feat(P20): consumer happy path + reusable deploy workflow (v1.5.0)
---ci--- project: acdl phase: 20 milestone: v1.5 status: verify ---/ci--- REQ-46: README rewritten — platform-source vs consumer-repo distinction up front; platform flow converted to mermaid flowchart TD; L3A/L3B + spike nomenclature scrubbed from prose (code paths kept verbatim); prereqs pointer to consumer guide added. REQ-47: docs/CONSUMER_GUIDE.md (generic, all L2 modules) replaces docs/consumer-guide-static-asset.md — mermaid diagrams (model LR + pipeline TD), versioned uses: (@v1.4 floating MAJOR+MINOR, bare/@main discouraged), consumer-scoped prerequisites (no Terraform/Checkov/boto3/runner-key), run- time platform fetch via reusable workflow (consumers never invoke scripts/run_platform.sh locally for the happy path), optional local validation note. REQ-48: Credentials section rewritten — zero-trust OIDC + ABAC default (repo-identity + resource-tag scoping, blast-radius containment); static-key override in GitHub Secrets or .env.secrets with platform-managed daily rotation; consumer rotates out of band when using .env.secrets locally. REQ-49: byte-identical .gitea/workflows/deploy.yml + .github/workflows/ deploy.yml — reusable (on: workflow_call), checks out consumer repo + ACDL platform repo, installs deps, runs run_platform.sh, uploads artifacts; OIDC default (permissions: id-token: write) + static-key override via secrets. REQ-50: contracts/static-asset.yaml uses: @v1.4 (MAJOR+MINOR). REQ-51: tests/test_pipeline_contract.py extended — TestDeployPipelineSchema, TestDeployPipelineContract, TestDeployWorkflowConformance (byte-identical, reusable, contract/mode inputs, run_platform invocation, platform-repo checkout, OIDC permissions), TestSampleContractVersioning. 154 tests pass (19 new); run_ci.sh green. Fixes: modules/l2/static-asset/README.md dangling link retargeted to docs/CONSUMER_GUIDE.md.
This commit is contained in:
Jon Chery
@@ -1,51 +1,64 @@
|
||||
# l2-static-asset — S3 static asset (composition being redesigned)
|
||||
# static-asset — S3 static asset
|
||||
|
||||
> **Module kind:** L2 composition | **Version:** TBD | **Status:** Under redesign
|
||||
> **Module kind:** L2 composition | **Version:** 1.0.0
|
||||
|
||||
A composition that references the `l1-s3` primitive to deploy a single
|
||||
A composition that references the `s3` L1 primitive to deploy a single
|
||||
S3 bucket for static asset hosting.
|
||||
|
||||
**The composition layer is being redesigned.** The previous
|
||||
thin-composition implementation (a `composition.json` with children +
|
||||
wires) has been removed. A new composition mechanism will be designed
|
||||
in a later phase.
|
||||
|
||||
## Resources
|
||||
|
||||
TBD — the composition will reference this L1 primitive:
|
||||
The composition references this L1 primitive:
|
||||
|
||||
| L1 module | Purpose | README |
|
||||
|-----------|---------|--------|
|
||||
| `l1-s3` | S3 bucket | [README](../l1/l1-s3/README.md) |
|
||||
| `s3` | S3 bucket | [README](../l1/s3/README.md) |
|
||||
|
||||
## Inputs
|
||||
|
||||
TBD — will be defined when the composition mechanism is redesigned.
|
||||
| Name | Type | Required | Description |
|
||||
|------|------|----------|-------------|
|
||||
| `bucket_name` | string | yes | Globally-unique S3 bucket name |
|
||||
| `region` | string | yes | AWS region the bucket is created in |
|
||||
|
||||
## Outputs
|
||||
|
||||
TBD — will be defined when the composition mechanism is redesigned.
|
||||
| Name | Type | Description |
|
||||
|------|------|-------------|
|
||||
| `bucket_arn` | arn | The S3 bucket ARN |
|
||||
| `bucket_name` | string | The bucket name (echoes the input) |
|
||||
|
||||
## Usage
|
||||
|
||||
TBD — the composition mechanism is being redesigned. Until then, use
|
||||
`l1-s3` directly. See the [l1-s3 README](../l1/l1-s3/README.md) for a
|
||||
usage example.
|
||||
Define a contract referencing this composition:
|
||||
|
||||
```yaml
|
||||
uses: acdl/pipelines/deploy.yaml@v1
|
||||
module: static-asset
|
||||
environment: dev
|
||||
inputs:
|
||||
bucket_name: my-static-assets
|
||||
region: us-east-1
|
||||
```
|
||||
|
||||
See the [consumer guide](../../docs/CONSUMER_GUIDE.md) for a
|
||||
step-by-step walkthrough, and the [s3 README](../l1/s3/README.md) for the
|
||||
underlying L1 primitive.
|
||||
|
||||
## Compliance extension points
|
||||
|
||||
The composition will need to wire compliance resources when the
|
||||
compliance milestone (GDPR, SOX, SOC2, HIPAA, DORA) lands:
|
||||
The composition can wire compliance resources when the compliance
|
||||
milestone (GDPR, SOX, SOC2, HIPAA, DORA) lands:
|
||||
|
||||
- **KMS key** — shared encryption key for S3 SSE.
|
||||
- **S3 access logs** — access logging to a separate audit bucket.
|
||||
- **Object Lock** — 7-year immutable retention for evidence.
|
||||
- **Public access block** — prevent data exfiltration.
|
||||
|
||||
See the [l1-s3 README](../l1/l1-s3/README.md) for per-module compliance
|
||||
extension points.
|
||||
See the [s3 README](../l1/s3/README.md) for per-module compliance extension
|
||||
points.
|
||||
|
||||
## Versioning
|
||||
|
||||
Versioning will be defined when the composition mechanism is
|
||||
redesigned.
|
||||
`1.0.0` — interface MAJOR, behavior MINOR, lifecycle PATCH. MAJOR bumps
|
||||
require a new registry entry (immutable publication); old entries enter
|
||||
a 12-month deprecation window.
|
||||
Reference in New Issue
Block a user