Files

T

Jon Chery 2a84c0047b feat(P20): consumer happy path + reusable deploy workflow (v1.5.0)

---ci---
project: acdl
phase: 20
milestone: v1.5
status: verify
---/ci---

REQ-46: README rewritten — platform-source vs consumer-repo distinction up
front; platform flow converted to mermaid flowchart TD; L3A/L3B + spike
nomenclature scrubbed from prose (code paths kept verbatim); prereqs pointer
to consumer guide added.
REQ-47: docs/CONSUMER_GUIDE.md (generic, all L2 modules) replaces
docs/consumer-guide-static-asset.md — mermaid diagrams (model LR + pipeline
TD), versioned uses: (@v1.4 floating MAJOR+MINOR, bare/@main discouraged),
consumer-scoped prerequisites (no Terraform/Checkov/boto3/runner-key), run-
time platform fetch via reusable workflow (consumers never invoke
scripts/run_platform.sh locally for the happy path), optional local
validation note.
REQ-48: Credentials section rewritten — zero-trust OIDC + ABAC default
(repo-identity + resource-tag scoping, blast-radius containment); static-key
override in GitHub Secrets or .env.secrets with platform-managed daily
rotation; consumer rotates out of band when using .env.secrets locally.
REQ-49: byte-identical .gitea/workflows/deploy.yml + .github/workflows/
deploy.yml — reusable (on: workflow_call), checks out consumer repo + ACDL
platform repo, installs deps, runs run_platform.sh, uploads artifacts; OIDC
default (permissions: id-token: write) + static-key override via secrets.
REQ-50: contracts/static-asset.yaml uses: @v1.4 (MAJOR+MINOR).
REQ-51: tests/test_pipeline_contract.py extended — TestDeployPipelineSchema,
TestDeployPipelineContract, TestDeployWorkflowConformance (byte-identical,
reusable, contract/mode inputs, run_platform invocation, platform-repo
checkout, OIDC permissions), TestSampleContractVersioning. 154 tests pass
(19 new); run_ci.sh green.

Fixes: modules/l2/static-asset/README.md dangling link retargeted to
docs/CONSUMER_GUIDE.md.

2026-07-22 17:14:12 +00:00

1.8 KiB

Raw Blame History

static-asset — S3 static asset

Module kind: L2 composition | Version: 1.0.0

A composition that references the s3 L1 primitive to deploy a single S3 bucket for static asset hosting.

Resources

The composition references this L1 primitive:

L1 module	Purpose	README
`s3`	S3 bucket	README

Inputs

Name	Type	Required	Description
`bucket_name`	string	yes	Globally-unique S3 bucket name
`region`	string	yes	AWS region the bucket is created in

Outputs

Name	Type	Description
`bucket_arn`	arn	The S3 bucket ARN
`bucket_name`	string	The bucket name (echoes the input)

Usage

Define a contract referencing this composition:

uses: acdl/pipelines/deploy.yaml@v1
module: static-asset
environment: dev
inputs:
  bucket_name: my-static-assets
  region: us-east-1

See the consumer guide for a step-by-step walkthrough, and the s3 README for the underlying L1 primitive.

Compliance extension points

The composition can wire compliance resources when the compliance milestone (GDPR, SOX, SOC2, HIPAA, DORA) lands:

KMS key — shared encryption key for S3 SSE.
S3 access logs — access logging to a separate audit bucket.
Object Lock — 7-year immutable retention for evidence.
Public access block — prevent data exfiltration.

See the s3 README for per-module compliance extension points.

Versioning

1.0.0 — interface MAJOR, behavior MINOR, lifecycle PATCH. MAJOR bumps require a new registry entry (immutable publication); old entries enter a 12-month deprecation window.

1.8 KiB Raw Blame History