Jon Chery
07c0349131
Phase 24 — platform-lambda-and-contract-ingestion. - core/lambda/contract_ingestor.py: AWS Lambda handler invoked via Function URL (IAM auth). Parses JSON body, validates required fields, writes the contract to DynamoDB table acdl-contracts (PK consumerRepo, SK contractId#submittedAt, status submitted, ISO-8601 submittedAt). report_error action is a stub returning "error_report_prepared"; GitHub issue creation is wired in Phase 25. Returns 400 on missing fields / unknown action, 500 on error. Table name + GitHub-token secret ID come from env (set by Terraform). - core/lambda/__init__.py: empty package marker. - terraform/platform/main.tf: DynamoDB acdl-contracts (PITR, SSE via CMK), KMS customer-managed key with alias/acdl-platform, Secrets Manager secret acdl/github-token, IAM execution role (DynamoDB write + Secrets Manager read + KMS decrypt + CloudWatch logs), Lambda acdl-contract-ingestor (Python 3.12, handler contract_ingestor.lambda_handler), Function URL with AWS_IAM auth. State key platform/terraform.tfstate (distinct from spike/microservice). - terraform/platform/README.md: documents what it deploys, the state key, how to apply, and the cross-account invocation model. - terraform/platform/consumer_invoke_policy.json: ABAC-scoped policy template applied to consumer deploy roles during onboarding; grants lambda:InvokeFunctionUrl conditioned on aws:PrincipalTag/acdl:owner == consumerRepo. - tests/test_contract_ingestor.py: 11 tests (moto-backed DynamoDB mock) covering submit_contract put_item shape, report_error stub, missing-field 400, unknown action 400, the lambda_handler wrapper with a Function-URL-style event, dict body, default action, and internal-error 500. - docs/environments/index.md: new section documenting the cross-account contract-ingestion grant (one-way consumer→platform, D-051) and that onboarding now also grants the consumer deploy role InvokeFunctionUrl. - scripts/run_ci.sh, pipelines/ci.yaml, .gitea/workflows/ci.yml, .github/workflows/ci.yml: add core/lambda/contract_ingestor.py to the lint py_compile list. The two workflow YAMLs remain byte-identical. Verification: scripts/run_ci.sh passes all 3 stages (lint/test/check-only); python3 -m pytest tests/ -v passes all 213 tests (11 new + 202 existing). ---ci--- project: acdl phase: 24 milestone: v1.7 status: execute ---/ci---
51 lines
1.8 KiB
YAML
51 lines
1.8 KiB
YAML
# ACDL Central CI Pipeline Contract (v1.5)
|
|
#
|
|
# This is the single source of truth for the CI/CD pipeline. Both
|
|
# .gitea/workflows/ci.yml (Gitea Actions, dev) and
|
|
# .github/workflows/ci.yml (GitHub Actions, production) implement the
|
|
# stages, commands, triggers, and runner declared here.
|
|
# scripts/run_ci.sh mirrors the same stages for shell reproducibility.
|
|
#
|
|
# A test (tests/test_pipeline_contract.py) validates that both workflow
|
|
# YAMLs conform to this contract and that run_ci.sh runs the same commands.
|
|
#
|
|
# The contract does NOT replace workflow YAML syntax — it declares the
|
|
# *intent* that the forge-specific workflows implement. The workflow files
|
|
# use Gitea/GitHub Actions syntax (checkout, setup-python, run blocks);
|
|
# this contract declares what those blocks must contain.
|
|
#
|
|
# Validated against schemas/pipeline.schema.json.
|
|
|
|
name: acdl-ci
|
|
environment: dev
|
|
triggers:
|
|
push: [main]
|
|
pull_request: [main]
|
|
runner: ubuntu-latest
|
|
python_version: "3.12"
|
|
|
|
stages:
|
|
- name: lint
|
|
description: Compile all Python files (py_compile)
|
|
command: |
|
|
python3 -m py_compile \
|
|
core/confidence_signal.py \
|
|
core/outbox_writer.py \
|
|
core/contract_resolver.py \
|
|
core/lambda/contract_ingestor.py \
|
|
adapters/terraform/adapter.py \
|
|
adapters/terraform/policy/checkov_adapter.py \
|
|
scripts/push_consumer_image.py
|
|
required: true
|
|
|
|
- name: test
|
|
description: Run the pytest test suite offline
|
|
command: python3 -m pytest tests/ -v --tb=short
|
|
install: pip install -r requirements-test.txt
|
|
required: true
|
|
|
|
- name: check-only
|
|
description: Run the platform pipeline offline (no AWS/Checkov/DynamoDB)
|
|
command: bash scripts/run_platform.sh --check-only
|
|
install: pip install jsonschema pyyaml boto3
|
|
required: true |