Repo update july 26

.github/workflows/ci.yaml

@@ -0,0 +1,104 @@
+name: CI
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: read
+
+jobs:
+  terraform:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3
+        with:
+          terraform_version: 1.15.8
+          terraform_wrapper: false
+      - run: bash scripts/ci/terraform.sh
+
+  cdk-python:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
+        with:
+          python-version: "3.12"
+          cache: pip
+          cache-dependency-path: |
+            cdk/requirements.txt
+            cdk/requirements-dev.txt
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        with:
+          node-version: "22"
+      - run: npm install --global aws-cdk@2.1133.0
+      - run: bash scripts/ci/cdk-python.sh
+
+  cdk-typescript:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        example:
+          - cdk/examples/data_pipeline/typescript
+          - cdk/examples/lb_service/typescript
+    defaults:
+      run:
+        working-directory: ${{ matrix.example }}
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        with:
+          node-version: "22"
+          cache: npm
+          cache-dependency-path: ${{ matrix.example }}/package-lock.json
+      - run: npm ci
+      - run: npm run build
+      - run: npm test -- --runInBand
+      - run: npx cdk synth
+
+  applications:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
+        with:
+          python-version: "3.12"
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        with:
+          node-version: "22"
+          cache: npm
+          cache-dependency-path: |
+            application-code/ecsdemo-nodejs/package-lock.json
+            application-code/nodejs-demoapp/src/package-lock.json
+      - run: bash scripts/ci/applications.sh
+
+  docker:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - context: application-code/container-queue-proc
+          - context: application-code/data-pipeline-task
+          - context: application-code/ecsdemo-cicd
+          - context: application-code/ecsdemo-nodejs
+          - context: application-code/ecsdemo-queue-proc
+          - context: application-code/nodejs-demoapp
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
+      - uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
+        with:
+          context: ${{ matrix.context }}
+          push: false
+          tags: ecs-blueprints-ci:${{ strategy.job-index }}
+
+  documentation:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - run: bash scripts/ci/docs.sh

.github/workflows/deploy-test.yaml

@@ -0,0 +1,52 @@
+name: Deploy test
+
+# Proves representative examples deploy, serve traffic, and destroy cleanly in a
+# real sandbox account. This backs the repository's "clone and apply once"
+# promise; static validate/synth checks cannot catch runtime failures.
+#
+# Requires repository configuration before it can run:
+#   - An AWS IAM role for GitHub OIDC in a DEDICATED SANDBOX account
+#     (see docs/authentication.md), stored as the DEPLOY_TEST_ROLE_ARN secret.
+#   - The `deploy-test` environment created in repo settings (for approval gating).
+# Until those exist, the workflow only runs when triggered manually.
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: "0 8 * * 1" # weekly, Monday 08:00 UTC
+
+permissions:
+  contents: read
+  id-token: write
+
+concurrency:
+  group: deploy-test
+  cancel-in-progress: false
+
+jobs:
+  deploy-test:
+    if: ${{ vars.DEPLOY_TEST_ENABLED == 'true' }}
+    runs-on: ubuntu-latest
+    environment: deploy-test
+    strategy:
+      fail-fast: false
+      max-parallel: 1
+      matrix:
+        include:
+          - root: terraform/patterns/lb-service
+            url_output: application_url
+          - root: terraform/patterns/express-mode
+            url_output: quick_start_url
+          - root: terraform/patterns/backend-service
+            url_output: ""
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3
+        with:
+          terraform_version: 1.15.8
+          terraform_wrapper: false
+      - uses: aws-actions/configure-aws-credentials@a159d7bb5354cf786f855f2f5d1d8d768d9a08d1 # v4.3.0
+        with:
+          role-to-assume: ${{ secrets.DEPLOY_TEST_ROLE_ARN }}
+          aws-region: us-west-2
+      - run: bash scripts/ci/deploy-test.sh "${{ matrix.root }}" "${{ matrix.url_output }}"

.github/workflows/pre-commit.yaml

@@ -1,98 +1,47 @@
-name: pre-commit
+name: Pre-commit
 
 on:
   pull_request:
+  push:
     branches:
       - main
 
+permissions:
+  contents: read
+
 env:
-  TERRAFORM_DOCS_VERSION: v0.16.0
-  TFLINT_VERSION: v0.45.0
+  TERRAFORM_DOCS_VERSION: v0.20.0
+  TERRAFORM_DOCS_SHA256: 34ae01772412bb11474e6718ea62113e38ff5964ee570a98c69fafe3a6dff286
+  TFLINT_VERSION: v0.59.1
+  TFLINT_SHA256: 6108d84282292f11d793dc8038ce08fbc629dcd25324d6f13c63d8100b52e01f
 
 jobs:
-  collectInputs:
-    name: Collect workflow inputs
-    runs-on: ubuntu-latest
-    outputs:
-      directories: ${{ steps.dirs.outputs.directories }}
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v3
-
-      - name: Get root directories
-        id: dirs
-        uses: clowdhaus/terraform-composite-actions/directories@v1.8.3
-
-  preCommitMinVersions:
-    name: Min TF pre-commit
-    needs: collectInputs
+  pre-commit:
     runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        directory: ${{ fromJson(needs.collectInputs.outputs.directories) }}
     steps:
-      - name: Checkout
-        uses: actions/checkout@v3
-
-      - uses: dorny/paths-filter@v2
-        id: changes
-        with:
-          # We only need to check Terraform files for the current directory
-          # because the `preCommitMaxVersion` job will run the full,
-          # exhaustive checks (always)
-          filters: |
-            src:
-              - '${{ matrix.directory }}/*.tf'
-
-      - name: Terraform min/max versions
-        uses: clowdhaus/terraform-min-max@v1.2.5
-        if: steps.changes.outputs.src == 'true'
-        id: minMax
-        with:
-          directory: ${{ matrix.directory }}
-
-      - name: Pre-commit Terraform ${{ steps.minMax.outputs.minVersion }}
-        uses: clowdhaus/terraform-composite-actions/pre-commit@v1.8.3
-        # Run only validate pre-commit check on min version supported
-        if: ${{ matrix.directory !=  '.' && steps.changes.outputs.src == 'true' }}
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
         with:
-          terraform-version: ${{ steps.minMax.outputs.minVersion }}
-          tflint-version: ${{ env.TFLINT_VERSION }}
-          args: 'terraform_validate --color=always --show-diff-on-failure --files ${{ matrix.directory }}/*'
-
-      - name: Pre-commit Terraform ${{ steps.minMax.outputs.minVersion }}
-        uses: clowdhaus/terraform-composite-actions/pre-commit@v1.8.3
-        # Run only validate pre-commit check on min version supported
-        if: ${{ matrix.directory ==  '.' && steps.changes.outputs.src == 'true' }}
-        with:
-          terraform-version: ${{ steps.minMax.outputs.minVersion }}
-          tflint-version: ${{ env.TFLINT_VERSION }}
-          args: 'terraform_validate --color=always --show-diff-on-failure --files $(ls *.tf)'
-
-  preCommitMaxVersion:
-    name: Max TF pre-commit
-    runs-on: ubuntu-latest
-    needs: collectInputs
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v3
-
-      - uses: dorny/paths-filter@v2
-        id: changes
-        with:
-          filters: |
-            src:
-              - '**/*.tf'
-
-      - name: Terraform min/max versions
-        id: minMax
-        uses: clowdhaus/terraform-min-max@v1.2.5
-        if: steps.changes.outputs.src == 'true'
-
-      - name: Pre-commit Terraform ${{ steps.minMax.outputs.maxVersion }}
-        uses: clowdhaus/terraform-composite-actions/pre-commit@v1.8.3
-        if: steps.changes.outputs.src == 'true'
+          python-version: "3.12"
+      - uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3
         with:
-          terraform-version: ${{ steps.minMax.outputs.maxVersion }}
-          terraform-docs-version: ${{ env.TERRAFORM_DOCS_VERSION }}
-          tflint-version: ${{ env.TFLINT_VERSION }}
+          terraform_version: 1.15.8
+          terraform_wrapper: false
+      - name: Install Terraform helper tools
+        run: |
+          terraform_docs_archive="${RUNNER_TEMP}/terraform-docs.tar.gz"
+          tflint_archive="${RUNNER_TEMP}/tflint.zip"
+
+          curl -fsSLo "${terraform_docs_archive}" \
+            "https://github.com/terraform-docs/terraform-docs/releases/download/${TERRAFORM_DOCS_VERSION}/terraform-docs-${TERRAFORM_DOCS_VERSION}-linux-amd64.tar.gz"
+          echo "${TERRAFORM_DOCS_SHA256}  ${terraform_docs_archive}" | sha256sum --check
+          tar -xzf "${terraform_docs_archive}" -C "${RUNNER_TEMP}" terraform-docs
+          sudo install -m 0755 "${RUNNER_TEMP}/terraform-docs" /usr/local/bin/terraform-docs
+
+          curl -fsSLo "${tflint_archive}" \
+            "https://github.com/terraform-linters/tflint/releases/download/${TFLINT_VERSION}/tflint_linux_amd64.zip"
+          echo "${TFLINT_SHA256}  ${tflint_archive}" | sha256sum --check
+          unzip -q "${tflint_archive}" -d "${RUNNER_TEMP}/tflint"
+          sudo install -m 0755 "${RUNNER_TEMP}/tflint/tflint" /usr/local/bin/tflint
+      - run: python -m pip install pre-commit==4.2.0
+      - run: pre-commit run --all-files --show-diff-on-failure