Cannot vendor github-actions-iam-role mixin

[jochem725]

On our latest reference architecture version, the vendor workflow fails when trying to vendor the github-actions-iam-role mixin.

# 'ecr' component vendoring config

# 'component.yaml' in the component folder is processed by the 'atmos' commands
# 'atmos vendor pull -c ecr' or 'atmos vendor pull --component ecr'

apiVersion: atmos/v1
kind: ComponentVendorConfig
spec:
  source:
    # 'uri' supports all protocols (local files, Git, Mercurial, HTTP, HTTPS, Amazon S3, Google GCP),
    # and all URL and archive formats as described in https://github.com/hashicorp/go-getter
    # In 'uri', Golang templates are supported  https://pkg.go.dev/text/template
    # If 'version' is provided, '{{ .Version }}' will be replaced with the 'version' value before pulling the files from 'uri'
    uri: github.com/cloudposse-terraform-components/aws-ecr.git//src?ref={{ .Version }}
    version: v1.538.4
    # Only include the files that match the 'included_paths' patterns
    # If 'included_paths' is not specified, all files will be matched except those that match the patterns from 'excluded_paths'
    # 'included_paths' support POSIX-style Globs for file names/paths (double-star `**` is supported)
    # https://en.wikipedia.org/wiki/Glob_(programming)
    # https://github.com/bmatcuk/doublestar#patterns
    included_paths:
      - "**/**"
    # Exclude the files that match any of the 'excluded_paths' patterns
    # Note that we are excluding 'context.tf' since a newer version of it will be downloaded using 'mixins'
    # 'excluded_paths' support POSIX-style Globs for file names/paths (double-star `**` is supported)
    excluded_paths: []
  # Mixins override files from 'source' with the same 'filename' (e.g. 'context.tf' will override 'context.tf' from the 'source')
  # All mixins are processed in the order they are declared in the list.
  mixins:
    # https://github.com/hashicorp/go-getter/issues/98
    - uri: https://raw.githubusercontent.com/cloudposse-terraform-components/mixins/{{ .Version }}/src/mixins/github-actions-iam-role/github-actions-iam-role.mixin.tf
      version: v1.538.4
      filename: github-actions-iam-role.mixin.tf
    - uri: https://raw.githubusercontent.com/cloudposse-terraform-components/aws-ecr/refs/tags/{{ .Version }}/mixins/github-actions-iam-policy.tf
      version: v1.538.4
      filename: github-actions-iam-policy.tf

If I update the version to v0.1.0 I can successfully pull the components (as found in this readme https://github.com/cloudposse-terraform-components/mixins)

Is this the correct approach?

[milldr]

Good catch, that's a mistake in the vendor config. The shared GitHub OIDC role mixin lives in the separate cloudposse-terraform-components/mixins repo and uses its own versioning, not the component’s version. The correct approach is to pin the mixin to its repo version (e.g., v0.1.0) while keeping the ECR component at v1.538.4.

apiVersion: atmos/v1
kind: ComponentVendorConfig
spec:
  source:
    # 'uri' supports all protocols (local files, Git, Mercurial, HTTP, HTTPS, Amazon S3, Google GCP),
    # and all URL and archive formats as described in https://github.com/hashicorp/go-getter
    # In 'uri', Golang templates are supported  https://pkg.go.dev/text/template
    # If 'version' is provided, '{{ .Version }}' will be replaced with the 'version' value before pulling the files from 'uri'
    uri: github.com/cloudposse-terraform-components/aws-ecr.git//src?ref={{ .Version }}
    version: v1.538.4
    # Only include the files that match the 'included_paths' patterns
    # If 'included_paths' is not specified, all files will be matched except those that match the patterns from 'excluded_paths'
    # 'included_paths' support POSIX-style Globs for file names/paths (double-star `**` is supported)
    # https://en.wikipedia.org/wiki/Glob_(programming)
    # https://github.com/bmatcuk/doublestar#patterns
    included_paths:
      - "**/**"
    # Exclude the files that match any of the 'excluded_paths' patterns
    # Note that we are excluding 'context.tf' since a newer version of it will be downloaded using 'mixins'
    # 'excluded_paths' support POSIX-style Globs for file names/paths (double-star `**` is supported)
    excluded_paths: []
  # Mixins override files from 'source' with the same 'filename' (e.g. 'context.tf' will override 'context.tf' from the 'source')
  # All mixins are processed in the order they are declared in the list.
  mixins:
    # https://github.com/hashicorp/go-getter/issues/98
    - uri: https://raw.githubusercontent.com/cloudposse-terraform-components/mixins/{{ .Version }}/src/mixins/github-actions-iam-role/github-actions-iam-role.mixin.tf
      version: v0.1.0
      filename: github-actions-iam-role.mixin.tf
    - uri: https://raw.githubusercontent.com/cloudposse-terraform-components/aws-ecr/refs/tags/{{ .Version }}/mixins/github-actions-iam-policy.tf
      version: v1.538.4
      filename: github-actions-iam-policy.tf