Skip to content

Create deploy-lambda.yaml - #2

Closed
garyrutland wants to merge 1 commit into
mainfrom
gary-workshop
Closed

Create deploy-lambda.yaml#2
garyrutland wants to merge 1 commit into
mainfrom
gary-workshop

Conversation

@garyrutland

@garyrutland garyrutland commented Feb 25, 2026

Copy link
Copy Markdown
Member

📝 Pull Request

Is this PR related to an open issue?

  • Yes, it resolves: [Link Issue Number(s) Here]
  • No, this is a new change/addition.

Description of changes

  • What was changed? (e.g., Added a new section, corrected a command, rephrased a paragraph)
  • Where was the change made? (e.g., WORKSHOP.md, line 45; README.md section Prerequisites)

Why is this change necessary?

  • Correction: Fixing a typo, broken link, or inaccurate information.
  • Clarification: Making a confusing section easier to understand.
  • Addition: Adding entirely new content/steps to the workshop.
  • Refactoring: Reorganising content without changing the meaning.
  • Other: [Please describe]

Cross-platform (Mac, Windows, Chromebook, Linux) checklist

Contributor must confirm the following to maintain compatibility across all target systems:

  • Path separation: Directory paths use forward slashes (/) only (avoiding Windows-style backslashes \).
  • Shell commands: Commands use only universal syntax (e.g., docker compose up, avoiding complex OS-specific utilities).
  • Terminal check: The instructions are clear and functional when run from common terminals across Mac, Windows, Chromebook (Crosh/Terminal), and Linux.
  • Case sensitivity: Filenames are referenced correctly using case-sensitive best practices to prevent errors when pulled down on different operating systems.
  • Prerequisites slignment: The changes do not introduce any new local tools that are not explicitly documented in the Prerequisites Guide.

Reviewer checklist

  • The content follows the style and tone of existing documentation.
  • The changes are grammatically correct and free of typos.
  • The file structure is maintained (e.g., no unnecessary files added).
  • (If applicable) All internal and external links are working.

@github-actions

github-actions Bot commented Feb 25, 2026

Copy link
Copy Markdown

Super-linter summary

Language Validation result
BASH Fail ❌
BASH_EXEC Pass ✅
BIOME_FORMAT Fail ❌
BIOME_LINT Fail ❌
CHECKOV Fail ❌
DOCKERFILE_HADOLINT Pass ✅
GITHUB_ACTIONS Pass ✅
GITHUB_ACTIONS_ZIZMOR Fail ❌
GITLEAKS Pass ✅
GIT_MERGE_CONFLICT_MARKERS Pass ✅
JSCPD Fail ❌
JSON Pass ✅
JSON_PRETTIER Pass ✅
MARKDOWN Pass ✅
MARKDOWN_PRETTIER Pass ✅
NATURAL_LANGUAGE Pass ✅
PRE_COMMIT Pass ✅
SHELL_SHFMT Fail ❌
SPELL_CODESPELL Pass ✅
TRIVY Fail ❌
TYPESCRIPT_ES Fail ❌
TYPESCRIPT_PRETTIER Pass ✅
YAML Pass ✅
YAML_PRETTIER Pass ✅

Super-linter detected linting errors

For more information, see the GitHub Actions workflow run

Powered by Super-linter

BASH 

�[1mIn /github/workspace/_facilitator/cleanup-aws.sh line 58:�[0m
�[0mFUNCTIONS=$(aws_cmd lambda list-functions --query "Functions[?contains(Tags[?Key==`Workshop`].Value, `GitHubActions`)].FunctionName" --output text)�[0m
�[32m                                                                                  ^--------^ SC2006 (style): Use $(...) notation instead of legacy backticks `...`.�[0m
�[32m                                                                                                     ^-------------^ SC2006 (style): Use $(...) notation instead of legacy backticks `...`.�[0m

�[1mDid you mean:�[0m
FUNCTIONS=$(aws_cmd lambda list-functions --query "Functions[?contains(Tags[?Key==$(Workshop)].Value, $(GitHubActions))].FunctionName" --output text)


�[1mIn /github/workspace/_facilitator/cleanup-aws.sh line 81:�[0m
�[0mROLES=$(aws_cmd iam list-roles --query "Roles[?contains(RoleName, `workshop-lambda`) || contains(RoleName, `WorkshopLambda`)].RoleName" --output text)�[0m
�[32m                                                                  ^---------------^ SC2006 (style): Use $(...) notation instead of legacy backticks `...`.�[0m
�[32m                                                                                                           ^--------------^ SC2006 (style): Use $(...) notation instead of legacy backticks `...`.�[0m

�[1mDid you mean:�[0m
ROLES=$(aws_cmd iam list-roles --query "Roles[?contains(RoleName, $(workshop-lambda)) || contains(RoleName, $(WorkshopLambda))].RoleName" --output text)


�[1mIn /github/workspace/_facilitator/cleanup-aws.sh line 110:�[0m
�[0mPOLICIES=$(aws_cmd iam list-policies --scope Local --query "Policies[?contains(PolicyName, `LambdaWorkshop`) || contains(PolicyName, `workshop-lambda`)].Arn" --output text)�[0m
�[32m                                                                                           ^--------------^ SC2006 (style): Use $(...) notation instead of legacy backticks `...`.�[0m
�[32m                                                                                                                                     ^---------------^ SC2006 (style): Use $(...) notation instead of legacy backticks `...`.�[0m

�[1mDid you mean:�[0m
POLICIES=$(aws_cmd iam list-policies --scope Local --query "Policies[?contains(PolicyName, $(LambdaWorkshop)) || contains(PolicyName, $(workshop-lambda))].Arn" --output text)


�[1mIn /github/workspace/_facilitator/cleanup-aws.sh line 134:�[0m
�[0mLOG_GROUPS=$(aws_cmd logs describe-log-groups --log-group-name-prefix '/aws/lambda/' --query "logGroups[?contains(logGroupName, `workshop-lambda`) || contains(logGroupName, `-workshop-lambda`)].logGroupName" --output text)�[0m
�[32m                                                                                                                                ^---------------^ SC2006 (style): Use $(...) notation instead of legacy backticks `...`.�[0m
�[32m                                                                                                                                                                             ^----------------^ SC2006 (style): Use $(...) notation instead of legacy backticks `...`.�[0m
�[33m                                                                                                                                                                              ^--------------^ SC2215 (warning): This flag is used as a command name. Bad line break or missing [ .. ]?�[0m

�[1mDid you mean:�[0m
LOG_GROUPS=$(aws_cmd logs describe-log-groups --log-group-name-prefix '/aws/lambda/' --query "logGroups[?contains(logGroupName, $(workshop-lambda)) || contains(logGroupName, $(-workshop-lambda))].logGroupName" --output text)

For more information:
  https://www.shellcheck.net/wiki/SC2215 -- This flag is used as a command na...
  https://www.shellcheck.net/wiki/SC2006 -- Use $(...) notation instead of le...
BIOME_FORMAT 
Checked 3 files in 20ms. No fixes applied.
Found 3 errors.lambda/package.json format ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

  × Formatter would have printed the following content:

     1  1 │   {
     2    │ - ··"name":·"task",
     3    │ - ··"version":·"1.0.0",
     4    │ - ··"description":·"",
     5    │ - ··"main":·"index.js",
     6    │ - ··"scripts":·{
     7    │ - ····"build":·"tsc",
     8    │ - ····"test":·"echo·\"Error:·no·test·specified\"·&&·exit·1",
     9    │ - ····"package":·"zip·-r·function.zip·build/·node_modules/"
    10    │ - ··},
    11    │ - ··"keywords":·[],
    12    │ - ··"author":·"",
    13    │ - ··"license":·"ISC",
    14    │ - ··"type":·"commonjs",
    15    │ - ··"devDependencies":·{
    16    │ - ····"@tsconfig/recommended":·"^1.0.13",
    17    │ - ····"@types/aws-lambda":·"^8.10.159",
    18    │ - ····"@types/node":·"^24.10.1",
    19    │ - ····"typescript":·"^5.9.3"
    20    │ - ··}
        2 │ + → "name":·"task",
        3 │ + → "version":·"1.0.0",
        4 │ + → "description":·"",
        5 │ + → "main":·"index.js",
        6 │ + → "scripts":·{
        7 │ + → → "build":·"tsc",
        8 │ + → → "test":·"echo·\"Error:·no·test·specified\"·&&·exit·1",
        9 │ + → → "package":·"zip·-r·function.zip·build/·node_modules/"
       10 │ + → },
       11 │ + → "keywords":·[],
       12 │ + → "author":·"",
       13 │ + → "license":·"ISC",
       14 │ + → "type":·"commonjs",
       15 │ + → "devDependencies":·{
       16 │ + → → "@tsconfig/recommended":·"^1.0.13",
       17 │ + → → "@types/aws-lambda":·"^8.10.159",
       18 │ + → → "@types/node":·"^24.10.1",
       19 │ + → → "typescript":·"^5.9.3"
       20 │ + → }
    21 21 │   }
    22 22 │


lambda/src/index.ts format ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

  × Formatter would have printed the following content:

     2  2 │
     3  3 │   export const handler: Handler = async (event, context) => {
     4    │ - ··console.log("Hello·world!");
     5    │ - ··console.log({·event,·context·});
        4 │ + → console.log("Hello·world!");
        5 │ + → console.log({·event,·context·});
     6  6 │
     7    │ - ··return·{
     8    │ - ····statusCode:·200,
     9    │ - ····body:·JSON.stringify({·event,·context·}),
    10    │ - ··};
        7 │ + → return·{
        8 │ + → → statusCode:·200,
        9 │ + → → body:·JSON.stringify({·event,·context·}),
       10 │ + → };
    11 11 │   };
    12 12 │


lambda/tsconfig.json format ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

  × Formatter would have printed the following content:

    1 1 │   {
    2   │ - ··"extends":·"@tsconfig/recommended/tsconfig.json",
    3   │ - ··"compilerOptions":·{
    4   │ - ····"outDir":·"./build"
    5   │ - ··}
      2 │ + → "extends":·"@tsconfig/recommended/tsconfig.json",
      3 │ + → "compilerOptions":·{
      4 │ + → → "outDir":·"./build"
      5 │ + → }
    6 6 │   }
    7 7 │


format ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

  × Some errors were emitted while running checks.
BIOME_LINT 
Checked 3 files in 54ms. No fixes applied.
Found 1 warning.lambda/src/index.ts:1:8 lint/style/useImportType  FIXABLE  ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

  ! All these imports are only used as types.

  > 1 │ import { Handler } from "aws-lambda";
      │        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
    2 │
    3 │ export const handler: Handler = async (event, context) => {

  i Importing the types with import type ensures that they are removed by the compilers and avoids loading unnecessary modules.

  i Safe fix: Use import type.

    1 │ import·type·{·Handler·}·from·"aws-lambda";
      │        +++++

lint ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

  × Some warnings were emitted while running checks.
CHECKOV 
dockerfile scan results:

Passed checks: 55, Failed checks: 2, Skipped checks: 0

Check: CKV_DOCKER_2: "Ensure that HEALTHCHECK instructions have been added to container images"
	FAILED for resource: /lambda/Dockerfile.
	File: /lambda/Dockerfile:1-21
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/docker-policies/docker-policy-index/ensure-that-healthcheck-instructions-have-been-added-to-container-images

		1  | FROM public.ecr.aws/lambda/nodejs:24 AS base
		2  |
		3  | FROM base AS builder
		4  |
		5  | COPY ./package*.json ${LAMBDA_TASK_ROOT}
		6  |
		7  | RUN npm install
		8  |
		9  | COPY ./ ${LAMBDA_TASK_ROOT}
		10 |
		11 | RUN npm run build
		12 |
		13 | FROM base
		14 |
		15 | COPY --from=builder ${LAMBDA_TASK_ROOT}/package*.json ${LAMBDA_TASK_ROOT}
		16 |
		17 | RUN npm ci --only=production
		18 |
		19 | COPY --from=builder ${LAMBDA_TASK_ROOT}/build ${LAMBDA_TASK_ROOT}/build
		20 |
		21 | CMD [ "build/index.handler" ]
Check: CKV_DOCKER_3: "Ensure that a user for the container has been created"
	FAILED for resource: /lambda/Dockerfile.
	File: /lambda/Dockerfile:1-21
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/docker-policies/docker-policy-index/ensure-that-a-user-for-the-container-has-been-created

		1  | FROM public.ecr.aws/lambda/nodejs:24 AS base
		2  |
		3  | FROM base AS builder
		4  |
		5  | COPY ./package*.json ${LAMBDA_TASK_ROOT}
		6  |
		7  | RUN npm install
		8  |
		9  | COPY ./ ${LAMBDA_TASK_ROOT}
		10 |
		11 | RUN npm run build
		12 |
		13 | FROM base
		14 |
		15 | COPY --from=builder ${LAMBDA_TASK_ROOT}/package*.json ${LAMBDA_TASK_ROOT}
		16 |
		17 | RUN npm ci --only=production
		18 |
		19 | COPY --from=builder ${LAMBDA_TASK_ROOT}/build ${LAMBDA_TASK_ROOT}/build
		20 |
		21 | CMD [ "build/index.handler" ]
github_actions scan results:

Passed checks: 19, Failed checks: 1, Skipped checks: 0

Check: CKV2_GHA_1: "Ensure top-level permissions are not set to write-all"
	FAILED for resource: on(Deploy Lambda to AWS)
	File: /.github/workflows/deploy-lambda.yaml:19-20
GITHUB_ACTIONS_ZIZMOR 
�[1m�[96mhelp[artipacked]�[0m�[1m: credential persistence through GitHub Actions artifacts�[0m
  �[1m�[94m--> �[0m/github/workspace/.github/workflows/deploy-lambda.yaml:23:9
   �[1m�[94m|�[0m
�[1m�[94m23�[0m �[1m�[94m|�[0m         - name: Checkout repository
   �[1m�[94m|�[0m �[1m�[96m _________^�[0m
�[1m�[94m24�[0m �[1m�[94m|�[0m �[1m�[96m|�[0m         uses: actions/checkout@v6
   �[1m�[94m|�[0m �[1m�[96m|__________________________________^�[0m �[1m�[96mdoes not set persist-credentials: false�[0m
   �[1m�[94m|�[0m
   �[1m�[94m= �[0m�[1mnote�[0m: audit confidence → Low
   �[1m�[94m= �[0m�[1mnote�[0m: this finding has an auto-fix
   �[1m�[94m= �[0m�[1mhelp�[0m: audit documentation → �[32mhttps://docs.zizmor.sh/audits/#artipacked�[39m

�[1m�[91merror[unpinned-uses]�[0m�[1m: unpinned action reference�[0m
  �[1m�[94m--> �[0m/github/workspace/.github/workflows/deploy-lambda.yaml:24:15
   �[1m�[94m|�[0m
�[1m�[94m24�[0m �[1m�[94m|�[0m         uses: actions/checkout@v6
   �[1m�[94m|�[0m               �[1m�[91m^^^^^^^^^^^^^^^^^^^�[0m �[1m�[91maction is not pinned to a hash (required by blanket policy)�[0m
   �[1m�[94m|�[0m
   �[1m�[94m= �[0m�[1mnote�[0m: audit confidence → High
   �[1m�[94m= �[0m�[1mnote�[0m: this finding has an auto-fix
   �[1m�[94m= �[0m�[1mhelp�[0m: audit documentation → �[32mhttps://docs.zizmor.sh/audits/#unpinned-uses�[39m

�[1m�[91merror[unpinned-uses]�[0m�[1m: unpinned action reference�[0m
  �[1m�[94m--> �[0m/github/workspace/.github/workflows/linting.yaml:18:11
   �[1m�[94m|�[0m
�[1m�[94m18�[0m �[1m�[94m|�[0m     uses: daemon-labs-io/.github/.github/workflows/reusable-linting.yaml@main
   �[1m�[94m|�[0m           �[1m�[91m^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^�[0m �[1m�[91maction is not pinned to a hash (required by blanket policy)�[0m
   �[1m�[94m|�[0m
   �[1m�[94m= �[0m�[1mnote�[0m: audit confidence → High
   �[1m�[94m= �[0m�[1mnote�[0m: this finding has an auto-fix
   �[1m�[94m= �[0m�[1mhelp�[0m: audit documentation → �[32mhttps://docs.zizmor.sh/audits/#unpinned-uses�[39m

�[32m11�[39m findings (�[1m�[93m8�[39m suppressed, �[92m3�[39m fixable�[0m): �[35m0�[39m informational, �[36m1�[39m low, �[33m0�[39m medium, �[31m2�[39m high🌈 zizmor v1.22.0
�[32m INFO�[0m �[1maudit�[0m�[2m:�[0m �[2mzizmor�[0m�[2m:�[0m 🌈 completed /github/workspace/.github/workflows/deploy-lambda.yaml
�[32m INFO�[0m �[1maudit�[0m�[2m:�[0m �[2mzizmor�[0m�[2m:�[0m 🌈 completed /github/workspace/.github/workflows/linting.yaml
JSCPD 
Clone found (bash):
 - /github/workspace/_facilitator/cleanup-aws.sh [14:1 - 41:64] (27 lines, 144 tokens)
   /github/workspace/_facilitator/setup-aws.sh [14:1 - 41:63]

Clone found (bash):
 - /github/workspace/_facilitator/cleanup-aws.sh [14:1 - 41:64] (27 lines, 144 tokens)
   /github/workspace/_facilitator/setup-aws.sh [14:1 - 41:63]

 14 │ 14 │ # Parse arguments
 15 │ 15 │ while [[ $# -gt 0 ]]; do
 16 │ 16 │     case $1 in
 17 │ 17 │         -p|--profile)
 18 │ 18 │             AWS_PROFILE="$2"
 19 │ 19 │             shift 2
 20 │ 20 │             ;;
 21 │ 21 │         -r|--region)
 22 │ 22 │             AWS_REGION="$2"
 23 │ 23 │             shift 2
 24 │ 24 │             ;;
 25 │ 25 │         *)
 26 │ 26 │             echo "Usage: $0 [-p|--profile <profile>] [-r|--region <region>]"
 27 │ 27 │             exit 1
 28 │ 28 │             ;;
 29 │ 29 │     esac
 30 │ 30 │ done
 31 │ 31 │
 32 │ 32 │ # Helper function to run aws commands
 33 │ 33 │ aws_cmd() {
 34 │ 34 │     local cmd="aws"
 35 │ 35 │     if [[ -n "$AWS_PROFILE" ]]; then
 36 │ 36 │         cmd="$cmd --profile $AWS_PROFILE"
 37 │ 37 │     fi
 38 │ 38 │     $cmd "$@"
 39 │ 39 │ }
 40 │ 40 │
 41 │ 41 │ echo "🧹 Cleaning up GitHub Actions AWS Lambda Workshop Environment"

Found 1 clones.
Error: ERROR: jscpd found too many duplicates (2.47%) over threshold (0%)
    at ThresholdReporter.report (/node_modules/@jscpd/finder/dist/index.js:615:13)
    at /node_modules/@jscpd/finder/dist/index.js:109:18
    at Array.forEach (<anonymous>)
    at /node_modules/@jscpd/finder/dist/index.js:108:22
    at async /node_modules/jscpd/dist/bin/jscpd.js:9:5ERROR: jscpd found too many duplicates (2.47%) over threshold (0%)
SHELL_SHFMT 
diff /github/workspace/_facilitator/cleanup-aws.sh.orig /github/workspace/_facilitator/cleanup-aws.sh
--- /github/workspace/_facilitator/cleanup-aws.sh.orig
+++ /github/workspace/_facilitator/cleanup-aws.sh
@@ -13,29 +13,29 @@

 # Parse arguments
 while [[ $# -gt 0 ]]; do
-    case $1 in
-        -p|--profile)
-            AWS_PROFILE="$2"
-            shift 2
-            ;;
-        -r|--region)
-            AWS_REGION="$2"
-            shift 2
-            ;;
-        *)
-            echo "Usage: $0 [-p|--profile <profile>] [-r|--region <region>]"
-            exit 1
-            ;;
-    esac
+	case $1 in
+	-p | --profile)
+		AWS_PROFILE="$2"
+		shift 2
+		;;
+	-r | --region)
+		AWS_REGION="$2"
+		shift 2
+		;;
+	*)
+		echo "Usage: $0 [-p|--profile <profile>] [-r|--region <region>]"
+		exit 1
+		;;
+	esac
 done

 # Helper function to run aws commands
 aws_cmd() {
-    local cmd="aws"
-    if [[ -n "$AWS_PROFILE" ]]; then
-        cmd="$cmd --profile $AWS_PROFILE"
-    fi
-    $cmd "$@"
+	local cmd="aws"
+	if [[ -n "$AWS_PROFILE" ]]; then
+		cmd="$cmd --profile $AWS_PROFILE"
+	fi
+	$cmd "$@"
 }

 echo "🧹 Cleaning up GitHub Actions AWS Lambda Workshop Environment"
@@ -43,9 +43,9 @@
 echo ""

 # Check AWS CLI is installed and configured
-if ! command -v aws &> /dev/null; then
-    echo "❌ AWS CLI is not installed. Please install it first."
-    exit 1
+if ! command -v aws &>/dev/null; then
+	echo "❌ AWS CLI is not installed. Please install it first."
+	exit 1
 fi

 # Test AWS credentials
@@ -55,92 +55,92 @@

 # Clean up workshop Lambda functions
 echo "🗑️ Cleaning up workshop Lambda functions..."
-FUNCTIONS=$(aws_cmd lambda list-functions --query "Functions[?contains(Tags[?Key==`Workshop`].Value, `GitHubActions`)].FunctionName" --output text)
+FUNCTIONS=$(aws_cmd lambda list-functions --query "Functions[?contains(Tags[?Key==$(Workshop)].Value, $(GitHubActions))].FunctionName" --output text)

 if [ -n "$FUNCTIONS" ]; then
-    for FUNCTION_NAME in $FUNCTIONS; do
-        echo "Deleting function: $FUNCTION_NAME"
-
-        # Remove function URL if it exists
-        if aws_cmd lambda get-function-url-config --function-name "$FUNCTION_NAME" >/dev/null 2>&1; then
-            echo "  Removing function URL..."
-            aws_cmd lambda delete-function-url-config --function-name "$FUNCTION_NAME" 2>/dev/null || true
-        fi
-
-        # Delete the function
-        aws_cmd lambda delete-function --function-name "$FUNCTION_NAME"
-        echo "  ✅ Deleted"
-    done
-else
-    echo "✅ No workshop Lambda functions found"
+	for FUNCTION_NAME in $FUNCTIONS; do
+		echo "Deleting function: $FUNCTION_NAME"
+
+		# Remove function URL if it exists
+		if aws_cmd lambda get-function-url-config --function-name "$FUNCTION_NAME" >/dev/null 2>&1; then
+			echo "  Removing function URL..."
+			aws_cmd lambda delete-function-url-config --function-name "$FUNCTION_NAME" 2>/dev/null || true
+		fi
+
+		# Delete the function
+		aws_cmd lambda delete-function --function-name "$FUNCTION_NAME"
+		echo "  ✅ Deleted"
+	done
+else
+	echo "✅ No workshop Lambda functions found"
 fi
 echo ""

 # Clean up Lambda execution roles
 echo "🗑️ Cleaning up Lambda execution roles..."
-ROLES=$(aws_cmd iam list-roles --query "Roles[?contains(RoleName, `workshop-lambda`) || contains(RoleName, `WorkshopLambda`)].RoleName" --output text)
+ROLES=$(aws_cmd iam list-roles --query "Roles[?contains(RoleName, $(workshop-lambda)) || contains(RoleName, $(WorkshopLambda))].RoleName" --output text)

 if [ -n "$ROLES" ]; then
-    for ROLE_NAME in $ROLES; do
-        echo "Detaching policies from role: $ROLE_NAME"
-
-        # List and detach all policies
-        POLICIES=$(aws_cmd iam list-attached-role-policies --role-name "$ROLE_NAME" --query 'AttachedPolicies[].PolicyArn' --output text)
-        for POLICY_ARN in $POLICIES; do
-            aws_cmd iam detach-role-policy --role-name "$ROLE_NAME" --policy-arn "$POLICY_ARN"
-        done
-
-        # List and delete all inline policies
-        INLINE_POLICIES=$(aws_cmd iam list-role-policies --role-name "$ROLE_NAME" --query 'PolicyNames[]' --output text)
-        for INLINE_POLICY in $INLINE_POLICIES; do
-            aws_cmd iam delete-role-policy --role-name "$ROLE_NAME" --policy-name "$INLINE_POLICY"
-        done
-
-        # Delete the role
-        aws_cmd iam delete-role --role-name "$ROLE_NAME"
-        echo "  ✅ Deleted role: $ROLE_NAME"
-    done
-else
-    echo "✅ No Lambda execution roles found"
+	for ROLE_NAME in $ROLES; do
+		echo "Detaching policies from role: $ROLE_NAME"
+
+		# List and detach all policies
+		POLICIES=$(aws_cmd iam list-attached-role-policies --role-name "$ROLE_NAME" --query 'AttachedPolicies[].PolicyArn' --output text)
+		for POLICY_ARN in $POLICIES; do
+			aws_cmd iam detach-role-policy --role-name "$ROLE_NAME" --policy-arn "$POLICY_ARN"
+		done
+
+		# List and delete all inline policies
+		INLINE_POLICIES=$(aws_cmd iam list-role-policies --role-name "$ROLE_NAME" --query 'PolicyNames[]' --output text)
+		for INLINE_POLICY in $INLINE_POLICIES; do
+			aws_cmd iam delete-role-policy --role-name "$ROLE_NAME" --policy-name "$INLINE_POLICY"
+		done
+
+		# Delete the role
+		aws_cmd iam delete-role --role-name "$ROLE_NAME"
+		echo "  ✅ Deleted role: $ROLE_NAME"
+	done
+else
+	echo "✅ No Lambda execution roles found"
 fi
 echo ""

 # Clean up workshop policies
 echo "🗑️ Cleaning up workshop policies..."
-POLICIES=$(aws_cmd iam list-policies --scope Local --query "Policies[?contains(PolicyName, `LambdaWorkshop`) || contains(PolicyName, `workshop-lambda`)].Arn" --output text)
+POLICIES=$(aws_cmd iam list-policies --scope Local --query "Policies[?contains(PolicyName, $(LambdaWorkshop)) || contains(PolicyName, $(workshop-lambda))].Arn" --output text)

 if [ -n "$POLICIES" ]; then
-    for POLICY_ARN in $POLICIES; do
-        POLICY_NAME=$(basename "$POLICY_ARN")
-        echo "Deleting policy: $POLICY_NAME"
-
-        # Get all roles and detach this policy
-        ROLE_NAMES=$(aws_cmd iam list-entities-for-policy --policy-arn "$POLICY_ARN" --query 'PolicyRoles[].RoleName' --output text)
-        for ROLE_NAME in $ROLE_NAMES; do
-            aws_cmd iam detach-role-policy --role-name "$ROLE_NAME" --policy-arn "$POLICY_ARN"
-        done
-
-        # Delete the policy
-        aws_cmd iam delete-policy --policy-arn "$POLICY_ARN"
-        echo "  ✅ Deleted policy: $POLICY_NAME"
-    done
-else
-    echo "✅ No workshop policies found"
+	for POLICY_ARN in $POLICIES; do
+		POLICY_NAME=$(basename "$POLICY_ARN")
+		echo "Deleting policy: $POLICY_NAME"
+
+		# Get all roles and detach this policy
+		ROLE_NAMES=$(aws_cmd iam list-entities-for-policy --policy-arn "$POLICY_ARN" --query 'PolicyRoles[].RoleName' --output text)
+		for ROLE_NAME in $ROLE_NAMES; do
+			aws_cmd iam detach-role-policy --role-name "$ROLE_NAME" --policy-arn "$POLICY_ARN"
+		done
+
+		# Delete the policy
+		aws_cmd iam delete-policy --policy-arn "$POLICY_ARN"
+		echo "  ✅ Deleted policy: $POLICY_NAME"
+	done
+else
+	echo "✅ No workshop policies found"
 fi
 echo ""

 # Clean up log groups
 echo "🗑️ Cleaning up log groups..."
-LOG_GROUPS=$(aws_cmd logs describe-log-groups --log-group-name-prefix '/aws/lambda/' --query "logGroups[?contains(logGroupName, `workshop-lambda`) || contains(logGroupName, `-workshop-lambda`)].logGroupName" --output text)
+LOG_GROUPS=$(aws_cmd logs describe-log-groups --log-group-name-prefix '/aws/lambda/' --query "logGroups[?contains(logGroupName, $(workshop-lambda)) || contains(logGroupName, $(-workshop-lambda))].logGroupName" --output text)

 if [ -n "$LOG_GROUPS" ]; then
-    for LOG_GROUP in $LOG_GROUPS; do
-        echo "Deleting log group: $LOG_GROUP"
-        aws_cmd logs delete-log-group --log-group-name "$LOG_GROUP"
-        echo "  ✅ Deleted"
-    done
-else
-    echo "✅ No workshop log groups found"
+	for LOG_GROUP in $LOG_GROUPS; do
+		echo "Deleting log group: $LOG_GROUP"
+		aws_cmd logs delete-log-group --log-group-name "$LOG_GROUP"
+		echo "  ✅ Deleted"
+	done
+else
+	echo "✅ No workshop log groups found"
 fi
 echo ""

diff /github/workspace/_facilitator/setup-aws.sh.orig /github/workspace/_facilitator/setup-aws.sh
--- /github/workspace/_facilitator/setup-aws.sh.orig
+++ /github/workspace/_facilitator/setup-aws.sh
@@ -13,29 +13,29 @@

 # Parse arguments
 while [[ $# -gt 0 ]]; do
-    case $1 in
-        -p|--profile)
-            AWS_PROFILE="$2"
-            shift 2
-            ;;
-        -r|--region)
-            AWS_REGION="$2"
-            shift 2
-            ;;
-        *)
-            echo "Usage: $0 [-p|--profile <profile>] [-r|--region <region>]"
-            exit 1
-            ;;
-    esac
+	case $1 in
+	-p | --profile)
+		AWS_PROFILE="$2"
+		shift 2
+		;;
+	-r | --region)
+		AWS_REGION="$2"
+		shift 2
+		;;
+	*)
+		echo "Usage: $0 [-p|--profile <profile>] [-r|--region <region>]"
+		exit 1
+		;;
+	esac
 done

 # Helper function to run aws commands
 aws_cmd() {
-    local cmd="aws"
-    if [[ -n "$AWS_PROFILE" ]]; then
-        cmd="$cmd --profile $AWS_PROFILE"
-    fi
-    $cmd "$@"
+	local cmd="aws"
+	if [[ -n "$AWS_PROFILE" ]]; then
+		cmd="$cmd --profile $AWS_PROFILE"
+	fi
+	$cmd "$@"
 }

 echo "🚀 Setting up GitHub Actions AWS Lambda Workshop Environment"
@@ -43,9 +43,9 @@
 echo ""

 # Check AWS CLI is installed and configured
-if ! command -v aws &> /dev/null; then
-    echo "❌ AWS CLI is not installed. Please install it first."
-    exit 1
+if ! command -v aws &>/dev/null; then
+	echo "❌ AWS CLI is not installed. Please install it first."
+	exit 1
 fi

 # Test AWS credentials
@@ -59,14 +59,14 @@
 GITHUB_OIDC_PROVIDER_ARN="arn:aws:iam::${ACCOUNT_ID}:oidc-provider/token.actions.githubusercontent.com"

 if ! aws_cmd iam get-open-id-connect-provider --open-id-connect-provider-arn "$GITHUB_OIDC_PROVIDER_ARN" 2>/dev/null; then
-    echo "Creating GitHub OIDC provider..."
-    aws_cmd iam create-open-id-connect-provider \
-        --url https://token.actions.githubusercontent.com \
-        --client-id-list sts.amazonaws.com \
-        --thumbprint-list 6938fd4d98bab03faadb97b34396831e3780aea1
-    echo "✅ GitHub OIDC provider created"
-else
-    echo "✅ GitHub OIDC provider already exists"
+	echo "Creating GitHub OIDC provider..."
+	aws_cmd iam create-open-id-connect-provider \
+		--url https://token.actions.githubusercontent.com \
+		--client-id-list sts.amazonaws.com \
+		--thumbprint-list 6938fd4d98bab03faadb97b34396831e3780aea1
+	echo "✅ GitHub OIDC provider created"
+else
+	echo "✅ GitHub OIDC provider already exists"
 fi
 echo ""

@@ -74,7 +74,7 @@
 echo "🔐 Creating GitHub Actions role: $WORKSHOP_ROLE_NAME"

 # Create trust policy for GitHub Actions
-cat > trust-policy.json << EOF
+cat >trust-policy.json <<EOF
 {
     "Version": "2012-10-17",
     "Statement": [
@@ -95,7 +95,7 @@
 EOF

 # Create permissions policy for workshop
-cat > workshop-permissions.json << EOF
+cat >workshop-permissions.json <<EOF
 {
     "Version": "2012-10-17",
     "Statement": [
@@ -132,26 +132,26 @@

 # Check if role already exists
 if ! aws_cmd iam get-role --role-name $WORKSHOP_ROLE_NAME 2>/dev/null; then
-    echo "Creating GitHub Actions role..."
-    aws_cmd iam create-role \
-        --role-name $WORKSHOP_ROLE_NAME \
-        --assume-role-policy-document file://trust-policy.json \
-        --description "GitHub Actions role for Lambda workshop" \
-        --tags Key=Workshop,Value=GitHubActions
-
-    # Attach permissions
-    aws_cmd iam put-role-policy \
-        --role-name $WORKSHOP_ROLE_NAME \
-        --policy-name "LambdaWorkshopPermissions" \
-        --policy-document file://workshop-permissions.json
-
-    echo "✅ GitHub Actions role created"
-else
-    echo "✅ GitHub Actions role already exists, updating permissions..."
-    aws_cmd iam put-role-policy \
-        --role-name $WORKSHOP_ROLE_NAME \
-        --policy-name "LambdaWorkshopPermissions" \
-        --policy-document file://workshop-permissions.json
+	echo "Creating GitHub Actions role..."
+	aws_cmd iam create-role \
+		--role-name $WORKSHOP_ROLE_NAME \
+		--assume-role-policy-document file://trust-policy.json \
+		--description "GitHub Actions role for Lambda workshop" \
+		--tags Key=Workshop,Value=GitHubActions
+
+	# Attach permissions
+	aws_cmd iam put-role-policy \
+		--role-name $WORKSHOP_ROLE_NAME \
+		--policy-name "LambdaWorkshopPermissions" \
+		--policy-document file://workshop-permissions.json
+
+	echo "✅ GitHub Actions role created"
+else
+	echo "✅ GitHub Actions role already exists, updating permissions..."
+	aws_cmd iam put-role-policy \
+		--role-name $WORKSHOP_ROLE_NAME \
+		--policy-name "LambdaWorkshopPermissions" \
+		--policy-document file://workshop-permissions.json
 fi

 WORKSHOP_ROLE_ARN="arn:aws:iam::${ACCOUNT_ID}:role/${WORKSHOP_ROLE_NAME}"
@@ -162,7 +162,7 @@
 echo "🏗️ Creating Lambda execution role: $LAMBDA_EXECUTION_ROLE_NAME"

 # Create Lambda execution trust policy
-cat > lambda-trust-policy.json << EOF
+cat >lambda-trust-policy.json <<EOF
 {
     "Version": "2012-10-17",
     "Statement": [
@@ -178,7 +178,7 @@
 EOF

 # Create Lambda execution permissions
-cat > lambda-execution-permissions.json << EOF
+cat >lambda-execution-permissions.json <<EOF
 {
     "Version": "2012-10-17",
     "Statement": [
@@ -203,27 +203,27 @@
 EOF

 if ! aws_cmd iam get-role --role-name $LAMBDA_EXECUTION_ROLE_NAME 2>/dev/null; then
-    echo "Creating Lambda execution role..."
-    aws_cmd iam create-role \
-        --role-name $LAMBDA_EXECUTION_ROLE_NAME \
-        --assume-role-policy-document file://lambda-trust-policy.json \
-        --description "Lambda execution role for workshop" \
-        --max-session-duration 3600 \
-        --tags Key=Workshop,Value=GitHubActions
-
-    # Attach permissions
-    aws_cmd iam put-role-policy \
-        --role-name $LAMBDA_EXECUTION_ROLE_NAME \
-        --policy-name "LambdaWorkshopExecutionPermissions" \
-        --policy-document file://lambda-execution-permissions.json
-
-    echo "✅ Lambda execution role created"
-else
-    echo "✅ Lambda execution role already exists, updating permissions..."
-    aws_cmd iam put-role-policy \
-        --role-name $LAMBDA_EXECUTION_ROLE_NAME \
-        --policy-name "LambdaWorkshopExecutionPermissions" \
-        --policy-document file://lambda-execution-permissions.json
+	echo "Creating Lambda execution role..."
+	aws_cmd iam create-role \
+		--role-name $LAMBDA_EXECUTION_ROLE_NAME \
+		--assume-role-policy-document file://lambda-trust-policy.json \
+		--description "Lambda execution role for workshop" \
+		--max-session-duration 3600 \
+		--tags Key=Workshop,Value=GitHubActions
+
+	# Attach permissions
+	aws_cmd iam put-role-policy \
+		--role-name $LAMBDA_EXECUTION_ROLE_NAME \
+		--policy-name "LambdaWorkshopExecutionPermissions" \
+		--policy-document file://lambda-execution-permissions.json
+
+	echo "✅ Lambda execution role created"
+else
+	echo "✅ Lambda execution role already exists, updating permissions..."
+	aws_cmd iam put-role-policy \
+		--role-name $LAMBDA_EXECUTION_ROLE_NAME \
+		--policy-name "LambdaWorkshopExecutionPermissions" \
+		--policy-document file://lambda-execution-permissions.json
 fi

 LAMBDA_EXECUTION_ROLE_ARN="arn:aws:iam::${ACCOUNT_ID}:role/${LAMBDA_EXECUTION_ROLE_NAME}"
TRIVY 

Report Summary

┌───────────────────┬────────────┬─────────────────┬───────────────────┬─────────┐
│      Target       │    Type    │ Vulnerabilities │ Misconfigurations │ Secrets │
├───────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ lambda/Dockerfile │ dockerfile │        -        │         2         │    -    │
└───────────────────┴────────────┴─────────────────┴───────────────────┴─────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)


lambda/Dockerfile (dockerfile)
==============================
Tests: 27 (SUCCESSES: 25, FAILURES: 2)
Failures: 2 (UNKNOWN: 0, LOW: 1, MEDIUM: 0, HIGH: 1, CRITICAL: 0)

DS-0002 (HIGH): Specify at least 1 USER command in Dockerfile with non-root user as argument
════════════════════════════════════════
Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile.

See https://avd.aquasec.com/misconfig/ds-0002
────────────────────────────────────────


DS-0026 (LOW): Add HEALTHCHECK instruction in your Dockerfile
════════════════════════════════════════
You should add HEALTHCHECK instruction in your docker container images to perform the health check on running containers.

See https://avd.aquasec.com/misconfig/ds-0026
────────────────────────────────────────
TYPESCRIPT_ES 

Oops! Something went wrong! :(

ESLint: 9.39.2

Error: Error while loading rule 'n/no-extraneous-import': File '@tsconfig/recommended/tsconfig.json' not found.
Occurred while linting /github/workspace/lambda/src/index.ts
    at resolveExtends (/node_modules/get-tsconfig/dist/index.cjs:7:6813)
    at _parseTsconfig (/node_modules/get-tsconfig/dist/index.cjs:7:7778)
    at parseTsconfig (/node_modules/get-tsconfig/dist/index.cjs:7:11396)
    at getTsconfig (/node_modules/get-tsconfig/dist/index.cjs:7:11950)
    at getTSConfigForFile (/node_modules/eslint-plugin-n/lib/util/get-tsconfig.js:24:12)
    at getTSConfigForContext (/node_modules/eslint-plugin-n/lib/util/get-tsconfig.js:36:12)
    at getTryExtensions (/node_modules/eslint-plugin-n/lib/util/get-try-extensions.js:70:9)
    at visitImport (/node_modules/eslint-plugin-n/lib/util/visit-import.js:44:24)
    at Object.create (/node_modules/eslint-plugin-n/lib/rules/no-extraneous-import.js:45:16)
    at createRuleListeners (/node_modules/eslint/lib/linter/linter.js:1019:15)

@garyrutland
garyrutland deleted the gary-workshop branch February 25, 2026 20:45
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@garyrutland