continuous-intelligence/acdl
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 128 Wiki Activity

feat(P25): deploy outputs (SSM + PR comment) + error reporting via Lambda + stage comments

Browse Source 
---ci---
project: acdl
phase: 25
milestone: v1.7
status: execute
---/ci---
This commit is contained in:
Jon Chery
2026-07-22 20:08:30 +00:00
parent 07c0349131
commit 4fe794c7a4
13 changed files with 910 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files
core/lambda/contract_ingestor.py
+102 -9
View File
@@ -5,8 +5,9 @@ communication, D-051). Accepts { consumerRepo, contractId, contract,
environment, action } and writes contracts to DynamoDB table acdl-contracts
(PK consumerRepo, SK contractId#submittedAt).
The report_error action (D-055) is prepared as a stub in this phase; the
GitHub issue creation is implemented in Phase 25.
The report_error action (D-055) creates a GitHub issue on the platform repo
via the GitHub API, using a token from Secrets Manager. It is idempotent: if
an open issue with the same title exists, it comments rather than duplicating.
Cross-account: the Lambda's Function URL uses IAM auth; the consumer's
deploy role (granted during onboarding) invokes it via SigV4-signed
@@ -71,17 +72,109 @@ def _submit_contract(payload):
def _report_error(payload):
# Phase 25 implements the GitHub issue creation.
# This stub validates the payload and returns a prepared status.
"""Create a GitHub issue on the platform repo for a deploy failure (D-055).
Uses the GitHub token from Secrets Manager. Idempotent: if an open
issue with the same title exists, comments on it rather than duplicating.
"""
import urllib.request
required = ["consumerRepo", "contractId", "error"]
for field in required:
if field not in payload:
raise ValueError(f"report_error requires '{field}'")
return {
"status": "error_report_prepared",
"contractId": payload["contractId"],
"action": "report_error",
}
consumer_repo = payload["consumerRepo"]
contract_id = payload["contractId"]
error = payload.get("error", "unknown error")
run_url = payload.get("runUrl", "")
stack_trace = payload.get("stackTrace", "")[:2000] # truncate
# Get the GitHub token from Secrets Manager
secrets = _get_secrets_client()
try:
secret_response = secrets.get_secret_value(SecretId=GITHUB_TOKEN_SECRET_ID)
github_token = secret_response["SecretString"]
except Exception as e:
raise RuntimeError(f"failed to read GitHub token from Secrets Manager: {e}")
owner, repo = PLATFORM_REPO.split("/")
title = f"[ACDL-ALERT] Deploy failure: {consumer_repo} / {contract_id}"
# Check for an existing open issue with the same title (idempotency)
search_url = (
f"https://api.github.com/search/issues?q=repo:{owner}/{repo}"
f"+is:issue+is:open+in:title+%22{contract_id}%22"
)
req = urllib.request.Request(search_url)
req.add_header("Authorization", f"token {github_token}")
req.add_header("Accept", "application/vnd.github+json")
try:
with urllib.request.urlopen(req, timeout=10) as resp:
search_result = json.loads(resp.read())
existing = search_result.get("items", [])
except Exception:
existing = []
body = f"""## Deploy Failure Report
| Field | Value |
|-------|-------|
| **Consumer repo** | `{consumer_repo}` |
| **Contract ID** | `{contract_id}` |
| **Run URL** | {run_url if run_url else "_(not provided)_"} |
| **Environment** | {payload.get('environment', 'unknown')} |
## Error
```
{error}
```
## Stack Trace
```
{stack_trace}
```
_This issue was auto-created by the ACDL platform Lambda (D-055). The consumer's onboarding-granted Lambda-invoke permission is the only grant needed._
"""
if existing:
# Comment on the existing issue
issue_number = existing[0]["number"]
url = f"https://api.github.com/repos/{owner}/{repo}/issues/{issue_number}/comments"
data = json.dumps({"body": body}).encode()
req = urllib.request.Request(url, data=data, method="POST")
req.add_header("Authorization", f"token {github_token}")
req.add_header("Accept", "application/vnd.github+json")
urllib.request.urlopen(req, timeout=10)
return {
"status": "commented_on_existing",
"issueNumber": issue_number,
"contractId": contract_id,
"action": "report_error",
}
else:
# Create a new issue
url = f"https://api.github.com/repos/{owner}/{repo}/issues"
data = json.dumps({
"title": title,
"body": body,
"labels": ["platform-alert", "auto-generated"],
}).encode()
req = urllib.request.Request(url, data=data, method="POST")
req.add_header("Authorization", f"token {github_token}")
req.add_header("Accept", "application/vnd.github+json")
resp = urllib.request.urlopen(req, timeout=10)
issue = json.loads(resp.read())
return {
"status": "issue_created",
"issueNumber": issue["number"],
"issueUrl": issue["html_url"],
"contractId": contract_id,
"action": "report_error",
}
def lambda_handler(event, context):
core/output_publisher.py
+167
View File
@@ -0,0 +1,167 @@
"""Publish deploy outputs to SSM + format GitHub PR comments (D-050).
Two canonical mechanisms:
1. SSM Parameter Store (SecureString, KMS-encrypted) for runtime-injectable
values — resources that need to read outputs at runtime (e.g. an ECS
task reading its S3 bucket name).
2. GitHub PR comment / job summary for human-readable outputs (connection
strings, ALB DNS, S3 bucket URL, CloudFront domain). No raw secrets in
the comment — only non-sensitive outputs (DNS names, ARNs, bucket names).
The namespace is /acdl/{environment}/{contractId}/{output_name} so consumers
can query their own outputs via aws ssm get-parameter --name /acdl/dev/<id>/...
"""
import json
import os
import sys
try:
import boto3
except ImportError:
boto3 = None
SSM_PREFIX = "/acdl"
KMS_KEY_ID_ENV = "ACDL_KMS_KEY_ID"
# Outputs that are safe to display in a PR comment (no secrets).
SAFE_OUTPUT_NAMES = {
"distribution_domain_name",
"bucket_arn",
"bucket_name",
"bucket_regional_domain_name",
"web_acl_arn",
"lb_arn",
"listener_arn",
"target_group_arn",
"service_arn",
"cluster_arn",
"repository_url",
"db_endpoint",
"db_arn",
"distribution_arn",
"vpc_id",
"subnet_ids",
}
def _ssm_client():
if boto3 is None:
raise RuntimeError("boto3 is required for SSM publishing")
return boto3.client("ssm")
def _kms_key_id():
return os.environ.get(KMS_KEY_ID_ENV, "alias/aws/ssm")
def publish_to_ssm(outputs, environment, contract_id):
"""Write each output to SSM Parameter Store as a SecureString.
Returns a dict of {output_name: parameter_arn} for successful writes.
Skips None values and empty strings.
"""
if boto3 is None:
return {}
client = _ssm_client()
kms_key = _kms_key_id()
results = {}
for name, value in outputs.items():
if value is None:
continue
if isinstance(value, str) and not value.strip():
continue
param_name = f"{SSM_PREFIX}/{environment}/{contract_id}/{name}"
try:
client.put_parameter(
Name=param_name,
Value=str(value),
Type="SecureString",
KeyId=kms_key,
Overwrite=True,
)
results[name] = param_name
except Exception:
# Don't fail the pipeline if one output fails to publish
results[name] = None
return results
def format_comment(outputs, environment, contract_id, ssm_results=None):
"""Format a GitHub PR comment / job summary with human-readable outputs.
Only non-sensitive outputs (SAFE_OUTPUT_NAMES) are included. Sensitive
outputs are noted as 'published to SSM' without their values.
"""
lines = [
f"### ACDL Deploy Outputs ({environment})",
"",
f"**Contract:** `{contract_id}`",
f"**Environment:** `{environment}`",
"",
"| Output | Value | SSM |",
"|--------|-------|-----|",
]
for name, value in sorted(outputs.items()):
if value is None:
continue
if isinstance(value, str) and not value.strip():
continue
safe = name in SAFE_OUTPUT_NAMES
display = str(value) if safe else "`(published to SSM)`"
ssm_path = ""
if ssm_results and ssm_results.get(name):
ssm_path = f"`{ssm_results[name]}`"
elif ssm_results is not None:
ssm_path = "—"
lines.append(f"| `{name}` | {display} | {ssm_path} |")
lines.append("")
lines.append("> Sensitive outputs are available via `aws ssm get-parameter --name /acdl/" + environment + "/" + contract_id + "/<output_name>` (KMS-encrypted SecureString).")
return "\n".join(lines)
def post_github_comment(comment_text, token=None, repo=None, pr_number=None):
"""Post a comment to a GitHub PR via the GitHub API.
Uses GITHUB_TOKEN from env if token is None. Uses GITHUB_REPOSITORY if
repo is None. Uses the PR number from the GITHUB_REF env if pr_number is
None (extracts from refs/pull/<N>/merge). No-op if not in a PR context.
"""
if token is None:
token = os.environ.get("GITHUB_TOKEN") or os.environ.get("GH_TOKEN")
if repo is None:
repo = os.environ.get("GITHUB_REPOSITORY", "")
if pr_number is None:
ref = os.environ.get("GITHUB_REF", "")
if "refs/pull/" in ref:
try:
pr_number = int(ref.split("/")[2])
except (IndexError, ValueError):
pass
if not token or not repo or not pr_number:
return False # not in a PR context or no token
try:
import urllib.request
url = f"https://api.github.com/repos/{repo}/issues/{pr_number}/comments"
data = json.dumps({"body": comment_text}).encode()
req = urllib.request.Request(url, data=data, method="POST")
req.add_header("Authorization", f"token {token}")
req.add_header("Accept", "application/vnd.github+json")
urllib.request.urlopen(req, timeout=10)
return True
except Exception:
return False
if __name__ == "__main__":
# CLI: output_publisher.py <outputs.json> <environment> <contract_id>
if len(sys.argv) != 4:
print("usage: output_publisher.py <outputs.json> <environment> <contract-id>", file=sys.stderr)
sys.exit(2)
with open(sys.argv[1]) as f:
outputs = json.load(f)
env = sys.argv[2]
cid = sys.argv[3]
ssm_results = publish_to_ssm(outputs, env, cid)
comment = format_comment(outputs, env, cid, ssm_results)
print(comment)