@continuous-excellence/ze-great-dashboard-aws 0.1.30 → 0.1.32

package/bootstrap/dashboard-bootstrap.example.json

@@ -10,6 +10,8 @@
     "stackName": "team-dashboard-github-bootstrap",
     "providerArn": "arn:aws:iam::123456789012:oidc-provider/token.actions.githubusercontent.com",
     "repository": "example/team-dashboard",
+    "ownerId": "12345678",
+    "repositoryId": "123456789",
     "environment": "production"
   }
 }

package/bootstrap/github-oidc-v1.yml

@@ -1,5 +1,5 @@
 AWSTemplateFormatVersion: '2010-09-09'
-Description: Ze Great Dashboard GitHub OIDC adapter v1. Administrator-managed; requires a central OIDC provider.
+Description: Ze Great Dashboard GitHub OIDC adapter v1. Superseded by github-oidc-v2.yml; retained for explicit migration review.
 
 Parameters:
   GitHubOidcProviderArn: { Type: String }

package/bootstrap/github-oidc-v2.yml

@@ -0,0 +1,60 @@
+AWSTemplateFormatVersion: '2010-09-09'
+Description: Ze Great Dashboard GitHub OIDC adapter v2. Administrator-managed; requires a central OIDC provider.
+
+Parameters:
+  GitHubOidcProviderArn: { Type: String }
+  GitHubRepository: { Type: String, Description: owner/repository }
+  GitHubOwnerId: { Type: String, Description: Immutable numeric GitHub owner id }
+  GitHubRepositoryId: { Type: String, Description: Immutable numeric GitHub repository id }
+  GitHubEnvironment: { Type: String, Description: Protected GitHub Environment name }
+  ApplicationStackName: { Type: String }
+  ArtifactBucketName: { Type: String }
+  CloudFormationExecutionRoleArn: { Type: String }
+
+Resources:
+  GitHubDeployRole:
+    Type: AWS::IAM::Role
+    DeletionPolicy: Retain
+    UpdateReplacePolicy: Retain
+    Properties:
+      RoleName: !Sub '${ApplicationStackName}-github-deploy'
+      MaxSessionDuration: 3600
+      AssumeRolePolicyDocument:
+        Version: '2012-10-17'
+        Statement:
+          - Effect: Allow
+            Principal: { Federated: !Ref GitHubOidcProviderArn }
+            Action: sts:AssumeRoleWithWebIdentity
+            Condition:
+              StringEquals:
+                'token.actions.githubusercontent.com:aud': sts.amazonaws.com
+                'token.actions.githubusercontent.com:sub': !Sub
+                  - 'repo:${Owner}@${GitHubOwnerId}/${Repository}@${GitHubRepositoryId}:environment:${GitHubEnvironment}'
+                  - Owner: !Select [0, !Split ['/', !Ref GitHubRepository]]
+                    Repository: !Select [1, !Split ['/', !Ref GitHubRepository]]
+      Policies:
+        - PolicyName: DeployOneDashboard
+          PolicyDocument:
+            Version: '2012-10-17'
+            Statement:
+              - Sid: UploadLambdaArtifacts
+                Effect: Allow
+                Action: [s3:PutObject, s3:GetObject]
+                Resource: !Sub 'arn:${AWS::Partition}:s3:::${ArtifactBucketName}/lambda/*'
+              - Sid: InspectArtifactBucket
+                Effect: Allow
+                Action: [s3:GetBucketLocation, s3:ListBucket]
+                Resource: !Sub 'arn:${AWS::Partition}:s3:::${ArtifactBucketName}'
+              - Sid: OperateOneApplicationStack
+                Effect: Allow
+                Action: [cloudformation:CreateChangeSet, cloudformation:DescribeChangeSet, cloudformation:ExecuteChangeSet, cloudformation:DeleteChangeSet, cloudformation:DescribeStacks, cloudformation:DescribeStackEvents, cloudformation:GetTemplate, cloudformation:GetTemplateSummary]
+                Resource: !Sub 'arn:${AWS::Partition}:cloudformation:${AWS::Region}:${AWS::AccountId}:stack/${ApplicationStackName}/*'
+              - Sid: PassCoreExecutionRole
+                Effect: Allow
+                Action: iam:PassRole
+                Resource: !Ref CloudFormationExecutionRoleArn
+                Condition: { StringEquals: { 'iam:PassedToService': cloudformation.amazonaws.com } }
+
+Outputs:
+  BootstrapContractVersion: { Value: '2' }
+  GitHubDeployRoleArn: { Value: !GetAtt GitHubDeployRole.Arn }

package/dist/bootstrap.d.ts

@@ -25,6 +25,8 @@ export type BootstrapConfig = {
         stackName?: string;
         providerArn?: string;
         repository?: string;
+        ownerId?: string;
+        repositoryId?: string;
         environment?: string;
     };
 };

package/dist/cli.js

@@ -843,7 +843,7 @@ import { readFile as readFile2 } from "node:fs/promises";
 import { fileURLToPath } from "node:url";
 var templates = {
   core: "../bootstrap/core-v1.yml",
-  "github-oidc": "../bootstrap/github-oidc-v1.yml"
+  "github-oidc": "../bootstrap/github-oidc-v2.yml"
 };
 async function bootstrapTemplatePath(kind) {
   if (!Object.hasOwn(templates, kind)) throw new Error(`Unknown bootstrap template: ${kind}`);
@@ -901,6 +901,8 @@ function requiredBootstrapParameters(kind, values) {
   const keys = kind === "core" ? ["ArtifactBucketName", "ApplicationStackName", "DashboardFunctionName"] : [
     "GitHubOidcProviderArn",
     "GitHubRepository",
+    "GitHubOwnerId",
+    "GitHubRepositoryId",
     "GitHubEnvironment",
     "ApplicationStackName",
     "ArtifactBucketName",
@@ -1254,6 +1256,8 @@ function bootstrapValues(config, coreOutputs = {}) {
     ArtifactKmsKeyArn: option("--artifact-kms-key-arn", config.core?.artifactKmsKeyArn),
     GitHubOidcProviderArn: option("--github-oidc-provider-arn", config.githubOidc?.providerArn),
     GitHubRepository: option("--github-repository", config.githubOidc?.repository),
+    GitHubOwnerId: option("--github-owner-id", config.githubOidc?.ownerId),
+    GitHubRepositoryId: option("--github-repository-id", config.githubOidc?.repositoryId),
     GitHubEnvironment: option("--github-environment", config.githubOidc?.environment),
     CloudFormationExecutionRoleArn: option(
       "--execution-role-arn",

package/dist/index.js

@@ -830,7 +830,7 @@ import { readFile as readFile2 } from "node:fs/promises";
 import { fileURLToPath } from "node:url";
 var templates = {
   core: "../bootstrap/core-v1.yml",
-  "github-oidc": "../bootstrap/github-oidc-v1.yml"
+  "github-oidc": "../bootstrap/github-oidc-v2.yml"
 };
 async function bootstrapTemplatePath(kind) {
   if (!Object.hasOwn(templates, kind)) throw new Error(`Unknown bootstrap template: ${kind}`);
@@ -888,6 +888,8 @@ function requiredBootstrapParameters(kind, values) {
   const keys = kind === "core" ? ["ArtifactBucketName", "ApplicationStackName", "DashboardFunctionName"] : [
     "GitHubOidcProviderArn",
     "GitHubRepository",
+    "GitHubOwnerId",
+    "GitHubRepositoryId",
     "GitHubEnvironment",
     "ApplicationStackName",
     "ArtifactBucketName",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@continuous-excellence/ze-great-dashboard-aws",
-  "version": "0.1.30",
+  "version": "0.1.32",
   "type": "module",
   "description": "AWS Lambda and CloudFormation adapter for Ze Great Dashboard.",
   "keywords": [