mirror of
https://github.com/Sea-Haven-Industries/afterhours-shift-manager.git
synced 2026-09-30 05:33:12 +00:00
53c85f7eed
* Add changelog-driven releases and App Home tab Version the bot continuously from CHANGELOG.md (the single source of truth for both the version and the staff-readable notes) and surface changes to users in two ways: - A new afterhours-release-notifier Lambda posts a "What's New" message to the shift channel on minor/major releases (patches stay silent). - The bot gains an App Home "About" tab showing what it does, the command list, and the current version's notes. release.yaml runs on Deploy success (not release:published — GITHUB_TOKEN events don't start downstream workflows), checks out the deployed commit, and tags + publishes a GitHub Release + invokes the notifier. It assumes a dedicated, boundary-carrying OIDC role scoped to InvokeFunction on the notifier; the account's cfn role gates role creation on that boundary. The manual Version Bump workflow is retired. A CI guard enforces that a CHANGELOG edit is a clean SemVer bump and that the in-package copy matches. * Harden release workflow and regex against CodeQL findings Address three code-scanning alerts on the PR: - Critical (actions/untrusted-checkout): split release.yaml into a read-only `prepare` job that checks out and runs repo code, and a privileged `publish` job (contents:write + OIDC) that never checks out repo code — it tags, releases, and invokes purely through the GitHub and AWS APIs. Also assert head_branch == main. - High x2 (py/polynomial-redos): rewrite the italic and link regexes in markdown_to_mrkdwn with possessive quantifiers and exclusive character classes so they run in linear time on adversarial input. Adds a regression test. * Move release/announce into Deploy workflow to clear CodeQL The workflow_run-triggered release.yaml kept tripping CodeQL's privileged-context rules (untrusted-checkout, then cache-poisoning) — CodeQL distrusts any workflow_run that checks out a ref, regardless of the main-only guarantee, and there is no autofix. Fold the release job into deploy.yaml gated on `needs: deploy`. A push-to-main run is a trusted context, so checking out and running repo code with write/OIDC is safe there. This still gates on deploy success and serializes via the deploy concurrency group, and removes the separate workflow entirely.
24 lines
687 B
Python
24 lines
687 B
Python
#!/usr/bin/env python3
|
|
"""Copy the canonical root CHANGELOG.md into the slack-bot package.
|
|
|
|
The bot's App Home "What's New" tab reads CHANGELOG.md from its own deployment
|
|
package ($LAMBDA_TASK_ROOT), so a copy must live under src/slack-bot/ (the
|
|
function's CodeUri). The root file is the single source of truth; run this after
|
|
editing it. CI's check_changelog.py fails if the two drift.
|
|
"""
|
|
|
|
import pathlib
|
|
import shutil
|
|
|
|
ROOT = pathlib.Path(__file__).resolve().parents[1]
|
|
|
|
|
|
def main() -> None:
|
|
src = ROOT / "CHANGELOG.md"
|
|
dst = ROOT / "src" / "slack-bot" / "CHANGELOG.md"
|
|
shutil.copyfile(src, dst)
|
|
print(f"Synced {src} -> {dst}")
|
|
|
|
|
|
if __name__ == "__main__":
|
|
main()
|