initial commit

.github/workflows/test.yml

@@ -0,0 +1,30 @@
+name: Run Tests
+
+on:
+  push:
+    branches: [ main ]
+  pull_request:
+    branches: [ main ]
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+
+    strategy:
+      matrix:
+        node-version: [12.x]
+
+    steps:
+      - uses: actions/checkout@v2
+      - name: Use Node.js ${{ matrix.node-verison }}
+        uses: actions/setup-node@v1
+        with:
+          node-version: ${{ matrix.node-version }}
+      - uses: actions/cache@v2
+        with:
+          path: ~/.npm
+          key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
+          restore-keys: |
+            ${{ runner.os }}-node-
+      - run: npm ci
+      - run: npm test

.gitignore

@@ -0,0 +1 @@
+node_modules/

.nvmrc

@@ -0,0 +1 @@
+v12

LICENSE

@@ -0,0 +1,22 @@
+
+The MIT License (MIT)
+
+Copyright (c) 2020 Ryan Owens and contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.

README.md

@@ -0,0 +1,25 @@
+# Enforce Pull Request Description Length Action
+
+This action checks that a Pull Request Description is at a minimum length.  By default the minimum length is one.  If a different minimum length is needed it can be passed in using an Action Input. 
+
+## Inputs
+
+### `minLength`
+
+A specific minimum length the description must be. 
+
+## Example Usage
+
+```
+- name: Enforce Jira Issue Key in Pull Request Title
+  uses: ryanvade/enforce-pr-description-length-action@v1
+```
+
+## Example Usage with a specific min length
+
+```
+- name: Enforce Jira Issue Key in Pull Request Title
+  uses: ryanvade/enforce-pr-description-length-action@v1
+  with:
+    minLength: 5
+```

__tests__/index.test.ts

@@ -0,0 +1,130 @@
+import * as AWSMock from "aws-sdk-mock";
+import nock from "nock";
+import { getIamUserName, createNewAccessKeyForUser, deleteAccessKey, getRepositorySecretsPublicKey, updateSecret } from "../src/index";
+
+describe("index", () => {
+    beforeEach(() => {
+        process.env.AWS_ACCESS_KEY_ID = "SOME_ACCESS_KEY";
+        process.env.AWS_SECRET_ACCESS_KEY = "SOME_SECRET_KEY";
+        process.env.AWS_DEFAULT_REGION = "us-east-1";
+        process.env.GITHUB_REPOSITORY = "test/repo";
+        process.env.GITHUB_ACTION = "test-action";
+        process.env[`INPUT_${"GITHUB_TOKEN".replace(/ /g, '_').toUpperCase()}`] = "SOME_GITHUB_TOKEN";
+    });
+
+    describe("getIamUserName", () => {
+        const name = "IAM_USER_NAME";
+        it("returns a provided username if it exists", async () => {
+            process.env[`INPUT_${name.replace(/ /g, '_').toUpperCase()}`] = "testUser";
+            const userName = await getIamUserName();
+            expect(userName).toBe("testUser");
+        });
+
+        it("returns a username from STS", async () => {
+            delete process.env[`INPUT_${name.replace(/ /g, '_').toUpperCase()}`];
+            AWSMock.mock("STS", "getCallerIdentity", () => {
+                return new Promise((resolve) => {
+                    resolve({
+                        UserId: "SOME_USER_ID",
+                        Account: "123456789123",
+                        Arn: "arn:aws:iam::123456789123:user/TestUser"
+                    });
+                });
+
+            });
+
+            const userName = await getIamUserName();
+            expect(userName).toBe("TestUser");
+            AWSMock.restore();
+        });
+
+        it("throws an error if a user arn is not returned", async () => {
+            delete process.env[`INPUT_${name.replace(/ /g, '_').toUpperCase()}`];
+            AWSMock.mock("STS", "getCallerIdentity", () => {
+                return new Promise((resolve) => {
+                    resolve({
+                        Account: "123456789123"
+                    });
+                });
+
+            });
+
+            await expect(getIamUserName()).rejects.toThrowError("Cannot get current IAM User username");
+            AWSMock.restore();
+        });
+    });
+
+    describe("createNewAccessKeyForUser", () => {
+        it("creates a new access key", async () => {
+            const accessKey = {
+                UserName: "TestUser",
+                AccessKeyId: "TEST_SOME_ACCESS_KEY",
+                Status: "Active",
+                SecretAccessKey: "TEST_SOME_SECRET_KEY",
+                CreateDate: new Date()
+            };
+
+            AWSMock.mock("IAM", "createAccessKey", () => {
+                return new Promise((resolve) => {
+                    resolve({
+                        AccessKey: accessKey
+                    })
+                })
+            });
+
+            const response = await createNewAccessKeyForUser("TestUser");
+
+            expect(response).toEqual(accessKey);
+
+            AWSMock.restore();
+        });
+    });
+
+    describe("deleteAccessKey", () => {
+        it("deletes an access key", async () => {
+            AWSMock.mock("IAM", "deleteAccessKey", (params: any) => {
+                expect(params).toEqual({ UserName: "TestUser", AccessKeyId: process.env.AWS_ACCESS_KEY_ID });
+                return new Promise((resolve) => {
+                    resolve({});
+                });
+            });
+
+            const response = deleteAccessKey("TestUser", process.env.AWS_ACCESS_KEY_ID || "", {
+                AccessKeyId: "TEST_SOME_ACCESS_KEY_ID",
+                SecretAccessKey: "TEST_SOME_SECRET_ACCESS_KEY",
+                UserName: "TestUser",
+                Status: "Active"
+            });
+            expect(response).toBeTruthy();
+            AWSMock.restore();
+        });
+    });
+
+    describe("getRepositorySecretsPublicKey", () => {
+        it("can get the repository public key", async () => {
+            const scope = nock("https://api.github.com").get("/repos/test/repo/actions/secrets/public-key").reply(200, {
+                key_id: "SOME_KEY_ID",
+                key: "SOME_KEY"
+            });
+
+            const response = await getRepositorySecretsPublicKey();
+
+            expect(response).toEqual({
+                key_id: "SOME_KEY_ID",
+                key: "SOME_KEY"
+            });
+
+            scope.done();
+        });
+    });
+
+    describe("updateSecret", () => {
+        it("can update a github action repository secret", async () => {
+            const scope = nock("https://api.github.com").put("/repos/test/repo/actions/secrets/TEST-SECRET-NAME").reply(204);
+
+            const response = await updateSecret("TEST-SECRET-NAME", "TEST_SOME_ACCESS_KEY", { key_id: "SOME_KEY", key: "wSXrksYGOupypWCJbux1hLU8ZeTpIgAqG65YaK0Za18="});
+            expect(response.status).toEqual(204);
+            scope.done();
+        });
+    })
+});

action.yml

@@ -0,0 +1,18 @@
+name: AWS Credentials Rotation
+description: Rotates AWS Credentials in Secrets
+inputs:
+  GITHUB_TOKEN: 
+    description: 'Github Access Token'
+    required: true
+  ACCESS_KEY_ID_SECRET_NAME:
+    description: 'Name of the Github Secret that holds the ACCESS_KEY_ID to rotate'
+    required: true
+  SECRET_ACCESS_KEY_SECRET_NAME:
+    description: 'Name of the Github Secret that holds the SECRET_ACCESS_KEY to rotate'
+    required: true
+  IAM_USER_USERNAME:
+    description: 'Username of the IAM User to rotate credentials for'
+    required: false
+runs:
+  using: node12
+  main: dist/index.js