skuba 9.2.0-main-20250114234022 → 9.2.0-main-20250217113038

package/template/lambda-sqs-worker-cdk/tsconfig.json

@@ -1,12 +1,12 @@
 {
   "compilerOptions": {
     "baseUrl": ".",
-    "lib": ["ES2022"],
+    "lib": ["ES2024"],
     "outDir": "lib",
     "paths": {
       "src": ["src"]
     },
-    "target": "ES2022"
+    "target": "ES2024"
   },
   "exclude": ["lib*/**/*"],
   "extends": "skuba/config/tsconfig.json"

package/template/oss-npm-package/.github/workflows/release.yml

@@ -25,7 +25,7 @@ jobs:
       - name: Set up Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: 20.x
+          node-version: ^22.14
 
       - name: Set up pnpm
         run: corepack enable pnpm && corepack install

package/template/oss-npm-package/.github/workflows/validate.yml

@@ -21,7 +21,7 @@ jobs:
       - name: Set up Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: 20.x
+          node-version: ^22.14
 
       - name: Set up pnpm
         run: corepack enable pnpm && corepack install

package/template/oss-npm-package/.nvmrc

@@ -1 +1 @@
-20
+22

package/template/oss-npm-package/_package.json

@@ -34,7 +34,7 @@
   },
   "dependencies": {},
   "devDependencies": {
-    "@types/node": "^20.16.5",
+    "@types/node": "^22.13.1",
     "commitizen": "^4.2.4",
     "skuba": "*"
   },

package/template/private-npm-package/.nvmrc

@@ -1 +1 @@
-20
+22

package/template/private-npm-package/_package.json

@@ -34,12 +34,12 @@
   },
   "dependencies": {},
   "devDependencies": {
-    "@types/node": "^20.16.5",
+    "@types/node": "^22.13.1",
     "commitizen": "^4.2.4",
     "skuba": "*"
   },
   "packageManager": "pnpm@8.15.1",
   "engines": {
-    "node": ">=18.12"
+    "node": ">=22"
   }
 }

package/template/lambda-sqs-worker/.buildkite/pipeline.yml

@@ -1,108 +0,0 @@
-agents:
-  queue: <%- prodBuildkiteQueueName %>
-
-configs:
-  plugins:
-    - &aws-sm
-      seek-oss/aws-sm#v2.3.2:
-        env:
-          NPM_READ_TOKEN: arn:aws:secretsmanager:ap-southeast-2:987872074697:secret:npm/npm-read-token
-
-    - &docker-ecr-cache
-      seek-oss/docker-ecr-cache#v2.2.1: &docker-ecr-cache-defaults
-        cache-on:
-          - .npmrc
-          - package.json#.packageManager
-          - pnpm-lock.yaml
-        secrets: id=npm,src=/tmp/.npmrc
-
-    - &private-npm
-      seek-oss/private-npm#v1.3.0:
-        env: NPM_READ_TOKEN
-        output-path: /tmp/
-
-  base-steps:
-    - &deploy
-      commands:
-        - echo '--- pnpm install --offline'
-        - pnpm install --offline
-        - echo '+++ pnpm run deploy'
-        - pnpm run deploy
-      concurrency: 1
-      plugins:
-        - artifacts#v1.9.4:
-            build: ${BUILDKITE_BUILD_ID}
-            download: lib/*
-        - *aws-sm
-        - *private-npm
-        - *docker-ecr-cache
-        - docker-compose#v5.5.0:
-            dependencies: false
-            run: app
-            propagate-environment: true
-      retry:
-        manual:
-          # Only use this if you need to roll back a deployment ASAP.
-          # Always follow up with a proper revert or fix in Git history.
-          permit_on_passed: true
-
-env:
-  VERSION: ${BUILDKITE_COMMIT:0:7}.${BUILDKITE_BUILD_NUMBER}
-
-steps:
-  - label: 🧪 Test, Lint & Build
-    artifact_paths: lib/**/*
-    commands:
-      - echo '--- pnpm install --offline'
-      - pnpm install --offline
-      - echo '+++ pnpm test:ci'
-      - pnpm test:ci
-      - echo '--- pnpm lint'
-      - pnpm lint
-      - echo '--- pnpm build'
-      - pnpm build
-    env:
-      GET_GITHUB_TOKEN: please
-    plugins:
-      - *aws-sm
-      - *private-npm
-      - *docker-ecr-cache
-      - docker-compose#v5.5.0:
-          run: app
-          environment:
-            - GITHUB_API_TOKEN
-          propagate-environment: true
-    timeout_in_minutes: 10
-
-  - agents:
-      queue: <%- devBuildkiteQueueName %>
-    branches: '!renovate-*'
-    label: 🧖‍♀️ Warm Dev
-    command: ':'
-    plugins:
-      - *aws-sm
-      - *private-npm
-      - seek-oss/docker-ecr-cache#v2.2.1:
-          <<: *docker-ecr-cache-defaults
-          skip-pull-from-cache: true
-
-  - wait
-  - block: 🙋🏻‍♀️ Deploy Dev
-    branches: '!${BUILDKITE_PIPELINE_DEFAULT_BRANCH}'
-
-  - <<: *deploy
-    agents:
-      queue: <%- devBuildkiteQueueName %>
-    env:
-      ENVIRONMENT: dev
-    concurrency_group: <%- repoName %>/deploy/dev
-    label: 🤞 Deploy Dev
-
-  - wait
-
-  - <<: *deploy
-    env:
-      ENVIRONMENT: prod
-    branches: ${BUILDKITE_PIPELINE_DEFAULT_BRANCH}
-    concurrency_group: <%- repoName %>/deploy/prod
-    label: 🚀 Deploy Prod

package/template/lambda-sqs-worker/.env

@@ -1 +0,0 @@
-ENVIRONMENT=local

package/template/lambda-sqs-worker/.nvmrc

@@ -1 +0,0 @@
-20

package/template/lambda-sqs-worker/Dockerfile

@@ -1,17 +0,0 @@
-# syntax=docker/dockerfile:1.12
-
-FROM public.ecr.aws/docker/library/node:20-alpine AS dev-deps
-
-RUN --mount=type=bind,source=package.json,target=package.json \
-    corepack enable pnpm && corepack install
-
-RUN --mount=type=bind,source=package.json,target=package.json \
-    pnpm config set store-dir /root/.pnpm-store
-
-WORKDIR /workdir
-
-RUN --mount=type=bind,source=.npmrc,target=.npmrc \
-    --mount=type=bind,source=package.json,target=package.json \
-    --mount=type=bind,source=pnpm-lock.yaml,target=pnpm-lock.yaml \
-    --mount=type=secret,id=npm,dst=/root/.npmrc,required=true \
-    pnpm fetch

package/template/lambda-sqs-worker/README.md

@@ -1,132 +0,0 @@
-# <%- repoName %>
-
-[![Powered by skuba](https://img.shields.io/badge/🤿%20skuba-powered-009DC4)](https://github.com/seek-oss/skuba)
-
-Next steps:
-
-1. [ ] Finish templating if this was skipped earlier:
-
-   ```shell
-   pnpm exec skuba configure
-   ```
-
-2. [ ] Create a new repository in the appropriate GitHub organisation.
-3. [ ] Add the repository to BuildAgency;
-       see our internal [Buildkite Docs] for more information.
-4. [ ] Add Datadog extension, deployment bucket configuration and data classification tags to [serverless.yml](serverless.yml).
-5. [ ] Push local commits to the upstream GitHub branch.
-6. [ ] Configure [GitHub repository settings].
-7. [ ] Delete this checklist 😌.
-
-[Buildkite Docs]: https://backstage.myseek.xyz/docs/default/component/buildkite-docs
-[GitHub repository settings]: https://github.com/<%-orgName%>/<%-repoName%>/settings
-
-## Design
-
-<%-repoName %> is a Node.js [Lambda] application built in line with our [Technical Guidelines].
-It is backed by a typical SQS message + dead letter queue configuration and uses common SEEK packages.
-Workers enable fault-tolerant asynchronous processing of events.
-
-The `lambda-sqs-worker` template is modelled after a hypothetical enricher that scores job advertisements.
-It's stubbed out with in-memory [scoring service](src/services/jobScorer.ts).
-This would be replaced with internal logic or an external service in production.
-
-This project is deployed with [Serverless].
-The Lambda runtime provisions a single Node.js process per container.
-The supplied [serverless.yml](serverless.yml) starts out with a minimal `memorySize` which may require tuning based on workload.
-Under load, we autoscale horizontally in terms of container count up to `reservedConcurrency`.
-
-Serverless configures [CodeDeploy] for a blue-green deployment approach.
-A smoke test is run against the new version before traffic is switched over,
-providing an opportunity to test access and connectivity to online dependencies.
-This defaults to an invocation with an empty object `{}`, per [src/hooks.ts](src/hooks.ts).
-
-## Development
-
-### Test
-
-```shell
-# Run Jest tests locally
-pnpm test
-
-# Authenticate to dev account
-awsauth
-
-# Run smoke test against deployed application
-ENVIRONMENT=dev pnpm smoke
-```
-
-### Lint
-
-```shell
-# Fix issues
-pnpm format
-
-# Check for issues
-pnpm lint
-```
-
-### Start
-
-```shell
-# Start a local HTTP server
-pnpm start
-
-# Start with Node.js Inspector enabled
-pnpm start:debug
-```
-
-This serves the Lambda application over HTTP.
-For example, to invoke the handler with an empty object `{}` for smoke testing:
-
-```shell
-curl --data '[{}, {"awsRequestId": "local"}]' --include localhost:<%- port %>
-```
-
-### Deploy
-
-This project is deployed through a [Buildkite pipeline](.buildkite/pipeline.yml).
-
-- Commits to a feature branch can be deployed to the dev environment by unblocking a step in the Buildkite UI
-- Commits to the default branch are automatically deployed to the dev and prod environments in sequence
-
-To deploy locally:
-
-```shell
-# Authenticate to dev account
-awsauth
-
-ENVIRONMENT=dev pnpm run deploy
-```
-
-To rapidly roll back a change,
-retry an individual deployment step from the previous build in Buildkite.
-Note that this will introduce drift between the head of the default Git branch and the live environment;
-use with caution and always follow up with a proper revert or fix in Git history.
-
-## Support
-
-### Dev
-
-TODO: add support links for the dev environment.
-
-<!--
-- CloudWatch dashboard
-- Datadog dashboard
-- Splunk logs
--->
-
-### Prod
-
-TODO: add support links for the prod environment.
-
-<!--
-- CloudWatch dashboard
-- Datadog dashboard
-- Splunk logs
--->
-
-[CodeDeploy]: https://docs.aws.amazon.com/codedeploy
-[Lambda]: https://docs.aws.amazon.com/lambda
-[Serverless]: https://www.serverless.com/
-[Technical Guidelines]: https://myseek.atlassian.net/wiki/spaces/AA/pages/2358346017/

package/template/lambda-sqs-worker/_.npmrc

@@ -1,13 +0,0 @@
-# managed by skuba
-package-manager-strict-version=true
-public-hoist-pattern[]="@types*"
-public-hoist-pattern[]="*eslint*"
-public-hoist-pattern[]="*prettier*"
-public-hoist-pattern[]="esbuild"
-public-hoist-pattern[]="jest"
-public-hoist-pattern[]="tsconfig-seek"
-# end managed by skuba
-
-# Required for Serverless packaging
-node-linker=hoisted
-shamefully-hoist=true

package/template/lambda-sqs-worker/docker-compose.yml

@@ -1,10 +0,0 @@
-services:
-  app:
-    image: ${BUILDKITE_PLUGIN_DOCKER_IMAGE:-''}
-    init: true
-    volumes:
-      - ./:/workdir
-      # Mount agent for Buildkite annotations.
-      - /usr/bin/buildkite-agent:/usr/bin/buildkite-agent
-      # Mount cached dependencies.
-      - /workdir/node_modules

package/template/lambda-sqs-worker/package.json

@@ -1,45 +0,0 @@
-{
-  "name": "@seek/<%- serviceName %>",
-  "private": true,
-  "license": "UNLICENSED",
-  "scripts": {
-    "build": "skuba build",
-    "deploy": "serverless deploy --force --verbose",
-    "format": "skuba format",
-    "lint": "skuba lint",
-    "smoke": "serverless invoke --data '{}' --function Worker",
-    "start": "skuba start --port <%- port %>",
-    "start:debug": "pnpm --silent start --inspect-brk",
-    "test": "skuba test",
-    "test:ci": "skuba test --coverage",
-    "test:watch": "skuba test --watch"
-  },
-  "dependencies": {
-    "@aws-sdk/client-codedeploy": "^3.363.0",
-    "@aws-sdk/client-lambda": "^3.363.0",
-    "@aws-sdk/client-sns": "^3.363.0",
-    "@seek/logger": "^9.0.0",
-    "datadog-lambda-js": "^9.0.0",
-    "dd-trace": "^5.0.0",
-    "skuba-dive": "^2.0.0",
-    "zod": "^3.19.1"
-  },
-  "devDependencies": {
-    "@types/aws-lambda": "^8.10.84",
-    "@types/chance": "^1.1.3",
-    "@types/node": "^20.16.5",
-    "aws-sdk-client-mock": "^4.0.0",
-    "aws-sdk-client-mock-jest": "^4.0.0",
-    "chance": "^1.1.8",
-    "pino-pretty": "^13.0.0",
-    "serverless": "^3.39.0",
-    "serverless-plugin-canary-deployments": "^0.8.0",
-    "serverless-plugin-datadog": "^5.12.0",
-    "serverless-prune-plugin": "^2.0.0",
-    "skuba": "*"
-  },
-  "packageManager": "pnpm@9.15.3",
-  "engines": {
-    "node": ">=20"
-  }
-}

package/template/lambda-sqs-worker/serverless.yml

@@ -1,213 +0,0 @@
-service: <%- serviceName %>
-
-configValidationMode: error
-
-params:
-  default:
-    datadogApiKeySecretArn: 'TODO: arn:aws:secretsmanager:${aws:region}:${aws:accountId}:secret:SECRET-NAME'
-    dataStoreTags:
-      - Key: seek:auto:backup:frequency
-        Value: none
-      # TODO: https://rfc.skinfra.xyz/RFC019-AWS-Tagging-Standard.html#data-services
-      # - Key: seek:data:derived
-      #   Value: copy
-      # - Key: seek:data:domain
-      #   Value: unassigned
-      # - Key: seek:data:jurisdiction-source
-      #   Value: australia hong-kong indonesia malaysia new-zealand philippines singapore thailand
-      # - Key: seek:data:types:restricted
-      #   Value: job-ads
-    description: <%- description %>
-  dev:
-    deploymentBucket: 'TODO: deployment-bucket-name'
-    concurrency: 2
-  prod:
-    deploymentBucket: 'TODO: deployment-bucket-name'
-    concurrency: 20
-
-custom:
-  datadog:
-    addLayers: false
-    apiKeySecretArn: ${param:datadogApiKeySecretArn}
-    enableDDLogs: false
-    # TODO: enable Datadog extension
-    enabled: false
-    exclude:
-      - WorkerPreHook
-    injectLogContext: false
-    version: ${env:VERSION}
-  prune:
-    automatic: true
-    number: 3
-
-plugins:
-  - serverless-plugin-canary-deployments
-  - serverless-plugin-datadog
-  - serverless-prune-plugin
-
-provider:
-  logRetentionInDays: 30
-  name: aws
-  region: ap-southeast-2
-  runtime: nodejs20.x
-  architecture: <%- lambdaServerlessArchitecture %>
-  deploymentMethod: direct
-  stackName: ${self:service}
-  stage: ${env:ENVIRONMENT}
-  deploymentBucket:
-    # Use a shared account-level bucket for Lambda bundles and other artefacts.
-    # This is easier to manage in terms of access, deployment, and tagging.
-    name: ${param:deploymentBucket}
-  environment:
-    NODE_ENV: production
-    # https://nodejs.org/api/cli.html#cli_node_options_options
-    NODE_OPTIONS: --enable-source-maps
-  iam:
-    role:
-      statements:
-        - Action:
-            - kms:Decrypt
-            - kms:GenerateDataKey*
-          Effect: Allow
-          Resource: !GetAtt EncryptionKey.Arn
-        - Action: lambda:InvokeFunction
-          Effect: Allow
-          Resource: !Sub arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:${self:functions.Worker.name}
-        - Action: secretsmanager:GetSecretValue
-          Effect: Allow
-          Resource: ${param:datadogApiKeySecretArn}-??????
-        - Action: sns:Publish
-          Effect: Allow
-          Resource: !Ref DestinationTopic
-  stackTags:
-    seek:env:label: ${env:ENVIRONMENT}
-    seek:source:sha: ${env:BUILDKITE_COMMIT, 'na'}
-    seek:source:url: 'https://github.com/SEEK-Jobs/<%- repoName %>'
-    seek:system:deployed-by: CFN
-    # seek:system:name: 'TODO: https://rfc.skinfra.xyz/RFC019-AWS-Tagging-Standard.html#required-tags'
-
-package:
-  patterns:
-    - '!**'
-    - lib/**
-    - node_modules/**
-
-functions:
-  Worker:
-    name: ${self:service}
-    handler: lib/app.handler
-    description: ${param:description}
-    memorySize: 128
-    reservedConcurrency: ${param:concurrency}
-    timeout: 30
-    deploymentSettings:
-      type: AllAtOnce
-      alias: Live
-      preTrafficHook: WorkerPreHook
-    environment:
-      ENVIRONMENT: ${env:ENVIRONMENT}
-      SERVICE: ${self:service}
-      VERSION: ${env:VERSION, 'local'}
-
-      DESTINATION_SNS_TOPIC_ARN: !Ref DestinationTopic
-    events:
-      - sqs:
-          arn: !GetAtt MessageQueue.Arn
-          batchSize: 1
-          maximumConcurrency: ${param:concurrency}
-  WorkerPreHook:
-    name: ${self:functions.Worker.name}-pre-hook
-    handler: lib/hooks.pre
-    memorySize: 128
-    # This is generous because a timeout will hang the deployment
-    timeout: 300
-    environment:
-      FUNCTION_NAME_TO_INVOKE: ${self:functions.Worker.name}
-
-resources:
-  # This becomes the Lambda application's description
-  Description: ${param:description}
-
-  Resources:
-    DeadLetterQueue:
-      Type: AWS::SQS::Queue
-      Properties:
-        MessageRetentionPeriod: 1209600
-        KmsDataKeyReusePeriodSeconds: 300
-        KmsMasterKeyId: !Ref EncryptionKey
-        QueueName: ${self:service}-dead-letters
-        Tags: ${param:dataStoreTags}
-
-    MessageQueue:
-      Type: AWS::SQS::Queue
-      Properties:
-        MessageRetentionPeriod: 1209600
-        KmsDataKeyReusePeriodSeconds: 300
-        KmsMasterKeyId: !Ref EncryptionKey
-        QueueName: ${self:service}-messages
-        RedrivePolicy:
-          deadLetterTargetArn: !GetAtt DeadLetterQueue.Arn
-          maxReceiveCount: 3
-        Tags: ${param:dataStoreTags}
-        VisibilityTimeout: 180
-
-    # MessageQueuePolicy:
-    #   Type: AWS::SQS::QueuePolicy
-    #   Properties:
-    #     PolicyDocument:
-    #       Version: '2012-10-17'
-    #       Statement:
-    #         - Action: sqs:SendMessage
-    #           Condition:
-    #             ArnEquals:
-    #               aws:SourceArn: 'TODO: sourceSnsTopicArn'
-    #           Effect: 'Allow'
-    #           Principal:
-    #             AWS: '*'
-    #           Resource: '*'
-    #     Queues:
-    #       - !Ref MessageQueue
-
-    # TopicSubscription:
-    #   Type: AWS::SNS::Subscription
-    #   Properties:
-    #     Endpoint: !GetAtt MessageQueue.Arn
-    #     Protocol: sqs
-    #     RawMessageDelivery: true # Remove this property if you require end to end datadog tracing
-    #     TopicArn: 'TODO: sourceSnsTopicArn'
-
-    DestinationTopic:
-      Type: AWS::SNS::Topic
-      Properties:
-        KmsMasterKeyId: alias/aws/sns
-        Tags: ${param:dataStoreTags}
-        TopicName: ${self:service}
-
-    EncryptionKey:
-      Type: AWS::KMS::Key
-      Properties:
-        Description: ${self:service}
-        EnableKeyRotation: true
-        KeyPolicy:
-          Version: '2012-10-17'
-          Statement:
-            - Sid: Admin access
-              Effect: Allow
-              Action: kms:*
-              Principal:
-                AWS: !Ref AWS::AccountId
-              Resource: '*'
-            - Sid: SNS compatibility
-              Effect: Allow
-              Action:
-                - kms:Decrypt
-                - kms:GenerateDataKey*
-              Principal:
-                Service: sns.amazonaws.com
-              Resource: '*'
-
-    EncryptionKeyAlias:
-      Type: AWS::KMS::Alias
-      Properties:
-        AliasName: alias/seek/${self:service}
-        TargetKeyId: !Ref EncryptionKey

package/template/lambda-sqs-worker/skuba.template.js

@@ -1,33 +0,0 @@
-/**
- * Run `skuba configure` to finish templating and remove this file.
- */
-
-module.exports = {
-  entryPoint: 'src/app.ts#handler',
-  fields: [
-    {
-      name: 'serviceName',
-      message: 'Service slug',
-      initial: 'my-project',
-    },
-    {
-      name: 'description',
-      message: 'Description',
-      initial: 'A project just for me',
-    },
-    {
-      name: 'devBuildkiteQueueName',
-      message: 'Dev Buildkite queue',
-      initial: 'my-team-aws-account-dev:cicd',
-      validate: (value) => /^.+:.+$/.test(value),
-    },
-    {
-      name: 'prodBuildkiteQueueName',
-      message: 'Prod Buildkite queue',
-      initial: 'my-team-aws-account-prod:cicd',
-      validate: (value) => /^.+:.+$/.test(value),
-    },
-  ],
-  packageManager: 'pnpm',
-  type: 'application',
-};