Files
paultiq 120b0b760d GH-50899: [CI][C++] Use OIDC instead of ACCESS_KEY and SECRET_KEY for sccache's s3 creds (#51028)
### Rationale for this change
This PR moves crossbow builds to short-lived S3 credentials. It does this via GitHub's OIDC provider and an AWS ROLE_ARN with a trust relationship configured. This configuration is detailed here: 
- [Use IAM roles to connect GitHub Actions to actions in AWS](https://aws.amazon.com/blogs/security/use-iam-roles-to-connect-github-actions-to-actions-in-aws/)

The benefits of short-lived / temporary credentials discussed further here: [AWS Well-architected Framework Best Practices SEC02-BP02 Use temporary credentials](https://docs.aws.amazon.com/wellarchitected/latest/framework/sec_identities_unique.html)

sccache supports a variety of S3 creds: [S3 credentials](https://github.com/mozilla/sccache/blob/main/docs/S3.md#credentials)

### What changes are included in this PR?

Use [AssumeRoleWithWebIdentity](https://github.com/mozilla/sccache/blob/main/docs/S3.md#credentials) for sccache S3 credentials.

By assuming the AWS_ROLE_ARN, the sccache session relies on credentials that expire\*, issued only to workflows in the trusted repository, and scoped to the sccache bucket.

Specific tasks: 
- create a role in IAM with the bucket and object level permissions, 
- trust the github oidc-provider, 
- define AWS_ROLE_ARN and set id-token permission
- grant sts:AssumeRoleWithWebIdentity for the specific repositories or organization. 
- pass AWS_SESSION_TOKEN
- add a `aws-actions/configure-aws-credentials@ v6` step to the workflow. 

Separately, someone will need to add the role and trust to AWS:
- Procedure is in https://aws.amazon.com/blogs/security/use-iam-roles-to-connect-github-actions-to-actions-in-aws/ 
- Set a "Maximum session duration" to maximum runtime of any job... maybe 4 hours? 8 hours? 
- Permissions: Role needs BucketLevel and ObjectLevels permissions to the bucket. 

\* I can share an example if needed

### Are these changes tested?
Yes, locally and on a fork. 

### Are there any user-facing changes?
No
* GitHub Issue: #50899

Authored-by: paul@iqmo.com <paul@iqmo.com>
Signed-off-by: Sutou Kouhei <kou@clear-code.com>
2026-09-06 16:04:43 +09:00

156 lines
5.5 KiB
YAML

# Licensed to the Apache Software Foundation (ASF) under one
# or more contributor license agreements. See the NOTICE file
# distributed with this work for additional information
# regarding copyright ownership. The ASF licenses this file
# to you under the Apache License, Version 2.0 (the
# "License"); you may not use this file except in compliance
# with the License. You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing,
# software distributed under the License is distributed on an
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
# KIND, either express or implied. See the License for the
# specific language governing permissions and limitations
# under the License.
{% import 'macros.jinja' as macros with context %}
{{ macros.github_header() }}
permissions:
packages: write
# For OIDC token for sccache
id-token: write
jobs:
build:
name: "Build wheel for {{ linux_wheel_kind }} {{ linux_wheel_version }}"
{% if arch == "amd64" %}
runs-on: ubuntu-latest
{% else %}
runs-on: ubuntu-24.04-arm
{% endif %}
env:
{% if linux_wheel_kind == "musllinux" %}
ALPINE_LINUX: "3.23"
{% endif %}
# archery uses these environment variables
{% if arch == "amd64" %}
ARCH: amd64
{% else %}
ARCH: arm64/v8
{% endif %}
PYTHON: "{{ python_version }}"
PYTHON_ABI_TAG: "{{ python_abi_tag }}"
{% if python_version == "3.15" %}
# TODO: Remove -rc suffix after 3.15 release
PYTHON_IMAGE_TAG: "{{ python_version }}-rc"
{% else %}
PYTHON_IMAGE_TAG: "{{ python_version }}"
{% endif %}
steps:
{{ macros.github_checkout_arrow()|indent }}
{{ macros.github_free_space()|indent }}
{{ macros.github_install_archery()|indent }}
{{ macros.github_login_dockerhub()|indent }}
# Detect free-threaded Python builds
- name: Prepare
run: |
if [[ "${PYTHON_ABI_TAG}" == *t ]]; then
test_image_prefix=python-free-threaded
else
test_image_prefix=python
fi
echo "TEST_IMAGE_PREFIX=${test_image_prefix}" >> ${GITHUB_ENV}
{{ macros.github_configure_aws_credentials()|indent }}
- name: Build wheel
shell: bash
env:
{{ macros.github_set_sccache_envvars()|indent(8) }}
GITHUB_TOKEN: {{ '${{ secrets.GITHUB_TOKEN }}' }}
run: |
if [ "{{ linux_wheel_kind }}" = "musllinux" ] && [ "{{ arch }}" = "arm64" ]; then
# We can't use NuGet on musl arm systems because the official NuGet binary for arm doesn't exist.
:
else
export VCPKG_BINARY_SOURCES="clear;nuget,GitHub,readwrite"
fi
archery docker run \
-e SETUPTOOLS_SCM_PRETEND_VERSION={{ arrow.no_rc_version }} \
python-wheel-{{ linux_wheel_kind }}-{{ linux_wheel_version }}
- uses: actions/upload-artifact@v4
with:
name: wheel
path: arrow/python/repaired_wheels/*.whl
# TODO(kszucs): auditwheel show
- name: Test wheel
shell: bash
run: |
source arrow/ci/scripts/util_enable_core_dumps.sh
archery docker run ${TEST_IMAGE_PREFIX}-wheel-{{ linux_wheel_kind }}-test-imports
archery docker run ${TEST_IMAGE_PREFIX}-wheel-{{ linux_wheel_kind }}-test-unittests
- name: Test wheel on AlmaLinux 8
shell: bash
if: |
'{{ python_version }}' == '3.12' && '{{ linux_wheel_kind }}' == 'manylinux'
env:
ALMALINUX: "8"
run: |
archery docker run \
-e ARROW_GANDIVA=OFF \
-e TEST_DEFAULT=0 \
-e TEST_PYARROW_VERSION={{ arrow.no_rc_version }} \
-e TEST_PYTHON_VERSIONS={{ python_version }} \
-e TEST_WHEEL_PLATFORM_TAGS={{ wheel_platform_tag }} \
-e TEST_WHEELS=1 \
almalinux-verify-rc
- name: Test wheel on Ubuntu 22.04
shell: bash
if: |
'{{ python_version }}' == '3.11' && '{{ linux_wheel_kind }}' == 'manylinux'
env:
UBUNTU: "22.04"
run: |
archery docker run \
-e TEST_DEFAULT=0 \
-e TEST_PYARROW_VERSION={{ arrow.no_rc_version }} \
-e TEST_PYTHON_VERSIONS={{ python_version }} \
-e TEST_WHEEL_PLATFORM_TAGS={{ wheel_platform_tag }} \
-e TEST_WHEELS=1 \
ubuntu-verify-rc
- name: Test wheel on Ubuntu 24.04
shell: bash
if: |
'{{ python_version }}' == '3.12' && '{{ linux_wheel_kind }}' == 'manylinux'
env:
UBUNTU: "24.04"
run: |
archery docker run \
-e TEST_DEFAULT=0 \
-e TEST_PYARROW_VERSION={{ arrow.no_rc_version }} \
-e TEST_PYTHON_VERSIONS={{ python_version }} \
-e TEST_WHEEL_PLATFORM_TAGS={{ wheel_platform_tag }} \
-e TEST_WHEELS=1 \
ubuntu-verify-rc
{{ macros.github_upload_releases("arrow/python/repaired_wheels/*.whl")|indent }}
{{ macros.github_upload_wheel_scientific_python("arrow/python/repaired_wheels/*.whl")|indent }}
{% if arrow.is_default_branch() %}
- name: Push Docker images
shell: bash
run: |
archery docker push python-wheel-{{ linux_wheel_kind }}-{{ linux_wheel_version }}
archery docker push ${TEST_IMAGE_PREFIX}-wheel-{{ linux_wheel_kind }}-test-unittests
{% endif %}