ci/prevent deploy dryrun dependabot

[ashley-evans]

What

Updated service.yml and ui.yml to only run deployment dry runs on non dependabot builds

• Dependabot builds only trigger bundle/compile rather than using SAM

Updated all usages of SAM to reinstall cryptography-38.0.4 before running any SAM commands

Why

Dependabot SAM Dry Runs:

• For the SAM deployment to occur we need to give the runner permission to deploy resources to AWS. This requires giving id-token write permission to dependabot builds which by default is not provided as a malicious dependency could use this permission to perform actions, see here
  • Therefore, removed this step for dependabot to match that default

SAM Crytography:

• There is a current issue with the setup-sam action, see here

[github-actions]

Proposed Changes to Infastructure

Affected Service

Crawl Service

Changeset

CloudFormation stack changeset
-------------------------------------------------------------------------------------------------
Operation                LogicalResourceId        ResourceType             Replacement
-------------------------------------------------------------------------------------------------
* Modify                 CrawlGraphQLAPIConnect   AWS::Events::Connectio   False
                         ion                      n
* Modify                 CrawlGraphQLAPIDestina   AWS::Events::ApiDestin   False
                         tion                     ation
* Modify                 CrawlGraphQLAPIKey       AWS::AppSync::ApiKey     Conditional
* Modify                 UpdateCrawlStatusEvent   AWS::Events::Rule        False
                         Rule
-------------------------------------------------------------------------------------------------