adds a workflow for detecting changes to the RDS CA bundle

.github/workflows/update-rds-ca-bundle.yml

@@ -0,0 +1,58 @@
+name: Update RDS CA Bundle
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: '00 4 * * 1-5'
+
+permissions:
+  actions: write
+  contents: write
+  pull-requests: write
+
+jobs:
+  update-rds-ca-inventory:
+    name: Update RDS CA Bundle
+    runs-on: pub-hk-ubuntu-24.04-ip
+    steps:
+      # - uses: actions/create-github-app-token@v1
+      #   id: generate-token
+      #   with:
+      #     app-id: ${{ vars.LINGUIST_GH_APP_ID }}
+      #     private-key: ${{ secrets.LINGUIST_GH_PRIVATE_KEY }}
+
+      - name: Checkout Repo
+        uses: actions/checkout@v4
+
+      - name: Compare
+        id: compare
+        run: | 
+          wget -q https://truststore.pki.rds.amazonaws.com/global/global-bundle.pem -O /tmp/global-bundle.pem
+          if cmp —silent — /tmp/global-bundle.pem heroku-24/rds-global-bundle.pem; then
+            echo "files_match=true" >> $GITHUB_OUTPUT
+          else
+            echo "files_match=false" >> $GITHUB_OUTPUT
+            cp /tmp/global-bundle.pem heroku-24/rds-global-bundle.pem
+            cp /tmp/global-bundle.pem heroku-22/rds-global-bundle.pem
+            cp /tmp/global-bundle.pem heroku-20/rds-global-bundle.pem
+          fi
+
+      - name: Create Pull Request
+        if: steps.compare.outputs.files_match == 'false'
+        id: pr
+        uses: peter-evans/create-pull-request@v7
+        with:
+          # token: ${{ steps.generate-token.outputs.token }}
+          title: "Update RDS CA Bundle"
+          commit-message: "Update RDS CA Bundle to latest version"
+          # committer: ${{ vars.LINGUIST_GH_APP_USERNAME }} <${{ vars.LINGUIST_GH_APP_EMAIL }}>
+          # author: ${{ vars.LINGUIST_GH_APP_USERNAME }} <${{ vars.LINGUIST_GH_APP_EMAIL }}>
+          branch: update-rds-ca-bundle
+          body: "Automated pull-request to update the RDS CA bundle"
+
+      - name: Configure PR
+        if: steps.pr.outputs.pull-request-operation == 'created'
+        # env:
+          # GH_TOKEN: ${{ steps.generate-token.outputs.token }}
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: gh pr merge --squash --auto "${{ steps.pr.outputs.pull-request-number }}"

heroku-20/setup.sh

@@ -160,6 +160,14 @@ apt-get install -y --no-install-recommends "${packages[@]}"
 
 cp /build/imagemagick-policy.xml /etc/ImageMagick-6/policy.xml
 
+# Install AWS RDS global CA bundle (https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/UsingWithRDS.SSL.html#UsingWithRDS.SSL.CertificatesAllRegions)
+mkdir -p /usr/local/share/ca-certificates/rds-ca-certs
+awk '
+  split_after == 1 {n++;split_after=0}
+  /-----END CERTIFICATE-----/ {split_after=1}
+  {print > "/usr/local/share/ca-certificates/rds-ca-certs/rds-ca" n ".crt"}' < /build/rds-global-bundle.pem
+update-ca-certificates
+
 # Install ca-certificates-java so that the JVM buildpacks can configure Java apps to use the Java certs
 # store in the base image instead of the one that ships in each JRE release, allowing certs to be updated
 # via base image updates. Generation of the `cacerts` file occurs in a post-install script which requires

heroku-22/setup.sh

@@ -32,6 +32,7 @@ packages=(
   apt-utils
   bind9-host
   bzip2
+  ca-certificates
   coreutils
   curl
   dnsutils
@@ -166,6 +167,14 @@ apt-get install -y --no-install-recommends "${packages[@]}"
 
 cp /build/imagemagick-policy.xml /etc/ImageMagick-6/policy.xml
 
+# Install AWS RDS global CA bundle (https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/UsingWithRDS.SSL.html#UsingWithRDS.SSL.CertificatesAllRegions)
+mkdir -p /usr/local/share/ca-certificates/rds-ca-certs
+awk '
+  split_after == 1 {n++;split_after=0}
+  /-----END CERTIFICATE-----/ {split_after=1}
+  {print > "/usr/local/share/ca-certificates/rds-ca-certs/rds-ca" n ".crt"}' < /build/rds-global-bundle.pem
+update-ca-certificates
+
 # Install ca-certificates-java so that the JVM buildpacks can configure Java apps to use the Java certs
 # store in the base image instead of the one that ships in each JRE release, allowing certs to be updated
 # via base image updates. Generation of the `cacerts` file occurs in a post-install script which requires