@deployfoundation/foundation-deploy 0.2.48 → 0.2.49

package/dist/bin/app.js

@@ -8,13 +8,13 @@ import {
   FoundationPages,
   FoundationPipeline,
   NewsletterStack
-} from "../chunk-z4gsy5kh.js";
+} from "../chunk-6f2hkamj.js";
 import {
   adminsFor,
   instanceNames,
   loadInstanceFile,
   provisionsIntegration
-} from "../chunk-2tachxjf.js";
+} from "../chunk-gnz747z2.js";
 import"../chunk-dz91avrb.js";
 
 // bin/app.ts

package/dist/bin/foundation-deploy.js

@@ -22,12 +22,15 @@ import {
   slackCommandPrefix,
   verifyManifest,
   versionedConfigKey
-} from "../chunk-2tachxjf.js";
+} from "../chunk-gnz747z2.js";
 import {
   DEFAULT_RELEASE_BUCKET,
   expectedKeyArn
 } from "../chunk-dz91avrb.js";
 
+// src/deploy/cli.ts
+import { readFileSync as readFileSync10 } from "node:fs";
+
 // src/deploy/aws.ts
 import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
@@ -2560,6 +2563,7 @@ Done. Now say \`@${ctx.instance.displayName} hello\` in Slack.`);
 
 // src/deploy/cli.ts
 var COMMANDS = [
+  "check",
   "deploy",
   "post-deploy",
   "config:sync",
@@ -2572,6 +2576,10 @@ var COMMANDS = [
 var USAGE = `usage: foundation-deploy <command> --instance <path> [options]
 
 commands
+  check                parse the instance and config files with THIS release's
+                       schema; no AWS. Run it on config PRs with the pinned
+                       version: a config the deployed release rejects puts the
+                       teammate on the fallback config.
   deploy               build and push the agent image, cdk deploy --all, refresh
                        the runtime secret, sync config
   post-deploy          smoke DEFAULT, probe the mount, promote \`live\`, smoke \`live\`
@@ -2650,6 +2658,18 @@ async function main(argv2 = process.argv.slice(2)) {
 ${USAGE}`);
     return 1;
   }
+  if (command === "check") {
+    const paths = loadInstanceContext(resolveInstanceFilePath(args, process.env));
+    try {
+      parseInstanceConfig(readFileSync10(paths.configPath, "utf8"));
+    } catch (error) {
+      console.error(`${paths.configPath} does not parse with this release (v${toolVersion()}):
+${error instanceof Error ? error.message : String(error)}`);
+      return 1;
+    }
+    console.log(`${paths.configPath} parses with this release (v${toolVersion()})`);
+    return 0;
+  }
   if (command === "slack-manifest") {
     const paths = loadInstanceContext(resolveInstanceFilePath(args, process.env));
     if (process.env.EVENTS_REQUEST_URL === undefined)

package/dist/bin/release-account.js

@@ -111,6 +111,11 @@ class ReleaseAccountStack extends cdk.Stack {
               actions: ["ecr:GetAuthorizationToken"],
               resources: ["*"]
             }),
+            new iam.PolicyStatement({
+              sid: "EcrPublicLogin",
+              actions: ["ecr-public:GetAuthorizationToken", "sts:GetServiceBearerToken"],
+              resources: ["*"]
+            }),
             new iam.PolicyStatement({
               sid: "SignManifest",
               actions: ["kms:Sign", "kms:GetPublicKey", "kms:DescribeKey"],

package/dist/{chunk-z4gsy5kh.js → chunk-6f2hkamj.js}

@@ -24,7 +24,7 @@ import {
   scheduledJobBindings,
   slackCommandPrefixes,
   webhookJobBindings
-} from "./chunk-2tachxjf.js";
+} from "./chunk-gnz747z2.js";
 
 // src/stacks/agent-stack.ts
 import * as cdk from "aws-cdk-lib";

package/dist/{chunk-2tachxjf.js → chunk-gnz747z2.js}

@@ -1975,4 +1975,4 @@ function ecrRepositoryArn(repositoryUri) {
   return `arn:aws:ecr:${region}:${account}:repository/${name}`;
 }
 
-export { parseSchedule, BASE_SLACK_EVENTS, CAPABILITY_IDS, requiredGithubPermissions, requiredSlackScopes, requiredSlackCommands, encodeProactiveChannels, CUSTOMIZATION_ARTIFACT_NAME, newsletterManifestFor, FOUNDATION_VERSION_RE, versionedConfigKey, instanceNames, slackCommandPrefix, slackCommandPrefixes, isScheduledJob, isWebhookJob, webhookJobBindings, scheduledJobBindings, jobWebhookKey, capabilityScheduledJobs, crmOutreachConfigured, crmPolicyFingerprint, parseInstanceConfig, loadInstanceFile, configPathFor, capabilityEnabled, requiresAuthenticatedQueue, enabledIntegrations, provisionsIntegration, adminsFor, WEB_SEARCH_TARGET, WEB_SEARCH_CONNECTOR_VERSION, LIVE_ENDPOINT_NAME, RELEASE_VERSION_RE, parseManifest, manifestKey, lambdaKey, skillsKey, buildManifest, manifestSigningPayload, verifyManifest, lambdaBundleContext, BUN_VERSION, LAMBDA_ENTRY_POINTS, skipBundle, RELEASE_BUCKET_ENV, RELEASE_DIR_ENV, releaseCacheDir, releaseSource, releaseAccess, lambdaCode, agentImage, agentImageTagRequired, releaseImageRepositoryArn, ecrRepositoryArn };
+export { parseSchedule, BASE_SLACK_EVENTS, CAPABILITY_IDS, requiredGithubPermissions, requiredSlackScopes, requiredSlackCommands, isScheduledJob, isWebhookJob, webhookJobBindings, scheduledJobBindings, jobWebhookKey, capabilityScheduledJobs, crmOutreachConfigured, crmPolicyFingerprint, parseInstanceConfig, encodeProactiveChannels, CUSTOMIZATION_ARTIFACT_NAME, newsletterManifestFor, FOUNDATION_VERSION_RE, versionedConfigKey, instanceNames, slackCommandPrefix, slackCommandPrefixes, loadInstanceFile, configPathFor, capabilityEnabled, requiresAuthenticatedQueue, enabledIntegrations, provisionsIntegration, adminsFor, WEB_SEARCH_TARGET, WEB_SEARCH_CONNECTOR_VERSION, LIVE_ENDPOINT_NAME, RELEASE_VERSION_RE, parseManifest, manifestKey, lambdaKey, skillsKey, buildManifest, manifestSigningPayload, verifyManifest, lambdaBundleContext, BUN_VERSION, LAMBDA_ENTRY_POINTS, skipBundle, RELEASE_BUCKET_ENV, RELEASE_DIR_ENV, releaseCacheDir, releaseSource, releaseAccess, lambdaCode, agentImage, agentImageTagRequired, releaseImageRepositoryArn, ecrRepositoryArn };

package/dist/src/index.js

@@ -10,7 +10,7 @@ import {
   FoundationPipeline,
   NewsletterStack,
   deployStatements
-} from "../chunk-z4gsy5kh.js";
+} from "../chunk-6f2hkamj.js";
 import {
   BUN_VERSION,
   LAMBDA_ENTRY_POINTS,
@@ -44,7 +44,7 @@ import {
   skillsKey,
   skipBundle,
   verifyManifest
-} from "../chunk-2tachxjf.js";
+} from "../chunk-gnz747z2.js";
 import"../chunk-dz91avrb.js";
 export {
   BUILD_TIMEOUT,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@deployfoundation/foundation-deploy",
-  "version": "0.2.48",
+  "version": "0.2.49",
   "description": "Deploys one Foundation instance from a published, signed release: the CDK app and the deploy tool.",
   "license": "UNLICENSED",
   "private": false,

package/src/deploy/cli.ts

@@ -11,6 +11,8 @@
  * tree into a deploy would make every release of the tool carry a model
  * runtime it never executes.
  */
+import { readFileSync } from "node:fs";
+import { parseInstanceConfig } from "@deployfoundation/foundation-core";
 import { type AwsContext, awsContext } from "./aws.ts";
 import { configSync } from "./config-sync.ts";
 import { deploy } from "./deploy.ts";
@@ -18,12 +20,13 @@ import { githubAppCreate } from "./github-app-create.ts";
 import { instanceBanner, loadInstanceContext, resolveInstanceFilePath } from "./instance.ts";
 import { jobKey } from "./job-key.ts";
 import { postDeploy } from "./post-deploy.ts";
-import { releaseRequest, resolveRelease } from "./release.ts";
+import { releaseRequest, resolveRelease, toolVersion } from "./release.ts";
 import { setup } from "./setup.ts";
 import { slackManifestFor } from "./slack-manifest.ts";
 import { stageCustomization } from "./stage-customization.ts";
 
 export const COMMANDS = [
+  "check",
   "deploy",
   "post-deploy",
   "config:sync",
@@ -39,6 +42,10 @@ export type Command = (typeof COMMANDS)[number];
 export const USAGE = `usage: foundation-deploy <command> --instance <path> [options]
 
 commands
+  check                parse the instance and config files with THIS release's
+                       schema; no AWS. Run it on config PRs with the pinned
+                       version: a config the deployed release rejects puts the
+                       teammate on the fallback config.
   deploy               build and push the agent image, cdk deploy --all, refresh
                        the runtime secret, sync config
   post-deploy          smoke DEFAULT, probe the mount, promote \`live\`, smoke \`live\`
@@ -120,6 +127,23 @@ export async function main(argv: readonly string[] = process.argv.slice(2)): Pro
     return 1;
   }
 
+  // `check` reads files only, so it runs in a pull request with no credentials.
+  if (command === "check") {
+    const paths = loadInstanceContext(resolveInstanceFilePath(args, process.env));
+    try {
+      parseInstanceConfig(readFileSync(paths.configPath, "utf8"));
+    } catch (error) {
+      console.error(
+        `${paths.configPath} does not parse with this release (v${toolVersion()}):\n${
+          error instanceof Error ? error.message : String(error)
+        }`,
+      );
+      return 1;
+    }
+    console.log(`${paths.configPath} parses with this release (v${toolVersion()})`);
+    return 0;
+  }
+
   // `slack-manifest` writes a machine-readable document to stdout and must not
   // print a banner into it; every other command announces its target first.
   if (command === "slack-manifest") {

package/src/stacks/release-account-stack.ts

@@ -208,6 +208,13 @@ export class ReleaseAccountStack extends cdk.Stack {
               actions: ["ecr:GetAuthorizationToken"],
               resources: ["*"],
             }),
+            // Pull-only login to public ECR. Anonymous base-image pulls share
+            // the hosted runners' quota and failed v0.2.48's build with 429.
+            new iam.PolicyStatement({
+              sid: "EcrPublicLogin",
+              actions: ["ecr-public:GetAuthorizationToken", "sts:GetServiceBearerToken"],
+              resources: ["*"],
+            }),
             new iam.PolicyStatement({
               sid: "SignManifest",
               actions: ["kms:Sign", "kms:GetPublicKey", "kms:DescribeKey"],