Add Continuous Integration (CI) as GitHub Action

Running the tests for this project requires read access to
s3://facia-tool-store/DEV/, so we need to provide the GitHub Action
with AWS credentials for a AWS role that allows that.

We're using https://github.com/aws-actions/configure-aws-credentials
to grant the credentials, and https://github.com/guardian/cdk to
create the AWS Role (as we're adding cdk, we get half a dozen new files
in the new `cdk` folder!).

Specific IAM permissions required
---------------------------------

Even though all the FAPI client does, in terms of S3 API calls,
is call `getObject`, we need more than the `s3:GetObject`
permission. We also need `s3:ListBucket` because FAPI sometimes
has to request objects that don't exist ...and without
`s3:ListBucket`, S3 will throw a `AccessDenied` error even tho'
you're possess the `s3:GetObject permission`:

https://stackoverflow.com/a/56027548/438886

Abusing the repositories field
------------------------------

Try to be specific to grant just this repo permissions

Note that I seem to be having to abuse the `repositories` field a bit (is
this field badly named?) in order to get this
`repo:guardian/facia-scala-client:*` value:

```
          - Action: sts:AssumeRoleWithWebIdentity
            Condition:
              StringLike:
                token.actions.githubusercontent.com:sub: repo:guardian/facia-scala-client:*

```

...which is apparently the format required:

aws-actions/configure-aws-credentials#306 (comment)

Co-authored-by: Akash Askoolum <[email protected]>

.github/workflows/ci.yml

@@ -0,0 +1,27 @@
+name: CI
+on:
+  pull_request:
+  workflow_dispatch:
+  push:
+    branches:
+      - main
+jobs:
+  CI:
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write # Needed to interact with GitHub's OIDC Token endpoint
+      contents: read
+    steps:
+      - uses: actions/checkout@v3
+      - uses: aws-actions/configure-aws-credentials@v1 # Needed for S3 read access for the tests!
+        with:
+          # The AWS role is configured as a GitHUb Repo secret, the value is the cloudformation-output of the
+          # 'Facia-Scala-Client-CI-Role-Provider' cloudformation stack
+          role-to-assume: ${{ secrets.AWS_ROLE_FOR_TESTS }}
+          aws-region: eu-west-1
+      - uses: coursier/cache-action@v6
+      - uses: olafurpg/setup-scala@v13
+        with:
+          java-version: [email protected]
+      - name: Build and Test
+        run: sbt test

cdk/.gitignore

@@ -0,0 +1,11 @@
+*.js
+!jest.config.js
+!jest.setup.js
+!.eslintrc.js
+*.d.ts
+node_modules
+dist
+
+# CDK asset staging directory
+.cdk.staging
+cdk.out

cdk/README.md

@@ -0,0 +1,5 @@
+# Infrastructure
+
+This directory defines the components to be deployed to AWS.
+
+See [`package.json`](./package.json) for a list of available scripts.

cdk/bin/cdk.ts

@@ -0,0 +1,9 @@
+import 'source-map-support/register';
+import { App } from 'aws-cdk-lib';
+import { FaciaScalaClientTesting } from '../lib/facia-scala-client-testing';
+
+const app = new App();
+new FaciaScalaClientTesting(app, 'FaciaScalaClientTesting-INFRA', {
+	stack: 'facia-scala-client',
+	stage: 'INFRA',
+});

cdk/cdk.json

@@ -0,0 +1,7 @@
+{
+  "app": "npx ts-node bin/cdk.ts",
+  "context": {
+    "aws-cdk:enableDiffNoFail": "true",
+    "@aws-cdk/core:stackRelativeExports": "true"
+  }
+}

cdk/lib/facia-scala-client-testing.ts

@@ -0,0 +1,36 @@
+import {join} from 'path';
+import type {GuStackProps} from '@guardian/cdk/lib/constructs/core';
+import {GuStack} from '@guardian/cdk/lib/constructs/core';
+import type {App} from 'aws-cdk-lib';
+import {CfnInclude} from 'aws-cdk-lib/cloudformation-include';
+import {GuGithubActionsRole} from "@guardian/cdk/lib/constructs/iam";
+import {
+    GuGithubActionsRepositoryCondition,
+    GuGithubActionsRoleProps
+} from "@guardian/cdk/lib/constructs/iam/roles/github-actions";
+import {GuPolicy} from "@guardian/cdk/lib/constructs/iam/policies";
+import {GuAllowPolicy, GuAllowPolicyProps} from "@guardian/cdk/lib/constructs/iam/policies/base-policy";
+
+export class FaciaScalaClientTesting extends GuStack {
+    constructor(scope: App, id: string, props: GuStackProps) {
+        super(scope, id, props);
+        let fapiBucketArn = "arn:aws:s3:::facia-tool-store"
+        new GuGithubActionsRole(this, {
+            policies: [new GuAllowPolicy(
+                this,
+                "fapi-s3-bucket-access",
+                {
+                    actions: ["s3:GetObject","s3:ListBucket"],
+                    resources: [
+                        fapiBucketArn, // bucket resource specified for s3:ListBucket
+                        `${fapiBucketArn}/DEV/*` // object resource specified for s3:GetObject
+                    ]
+                }
+            )],
+            condition: {
+                githubOrganisation: "guardian",
+                repositories: "facia-scala-client:*"
+            }
+        })
+    }
+}