continuous-intelligence/acdl
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 128 Wiki Activity

feat(P22): rename static-asset→static-assets + cloudfront/waf primitives + production stack + @v1.6 bump

Browse Source 
---ci---
phase: 22
title: rename-and-production-static-assets-stack
status: complete
verification:
  - scripts/run_ci.sh: PASS (CI PIPELINE OK)
  - python3 -m pytest tests/ -v: 175 passed
  - scripts/run_platform.sh --check-only: PASS (PLATFORM CHECK OK)
  - grep -R "static-asset[^s]" . (excl .git/): 0 hits
  - grep -R "static-asset$" . (excl .git/): 0 hits
  - floating git tags v1.6 + v1 point at v1.6.0 (a90a756)
changed_files:
  - Task 1 (rename): contracts/static-asset.yaml→static-assets.yaml (git mv); modules/l2/static-asset→static-assets (git mv); sed replaceAll static-asset→static-assets in 22 files (README, docs, scripts/run_platform.sh, pipelines/deploy.yaml, modules/registry.json, tests/*, .ciagent/* historical narrative)
  - Task 2 (cloudfront primitive): modules/l1/cloudfront/interface.json + README.md
  - Task 3 (waf primitive): modules/l1/waf/interface.json + README.md
  - Task 4 (registry): modules/registry.json (+cloudfront, +waf, static-assets renamed)
  - Task 5 (augment static-assets): modules/l2/static-assets/composition.json (s3+cloudfront+waf, depth 1); modules/l1/s3/interface.json +instance.json (+bucket_regional_domain_name output); modules/l2/static-assets/README.md (production stack docs)
  - Task 6 (adapter): adapters/terraform/adapter.py (+TYPE_MAP/INPUT_MAP/OUTPUT_MAP for cloudfront distribution+OAC+wafv2 webacl; special handling in _emit_resource for OAC defaults, distribution origin/cache_behavior/restrictions/viewer_certificate/web_acl_id, waf scope/default_action/visibility_config/managed rules)
  - Task 7 (contract schema): no change needed (generic inputs object; new module names match ^[a-z][a-z0-9-]*$)
  - Task 8 (@v1.6 bump): contracts/static-assets.yaml, .gitea/.github/workflows/deploy.yml (ref: v1.6 + header comments), docs/consumer-guide.md, docs/contracts/index.md, docs/pipeline/versioning.md, docs/pipeline/index.md, docs/architecture.md, README.md, modules/l2/microservice/README.md, tests/test_environment_check.py, tests/test_pipeline_contract.py
  - Task 9 (floating tags): git tag -f v1.6 v1.6.0; git tag -f v1 v1.6.0
  - Task 10 (tests): tests/test_adapter.py (registry 11 entries/9 L1/2 L2; cloudfront+waf type map tests; TestS3Output bucket_regional_domain_name; TestStaticAssetsStack 4 tests); tests/test_contract_resolver.py (+s3/cloudfront/waf resource assertions)
generated:
  - terraform/spike/main.tf + terraform.tf (regenerated by run_platform.sh --check-only; reflect static-assets production stack + backend key spike/static-assets/)
notes:
  - D-048 full rewrite of .ciagent/ historical narrative (verbatim phase descriptions, REQ-25/27/50, D-036) — produces intentional tautologies (e.g. "Rename static-assets → static-assets") per the decision to override the v1.6 preservation precedent.
  - cloudfront interface.json resources array ordered distribution-first so the resolver (first-match wire resolution) routes bucket_regional_domain_name/waf_web_acl_arn/region to the distribution; the OAC gets adapter-provided defaults (name=acdl-oac, origin_type=s3, signing_behavior=always).
  - .ciagent/ @v1.4 references left as historical record (D-048 scope was static-asset rename only; @v1.4 is historical narrative of Phase 20).
  - s3 OUTPUT_MAP bucket_regional_domain_name not added (identity fallback in adapt() already handles it; OUTPUT_MAP documents non-identity mappings only).
---ci---
This commit is contained in:
Jon Chery
2026-07-22 19:56:52 +00:00
parent 2732abb23f
commit dca35c78ec
37 changed files with 804 additions and 191 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/architecture.md
+2 -2
View File
@@ -36,7 +36,7 @@ The four layers:
cluster). A primitive does not reference other primitives; it takes its
environment as input.
2. **Modules** — patterns that combine primitives into deployable
infrastructure shapes (an ECS Fargate microservice, a static-asset site).
infrastructure shapes (an ECS Fargate microservice, a static-assets site).
A module references registered primitives (max depth 5).
3. **Developer surface** — the developer-owned workflow file + contract. The
developer references the central pipeline via a versioned tag and owns
@@ -230,7 +230,7 @@ change to the modules/stack/confidence/audit.
- A MAJOR bump requires a new registry entry (immutable publication); the
old entry enters a 12-month deprecation window.
- The central deploy pipeline is referenced by a floating MAJOR + MINOR tag
(e.g. `@v1.4`); patch fixes flow within the tag, breaking changes land
(e.g. `@v1.6`); patch fixes flow within the tag, breaking changes land
under the next MINOR tag.
See [Versioning](pipeline/versioning) for the consumer-facing details.
docs/consumer-guide.md
+23 -19
View File
@@ -2,7 +2,7 @@
This guide walks a consumer through creating their pipeline and defining a
contract that deploys any ACDL module to AWS. It is **generic** across all
modules in the registry; `static-asset` is the worked example, but every
modules in the registry; `static-assets` is the worked example, but every
step applies to `microservice` and any future module.
## The model
@@ -19,7 +19,7 @@ definitions.
```mermaid
flowchart LR
A["your repo<br/>(app code + contracts + CI definitions)"] -->|uses: acdl/.github/workflows/deploy.yml@v1.4| B
A["your repo<br/>(app code + contracts + CI definitions)"] -->|uses: acdl/.github/workflows/deploy.yml@v1.6| B
B["platform runners<br/>(modules + pipelines + adapters + schemas)"] -->|contract -&gt; resolver -&gt; stack -&gt; adapter<br/>-&gt; security checks -&gt; infrastructure plan -&gt; policy checks<br/>-&gt; confidence -&gt; apply -&gt; evidence event| C
C["your resources in AWS"]
```
@@ -27,7 +27,7 @@ flowchart LR
## Versioning the `uses:` reference
The central deployment pipeline is **always versioned with floating MAJOR
and MINOR tags** (e.g. `acdl/pipelines/deploy.yaml@v1.4`). Version
and MINOR tags** (e.g. `acdl/pipelines/deploy.yaml@v1.6`). Version
constraints cannot be expressed inside the contract, so the tag in
`uses:` is the only immutability lever a consumer has. See
[Versioning](pipeline/versioning) for the full rationale.
@@ -47,7 +47,7 @@ platform-managed. See [Environments](environments/).
environment is bound, your first pipeline run emits a friendly onboarding
prompt. See [Environments](environments/).
- **Authorization to reference the central pipeline.** Onboarding grants
your repo the right to `uses: acdl/.github/workflows/deploy.yml@v1.4`.
your repo the right to `uses: acdl/.github/workflows/deploy.yml@v1.6`.
Contact the platform team if you have not been onboarded.
## Step 1 — Create a consumer repo
@@ -92,7 +92,7 @@ In your contract YAML, declare `uses:` pointing at the central ACDL
deployment pipeline with a **versioned tag** (floating MAJOR + MINOR):
```yaml
uses: acdl/pipelines/deploy.yaml@v1.4
uses: acdl/pipelines/deploy.yaml@v1.6
```
This tells the platform to run the standard deployment pipeline:
@@ -101,11 +101,11 @@ policy checks → confidence → evidence event → apply.
## Step 3 — Define the contract
Write `.acdl/contract.yaml`. The `static-asset` example:
Write `.acdl/contract.yaml`. The `static-assets` example:
```yaml
uses: acdl/pipelines/deploy.yaml@v1.4
module: static-asset
uses: acdl/pipelines/deploy.yaml@v1.6
module: static-assets
environment: dev
inputs:
bucket_name: my-static-site-assets
@@ -115,7 +115,7 @@ inputs:
A `microservice` example:
```yaml
uses: acdl/pipelines/deploy.yaml@v1.4
uses: acdl/pipelines/deploy.yaml@v1.6
module: microservice
environment: dev
inputs:
@@ -129,8 +129,8 @@ inputs:
| Field | Type | Required | Description |
|-------|------|----------|-------------|
| `uses` | string | yes | Reference to the central deployment pipeline, **versioned** with a floating MAJOR+MINOR tag (e.g. `acdl/pipelines/deploy.yaml@v1.4`). Bare or `@main` references are discouraged. See [Versioning](pipeline/versioning). |
| `module` | string | yes | Module name from the registry — any primitive or module (e.g. `static-asset`, `microservice`, `s3`). See the [module catalog](modules/). |
| `uses` | string | yes | Reference to the central deployment pipeline, **versioned** with a floating MAJOR+MINOR tag (e.g. `acdl/pipelines/deploy.yaml@v1.6`). Bare or `@main` references are discouraged. See [Versioning](pipeline/versioning). |
| `module` | string | yes | Module name from the registry — any primitive or module (e.g. `static-assets`, `microservice`, `s3`). See the [module catalog](modules/). |
| `environment` | string | yes | The platform-managed environment to deploy to (e.g. `dev`). See [Environments](environments/). |
| `inputs` | object | yes | Module-specific inputs (see the module's README). |
@@ -163,14 +163,14 @@ on:
branches: [main]
jobs:
deploy:
uses: acdl/.github/workflows/deploy.yml@v1.4
uses: acdl/.github/workflows/deploy.yml@v1.6
with:
contract: .acdl/contract.yaml
```
That is the entire consumer-side workflow. When you push to `main`:
1. The platform runner resolves `uses: acdl/.github/workflows/deploy.yml@v1.4`
1. The platform runner resolves `uses: acdl/.github/workflows/deploy.yml@v1.6`
to the reusable workflow **at the pinned tag**.
2. A **platform-provided runner** checks out **your** repo.
3. The runner checks out the **ACDL platform repo** into the workspace —
@@ -245,22 +245,26 @@ flowchart TD
After a successful `dev` run, the resources declared by your module's
pattern exist in your AWS account, and an evidence event is recorded.
For the `static-asset` example:
For the `static-assets` example:
- **An S3 bucket** named `my-static-site-assets` in `us-east-1` with
versioning enabled.
- **A CloudFront distribution** with the S3 bucket as the origin (via
Origin Access Control) and HTTPS redirection.
- **A WAFv2 Web ACL** (CloudFront-scoped) associated with the
distribution.
- **An evidence event** in the audit outbox with the contract ID, stack
name (`static-asset`), confidence score, and band.
name (`static-assets`), confidence score, and band.
- **A confidence band** of `pass` (score ≥ 0.50 for dev).
For other modules, consult the module's README
(`modules/l1/<name>/README.md` or `modules/l2/<name>/README.md`) for the
exact resources created.
## Step 7 — Upload your content (static-asset example)
## Step 7 — Upload your content (static-assets example)
The platform provisions the infrastructure; you upload your content. For
the `static-asset` module:
the `static-assets` module:
```bash
aws s3 sync ./assets s3://my-static-site-assets/ --acl public-read
@@ -274,7 +278,7 @@ push your container image to the ECR repo the platform created.
Change `environment` in your contract (keeping the same versioned `uses:`):
```yaml
uses: acdl/pipelines/deploy.yaml@v1.4
uses: acdl/pipelines/deploy.yaml@v1.6
environment: qa # QA attestation + confidence >= 0.75
```
@@ -303,7 +307,7 @@ per-module extension points. Common examples:
| Contract schema | `schemas/contract.schema.json` | JSON Schema for consumer contracts. |
| Stack schema | `schemas/stack.schema.json` | JSON Schema for the resolved stack instance. |
| Module catalog | [modules/](modules/) | All primitives and modules. |
| Sample contract | `contracts/static-asset.yaml` | The reference example contract (uses `@v1.4`). |
| Sample contract | `contracts/static-assets.yaml` | The reference example contract (uses `@v1.6`). |
| Contract resolver | `core/contract_resolver.py` | Resolves contracts to stack instances. |
| Substrate adapter | `adapters/terraform/adapter.py` | Compiles stack instances to infrastructure. |
| Platform pipeline runner | `scripts/run_platform.sh` | The pipeline runner (platform-side; consumers do not invoke it directly). |
docs/contracts/index.md
+8 -8
View File
@@ -8,11 +8,11 @@ resolves, and deploys it.
## The contract file
A consumer repo keeps its contract at `.acdl/contract.yaml`. A minimal
example (the `static-asset` module):
example (the `static-assets` module):
```yaml
uses: acdl/pipelines/deploy.yaml@v1.4
module: static-asset
uses: acdl/pipelines/deploy.yaml@v1.6
module: static-assets
environment: dev
inputs:
bucket_name: my-static-site-assets
@@ -22,7 +22,7 @@ inputs:
A `microservice` example:
```yaml
uses: acdl/pipelines/deploy.yaml@v1.4
uses: acdl/pipelines/deploy.yaml@v1.6
module: microservice
environment: dev
inputs:
@@ -36,8 +36,8 @@ inputs:
| Field | Type | Required | Description |
|-------|------|----------|-------------|
| `uses` | string | yes | Reference to the central deploy pipeline, **versioned** with a floating MAJOR+MINOR tag (e.g. `acdl/pipelines/deploy.yaml@v1.4`). Bare or `@main` references are discouraged. See [Versioning](../pipeline/versioning). |
| `module` | string | yes | Module name from the registry — any primitive or module (e.g. `static-asset`, `microservice`, `s3`). See the [module catalog](../modules/). |
| `uses` | string | yes | Reference to the central deploy pipeline, **versioned** with a floating MAJOR+MINOR tag (e.g. `acdl/pipelines/deploy.yaml@v1.6`). Bare or `@main` references are discouraged. See [Versioning](../pipeline/versioning). |
| `module` | string | yes | Module name from the registry — any primitive or module (e.g. `static-assets`, `microservice`, `s3`). See the [module catalog](../modules/). |
| `environment` | string | yes | The platform-managed environment to deploy to (e.g. `dev`). See [Environments](../environments/). |
| `inputs` | object | yes | Module-specific inputs (see the module's README). |
@@ -51,8 +51,8 @@ validate-contract stage with a clear error.
## Sample contract
The reference example is
[`contracts/static-asset.yaml`](https://github.com/acdl/acdl/blob/main/contracts/static-asset.yaml),
which uses `@v1.4` as the canonical versioned `uses:` reference.
[`contracts/static-assets.yaml`](https://github.com/acdl/acdl/blob/main/contracts/static-assets.yaml),
which uses `@v1.6` as the canonical versioned `uses:` reference.
## Multiple contracts
docs/modules/index.md
+3 -1
View File
@@ -23,12 +23,14 @@ module's README documents which resources it creates.
| `iam-role` | `aws_iam_role` — IAM role with assume-role policy | [modules/l1/iam-role/README.md](https://github.com/acdl/acdl/blob/main/modules/l1/iam-role/README.md) |
| `alb` | `aws_lb` + `aws_lb_target_group` + `aws_lb_listener` — Application Load Balancer | [modules/l1/alb/README.md](https://github.com/acdl/acdl/blob/main/modules/l1/alb/README.md) |
| `ecr` | `aws_ecr_repository` — ECR container image repository | [modules/l1/ecr/README.md](https://github.com/acdl/acdl/blob/main/modules/l1/ecr/README.md) |
| `cloudfront` | `aws_cloudfront_distribution` + `aws_cloudfront_origin_access_control` — CloudFront distribution with S3 origin via OAC | [modules/l1/cloudfront/README.md](https://github.com/acdl/acdl/blob/main/modules/l1/cloudfront/README.md) |
| `waf` | `aws_wafv2_web_acl` — WAFv2 Web ACL (CloudFront-scoped) | [modules/l1/waf/README.md](https://github.com/acdl/acdl/blob/main/modules/l1/waf/README.md) |
## Modules
| Module | What it references | Source |
|--------|--------------------|--------|
| `static-asset` | 1 primitive (s3) — a static-asset S3 bucket | [modules/l2/static-asset/README.md](https://github.com/acdl/acdl/blob/main/modules/l2/static-asset/README.md) |
| `static-assets` | 3 primitives (s3, cloudfront, waf) — a production static asset stack | [modules/l2/static-assets/README.md](https://github.com/acdl/acdl/blob/main/modules/l2/static-assets/README.md) |
| `microservice` | 6 primitives (vpc, cluster, ecr, iam-role, alb, ecs-service) — an ECS Fargate microservice | [modules/l2/microservice/README.md](https://github.com/acdl/acdl/blob/main/modules/l2/microservice/README.md) |
## Registry
docs/pipeline/index.md
+1 -1
View File
@@ -39,7 +39,7 @@ It is exposed to consumer repos as a **reusable workflow**:
- `.github/workflows/deploy.yml` — GitHub Actions (production)
A consumer repo invokes the reusable workflow via a **versioned tag**
(floating MAJOR + MINOR, e.g. `acdl/.github/workflows/deploy.yml@v1.4`).
(floating MAJOR + MINOR, e.g. `acdl/.github/workflows/deploy.yml@v1.6`).
The workflow checks out the consumer repo, then checks out the ACDL platform
repo into the runner workspace, and runs `scripts/run_platform.sh` against
the consumer's contract. The consumer never clones the platform repo or
docs/pipeline/versioning.md
+1 -1
View File
@@ -24,7 +24,7 @@ The central deploy pipeline is referenced by a **floating MAJOR + MINOR
tag** in a consumer's contract and CI definition:
```yaml
uses: acdl/pipelines/deploy.yaml@v1.4
uses: acdl/pipelines/deploy.yaml@v1.6
```
Version constraints cannot be expressed inside the contract, so the tag in