@continuous-excellence/ze-great-dashboard-aws 0.1.23 → 0.1.24

package/README.md

@@ -14,8 +14,8 @@ opinion about your process. Every panel is a live read of a system that already
 Design doc: `ze-great-idea-pit/tool-ideas/trust-dashboard.md`. How this repo came to be shaped the
 way it is, including the quirks that look like bugs: `docs/initialization-log.md`.
 
-**Status: first Stage 2 slice.** GitHub Actions `pipeline-status` panels work end to end. Azure
-DevOps and `http-value` adapters remain to be built.
+**Status: MVP in active use.** GitHub Actions `pipeline-status` and source-agnostic `http-value`
+panels work end to end. Azure DevOps remains to be built.
 
 ## Quickstart
 
@@ -116,12 +116,14 @@ Server environment variables are documented in `.env.example`. The one that matt
 ## Deploying
 
 Push to `main`. CI checks, versions with [Tagger](https://github.com/robertfmurdock/tagger), publishes
-the client to S3, and points the Lambda at the new version.
+the immutable client assets, then deploys the exact npm tarball to the repository-owned consumer
+reference before publishing that same tarball.
 
 Infrastructure is a CloudFormation stack under `infra/`. On `main`, CI deploys the stack before it
-publishes assets and updates the Lambda. Other branches receive no AWS credentials. CloudFormation
+publishes assets and updates the Lambda. The public client origin is
+`https://public-assets.zegreatrob.com`. Other branches receive no AWS credentials. CloudFormation
 keeps the infrastructure state in AWS; `infra/README.md` documents the one-time GitHub OIDC role
-bootstrap.
+bootstraps, including the consumer reference.
 
 For a consumer-managed deployment with the published AWS package, see [`docs/aws-setup.md`](docs/aws-setup.md).
 

package/dist/cli.js

@@ -921,12 +921,9 @@ async function packageLambda(options) {
   );
   return packagedRelease;
 }
-async function deployLambda(options) {
-  const artifactDir = resolve2(options.artifactDir);
+async function publishClientAssets(options) {
   const assetsDir = resolve2(options.assetsDir);
-  await readFile2(join2(artifactDir, "lambda.zip"));
   await readFile2(join2(assetsDir, "index.html"));
-  if (options.dryRun) return;
   const assetPath = `${options.assetsBaseUrl.replace(/\/+$/, "")}/dashboard/${options.version}`;
   await run("aws", [
     "s3",
@@ -946,6 +943,15 @@ async function deployLambda(options) {
     "--cache-control",
     "public, max-age=60"
   ]);
+  return assetPath;
+}
+async function deployLambda(options) {
+  const artifactDir = resolve2(options.artifactDir);
+  const assetsDir = resolve2(options.assetsDir);
+  await readFile2(join2(artifactDir, "lambda.zip"));
+  await readFile2(join2(assetsDir, "index.html"));
+  if (options.dryRun) return;
+  const assetPath = await publishClientAssets(options);
   await run("aws", [
     "lambda",
     "update-function-code",
@@ -1180,6 +1186,15 @@ try {
       dryRun: args.includes("--dry-run")
     });
     console.log(JSON.stringify({ deployed: true, version }));
+  } else if (args[0] === "publish-assets") {
+    const version = requiredOption("--version", packageVersion);
+    const assetPath = await publishClientAssets({
+      assetsDir: option("--assets-dir", bundledAssets) ?? bundledAssets,
+      assetsBucket: requiredOption("--assets-bucket"),
+      assetsBaseUrl: requiredOption("--assets-base-url"),
+      version
+    });
+    console.log(JSON.stringify({ published: true, version, assetPath }));
   } else if (args[0] === "doctor") {
     const parametersPath = option("--parameters", "aws-dashboard-parameters.json") ?? "aws-dashboard-parameters.json";
     const region = option("--region", process.env.AWS_REGION ?? process.env.AWS_DEFAULT_REGION ?? "us-east-1") ?? "us-east-1";
@@ -1237,7 +1252,9 @@ try {
 `);
     console.log(JSON.stringify({ output }));
   } else if (args[0] !== "package")
-    throw new Error("Usage: ze-great-dashboard-aws package|parameters|deploy|doctor [options]");
+    throw new Error(
+      "Usage: ze-great-dashboard-aws package|parameters|publish-assets|deploy|doctor [options]"
+    );
   else {
     const boardConfig = option("--board-config");
     const version = option("--version", process.env.DASHBOARD_VERSION ?? packageVersion);

package/dist/index.d.ts

@@ -27,6 +27,14 @@ export type DeployLambdaOptions = {
     version: string;
     dryRun?: boolean;
 };
+export type PublishClientAssetsOptions = {
+    assetsDir: string;
+    assetsBucket: string;
+    assetsBaseUrl: string;
+    version: string;
+};
+/** Publishes the immutable client half of a provider-managed release. */
+export declare function publishClientAssets(options: PublishClientAssetsOptions): Promise<string>;
 /** Performs the AWS-specific half of a release using explicit deployment outputs. */
 export declare function deployLambda(options: DeployLambdaOptions): Promise<void>;
 export declare function cloudFormationTemplate(): Promise<string>;

package/dist/index.js

@@ -908,12 +908,9 @@ async function packageLambda(options) {
   );
   return packagedRelease;
 }
-async function deployLambda(options) {
-  const artifactDir = resolve2(options.artifactDir);
+async function publishClientAssets(options) {
   const assetsDir = resolve2(options.assetsDir);
-  await readFile2(join2(artifactDir, "lambda.zip"));
   await readFile2(join2(assetsDir, "index.html"));
-  if (options.dryRun) return;
   const assetPath = `${options.assetsBaseUrl.replace(/\/+$/, "")}/dashboard/${options.version}`;
   await run("aws", [
     "s3",
@@ -933,6 +930,15 @@ async function deployLambda(options) {
     "--cache-control",
     "public, max-age=60"
   ]);
+  return assetPath;
+}
+async function deployLambda(options) {
+  const artifactDir = resolve2(options.artifactDir);
+  const assetsDir = resolve2(options.assetsDir);
+  await readFile2(join2(artifactDir, "lambda.zip"));
+  await readFile2(join2(assetsDir, "index.html"));
+  if (options.dryRun) return;
+  const assetPath = await publishClientAssets(options);
   await run("aws", [
     "lambda",
     "update-function-code",
@@ -960,5 +966,6 @@ async function cloudFormationTemplate() {
 export {
   cloudFormationTemplate,
   deployLambda,
-  packageLambda
+  packageLambda,
+  publishClientAssets
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@continuous-excellence/ze-great-dashboard-aws",
-  "version": "0.1.23",
+  "version": "0.1.24",
   "type": "module",
   "description": "AWS Lambda and CloudFormation adapter for Ze Great Dashboard.",
   "keywords": [

package/template.yml

@@ -25,6 +25,9 @@ Resources:
   ServerRole:
     Type: AWS::IAM::Role
     Properties:
+      # A stable, Name-derived role name lets consumer bootstrap policies scope CloudFormation
+      # execution to this stack's runtime role rather than every role in the account.
+      RoleName: !Sub '${Name}-server'
       AssumeRolePolicyDocument:
         Version: '2012-10-17'
         Statement: [{ Effect: Allow, Principal: { Service: lambda.amazonaws.com }, Action: sts:AssumeRole }]
@@ -36,7 +39,12 @@ Resources:
             Statement:
               - Effect: Allow
                 Action: [secretsmanager:DescribeSecret, secretsmanager:GetSecretValue]
-                Resource: !If [HasSecretReference, !Ref SecretReference, !Ref AWS::NoValue]
+                # IAM requires every statement to have a resource. When no secret is configured,
+                # keep this read permission pointed at a nonexistent ARN rather than widening it.
+                Resource: !If
+                  - HasSecretReference
+                  - !Ref SecretReference
+                  - !Sub 'arn:${AWS::Partition}:secretsmanager:${AWS::Region}:${AWS::AccountId}:secret:ze-great-dashboard-no-secret-configured'
   ServerLogGroup:
     Type: AWS::Logs::LogGroup
     Properties: { RetentionInDays: !Ref LogRetentionInDays, LogGroupName: !Sub '/aws/lambda/${Name}' }