release: promote AWSops 0.10.1 from dev to main

.github/actionlint.yaml

@@ -0,0 +1,3 @@
+self-hosted-runner:
+  labels:
+    - sample-awsops

.github/workflows/audit-deployment.yml

@@ -0,0 +1,209 @@
+name: Audit Development Deployment
+
+on:
+  workflow_dispatch:
+    inputs:
+      expected_project:
+        description: Exact development project from the reviewed deployment configuration
+        required: true
+        type: string
+
+permissions:
+  contents: read
+
+concurrency:
+  group: deployment-audit-development
+  cancel-in-progress: false
+
+jobs:
+  guard:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Require a samples development dispatch
+        run: |
+          set -euo pipefail
+          [ "$GITHUB_REPOSITORY" = "aws-samples/sample-awsops" ] &&
+          [ "$GITHUB_EVENT_NAME" = "workflow_dispatch" ] &&
+          [ "$GITHUB_REF" = "refs/heads/dev" ] || {
+            echo "::error::Only a samples dev dispatch can run this audit"
+            exit 1
+          }
+
+  audit:
+    needs: [guard]
+    runs-on: sample-awsops
+    environment: development
+    timeout-minutes: 15
+    permissions:
+      contents: read
+      id-token: write
+    env:
+      AWS_REGION: ap-northeast-2
+      AWS_ACCOUNT_ID_DEV: ${{ secrets.AWS_ACCOUNT_ID_DEV }}
+      RUNTIME_ROLE_ARN: ${{ secrets.AWS_CI_DEPLOYER_DEV_ROLE_ARN }}
+      EXPECTED_PROJECT: ${{ inputs.expected_project }}
+    steps:
+      - name: Select private audit directory
+        run: |
+          printf 'AUDIT_DIR=%s/deployment-audit-%s-%s\n' \
+            "$RUNNER_TEMP" "$GITHUB_RUN_ID" "$GITHUB_RUN_ATTEMPT" >> "$GITHUB_ENV"
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.sha }}
+          persist-credentials: false
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - name: Install read API SDK
+        run: |
+          python3 -m pip install --require-hashes --only-binary=:all: -r scripts/v2/agentcore/requirements-provision.txt
+      - uses: hashicorp/setup-terraform@v3
+        with:
+          terraform_version: 1.15.7
+          terraform_wrapper: false
+      - name: Check context and configured account before OIDC
+        id: scope
+        env:
+          BACKEND_B64: ${{ secrets.TF_BACKEND_HCL_DEV }}
+        run: |
+          set -euo pipefail
+          umask 077
+          mkdir -m 700 "$AUDIT_DIR"
+          python3 scripts/v2/ci_deployment_audit.py guard
+      - name: Mask and publish the backend session policy
+        id: backend_session
+        uses: actions/github-script@v7
+        env:
+          POLICY_FILE: ${{ steps.scope.outputs.policy_file }}
+        with:
+          script: |
+            const fs = require('fs');
+            const file = process.env.POLICY_FILE;
+            try {
+              if (file !== `${process.env.AUDIT_DIR}/session-policy.json`) throw new Error();
+              const text = fs.readFileSync(file, 'utf8');
+              const policy = JSON.parse(text);
+              core.setSecret(text);
+              for (const statement of policy.Statement) {
+                for (const arn of [].concat(statement.Resource)) {
+                  if (arn.startsWith('arn:')) core.setSecret(arn);
+                  if (arn.startsWith('arn:aws:s3:::')) core.setSecret(arn.slice('arn:aws:s3:::'.length));
+                }
+              }
+              core.setOutput('session_policy', text);
+            } catch {
+              core.setFailed('audit_policy_publication_failed');
+            } finally {
+              if (file === `${process.env.AUDIT_DIR}/session-policy.json`) fs.rmSync(file, {force: true});
+            }
+      - name: Require the backend session restriction
+        env:
+          SESSION_POLICY: ${{ steps.backend_session.outputs.session_policy }}
+        run: |
+          set -euo pipefail
+          [ -n "${SESSION_POLICY//[[:space:]]/}" ] || {
+            echo "::error::audit_session_policy_missing"; exit 1;
+          }
+      - uses: aws-actions/configure-aws-credentials@v4
+        if: ${{ success() && steps.backend_session.outputs.session_policy != '' }}
+        with:
+          role-to-assume: ${{ secrets.AWS_CI_DEPLOYER_DEV_ROLE_ARN }}
+          aws-region: ap-northeast-2
+          mask-aws-account-id: true
+          unset-current-credentials: true
+          role-duration-seconds: 900
+          inline-session-policy: ${{ steps.backend_session.outputs.session_policy }}
+      - name: Verify the existing development caller
+        run: python3 scripts/v2/ci_deployment_audit.py caller
+      - name: Capture only named outputs and remove backend immediately
+        timeout-minutes: 5
+        env:
+          BACKEND_B64: ${{ secrets.TF_BACKEND_HCL_DEV }}
+        run: |
+          set -euo pipefail
+          umask 077
+          export TF_DATA_DIR="$AUDIT_DIR/tfdata"
+          export TF_WORKSPACE=default
+          trap 'rm -rf -- "$TF_DATA_DIR"; rm -f -- "$AUDIT_DIR/backend.hcl"' EXIT
+          # No tfvars, plans, full state, Terraform debug logs or CLI overrides.
+          for name in ${!TF_LOG@} ${!TF_CLI_ARGS@}; do unset "$name"; done
+          [ -n "$BACKEND_B64" ] || { echo "::error::Development backend is missing"; exit 1; }
+          printf '%s' "$BACKEND_B64" | base64 --decode > "$AUDIT_DIR/backend.hcl" 2>/dev/null || {
+            echo "::error::Backend restore failed (details withheld)"; exit 1;
+          }
+          unset BACKEND_B64
+          terraform -chdir=terraform/foundation init -backend-config="$AUDIT_DIR/backend.hcl" \
+            -input=false -lockfile=readonly >/dev/null 2>&1 || {
+              echo "::error::Backend initialization failed (details withheld)"; exit 1;
+            }
+          for output in runtime_deployment agentcore agent_sql_reader_secret_arn aurora_database; do
+            if [ "$output" = agentcore ]; then
+              state=$(python3 -c \
+                'import json,sys; enabled=json.load(open(sys.argv[1]))["features"]["agentcore"]; assert type(enabled) is bool; print("enabled" if enabled else "disabled")' \
+                "$AUDIT_DIR/runtime_deployment.json" 2>/dev/null) || {
+                  echo "::error::Invalid captured runtime configuration"; exit 1;
+                }
+              if [ "$state" = disabled ]; then
+                printf 'null\n' > "$AUDIT_DIR/agentcore.json"
+                continue
+              fi
+            fi
+            terraform -chdir=terraform/foundation output -json "$output" \
+              > "$AUDIT_DIR/$output.json" 2>/dev/null || {
+                echo "::error::Required deployment output unavailable (details withheld)"; exit 1
+              }
+          done
+          rm -rf -- "$TF_DATA_DIR"
+          rm -f -- "$AUDIT_DIR/backend.hcl"
+      - name: Validate captured identities and restrict the audit session
+        id: read_scope
+        run: python3 scripts/v2/ci_deployment_audit.py audit-policy --directory "$AUDIT_DIR"
+      - name: Mask and publish the workload session policy
+        id: workload_session
+        uses: actions/github-script@v7
+        env:
+          POLICY_FILE: ${{ steps.read_scope.outputs.policy_file }}
+        with:
+          script: |
+            const fs = require('fs');
+            const file = process.env.POLICY_FILE;
+            try {
+              if (file !== `${process.env.AUDIT_DIR}/session-policy.json`) throw new Error();
+              const text = fs.readFileSync(file, 'utf8');
+              const policy = JSON.parse(text);
+              core.setSecret(text);
+              for (const statement of policy.Statement) {
+                for (const arn of [].concat(statement.Resource)) {
+                  if (arn.startsWith('arn:')) core.setSecret(arn);
+                }
+              }
+              core.setOutput('session_policy', text);
+            } catch {
+              core.setFailed('audit_policy_publication_failed');
+            } finally {
+              if (file === `${process.env.AUDIT_DIR}/session-policy.json`) fs.rmSync(file, {force: true});
+            }
+      - name: Require the workload session restriction
+        env:
+          SESSION_POLICY: ${{ steps.workload_session.outputs.session_policy }}
+        run: |
+          set -euo pipefail
+          [ -n "${SESSION_POLICY//[[:space:]]/}" ] || {
+            echo "::error::audit_session_policy_missing"; exit 1;
+          }
+      - name: Assume the existing role for workload reads only
+        if: ${{ success() && steps.workload_session.outputs.session_policy != '' }}
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: ${{ secrets.AWS_CI_DEPLOYER_DEV_ROLE_ARN }}
+          aws-region: ap-northeast-2
+          mask-aws-account-id: true
+          unset-current-credentials: true
+          role-duration-seconds: 900
+          inline-session-policy: ${{ steps.workload_session.outputs.session_policy }}
+      - name: Read deployment, schedule execution and database observations
+        timeout-minutes: 8
+        run: python3 scripts/v2/ci_deployment_audit.py audit --directory "$AUDIT_DIR"
+      - name: Always remove private audit scratch
+        if: always()
+        run: rm -rf -- "$AUDIT_DIR"

.github/workflows/build-runtime-images.yml

@@ -0,0 +1,80 @@
+name: Build Development Runtime Image
+
+on:
+  workflow_dispatch:
+    inputs:
+      component:
+        description: Existing backend image to build (repository must already exist)
+        required: true
+        type: choice
+        options: [steampipe, worker]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: runtime-image-dev-${{ inputs.component }}
+  cancel-in-progress: false
+
+jobs:
+  guard:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Require a samples development dispatch
+        env:
+          COMPONENT: ${{ inputs.component }}
+        run: |
+          set -euo pipefail
+          [ "$GITHUB_REPOSITORY" = "aws-samples/sample-awsops" ] &&
+          [ "$GITHUB_EVENT_NAME" = "workflow_dispatch" ] &&
+          [ "$GITHUB_REF" = "refs/heads/dev" ] || exit 1
+          case "$COMPONENT" in steampipe|worker) ;; *) exit 1;; esac
+
+  build:
+    needs: [guard]
+    runs-on: sample-awsops
+    timeout-minutes: 60
+    permissions:
+      contents: read
+      id-token: write
+    env:
+      AWS_REGION: ap-northeast-2
+      AWS_ACCOUNT_ID_DEV: ${{ secrets.AWS_ACCOUNT_ID_DEV }}
+      RUNTIME_ROLE_ARN: ${{ secrets.AWS_CI_BUILD_DEV_ROLE_ARN }}
+      RUNTIME_COMPONENT: ${{ inputs.component }}
+    outputs:
+      project: ${{ steps.image.outputs.project }}
+      digest: ${{ steps.image.outputs.digest }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.sha }}
+          persist-credentials: false
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+      - name: Validate independent development account before OIDC
+        run: node scripts/v2/ci/runtime-build.mjs check-role
+      - uses: docker/setup-qemu-action@v3
+      - uses: docker/setup-buildx-action@v3
+      - uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: ${{ secrets.AWS_CI_BUILD_DEV_ROLE_ARN }}
+          aws-region: ap-northeast-2
+          mask-aws-account-id: true
+          unset-current-credentials: true
+          role-duration-seconds: 3600
+      - name: Verify caller, build ARM64 and bind uploaded digest
+        id: image
+        timeout-minutes: 50
+        env:
+          DEV_TFVARS_B64: ${{ secrets.TF_TFVARS_DEV }}
+        run: |
+          set -euo pipefail
+          umask 077
+          CONFIG=$(mktemp "$RUNNER_TEMP/runtime-project.XXXXXX")
+          trap 'rm -f "$CONFIG"' EXIT
+          [ -n "$DEV_TFVARS_B64" ] || { echo "::error::TF_TFVARS_DEV is required"; exit 1; }
+          printf '%s' "$DEV_TFVARS_B64" | base64 --decode > "$CONFIG"
+          unset DEV_TFVARS_B64
+          node scripts/v2/ci/runtime-build.mjs build < "$CONFIG"