Jon Chery
491ba78768
---ci--- project: acdl phase: 33 milestone: v1.8 status: execute ---/ci--- - New uptime L1 primitive (aws:ecs:uptime-service) deploying uptime-kuma on ECS Fargate with feature_flag_enabled, monitored_endpoints, static_checks, alert_channels (Teams/email/SMS/GitHub issues). - Adapter emits ECS Fargate task + service when feature_flag_enabled=true; emits nothing when false. Container image louislam/uptime-kuma:1. - New deploy-uptime pipeline stage in pipelines/deploy.yaml (after publish-outputs, before comment-outputs). Now 9 stages. - run_platform.sh --deploy-uptime flag + automatic uptime deployment after L2 module (separate state $WORK/uptime-tf). Endpoints from L2 outputs passed as monitored_endpoints. Feature flag from inputs.uptime_enabled (default true). - scripts/seed_uptime_monitors.py for post-deploy monitor seeding via uptime-kuma API. - Registered in registry.json (14 modules total). Tests: +6 (312 -> 318). All pass.
66 lines
2.9 KiB
YAML
66 lines
2.9 KiB
YAML
# ACDL Central Deployment Pipeline Contract (v1.5)
|
|
#
|
|
# This is the single source of truth for the deployment pipeline. It
|
|
# declares the stages that run when a consumer submits a contract:
|
|
# validate-contract -> resolve-stack -> terraform-plan -> checkov ->
|
|
# confidence -> apply (dev only)
|
|
#
|
|
# Consumers reference this pipeline via `uses: acdl/pipelines/deploy.yaml@v1`
|
|
# in their contract YAML. The platform (scripts/run_platform.sh) implements
|
|
# these stages.
|
|
#
|
|
# Validated against schemas/deploy-pipeline.schema.json.
|
|
|
|
name: acdl-deploy
|
|
environment: dev
|
|
triggers:
|
|
push: [main]
|
|
pull_request: [main]
|
|
runner: ubuntu-latest
|
|
python_version: "3.12"
|
|
|
|
stages:
|
|
- name: validate-contract
|
|
description: Validate the consumer contract against the contract schema
|
|
command: python3 -c "import jsonschema, yaml; jsonschema.validate(yaml.safe_load(open('contracts/static-assets.yaml')), json.load(open('schemas/contract.schema.json')))"
|
|
required: true
|
|
|
|
- name: resolve-stack
|
|
description: Resolve the contract to a Target Stack instance via the contract resolver
|
|
command: python3 core/contract_resolver.py contracts/static-assets.yaml /tmp/acdl-stack.json
|
|
required: true
|
|
|
|
- name: terraform-plan
|
|
description: Compile the stack to Terraform and run terraform plan
|
|
command: bash scripts/run_platform.sh --plan-only contracts/static-assets.yaml
|
|
required: true
|
|
|
|
- name: checkov
|
|
description: Run Checkov policy checks on the emitted Terraform
|
|
command: checkov -f terraform/spike/main.tf --framework terraform -o json --soft-fail
|
|
required: false
|
|
|
|
- name: confidence
|
|
description: Compute the confidence signal from policy + validation inputs
|
|
command: python3 core/confidence_signal.py /tmp/acdl-deploy-inputs.json dev
|
|
required: true
|
|
|
|
- name: apply
|
|
description: Apply the Terraform plan (dev environment only, autonomous per §10)
|
|
command: terraform -chdir=terraform/spike apply -auto-approve -lock=false
|
|
required: false
|
|
|
|
- name: publish-outputs
|
|
description: Publish deploy outputs to SSM Parameter Store (SecureString) + GitHub PR comment
|
|
command: python3 -c "from core.output_publisher import publish_to_ssm, format_comment, post_github_comment; import json,subprocess; tf=json.loads(subprocess.check_output(['terraform','-chdir=terraform/spike','output','-json']) or '{}'); outputs={k:v.get('value') if isinstance(v,dict) else v for k,v in tf.items()}; ssm=publish_to_ssm(outputs,'dev','spike'); comment=format_comment(outputs,'dev','spike',ssm); post_github_comment(comment)"
|
|
required: false
|
|
|
|
- name: deploy-uptime
|
|
description: Deploy uptime-kuma monitoring stack (separate terraform state) with endpoints from L2 outputs
|
|
command: bash scripts/run_platform.sh --deploy-uptime
|
|
required: false
|
|
|
|
- name: comment-outputs
|
|
description: Post a structured GitHub PR comment with human-readable deploy outputs
|
|
command: bash scripts/post_stage_comment.sh publish-outputs pass
|
|
required: false |