{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Federated": "arn:aws:iam::xxxxxxxxxxxx:oidc-provider/token.actions.githubusercontent.com"
      },
      "Action": "sts:AssumeRoleWithWebIdentity",
      "Condition": {
        "StringEquals": {
          "token.actions.githubusercontent.com:aud": "sigstore"
        }
      }
    }
  ]
}

name: Deploy to AWS Batch

on:
  push:
    branches:
      - dev

env:
  AWS_REGION: ap-northeast-1
  AWS_ROLE_ARN: arn:aws:iam::xxxxxxxxxxxx:role/GithubActionsDeployRole
  AWS_WEB_IDENTITY_TOKEN_FILE: /tmp/awscreds
  ECR_REPOSITORY: test-repository
  BATCH_JOB_DEFINITION: aws/batch/job-definition.json
  BATCH_JOB_DEFINITION_TEMPLATE: aws/batch/job-definition-template.json

jobs:
  deploy:
    name: Deploy
    runs-on: ubuntu-latest
    environment: production
    permissions:
      id-token: write
      contents: read

    steps:
    - name: Checkout
      uses: actions/checkout@v2

    - name: Configure AWS
      run: |
        echo AWS_WEB_IDENTITY_TOKEN_FILE=$AWS_WEB_IDENTITY_TOKEN_FILE >> $GITHUB_ENV
        echo AWS_ROLE_ARN=$AWS_ROLE_ARN >> $GITHUB_ENV
        echo AWS_DEFAULT_REGION=$AWS_REGION >> $GITHUB_ENV
        curl --silent -H "Authorization: bearer ${ACTIONS_ID_TOKEN_REQUEST_TOKEN}" "${ACTIONS_ID_TOKEN_REQUEST_URL}&audience=sigstore" | jq -r '.value' > $AWS_WEB_IDENTITY_TOKEN_FILE

    - name: Login to Amazon ECR
      id: login-ecr
      uses: aws-actions/amazon-ecr-login@v1

permissions:
  id-token: write
  contents: read

- name: Configure AWS credentials
  uses: aws-actions/configure-aws-credentials@v1
  with:
    aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
    aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
    aws-region: ${{ env.AWS_REGION }}

- name: Login to Amazon ECR
  id: login-ecr
  uses: aws-actions/amazon-ecr-login@v1

- name: Build, tag, and push image to Amazon ECR
  id: build-image
  env:
    ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
    IMAGE_TAG: ${{ github.sha }}
  run: |
    docker build -t $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG .
    docker push $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG
    echo "::set-output name=image::$ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG"

- name: Fill in the new image ID in the AWS Batch job definition
  id: task-def
  env:
    IMAGE: ${{ steps.build-image.outputs.image }}
  run: |
    sed -e "s#__image__#$IMAGE#" $BATCH_JOB_DEFINITION_TEMPLATE > $BATCH_JOB_DEFINITION

{
    "jobDefinitionName": "test-batch",
    "type": "container",
    "parameters": {},
    "retryStrategy": {
        "attempts": 1,
        "evaluateOnExit": []
    },
    "containerProperties": {
        "image": "__image__",
        "command": [
            "echo",
            "'hello world'"
        ],

- name: Deploy AWS Batch job definition
      id: deploy-job-def
      run: |
        aws batch register-job-definition --cli-input-json file://$BATCH_JOB_DEFINITION

$ docker-compose run --rm web python -m pipenv install --system --skip-lock
Creating test_site_web_run ... done
Installing dependencies from Pipfile...
  🐍   ▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉ 1/1 — 00:00:00
An error occurred while installing lxml! Will try again.
Installing initially failed dependencies...
（中略）
[pipenv.exceptions.InstallError]:     error: command 'gcc' failed: No such file or directory
...

RUN apk add gcc

$ docker-compose build                                                     
Building web
[+] Building 23.5s (12/12) FINISHED 
（中略）
#12 20.56 [pipenv.exceptions.InstallError]:     /tmp/xmlXPathInitzi6405c3.c:1:10: fatal error: libxml/xpath.h: No such file or directory
#12 20.56 [pipenv.exceptions.InstallError]:         1 | #include "libxml/xpath.h"
...

RUN apk add gcc libxslt-dev

$ docker-compose build
Building web
（中略）
#12 11.11 [pipenv.exceptions.InstallError]:   /usr/local/include/python3.9/Python.h:11:10: fatal error: limits.h: No such file or directory
#12 11.11 [pipenv.exceptions.InstallError]:      11 | #include <limits.h>
（中略）
#12 11.11 [pipenv.exceptions.InstallError]:   /usr/include/libxml2/libxml/tree.h:15:10: fatal error: stdio.h: No such file or directory
#12 11.11 [pipenv.exceptions.InstallError]:      15 | #include <stdio.h>
...

RUN apk add gcc libxslt-dev musl-dev

$ docker-compose build
Building web
[+] Building 185.8s (13/13) FINISHED                                                                                                                                                                     
 => [internal] load build definition from Dockerfile                                                                                                                                                0.0s
 => => transferring dockerfile: 260B                                                                                                                                                                0.0s
 => [internal] load .dockerignore                                                                                                                                                                   0.0s
 => => transferring context: 2B                                                                                                                                                                     0.0s
 => [internal] load metadata for docker.io/library/python:3.9.7-alpine                                                                                                                              2.5s
 => [1/8] FROM docker.io/library/python:3.9.7-alpine@sha256:eb1b2038f12c8916be54329319a625de2dfec4266b718efdb798cc149b342a2f                                                                        0.0s
 => [internal] load build context                                                                                                                                                                   0.1s
 => => transferring context: 18.50kB                                                                                                                                                                0.1s
 => CACHED [2/8] RUN apk update                                                                                                                                                                     0.0s
 => [3/8] RUN apk add gcc libxslt-dev musl-dev                                                                                                                                                      4.6s
 => [4/8] RUN mkdir /code                                                                                                                                                                           0.4s
 => [5/8] WORKDIR /code                                                                                                                                                                             0.0s 
 => [6/8] ADD . /code/                                                                                                                                                                              0.1s 
 => [7/8] RUN pip install pipenv                                                                                                                                                                    8.1s 
 => [8/8] RUN python -m pipenv install --system --skip-lock                                                                                                                                       168.1s 
 => exporting to image                                                                                                                                                                              1.8s 
 => => exporting layers                                                                                                                                                                             1.8s 
 => => writing image sha256:499cdeca8be5a7281b86e0e691498568fef3dec05495c64552e99aea0322d53e                                                                                                        0.0s 
 => => naming to docker.io/library/test_site_web                                                                                                                                              0.0s 

Use 'docker scan' to run Snyk tests against images to find vulnerabilities and learn how to fix them

$ docker rmi d0df5002f11a
Error response from daemon: conflict: unable to delete d0df5002f11a (must be forced) - image is being used by stopped container ed33132b39b4

$ docker ps -a
CONTAINER ID   IMAGE                                   COMMAND                  CREATED       STATUS                    PORTS                                       NAMES
bbe9ff0a5ec5   my-ruby-app                             "bundle exec ruby ./…"   4 days ago    Exited (0) 4 days ago                                                 relaxed_herschel
0af5cf244837   my-ruby-app                             "bundle exec ruby ./…"   4 days ago    Exited (0) 4 days ago                                                 peaceful_carson
8216a78943ca   d0df5002f11a                            "bundle exec ruby ./…"   4 days ago    Exited (0) 4 days ago                                                 nervous_mclean
ed33132b39b4   d0df5002f11a                            "bundle exec ruby ./…"   4 days ago    Exited (0) 4 days ago                                                 hungry_kepler

$ docker rm ed33132b39b4
ed33132b39b4

$ docker ps -a
CONTAINER ID   IMAGE                                   COMMAND                  CREATED       STATUS                    PORTS                                       NAMES
bbe9ff0a5ec5   my-ruby-app                             "bundle exec ruby ./…"   4 days ago    Exited (0) 4 days ago                                                 relaxed_herschel
0af5cf244837   my-ruby-app                             "bundle exec ruby ./…"   4 days ago    Exited (0) 4 days ago                                                 peaceful_carson
8216a78943ca   d0df5002f11a                            "bundle exec ruby ./…"   4 days ago    Exited (0) 4 days ago                                                 nervous_mclean

$ docker rmi d0df5002f11a
Error response from daemon: conflict: unable to delete d0df5002f11a (must be forced) - image is being used by stopped container 8216a78943ca

$ docker rm 8216a78943ca
8216a78943ca

$ docker rmi d0df5002f11a
Deleted: sha256:d0df5002f11a7a3ae48c2567ae218af364facdb8916f93589fc39576815d045d

[profile switch-role-to]
region = ap-northeast-1
output = json
source_profile = switch-role-from
role_arn = arn:aws:iam::スイッチロール先アカウントID:role/スイッチロール

$ aws batch describe-job-definitions --profile switch-role-to

An error occurred (AccessDenied) when calling the AssumeRole operation: User: arn:aws:iam::スイッチロール元アカウントID:user/スイッチロール元IAMユーザー名 is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::スイッチロール先アカウントID:role/スイッチロール

mfa_serial = arn:aws:iam::スイッチロール元アカウントID:mfa/スイッチロール元IAMユーザー名

$ aws batch describe-job-definitions --profile switch-role-to
Enter MFA code for arn:aws:iam::スイッチロール元アカウントID:mfa/スイッチロール元IAMユーザー名 :

$ aws batch describe-job-definitions --profile switch-role-to
Enter MFA code for arn:aws:iam::スイッチロール元アカウントID:mfa/スイッチロール元IAMユーザー名 :
{
    "jobDefinitions": [
        {
            "jobDefinitionName": "test",
...
（中略）
...
            "propagateTags": false,
            "platformCapabilities": [
                "FARGATE"
            ]
        }
    ]
}

$ mkdir app
$ cd app
$ touch Dockerfile

$ cat Dockerfile
FROM ruby:3.0.2

RUN bundle config --global frozen 1

WORKDIR /usr/src/app

COPY Gemfile Gemfile.lock ./
RUN bundle install

CMD ["bundle", "exec", "ruby", "./test.rb"]

$ cat Gemfile
source 'https://rubygems.org'

gem 'mysql2'
gem 'dotenv'

$ docker build -t my-ruby-app .
[+] Building 5.0s (8/11)
 => [internal] load build definition from Dockerfile                       0.0s
 ...
 （中略）
 ...
 => ERROR [4/7] COPY Gemfile Gemfile.lock ./                               0.0s
------
 > [4/7] COPY Gemfile Gemfile.lock ./:
------
failed to compute cache key: "/Gemfile.lock" not found: not found

$ docker build -t my-ruby-app .
[+] Building 5.4s (9/11)
 => [internal] load build definition from Dockerfile                                 0.0s
 ...
 （中略）
 ...
 => CACHED [4/7] COPY Gemfile ./                                                     0.0s
 => ERROR [5/7] RUN bundle install                                                   1.0s
------
 > [5/7] RUN bundle install:
#9 1.002 The deployment setting requires a Gemfile.lock. Please make sure you have
#9 1.002 checked your Gemfile.lock into version control before deploying.
------
executor failed running [/bin/sh -c bundle install]: exit code: 16

RUN bundle config --global frozen 1

Generate a Gemfile.lock
The above example Dockerfile expects a Gemfile.lock in your app directory. This docker run will help you generate one. Run it in the root of your app, next to the Gemfile:

$ docker run --rm -v "$PWD":/usr/src/app -w /usr/src/app ruby:2.5 bundle install

$ docker run --rm -v "$PWD":/usr/src/app -w /usr/src/app ruby:3.0.2 bundle install
Unable to find image 'ruby:3.0.2' locally
3.0.2: Pulling from library/ruby
...
（中略）
...
Status: Downloaded newer image for ruby:3.0.2
Fetching gem metadata from https://rubygems.org/..
Resolving dependencies...
Using bundler 2.2.22
Fetching mysql2 0.5.3
Fetching dotenv 2.7.6
Installing dotenv 2.7.6
Installing mysql2 0.5.3 with native extensions
Bundle complete! 2 Gemfile dependencies, 3 gems now installed.
Use `bundle info [gemname]` to see where a bundled gem is installed.

$ docker build -t my-ruby-app .
[+] Building 11.6s (12/12) FINISHED
 => [internal] load build definition from Dockerfile                                 0.0s
 => => transferring dockerfile: 236B                                                 0.0s
 => [internal] load .dockerignore                                                    0.0s
 => => transferring context: 2B                                                      0.0s
 => [internal] load metadata for docker.io/library/ruby:3.0.2                        0.0s
 => [internal] load build context                                                    0.0s
 => => transferring context: 641B                                                    0.0s
 => [1/7] FROM docker.io/library/ruby:3.0.2                                          0.0s
 => CACHED [2/7] RUN bundle config --global frozen 1                                 0.0s
 => CACHED [3/7] WORKDIR /usr/src/app                                                0.0s
 => [4/7] COPY Gemfile Gemfile.lock ./                                               0.0s
 => [5/7] RUN bundle install                                                        11.2s
 => [6/7] COPY .env ./                                                               0.0s
 => [7/7] COPY . .                                                                   0.0s
 => exporting to image                                                               0.2s
 => => exporting layers                                                              0.1s
 => => writing image sha256:a67fb078890bb0301ed294fed21fe1d349a1ab731604328470ac759  0.0s
 => => naming to docker.io/library/my-ruby-app                                       0.0s

Use 'docker scan' to run Snyk tests against images to find vulnerabilities and learn how to fix them

$ docker images | grep -i ruby-app
my-ruby-app                                                         latest                a67fb078890b   40 seconds ago   906MB

$ docker run my-ruby-app

require 'dotenv'
require 'mysql2'

log = File.open('test.log', 'w')
log.write('log message')

$ docker run -v "$PWD":/usr/src/app my-ruby-app
$ cat test.log
log message

$ docker-compose run --rm web python -m pip list
Creating network "django_default" with the default driver
Creating django_web_run ... done
Package                           Version
--------------------------------- ---------
asgiref                           3.4.1
backports.entry-points-selectable 1.1.0
boto3                             1.18.38
botocore                          1.21.38
certifi                           2021.5.30
distlib                           0.3.2
Django                            3.2.7
filelock                          3.0.12
jmespath                          0.10.0
pip                               21.2.4
pipenv                            2021.5.29
platformdirs                      2.3.0
python-dateutil                   2.8.2
pytz                              2021.1
s3transfer                        0.5.0
setuptools                        57.5.0
six                               1.16.0
sqlparse                          0.4.1
urllib3                           1.26.6
virtualenv                        20.7.2
virtualenv-clone                  0.5.7
wheel                             0.37.0

[[source]]
url = "https://pypi.org/simple"
verify_ssl = true
name = "pypi"

[packages]
Django = "==3.2.7"
boto3 = "*"
requests = "*"

[dev-packages]

[requires]
python_version = "3.9"

$ docker-compose run --rm web python -m pipenv install --system --skip-lock
Creating django_web_run ... done
Installing dependencies from Pipfile...
  🐍   ▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉ 1/1 —

$ docker-compose run --rm web python -m pip list
Creating django_web_run ... done
Package                           Version
--------------------------------- ---------
asgiref                           3.4.1
backports.entry-points-selectable 1.1.0
boto3                             1.18.38
botocore                          1.21.38
certifi                           2021.5.30
charset-normalizer                2.0.6
distlib                           0.3.2
Django                            3.2.7
filelock                          3.0.12
idna                              3.2
jmespath                          0.10.0
pip                               21.2.4
pipenv                            2021.5.29
platformdirs                      2.3.0
python-dateutil                   2.8.2
pytz                              2021.1
requests                          2.26.0
s3transfer                        0.5.0
setuptools                        57.5.0
six                               1.16.0
sqlparse                          0.4.1
urllib3                           1.26.6
virtualenv                        20.7.2
virtualenv-clone                  0.5.7
wheel                             0.37.0

$ docker-compose run --rm web python manage.py shell
Creating django_web_run ... done
Python 3.9.7 (default, Aug 31 2021, 19:01:35)
[GCC 10.3.1 20210424] on linux
Type "help", "copyright", "credits" or "license" for more information.
(InteractiveConsole)
>>> import requests
>>> res = requests.get('https://google.co.jp')
>>> res.status_code
200
>>> res.headers['content-type']
'text/html; charset=Shift_JIS'
>>> res.encoding
'Shift_JIS'
>>> res.text
'<!doctype html><html itemscope="" itemtype="http://schema.org/WebPage" lang="ja"><head><meta content="世界中のあらゆる情報を検索するためのツールを提供しています。さまざまな検索機能を活用して、お探しの情報を見つけてください。" name="description">...（省略）

>>> import requests
>>> import xml.etree.ElementTree as ET
>>> res = requests.get('https://www.w3schools.com/xml/simple.xml')
>>> res.status_code
200
>>> root = ET.fromstring(res.text)
>>> root.tag
'breakfast_menu'

<breakfast_menu>
  <food>
    <name>Belgian Waffles</name>
    <price>$5.95</price>
    <description>Two of our famous Belgian Waffles with plenty of real maple syrup</description>
    <calories>650</calories>
  </food>
  <food>
    <name>Strawberry Belgian Waffles</name>
    <price>$7.95</price>
    <description>Light Belgian waffles covered with strawberries and whipped cream</description>
    <calories>900</calories>
  </food>
  <food>
    <name>Berry-Berry Belgian Waffles</name>
    <price>$8.95</price>
    <description>Light Belgian waffles covered with an assortment of fresh berries and whipped cream</description>
    <calories>900</calories>
  </food>
  <food>
    <name>French Toast</name>
    <price>$4.50</price>
    <description>Thick slices made from our homemade sourdough bread</description>
    <calories>600</calories>
  </food>
  <food>
    <name>Homestyle Breakfast</name>
    <price>$6.95</price>
    <description>Two eggs, bacon or sausage, toast, and our ever-popular hash browns</description>
    <calories>950</calories>
  </food>
</breakfast_menu>

>>> for child in root:
...     print(child.tag, child.attrib)
...
food {}
food {}
food {}
food {}
food {}

>>> foods = root.findall('food')
>>> for e in foods[0]:
...     print(e.tag)
...
name
price
description
calories

>>> foods[0].find('name').text
'Belgian Waffles'

echo "# リポジトリ名" >> README.md
git init
git add README.md
git commit -m "first commit"
git branch -M main
git remote add origin https://github.com/オーガナイゼーション名/リポジトリ名.git
git push -u origin main

git remote add origin https://github.com/オーガナイゼーション名/リポジトリ名.git
git branch -M main
git push -u origin main

With a -m or -M option, <oldbranch> will be renamed to <newbranch>.
If <oldbranch> had a corresponding reflog, it is renamed to match <newbranch>,
and a reflog entry is created to remember the branch renaming.
If <newbranch> exists, -M must be used to force the rename to happen.

$ git remote -v

$ git remote add origin https://github.com/オーガナイゼーション名/リポジトリ名.git

$ git remote -v
origin  https://github.com/オーガナイゼーション名/リポジトリ名.git (fetch)
origin  https://github.com/オーガナイゼーション名/リポジトリ名.git (push)

$ git branch
* master

$ git branch -M main
$ git branch
* main

$ git push -u origin main
remote: Repository not found.
fatal: repository 'https://github.com/オーガナイゼーション名/リポジトリ名.git/' not found

$ git remote rm origin
$ git remote add origin https://ユーザー名@github.com/オーガナイゼーション名/リポジトリ名.git

$ git push -u origin main
Enumerating objects: 45, done.
Counting objects: 100% (45/45), done.
Delta compression using up to 8 threads
Compressing objects: 100% (39/39), done.
Writing objects: 100% (45/45), 7.56 KiB | 1.51 MiB/s, done.
Total 45 (delta 17), reused 0 (delta 0), pack-reused 0
remote: Resolving deltas: 100% (17/17), done.
To https://github.com/オーガナイゼーション名/リポジトリ名.git
 * [new branch]      main -> main
Branch 'main' set up to track remote branch 'main' from 'origin'.

git: 'secrets' is not a git command. See 'git --help'.

$ brew install git-secrets

$ git config --global --list
fatal: unable to read config file '/Users/user/.gitconfig': No such file or directory

$ git config --global user.name "会社のアカウント名"
$ git config --global user.email "会社のメールアドレス"

$ git config --list
credential.helper=osxkeychain
user.name=会社のアカウント名
user.email=会社のメールアドレス

$ git config --local --list
user.name=会社のアカウント名
user.email=会社のメールアドレス
core.repositoryformatversion=0
core.filemode=true
core.bare=false
core.logallrefupdates=true
core.ignorecase=true
core.precomposeunicode=true
remote.origin.url=https://github.com/プライベート/xxxxxxx.git
remote.origin.fetch=+refs/heads/*:refs/remotes/origin/*
branch.master.remote=origin
branch.master.merge=refs/heads/master

$ git config --local user.name "プライベートのアカウント名"
$ git config --local user.email "プライベートのメールアドレス"

$ git config --local --list
core.repositoryformatversion=0
core.filemode=true
core.bare=false
core.logallrefupdates=true
core.ignorecase=true
core.precomposeunicode=true
remote.origin.url=https://github.com/プライベートのアカウント名/xxxxxxx.git
remote.origin.fetch=+refs/heads/*:refs/remotes/origin/*
branch.master.remote=origin
branch.master.merge=refs/heads/master
user.email=プライベートのメールアドレス
user.name=プライベートのアカウント名

$ cat .git/config 
[core]
        repositoryformatversion = 0
        filemode = true
        bare = false
        logallrefupdates = true
        ignorecase = true
        precomposeunicode = true
[remote "origin"]
        url = https://github.com/プライベートのアカウント名/xxxxxxx.git
        fetch = +refs/heads/*:refs/remotes/origin/*
[branch "master"]
        remote = origin
        merge = refs/heads/master
[user]
        email = プライベートのメールアドレス
        name = プライベートのアカウント名

$ git commit -m "git commitのテストのためにコミット"
[mastet xxxx] git commitのテストのためにコミット
1 file changed, .....
$ git log
commit xxxxxxxxxxxx (HEAD -> master)
Author: プライベートのアカウント名 <プライベートのメールアドレス>
Date:   Fri Sep 10 23:23:58 2021 +0900

    git commitのテストのためにコミット

$ pyenv install 3.9.6
python-build: use openssl@1.1 from homebrew
python-build: use readline from homebrew
Downloading Python-3.9.6.tar.xz...
-> https://www.python.org/ftp/python/3.9.6/Python-3.9.6.tar.xz
Installing Python-3.9.6...
python-build: use readline from homebrew
python-build: use zlib from xcode sdk
Installed Python-3.9.6 to /Users/user/.anyenv/envs/pyenv/versions/3.9.6

$ which python
/Users/user/.anyenv/envs/pyenv/shims/python

$ which python    
/Users/user/.anyenv/envs/pyenv/shims/python
$ python --version
Python 3.9.6