Backlog の Git リポジトリをソースとした Docker イメージのビルドパイプラインを作ってみた

version: 0.2
env:
  variables:
    DOCKER_BUILDKIT: "1"
    AWS_PAGER: ""

phases:
  install:
    commands:
      - pip3 install git-remote-codecommit
  pre_build:
    commands:
      - eval $(ssh-agent)
      - ssh-add - <<< "$BACKLOG_GIT_CREDENTIAL"
      - ssh-keyscan $BACKLOG_SPACE_ID.git.$BACKLOG_DOMAIN_NAME >> ~/.ssh/known_hosts
  build:
    commands:
      - echo Cloning repository ...
      - git clone $BACKLOG_SPACE_ID@$BACKLOG_SPACE_ID.git.$BACKLOG_DOMAIN_NAME:/$BACKLOG_PROJECT_KEY/$BACKLOG_REPOSITORY_NAME.git
      - cd $BACKLOG_REPOSITORY_NAME
      - COMMIT_HASH=$(git log -n 1 --pretty=format:"%H" | cut -c 1-10)
      - IMAGE_TAG=${COMMIT_HASH:=latest}
      - echo Build started on `date`
      - echo Building Docker image...
      - docker image build -f docker/Dockerfile -t $AWS_ACCOUNT_ID.dkr.ecr.$AWS_DEFAULT_REGION.amazonaws.com/$ECR_REPOSITORY_NAME:$IMAGE_TAG docker
  post_build:
    commands:
      - echo Build completed on `date`
      - echo Logging in to Amazon ECR...
      - aws ecr get-login-password --region $AWS_DEFAULT_REGION | docker login --username AWS --password-stdin $AWS_ACCOUNT_ID.dkr.ecr.$AWS_DEFAULT_REGION.amazonaws.com
      - echo Pushing Docker image...
      - docker image push $AWS_ACCOUNT_ID.dkr.ecr.$AWS_DEFAULT_REGION.amazonaws.com/$ECR_REPOSITORY_NAME:$IMAGE_TAG
      - printf '{"ImageURI":"%s"}' $AWS_ACCOUNT_ID.dkr.ecr.$AWS_DEFAULT_REGION.amazonaws.com/$ECR_REPOSITORY_NAME:$IMAGE_TAG > $CODEBUILD_SRC_DIR/imageDetail.json
      - cd codesries_asset
      - sed -i -e "s#<TASK_FAMILY>#${TASK_FAMILY}#" taskdef.json
      - sed -i -e "s#<TASK_EXECUTION_ROLE_ARN>#${TASK_EXECUTION_ROLE_ARN}#" taskdef.json
      - sed -i -e "s#<CONTAINER_NAME>#${CONTAINER_NAME}#" taskdef.json
      - sed -i -e "s#<AWS_DEFAULT_REGION>#${AWS_DEFAULT_REGION}#" taskdef.json
      - sed -i -e "s#<LOG_GROUP_NAME>#${LOG_GROUP_NAME}#" taskdef.json
      - sed -i -e "s#<LOG_STREAM_PREFIX>#${LOG_STREAM_PREFIX}#" taskdef.json
      - sed -i -e "s#<CONTAINER_NAME>#${CONTAINER_NAME}#" appspec.yaml
      - cp -p taskdef.json $CODEBUILD_SRC_DIR/
      - cp -p appspec.yaml $CODEBUILD_SRC_DIR/
artifacts:
  files:
    - imageDetail.json
    - taskdef.json
    - appspec.yaml

cache:
  paths:
    - /root/.cache/pip/**/*

resource "aws_secretsmanager_secret" "backlog_info" {
  name                    = "${local.prefix}/backlog_info"
  recovery_window_in_days = 0
  policy = templatefile("${path.module}/iam_policy_document/resource_secretsmanager.json", {
    role_arn = aws_iam_role.codebuild.arn
  })
}

resource "aws_secretsmanager_secret_version" "backlog_info" {
  secret_id = aws_secretsmanager_secret.backlog_info.id
  secret_string = jsonencode({
    space_id        = var.backlog.space_id
    domain_name     = var.backlog.domain_name
    project_key     = var.backlog.project_key
    repository_name = var.backlog.repository_name
    ssh_key         = tls_private_key.backlog.private_key_pem
  })

  lifecycle {
    ignore_changes = [
      secret_string
    ]
  }
}

variable "system" {
  type    = string
  default = "backlog"
}

variable "env" {
  type    = string
  default = "cicd"
}

variable "cidr" {
  default = {
    vpc       = "192.168.0.0/16"
    public_a  = "192.168.0.0/24"
    public_c  = "192.168.1.0/24"
    private_a = "192.168.2.0/24"
    private_c = "192.168.3.0/24"
  }
}

variable "backlog" {
  default = {
    space_id        = "" # htts://sample.backlog.jp の sample の部分
    domain_name     = "" # backlog.jp または backlog.com
    project_key     = "" # https://backlog.com/ja/enterprise-help/userguide/userguide353/
    repository_name = "" # Backlog Git のレポジトリ名
    webhook_ip = [
      "54.248.107.22/32",
      "54.248.105.89/32",
      "54.238.168.195/32",
      "52.192.66.90/32",
      "54.65.251.183/32",
      "54.250.148.49/32",
      "35.166.55.243/32",
      "50.112.242.159/32",
      "52.199.112.83/32",
      "35.73.201.244/32",
      "35.72.166.154/32",
      "35.73.143.41/32",
      "35.74.201.20/32",
      "52.198.115.185/32",
      "35.165.230.177/32",
      "18.236.6.123/32",
    ] # https://support-ja.backlog.com/hc/ja/articles/360035645534-Webhook-%E9%80%81%E4%BF%A1%E3%82%B5%E3%83%BC%E3%83%90%E3%83%BC%E3%81%AE-IP-%E3%82%A2%E3%83%89%E3%83%AC%E3%82%B9%E3%82%92%E6%95%99%E3%81%88%E3%81%A6%E3%81%8F%E3%81%A0%E3%81%95%E3%81%84
  }
}

terraform init
terraform plan
terraform apply

BACKLOG_GIT_REPO
├── codesries_asset
│   ├── appspec.yaml
│   └── taskdef.json
└── docker
    └── Dockerfile

cp -pR backlog-git-docker-build/BACKLOG_GIT_REPO/* {BACKLOG_GITのレポジトリ名}/
cd {BACKLOG_GITのレポジトリ名}/
git add .
git commit -m 'ADD docker image build asset.'
git push

cd backlog-git-docker-build
terraform destroy