From 126f4d3a4d309ed0a0179d438b2c72ef46cdc31e Mon Sep 17 00:00:00 2001 From: Justin Gasper Date: Tue, 3 Nov 2026 10:09:15 +1100 Subject: [PATCH 1/8] chore: adopt core v4.0.0-rc.2 identity denylists --- package.json | 2 +- pnpm-lock.yaml | 12 ++++++------ 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/package.json b/package.json index 2cc37a0..daf0f08 100644 --- a/package.json +++ b/package.json @@ -36,7 +36,7 @@ "pg": "^8.16.3", "reflect-metadata": "^0.1.13", "rxjs": "^7.8.2", - "tc-core-library-js": "github:topcoder-platform/tc-core-library-js#v4.0.0-rc.1" + "tc-core-library-js": "github:topcoder-platform/tc-core-library-js#v4.0.0-rc.2" }, "devDependencies": { "@eslint/eslintrc": "^3.2.0", diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 169ec6c..29b3ca1 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -96,8 +96,8 @@ importers: specifier: ^7.8.2 version: 7.8.2 tc-core-library-js: - specifier: github:topcoder-platform/tc-core-library-js#v4.0.0-rc.1 - version: https://codeload.github.com/topcoder-platform/tc-core-library-js/tar.gz/6c326fea0abfccb5ae29dff2ac5bce01aabc1fa4(supports-color@8.1.1) + specifier: github:topcoder-platform/tc-core-library-js#v4.0.0-rc.2 + version: https://codeload.github.com/topcoder-platform/tc-core-library-js/tar.gz/58de37670180e183e8378c3d203df0112a0414f6(supports-color@8.1.1) devDependencies: '@eslint/eslintrc': specifier: ^3.2.0 @@ -3161,9 +3161,9 @@ packages: resolution: {integrity: sha512-Re10+NauLTMCudc7T5WLFLAwDhQ0JWdrMK+9B2M8zR5hRExKmsRDCBA7/aV/pNJFltmBFO5BAMlQFi/vq3nKOg==} engines: {node: '>=6'} - tc-core-library-js@https://codeload.github.com/topcoder-platform/tc-core-library-js/tar.gz/6c326fea0abfccb5ae29dff2ac5bce01aabc1fa4: - resolution: {gitHosted: true, tarball: https://codeload.github.com/topcoder-platform/tc-core-library-js/tar.gz/6c326fea0abfccb5ae29dff2ac5bce01aabc1fa4} - version: 4.0.0-rc.1 + tc-core-library-js@https://codeload.github.com/topcoder-platform/tc-core-library-js/tar.gz/58de37670180e183e8378c3d203df0112a0414f6: + resolution: {gitHosted: true, tarball: https://codeload.github.com/topcoder-platform/tc-core-library-js/tar.gz/58de37670180e183e8378c3d203df0112a0414f6} + version: 4.0.0-rc.2 engines: {node: '>=22.13'} terser-webpack-plugin@5.3.14: @@ -6928,7 +6928,7 @@ snapshots: tapable@2.2.2: {} - tc-core-library-js@https://codeload.github.com/topcoder-platform/tc-core-library-js/tar.gz/6c326fea0abfccb5ae29dff2ac5bce01aabc1fa4(supports-color@8.1.1): + tc-core-library-js@https://codeload.github.com/topcoder-platform/tc-core-library-js/tar.gz/58de37670180e183e8378c3d203df0112a0414f6(supports-color@8.1.1): dependencies: '@types/jsonwebtoken': 9.0.10 jsonwebtoken: 9.0.3 From 7da34e55e2973bb280bdd8b121cba65c9bb6ada0 Mon Sep 17 00:00:00 2001 From: Justin Gasper Date: Tue, 3 Nov 2026 22:01:13 +1100 Subject: [PATCH 2/8] Migrate ECS deployment to scoped OIDC without parameter access --- .circleci/config.yml | 157 ++++++++++++++++++++--------------- deploy/MIGRATION.md | 23 +++++ deploy/prod-healthcheck.json | 14 ++++ deploy/prod.json | 19 +++++ deploy/release.py | 13 +++ 5 files changed, 158 insertions(+), 68 deletions(-) create mode 100644 deploy/MIGRATION.md create mode 100644 deploy/prod-healthcheck.json create mode 100644 deploy/prod.json create mode 100644 deploy/release.py diff --git a/.circleci/config.yml b/.circleci/config.yml index 0adcae0..cc296a3 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -1,78 +1,99 @@ +# Deployment migration: see deploy/MIGRATION.md before enabling either environment. version: 2.1 - -defaults: &defaults - docker: - - image: cimg/python:3.13.2-browsers -install_dependency: &install_dependency - name: Installation of build and deployment dependencies. - command: | - sudo apt update - sudo apt install -y jq python3-pip - sudo pip3 install awscli --upgrade -install_deploysuite: &install_deploysuite - name: Installation of install_deploysuite. - command: | - git clone --branch v1.4.19 https://github.com/topcoder-platform/tc-deploy-scripts ../buildscript - cp ./../buildscript/master_deploy.sh . - cp ./../buildscript/buildenv.sh . - cp ./../buildscript/awsconfiguration.sh . - cp ./../buildscript/psvar-processor.sh . - -builddeploy_steps: &builddeploy_steps - - checkout - - setup_remote_docker - - run: *install_dependency - - run: *install_deploysuite - - run: docker buildx build --no-cache=true -t ${APPNAME}:latest . - - run: - name: Running MasterScript. - command: | - ./awsconfiguration.sh $DEPLOY_ENV - source awsenvconf - ./psvar-processor.sh -t appenv -p /config/${APPNAME}/deployvar - source deployvar_env - ./master_deploy.sh -d ECS -e $DEPLOY_ENV -t latest -j /config/${APPNAME}/appvar,/config/common/global-appvar -i ${APPNAME} -p FARGATE - +executors: + reviewed: + docker: + - image: cimg/aws@sha256:4cf3768db00ddf9bc439b8c84e8a60c11a14edf81c8baf76f74132144f8340d5 +commands: + checkout-suite: + steps: + - run: + name: Verify the reviewed deployment suite + command: | + set -euo pipefail + git init --quiet /tmp/tc-deploy-scripts + git -C /tmp/tc-deploy-scripts remote add origin https://github.com/topcoder-platform/tc-deploy-scripts.git + git -C /tmp/tc-deploy-scripts fetch --quiet --depth 1 origin 2a76ef3153bf966f29b66a007397e21affc5e169 + git -C /tmp/tc-deploy-scripts checkout --quiet --detach FETCH_HEAD + test "$(git -C /tmp/tc-deploy-scripts rev-parse HEAD)" = 2a76ef3153bf966f29b66a007397e21affc5e169 jobs: - # Build & Deploy against development backend - "build-dev": - !!merge <<: *defaults - environment: - DEPLOY_ENV: "DEV" - LOGICAL_ENV: "dev" - APPNAME: "reports-api-v6" - DEPLOYMENT_ENVIRONMENT: 'dev' - steps: *builddeploy_steps - - "build-prod": - !!merge <<: *defaults + build: + executor: reviewed + steps: + - checkout + - setup_remote_docker + - checkout-suite + - run: + name: Build committed source without AWS or broker credentials + command: | + set -euo pipefail + python3 -I /tmp/tc-deploy-scripts/build_image.py --dockerfile Dockerfile --image reports-api-v6:candidate + mkdir -p /tmp/release + docker save --output /tmp/release/image.tar reports-api-v6:candidate + no_output_timeout: 30m + - persist_to_workspace: + root: /tmp/release + paths: + - image.tar + deploy: + executor: reviewed + parameters: + environment: + type: enum + enum: + - dev + - prod environment: - DEPLOY_ENV: "PROD" - LOGICAL_ENV: "prod" - APPNAME: "reports-api-v6" - DEPLOYMENT_ENVIRONMENT: 'prod' - steps: *builddeploy_steps - + DEPLOY_ENV: << parameters.environment >> + steps: + - checkout + - setup_remote_docker + - checkout-suite + - attach_workspace: + at: /tmp/release + - run: + name: Promote a scanned digest with repository-bound OIDC + command: | + set +x + set -euo pipefail + test -f "deploy/${DEPLOY_ENV}.json" + docker load --input /tmp/release/image.tar + python3 -I deploy/release.py "deploy/${DEPLOY_ENV}.json" + no_output_timeout: 45m workflows: - version: 2 - build: + release: jobs: - # Development builds are executed on "develop" branch only. - - "build-dev": - context: org-global + - build + - deploy: + name: deploy-dev + environment: dev + requires: + - build + context: reports-api-v6-dev-deploy + serial-group: << pipeline.project.slug >>/deploy-dev filters: branches: - only: - - develop - - PM-4931 + only: develop tags: - only: /^dev-.*/ - - # Production builds are exectuted only on tagged commits to the - # master branch. - - "build-prod": - context: org-global + ignore: /.*/ + - approve-prod: + type: approval + requires: + - build filters: branches: - only: - - master + only: master + tags: + ignore: /.*/ + - deploy: + name: deploy-prod + environment: prod + requires: + - approve-prod + context: reports-api-v6-prod-deploy + serial-group: << pipeline.project.slug >>/deploy-prod + filters: + branches: + only: master + tags: + ignore: /.*/ diff --git a/deploy/MIGRATION.md b/deploy/MIGRATION.md new file mode 100644 index 0000000..4779436 --- /dev/null +++ b/deploy/MIGRATION.md @@ -0,0 +1,23 @@ +# OIDC deployment migration + +This change replaces the Auth0 credential broker and SSM-to-shell deployment path with the reviewed [shared suite PR #40](https://github.com/topcoder-platform/tc-deploy-scripts/pull/40), pinned to `2a76ef3153bf966f29b66a007397e21affc5e169`. Build and deployment run in separate jobs. The deployer cannot read Parameter Store, Secrets Manager or decrypt KMS data, including through another assumed role. ECS continues resolving the existing runtime secret references using the execution role. + +## Production target + +The read-only inventory on 2026-11-03 verified account `409275337247`, cluster `tc-reporting-serverless`, service `reports-api-v6`, family `reports-api-v6`, and container `reports-api-v6`. `prod.json` preserves the observed task/execution roles and names the proposed service-specific deployment role. `prod-baseline.json` records references only; it contains no parameter values. Do not recreate the service or replace its complete task definition from this baseline. + +## Infrastructure prerequisites, applied separately by an administrator + +1. In each account, register the CircleCI OIDC issuer `https://oidc.circleci.com/org/947bef5e-1669-415d-b83c-4fc85155b7df` with client ID `947bef5e-1669-415d-b83c-4fc85155b7df`. The current production account has only the legacy Auth0 provider. Do not remove that provider until all its consumers have migrated. +2. Review and install `iam/prod-role.cloudformation.json` with an administrator/IaC identity. It creates the proposed deployment role and applies the same least-privilege policy as a permissions boundary. The trust binds this CircleCI project, repository, checkout branch and configuration branch. It does not grant infrastructure creation to CircleCI. +3. Configure ECR repository `reports-api-v6` with unconditional `IMMUTABLE` tags and supported scan-on-push. Existing tags are not retagged. The release fails for MEDIUM/HIGH/CRITICAL/UNDEFINED findings, failed scans, or a mismatched digest. +4. In the infrastructure that owns the task definition, add the reviewed container check from `prod-healthcheck.json`, keeping all roles, runtime secret references, resources, mounts and sidecars. Verify the health endpoint against the running container in dev first. Preserve circuit-breaker rollback and positive desired capacity. Remove any `RESET_DB` secret binding and plaintext secret environment entries before adoption. Keep the execution role's runtime read permissions scoped to the references that service needs. +5. Create restricted `reports-api-v6-dev-deploy` and `reports-api-v6-prod-deploy` CircleCI contexts without Auth0/static AWS credentials. Restrict production to the reviewed `master` checkout and configuration ref, authorized operators, and approval job. Remove legacy credentials from project settings too: removing `org-global` alone does not remove project-level variables. Confirm `CIRCLE_OIDC_TOKEN_V3` is issued. Disable secret access for forks and SSH debugging in deployment jobs. + +## Development acceptance before merge/release + +The saved dev AWS session had expired during preparation. No dev cluster, role or family has been guessed. **This PR is a draft until an administrator verifies and commits `deploy/dev.json` for account `811668436784` and branch `develop`, with corresponding narrow IAM policy/trust.** Use the same schema as `prod.json`, but inspect the actual dev resources and roles; do not replace just the account number. The dev job fails closed while its manifest is absent. Branches other than `develop` and `master` build only and receive no deployment context. + +Run the shared offline suite, validate the CircleCI config and IAM policies, and test a dev release plus an unhealthy-image rollback. Verify CloudTrail contains no SSM/Secrets Manager calls from the deployment principal. Remove its old broker grants only after migration. Check the runtime secret references and roles stayed unchanged. Production requires the manual approval job and a passing digest/scan/health verification. + +The pinned executor is `cimg/aws@sha256:4cf3768db00ddf9bc439b8c84e8a60c11a14edf81c8baf76f74132144f8340d5`. Python/AWS CLI/Buildx/Git compatibility was tested with the shared offline suite. No package installation or service build runs in the deployment job. The Dockerfile retains the existing in-image quality gates. This PR does not deploy, change IAM, rotate credentials, or claim a successful live rollout. diff --git a/deploy/prod-healthcheck.json b/deploy/prod-healthcheck.json new file mode 100644 index 0000000..770ede4 --- /dev/null +++ b/deploy/prod-healthcheck.json @@ -0,0 +1,14 @@ +{ + "reports-api-v6": { + "command": [ + "CMD", + "node", + "-e", + "const r=require('node:http').get('http://127.0.0.1:3000/v6/reports/health',r=>{r.resume();process.exit(r.statusCode>=200&&r.statusCode<300?0:1)});r.setTimeout(4000,()=>{r.destroy();process.exit(1)});r.on('error',()=>process.exit(1))" + ], + "interval": 30, + "timeout": 5, + "retries": 3, + "startPeriod": 120 + } +} diff --git a/deploy/prod.json b/deploy/prod.json new file mode 100644 index 0000000..b7759ee --- /dev/null +++ b/deploy/prod.json @@ -0,0 +1,19 @@ +{ + "schemaVersion": 2, + "environment": "prod", + "accountId": "409275337247", + "region": "us-east-1", + "deployRoleArn": "arn:aws:iam::409275337247:role/reports-api-v6-prod-deploy", + "taskRoleArn": null, + "executionRoleArn": "arn:aws:iam::409275337247:role/ecsTaskExecutionRole", + "cluster": "tc-reporting-serverless", + "service": "reports-api-v6", + "taskFamily": "reports-api-v6", + "circleciOrgId": "947bef5e-1669-415d-b83c-4fc85155b7df", + "circleciProjectId": "b590101b-f538-45fe-93f4-3e26b4979ea1", + "repository": "github.com/topcoder-platform/reports-api-v6", + "branch": "master", + "images": { + "reports-api-v6": "reports-api-v6" + } +} diff --git a/deploy/release.py b/deploy/release.py new file mode 100644 index 0000000..7ebc110 --- /dev/null +++ b/deploy/release.py @@ -0,0 +1,13 @@ +#!/usr/bin/env python3 +"""Pass the reviewed manifest and this job's prebuilt images to the pinned suite.""" +import json +from pathlib import Path +import subprocess +import sys + +manifest = Path(sys.argv[1]) +data = json.loads(manifest.read_text()) +command = [sys.executable, '-I', '/tmp/tc-deploy-scripts/tcdeploy.py', 'deploy', '--manifest', str(manifest)] +for container in data['images']: + command.extend(['--image', container + '=reports-api-v6:candidate']) +subprocess.run(command, check=True) From f645bccedd4042448643e15127d80f1b3a9fac40 Mon Sep 17 00:00:00 2001 From: Justin Gasper Date: Tue, 3 Nov 2026 22:32:03 +1100 Subject: [PATCH 3/8] Migrate ECS deployment to scoped OIDC without parameter access --- .circleci/config.yml | 4 ++-- deploy/MIGRATION.md | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.circleci/config.yml b/.circleci/config.yml index cc296a3..15ae31d 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -13,9 +13,9 @@ commands: set -euo pipefail git init --quiet /tmp/tc-deploy-scripts git -C /tmp/tc-deploy-scripts remote add origin https://github.com/topcoder-platform/tc-deploy-scripts.git - git -C /tmp/tc-deploy-scripts fetch --quiet --depth 1 origin 2a76ef3153bf966f29b66a007397e21affc5e169 + git -C /tmp/tc-deploy-scripts fetch --quiet --depth 1 origin b900d58e38787e3397743412597c6563fe6e08dd git -C /tmp/tc-deploy-scripts checkout --quiet --detach FETCH_HEAD - test "$(git -C /tmp/tc-deploy-scripts rev-parse HEAD)" = 2a76ef3153bf966f29b66a007397e21affc5e169 + test "$(git -C /tmp/tc-deploy-scripts rev-parse HEAD)" = b900d58e38787e3397743412597c6563fe6e08dd jobs: build: executor: reviewed diff --git a/deploy/MIGRATION.md b/deploy/MIGRATION.md index 4779436..39646fe 100644 --- a/deploy/MIGRATION.md +++ b/deploy/MIGRATION.md @@ -1,6 +1,6 @@ # OIDC deployment migration -This change replaces the Auth0 credential broker and SSM-to-shell deployment path with the reviewed [shared suite PR #40](https://github.com/topcoder-platform/tc-deploy-scripts/pull/40), pinned to `2a76ef3153bf966f29b66a007397e21affc5e169`. Build and deployment run in separate jobs. The deployer cannot read Parameter Store, Secrets Manager or decrypt KMS data, including through another assumed role. ECS continues resolving the existing runtime secret references using the execution role. +This change replaces the Auth0 credential broker and SSM-to-shell deployment path with the reviewed [shared suite PR #40](https://github.com/topcoder-platform/tc-deploy-scripts/pull/40), pinned to `b900d58e38787e3397743412597c6563fe6e08dd`. Build and deployment run in separate jobs. The deployer cannot read Parameter Store, Secrets Manager or decrypt KMS data, including through another assumed role. ECS continues resolving the existing runtime secret references using the execution role. ## Production target From b927313afa85cf8335e35c4bceddb9c73bb0742e Mon Sep 17 00:00:00 2001 From: Justin Gasper Date: Tue, 3 Nov 2026 22:53:41 +1100 Subject: [PATCH 4/8] Migrate ECS deployment to scoped OIDC without parameter access --- .circleci/config.yml | 4 ++-- deploy/MIGRATION.md | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.circleci/config.yml b/.circleci/config.yml index 15ae31d..d4f9b8f 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -13,9 +13,9 @@ commands: set -euo pipefail git init --quiet /tmp/tc-deploy-scripts git -C /tmp/tc-deploy-scripts remote add origin https://github.com/topcoder-platform/tc-deploy-scripts.git - git -C /tmp/tc-deploy-scripts fetch --quiet --depth 1 origin b900d58e38787e3397743412597c6563fe6e08dd + git -C /tmp/tc-deploy-scripts fetch --quiet --depth 1 origin bbc9b3d0c702947d26b6d9686d7b29104ebe461a git -C /tmp/tc-deploy-scripts checkout --quiet --detach FETCH_HEAD - test "$(git -C /tmp/tc-deploy-scripts rev-parse HEAD)" = b900d58e38787e3397743412597c6563fe6e08dd + test "$(git -C /tmp/tc-deploy-scripts rev-parse HEAD)" = bbc9b3d0c702947d26b6d9686d7b29104ebe461a jobs: build: executor: reviewed diff --git a/deploy/MIGRATION.md b/deploy/MIGRATION.md index 39646fe..bcb1f7c 100644 --- a/deploy/MIGRATION.md +++ b/deploy/MIGRATION.md @@ -1,6 +1,6 @@ # OIDC deployment migration -This change replaces the Auth0 credential broker and SSM-to-shell deployment path with the reviewed [shared suite PR #40](https://github.com/topcoder-platform/tc-deploy-scripts/pull/40), pinned to `b900d58e38787e3397743412597c6563fe6e08dd`. Build and deployment run in separate jobs. The deployer cannot read Parameter Store, Secrets Manager or decrypt KMS data, including through another assumed role. ECS continues resolving the existing runtime secret references using the execution role. +This change replaces the Auth0 credential broker and SSM-to-shell deployment path with the reviewed [shared suite PR #40](https://github.com/topcoder-platform/tc-deploy-scripts/pull/40), pinned to `bbc9b3d0c702947d26b6d9686d7b29104ebe461a`. Build and deployment run in separate jobs. The deployer cannot read Parameter Store, Secrets Manager or decrypt KMS data, including through another assumed role. ECS continues resolving the existing runtime secret references using the execution role. ## Production target From 08185b13676f27bf426481d200ea20d35041a4aa Mon Sep 17 00:00:00 2001 From: Justin Gasper Date: Wed, 4 Nov 2026 08:23:06 +1100 Subject: [PATCH 5/8] Maintain IAM templates and AWS baselines in private infrastructure repository --- .gitignore | 4 ++++ deploy/MIGRATION.md | 8 ++++++-- 2 files changed, 10 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index 019f162..6b16d76 100644 --- a/.gitignore +++ b/.gitignore @@ -57,3 +57,7 @@ pids report.[0-9]*.[0-9]*.[0-9]*.[0-9]*.json /generated/prisma + +# Infrastructure definitions and detailed AWS inventories are maintained privately. +/deploy/iam/ +/deploy/*-baseline.json diff --git a/deploy/MIGRATION.md b/deploy/MIGRATION.md index bcb1f7c..18ee002 100644 --- a/deploy/MIGRATION.md +++ b/deploy/MIGRATION.md @@ -4,12 +4,12 @@ This change replaces the Auth0 credential broker and SSM-to-shell deployment pat ## Production target -The read-only inventory on 2026-11-03 verified account `409275337247`, cluster `tc-reporting-serverless`, service `reports-api-v6`, family `reports-api-v6`, and container `reports-api-v6`. `prod.json` preserves the observed task/execution roles and names the proposed service-specific deployment role. `prod-baseline.json` records references only; it contains no parameter values. Do not recreate the service or replace its complete task definition from this baseline. +The read-only inventory on 2026-11-03 verified account `409275337247`, cluster `tc-reporting-serverless`, service `reports-api-v6`, family `reports-api-v6`, and container `reports-api-v6`. `prod.json` preserves the observed task/execution roles and names the proposed service-specific deployment role. [prod-baseline.json](https://github.com/topcoder-platform/v6-services-iac/blob/main/services/reports-api-v6/deploy/prod-baseline.json) records references only; it contains no parameter values. Do not recreate the service or replace its complete task definition from this baseline. ## Infrastructure prerequisites, applied separately by an administrator 1. In each account, register the CircleCI OIDC issuer `https://oidc.circleci.com/org/947bef5e-1669-415d-b83c-4fc85155b7df` with client ID `947bef5e-1669-415d-b83c-4fc85155b7df`. The current production account has only the legacy Auth0 provider. Do not remove that provider until all its consumers have migrated. -2. Review and install `iam/prod-role.cloudformation.json` with an administrator/IaC identity. It creates the proposed deployment role and applies the same least-privilege policy as a permissions boundary. The trust binds this CircleCI project, repository, checkout branch and configuration branch. It does not grant infrastructure creation to CircleCI. +2. Review and install [iam/prod-role.cloudformation.json](https://github.com/topcoder-platform/v6-services-iac/blob/main/services/reports-api-v6/deploy/iam/prod-role.cloudformation.json) with an administrator/IaC identity. It creates the proposed deployment role and applies the same least-privilege policy as a permissions boundary. The trust binds this CircleCI project, repository, checkout branch and configuration branch. It does not grant infrastructure creation to CircleCI. 3. Configure ECR repository `reports-api-v6` with unconditional `IMMUTABLE` tags and supported scan-on-push. Existing tags are not retagged. The release fails for MEDIUM/HIGH/CRITICAL/UNDEFINED findings, failed scans, or a mismatched digest. 4. In the infrastructure that owns the task definition, add the reviewed container check from `prod-healthcheck.json`, keeping all roles, runtime secret references, resources, mounts and sidecars. Verify the health endpoint against the running container in dev first. Preserve circuit-breaker rollback and positive desired capacity. Remove any `RESET_DB` secret binding and plaintext secret environment entries before adoption. Keep the execution role's runtime read permissions scoped to the references that service needs. 5. Create restricted `reports-api-v6-dev-deploy` and `reports-api-v6-prod-deploy` CircleCI contexts without Auth0/static AWS credentials. Restrict production to the reviewed `master` checkout and configuration ref, authorized operators, and approval job. Remove legacy credentials from project settings too: removing `org-global` alone does not remove project-level variables. Confirm `CIRCLE_OIDC_TOKEN_V3` is issued. Disable secret access for forks and SSH debugging in deployment jobs. @@ -21,3 +21,7 @@ The saved dev AWS session had expired during preparation. No dev cluster, role o Run the shared offline suite, validate the CircleCI config and IAM policies, and test a dev release plus an unhealthy-image rollback. Verify CloudTrail contains no SSM/Secrets Manager calls from the deployment principal. Remove its old broker grants only after migration. Check the runtime secret references and roles stayed unchanged. Production requires the manual approval job and a passing digest/scan/health verification. The pinned executor is `cimg/aws@sha256:4cf3768db00ddf9bc439b8c84e8a60c11a14edf81c8baf76f74132144f8340d5`. Python/AWS CLI/Buildx/Git compatibility was tested with the shared offline suite. No package installation or service build runs in the deployment job. The Dockerfile retains the existing in-image quality gates. This PR does not deploy, change IAM, rotate credentials, or claim a successful live rollout. + +## Infrastructure source + +IAM templates and detailed AWS baselines are maintained in the private [v6-services-iac service directory](https://github.com/topcoder-platform/v6-services-iac/tree/main/services/reports-api-v6). Provision infrastructure separately with an administrator identity; application CI does not fetch that repository or install IAM. Required application manifests and health-check proposals remain here. From 697dcc612dfe5760052a56fda35fd3001bab06d0 Mon Sep 17 00:00:00 2001 From: Justin Gasper Date: Wed, 4 Nov 2026 21:15:49 +1100 Subject: [PATCH 6/8] Refresh deployment suite v2.0.5 and dev review prerequisites --- .circleci/config.yml | 23 ++++++++++++++++++----- deploy/MIGRATION.md | 19 +++++++++++++++---- deploy/dev-healthcheck.json | 14 ++++++++++++++ deploy/dev.json | 19 +++++++++++++++++++ 4 files changed, 66 insertions(+), 9 deletions(-) create mode 100644 deploy/dev-healthcheck.json create mode 100644 deploy/dev.json diff --git a/.circleci/config.yml b/.circleci/config.yml index d4f9b8f..a7c6e0c 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -5,22 +5,35 @@ executors: docker: - image: cimg/aws@sha256:4cf3768db00ddf9bc439b8c84e8a60c11a14edf81c8baf76f74132144f8340d5 commands: + checkout-source: + steps: + - run: + name: Check out the exact public source commit over HTTPS + command: | + set -euo pipefail + [[ "$CIRCLE_SHA1" =~ ^[0-9a-f]{40}$ ]] + export GIT_CONFIG_NOSYSTEM=1 GIT_CONFIG_GLOBAL=/dev/null GIT_TERMINAL_PROMPT=0 + git init --quiet . + git remote add origin https://github.com/topcoder-platform/reports-api-v6.git + git -c credential.helper= fetch --quiet --depth 1 origin "$CIRCLE_SHA1" + git checkout --quiet --detach FETCH_HEAD + test "$(git rev-parse HEAD)" = "$CIRCLE_SHA1" checkout-suite: steps: - run: - name: Verify the reviewed deployment suite + name: Verify deployment suite v2.0.5 command: | set -euo pipefail git init --quiet /tmp/tc-deploy-scripts git -C /tmp/tc-deploy-scripts remote add origin https://github.com/topcoder-platform/tc-deploy-scripts.git - git -C /tmp/tc-deploy-scripts fetch --quiet --depth 1 origin bbc9b3d0c702947d26b6d9686d7b29104ebe461a + git -C /tmp/tc-deploy-scripts fetch --quiet --depth 1 origin refs/tags/v2.0.5 git -C /tmp/tc-deploy-scripts checkout --quiet --detach FETCH_HEAD - test "$(git -C /tmp/tc-deploy-scripts rev-parse HEAD)" = bbc9b3d0c702947d26b6d9686d7b29104ebe461a + test "$(git -C /tmp/tc-deploy-scripts rev-parse HEAD)" = bff574ab5c0b46773e25d2af1eff76675fba2ba5 jobs: build: executor: reviewed steps: - - checkout + - checkout-source - setup_remote_docker - checkout-suite - run: @@ -46,7 +59,7 @@ jobs: environment: DEPLOY_ENV: << parameters.environment >> steps: - - checkout + - checkout-source - setup_remote_docker - checkout-suite - attach_workspace: diff --git a/deploy/MIGRATION.md b/deploy/MIGRATION.md index 18ee002..ba76764 100644 --- a/deploy/MIGRATION.md +++ b/deploy/MIGRATION.md @@ -1,6 +1,6 @@ # OIDC deployment migration -This change replaces the Auth0 credential broker and SSM-to-shell deployment path with the reviewed [shared suite PR #40](https://github.com/topcoder-platform/tc-deploy-scripts/pull/40), pinned to `bbc9b3d0c702947d26b6d9686d7b29104ebe461a`. Build and deployment run in separate jobs. The deployer cannot read Parameter Store, Secrets Manager or decrypt KMS data, including through another assumed role. ECS continues resolving the existing runtime secret references using the execution role. +This change replaces the Auth0 credential broker and SSM-to-shell deployment path with [tc-deploy-scripts v2.0.5](https://github.com/topcoder-platform/tc-deploy-scripts/releases/tag/v2.0.5), fetched by tag and verified against commit `bff574ab5c0b46773e25d2af1eff76675fba2ba5`. Build and deployment run in separate jobs. The deployer cannot read Parameter Store, Secrets Manager or decrypt KMS data, including through another assumed role. ECS continues resolving the existing runtime secret references using the execution role. ## Production target @@ -9,14 +9,19 @@ The read-only inventory on 2026-11-03 verified account `409275337247`, cluster ` ## Infrastructure prerequisites, applied separately by an administrator 1. In each account, register the CircleCI OIDC issuer `https://oidc.circleci.com/org/947bef5e-1669-415d-b83c-4fc85155b7df` with client ID `947bef5e-1669-415d-b83c-4fc85155b7df`. The current production account has only the legacy Auth0 provider. Do not remove that provider until all its consumers have migrated. -2. Review and install [iam/prod-role.cloudformation.json](https://github.com/topcoder-platform/v6-services-iac/blob/main/services/reports-api-v6/deploy/iam/prod-role.cloudformation.json) with an administrator/IaC identity. It creates the proposed deployment role and applies the same least-privilege policy as a permissions boundary. The trust binds this CircleCI project, repository, checkout branch and configuration branch. It does not grant infrastructure creation to CircleCI. -3. Configure ECR repository `reports-api-v6` with unconditional `IMMUTABLE` tags and supported scan-on-push. Existing tags are not retagged. The release fails for MEDIUM/HIGH/CRITICAL/UNDEFINED findings, failed scans, or a mismatched digest. +2. Review and install [iam/prod-role.cloudformation.json](https://github.com/topcoder-platform/v6-services-iac/blob/main/services/reports-api-v6/deploy/iam/prod-role.cloudformation.json) with an administrator/IaC identity. It creates the proposed deployment role and applies the same least-privilege policy as a permissions boundary. The trust binds this CircleCI project, repository, checkout branch and configuration branch. It does not grant infrastructure creation to CircleCI. The role and matching boundary include `inspector2:ListFindings` and `inspector2:ListCoverage` restricted to the deployment region; these scan-metadata APIs require `Resource: "*"`. Secret-access denies remain explicit. +3. Configure ECR repository `reports-api-v6` with unconditional `IMMUTABLE` tags and supported scanning. Preserve existing enhanced scanning where enabled. Existing tags are not retagged. The release fails for MEDIUM/HIGH/CRITICAL/UNDEFINED findings, failed scans, or a mismatched digest. 4. In the infrastructure that owns the task definition, add the reviewed container check from `prod-healthcheck.json`, keeping all roles, runtime secret references, resources, mounts and sidecars. Verify the health endpoint against the running container in dev first. Preserve circuit-breaker rollback and positive desired capacity. Remove any `RESET_DB` secret binding and plaintext secret environment entries before adoption. Keep the execution role's runtime read permissions scoped to the references that service needs. 5. Create restricted `reports-api-v6-dev-deploy` and `reports-api-v6-prod-deploy` CircleCI contexts without Auth0/static AWS credentials. Restrict production to the reviewed `master` checkout and configuration ref, authorized operators, and approval job. Remove legacy credentials from project settings too: removing `org-global` alone does not remove project-level variables. Confirm `CIRCLE_OIDC_TOKEN_V3` is issued. Disable secret access for forks and SSH debugging in deployment jobs. ## Development acceptance before merge/release -The saved dev AWS session had expired during preparation. No dev cluster, role or family has been guessed. **This PR is a draft until an administrator verifies and commits `deploy/dev.json` for account `811668436784` and branch `develop`, with corresponding narrow IAM policy/trust.** Use the same schema as `prod.json`, but inspect the actual dev resources and roles; do not replace just the account number. The dev job fails closed while its manifest is absent. Branches other than `develop` and `master` build only and receive no deployment context. +Read-only inventory on 2026-11-04 verified `dev.json` against the actual development service, task/execution roles and image repositories. This PR targets `develop`. Matching IAM templates and detailed baselines remain private. **Keep this PR in draft until the service-specific prerequisites below are complete.** No AWS or CircleCI resources were provisioned by this refresh. + +- Install the service deployment role and matching permissions boundary. +- Create the restricted empty CircleCI deployment context. +- Set unconditional immutable ECR tags, preserving existing enhanced scanning. +- Review and install the dev container health-check proposal; preserve all other task configuration. Run the shared offline suite, validate the CircleCI config and IAM policies, and test a dev release plus an unhealthy-image rollback. Verify CloudTrail contains no SSM/Secrets Manager calls from the deployment principal. Remove its old broker grants only after migration. Check the runtime secret references and roles stayed unchanged. Production requires the manual approval job and a passing digest/scan/health verification. @@ -25,3 +30,9 @@ The pinned executor is `cimg/aws@sha256:4cf3768db00ddf9bc439b8c84e8a60c11a14edf8 ## Infrastructure source IAM templates and detailed AWS baselines are maintained in the private [v6-services-iac service directory](https://github.com/topcoder-platform/v6-services-iac/tree/main/services/reports-api-v6). Provision infrastructure separately with an administrator identity; application CI does not fetch that repository or install IAM. Required application manifests and health-check proposals remain here. + +## Dev branch refresh + +This PR targets `develop` and preserves its current application/dependency fixes. The shared suite is v2.0.5 (82 offline tests); service-specific adapters and their tests remain part of review. Keep this PR in draft until its documented infrastructure and integration prerequisites are met. Updating these files does not provision AWS or CircleCI resources. + +Source checkout uses the public HTTPS repository and verifies the exact CircleCI commit, avoiding dependency on failing SSH checkout keys. No GitHub token is added to build or deployment contexts. diff --git a/deploy/dev-healthcheck.json b/deploy/dev-healthcheck.json new file mode 100644 index 0000000..4e47f6c --- /dev/null +++ b/deploy/dev-healthcheck.json @@ -0,0 +1,14 @@ +{ + "reports-api-v6": { + "command": [ + "CMD", + "node", + "-e", + "const r=require('node:http').get(\"http://127.0.0.1:3000/v6/reports/health\",r=>{r.resume();process.exit(r.statusCode>=200&&r.statusCode<300?0:1)});r.setTimeout(4000,()=>{r.destroy();process.exit(1)});r.on('error',()=>process.exit(1))" + ], + "interval": 30, + "timeout": 5, + "retries": 3, + "startPeriod": 120 + } +} diff --git a/deploy/dev.json b/deploy/dev.json new file mode 100644 index 0000000..7e553c6 --- /dev/null +++ b/deploy/dev.json @@ -0,0 +1,19 @@ +{ + "schemaVersion": 2, + "environment": "dev", + "accountId": "811668436784", + "region": "us-east-1", + "deployRoleArn": "arn:aws:iam::811668436784:role/reports-api-v6-dev-deploy", + "taskRoleArn": null, + "executionRoleArn": "arn:aws:iam::811668436784:role/ecsTaskExecutionRole", + "cluster": "tc-reporting-serverless", + "service": "reports-api-v6", + "taskFamily": "reports-api-v6", + "circleciOrgId": "947bef5e-1669-415d-b83c-4fc85155b7df", + "circleciProjectId": "b590101b-f538-45fe-93f4-3e26b4979ea1", + "repository": "github.com/topcoder-platform/reports-api-v6", + "branch": "develop", + "images": { + "reports-api-v6": "reports-api-v6" + } +} From 1f3d63a1e479f1b0cc78414f93ccf07e58a8e2c7 Mon Sep 17 00:00:00 2001 From: Justin Gasper Date: Thu, 5 Nov 2026 07:49:21 +1100 Subject: [PATCH 7/8] Record installed dev prerequisites and production cutover readiness --- deploy/MIGRATION.md | 21 ++++++++------------- 1 file changed, 8 insertions(+), 13 deletions(-) diff --git a/deploy/MIGRATION.md b/deploy/MIGRATION.md index ba76764..3ed7da9 100644 --- a/deploy/MIGRATION.md +++ b/deploy/MIGRATION.md @@ -6,22 +6,17 @@ This change replaces the Auth0 credential broker and SSM-to-shell deployment pat The read-only inventory on 2026-11-03 verified account `409275337247`, cluster `tc-reporting-serverless`, service `reports-api-v6`, family `reports-api-v6`, and container `reports-api-v6`. `prod.json` preserves the observed task/execution roles and names the proposed service-specific deployment role. [prod-baseline.json](https://github.com/topcoder-platform/v6-services-iac/blob/main/services/reports-api-v6/deploy/prod-baseline.json) records references only; it contains no parameter values. Do not recreate the service or replace its complete task definition from this baseline. -## Infrastructure prerequisites, applied separately by an administrator +## Installed infrastructure and production cutover -1. In each account, register the CircleCI OIDC issuer `https://oidc.circleci.com/org/947bef5e-1669-415d-b83c-4fc85155b7df` with client ID `947bef5e-1669-415d-b83c-4fc85155b7df`. The current production account has only the legacy Auth0 provider. Do not remove that provider until all its consumers have migrated. -2. Review and install [iam/prod-role.cloudformation.json](https://github.com/topcoder-platform/v6-services-iac/blob/main/services/reports-api-v6/deploy/iam/prod-role.cloudformation.json) with an administrator/IaC identity. It creates the proposed deployment role and applies the same least-privilege policy as a permissions boundary. The trust binds this CircleCI project, repository, checkout branch and configuration branch. It does not grant infrastructure creation to CircleCI. The role and matching boundary include `inspector2:ListFindings` and `inspector2:ListCoverage` restricted to the deployment region; these scan-metadata APIs require `Resource: "*"`. Secret-access denies remain explicit. -3. Configure ECR repository `reports-api-v6` with unconditional `IMMUTABLE` tags and supported scanning. Preserve existing enhanced scanning where enabled. Existing tags are not retagged. The release fails for MEDIUM/HIGH/CRITICAL/UNDEFINED findings, failed scans, or a mismatched digest. -4. In the infrastructure that owns the task definition, add the reviewed container check from `prod-healthcheck.json`, keeping all roles, runtime secret references, resources, mounts and sidecars. Verify the health endpoint against the running container in dev first. Preserve circuit-breaker rollback and positive desired capacity. Remove any `RESET_DB` secret binding and plaintext secret environment entries before adoption. Keep the execution role's runtime read permissions scoped to the references that service needs. -5. Create restricted `reports-api-v6-dev-deploy` and `reports-api-v6-prod-deploy` CircleCI contexts without Auth0/static AWS credentials. Restrict production to the reviewed `master` checkout and configuration ref, authorized operators, and approval job. Remove legacy credentials from project settings too: removing `org-global` alone does not remove project-level variables. Confirm `CIRCLE_OIDC_TOKEN_V3` is issued. Disable secret access for forks and SSH debugging in deployment jobs. +The dev deployment role/boundary, restricted empty CircleCI context, and immutable ECR tags are installed. Existing enhanced scanning is preserved. The production OIDC provider, deployment role/boundary and restricted context are also installed; production runtime and ECR changes remain gated on dev validation. Installation evidence and remaining service-specific steps are private in [PROVISIONING.txt](https://github.com/topcoder-platform/v6-services-iac/blob/main/services/reports-api-v6/deploy/PROVISIONING.txt). Deploy roles have explicit secret-store and KMS-decryption denies. Runtime values are retrieved only by ECS using the execution role. -## Development acceptance before merge/release +At production cutover, stop legacy publishers, enable unconditional tag immutability, adopt missing task health checks with the reviewed image, and use the approval-gated `master` workflow. Preserve capacity, roles, secret references and rollback. Do not run production before dev validation. -Read-only inventory on 2026-11-04 verified `dev.json` against the actual development service, task/execution roles and image repositories. This PR targets `develop`. Matching IAM templates and detailed baselines remain private. **Keep this PR in draft until the service-specific prerequisites below are complete.** No AWS or CircleCI resources were provisioned by this refresh. +## Development acceptance -- Install the service deployment role and matching permissions boundary. -- Create the restricted empty CircleCI deployment context. -- Set unconditional immutable ECR tags, preserving existing enhanced scanning. -- Review and install the dev container health-check proposal; preserve all other task configuration. +This PR targets `develop`. Administrator-installed dev prerequisites are recorded in the private IaC repository. The reviewed task health check was submitted only after confirming the existing image serves the identical healthy load-balancer endpoint. + +- Dev infrastructure prerequisites are installed; merge to run the application deployment, then validate functionality. Run the shared offline suite, validate the CircleCI config and IAM policies, and test a dev release plus an unhealthy-image rollback. Verify CloudTrail contains no SSM/Secrets Manager calls from the deployment principal. Remove its old broker grants only after migration. Check the runtime secret references and roles stayed unchanged. Production requires the manual approval job and a passing digest/scan/health verification. @@ -33,6 +28,6 @@ IAM templates and detailed AWS baselines are maintained in the private [v6-servi ## Dev branch refresh -This PR targets `develop` and preserves its current application/dependency fixes. The shared suite is v2.0.5 (82 offline tests); service-specific adapters and their tests remain part of review. Keep this PR in draft until its documented infrastructure and integration prerequisites are met. Updating these files does not provision AWS or CircleCI resources. +This PR targets `develop` and preserves its current application/dependency fixes. The shared suite is v2.0.5 (82 offline tests); service-specific adapters and their tests remain part of review. Use the current readiness record above for the remaining merge/deployment gates. Updating these files does not provision AWS or CircleCI resources. Source checkout uses the public HTTPS repository and verifies the exact CircleCI commit, avoiding dependency on failing SSH checkout keys. No GitHub token is added to build or deployment contexts. From 9295930a8b8ca3a12e72f1e35694545127750032 Mon Sep 17 00:00:00 2001 From: Justin Gasper Date: Thu, 5 Nov 2026 08:44:39 +1100 Subject: [PATCH 8/8] Pin deployment suite v2.0.6 and enable reviewed health-check bootstrap --- .circleci/config.yml | 6 +++--- deploy/MIGRATION.md | 8 ++++++-- deploy/release.py | 3 ++- 3 files changed, 11 insertions(+), 6 deletions(-) diff --git a/.circleci/config.yml b/.circleci/config.yml index a7c6e0c..ec294b7 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -21,14 +21,14 @@ commands: checkout-suite: steps: - run: - name: Verify deployment suite v2.0.5 + name: Verify deployment suite v2.0.6 command: | set -euo pipefail git init --quiet /tmp/tc-deploy-scripts git -C /tmp/tc-deploy-scripts remote add origin https://github.com/topcoder-platform/tc-deploy-scripts.git - git -C /tmp/tc-deploy-scripts fetch --quiet --depth 1 origin refs/tags/v2.0.5 + git -C /tmp/tc-deploy-scripts fetch --quiet --depth 1 origin refs/tags/v2.0.6 git -C /tmp/tc-deploy-scripts checkout --quiet --detach FETCH_HEAD - test "$(git -C /tmp/tc-deploy-scripts rev-parse HEAD)" = bff574ab5c0b46773e25d2af1eff76675fba2ba5 + test "$(git -C /tmp/tc-deploy-scripts rev-parse HEAD)" = 26aaf607463d4a271c0099854c1731214215a9c5 jobs: build: executor: reviewed diff --git a/deploy/MIGRATION.md b/deploy/MIGRATION.md index 3ed7da9..db8d633 100644 --- a/deploy/MIGRATION.md +++ b/deploy/MIGRATION.md @@ -1,6 +1,6 @@ # OIDC deployment migration -This change replaces the Auth0 credential broker and SSM-to-shell deployment path with [tc-deploy-scripts v2.0.5](https://github.com/topcoder-platform/tc-deploy-scripts/releases/tag/v2.0.5), fetched by tag and verified against commit `bff574ab5c0b46773e25d2af1eff76675fba2ba5`. Build and deployment run in separate jobs. The deployer cannot read Parameter Store, Secrets Manager or decrypt KMS data, including through another assumed role. ECS continues resolving the existing runtime secret references using the execution role. +This change replaces the Auth0 credential broker and SSM-to-shell deployment path with [tc-deploy-scripts v2.0.6](https://github.com/topcoder-platform/tc-deploy-scripts/releases/tag/v2.0.6), fetched by tag and verified against commit `26aaf607463d4a271c0099854c1731214215a9c5`. Build and deployment run in separate jobs. The deployer cannot read Parameter Store, Secrets Manager or decrypt KMS data, including through another assumed role. ECS continues resolving the existing runtime secret references using the execution role. ## Production target @@ -28,6 +28,10 @@ IAM templates and detailed AWS baselines are maintained in the private [v6-servi ## Dev branch refresh -This PR targets `develop` and preserves its current application/dependency fixes. The shared suite is v2.0.5 (82 offline tests); service-specific adapters and their tests remain part of review. Use the current readiness record above for the remaining merge/deployment gates. Updating these files does not provision AWS or CircleCI resources. +This PR targets `develop` and preserves its current application/dependency fixes. The shared suite is v2.0.6 (92 offline tests); service-specific adapters and their tests remain part of review. Use the current readiness record above for the remaining merge/deployment gates. Updating these files does not provision AWS or CircleCI resources. Source checkout uses the public HTTPS repository and verifies the exact CircleCI commit, avoiding dependency on failing SSH checkout keys. No GitHub token is added to build or deployment contexts. + +## Reviewed health-check bootstrap + +The release wrapper passes the environment-specific health-check JSON to v2.0.6. A missing check is added with the new scanned image; the old image is not restarted with a new probe. An identical existing check is preserved, and a different existing check stops the release. Role, runtime-secret reference, scan, concurrency and healthy-digest checks remain enforced. diff --git a/deploy/release.py b/deploy/release.py index 7ebc110..f239c04 100644 --- a/deploy/release.py +++ b/deploy/release.py @@ -7,7 +7,8 @@ manifest = Path(sys.argv[1]) data = json.loads(manifest.read_text()) -command = [sys.executable, '-I', '/tmp/tc-deploy-scripts/tcdeploy.py', 'deploy', '--manifest', str(manifest)] +command = [sys.executable, '-I', '/tmp/tc-deploy-scripts/tcdeploy.py', 'deploy', '--manifest', str(manifest), + '--bootstrap-health-checks', str(manifest.with_name(data['environment'] + '-healthcheck.json'))] for container in data['images']: command.extend(['--image', container + '=reports-api-v6:candidate']) subprocess.run(command, check=True)