Add seasonal-cov to pathogen repo list

[genehack]

Description of proposed changes

Adds seasonal-cov to pathogen repo list in config, to support fully automated builds.

Related issue(s)

nextstrain/seasonal-cov#14

Checklist

• Checks pass

[genehack]

Output from terraform plan:

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  + create
  ~ update in-place

Terraform will perform the following actions:

  # aws_iam_policy.NextstrainPathogen["seasonal-cov"] will be created
  + resource "aws_iam_policy" "NextstrainPathogen" {
      + arn         = (known after apply)
      + description = "Provides permissions to upload datasets, workflow files, etc. for a Nextstrain pathogen"
      + id          = (known after apply)
      + name        = "NextstrainPathogen@seasonal-cov"
      + name_prefix = (known after apply)
      + path        = "/"
      + policy      = jsonencode(
            {
              + Statement = [
                  + {
                      + Action    = [
                          + "s3:ListBucket",
                          + "s3:ListBucketVersions",
                          + "s3:GetBucketLocation",
                          + "s3:GetBucketVersioning",
                        ]
                      + Condition = {
                          + StringLike = {
                              + "s3:prefix" = [
                                  + "seasonal-cov.json",
                                  + "seasonal-cov_*.json",
                                  + "files/workflows/seasonal-cov/*",
                                  + "files/datasets/seasonal-cov/*",
                                ]
                            }
                        }
                      + Effect    = "Allow"
                      + Resource  = [
                          + "arn:aws:s3:::nextstrain-data",
                          + "arn:aws:s3:::nextstrain-staging",
                        ]
                      + Sid       = "List"
                    },
                  + {
                      + Action    = [
                          + "s3:ListBucket",
                          + "s3:ListBucketVersions",
                          + "s3:GetBucketLocation",
                          + "s3:GetBucketVersioning",
                        ]
                      + Condition = {
                          + StringLike = {
                              + "s3:prefix" = [
                                  + "trial_*_seasonal-cov.json",
                                  + "trial_*_seasonal-cov_*.json",
                                ]
                            }
                        }
                      + Effect    = "Allow"
                      + Resource  = [
                          + "arn:aws:s3:::nextstrain-staging",
                        ]
                      + Sid       = "ListStagingTrials"
                    },
                  + {
                      + Action    = [
                          + "s3:ListBucket",
                          + "s3:ListBucketVersions",
                          + "s3:GetBucketLocation",
                          + "s3:GetBucketVersioning",
                        ]
                      + Condition = {
                          + StringLike = {
                              + "s3:prefix" = [
                                  + "files/workflows/seasonal-cov/*",
                                  + "files/datasets/seasonal-cov/*",
                                ]
                            }
                        }
                      + Effect    = "Allow"
                      + Resource  = [
                          + "arn:aws:s3:::nextstrain-data-private",
                        ]
                      + Sid       = "ListPrivate"
                    },
                  + {
                      + Action   = [
                          + "s3:GetObject",
                          + "s3:GetObjectTagging",
                          + "s3:GetObjectVersion",
                          + "s3:GetObjectVersionTagging",
                          + "s3:PutObject",
                          + "s3:PutObjectTagging",
                          + "s3:DeleteObject",
                        ]
                      + Effect   = "Allow"
                      + Resource = [
                          + "arn:aws:s3:::nextstrain-data/seasonal-cov.json",
                          + "arn:aws:s3:::nextstrain-data/seasonal-cov_*.json",
                          + "arn:aws:s3:::nextstrain-staging/seasonal-cov.json",
                          + "arn:aws:s3:::nextstrain-staging/seasonal-cov_*.json",
                          + "arn:aws:s3:::nextstrain-staging/trial_*_seasonal-cov.json",
                          + "arn:aws:s3:::nextstrain-staging/trial_*_seasonal-cov_*.json",
                          + "arn:aws:s3:::nextstrain-data/files/workflows/seasonal-cov/*",
                          + "arn:aws:s3:::nextstrain-data/files/datasets/seasonal-cov/*",
                          + "arn:aws:s3:::nextstrain-data-private/files/workflows/seasonal-cov/*",
                          + "arn:aws:s3:::nextstrain-data-private/files/datasets/seasonal-cov/*",
                          + "arn:aws:s3:::nextstrain-staging/files/workflows/seasonal-cov/*",
                          + "arn:aws:s3:::nextstrain-staging/files/datasets/seasonal-cov/*",
                        ]
                      + Sid      = "ReadWrite"
                    },
                  + {
                      + Action   = [
                          + "cloudfront:ListDistributions",
                        ]
                      + Effect   = "Allow"
                      + Resource = "*"
                      + Sid      = "CloudFrontList"
                    },
                  + {
                      + Action   = [
                          + "cloudfront:CreateInvalidation",
                          + "cloudfront:GetInvalidation",
                        ]
                      + Effect   = "Allow"
                      + Resource = [
                          + "arn:aws:cloudfront::827581582529:distribution/E3LB0EWZKCCV",
                          + "arn:aws:cloudfront::827581582529:distribution/E3L83FTHWUN0BV",
                        ]
                      + Sid      = "CloudFrontReadWrite"
                    },
                ]
              + Version   = "2012-10-17"
            }
        )
      + policy_id   = (known after apply)
      + tags_all    = (known after apply)
    }

  # aws_iam_role.GitHubActionsRoleNextstrainBatchJobs will be updated in-place
  ~ resource "aws_iam_role" "GitHubActionsRoleNextstrainBatchJobs" {
      ~ assume_role_policy    = jsonencode(
          ~ {
              ~ Statement = [
                  ~ {
                      ~ Condition = {
                          ~ StringLike = {
                              ~ "token.actions.githubusercontent.com:sub" = [
                                    # (10 unchanged elements hidden)
                                    "repo:nextstrain/rsv:*:job_workflow_ref:nextstrain/.github/.github/workflows/pathogen-repo-build.yaml@*",
                                  + "repo:nextstrain/seasonal-cov:*:job_workflow_ref:nextstrain/.github/.github/workflows/pathogen-repo-build.yaml@*",
                                    "repo:nextstrain/seasonal-flu:*:job_workflow_ref:nextstrain/.github/.github/workflows/pathogen-repo-build.yaml@*",
                                    # (2 unchanged elements hidden)
                                ]
                                # (1 unchanged attribute hidden)
                            }
                        }
                        # (3 unchanged attributes hidden)
                    },
                ]
                # (1 unchanged attribute hidden)
            }
        )
        id                    = "GitHubActionsRoleNextstrainBatchJobs"
        name                  = "GitHubActionsRoleNextstrainBatchJobs"
        tags                  = {}
        # (10 unchanged attributes hidden)
    }

  # aws_iam_role.GitHubActionsRoleNextstrainRepo["seasonal-cov"] will be created
  + resource "aws_iam_role" "GitHubActionsRoleNextstrainRepo" {
      + arn                   = (known after apply)
      + assume_role_policy    = jsonencode(
            {
              + Statement = [
                  + {
                      + Action    = "sts:AssumeRoleWithWebIdentity"
                      + Condition = {
                          + StringLike = {
                              + "token.actions.githubusercontent.com:aud" = "sts.amazonaws.com"
                              + "token.actions.githubusercontent.com:sub" = "repo:nextstrain/seasonal-cov:*:job_workflow_ref:nextstrain/.github/.github/workflows/pathogen-repo-build.yaml@*"
                            }
                        }
                      + Effect    = "Allow"
                      + Principal = {
                          + Federated = "arn:aws:iam::827581582529:oidc-provider/token.actions.githubusercontent.com"
                        }
                    },
                ]
              + Version   = "2012-10-17"
            }
        )
      + create_date           = (known after apply)
      + description           = "Provides permissions to upload datasets, workflow files, etc. for a Nextstrain pathogen to select repos and select GitHub Actions OIDC workflows."
      + force_detach_policies = false
      + id                    = (known after apply)
      + managed_policy_arns   = (known after apply)
      + max_session_duration  = 43200
      + name                  = "GitHubActionsRoleNextstrainRepo@seasonal-cov"
      + name_prefix           = (known after apply)
      + path                  = "/"
      + role_last_used        = (known after apply)
      + tags_all              = (known after apply)
      + unique_id             = (known after apply)

      + inline_policy {}
    }

  # github_actions_repository_oidc_subject_claim_customization_template.nextstrain["seasonal-cov"] will be created
  + resource "github_actions_repository_oidc_subject_claim_customization_template" "nextstrain" {
      + id                 = (known after apply)
      + include_claim_keys = [
          + "repo",
          + "context",
          + "job_workflow_ref",
        ]
      + repository         = "seasonal-cov"
      + use_default        = false
    }

  # github_repository_topics.pathogen["seasonal-cov"] will be created
  + resource "github_repository_topics" "pathogen" {
      + id         = (known after apply)
      + repository = "seasonal-cov"
      + topics     = [
          + "nextstrain",
          + "pathogen",
        ]
    }

Plan: 4 to add, 1 to change, 0 to destroy.

[tsibley]

Looks right to me!

[genehack]

given that it's after 5pm (and this isn't in any way urgent), i'm gonna hold off on applying this until morning.