@anthusai/papyrus 1.0.0-next.4 → 1.0.0-next.6

package/components/newsroom-articles-view.tsx

@@ -0,0 +1,129 @@
+"use client";
+
+import { PlusIcon } from "lucide-react";
+import Link from "next/link";
+import { useEffect, useMemo, useState } from "react";
+import { Badge } from "./ui/badge";
+import { buttonVariants } from "./ui/button";
+import { Spinner } from "./ui/spinner";
+import { Tabs, TabsList, TabsTrigger } from "./ui/tabs";
+import { SITE_BRAND } from "../lib/site-brand";
+import { getNewsroomNavHref } from "../lib/newsroom-nav";
+import { newsroomHref } from "../lib/newsroom-base-path";
+import {
+  resolveArticlesBackend,
+  rowStatusLabel,
+  type NewsroomArticleRow,
+} from "../lib/newsroom-articles";
+import { cn } from "../lib/utils";
+import { useOptionalNewsDeskClient } from "./news-desk-client-provider";
+import { NewsDeskAccessGate } from "./newsroom-access-gate";
+import { NewsroomOpsShell, NewsroomOpsStatusBanner } from "./newsroom-ops-shell";
+
+type ArticleFilter = "all" | "drafts" | "published";
+
+export function articlesAccessBlocked(phase: string | undefined): boolean {
+  return phase === undefined || phase === "checkingAccess" || phase === "signedOut" || phase === "forbidden" || phase === "error";
+}
+
+export function NewsroomArticlesView({ demo }: { demo: boolean }) {
+  const session = useOptionalNewsDeskClient();
+  const blocked = !demo && articlesAccessBlocked(session?.shell.phase);
+  const [rows, setRows] = useState<NewsroomArticleRow[] | null>(null);
+  const [loadError, setLoadError] = useState<string | null>(null);
+  const [filter, setFilter] = useState<ArticleFilter>("all");
+
+  useEffect(() => {
+    if (blocked) return;
+    let cancelled = false;
+    resolveArticlesBackend(demo)
+      .listRows()
+      .then((loaded) => {
+        if (!cancelled) setRows(loaded);
+      })
+      .catch((error: unknown) => {
+        if (!cancelled) setLoadError(error instanceof Error ? error.message : "Could not load articles.");
+      });
+    return () => {
+      cancelled = true;
+    };
+  }, [blocked, demo]);
+
+  const visibleRows = useMemo(() => {
+    if (!rows) return [];
+    if (filter === "drafts") return rows.filter((row) => row.status === "draft");
+    if (filter === "published") return rows.filter((row) => row.status === "published");
+    return rows;
+  }, [filter, rows]);
+
+  if (blocked) return <NewsDeskAccessGate shell={session?.shell ?? null} />;
+
+  return (
+    <NewsroomOpsShell
+      activeTab="articles"
+      appTitle={SITE_BRAND.appTitle}
+      backHref="/"
+      backLabel={SITE_BRAND.backToHomeLabel}
+      demo={demo}
+      headerActions={(
+        <>
+          {demo ? <Badge variant="outline">Demo</Badge> : null}
+          <Link
+            className={cn(buttonVariants({ size: "sm" }))}
+            data-newsroom-article-new
+            href={getNewsroomNavHref(newsroomHref("articles", "new"), demo)}
+          >
+            <PlusIcon aria-hidden="true" />
+            New article
+          </Link>
+        </>
+      )}
+      pageTitle="Articles"
+    >
+      <div className="space-y-4" data-newsroom-articles>
+        <Tabs defaultValue="all" onValueChange={(value) => setFilter(value as ArticleFilter)} value={filter}>
+          <TabsList>
+            <TabsTrigger className="min-w-[5.5rem]" value="all">All</TabsTrigger>
+            <TabsTrigger className="min-w-[5.5rem]" value="drafts">Drafts</TabsTrigger>
+            <TabsTrigger className="min-w-[5.5rem]" value="published">Published</TabsTrigger>
+          </TabsList>
+        </Tabs>
+        {loadError ? <NewsroomOpsStatusBanner tone="error">{loadError}</NewsroomOpsStatusBanner> : null}
+        {rows === null && !loadError ? (
+          <div className="flex items-center gap-2 text-sm text-muted-foreground">
+            <Spinner /> Loading articles…
+          </div>
+        ) : null}
+        {rows !== null && visibleRows.length === 0 ? (
+          <p className="text-sm text-muted-foreground">Nothing here yet.</p>
+        ) : null}
+        <ul className="divide-y divide-border rounded-xl border border-border bg-card" data-newsroom-articles-list>
+          {visibleRows.map((row) => (
+            <li key={row.id}>
+              <Link
+                className="flex flex-col gap-1 px-4 py-3 hover:bg-muted/40 sm:flex-row sm:items-center sm:justify-between sm:gap-4"
+                data-newsroom-article-row={row.slug}
+                href={getNewsroomNavHref(newsroomHref("articles", row.id), demo)}
+              >
+                <span className="min-w-0">
+                  <span className="block truncate text-sm font-medium">{row.title}</span>
+                  <span className="block truncate text-xs text-muted-foreground">
+                    {row.slug}
+                    {row.section ? ` · ${row.section}` : ""}
+                    {row.type !== "article" ? ` · ${row.type}` : ""}
+                  </span>
+                </span>
+                <Badge
+                  data-newsroom-article-status
+                  variant={row.status === "draft" ? "muted" : row.pending ? "outline" : "secondary"}
+                >
+                  {rowStatusLabel(row)}
+                </Badge>
+              </Link>
+            </li>
+          ))}
+        </ul>
+      </div>
+    </NewsroomOpsShell>
+  );
+}

package/components/newsroom-ops-shell.tsx

@@ -3,6 +3,7 @@
 import {
   BookOpenIcon,
   ClipboardListIcon,
+  FileTextIcon,
   LayoutGridIcon,
   MenuIcon,
   SearchIcon,
@@ -55,6 +56,7 @@ type NewsroomOpsShellProps = {
 
 const MOBILE_TAB_ICONS: Record<string, typeof LayoutGridIcon> = {
   overview: LayoutGridIcon,
+  articles: FileTextIcon,
   assignments: ClipboardListIcon,
   references: BookOpenIcon,
   topics: TagsIcon,
@@ -198,7 +200,7 @@ export function NewsroomOpsShell({
           className="shrink-0 border-t border-border bg-card/95 pb-[max(env(safe-area-inset-bottom),0.35rem)] pt-1 md:hidden"
           data-newsroom-ops-bottom-nav
         >
-          <ul className="grid grid-cols-5 gap-1 px-2">
+          <ul className="grid grid-cols-6 gap-1 px-1">
             {mobilePrimary.map((item) => {
               const Icon = MOBILE_TAB_ICONS[item.id] ?? LayoutGridIcon;
               const active = resolvedActiveTab === item.id;

package/components/topic-steering-workspace.tsx

@@ -81,7 +81,7 @@ import { cn } from "../lib/utils";
 import { useOptionalNewsDeskClient } from "./news-desk-client-provider";
 import { ReferenceSourcePreview } from "./reference-source-preview";
 import type { ReaderAuthSnapshot } from "./reader-auth-state";
-import { ReaderAuthControl } from "./reader-auth-control";
+import { NewsDeskAccessGate } from "./newsroom-access-gate";
 import { NewsroomOpsOverview } from "./newsroom-ops-overview";
 import { NewsroomReferencesView } from "./newsroom-references-view";
 import { NewsroomAssignmentsView } from "./newsroom-assignments-view";
@@ -169,7 +169,6 @@ import {
   uniqueNeighborGroupsForCategoryContext,
   type CategoryDrilldownContext,
 } from "../lib/newsroom-category-drilldown";
-import type { NewsDeskShellState } from "../lib/news-desk-session";
 import {
   resolveNewsroomCardTemplate,
   type NewsroomCardSpan,
@@ -15399,63 +15398,6 @@ function readTextClaim(value: unknown): string | null {
   return typeof value === "string" && value.trim() ? value.trim() : null;
 }
 
-function NewsDeskAccessGate({ shell, showSectionTabs = false }: { shell: NewsDeskShellState | null; showSectionTabs?: boolean }) {
-  const accessPhase = shell?.phase ?? "checkingAccess";
-
-  return (
-    <NewsroomOpsShell
-      activeTab="overview"
-      appTitle={SITE_BRAND.appTitle}
-      backHref="/"
-      backLabel={SITE_BRAND.backToHomeLabel}
-      headerActions={(
-        <Link className={cn(buttonVariants({ variant: "ghost", size: "sm" }))} href="/settings">Settings</Link>
-      )}
-      pageTitle="Newsroom"
-      showNavigation={showSectionTabs}
-    >
-      <section aria-live="polite" data-news-desk-access={accessPhase} data-news-desk-access-phase={accessPhase}>
-        <div className="space-y-3 rounded-xl border border-border bg-card p-6">
-          <p className="m-0 text-[0.7rem] font-semibold uppercase tracking-[0.08em] text-muted-foreground">Access</p>
-          <h2 className="m-0 font-sans text-xl font-semibold tracking-tight">{formatAccessTitle(shell)}</h2>
-          <p className="m-0 text-sm text-muted-foreground">{formatAccessDetail(shell)}</p>
-          {shell?.error ? <p className="text-sm text-destructive">{shell.error}</p> : null}
-          <p className="m-0 text-sm text-foreground">{formatAccessActionDetail(shell)}</p>
-          {shell?.phase === "signedOut" || shell?.phase === "error" ? (
-            <div className="news-desk-access-panel__auth">
-              <ReaderAuthControl postAuthPath="/newsroom" showIdentity />
-            </div>
-          ) : null}
-        </div>
-      </section>
-    </NewsroomOpsShell>
-  );
-}
-
-function formatAccessTitle(state: NewsDeskShellState | null): string {
-  if (!state || state.phase === "checkingAccess") return "Checking Desk Credentials";
-  if (state.phase === "loadingDesk") return "Loading Newsroom Records";
-  if (state.phase === "forbidden") return "Editor Role Required";
-  if (state.phase === "error") return "Newsroom Unavailable";
-  return "Editor Sign-In Required";
-}
-
-function formatAccessDetail(state: NewsDeskShellState | null): string {
-  if (!state || state.phase === "checkingAccess") return `${SITE_BRAND.appTitle} is checking the current browser session before loading steering state.`;
-  if (state.phase === "loadingDesk") return `${SITE_BRAND.appTitle} verified the browser session and is loading private Newsroom records.`;
-  if (state.phase === "forbidden") return "This account is signed in, but the Cognito session does not include the editor or admin group.";
-  if (state.phase === "error") return `${SITE_BRAND.appTitle} could not verify this editor session or load the private Newsroom data.`;
-  return "Sign in with an editor or admin account to inspect category, category tree, ontology, and graph steering.";
-}
-
-function formatAccessActionDetail(state: NewsDeskShellState | null): string {
-  if (!state || state.phase === "checkingAccess") return "This should only take a moment. If it hangs, reload the page.";
-  if (state.phase === "loadingDesk") return "Private records are loading from GraphQL. Large reference queues may take several seconds.";
-  if (state.phase === "forbidden") return "Ask an admin to add this account to the editor or admin group, then sign out and back in.";
-  if (state.phase === "error") return "Reload the page or check the local development console for the GraphQL error.";
-  return "Use the login button above to authenticate with an editor or admin account.";
-}
-
 function SectionHeader({ title, detail }: { title: string; detail: string }) {
   const id = title.toLowerCase().replace(/[^a-z0-9]+/g, "-");
   return (

package/infra/amplify-app-shell.js

@@ -1,6 +1,7 @@
-import { ArnFormat, CfnOutput, Stack } from "aws-cdk-lib";
+import { ArnFormat, CfnOutput, Duration, Stack } from "aws-cdk-lib";
 import * as iam from "aws-cdk-lib/aws-iam";
 import * as amplify from "aws-cdk-lib/aws-amplify";
+import { GITHUB_OIDC_PROVIDER_HOST } from "./github-oidc-provider.js";
 import { cmsProductionBuildSpec, cmsStagingBuildSpec, readerBuildSpec } from "./build-specs.js";
 import { resolveStagingDomainName } from "./site-config.js";
 function environmentVariables(variables) {
@@ -100,6 +101,60 @@ export class AmplifyAppShellStack extends Stack {
         if (config.reader) {
             this.readerAppId = this.addReaderApp(config, config.reader, cmsApp.attrAppId);
         }
+        if (config.github) {
+            this.addGithubCiRole(config, config.github, [cmsApp.attrAppId, ...(this.readerAppId ? [this.readerAppId] : [])]);
+        }
+    }
+    addGithubCiRole(config, github, amplifyAppIds) {
+        const provider = iam.OpenIdConnectProvider.fromOpenIdConnectProviderArn(this, "GithubOidcProvider", this.formatArn({
+            service: "iam",
+            region: "",
+            resource: "oidc-provider",
+            resourceName: GITHUB_OIDC_PROVIDER_HOST,
+            arnFormat: ArnFormat.SLASH_RESOURCE_NAME,
+        }));
+        const ciRole = new iam.Role(this, "GithubCiRole", {
+            roleName: `${config.siteId}-github-ci`,
+            description: `GitHub Actions role for ${github.owner}/${github.repo} (OIDC, least privilege, no admin policy)`,
+            maxSessionDuration: Duration.hours(1),
+            assumedBy: new iam.OpenIdConnectPrincipal(provider, {
+                StringEquals: { [`${GITHUB_OIDC_PROVIDER_HOST}:aud`]: "sts.amazonaws.com" },
+                StringLike: {
+                    [`${GITHUB_OIDC_PROVIDER_HOST}:sub`]: github.branches.map((branch) => `repo:${github.owner}/${github.repo}:ref:refs/heads/${branch}`),
+                },
+            }),
+        });
+        ciRole.addToPolicy(new iam.PolicyStatement({
+            sid: "StartAndInspectAmplifyJobs",
+            actions: ["amplify:StartJob", "amplify:ListJobs", "amplify:GetJob", "amplify:ListBranches"],
+            resources: amplifyAppIds.flatMap((appId) => [
+                this.formatArn({ service: "amplify", resource: "apps", resourceName: appId, arnFormat: ArnFormat.SLASH_RESOURCE_NAME }),
+                this.formatArn({ service: "amplify", resource: "apps", resourceName: `${appId}/*`, arnFormat: ArnFormat.SLASH_RESOURCE_NAME }),
+            ]),
+        }));
+        ciRole.addToPolicy(new iam.PolicyStatement({
+            sid: "ReadSiteSecretsForJwtMinting",
+            actions: ["ssm:GetParameter", "ssm:GetParameters"],
+            resources: [
+                this.formatArn({ service: "ssm", resource: "parameter", resourceName: `amplify/${this.cmsAppId}/*`, arnFormat: ArnFormat.SLASH_RESOURCE_NAME }),
+                this.formatArn({ service: "ssm", resource: "parameter", resourceName: `amplify/shared/${this.cmsAppId}/*`, arnFormat: ArnFormat.SLASH_RESOURCE_NAME }),
+            ],
+        }));
+        ciRole.addToPolicy(new iam.PolicyStatement({
+            sid: "WhoAmI",
+            actions: ["sts:GetCallerIdentity"],
+            resources: ["*"],
+        }));
+        if (github.ciCanDeployInfra) {
+            ciRole.addToPolicy(new iam.PolicyStatement({
+                sid: "DeployThisSitesAppShellStack",
+                actions: ["cloudformation:*"],
+                resources: [
+                    this.formatArn({ service: "cloudformation", resource: "stack", resourceName: `amplify-app-shell-${config.siteId}/*`, arnFormat: ArnFormat.SLASH_RESOURCE_NAME }),
+                ],
+            }));
+        }
+        new CfnOutput(this, "GithubCiRoleArn", { value: ciRole.roleArn, description: `Role for GitHub Actions in ${github.owner}/${github.repo}` });
     }
     addReaderApp(config, reader, cmsAppId) {
         const readerAppName = reader.appName ?? `${config.siteId}-reader`;

package/infra/amplify-app-shell.ts

@@ -1,7 +1,8 @@
 import { Construct } from "constructs";
-import { ArnFormat, CfnOutput, Stack, StackProps } from "aws-cdk-lib";
+import { ArnFormat, CfnOutput, Duration, Stack, StackProps } from "aws-cdk-lib";
 import * as iam from "aws-cdk-lib/aws-iam";
 import * as amplify from "aws-cdk-lib/aws-amplify";
+import { GITHUB_OIDC_PROVIDER_HOST } from "./github-oidc-provider";
 import { cmsProductionBuildSpec, cmsStagingBuildSpec, readerBuildSpec } from "./build-specs";
 import { AmplifyAppShellSiteConfig, resolveStagingDomainName } from "./site-config";
 
@@ -115,6 +116,83 @@ export class AmplifyAppShellStack extends Stack {
     if (config.reader) {
       this.readerAppId = this.addReaderApp(config, config.reader, cmsApp.attrAppId);
     }
+
+    if (config.github) {
+      this.addGithubCiRole(config, config.github, [cmsApp.attrAppId, ...(this.readerAppId ? [this.readerAppId] : [])]);
+    }
+  }
+
+  private addGithubCiRole(
+    config: AmplifyAppShellSiteConfig,
+    github: NonNullable<AmplifyAppShellSiteConfig["github"]>,
+    amplifyAppIds: string[],
+  ): void {
+    const provider = iam.OpenIdConnectProvider.fromOpenIdConnectProviderArn(
+      this,
+      "GithubOidcProvider",
+      this.formatArn({
+        service: "iam",
+        region: "",
+        resource: "oidc-provider",
+        resourceName: GITHUB_OIDC_PROVIDER_HOST,
+        arnFormat: ArnFormat.SLASH_RESOURCE_NAME,
+      }),
+    );
+
+    const ciRole = new iam.Role(this, "GithubCiRole", {
+      roleName: `${config.siteId}-github-ci`,
+      description: `GitHub Actions role for ${github.owner}/${github.repo} (OIDC, least privilege, no admin policy)`,
+      maxSessionDuration: Duration.hours(1),
+      assumedBy: new iam.OpenIdConnectPrincipal(provider, {
+        StringEquals: { [`${GITHUB_OIDC_PROVIDER_HOST}:aud`]: "sts.amazonaws.com" },
+        StringLike: {
+          [`${GITHUB_OIDC_PROVIDER_HOST}:sub`]: github.branches.map(
+            (branch) => `repo:${github.owner}/${github.repo}:ref:refs/heads/${branch}`,
+          ),
+        },
+      }),
+    });
+
+    ciRole.addToPolicy(
+      new iam.PolicyStatement({
+        sid: "StartAndInspectAmplifyJobs",
+        actions: ["amplify:StartJob", "amplify:ListJobs", "amplify:GetJob", "amplify:ListBranches"],
+        resources: amplifyAppIds.flatMap((appId) => [
+          this.formatArn({ service: "amplify", resource: "apps", resourceName: appId, arnFormat: ArnFormat.SLASH_RESOURCE_NAME }),
+          this.formatArn({ service: "amplify", resource: "apps", resourceName: `${appId}/*`, arnFormat: ArnFormat.SLASH_RESOURCE_NAME }),
+        ]),
+      }),
+    );
+    ciRole.addToPolicy(
+      new iam.PolicyStatement({
+        sid: "ReadSiteSecretsForJwtMinting",
+        actions: ["ssm:GetParameter", "ssm:GetParameters"],
+        resources: [
+          this.formatArn({ service: "ssm", resource: "parameter", resourceName: `amplify/${this.cmsAppId}/*`, arnFormat: ArnFormat.SLASH_RESOURCE_NAME }),
+          this.formatArn({ service: "ssm", resource: "parameter", resourceName: `amplify/shared/${this.cmsAppId}/*`, arnFormat: ArnFormat.SLASH_RESOURCE_NAME }),
+        ],
+      }),
+    );
+    ciRole.addToPolicy(
+      new iam.PolicyStatement({
+        sid: "WhoAmI",
+        actions: ["sts:GetCallerIdentity"],
+        resources: ["*"],
+      }),
+    );
+    if (github.ciCanDeployInfra) {
+      ciRole.addToPolicy(
+        new iam.PolicyStatement({
+          sid: "DeployThisSitesAppShellStack",
+          actions: ["cloudformation:*"],
+          resources: [
+            this.formatArn({ service: "cloudformation", resource: "stack", resourceName: `amplify-app-shell-${config.siteId}/*`, arnFormat: ArnFormat.SLASH_RESOURCE_NAME }),
+          ],
+        }),
+      );
+    }
+
+    new CfnOutput(this, "GithubCiRoleArn", { value: ciRole.roleArn, description: `Role for GitHub Actions in ${github.owner}/${github.repo}` });
   }
 
   private addReaderApp(

package/infra/github-oidc-provider.js

@@ -0,0 +1,24 @@
+import { CfnOutput, Stack } from "aws-cdk-lib";
+import * as iam from "aws-cdk-lib/aws-iam";
+export const GITHUB_OIDC_PROVIDER_HOST = "token.actions.githubusercontent.com";
+/**
+ * Account-global singleton: AWS allows one IAM OIDC provider per issuer URL per
+ * account, so this never belongs in a per-site stack. Deploy it once per
+ * account, and only after `aws iam list-open-id-connect-providers` shows no
+ * provider for token.actions.githubusercontent.com. When one already exists,
+ * do not deploy this stack: per-site CI roles only reference the provider by
+ * its ARN (arn:aws:iam::<account>:oidc-provider/token.actions.githubusercontent.com)
+ * and work against an existing provider unchanged.
+ */
+export class GithubOidcProviderStack extends Stack {
+    providerArn;
+    constructor(scope, id, props) {
+        super(scope, id, props);
+        const provider = new iam.OpenIdConnectProvider(this, "GithubOidc", {
+            url: `https://${GITHUB_OIDC_PROVIDER_HOST}`,
+            clientIds: ["sts.amazonaws.com"],
+        });
+        this.providerArn = provider.openIdConnectProviderArn;
+        new CfnOutput(this, "GithubOidcProviderArn", { value: provider.openIdConnectProviderArn });
+    }
+}

package/infra/github-oidc-provider.ts

@@ -0,0 +1,30 @@
+import { Construct } from "constructs";
+import { CfnOutput, Stack, StackProps } from "aws-cdk-lib";
+import * as iam from "aws-cdk-lib/aws-iam";
+
+export const GITHUB_OIDC_PROVIDER_HOST = "token.actions.githubusercontent.com";
+
+/**
+ * Account-global singleton: AWS allows one IAM OIDC provider per issuer URL per
+ * account, so this never belongs in a per-site stack. Deploy it once per
+ * account, and only after `aws iam list-open-id-connect-providers` shows no
+ * provider for token.actions.githubusercontent.com. When one already exists,
+ * do not deploy this stack: per-site CI roles only reference the provider by
+ * its ARN (arn:aws:iam::<account>:oidc-provider/token.actions.githubusercontent.com)
+ * and work against an existing provider unchanged.
+ */
+export class GithubOidcProviderStack extends Stack {
+  public readonly providerArn: string;
+
+  constructor(scope: Construct, id: string, props?: StackProps) {
+    super(scope, id, props);
+
+    const provider = new iam.OpenIdConnectProvider(this, "GithubOidc", {
+      url: `https://${GITHUB_OIDC_PROVIDER_HOST}`,
+      clientIds: ["sts.amazonaws.com"],
+    });
+
+    this.providerArn = provider.openIdConnectProviderArn;
+    new CfnOutput(this, "GithubOidcProviderArn", { value: provider.openIdConnectProviderArn });
+  }
+}

package/infra/index.js

@@ -10,5 +10,6 @@ try {
   );
 }
 export const { AmplifyAppShellStack } = await import("./amplify-app-shell.js");
+export const { GithubOidcProviderStack } = await import("./github-oidc-provider.js");
 export { parseSiteConfig } from "./site-config.js";
 export { cmsProductionBuildSpec, cmsStagingBuildSpec, readerBuildSpec, buildSpecFor } from "./build-specs.js";

package/infra/site-config.js

@@ -1,3 +1,4 @@
+export const DEFAULT_CI_BRANCHES = ["main", "staging"];
 const SITE_ID_PATTERN = /^[a-z][a-z0-9]*(-[a-z0-9]+)*$/;
 const REPOSITORY_PATTERN = /^https:\/\/github\.com\/[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/;
 const HOSTED_ZONE_ID_PATTERN = /^Z[A-Z0-9]+$/;
@@ -5,6 +6,8 @@ const HOST_NAME_PATTERN = /^([a-z0-9]([a-z0-9-]*[a-z0-9])?\.)+[a-z]{2,}$/;
 const APP_NAME_PATTERN = /^[A-Za-z0-9][A-Za-z0-9 _.-]*$/;
 const BRANCH_NAME_PATTERN = /^[A-Za-z0-9][A-Za-z0-9/_.-]*$/;
 const PAPYRUS_VERSION_PATTERN = /^\d+\.\d+\.\d+(-[0-9A-Za-z-]+\.\d+)?$/;
+const GITHUB_OWNER_PATTERN = /^[A-Za-z0-9](?:[A-Za-z0-9]|-(?=[A-Za-z0-9])){0,38}$/;
+const GITHUB_REPO_PATTERN = /^[A-Za-z0-9_.-]+$/;
 const LOCAL_DEVELOPMENT_ORIGIN = "http://localhost:3001/";
 function fail(field, problem) {
     throw new Error(`site.json: ${field} ${problem}`);
@@ -54,7 +57,7 @@ export function resolveStoragePreviewPrefix(config) {
 }
 export function parseSiteConfig(raw) {
     const record = requireObject(raw, "site");
-    rejectUnknownKeys(record, ["siteId", "repository", "brand", "frontend", "hostedZoneId", "cms", "reader", "papyrusVersion", "storagePreviewPrefix"], "site");
+    rejectUnknownKeys(record, ["siteId", "repository", "brand", "frontend", "hostedZoneId", "cms", "reader", "papyrusVersion", "storagePreviewPrefix", "github"], "site");
     const siteId = requireString(record.siteId, "siteId", SITE_ID_PATTERN, "kebab-case");
     const repository = requireString(record.repository, "repository", REPOSITORY_PATTERN, "https://github.com/<org>/<repo>");
     const brand = requireString(record.brand, "brand");
@@ -96,6 +99,32 @@ export function parseSiteConfig(raw) {
     else if (frontend === "markus-static") {
         fail("reader", `is required when frontend is "markus-static"`);
     }
+    let github;
+    if (record.github !== undefined) {
+        const githubRecord = requireObject(record.github, "github");
+        rejectUnknownKeys(githubRecord, ["owner", "repo", "branches", "ciCanDeployInfra"], "github");
+        const owner = requireString(githubRecord.owner, "github.owner", GITHUB_OWNER_PATTERN, "plain GitHub login");
+        const repo = requireString(githubRecord.repo, "github.repo", GITHUB_REPO_PATTERN);
+        if (repository !== `https://github.com/${owner}/${repo}`) {
+            fail("github", `owner/repo must match repository ${repository}`);
+        }
+        let branches = DEFAULT_CI_BRANCHES;
+        if (githubRecord.branches !== undefined) {
+            if (!Array.isArray(githubRecord.branches) || githubRecord.branches.length === 0) {
+                fail("github.branches", "must be a non-empty array of branch names");
+            }
+            branches = githubRecord.branches.map((branch, index) => {
+                if (typeof branch === "string" && /[*?]/.test(branch)) {
+                    fail(`github.branches[${index}]`, `must not contain wildcards: ${JSON.stringify(branch)}`);
+                }
+                return requireString(branch, `github.branches[${index}]`, BRANCH_NAME_PATTERN);
+            });
+        }
+        const ciCanDeployInfra = githubRecord.ciCanDeployInfra ?? false;
+        if (typeof ciCanDeployInfra !== "boolean")
+            fail("github.ciCanDeployInfra", "must be a boolean");
+        github = { owner, repo, branches, ciCanDeployInfra: ciCanDeployInfra };
+    }
     const config = {
         siteId,
         repository,
@@ -106,6 +135,7 @@ export function parseSiteConfig(raw) {
         reader,
         papyrusVersion,
         storagePreviewPrefix,
+        github,
     };
     const redirectValue = cms.environment.PAPYRUS_OAUTH_REDIRECT_URLS;
     if (redirectValue === undefined)

package/infra/site-config.ts

@@ -21,8 +21,16 @@ export type AmplifyAppShellSiteConfig = {
   };
   papyrusVersion: string;
   storagePreviewPrefix?: string;
+  github?: {
+    owner: string;
+    repo: string;
+    branches: string[];
+    ciCanDeployInfra: boolean;
+  };
 };
 
+export const DEFAULT_CI_BRANCHES = ["main", "staging"];
+
 const SITE_ID_PATTERN = /^[a-z][a-z0-9]*(-[a-z0-9]+)*$/;
 const REPOSITORY_PATTERN = /^https:\/\/github\.com\/[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/;
 const HOSTED_ZONE_ID_PATTERN = /^Z[A-Z0-9]+$/;
@@ -30,6 +38,8 @@ const HOST_NAME_PATTERN = /^([a-z0-9]([a-z0-9-]*[a-z0-9])?\.)+[a-z]{2,}$/;
 const APP_NAME_PATTERN = /^[A-Za-z0-9][A-Za-z0-9 _.-]*$/;
 const BRANCH_NAME_PATTERN = /^[A-Za-z0-9][A-Za-z0-9/_.-]*$/;
 const PAPYRUS_VERSION_PATTERN = /^\d+\.\d+\.\d+(-[0-9A-Za-z-]+\.\d+)?$/;
+const GITHUB_OWNER_PATTERN = /^[A-Za-z0-9](?:[A-Za-z0-9]|-(?=[A-Za-z0-9])){0,38}$/;
+const GITHUB_REPO_PATTERN = /^[A-Za-z0-9_.-]+$/;
 const LOCAL_DEVELOPMENT_ORIGIN = "http://localhost:3001/";
 
 function fail(field: string, problem: string): never {
@@ -87,7 +97,7 @@ export function parseSiteConfig(raw: unknown): AmplifyAppShellSiteConfig {
   const record = requireObject(raw, "site");
   rejectUnknownKeys(
     record,
-    ["siteId", "repository", "brand", "frontend", "hostedZoneId", "cms", "reader", "papyrusVersion", "storagePreviewPrefix"],
+    ["siteId", "repository", "brand", "frontend", "hostedZoneId", "cms", "reader", "papyrusVersion", "storagePreviewPrefix", "github"],
     "site",
   );
 
@@ -133,6 +143,32 @@ export function parseSiteConfig(raw: unknown): AmplifyAppShellSiteConfig {
     fail("reader", `is required when frontend is "markus-static"`);
   }
 
+  let github: AmplifyAppShellSiteConfig["github"];
+  if (record.github !== undefined) {
+    const githubRecord = requireObject(record.github, "github");
+    rejectUnknownKeys(githubRecord, ["owner", "repo", "branches", "ciCanDeployInfra"], "github");
+    const owner = requireString(githubRecord.owner, "github.owner", GITHUB_OWNER_PATTERN, "plain GitHub login");
+    const repo = requireString(githubRecord.repo, "github.repo", GITHUB_REPO_PATTERN);
+    if (repository !== `https://github.com/${owner}/${repo}`) {
+      fail("github", `owner/repo must match repository ${repository}`);
+    }
+    let branches = DEFAULT_CI_BRANCHES;
+    if (githubRecord.branches !== undefined) {
+      if (!Array.isArray(githubRecord.branches) || githubRecord.branches.length === 0) {
+        fail("github.branches", "must be a non-empty array of branch names");
+      }
+      branches = (githubRecord.branches as unknown[]).map((branch, index) => {
+        if (typeof branch === "string" && /[*?]/.test(branch)) {
+          fail(`github.branches[${index}]`, `must not contain wildcards: ${JSON.stringify(branch)}`);
+        }
+        return requireString(branch, `github.branches[${index}]`, BRANCH_NAME_PATTERN);
+      });
+    }
+    const ciCanDeployInfra = githubRecord.ciCanDeployInfra ?? false;
+    if (typeof ciCanDeployInfra !== "boolean") fail("github.ciCanDeployInfra", "must be a boolean");
+    github = { owner, repo, branches, ciCanDeployInfra: ciCanDeployInfra as boolean };
+  }
+
   const config: AmplifyAppShellSiteConfig = {
     siteId,
     repository,
@@ -143,6 +179,7 @@ export function parseSiteConfig(raw: unknown): AmplifyAppShellSiteConfig {
     reader,
     papyrusVersion,
     storagePreviewPrefix,
+    github,
   };
 
   const redirectValue = cms.environment.PAPYRUS_OAUTH_REDIRECT_URLS;