kick-codebuild.yaml

name: Call and execute AWS CodeBuild
on:
  workflow_call:
    inputs:
      aws_account_id:
        required: true
        type: string
      codebuild_project_name:
        required: true
        type: string
      codebuild_buildspec:
        required: false
        type: string
        default: buildspec.yml
      timeout_minutes:
        required: false
        type: number
        default: 10
      platform:
        required: false
        type: string
        default: ubuntu-latest

jobs:
  execute:
    runs-on: ${{ inputs.platform }}
    timeout-minutes: ${{ inputs.timeout_minutes }}
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 1
          # pull_request_review イベントではデフォルトで merge commit が checkout されるが、
          # CodeBuild は ephemeral な merge commit の SHA を fetch できないため失敗する。
          # pull_request_review 時は PR HEAD の SHA を明示的に指定する。
          ref: ${{ github.event_name == 'pull_request_review' && github.event.pull_request.head.sha || '' }}
      - name: configure aws credentials
        uses: aws-actions/configure-aws-credentials@ec61189d14ec14c8efccab744f656cffd0e33f37 # v6.1.0
        with:
          role-to-assume: arn:aws:iam::${{ inputs.aws_account_id }}:role/codebuild-github-actions-role
          aws-region: ap-northeast-1
          mask-aws-account-id: false
      - name: Execute CodeBuild
        uses: aws-actions/aws-codebuild-run-build@7e46c3fa1c1f217e26a73712796b1f78938b534b # v1.0.19
        with:
          project-name: ${{ inputs.codebuild_project_name }}
          buildspec-override: ${{ inputs.codebuild_buildspec }}