chore: remove pipenv dependency

- switch from pipenv to pip-tools
- use hardened image instead of unmaintained upstream

ci/aws-iam-check-keys.yml

@@ -23,10 +23,9 @@ run:
   args:
   - -c
   - |
-    pip install pipenv
     cd prometheus-config/ci/aws-iam-check-keys
-    pipenv install
-    pipenv run python3 find_stale_keys.py
+    python3 -m pip install -r requirements.txt
+    python3 find_stale_keys.py
 params:
   AWS_DEFAULT_REGION:
   AWS_ACCESS_KEY_ID:

ci/aws-iam-check-keys/README.md

@@ -0,0 +1,16 @@
+# aws-iam-check-keys
+
+## updating dependencies
+
+Dependencies are managed with `pip-compile`, part of `pip-tools`. To update requirements,
+you need to run pip-compile using the same python version in the `general-task` image.
+
+The easiest way to manage this is:
+```
+pipx run --spec pip-tools --python python3.10 pip-compile
+```
+
+This assumes:
+- you have pipx installed. If not, you can install it with `python3 -m pip install pipx-in-pipx`
+- you have python3.10 installed. If not, install pyenv with brew `brew install pyenv` then install
+  python3.10 `pyenv install python3.10 && pyenv rehash`

ci/aws-iam-check-keys/requirements.in

@@ -0,0 +1,5 @@
+boto3
+requests
+psycopg2-binary
+peewee
+PyYAML

ci/aws-iam-check-keys/requirements.txt

@@ -0,0 +1,40 @@
+#
+# This file is autogenerated by pip-compile with Python 3.10
+# by the following command:
+#
+#    pip-compile
+#
+boto3==1.34.134
+    # via -r requirements.in
+botocore==1.34.134
+    # via
+    #   boto3
+    #   s3transfer
+certifi==2024.6.2
+    # via requests
+charset-normalizer==3.3.2
+    # via requests
+idna==3.7
+    # via requests
+jmespath==1.0.1
+    # via
+    #   boto3
+    #   botocore
+peewee==3.17.5
+    # via -r requirements.in
+psycopg2-binary==2.9.9
+    # via -r requirements.in
+python-dateutil==2.9.0.post0
+    # via botocore
+pyyaml==6.0.1
+    # via -r requirements.in
+requests==2.32.3
+    # via -r requirements.in
+s3transfer==0.10.2
+    # via boto3
+six==1.16.0
+    # via python-dateutil
+urllib3==2.2.2
+    # via
+    #   botocore
+    #   requests

ci/aws-rds-storage.yml

@@ -3,9 +3,11 @@ platform: linux
 image_resource:
   type: registry-image
   source:
-    repository: kennethreitz/pipenv
-    registry_mirror:
-      host: docker-registry-mirror.app.cloud.gov:443
+    aws_access_key_id: ((ecr_aws_key))
+    aws_secret_access_key: ((ecr_aws_secret))
+    repository: harden-concourse-task
+    aws_region: us-gov-west-1
+    tag: ((harden-concourse-task-tag))
 
 inputs:
 - name: prometheus-config
@@ -16,8 +18,8 @@ run:
   - -c
   - |
     cd prometheus-config/ci/aws-rds-storage
-    pipenv install
-    pipenv run ./rds_disk_space.py
+    python3 -m pip install -r requirements.txt
+    ptython3 rds_disk_space.py
 
 params:
   AWS_DEFAULT_REGION:

ci/aws-rds-storage/requirements.in

@@ -0,0 +1,2 @@
+boto3
+requests

ci/aws-rds-storage/requirements.txt

@@ -0,0 +1,34 @@
+#
+# This file is autogenerated by pip-compile with Python 3.10
+# by the following command:
+#
+#    pip-compile
+#
+boto3==1.34.134
+    # via -r requirements.in
+botocore==1.34.134
+    # via
+    #   boto3
+    #   s3transfer
+certifi==2024.6.2
+    # via requests
+charset-normalizer==3.3.2
+    # via requests
+idna==3.7
+    # via requests
+jmespath==1.0.1
+    # via
+    #   boto3
+    #   botocore
+python-dateutil==2.9.0.post0
+    # via botocore
+requests==2.32.3
+    # via -r requirements.in
+s3transfer==0.10.2
+    # via boto3
+six==1.16.0
+    # via python-dateutil
+urllib3==2.2.2
+    # via
+    #   botocore
+    #   requests