@ossy/deployment-tools 3.4.0 → 3.6.0

package/CHANGELOG.md

@@ -3,6 +3,13 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# [3.6.0](https://github.com/ossy-se/ossy/compare/v3.5.1...v3.6.0) (2026-08-16)
+
+### Bug Fixes
+
+* **deployment-tools:** stabilize ECS cutover edge, OIDC, and ALB rules ([#657](https://github.com/ossy-se/ossy/issues/657)) ([257bd79](https://github.com/ossy-se/ossy/commit/257bd7965d86a09aae2b8f285c5e22e2d29160bb))
+
+
 # [3.4.0](https://github.com/ossy-se/ossy/compare/v3.3.0...v3.4.0) (2026-08-14)
 
 ### Features

package/cdk.context.json

@@ -84,5 +84,18 @@
   "hosted-zone:account=858451553223:domainName=tepit.se:region=eu-north-1": {
     "Id": "/hostedzone/Z07859112SU1GH5SKMUXD",
     "Name": "tepit.se."
+  },
+  "availability-zones:account=858451553223:region=eu-north-1": [
+    "eu-north-1a",
+    "eu-north-1b",
+    "eu-north-1c"
+  ],
+  "hosted-zone:account=858451553223:domainName=ossy.se:region=us-east-1": {
+    "Id": "/hostedzone/Z09424571CVOTIJV8Z50C",
+    "Name": "ossy.se."
+  },
+  "hosted-zone:account=858451553223:domainName=plexus-sanitas.com:region=us-east-1": {
+    "Id": "/hostedzone/Z0222639MQIJ8EOL9VAG",
+    "Name": "plexus-sanitas.com."
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ossy/deployment-tools",
-  "version": "3.4.0",
+  "version": "3.6.0",
   "description": "Collection of scripts and tools to aid deployment of containers and static files to Amazon Web Services through GitHub Actions",
   "source": "./src/index.js",
   "main": "./src/index.js",
@@ -24,5 +24,5 @@
   "devDependencies": {
     "jest": "^30.4.2"
   },
-  "gitHead": "d36b69444268d172bc3e8e1dc77e67afc63f8650"
+  "gitHead": "d1fd144986b0e819d46926aeb11f7815ac52a784"
 }

package/src/edge/platform-edge-domains.js

@@ -28,8 +28,29 @@ function rootDomainOf(domain) {
   return parts.slice(-2).join('.')
 }
 
+/**
+ * Whether `hostname` is already covered by a `*.root` wildcard in `aliases`.
+ * CloudFront rejects overlapping CNAMEs (e.g. both `*.ossy.se` and `api.ossy.se`).
+ *
+ * @param {string} hostname
+ * @param {string[]} aliases
+ * @returns {boolean}
+ */
+function coveredByWildcardAlias(hostname, aliases) {
+  if (!hostname || hostname.includes('*')) return false
+  return aliases.some(alias => {
+    if (!alias.startsWith('*.')) return false
+    const suffix = alias.slice(1) // e.g. ".ossy.se"
+    if (!hostname.endsWith(suffix)) return false
+    const prefix = hostname.slice(0, -suffix.length)
+    // single-label subdomain only (*.ossy.se covers api.ossy.se, not a.b.ossy.se)
+    return prefix.length > 0 && !prefix.includes('.')
+  })
+}
+
 /**
  * Unique, stable sorted list of CloudFront aliases from `domains` + HTTP service hosts.
+ * Drops hostnames covered by a sibling wildcard so ACM/CloudFront accept the set.
  *
  * @param {{
  *   domains?: string[],
@@ -46,9 +67,10 @@ function listEdgeAliases(config) {
       return entry.domain ? [entry.domain] : []
     })
 
-  return [...new Set([...fromDomains, ...fromServices])].sort((a, b) =>
-    a.localeCompare(b)
-  )
+  const all = [...new Set([...fromDomains, ...fromServices])]
+  return all
+    .filter(alias => !coveredByWildcardAlias(alias, all))
+    .sort((a, b) => a.localeCompare(b))
 }
 
 /**

package/src/edge/platform-edge-domains.spec.js

@@ -14,7 +14,7 @@ describe('rootDomainOf', () => {
 })
 
 describe('listEdgeAliases', () => {
-  it('unions domains and HTTP service hosts; skips tcp', () => {
+  it('unions domains and HTTP service hosts; skips tcp; drops names under wildcards', () => {
     expect(listEdgeAliases({
       domains: ['ossy.se', '*.ossy.se', 'worker.ossy.se'],
       services: [
@@ -30,7 +30,7 @@ describe('listEdgeAliases', () => {
           ports: [25565],
         },
       ],
-    })).toEqual(['*.ossy.se', 'api.ossy.se', 'ossy.se', 'worker.ossy.se'])
+    })).toEqual(['*.ossy.se', 'ossy.se'])
   })
 })
 
@@ -59,17 +59,14 @@ describe('planEdgeDomains', () => {
     })
 
     expect(plan.primaryDomain).toBe('ossy.se')
+    // api/worker covered by *.ossy.se — CloudFront forbids overlapping CNAMEs
     expect(plan.aliases).toEqual([
       '*.ossy.se',
-      'api.ossy.se',
       'ossy.se',
-      'worker.ossy.se',
       'www.plexus-sanitas.com',
     ])
     expect(plan.subjectAlternativeNames).toEqual([
       '*.ossy.se',
-      'api.ossy.se',
-      'worker.ossy.se',
       'www.plexus-sanitas.com',
     ])
     expect(plan.validationDomainToRoot.get('*.ossy.se')).toBe('ossy.se')

package/src/infrastructure/platform-ci-stack.js

@@ -23,8 +23,9 @@ const {
  * Trust is limited to `ref:refs/heads/main` for `config.githubDeployRepos`
  * (set in platforms.json — add a repo there to allow it to assume this role).
  *
- * Note: AWS allows only one OIDC provider per URL per account. This stack is
- * intended for the primary platform stage until a shared account bootstrap exists.
+ * Note: AWS allows only one OIDC provider per URL per account. This stack
+ * references the account provider (often created earlier by `trust-ci`) instead
+ * of creating a second one.
  */
 class PlatformCiStack extends Stack {
   /**
@@ -61,10 +62,12 @@ class PlatformCiStack extends Stack {
       return `repo:${repo}:ref:refs/heads/main`
     })
 
-    const provider = new OpenIdConnectProvider(this, 'GithubOidcProvider', {
-      url: 'https://token.actions.githubusercontent.com',
-      clientIds: ['sts.amazonaws.com'],
-    })
+    // One provider per issuer URL per account — reuse the existing GitHub OIDC IdP.
+    const provider = OpenIdConnectProvider.fromOpenIdConnectProviderArn(
+      this,
+      'GithubOidcProvider',
+      `arn:aws:iam::${account}:oidc-provider/token.actions.githubusercontent.com`
+    )
 
     const deployRole = new Role(this, 'GithubDeployRole', {
       roleName,

package/src/infrastructure/platform-ecs-stack.js

@@ -281,23 +281,18 @@ class PlatformEcsStack extends Stack {
 
     // Lower priority number = evaluated first. Specific hosts before wildcards
     // so `api.ossy.se` is not swallowed by `*.ossy.se`.
-    const orderedHostRules = [...hostRules].sort((a, b) => {
-      const aWild = a.host.includes('*') ? 1 : 0
-      const bWild = b.host.includes('*') ? 1 : 0
-      return aWild - bWild
-    })
-
-    let rulePriority = 10
-    for (const rule of orderedHostRules) {
+    // Priorities are hash-stable per host — sequential 10,11,12… renumbers
+    // every insert and CloudFormation cannot swap ALB priorities in one update.
+    const usedPriorities = new Set()
+    for (const rule of hostRules) {
       listener.addTargetGroups(
         `Rule${rule.idSuffix}${toConstructId(rule.host)}`,
         {
-          priority: rulePriority,
+          priority: albHostRulePriority(rule.host, usedPriorities),
           conditions: [ListenerCondition.hostHeaders([rule.host])],
           targetGroups: [rule.targetGroup],
         }
       )
-      rulePriority += 1
     }
 
     this.vpc = vpc
@@ -325,6 +320,29 @@ class PlatformEcsStack extends Stack {
   }
 }
 
+/**
+ * Stable ALB listener-rule priority for a host header (1–50000).
+ * Specific hosts: 10000–29999; wildcards: 40000–49999 (evaluated later).
+ * @param {string} host
+ * @param {Set<number>} used
+ * @returns {number}
+ */
+function albHostRulePriority(host, used) {
+  const band = host.includes('*') ? 40000 : 10000
+  let hash = 2166136261
+  for (let i = 0; i < host.length; i += 1) {
+    hash ^= host.charCodeAt(i)
+    hash = Math.imul(hash, 16777619) >>> 0
+  }
+  let priority = band + (hash % 20000)
+  while (used.has(priority)) {
+    priority += 1
+    if (priority >= band + 20000) priority = band
+  }
+  used.add(priority)
+  return priority
+}
+
 /**
  * CloudFormation-safe construct id fragment.
  * @param {string} key
@@ -346,4 +364,5 @@ function truncateAwsName(name, max) {
 
 module.exports = {
   PlatformEcsStack,
+  albHostRulePriority,
 }