baee9385f116459", - "zh:8dfe82c55ab8f633c1e2a39c687e9ca8c892d1c2005bf5166ac396ce868ecd05", + "h1:Ijt7pOlB7Tr7maGQIqtsLFbl7pSMIj06TVdkoSBcYOw=", + "zh:054b8dd49f0549c9a7cc27d159e45327b7b65cf404da5e5a20da154b90b8a644", + "zh:0b97bf8d5e03d15d83cc40b0530a1f84b459354939ba6f135a0086c20ebbe6b2", + "zh:1589a2266af699cbd5d80737a0fe02e54ec9cf2ca54e7e00ac51c7359056f274", + "zh:6330766f1d85f01ae6ea90d1b214b8b74cc8c1badc4696b165b36ddd4cc15f7b", + "zh:7c8c2e30d8e55291b86fcb64bdf6c25489d538688545eb48fd74ad622e5d3862", + "zh:99b1003bd9bd32ee323544da897148f46a527f622dc3971af63ea3e251596342", "zh:9b12af85486a96aedd8d7984b0ff811a4b42e3d88dad1a3fb4c0b580d04fa425", - "zh:a754952d69b4860480d5207390e3ab42350c964dbca9a5ac0c6912dd24b4c11d", - "zh:b2a4dbf4abee0e9ec18c5d323b99defdcd3c681f8c4306fb6e02cff7de038f85", - "zh:b57d84be258b571c04271015f03858ab215768b82e47c11ecd86e789d577030a", - "zh:be811b03289407c8d59e6b199bf16e6071165565ffe502148172d0886cf849c4", - "zh:d4144c7366c840eff1ac15ba13d96063f798f0983d24053a832362033624fe6f", - "zh:d88612856d453c4e10c49c76e4ef522b7d068b4f7c3e2e0b03dd74540986eecd", - "zh:e8bd231a5d0786cc4aab8471bb6dabd5a5df1c598afda077a9f27987ada57b67", - "zh:ffb40a66b4d000a8ee4c54227eeb998f887ad867419c3af7d3981587788de074", + "zh:9f8b909d3ec50ade83c8062290378b1ec553edef6a447c56dadc01a99f4eaa93", + "zh:aaef921ff9aabaf8b1869a86d692ebd24fbd4e12c21205034bb679b9caf883a2", + "zh:ac882313207aba00dd5a76dbd572a0ddc818bb9cbf5c9d61b28fe30efaec951e", + "zh:bb64e8aff37becab373a1a0cc1080990785304141af42ed6aa3dd4913b000421", + "zh:dfe495f6621df5540d9c92ad40b8067376350b005c637ea6efac5dc15028add4", + "zh:f0ddf0eaf052766cfe09dea8200a946519f653c384ab4336e2a4a64fdd6310e9", + "zh:f1b7e684f4c7ae1eed272b6de7d2049bb87a0275cb04dbb7cda6636f600699c9", + "zh:ff461571e3f233699bf690db319dfe46aec75e58726636a0d97dd9ac6e32fb70", ] } diff --git a/README.md b/README.md index c9aaa84..ce1c32a 100644 --- a/README.md +++ b/README.md @@ -112,6 +112,9 @@ This is a core infrastructure repository that defines infrastructure related to * [ETD](https://github.com/MITLibraries/mitlib-tf-workloads-etd) * [HRQB](https://github.com/MITLibraries/mitlib-tf-workloads-hrqb-loader) * [HRQB Client](https://github.com/MITLibraries/hrqb-client) +* [marimo notebooks](https://github.com/MITLibraries/mitlib-tf-workloads-notebooks) + * [marimo-launcher](https://github.com/MITLibraries/marimo-launcher) + * [marimo-helloworld](https://github.com/MITLibraries/marimo-helloworld) * [Matomo](https://github.com/MITLibraries/mitlib-tf-workloads-matomo) * [Matomo Application Container](https://github.com/MITLibraries/docker-matomo) * [PPOD](https://github.com/MITLibraries/mitlib-tf-workloads-ppod) @@ -134,7 +137,7 @@ This is a core infrastructure repository that defines infrastructure related to * Owner: See [CODEOWNERS](./.github/CODEOWNERS) * Team: See [CODEOWNERS](./.github/CODEOWNERS) -* Last Maintenance: 2025-06 +* Last Maintenance: 2025-08 ## TF markdown is automatically inserted at the bottom of this file, nothing should be written beyond this point @@ -150,7 +153,7 @@ This is a core infrastructure repository that defines infrastructure related to | Name | Version | |------|---------| -| aws | 5.62.0 | +| aws | 5.100.0 | ## Modules @@ -168,6 +171,7 @@ This is a core infrastructure repository that defines infrastructure related to | ecr\_dsc | ./modules/ecr | n/a | | ecr\_dss | ./modules/ecr | n/a | | ecr\_hrqb\_client | ./modules/ecr | n/a | +| ecr\_marimo | ./modules/ecr | n/a | | ecr\_matomo | ./modules/ecr | n/a | | ecr\_oaiharvester | ./modules/ecr | n/a | | ecr\_patronload | ./modules/ecr | n/a | @@ -256,6 +260,10 @@ This is a core infrastructure repository that defines infrastructure related to | hrqb\_client\_fargate\_makefile | Full contents of the Makefile for the hrqb-client repo (allows devs to push to Dev account only) | | hrqb\_client\_fargate\_prod\_promote\_workflow | Full contents of the prod-promote.yml for the hrqb-client repo | | hrqb\_client\_fargate\_stage\_build\_workflow | Full contents of the stage-build.yml for the hrqb-client repo | +| marimo\_fargate\_dev\_build\_workflow | Full contents of the dev-build.yml for the marimo-launcher repo | +| marimo\_fargate\_makefile | Full contents of the Makefile for the marimo-launcher repo (allows devs to push to Dev account only) | +| marimo\_fargate\_prod\_promote\_workflow | Full contents of the prod-promote.yml for the marimo-launcher repo | +| marimo\_fargate\_stage\_build\_workflow | Full contents of the stage-build.yml for the marimo-launcher repo | | matomo\_fargate\_dev\_build\_workflow | Full contents of the dev-build.yml for the matomo repo | | matomo\_fargate\_makefile | Full contents of the Makefile for the matomo repo (allows devs to push to Dev account only) | | matomo\_fargate\_prod\_promote\_workflow | Full contents of the prod-promote.yml for the matomo repo | diff --git a/marimo_ecr.tf b/marimo_ecr.tf new file mode 100644 index 0000000..67802c0 --- /dev/null +++ b/marimo_ecr.tf @@ -0,0 +1,67 @@ + +# marimo-launcher containers +# This is a standard ECR for an ECS with a Fargate launch type +locals { + ecr_marimo = "marimo-${var.environment}" +} +module "ecr_marimo" { + source = "./modules/ecr" + repo_name = "marimo-launcher" + login_policy_arn = aws_iam_policy.login.arn + oidc_arn = data.aws_ssm_parameter.oidc_arn.value + environment = var.environment + tfoutput_ssm_path = var.tfoutput_ssm_path + tags = { + app-repo = "marimo-launcher" + } +} + +## Outputs to Terraform Cloud for devs ## + +## For marimo-launcher application repo and ECR repository +# Outputs in dev +output "marimo_fargate_dev_build_workflow" { + value = var.environment == "prod" || var.environment == "stage" ? null : templatefile("${path.module}/files/dev-build.tpl", { + region = var.aws_region + role = module.ecr_marimo.gha_role + ecr = module.ecr_marimo.repository_name + function = "" + } + ) + description = "Full contents of the dev-build.yml for the marimo-launcher repo" +} +output "marimo_fargate_makefile" { + value = var.environment == "prod" || var.environment == "stage" ? null : templatefile("${path.module}/files/makefile.tpl", { + ecr_name = module.ecr_marimo.repository_name + ecr_url = module.ecr_marimo.repository_url + function = "" + } + ) + description = "Full contents of the Makefile for the marimo-launcher repo (allows devs to push to Dev account only)" +} + +# Outputs in stage +output "marimo_fargate_stage_build_workflow" { + value = var.environment == "prod" || var.environment == "dev" ? null : templatefile("${path.module}/files/stage-build.tpl", { + region = var.aws_region + role = module.ecr_marimo.gha_role + ecr = module.ecr_marimo.repository_name + function = "" + } + ) + description = "Full contents of the stage-build.yml for the marimo-launcher repo" +} + +# Outputs after promotion to prod +output "marimo_fargate_prod_promote_workflow" { + value = var.environment == "stage" || var.environment == "dev" ? null : templatefile("${path.module}/files/prod-promote.tpl", { + region = var.aws_region + role_stage = "${module.ecr_marimo.repo_name}-gha-stage" + role_prod = "${module.ecr_marimo.repo_name}-gha-prod" + ecr_stage = "${module.ecr_marimo.repo_name}-stage" + ecr_prod = "${module.ecr_marimo.repo_name}-prod" + function = "" + } + ) + description = "Full contents of the prod-promote.yml for the marimo-launcher repo" +}