Jon Chery
dca35c78ec
---ci---
phase: 22
title: rename-and-production-static-assets-stack
status: complete
verification:
- scripts/run_ci.sh: PASS (CI PIPELINE OK)
- python3 -m pytest tests/ -v: 175 passed
- scripts/run_platform.sh --check-only: PASS (PLATFORM CHECK OK)
- grep -R "static-asset[^s]" . (excl .git/): 0 hits
- grep -R "static-asset$" . (excl .git/): 0 hits
- floating git tags v1.6 + v1 point at v1.6.0 (a90a756)
changed_files:
- Task 1 (rename): contracts/static-asset.yaml→static-assets.yaml (git mv); modules/l2/static-asset→static-assets (git mv); sed replaceAll static-asset→static-assets in 22 files (README, docs, scripts/run_platform.sh, pipelines/deploy.yaml, modules/registry.json, tests/*, .ciagent/* historical narrative)
- Task 2 (cloudfront primitive): modules/l1/cloudfront/interface.json + README.md
- Task 3 (waf primitive): modules/l1/waf/interface.json + README.md
- Task 4 (registry): modules/registry.json (+cloudfront, +waf, static-assets renamed)
- Task 5 (augment static-assets): modules/l2/static-assets/composition.json (s3+cloudfront+waf, depth 1); modules/l1/s3/interface.json +instance.json (+bucket_regional_domain_name output); modules/l2/static-assets/README.md (production stack docs)
- Task 6 (adapter): adapters/terraform/adapter.py (+TYPE_MAP/INPUT_MAP/OUTPUT_MAP for cloudfront distribution+OAC+wafv2 webacl; special handling in _emit_resource for OAC defaults, distribution origin/cache_behavior/restrictions/viewer_certificate/web_acl_id, waf scope/default_action/visibility_config/managed rules)
- Task 7 (contract schema): no change needed (generic inputs object; new module names match ^[a-z][a-z0-9-]*$)
- Task 8 (@v1.6 bump): contracts/static-assets.yaml, .gitea/.github/workflows/deploy.yml (ref: v1.6 + header comments), docs/consumer-guide.md, docs/contracts/index.md, docs/pipeline/versioning.md, docs/pipeline/index.md, docs/architecture.md, README.md, modules/l2/microservice/README.md, tests/test_environment_check.py, tests/test_pipeline_contract.py
- Task 9 (floating tags): git tag -f v1.6 v1.6.0; git tag -f v1 v1.6.0
- Task 10 (tests): tests/test_adapter.py (registry 11 entries/9 L1/2 L2; cloudfront+waf type map tests; TestS3Output bucket_regional_domain_name; TestStaticAssetsStack 4 tests); tests/test_contract_resolver.py (+s3/cloudfront/waf resource assertions)
generated:
- terraform/spike/main.tf + terraform.tf (regenerated by run_platform.sh --check-only; reflect static-assets production stack + backend key spike/static-assets/)
notes:
- D-048 full rewrite of .ciagent/ historical narrative (verbatim phase descriptions, REQ-25/27/50, D-036) — produces intentional tautologies (e.g. "Rename static-assets → static-assets") per the decision to override the v1.6 preservation precedent.
- cloudfront interface.json resources array ordered distribution-first so the resolver (first-match wire resolution) routes bucket_regional_domain_name/waf_web_acl_arn/region to the distribution; the OAC gets adapter-provided defaults (name=acdl-oac, origin_type=s3, signing_behavior=always).
- .ciagent/ @v1.4 references left as historical record (D-048 scope was static-asset rename only; @v1.4 is historical narrative of Phase 20).
- s3 OUTPUT_MAP bucket_regional_domain_name not added (identity fallback in adapt() already handles it; OUTPUT_MAP documents non-identity mappings only).
---ci---
95 lines
4.1 KiB
Markdown
95 lines
4.1 KiB
Markdown
# Pipeline
|
|
|
|
The platform runs two pipelines, both defined by declarative contracts that
|
|
are the single source of truth for the workflow files.
|
|
|
|
## CI pipeline
|
|
|
|
The CI pipeline runs on every push and pull request to `main`. It is defined
|
|
by [`pipelines/ci.yaml`](https://github.com/acdl/acdl/blob/main/pipelines/ci.yaml),
|
|
validated against
|
|
[`schemas/pipeline.schema.json`](https://github.com/acdl/acdl/blob/main/schemas/pipeline.schema.json).
|
|
Both platform-runner workflow files implement the same contract and are
|
|
byte-identical:
|
|
|
|
- `.github/workflows/ci.yml` — GitHub Actions (production)
|
|
|
|
Three stages run in sequence:
|
|
|
|
1. **lint** — `py_compile` across the platform's Python files.
|
|
2. **test** — `pytest` across the offline test suite.
|
|
3. **check-only** — `run_platform.sh --check-only` (offline, no AWS).
|
|
|
|
`scripts/run_ci.sh` mirrors the CI pipeline locally so the pipeline is fully
|
|
reproducible from the shell:
|
|
|
|
```bash
|
|
bash scripts/run_ci.sh # run all 3 stages
|
|
bash scripts/run_ci.sh --quiet # suppress per-stage banners
|
|
```
|
|
|
|
## Deployment pipeline
|
|
|
|
The deployment pipeline runs when a consumer submits a contract. It is
|
|
defined by [`pipelines/deploy.yaml`](https://github.com/acdl/acdl/blob/main/pipelines/deploy.yaml),
|
|
validated against
|
|
[`schemas/deploy-pipeline.schema.json`](https://github.com/acdl/acdl/blob/main/schemas/deploy-pipeline.schema.json).
|
|
It is exposed to consumer repos as a **reusable workflow**:
|
|
|
|
- `.github/workflows/deploy.yml` — GitHub Actions (production)
|
|
|
|
A consumer repo invokes the reusable workflow via a **versioned tag**
|
|
(floating MAJOR + MINOR, e.g. `acdl/.github/workflows/deploy.yml@v1.6`).
|
|
The workflow checks out the consumer repo, then checks out the ACDL platform
|
|
repo into the runner workspace, and runs `scripts/run_platform.sh` against
|
|
the consumer's contract. The consumer never clones the platform repo or
|
|
invokes its scripts locally. See the [Consumer Guide](../consumer-guide/)
|
|
for the end-to-end happy path.
|
|
|
|
## Deployment stages
|
|
|
|
```mermaid
|
|
flowchart TD
|
|
S1["validate-contract<br/>schema check"] --> S2
|
|
S2["resolve-stack<br/>contract -> Target Stack"] --> S3
|
|
S3["security checks<br/>(adapter)"] --> S4
|
|
S4["infrastructure plan<br/>(adapter compiles the stack)"] --> S5
|
|
S5["policy checks<br/>(adapter -> PolicyCheckResult)"] --> S6
|
|
S6["confidence<br/>score + band"] --> S7
|
|
S7["evidence event<br/>to the audit outbox"] --> S8
|
|
S8["infrastructure apply<br/>(dev only)"]
|
|
```
|
|
|
|
1. **validate-contract** — validates the contract YAML against the contract
|
|
schema. Fails fast on missing fields, unknown modules, or wrong types.
|
|
2. **resolve-stack** — the contract resolver resolves the contract to a
|
|
Target Stack instance (loads the module's pattern, expands its children,
|
|
wires the contract inputs, emits a stack JSON instance).
|
|
3. **security checks** (adapter) — security checks run on the resolved
|
|
stack before any infrastructure is planned.
|
|
4. **infrastructure plan** (adapter) — the substrate adapter compiles the
|
|
stack to an infrastructure plan.
|
|
5. **policy checks** (adapter) — policy checks run on the plan. Results are
|
|
normalized to `PolicyCheckResult` records (severity, rule ID, pass/fail).
|
|
6. **confidence** — the confidence signal computes a score from 6 inputs
|
|
(policy, validation, freshness, source, history, NFRs). For `dev`, the
|
|
threshold is ≥ 0.50. If the band is `pass`, the pipeline proceeds.
|
|
7. **evidence event** — a hash-chained evidence event is written to the
|
|
audit outbox.
|
|
8. **infrastructure apply** (dev only) — the infrastructure plan is applied,
|
|
creating the resources. An evidence event for the apply is recorded.
|
|
|
|
Higher environments hold for human attestation (see
|
|
[Environments](../environments/)).
|
|
|
|
## Output streaming
|
|
|
|
`scripts/run_platform.sh` streams output by default so the user can see what
|
|
the platform is doing:
|
|
|
|
- **`--check-only`**: streams the emitted infrastructure file content.
|
|
- **`--plan-only`** and **full mode**: streams the infrastructure plan output.
|
|
- **Full mode**: prints policy-check results with severity, rule ID, and
|
|
pass/fail status.
|
|
|
|
A `--quiet` flag suppresses streaming (output to log files only). |