open-swe/infra/.gitignore at fcbdfb67aaef5cf4e6cb39a094c399c073182d37 - adam/open-swe - Sea Haven Git

adam/open-swe

mirror of https://github.com/Sea-Haven-Industries/open-swe.git synced 2026-10-02 03:53:18 +00:00

Adam Moussa 92fd886076

feat(infra): add /infra CDK scaffold + per-env OIDC/instance IAM role defs (#6 )

PR#1 of the AWS migration. CDK TypeScript app under /infra: stacks open-swe-iam
(four per-env GitHub-OIDC deploy roles) + open-swe-dev/-prod (per-env EC2 instance
role + AMI cache). aws-cdk-lib pinned exact 2.260.0; kebab naming Aspect + 15 tests.

IAM is synth-only (NOT deployed). Cleared the Phase-1 security gates:
- T4 GPT-4.1 IAM cross-review (StringEquals trust; cdk-hnb659fds-* wildcard kept as
  org convention; AWS-RunShellScript timeboxed to T19).
- T5 /sh-security-review: deploy roles split PER-ENV with env-scoped OIDC trust
  (dev=branch ref+tag dev, prod=environment:prod+tag prod) so a dev token cannot
  reach prod; re-verified block:false.

2026-06-26 15:06:30 -04:00

19 lines

342 B

Text

Raw Blame History

 # CDK / build output
 cdk.out/
 *.js
 *.d.ts
 *.js.map
 # deps
 node_modules/
 # env
 .env
 # coverage
 coverage/
 # NOTE: cdk.context.json IS committed on purpose (pins the AMI / lookups so
 # deploys are reproducible and don't implicitly pick up a newer AMI — see
 # lib/constructs/ami-cache.ts and feedback_inline_ebs_volumes).
 !cdk.context.json