skuba 7.3.1 → 7.4.0-horrible-hacks-20240206023615

package/template/lambda-sqs-worker-cdk/infra/appStack.test.ts

@@ -1,5 +1,5 @@
-import { SynthUtils } from '@aws-cdk/assert';
-import { App } from 'aws-cdk-lib';
+import { App, aws_sns } from 'aws-cdk-lib';
+import { Template } from 'aws-cdk-lib/assertions';
 
 import cdkJson from '../cdk.json';
 
@@ -17,14 +17,34 @@ const contexts = [
   },
 ];
 
+const currentDate = '1212-12-12T12:12:12.121Z';
+
+jest.useFakeTimers({
+  legacyFakeTimers: false,
+  doNotFake: [
+    'nextTick',
+    'setInterval',
+    'clearInterval',
+    'setTimeout',
+    'clearTimeout',
+  ],
+  now: new Date(currentDate),
+});
+
 it.each(contexts)(
   'returns expected CloudFormation stack for $stage',
   (context) => {
+    jest
+      .spyOn(aws_sns.Topic, 'fromTopicArn')
+      .mockImplementation((scope, id) => new aws_sns.Topic(scope, id));
+
     const app = new App({ context });
 
     const stack = new AppStack(app, 'appStack');
 
-    const json = JSON.stringify(SynthUtils.toCloudFormation(stack)).replace(
+    const template = Template.fromStack(stack);
+
+    const json = JSON.stringify(template.toJSON()).replace(
       /"S3Key":"([0-9a-f]+)\.zip"/g,
       (_, hash) => `"S3Key":"${'x'.repeat(hash.length)}.zip"`,
     );

package/template/lambda-sqs-worker-cdk/infra/appStack.ts

@@ -1,10 +1,14 @@
 import {
+  Duration,
   Stack,
   type StackProps,
+  aws_cloudwatch,
+  aws_codedeploy,
   aws_iam,
   aws_kms,
   aws_lambda,
   aws_lambda_event_sources,
+  aws_lambda_nodejs,
   aws_sns,
   aws_sns_subscriptions,
   aws_sqs,
@@ -31,11 +35,6 @@ export class AppStack extends Stack {
 
     kmsKey.grantEncrypt(accountPrincipal);
 
-    const topic = new aws_sns.Topic(this, 'topic', {
-      topicName: '<%- serviceName %>',
-      masterKey: kmsKey,
-    });
-
     const deadLetterQueue = new aws_sqs.Queue(this, 'worker-queue-dlq', {
       queueName: '<%- serviceName %>-dlq',
       encryptionMasterKey: kmsKey,
@@ -50,25 +49,139 @@ export class AppStack extends Stack {
       encryptionMasterKey: kmsKey,
     });
 
+    const topic = aws_sns.Topic.fromTopicArn(
+      this,
+      'source-topic',
+      context.sourceSnsTopicArn,
+    );
+
+    topic.addSubscription(new aws_sns_subscriptions.SqsSubscription(queue));
+
     const architecture = '<%- lambdaCdkArchitecture %>';
 
-    const worker = new aws_lambda.Function(this, 'worker', {
+    const defaultWorkerConfig: aws_lambda_nodejs.NodejsFunctionProps = {
       architecture: aws_lambda.Architecture[architecture],
-      code: new aws_lambda.AssetCode('./lib'),
       runtime: aws_lambda.Runtime.NODEJS_20_X,
-      handler: 'app.handler',
-      functionName: '<%- serviceName %>',
       environmentEncryption: kmsKey,
+      // aws-sdk-v3 sets this to true by default, so it is not necessary to set the environment variable
+      // https://docs.aws.amazon.com/sdk-for-javascript/v3/developer-guide/node-reusing-connections.html
+      awsSdkConnectionReuse: false,
+    };
+
+    const defaultWorkerBundlingConfig: aws_lambda_nodejs.BundlingOptions = {
+      sourceMap: true,
+      target: 'node20',
+      // aws-sdk-v3 is set as an external module by default, but we want it to be bundled with the function
+      externalModules: [],
+    };
+
+    const defaultWorkerEnvironment: Record<string, string> = {
+      NODE_ENV: 'production',
+      // https://nodejs.org/api/cli.html#cli_node_options_options
+      NODE_OPTIONS: '--enable-source-maps',
+    };
+
+    const worker = new aws_lambda_nodejs.NodejsFunction(this, 'worker', {
+      ...defaultWorkerConfig,
+      entry: './src/app.ts',
+      timeout: Duration.seconds(30),
+      bundling: defaultWorkerBundlingConfig,
+      functionName: '<%- serviceName %>',
       environment: {
-        NODE_ENV: 'production',
-        // https://nodejs.org/api/cli.html#cli_node_options_options
-        NODE_OPTIONS: '--enable-source-maps',
+        ...defaultWorkerEnvironment,
         ...context.workerLambda.environment,
       },
+      // https://github.com/aws/aws-cdk/issues/28237
+      // This forces the lambda to be updated on every deployment
+      // If you do not wish to use hotswap, you can remove the new Date().toISOString() from the description
+      description: `Updated at ${new Date().toISOString()}`,
+      reservedConcurrentExecutions: context.workerLambda.reservedConcurrency,
     });
 
-    worker.addEventSource(new aws_lambda_event_sources.SqsEventSource(queue));
+    const alias = worker.addAlias('live', {
+      description: 'The Lambda version currently receiving traffic',
+    });
 
-    topic.addSubscription(new aws_sns_subscriptions.SqsSubscription(queue));
+    alias.addEventSource(
+      new aws_lambda_event_sources.SqsEventSource(queue, {
+        maxConcurrency: context.workerLambda.reservedConcurrency,
+      }),
+    );
+
+    const preHook = new aws_lambda_nodejs.NodejsFunction(
+      this,
+      'worker-pre-hook',
+      {
+        ...defaultWorkerConfig,
+        entry: './src/preHook.ts',
+        timeout: Duration.seconds(120),
+        bundling: defaultWorkerBundlingConfig,
+        functionName: '<%- serviceName %>-pre-hook',
+        environment: {
+          ...defaultWorkerEnvironment,
+          ...context.workerLambda.environment,
+          FUNCTION_NAME_TO_INVOKE: worker.functionName,
+        },
+      },
+    );
+
+    worker.grantInvoke(preHook);
+
+    const postHook = new aws_lambda_nodejs.NodejsFunction(
+      this,
+      'worker-post-hook',
+      {
+        ...defaultWorkerConfig,
+        entry: './src/postHook.ts',
+        timeout: Duration.seconds(30),
+        bundling: defaultWorkerBundlingConfig,
+        functionName: '<%- serviceName %>-post-hook',
+        environment: {
+          ...defaultWorkerEnvironment,
+          ...context.workerLambda.environment,
+          FUNCTION_NAME_TO_PRUNE: worker.functionName,
+        },
+      },
+    );
+
+    const prunePermissions = new aws_iam.PolicyStatement({
+      actions: [
+        'lambda:ListAliases',
+        'lambda:ListVersionsByFunction',
+        'lambda:DeleteFunction',
+      ],
+      resources: [worker.functionArn, `${worker.functionArn}:*`],
+    });
+
+    postHook.addToRolePolicy(prunePermissions);
+
+    const application = new aws_codedeploy.LambdaApplication(
+      this,
+      'codedeploy-application',
+    );
+
+    const deploymentGroup = new aws_codedeploy.LambdaDeploymentGroup(
+      this,
+      'codedeploy-group',
+      {
+        application,
+        alias,
+        deploymentConfig: aws_codedeploy.LambdaDeploymentConfig.ALL_AT_ONCE,
+      },
+    );
+
+    const alarm = new aws_cloudwatch.Alarm(this, 'codedeploy-alarm', {
+      metric: alias.metricErrors({
+        period: Duration.seconds(60),
+      }),
+      threshold: 1,
+      evaluationPeriods: 1,
+    });
+
+    deploymentGroup.addAlarm(alarm);
+
+    deploymentGroup.addPreHook(preHook);
+
+    deploymentGroup.addPostHook(postHook);
   }
 }

package/template/lambda-sqs-worker-cdk/package.json

@@ -2,21 +2,23 @@
   "private": true,
   "license": "UNLICENSED",
   "scripts": {
-    "build": "skuba build",
     "deploy": "cdk deploy appStack --require-approval never --context stage=${ENVIRONMENT}",
+    "deploy:hotswap": "pnpm run --silent deploy --hotswap",
+    "deploy:watch": "pnpm run --silent deploy:hotswap --watch",
     "format": "skuba format",
     "lint": "skuba lint",
-    "package": "yarn install --ignore-optional --ignore-scripts --modules-folder ./lib/node_modules --non-interactive --offline --production",
     "test": "skuba test",
     "test:ci": "skuba test --coverage",
     "test:watch": "skuba test --watch"
   },
   "dependencies": {
+    "@aws-sdk/client-codedeploy": "^3.363.0",
+    "@aws-sdk/client-lambda": "^3.363.0",
+    "@aws-sdk/client-sns": "^3.363.0",
     "@seek/logger": "^6.0.0",
     "zod": "^3.19.1"
   },
   "devDependencies": {
-    "@aws-cdk/assert": "^2.24.0",
     "@types/aws-lambda": "^8.10.82",
     "@types/node": "^20.9.0",
     "aws-cdk": "^2.109.0",

package/template/lambda-sqs-worker-cdk/shared/context-types.ts

@@ -10,6 +10,7 @@ export const EnvContextSchema = z.object({
       SOMETHING: z.string(),
     }),
   }),
+  sourceSnsTopicArn: z.string(),
 });
 
 export type EnvContext = z.infer<typeof EnvContextSchema>;

package/template/lambda-sqs-worker-cdk/skuba.template.js

@@ -23,5 +23,6 @@ module.exports = {
       validate: (value) => /^.+:.+$/.test(value),
     },
   ],
+  packageManager: 'pnpm',
   type: 'application',
 };

package/template/lambda-sqs-worker-cdk/src/app.ts

@@ -5,6 +5,19 @@ const logger = createLogger({
   name: '<%- serviceName %>',
 });
 
-export const handler: SQSHandler = (_: SQSEvent) => {
+/**
+ * Tests connectivity to ensure appropriate access and network configuration.
+ */
+const smokeTest = async () => Promise.resolve();
+
+export const handler: SQSHandler = (event: SQSEvent) => {
+  // Treat an empty object as our smoke test event.
+  if (!Object.keys(event).length) {
+    logger.debug('Received smoke test request');
+    return smokeTest();
+  }
+
   logger.info('Hello World!');
+
+  return;
 };

package/template/lambda-sqs-worker-cdk/src/postHook.ts

@@ -0,0 +1,154 @@
+/* eslint-disable no-console */
+/* istanbul ignore file */
+
+import {
+  CodeDeploy,
+  PutLifecycleEventHookExecutionStatusCommand,
+} from '@aws-sdk/client-codedeploy';
+import {
+  type AliasConfiguration,
+  DeleteFunctionCommand,
+  type FunctionConfiguration,
+  LambdaClient,
+  ListAliasesCommand,
+  ListVersionsByFunctionCommand,
+} from '@aws-sdk/client-lambda';
+import { z } from 'zod';
+
+const lambda = new LambdaClient();
+const codeDeploy = new CodeDeploy();
+
+const listLambdaVersions = async (
+  functionName: string,
+  marker?: string,
+): Promise<FunctionConfiguration[]> => {
+  const result = await lambda.send(
+    new ListVersionsByFunctionCommand({
+      FunctionName: functionName,
+      Marker: marker,
+    }),
+  );
+  const versions = result.Versions ?? [];
+  if (result.NextMarker) {
+    return [
+      ...versions,
+      ...(await listLambdaVersions(functionName, result.NextMarker)),
+    ];
+  }
+
+  return versions;
+};
+
+const listAliases = async (
+  functionName: string,
+  marker?: string,
+): Promise<AliasConfiguration[]> => {
+  const result = await lambda.send(
+    new ListAliasesCommand({
+      FunctionName: functionName,
+      Marker: marker,
+    }),
+  );
+  const aliases = result.Aliases ?? [];
+  if (result.NextMarker) {
+    return [
+      ...aliases,
+      ...(await listAliases(functionName, result.NextMarker)),
+    ];
+  }
+
+  return aliases;
+};
+
+const pruneLambdas = async (
+  functionName: string,
+  numberToKeep: number,
+): Promise<void> => {
+  const [aliases, versions] = await Promise.all([
+    listAliases(functionName),
+    listLambdaVersions(functionName),
+  ]);
+
+  const aliasMap = new Map(
+    aliases.flatMap((alias) =>
+      alias.FunctionVersion ? [[alias.FunctionVersion, alias]] : [],
+    ),
+  );
+
+  const versionsToPrune = versions
+    .filter(
+      (version) =>
+        version.Version &&
+        !aliasMap.has(version.Version) &&
+        version.Version !== '$LATEST',
+    )
+    .sort((a, b) => Number(b.Version) - Number(a.Version))
+    .slice(numberToKeep);
+
+  if (!versionsToPrune.length) {
+    console.log('No function versions to prune');
+    return;
+  }
+
+  console.log(
+    `Pruning function versions: ${versionsToPrune
+      .map((version) => version.Version)
+      .join(', ')}`,
+  );
+
+  await Promise.all(
+    versionsToPrune.map((version) =>
+      lambda.send(
+        new DeleteFunctionCommand({
+          FunctionName: version.FunctionName,
+          Qualifier: version.Version,
+        }),
+      ),
+    ),
+  );
+};
+
+const EnvSchema = z.object({
+  FUNCTION_NAME_TO_PRUNE: z.string(),
+  NUMBER_OF_VERSIONS_TO_KEEP: z.coerce.number().default(0),
+});
+
+type Status = 'Succeeded' | 'Failed';
+
+/**
+ * The event supplied to a CodeDeploy lifecycle hook Lambda function.
+ *
+ * {@link https://docs.aws.amazon.com/codedeploy/latest/userguide/tutorial-ecs-with-hooks-create-hooks.html}
+ */
+interface CodeDeployLifecycleHookEvent {
+  DeploymentId: string;
+  LifecycleEventHookExecutionId: string;
+}
+
+/**
+ * A handler to clean up old Lambda function versions and layers
+ */
+export const handler = async (
+  event: CodeDeployLifecycleHookEvent,
+): Promise<void> => {
+  let status: Status = 'Succeeded';
+  try {
+    const {
+      FUNCTION_NAME_TO_PRUNE: functionName,
+      NUMBER_OF_VERSIONS_TO_KEEP: numberToKeep,
+    } = EnvSchema.parse(process.env);
+
+    await pruneLambdas(functionName, numberToKeep);
+  } catch (err) {
+    console.error('Exception:', err);
+    status = 'Failed';
+  }
+
+  await codeDeploy.send(
+    new PutLifecycleEventHookExecutionStatusCommand({
+      deploymentId: event.DeploymentId,
+      lifecycleEventHookExecutionId: event.LifecycleEventHookExecutionId,
+      status,
+    }),
+  );
+};

package/template/lambda-sqs-worker-cdk/src/preHook.ts

@@ -0,0 +1,95 @@
+/* eslint-disable no-console */
+/* istanbul ignore file */
+
+// Use minimal dependencies to reduce the chance of crashes on module load.
+import {
+  CodeDeployClient,
+  PutLifecycleEventHookExecutionStatusCommand,
+} from '@aws-sdk/client-codedeploy';
+import { InvokeCommand, LambdaClient } from '@aws-sdk/client-lambda';
+
+const codeDeploy = new CodeDeployClient({
+  apiVersion: '2014-10-06',
+  maxAttempts: 5,
+});
+
+const lambda = new LambdaClient({
+  apiVersion: '2015-03-31',
+  maxAttempts: 5,
+});
+
+type Status = 'Succeeded' | 'Failed';
+
+/**
+ * Synchronously invokes a Lambda function with a smoke test event.
+ *
+ * Any non-error response is treated as a success.
+ */
+const smokeTestLambdaFunction = async (): Promise<Status> => {
+  const functionName = process.env.FUNCTION_NAME_TO_INVOKE;
+
+  if (!functionName) {
+    console.error('Missing process.env.FUNCTION_NAME_TO_INVOKE');
+    return 'Failed';
+  }
+
+  console.info('Function:', functionName);
+
+  const response = await lambda.send(
+    new InvokeCommand({
+      FunctionName: functionName,
+      InvocationType: 'RequestResponse',
+      // Treat an empty object as our smoke test event.
+      Payload: Buffer.from('{}'),
+    }),
+  );
+
+  console.info('Version:', response.ExecutedVersion ?? '?');
+  console.info('Status', response.StatusCode ?? '?');
+
+  if (response.FunctionError) {
+    console.error('Error:', response.FunctionError);
+    if (response.Payload) {
+      console.error(response.Payload.transformToString());
+    }
+    return 'Failed';
+  }
+
+  return response.StatusCode === 200 ? 'Succeeded' : 'Failed';
+};
+
+/**
+ * The event supplied to a CodeDeploy lifecycle hook Lambda function.
+ *
+ * {@link https://docs.aws.amazon.com/codedeploy/latest/userguide/tutorial-ecs-with-hooks-create-hooks.html}
+ */
+interface CodeDeployLifecycleHookEvent {
+  DeploymentId: string;
+  LifecycleEventHookExecutionId: string;
+}
+
+/**
+ * A handler to smoke test a new Lambda function version before it goes live.
+ *
+ * This tries to be exception safe so that a status reaches CodeDeploy. If we
+ * crash or otherwise fail to report back, the deployment will hang for an hour.
+ */
+export const handler = async (
+  event: CodeDeployLifecycleHookEvent,
+): Promise<void> => {
+  let status: Status;
+  try {
+    status = await smokeTestLambdaFunction();
+  } catch (err) {
+    console.error('Exception:', err);
+    status = 'Failed';
+  }
+
+  await codeDeploy.send(
+    new PutLifecycleEventHookExecutionStatusCommand({
+      deploymentId: event.DeploymentId,
+      lifecycleEventHookExecutionId: event.LifecycleEventHookExecutionId,
+      status,
+    }),
+  );
+};

package/template/oss-npm-package/.github/workflows/release.yml

@@ -3,8 +3,8 @@ name: Release
 on:
   push:
     branches:
+      - $default-branch
       - beta
-      - master
 
 permissions: {}
 
@@ -17,20 +17,23 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out repo
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           fetch-depth: 0
 
-      - name: Set up Node.js 16.x
-        uses: actions/setup-node@v3
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
         with:
-          node-version: 16.x
+          node-version: 20.x
+
+      - name: Set up pnpm
+        run: corepack enable pnpm
 
       - name: Install dependencies
-        run: yarn install --frozen-lockfile
+        run: pnpm install --frozen-lockfile
 
       - name: Publish to npm
-        run: yarn release
+        run: pnpm run release
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           NPM_TOKEN: ${{ secrets.SEEK_OSS_CI_NPM_TOKEN }}

package/template/oss-npm-package/.github/workflows/validate.yml

@@ -14,18 +14,21 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out repo
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
-      - name: Set up Node.js 16.x
-        uses: actions/setup-node@v3
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
         with:
-          node-version: 16.x
+          node-version: 20.x
+
+      - name: Set up pnpm
+        run: corepack enable pnpm
 
       - name: Install dependencies
-        run: yarn install --frozen-lockfile
+        run: pnpm install --frozen-lockfile
 
       - name: Test
-        run: yarn test:ci
+        run: pnpm run test:ci
 
       - name: Lint
-        run: yarn lint
+        run: pnpm run lint

package/template/oss-npm-package/.releaserc

@@ -0,0 +1,16 @@
+{
+  "branches": [
+    "+([0-9])?(.{+([0-9]),x}).x",
+    "<%- defaultBranch %>",
+    "next",
+    "next-major",
+    {
+      "name": "beta",
+      "prerelease": true
+    },
+    {
+      "name": "alpha",
+      "prerelease": true
+    }
+  ]
+}