continuous-intelligence/acdl
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 128 Wiki Activity

feat(P22): rename static-asset→static-assets + cloudfront/waf primitives + production stack + @v1.6 bump

Browse Source 
---ci---
phase: 22
title: rename-and-production-static-assets-stack
status: complete
verification:
  - scripts/run_ci.sh: PASS (CI PIPELINE OK)
  - python3 -m pytest tests/ -v: 175 passed
  - scripts/run_platform.sh --check-only: PASS (PLATFORM CHECK OK)
  - grep -R "static-asset[^s]" . (excl .git/): 0 hits
  - grep -R "static-asset$" . (excl .git/): 0 hits
  - floating git tags v1.6 + v1 point at v1.6.0 (a90a756)
changed_files:
  - Task 1 (rename): contracts/static-asset.yaml→static-assets.yaml (git mv); modules/l2/static-asset→static-assets (git mv); sed replaceAll static-asset→static-assets in 22 files (README, docs, scripts/run_platform.sh, pipelines/deploy.yaml, modules/registry.json, tests/*, .ciagent/* historical narrative)
  - Task 2 (cloudfront primitive): modules/l1/cloudfront/interface.json + README.md
  - Task 3 (waf primitive): modules/l1/waf/interface.json + README.md
  - Task 4 (registry): modules/registry.json (+cloudfront, +waf, static-assets renamed)
  - Task 5 (augment static-assets): modules/l2/static-assets/composition.json (s3+cloudfront+waf, depth 1); modules/l1/s3/interface.json +instance.json (+bucket_regional_domain_name output); modules/l2/static-assets/README.md (production stack docs)
  - Task 6 (adapter): adapters/terraform/adapter.py (+TYPE_MAP/INPUT_MAP/OUTPUT_MAP for cloudfront distribution+OAC+wafv2 webacl; special handling in _emit_resource for OAC defaults, distribution origin/cache_behavior/restrictions/viewer_certificate/web_acl_id, waf scope/default_action/visibility_config/managed rules)
  - Task 7 (contract schema): no change needed (generic inputs object; new module names match ^[a-z][a-z0-9-]*$)
  - Task 8 (@v1.6 bump): contracts/static-assets.yaml, .gitea/.github/workflows/deploy.yml (ref: v1.6 + header comments), docs/consumer-guide.md, docs/contracts/index.md, docs/pipeline/versioning.md, docs/pipeline/index.md, docs/architecture.md, README.md, modules/l2/microservice/README.md, tests/test_environment_check.py, tests/test_pipeline_contract.py
  - Task 9 (floating tags): git tag -f v1.6 v1.6.0; git tag -f v1 v1.6.0
  - Task 10 (tests): tests/test_adapter.py (registry 11 entries/9 L1/2 L2; cloudfront+waf type map tests; TestS3Output bucket_regional_domain_name; TestStaticAssetsStack 4 tests); tests/test_contract_resolver.py (+s3/cloudfront/waf resource assertions)
generated:
  - terraform/spike/main.tf + terraform.tf (regenerated by run_platform.sh --check-only; reflect static-assets production stack + backend key spike/static-assets/)
notes:
  - D-048 full rewrite of .ciagent/ historical narrative (verbatim phase descriptions, REQ-25/27/50, D-036) — produces intentional tautologies (e.g. "Rename static-assets → static-assets") per the decision to override the v1.6 preservation precedent.
  - cloudfront interface.json resources array ordered distribution-first so the resolver (first-match wire resolution) routes bucket_regional_domain_name/waf_web_acl_arn/region to the distribution; the OAC gets adapter-provided defaults (name=acdl-oac, origin_type=s3, signing_behavior=always).
  - .ciagent/ @v1.4 references left as historical record (D-048 scope was static-asset rename only; @v1.4 is historical narrative of Phase 20).
  - s3 OUTPUT_MAP bucket_regional_domain_name not added (identity fallback in adapt() already handles it; OUTPUT_MAP documents non-identity mappings only).
---ci---
This commit is contained in:
Jon Chery
2026-07-22 19:56:52 +00:00
parent 2732abb23f
commit dca35c78ec
37 changed files with 804 additions and 191 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/test_adapter.py
+66 -6
View File
@@ -31,14 +31,14 @@ class TestInstance:
class TestRegistry:
EXPECTED_L1_KEYS = {"s3", "vpc", "ecs-cluster", "ecs-service", "iam-role", "alb", "ecr"}
EXPECTED_L2_KEYS = {"static-asset", "microservice"}
EXPECTED_L1_KEYS = {"s3", "vpc", "ecs-cluster", "ecs-service", "iam-role", "alb", "ecr", "cloudfront", "waf"}
EXPECTED_L2_KEYS = {"static-assets", "microservice"}
def test_registry_has_9_entries(self, registry):
assert len(registry) == 9
def test_registry_has_11_entries(self, registry):
assert len(registry) == 11
assert set(registry.keys()) == (self.EXPECTED_L1_KEYS | self.EXPECTED_L2_KEYS)
def test_registry_has_7_l1_entries(self, registry):
def test_registry_has_9_l1_entries(self, registry):
l1 = {k for k in registry if registry[k]["1.0.0"]["interface"].startswith("modules/l1/")}
assert l1 == self.EXPECTED_L1_KEYS
@@ -78,6 +78,13 @@ class TestTypeMap:
assert TYPE_MAP["aws:iam:role"] == "aws_iam_role"
assert TYPE_MAP["aws:ecr:repository"] == "aws_ecr_repository"
def test_cloudfront_types_in_type_map(self):
assert TYPE_MAP["aws:cloudfront:distribution"] == "aws_cloudfront_distribution"
assert TYPE_MAP["aws:cloudfront:originaccesscontrol"] == "aws_cloudfront_origin_access_control"
def test_waf_type_in_type_map(self):
assert TYPE_MAP["aws:wafv2:webacl"] == "aws_wafv2_web_acl"
class TestTfValue:
def test_string_quoted(self):
@@ -177,4 +184,57 @@ class TestAdapt:
out_dir = str(tmp_path / "tf_out")
adapt(stack_instance, out_dir)
terraform_tf = open(os.path.join(out_dir, "terraform.tf")).read()
assert "spike/s3/terraform.tfstate" in terraform_tf
assert "spike/s3/terraform.tfstate" in terraform_tf
class TestS3Output:
def test_s3_instance_has_bucket_regional_domain_name_output(self, stack_instance, tmp_path):
out_dir = str(tmp_path / "tf_out")
adapt(stack_instance, out_dir)
main_tf = open(os.path.join(out_dir, "main.tf")).read()
assert 'output "bucket_regional_domain_name"' in main_tf
assert "aws_s3_bucket.s3.bucket_regional_domain_name" in main_tf
class TestStaticAssetsStack:
@pytest.fixture
def static_assets_stack(self):
from core.contract_resolver import resolve
return resolve(str(ROOT / "contracts/static-assets.yaml"), str(ROOT))
def test_static_assets_resolves_to_4_resources(self, static_assets_stack):
types = [r["type"] for r in static_assets_stack["resources"]]
assert "aws:s3:bucket" in types
assert "aws:cloudfront:distribution" in types
assert "aws:cloudfront:originaccesscontrol" in types
assert "aws:wafv2:webacl" in types
def test_static_assets_adapter_emits_all_resources(self, static_assets_stack, tmp_path):
out_dir = str(tmp_path / "tf_out")
adapt(static_assets_stack, out_dir)
main_tf = open(os.path.join(out_dir, "main.tf")).read()
assert 'resource "aws_s3_bucket" "s3"' in main_tf
assert 'resource "aws_cloudfront_distribution" "cloudfront-distribution"' in main_tf
assert 'resource "aws_cloudfront_origin_access_control" "cloudfront-originaccesscontrol"' in main_tf
assert 'resource "aws_wafv2_web_acl" "waf"' in main_tf
def test_static_assets_adapter_wires_s3_origin_to_cloudfront(self, static_assets_stack, tmp_path):
out_dir = str(tmp_path / "tf_out")
adapt(static_assets_stack, out_dir)
main_tf = open(os.path.join(out_dir, "main.tf")).read()
assert "aws_s3_bucket.s3.bucket_regional_domain_name" in main_tf
assert "aws_cloudfront_origin_access_control.cloudfront-originaccesscontrol.id" in main_tf
def test_static_assets_adapter_wires_waf_to_cloudfront(self, static_assets_stack, tmp_path):
out_dir = str(tmp_path / "tf_out")
adapt(static_assets_stack, out_dir)
main_tf = open(os.path.join(out_dir, "main.tf")).read()
assert "aws_wafv2_web_acl.waf.arn" in main_tf
assert "web_acl_id = aws_wafv2_web_acl.waf.arn" in main_tf
def test_static_assets_adapter_emits_distribution_outputs(self, static_assets_stack, tmp_path):
out_dir = str(tmp_path / "tf_out")
adapt(static_assets_stack, out_dir)
main_tf = open(os.path.join(out_dir, "main.tf")).read()
assert 'output "distribution_domain_name"' in main_tf
assert 'output "web_acl_arn"' in main_tf
tests/test_contract_resolver.py
+13 -4
View File
@@ -26,15 +26,24 @@ class TestContractSchema:
class TestResolveStaticAsset:
def test_resolve_static_asset_contract(self, tmp_path):
from core.contract_resolver import resolve
stack = resolve(str(ROOT / "contracts/static-asset.yaml"), str(ROOT))
assert stack["stack"]["name"] == "static-asset"
stack = resolve(str(ROOT / "contracts/static-assets.yaml"), str(ROOT))
assert stack["stack"]["name"] == "static-assets"
assert stack["stack"]["kind"] == "l2"
assert stack["stack"]["depth"] == 1
assert len(stack["resources"]) >= 1
def test_resolve_static_asset_has_s3_cloudfront_waf_resources(self):
from core.contract_resolver import resolve
stack = resolve(str(ROOT / "contracts/static-assets.yaml"), str(ROOT))
types = [r["type"] for r in stack["resources"]]
assert "aws:s3:bucket" in types
assert "aws:cloudfront:distribution" in types
assert "aws:cloudfront:originaccesscontrol" in types
assert "aws:wafv2:webacl" in types
def test_resolve_static_asset_has_s3_resource(self):
from core.contract_resolver import resolve
stack = resolve(str(ROOT / "contracts/static-asset.yaml"), str(ROOT))
stack = resolve(str(ROOT / "contracts/static-assets.yaml"), str(ROOT))
s3_res = [r for r in stack["resources"] if r["type"] == "aws:s3:bucket"]
assert len(s3_res) == 1
assert s3_res[0]["inputs"]["bucket_name"] == "acdl-spike-bucket"
@@ -42,7 +51,7 @@ class TestResolveStaticAsset:
def test_resolve_static_asset_validates_against_stack_schema(self):
from core.contract_resolver import resolve
stack = resolve(str(ROOT / "contracts/static-asset.yaml"), str(ROOT))
stack = resolve(str(ROOT / "contracts/static-assets.yaml"), str(ROOT))
schema = json.load(open(ROOT / "schemas/stack.schema.json"))
jsonschema.validate(stack, schema)
tests/test_environment_check.py
+5 -5
View File
@@ -32,15 +32,15 @@ class TestEnvironmentCheck:
assert "IAM role" in msg
def test_contract_with_dev_environment_passes(self):
ok, msg = check(contract_path=str(ROOT / "contracts/static-asset.yaml"), root=ROOT)
ok, msg = check(contract_path=str(ROOT / "contracts/static-assets.yaml"), root=ROOT)
assert ok is True
assert "dev" in msg
def test_contract_with_missing_environment_fails(self, tmp_path):
contract = tmp_path / "contract.yaml"
contract.write_text(
"uses: acdl/pipelines/deploy.yaml@v1.4\n"
"module: static-asset\n"
"uses: acdl/pipelines/deploy.yaml@v1.6\n"
"module: static-assets\n"
"environment: no-such-env\n"
"inputs:\n bucket_name: x\n region: us-east-1\n"
)
@@ -55,8 +55,8 @@ class TestEnvironmentCheck:
def test_contract_without_environment_field_returns_false(self, tmp_path):
contract = tmp_path / "contract.yaml"
contract.write_text(
"uses: acdl/pipelines/deploy.yaml@v1.4\n"
"module: static-asset\n"
"uses: acdl/pipelines/deploy.yaml@v1.6\n"
"module: static-assets\n"
"inputs:\n bucket_name: x\n region: us-east-1\n"
)
ok, msg = check(contract_path=str(contract), root=ROOT)
tests/test_pipeline_contract.py
+2 -2
View File
@@ -354,8 +354,8 @@ class TestDeployWorkflowConformance:
class TestSampleContractVersioning:
def test_sample_contract_uses_versioned_tag(self):
contract = _load_yaml("contracts/static-asset.yaml")
contract = _load_yaml("contracts/static-assets.yaml")
uses = contract["uses"]
assert "@v" in uses, "sample contract must use a versioned @vX.Y tag"
assert "@main" not in uses, "sample contract must not use @main"
assert uses == "acdl/pipelines/deploy.yaml@v1.4"
assert uses == "acdl/pipelines/deploy.yaml@v1.6"