Description
This issue was produced by the automated enterprise quality & NFR audit (2026-07-02), which audited the repository against the quality attributes from Wikipedia's "List of system quality attributes" plus AI-native development readiness. Attribute: affordability (cluster: Governance, Process & Compliance), current score 3/5. Audit justification: The template is cost-conscious in places: the CrossGuard policy pack (policy/guardrails.py, policy/vilnacrm_guardrails.yaml) makes CostCenter/Owner tagging mandatory for cost allocation, the entire toolchain is OSS (uv, ruff, ty, gitleaks, pip-audit) with no paid SaaS dependency, and all workflows use concurrency cancellation plus bounded timeout-minutes so stale runs do not burn minutes. However, there is no cloud cost-estimation gate even though docs/sre-operations.md:142 lists 'Infracost' as a CI check that does not exist anywhere in .github/workflows/, and every one of the ~25 CI jobs rebuilds the large multi-stage Dockerfile from scratch via 'make start' with zero layer caching or prebuilt image, multiplying CI compute spend on every PR (python-quality.yml alone spawns 6 rebuild jobs; pulumi-mutation.yml runs a 45-minute-budget job on every PR). Identified gaps: No infrastructure cost-estimation gate despite docs claiming Infracost exists — docs/sre-operations.md line 142 maps 'Infracost' to a 'GitHub-native only' CI check, but no Infracost workflow, config file, or action exists anywhere in .github/workflows/ or the repo root. Downstream teams consuming this template get no PR-time visibility into the dollar impact of Pulumi changes, and the documentation makes a false claim about an enforced control — a governance red flag in an enterprise audit. Every CI job rebuilds the Docker workspace from scratch with no caching — grep for 'cache' across .github/workflows/*.yml returns nothing, while 'make start' (compose build of the ~300-line multi-stage Dockerfile downloading Pulumi, AWS CLI, uv, actionlint, gitleaks, hadolint) runs in at least 16 workflow jobs per PR push (6 in python-quality.yml, 6 in security-scans.yml, 4 in pulumi-pr-guardrails.yml, plus unit/integration/policy/structural/mutation/bats/local-battery). This is pure redundant compute cost for the org and for every downstream repo created from the template. Policy pack enforces no cost-relevant sizing or budget guardrails — policy/guardrails.py covers tagging, region allowlists, S3 privacy, encryption, logging, wildcard IAM, open admin ports, and production-database safety, but nothing prevents accidentally expensive resources (e.g. oversized RDS/EC2 instance classes, unthrottled provisioned IOPS, NAT gateway sprawl) and no AWS Budgets/Cost Anomaly Detection pattern is provided in pulumi/app/ for downstream teams.
Tasks
Acceptance Criteria
Description
This issue was produced by the automated enterprise quality & NFR audit (2026-07-02), which audited the repository against the quality attributes from Wikipedia's "List of system quality attributes" plus AI-native development readiness. Attribute: affordability (cluster: Governance, Process & Compliance), current score 3/5. Audit justification: The template is cost-conscious in places: the CrossGuard policy pack (policy/guardrails.py, policy/vilnacrm_guardrails.yaml) makes CostCenter/Owner tagging mandatory for cost allocation, the entire toolchain is OSS (uv, ruff, ty, gitleaks, pip-audit) with no paid SaaS dependency, and all workflows use concurrency cancellation plus bounded timeout-minutes so stale runs do not burn minutes. However, there is no cloud cost-estimation gate even though docs/sre-operations.md:142 lists 'Infracost' as a CI check that does not exist anywhere in .github/workflows/, and every one of the ~25 CI jobs rebuilds the large multi-stage Dockerfile from scratch via 'make start' with zero layer caching or prebuilt image, multiplying CI compute spend on every PR (python-quality.yml alone spawns 6 rebuild jobs; pulumi-mutation.yml runs a 45-minute-budget job on every PR). Identified gaps: No infrastructure cost-estimation gate despite docs claiming Infracost exists — docs/sre-operations.md line 142 maps 'Infracost' to a 'GitHub-native only' CI check, but no Infracost workflow, config file, or action exists anywhere in .github/workflows/ or the repo root. Downstream teams consuming this template get no PR-time visibility into the dollar impact of Pulumi changes, and the documentation makes a false claim about an enforced control — a governance red flag in an enterprise audit. Every CI job rebuilds the Docker workspace from scratch with no caching — grep for 'cache' across .github/workflows/*.yml returns nothing, while 'make start' (compose build of the ~300-line multi-stage Dockerfile downloading Pulumi, AWS CLI, uv, actionlint, gitleaks, hadolint) runs in at least 16 workflow jobs per PR push (6 in python-quality.yml, 6 in security-scans.yml, 4 in pulumi-pr-guardrails.yml, plus unit/integration/policy/structural/mutation/bats/local-battery). This is pure redundant compute cost for the org and for every downstream repo created from the template. Policy pack enforces no cost-relevant sizing or budget guardrails — policy/guardrails.py covers tagging, region allowlists, S3 privacy, encryption, logging, wildcard IAM, open admin ports, and production-database safety, but nothing prevents accidentally expensive resources (e.g. oversized RDS/EC2 instance classes, unthrottled provisioned IOPS, NAT gateway sprawl) and no AWS Budgets/Cost Anomaly Detection pattern is provided in pulumi/app/ for downstream teams.
Tasks
Acceptance Criteria