continuous-intelligence/acdl
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 128 Wiki Activity

128 Releases 190 Tags

RSS Feed
  • v1.7.0 e597c0b089
    Compare

    v1.7.0 — Production Platform + Contract Ingestion + Pipeline Maturation
    acdl-ci / Lint (push) Successful in 8s
    Details
    acdl-ci / Test (push) Successful in 24s
    Details
    acdl-ci / Platform check-only (offline) (push) Successful in 9s
    Details
    Stable

    cloudinit-bot released this 2026-07-22 21:26:40 +00:00 | 501 commits to main since this release

    ACDL v1.7.0

    Production platform + contract ingestion + pipeline maturation. The v1.6 milestone left the platform documented and environments-aware; v1.7 takes it to a production-grade platform.

    Phases (6)

    Phase Name Scope
    22 rename-and-production-static-assets-stack Rename static-asset → static-assets (D-048). Author cloudfront + waf primitives. Augment static-assets to S3 + CloudFront (OAC) + WAF production stack (D-049). Bump uses: to @v1.6; create floating v1.6 + v1 tags (D-057).
    23 tagging-standards-and-security-adapters Required-tag set + Checkov custom rule (D-054, D-043 closure). Wiz adapter stub (D-052). Kyverno K8s-native adapter (D-053).
    24 platform-lambda-and-contract-ingestion Platform Lambda + DynamoDB acdl-contracts table (D-051) + cross-account IAM via ABAC.
    25 deploy-pipeline-dx-outputs-and-error-reporting SSM SecureString + GitHub PR comment outputs (D-050). Lambda report_error → GitHub issue on platform repo (D-055). Stage comments after each successful stage.
    26 platform-pipelines-and-release-automation 3 platform pipelines (platform-test, primitives-plan, patterns-plan). Release job with semver + MAJOR.MINOR/MAJOR tag maintenance (D-057). Multi-resource L1 ref fix in resolver.
    27 remove-consumer-repos-and-module-documentation-examples Delete consumer-repos/. RDS primitive with multi-engine variation (D-059). Validated per-module examples (D-058).

    Requirements Covered (14)

    REQ-62 (rename), REQ-63 (cloudfront/waf primitives), REQ-64 (production stack + @v1.6), REQ-65 (tagging standard), REQ-66 (Wiz adapter), REQ-67 (Kyverno adapter), REQ-68 (Lambda + DynamoDB + cross-account IAM), REQ-69 (SSM + PR comment outputs), REQ-70 (error reporting via Lambda), REQ-71 (stage comments), REQ-72 (3 platform pipelines), REQ-73 (release job), REQ-74 (remove consumer-repos), REQ-75 (module examples + RDS primitive).

    Decisions (D-048 → D-060)

    • D-048: Full rename including .ciagent/ historical narrative
    • D-049: Production stack = S3 + CloudFront (OAC) + WAF
    • D-050: Outputs via SSM SecureString + GitHub PR comment
    • D-051: Contract ingestion = DynamoDB acdl-contracts
    • D-052: Wiz adapter = stub + schema path
    • D-053: Kyverno adapter = K8s-native policy adapter
    • D-054: Tagging = required-tag set + Checkov custom rule
    • D-055: Error reporting = Lambda → GitHub issue (Gitea excluded)
    • D-056: Ship v1.7.0, bump uses: to @v1.6
    • D-057: Create floating tags in Phase 22
    • D-058: Module examples = separate validated files
    • D-059: Add RDS primitive + multi-engine example

    Tests

    275 tests pass. CI pipeline green (lint + test + check-only).

    Code Review

    1 P0 auto-fixed (run_platform.sh check-only assertions generalized). 2 P1 security fixes applied (URL injection prevention, caller identity validation). 7 P1 flagged for v1.8 post-hoc review.

    New Files

    • modules/l1/cloudfront/ (interface.json + README.md + instance.json)
    • modules/l1/waf/ (interface.json + README.md + instance.json)
    • modules/l1/rds/ (interface.json + README.md + instance.json)
    • modules/l2/static-assets/ (renamed from static-asset, augmented composition)
    • core/lambda/contract_ingestor.py (Lambda handler)
    • core/output_publisher.py (SSM + PR comment)
    • adapters/wiz/wiz_adapter.py (Wiz adapter)
    • adapters/kyverno/kyverno_adapter.py (Kyverno adapter)
    • adapters/terraform/policy/custom_rules/acdl_tagging.py (Checkov custom rule)
    • schemas/tagging-standard.json
    • terraform/platform/main.tf (DynamoDB + Lambda + KMS + Secrets Manager + Function URL)
    • .github/workflows/platform-test.yml, primitives-plan.yml, patterns-plan.yml, release.yml
    • scripts/post_stage_comment.sh, run_primitive_plan.sh, run_pattern_plan.sh
    • 25 validated module example contracts (modules/*/examples/*.yaml)
    • tests/test_contract_ingestor.py, test_output_publisher.py, test_wiz_adapter.py, test_kyverno_adapter.py, test_release_logic.py

    Floating Tags

    • v1.7.0 — this release
    • v1.7 — floating MAJOR.MINOR (consumers pin @v1.7 for updates within v1.7.x)
    • v1 — floating MAJOR (consumers pin @v1 for all v1.x updates)

    The release job (.github/workflows/release.yml) maintains these going forward.

    Known Issues (P1, deferred to v1.8)

    • SSM parameters use AWS-managed key, not platform CMK
    • WAF custom rules emit invalid HCL (attribute vs block syntax)
    • WAF default_action input silently ignored
    • consumer_invoke_policy.json has placeholder account ID
    • L2 composition outputs section not implemented in resolver
    • terraform/spike/*.tf overwritten by run_platform.sh (local state contamination)
    • GitHub API URLs hardcoded (Gitea deployments silently fail — by design per D-055)
    Downloads