adam/exec-aide
Archived
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add GitHub Actions deploy workflow #28

Merged
amoussa1229 merged 3 commits from feature/add-deploy-workflow into main 2026-05-08 21:08:17 +00:00
Conversation 4 Commits 3 Files changed 1 +20
1 changed files with 20 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

20
.github/workflows/deploy.yaml vendored Normal file
View file

@ -0,0 +1,20 @@
name: Deploy
on:
push:
branches: [main]
permissions:
id-token: write
contents: read
concurrency:
group: deploy
cancel-in-progress: false
jobs:
deploy:
uses: Sea-Haven-Industries/.github/.github/workflows/cd-cdk.yaml@main
with:
enable-qemu: true
secrets:
deploy-role-arn: ${{ secrets.AWS_DEPLOY_ROLE_ARN }}
cursor[bot] commented 2026-05-08 20:53:52 +00:00 (Migrated from github.com)
Review
Copy link

Missing id-token: write permission breaks OIDC deploy

High Severity

This workflow uses OIDC-based AWS authentication via a reusable workflow (cd-cdk.yaml), but the caller workflow does not declare permissions: id-token: write. GitHub Actions requires the calling workflow to explicitly grant this permission — the reusable workflow's own permissions are constrained to the intersection with the caller's. Without it, the OIDC token request will fail and the deploy job will error out when attempting to assume the deploy-role-arn.

Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit 1a17640003. Configure here.

### Missing `id-token: write` permission breaks OIDC deploy **High Severity** <!-- DESCRIPTION START --> This workflow uses OIDC-based AWS authentication via a reusable workflow (`cd-cdk.yaml`), but the caller workflow does not declare `permissions: id-token: write`. GitHub Actions requires the **calling** workflow to explicitly grant this permission — the reusable workflow's own permissions are constrained to the intersection with the caller's. Without it, the OIDC token request will fail and the deploy job will error out when attempting to assume the `deploy-role-arn`. <!-- DESCRIPTION END --> <!-- BUGBOT_BUG_ID: e753fd60-54de-47bb-b35a-aac232f2052d --> <!-- LOCATIONS START .github/workflows/deploy.yaml#L1-L12 LOCATIONS END --> <div><a href="https://cursor.com/open?data=eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6ImJ1Z2JvdC12MiJ9.eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiQlVHQk9UX0ZJWF9JTl9DVVJTT1IiLCJkYXRhIjp7InJlZGlzS2V5IjoiYnVnYm90OjA0OTUxNGQzLTllOWQtNDI4Ny1iMWY1LTAzZjk0ZGE3YWZjNiIsImVuY3J5cHRpb25LZXkiOiJiUWNrV2JnR0NRR0ZBTEdhZGliSmY4V21IcnpBbTNYZ2dLM0RMUlRlQjRNIiwiYnJhbmNoIjoiZmVhdHVyZS9hZGQtZGVwbG95LXdvcmtmbG93IiwicmVwb093bmVyIjoiU2VhLUhhdmVuLUluZHVzdHJpZXMiLCJyZXBvTmFtZSI6ImV4ZWMtYWlkZSJ9LCJpYXQiOjE3NzgyNzM2MzEsImV4cCI6MTc4MDg2NTYzMX0.w6HBC9G3-WeoWRcU3mzhOxwwBGEkHHlMN3zWK74FOmxol50jU-ncD_rkD8R8Rhtti8GRSYyyQyZ51FURlUneIiSa8eSlRGhdxNqAc4CHCx70bGbImdAu8VS0bfJSKojkBexv_htx1rB7vNAzUZxJPXmF2BHxAfvu6lS8NfImdhqhQGgVuQtPKxxz9Oy6Gs2FBOdMhZ6rmONPuX3jC6LRhRfYI3rdcEOs1vwVMyV7vjC52Umcj7v3gi6p1XVkw6xPdxfKxFkOUCRO9R2MuvXIuR1rgTUqZGiRXPP9HLa_AKs8DizAuW_5kMPmPRBeZFeZKb4R9NxCRV7X6sd8p7_nIw" target="_blank" rel="noopener noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/fix-in-cursor-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/fix-in-cursor-light.png"><img alt="Fix in Cursor" width="115" height="28" src="https://cursor.com/assets/images/fix-in-cursor-dark.png"></picture></a>&nbsp;<a href="https://cursor.com/agents?data=eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6ImJ1Z2JvdC12MiJ9.eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiQlVHQk9UX0ZJWF9JTl9XRUIiLCJkYXRhIjp7InJlZGlzS2V5IjoiYnVnYm90OjA0OTUxNGQzLTllOWQtNDI4Ny1iMWY1LTAzZjk0ZGE3YWZjNiIsImVuY3J5cHRpb25LZXkiOiJiUWNrV2JnR0NRR0ZBTEdhZGliSmY4V21IcnpBbTNYZ2dLM0RMUlRlQjRNIiwiYnJhbmNoIjoiZmVhdHVyZS9hZGQtZGVwbG95LXdvcmtmbG93IiwicmVwb093bmVyIjoiU2VhLUhhdmVuLUluZHVzdHJpZXMiLCJyZXBvTmFtZSI6ImV4ZWMtYWlkZSIsInByTnVtYmVyIjoyOCwiY29tbWl0U2hhIjoiMWExNzY0MDAwMzc4NGM5NDhhOGY4YTJmZTMwNjQzYTUwMDg1NzdhNyIsInByb3ZpZGVyIjoiZ2l0aHViIn0sImlhdCI6MTc3ODI3MzYzMSwiZXhwIjoxNzgwODY1NjMxfQ.goRvvJtrUDp6wO9fK8fEkNzD4RXP6qxh7YKcnM2VT7tdkjWSH0OSIA9Co4hrG2HW0eFFdgks1WGjyc7QYTai10Q2P3UNUAArBaIakLdjU4iWf5AIqWuIrs7402nP7PDHyuy-ka3iDdHawYC36fjW9xP3v71Trd2lIPjDrcRZCVD2Ud3VmqTofLHy0ot1ypmHCQb0lmac_g46LvF2EDwQ0w95VNbuEN3MjgUr2aRmHUTxDhxhaG5FQtWY9Ym9o07Zu_lZLiLQ3V0_1UL70n_HkImY2F9xRQ4ZkQq5zibFgsPSRbzXulIp5_q1nzeyaBdWk_adsODo3JFEmkvyr4a5AQ" target="_blank" rel="noopener noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/fix-in-web-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/fix-in-web-light.png"><img alt="Fix in Web" width="99" height="28" src="https://cursor.com/assets/images/fix-in-web-dark.png"></picture></a></div> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 1a17640003784c948a8f8a2fe30643a5008577a7. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup>
cursor[bot] commented 2026-05-08 20:59:28 +00:00 (Migrated from github.com)
Review
Copy link

Missing concurrency control risks parallel deploy failures

Medium Severity

This deploy workflow lacks a concurrency group. The CodePipeline it replaces (in pipeline.yaml) natively serializes executions, but GitHub Actions does not — rapid successive merges to main trigger parallel runs. CloudFormation rejects concurrent stack updates, so the second cdk deploy would fail, leaving the latest changes undeployed with no automatic retry.

Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit f65c5fe3eb. Configure here.

### Missing concurrency control risks parallel deploy failures **Medium Severity** <!-- DESCRIPTION START --> This deploy workflow lacks a `concurrency` group. The CodePipeline it replaces (in `pipeline.yaml`) natively serializes executions, but GitHub Actions does not — rapid successive merges to `main` trigger parallel runs. CloudFormation rejects concurrent stack updates, so the second `cdk deploy` would fail, leaving the latest changes undeployed with no automatic retry. <!-- DESCRIPTION END --> <!-- BUGBOT_BUG_ID: ref1_ee430734-7e84-4da7-be37-35a2aba2ee21 --> <!-- LOCATIONS START .github/workflows/deploy.yaml#L1-L16 LOCATIONS END --> <div><a href="https://cursor.com/open?data=eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6ImJ1Z2JvdC12MiJ9.eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiQlVHQk9UX0ZJWF9JTl9DVVJTT1IiLCJkYXRhIjp7InJlZGlzS2V5IjoiYnVnYm90OmM0YzM4ODM5LTJmODQtNDBlMC1iMzY1LTM4NTIyZWJjZDc5NiIsImVuY3J5cHRpb25LZXkiOiI0bjlZQUhmMFZPdUR5bW5LbHA2eFc5N2pNN3RvTmFPakVNbU02NURPSkVJIiwiYnJhbmNoIjoiZmVhdHVyZS9hZGQtZGVwbG95LXdvcmtmbG93IiwicmVwb093bmVyIjoiU2VhLUhhdmVuLUluZHVzdHJpZXMiLCJyZXBvTmFtZSI6ImV4ZWMtYWlkZSJ9LCJpYXQiOjE3NzgyNzM5NjcsImV4cCI6MTc4MDg2NTk2N30.oSWN5zyV6VgbT_jS9EAIkfX2RugVSof5jLzv1fL9UuCz1dso2-HT21DQzAZFEEuTh4IHSJIYXi5pDGPeKElRvHcKyTZzdLuRZnlLLliwCCTdIFWIcp6ijP1gJijYWsEpqzVwR18pe7j52dWnJWplltYsvu2KsZ2bWNqUSqvjQikaVIx0C1LQe4pkCvJw1bl_YElHNqKAxwQA3KWycyTmS-o0N7T6tRIQ82WvlGnHQdCik4mnlh3_jCCopl_GvHsYwxwCTnxel1imp3dAvf94e_iBXO6cXF1ODy34wQw_Xosu-zoH4QzoPmVpYnWucRV0lkUCv8eJOyjFLbnibBJ-Xw" target="_blank" rel="noopener noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/fix-in-cursor-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/fix-in-cursor-light.png"><img alt="Fix in Cursor" width="115" height="28" src="https://cursor.com/assets/images/fix-in-cursor-dark.png"></picture></a>&nbsp;<a href="https://cursor.com/agents?data=eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6ImJ1Z2JvdC12MiJ9.eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiQlVHQk9UX0ZJWF9JTl9XRUIiLCJkYXRhIjp7InJlZGlzS2V5IjoiYnVnYm90OmM0YzM4ODM5LTJmODQtNDBlMC1iMzY1LTM4NTIyZWJjZDc5NiIsImVuY3J5cHRpb25LZXkiOiI0bjlZQUhmMFZPdUR5bW5LbHA2eFc5N2pNN3RvTmFPakVNbU02NURPSkVJIiwiYnJhbmNoIjoiZmVhdHVyZS9hZGQtZGVwbG95LXdvcmtmbG93IiwicmVwb093bmVyIjoiU2VhLUhhdmVuLUluZHVzdHJpZXMiLCJyZXBvTmFtZSI6ImV4ZWMtYWlkZSIsInByTnVtYmVyIjoyOCwiY29tbWl0U2hhIjoiZjY1YzVmZTNlYjhlMjJjN2VkODE1NWQwZTk5NTFkNDhiZTJjZDdkMyIsInByb3ZpZGVyIjoiZ2l0aHViIn0sImlhdCI6MTc3ODI3Mzk2NywiZXhwIjoxNzgwODY1OTY3fQ.yIPiMedF-HnW6iBKDTvL03bDx8DQG4XWDoK1x1Emu9iy2djvye30nrM1xBbmGIlqBvJrDtNlCdjWm1H6YaOANKgty3ZDOMULpRZpfd_rR2NpRCV5_GVr0PjUIaM2C9xHRUwC4HnBOM4-aqzfnsWzVWwIsvyE-bJ-__YC8-0_KyIZGgF7VVxe8AxH2R2wBXOseze5dg0pzAN3AlT1fWTGRGphljrg69yb-Fm0aUeQGof_kHnqLv3prjsl3LLfcd1pl9sCuSD5vw1uYnPTpze9JpjnpQD6RSGoVro7RFGyiARZxBym7dFgnvhhKr_9Y6oDq46Lko4BwiR4SVBshCwdIg" target="_blank" rel="noopener noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/fix-in-web-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/fix-in-web-light.png"><img alt="Fix in Web" width="99" height="28" src="https://cursor.com/assets/images/fix-in-web-dark.png"></picture></a></div> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit f65c5fe3eb8e22c7ed8155d0e9951d48be2cd7d3. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup>