feat(ci): Change pipeline to use GIthub App auth

Author: HarrisonDuffield

infrastructure/lib/pipeline-stack.ts

@@ -15,7 +15,6 @@ import {
 	aws_kms as kms,
 } from "aws-cdk-lib";
 import { DocTranAppStage } from "./pipeline-app-stage";
-import { GitHubTrigger } from "aws-cdk-lib/aws-codepipeline-actions";
 import { Config } from "./types";
 import { loadConfig } from "../util/loadConfig";
 
@@ -78,21 +77,21 @@ export class pipelineStack extends cdk.Stack {
 		});
 
 		// SOURCE
-		const oauthToken = cdk.SecretValue.secretsManager(
-			`doctran-${config.common.instance.name}-oauth-token`,
-		);
-		const pipelineTrigger: GitHubTrigger = config.pipeline.source.repoHook
-			.enable
-			? GitHubTrigger.WEBHOOK
-			: GitHubTrigger.POLL;
+		if (!config.pipeline.source.connectionArn) {
+			throw new Error(
+				`Connection ARN is required. Please set it in SSM Parameter Store at: /doctran/${config.common.instance.name}/pipeline/source/connectionArn`
+			);
+		}
+		const connectionArn = config.pipeline.source.connectionArn;
+		
 		const actionName = "Source";
-		const pipelineSource = cdkpipelines.CodePipelineSource.gitHub(
+		const pipelineSource = cdkpipelines.CodePipelineSource.connection(
 			sourceRepo,
 			config.pipeline.source.repoBranch,
 			{
 				actionName: actionName,
-				trigger: pipelineTrigger,
-				authentication: oauthToken,
+				connectionArn: connectionArn,
+				triggerOnPush: config.pipeline.source.repoHook.enable,
 			},
 		);
 
@@ -110,6 +109,18 @@ export class pipelineStack extends cdk.Stack {
 			pipelineType: codepipeline.PipelineType.V2,
 		});
 
+		// Add CodeConnections permissions to the pipeline role
+		pipeline.role.addToPrincipalPolicy(
+			new iam.PolicyStatement({
+				effect: iam.Effect.ALLOW,
+				actions: [
+					"codeconnections:UseConnection",
+					"codestar-connections:UseConnection"
+				],
+				resources: [connectionArn],
+			}),
+		);
+
 		const getConfigOutput = new codepipeline.Artifact("GetConfigOutput");
 
 		const dirPipeline = "infrastructure";

infrastructure/lib/types.ts

@@ -22,6 +22,7 @@ export type PipelineConfig = {
 		};
 		repoName: string;
 		repoOwner: string;
+		connectionArn?: string;
 	};
 };