Files

T

Jon Chery 031887ec56 refactor(P57): contract surface redesign + rename + .yml repo-wide

Contract surface redesign:
- New top-level fields: id (3-6 char acronym → stack.name), name (full → stack.title),
  infrastructure (map keyed by module name, replaces module:)
- Drop uses: field (dead reference; version pin lives in CI workflow uses: line)
- Drop top-level module/inputs (now nested under infrastructure map)
- Per-module optional version (defaults to latest published from registry)
- Multi-module contracts: one file deploys N modules in one pipeline run,
  resource IDs namespaced with module name to avoid collisions
- stack.schema.json: add optional title field for display name

Rename:
- pipelines/deploy.yaml → pipelines/contract.yml (declarative spec, not a pipeline)
- pipelines/ci.yaml → pipelines/ci.yml
- All 44 .yaml files → .yml repo-wide (contracts, module examples, kyverno policies)
- .acdl/contract.yaml → .acdl/contract.yml

Resolver (core/contract_resolver.py):
- Rewrite resolve() to loop infrastructure map, default version to latest,
  merge module fragments into one stack with namespaced resource IDs
- _latest_version() picks highest non-deprecated from registry
- _namespace_resources() prefixes IDs + rewrites ref: expressions for multi-module
- Single-module path: unprefixed IDs (backward compatible)

Verification:
- 494 tests pass (0 contract-shape failures)
- Local E2E passes (contract → resolver → adapter → local ECS HTTP 200 → outbox)

---ci---
project: acdl
phase: 57
milestone: v1.10.2
status: execute
---/ci---

2026-07-27 21:37:40 +00:00

2.6 KiB

Raw Permalink Blame History

ecr — ECR repository

Module kind: primitive | Version: 1.0.0

A single ECR repository that hosts the container image for the ECS task. The simplest container-registry module — one resource, two inputs, two outputs.

Resources

Resource	Type	Purpose
repository	`aws_ecr_repository`	The ECR repository

Inputs

Name	Type	Required	Default	Description
`name`	string	yes	—	The ECR repository name
`region`	string	yes	—	AWS region the repository is created in

Outputs

Name	Type	Description
`repository_url`	string	The ECR repository URL
`repository_arn`	arn	The ECR repository ARN

Usage

{
  "id": "ecr",
  "type": "aws:ecr:repository",
  "module": "ecr@1.0.0",
  "inputs": {
    "name": "acdl-microservice",
    "region": "us-east-1"
  }
}

The repository_url output is used to build the image input for ecs-service (e.g. <repository_url>:latest).

Compliance extension points

Image scanning — add image_scanning_configuration { scan_on_push = true } for vulnerability scanning (SOC2 CC7.6, DORA ICT risk testing, security monitoring).
Encryption — add encryption_configuration { encryption_type = "KMS", kms_key = ... } with a customer-managed key (SOC2 CC6.1, GDPR Art.32).
Image tag immutability — add image_tag_mutability = "IMMUTABLE" to prevent tag overwriting (SOX §802, SOC2 CC6.1 integrity, DORA audit integrity).
Lifecycle policy — add aws_ecr_lifecycle_policy to enforce image retention / cleanup (GDPR Art.5(2) data minimization, SOC2 CC5.2).
Access policy — add a repository policy restricting pull/push to known roles (SOC2 CC6.1.

Examples

Validated example contracts are in examples/. The platform-test pipeline validates them against schemas/contract.schema.json.

Simple

A minimal deployment:

examples/simple.yml

environment: dev
id: ecr
infrastructure:
  ecr:
    inputs:
      name: my-repo
      region: us-east-1
    version: 1.0.0
name: ecr-repo

Complex

A production deployment with optional inputs:

examples/complex.yml

environment: dev
id: ecr
infrastructure:
  ecr:
    inputs:
      name: my-production-repo
      region: us-east-1
    version: 1.0.0
name: ecr-repo

Versioning

1.0.0 — interface MAJOR, behavior MINOR, lifecycle PATCH. MAJOR bumps require a new registry entry (immutable publication); old entries enter a 12-month deprecation window.

2.6 KiB Raw Permalink Blame History