continuous-intelligence/acdl
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 128 Wiki Activity

feat(P3): Nova rebrand — SSM path + tag keys (REQ-161/162)

Browse Source 
SSM path /acdl/{env}/{contractId}/{output} → /nova/... across
core/output_publisher + contract resolver + consumer docs. New
scripts/migrate_ssm_paths.py (copy/verify/delete, dry-run default).
AWS tag keys acdl:owner|environment|contract|cost-center|ref → nova:*
across terraform tagging + ABAC session policies (iam:ResourceTag/acdl:*
→ iam:ResourceTag/nova:*). nova_tagging.py hard mode (D-109 warn→hard).
tagging-standard.json tag-key values → nova:*. New
scripts/untag_acdl_keys.py (remove old acdl:* tags, dry-run default).
Test fixtures updated; pytest + run_ci.sh PASS.

---ci---
project: acdl
phase: 3
milestone: v1.15
status: execute
---/ci---
This commit is contained in:
Jon Chery
2026-07-30 01:38:30 +00:00
parent e998d9fa6b
commit 51c3edf458
18 changed files with 848 additions and 164 deletions
Download Patch File Download Diff File Expand all files Collapse all files
terraform/ci-vpc/main.tf
+4 -4
View File
@@ -33,8 +33,8 @@ resource "aws_vpc" "ci" {
cidr_block = "10.1.0.0/16"
tags = {
Name = "acdl-ci-vpc"
"acdl:owner" = "acdl"
"acdl:environment" = "ci"
"nova:owner" = "acdl"
"nova:environment" = "ci"
}
}
@@ -45,8 +45,8 @@ resource "aws_subnet" "ci" {
availability_zone = data.aws_availability_zones.available.names[count.index]
tags = {
Name = "acdl-ci-subnet-${count.index}"
"acdl:owner" = "acdl"
"acdl:environment" = "ci"
"nova:owner" = "acdl"
"nova:environment" = "ci"
}
}
terraform/platform/README.md
+1 -1
View File
@@ -59,7 +59,7 @@ flow:
applies [`consumer_invoke_policy.json`](./consumer_invoke_policy.json)
to the consumer's deploy role. The policy grants
`lambda:InvokeFunctionUrl` on the Lambda ARN, scoped via ABAC — the
condition `aws:PrincipalTag/acdl:owner == ${consumerRepo}` ensures a
condition `aws:PrincipalTag/nova:owner == ${consumerRepo}` ensures a
repo can only invoke when it is the owner it claims to be.
2. **Runtime.** The consumer's deploy workflow (running in the consumer
AWS account under the consumer's deploy role) signs the Function URL
terraform/platform/consumer_invoke_policy.json
+1 -1
View File
@@ -7,7 +7,7 @@
"Resource": "arn:aws:lambda:${region}:${account_id}:function:acdl-contract-ingestor",
"Condition": {
"StringEquals": {
"aws:PrincipalTag/acdl:owner": "${consumerRepo}"
"aws:PrincipalTag/nova:owner": "${consumerRepo}"
}
}
}
terraform/platform/main.tf
+40 -40
View File
@@ -75,10 +75,10 @@ resource "aws_dynamodb_table" "acdl_contracts" {
}
tags = {
"acdl:owner" = "acdl"
"acdl:contract" = "platform"
"acdl:environment" = "prod"
"acdl:cost-center" = "acdl-default"
"nova:owner" = "acdl"
"nova:contract" = "platform"
"nova:environment" = "prod"
"nova:cost-center" = "nova-default"
}
}
@@ -89,10 +89,10 @@ resource "aws_secretsmanager_secret" "github_token" {
kms_key_id = aws_kms_key.acdl_platform.arn
tags = {
"acdl:owner" = "acdl"
"acdl:contract" = "platform"
"acdl:environment" = "prod"
"acdl:cost-center" = "acdl-default"
"nova:owner" = "acdl"
"nova:contract" = "platform"
"nova:environment" = "prod"
"nova:cost-center" = "nova-default"
}
}
@@ -168,10 +168,10 @@ resource "aws_lambda_function" "contract_ingestor" {
}
tags = {
"acdl:owner" = "acdl"
"acdl:contract" = "platform"
"acdl:environment" = "prod"
"acdl:cost-center" = "acdl-default"
"nova:owner" = "acdl"
"nova:contract" = "platform"
"nova:environment" = "prod"
"nova:cost-center" = "nova-default"
}
}
@@ -230,10 +230,10 @@ resource "aws_dynamodb_table" "acdl_change_requests" {
}
tags = {
"acdl:owner" = "acdl"
"acdl:contract" = "platform"
"acdl:environment" = "prod"
"acdl:cost-center" = "acdl-default"
"nova:owner" = "acdl"
"nova:contract" = "platform"
"nova:environment" = "prod"
"nova:cost-center" = "nova-default"
}
}
# REQ-107: SNS topic for separation-of-duties halt artifacts.
@@ -242,10 +242,10 @@ resource "aws_sns_topic" "acdl_sod_halt" {
name = "acdl-sod-halt"
kms_master_key_id = aws_kms_key.acdl_platform.id
tags = {
"acdl:owner" = "acdl"
"acdl:contract" = "platform"
"acdl:environment" = "prod"
"acdl:cost-center" = "acdl-default"
"nova:owner" = "acdl"
"nova:contract" = "platform"
"nova:environment" = "prod"
"nova:cost-center" = "nova-default"
}
}
@@ -262,10 +262,10 @@ resource "aws_vpc" "acdl_shared" {
cidr_block = var.vpc_cidr
tags = {
Name = "acdl-shared"
"acdl:owner" = "acdl"
"acdl:contract" = "platform"
"acdl:environment" = "shared"
"acdl:cost-center" = "acdl-default"
"nova:owner" = "acdl"
"nova:contract" = "platform"
"nova:environment" = "shared"
"nova:cost-center" = "nova-default"
}
}
@@ -276,10 +276,10 @@ resource "aws_subnet" "acdl_shared" {
availability_zone = data.aws_availability_zones.available.names[count.index]
tags = {
Name = "acdl-shared-subnet-${count.index}"
"acdl:owner" = "acdl"
"acdl:contract" = "platform"
"acdl:environment" = "shared"
"acdl:cost-center" = "acdl-default"
"nova:owner" = "acdl"
"nova:contract" = "platform"
"nova:environment" = "shared"
"nova:cost-center" = "nova-default"
}
}
@@ -291,10 +291,10 @@ resource "aws_internet_gateway" "acdl_shared" {
vpc_id = aws_vpc.acdl_shared.id
tags = {
Name = "acdl-shared-igw"
"acdl:owner" = "acdl"
"acdl:contract" = "platform"
"acdl:environment" = "shared"
"acdl:cost-center" = "acdl-default"
"nova:owner" = "acdl"
"nova:contract" = "platform"
"nova:environment" = "shared"
"nova:cost-center" = "nova-default"
}
}
@@ -306,10 +306,10 @@ resource "aws_route_table" "acdl_shared" {
}
tags = {
Name = "acdl-shared-rt"
"acdl:owner" = "acdl"
"acdl:contract" = "platform"
"acdl:environment" = "shared"
"acdl:cost-center" = "acdl-default"
"nova:owner" = "acdl"
"nova:contract" = "platform"
"nova:environment" = "shared"
"nova:cost-center" = "nova-default"
}
}
@@ -344,10 +344,10 @@ resource "aws_security_group" "ecs" {
tags = {
Name = "acdl-ecs-sg"
"acdl:owner" = "acdl"
"acdl:contract" = "platform"
"acdl:environment" = "shared"
"acdl:cost-center" = "acdl-default"
"nova:owner" = "acdl"
"nova:contract" = "platform"
"nova:environment" = "shared"
"nova:cost-center" = "nova-default"
}
}