mirror of
https://github.com/Sea-Haven-Industries/shoc-frontend-new.git
synced 2026-09-30 04:33:11 +00:00
Adam Moussa
82361e14b5
retainForTerraformAdoption=true adds the required ManageSiteInfrastructure parameter, conditions the 13 transferred resources and the S3 auto-delete custom resource on it, applies Retain policies, pins the live dev origin ID, attaches the deploy boundary and HcpTerraformWorkspace tag, and narrows the OIDC subject to StringEquals. Normal synthesis is unchanged; template tests cover both modes.
58 lines
2.4 KiB
JavaScript
58 lines
2.4 KiB
JavaScript
#!/usr/bin/env node
|
|
import { App, Tags } from "aws-cdk-lib";
|
|
import { FrontendStack } from "../lib/frontend-stack";
|
|
|
|
const app = new App();
|
|
|
|
// Defaults match the dev setup; override via `-c key=value` on the CLI.
|
|
const envName = app.node.tryGetContext("envName") ?? "dev";
|
|
const githubRepo = app.node.tryGetContext("githubRepo") ?? "Sea-Haven-Industries/shoc-frontend-new";
|
|
const deployBranch = app.node.tryGetContext("deployBranch") ?? "dev";
|
|
// When set (e.g. "staging"), the deploy role trusts the exact GitHub
|
|
// environment OIDC subject instead of a deploy-branch ref. Empty = dev-style
|
|
// branch-ref trust.
|
|
const githubEnvironment = app.node.tryGetContext("githubEnvironment") ?? "";
|
|
|
|
// Custom domain. Comma-separated, e.g. -c domainNames=dev.seahaven.com
|
|
// The ACM cert MUST be in us-east-1 in the SAME account this stack deploys to.
|
|
const domainNames = (app.node.tryGetContext("domainNames") ?? "")
|
|
.split(",")
|
|
.map((d: string) => d.trim())
|
|
.filter((d: string) => d.length > 0);
|
|
const certificateArn = app.node.tryGetContext("certificateArn") ?? "";
|
|
|
|
// Route 53 hosted zone (this account) for the custom-domain alias record.
|
|
const hostedZoneId = app.node.tryGetContext("hostedZoneId") ?? "";
|
|
const hostedZoneName = app.node.tryGetContext("hostedZoneName") ?? "";
|
|
|
|
// Terraform adoption safety mode (see infra/cdk/README.md). Adds the required
|
|
// ManageSiteInfrastructure parameter and Retain policies on the transferred
|
|
// resources. Off by default so ordinary synthesis is unchanged.
|
|
const retainForTerraformAdoption =
|
|
String(app.node.tryGetContext("retainForTerraformAdoption") ?? "false").toLowerCase() === "true";
|
|
|
|
// Staging and beyond protect their stacks from accidental deletion; dev
|
|
// stays teardown-friendly (its artifacts are reproducible). CDK applies this
|
|
// at deploy time — it is not part of the synthesized template.
|
|
const terminationProtection = envName !== "dev";
|
|
|
|
const stack = new FrontendStack(app, `shoc-frontend-${envName}`, {
|
|
envName,
|
|
githubRepo,
|
|
deployBranch,
|
|
githubEnvironment,
|
|
terminationProtection,
|
|
domainNames,
|
|
certificateArn,
|
|
hostedZoneId,
|
|
hostedZoneName,
|
|
retainForTerraformAdoption,
|
|
env: {
|
|
account: process.env.CDK_DEFAULT_ACCOUNT,
|
|
region: process.env.CDK_DEFAULT_REGION ?? "us-east-1",
|
|
},
|
|
});
|
|
|
|
Tags.of(stack).add("Project", "shoc-frontend");
|
|
Tags.of(stack).add("Environment", envName);
|
|
Tags.of(stack).add("ManagedBy", "cdk");
|