pipelines: Provide means to link publish and deploy stages

[danieljamesscott]

Describe the feature

I would like to be able to specify a role during pipeline.addStage(), which is assumed prior to publication, and deployment. Alternatively, I would like the ability to link the publish stage with the deployment stage using some sort of name/identifier.

Use Case

I am trying to use GitHub actions with CDK pipelines: https://github.com/cdklabs/cdk-pipelines-github/

I have run into an issue where I would like to link the "publish" stages with the "deploy" stages, so that I can permit GitHub actions to assume a role in the correct account during the "publish" stage. cdklabs/cdk-pipelines-github#302

I am aware that when using CodePipeline, the account executing the pipeline would be bootstrapped into the target accounts as a trusted entity. However, when using GitHub actions to execute the pipeline, there is no "pipeline" account, and it seems overkill to create an entire AWS account, simply to handle the initial role authentication.

Proposed Solution

No response

Other Information

No response

Acknowledgements

• I may be able to implement this feature request
• This feature might incur a breaking change

CDK version used

2.40.0

Environment details (OS name and version, etc.)

macOS

[rix0rrr]

Since this issue is specifically about CDK Pipelines for GitHub, create the issue there instead of here: https://github.com/cdklabs/cdk-pipelines-github/

I also have to confess I don't quite understand what the request is. If the request is about allowing GitHub to access your account, the README has instructions on how to set this up. You don't necessarily need a separate pipeline account, you can directly link the account you're deploying into. You need to do a one-off deployment using cdk deploy into the target account to deploy a stack with the GitHubActionRole construct: https://github.com/cdklabs/cdk-pipelines-github/#githubactionrole-construct

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.