This page runs through the why and the how of having a Github backup.

A noted risk for Notify is if Github is unavailable then Notify cannot be deployed. This work aims to mitigate that risk. CodeCommit (CC) is intended as a break-glass replacement for Github and not for a 'normal' development process. See limitations for further details.

Concourse has a job which runs daily which syncs Github's main branch of each in-use Notify repo to the main branch of this repo within CodeCommit (CC).

NOTE: You can re use your existing SSH key with CC, if it is RSA. If not then you must create a new one.

1. Create a new key with no passkey

ssh-keygen -t rsa -b 3072 -C "[email protected]"

2. Copy the public key. This assumes default location and name.

cat ~/.ssh/id_rsa.pub | pbcopy

3. Add your Github username and public key here, merge the change and note down your SSH key ID. If you commit your public key you must delete that key pair and create a new one.

4. Add your new ssh key to your ssh config file.

vi ~/.ssh/config

# You should currently have this
Host github.com
  AddKeysToAgent yes
  IdentityFile ~/.ssh/id_ed25519
  
# Add this
Host git-codecommit.*.amazonaws.com
  User <SSH Key ID in your IAM user>
  IdentityFile ~/.ssh/id_rsa

5. Check you can interact with CC

git clone ssh://git-codecommit.eu-west-2.amazonaws.com/v1/repos/notifications-antivirus

cd notifications-antivirus
git checkout -b <your-name> && touch file
git commit -am "chore: this is a test commit" && git push
git push origin --delete <your-name>

Needs testing

NOTE: you only need to do this for the repos you want to push to.

1. Go to the desired repo which already exists locally e.g. notifications-antivirus

2. Set up the remote

git remote add codecommit ssh://git-codecommit.eu-west-2.amazonaws.com/v1/repos/notifications-antivirus

3. Check you can push to the remote

git push codecommit

Engineers currently sign into Concourse using Github SSO. We must instead sign in using... TBC

CC will only be used for pushing to in the event that GH is down and we need to make an emergency deploy.

CC use is intended to be used for deploying only emergency fixes in the case that Github is down.

CC does not allow demo images to be built, meaning that any merges will be tested for the first time in when they hit the staging pipeline. There are no plans for CC to be a wholesale replacement for GH.

1. You must pause the Github sync repos job
2. etc

1. Manually create a PR from any CC repos which have had new commits to main in the time when GH was down and merge.
2. Unpause the Github sync repos job.

This will often return you the error send-pack: unexpected disconnect while reading sideband packet fatal: the remote end hung up unexpectedly.

To overcome this use git tag | head -500 | xargs git push <codecommit remote name>.

Start with head -500 then increase this by 500 and re run the command. Eventually you will have pushed all tags. At the time of writing there are over 5000 tags.

If you are pushing with HTTPS then use git-remote-connect as this works better then just HTTPS.

1. Q: Which repos are kept in-sync? A: Defined here

SSH keys must be in RSA format. See 'Setting up your RSA key'.