Adam Moussa
0f6b72e68a
fix(terraform): add CI platform hashes to the AWS provider lockfile
2026-09-19 20:07:50 +00:00
Adam Moussa
4fb4159df2
fix(iam): scope staging githubdeploy uploads to the staging release prefix ( #158 )
Architecture and changed-file quality / architecture (push) Waiting to run
Terraform CI / terraform (push) Waiting to run
Backend CI / Build and test (push) Waiting to run
2026-09-18 17:10:13 -04:00
Adam Moussa
9eb51b528f
chore(terraform): complete staging environment adoption ( #156 )
...
Architecture and changed-file quality / architecture (push) Waiting to run
Terraform CI / terraform (push) Waiting to run
Backend CI / Build and test (push) Waiting to run
* chore(terraform): complete staging environment adoption
* test(terraform): include deploy SSM parameters in the import ownership boundary
2026-09-18 15:13:18 -04:00
Adam Moussa
facc6ef71e
fix(iam): let staging githubdeploy GetObject the release zip ( #154 )
...
Architecture and changed-file quality / architecture (push) Waiting to run
Terraform CI / terraform (push) Waiting to run
Backend CI / Build and test (push) Waiting to run
* fix(iam): let staging githubdeploy GetObject the release zip
* fix(iam): allow staging githubdeploy to cache EB processed extensions
* fix(iam): allow staging githubdeploy GetObjectAcl for EB updates
* fix(iam): grant staging githubdeploy named S3 reads on EB resources prefix
* fix(iam): allow staging githubdeploy to delete EB version cache objects
* fix(iam): scope staging githubdeploy S3 object access to the EB bucket
* fix(iam): allow staging githubdeploy PutObjectVersionAcl on EB artifacts
* fix(iam): allow staging githubdeploy GetBucketPolicy on the EB bucket
* fix(iam): scope staging githubdeploy S3 objects to SHOC and staging EB prefixes
2026-09-18 15:29:15 -03:00
f42576e2db
chore(cd): retire leftover Terraform app CD path
2026-09-18 12:38:15 -04:00
396b1c690b
fix(cd): honor reusable workflow inputs when resolving deploy target
2026-09-18 11:33:34 -04:00
7eaa7fb3f9
docs(cd): document GitHub Environment branch and tag policies
2026-09-18 11:22:50 -04:00
8f4fa36647
refactor(cd): ship Elastic Beanstalk versions from GitHub on main
...
Keep application and Terraform changes in separate PRs so a merge cannot race an HCP apply against an app deploy.
2026-09-17 15:54:31 -04:00
Alexandre Brandizzi
65c1ed86e1
docs(terraform): document staging token scope
2026-09-16 16:07:16 -03:00
Alexandre Brandizzi
4ae6d02d55
feat(deploy): rebuild protected staging lane
2026-09-16 15:52:02 -03:00
Adam Moussa
1bdbc12292
fix(deploy): treat applied HCP runs as success ( #108 )
...
Validate and deploy / Validate deployable source bundle (push) Waiting to run
Validate and deploy / Deploy shoc-backend-dev through Terraform (push) Blocked by required conditions
Validate and deploy / Deploy shoc-backend-staging to Elastic Beanstalk (push) Blocked by required conditions
* fix(deploy): treat applied HCP runs as success
* fix(deploy): wait on rollback apply result
* fix(deploy): compare G3 formatting against the PR merge base
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(deploy): fence rollback create-run on unlock success
---------
Co-authored-by: Cursor <cursoragent@cursor.com>
2026-09-08 13:26:11 -04:00
Alexandre Brandizzi
6ceb274bfb
feat: add API Sentry tracing (SH-298) ( #105 )
...
Validate and deploy / Validate deployable source bundle (push) Has been cancelled
Validate and deploy / Deploy shoc-backend-dev through Terraform (push) Has been cancelled
Validate and deploy / Deploy shoc-backend-staging to Elastic Beanstalk (push) Has been cancelled
* feat: add API Sentry tracing
* feat: activate Sentry deployment environments
* fix: allow Sentry-free design-time tooling
* fix: trace background jobs in Sentry
* feat(observability): identify and scrub Sentry transactions
* fix(observability): finish abandoned transactions
2026-09-04 14:11:32 -03:00
Adam Moussa
69ba573315
chore(terraform): remove tf-poc rehearsal (SH-300) ( #95 )
...
Validate and deploy / Validate deployable source bundle (push) Waiting to run
Validate and deploy / Deploy shoc-backend-dev through Terraform (push) Blocked by required conditions
Validate and deploy / Deploy shoc-backend-staging to Elastic Beanstalk (push) Blocked by required conditions
* chore(terraform): remove tf-poc rehearsal
* chore(terraform): drop tf-poc from live module and CI
* chore: clean remaining tf-poc reference from `shared_certificate_arn`
2026-09-03 10:40:32 -04:00
Adam Moussa
77c3016c9d
feat(deploy): move dev application CD through Terraform ( #102 )
...
Validate and deploy / Validate deployable source bundle (push) Waiting to run
Validate and deploy / Deploy shoc-backend-dev through Terraform (push) Blocked by required conditions
Validate and deploy / Deploy shoc-backend-staging to Elastic Beanstalk (push) Blocked by required conditions
* feat(deploy): move dev application CD through Terraform
GitHub creates the immutable Elastic Beanstalk version; HCP Terraform is the only UpdateEnvironment caller via a guarded version_label run.
* fix: add permissions block for dependency-review workflow
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
* fix(terraform): stop pinning the generated dev instance SG
---------
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
2026-09-03 14:12:06 +00:00
Adam Moussa
6ef8e9ba2a
feat(terraform): complete dev environment adoption (SH-300) ( #99 )
...
* feat(terraform): complete dev environment adoption
* fix(terraform): preserve dev release permissions
2026-08-31 20:18:44 -03:00
Adam Moussa
e1e547f7d0
fix(terraform): preserve live state during dev import ( #98 )
2026-08-31 15:05:46 -03:00
Adam Moussa
24f08d3cb1
feat(terraform): adopt live deployment roles safely ( #94 )
...
* feat(terraform): add safe backend environment adoption
Introduce import-guarded environment roots and retire temporary bootstrap and POC provisioning after ownership transfer.
* ci(deploy): pause dev and staging deployments
Prevent application releases from racing Terraform adoption while retaining production deployment and validation.
* ci(deploy): require manual environment dispatch
* fix: update `required_version` from `>=1.7.0` to `>=1.9.0`
The deploy-boundary check interpolates `var.aws_account_id` and `var.environment`. Terraform only allows other variables inside `validation` from 1.9.0+.
CI already runs against `1.9.8` so `versions.tf` setting version as `>=1.7.0` is a breaking finding
* chore(deps): add `terraform` to renovate dependency coverage
* ci(deploy): drop unprovisioned prod dispatch path
2026-08-31 11:51:18 -04:00
