Repository navigation
feat(tools): seed an approved smoke echo tool in non-production environments - #312
Merged
Merged
Conversation
![github-code-quality[bot]](https://avatars.githubusercontent.com/u/9919?s=60&v=4){kind=small}
| // --- Production exclusion ------------------------------------------------ | ||
| it("skips when ENVIRONMENT is prod", async () => { | ||
| process.env.ENVIRONMENT = "prod"; | ||
| await handler(makeEvent(), mockContext, jest.fn()); |
| // --- Smoke-disabled exclusion -------------------------------------------- | ||
| it("skips when SMOKE_FIXTURES_ENABLED is not true", async () => { | ||
| delete process.env.SMOKE_FIXTURES_ENABLED; | ||
| await handler(makeEvent(), mockContext, jest.fn()); |
|
|
||
| // --- Delete no-op -------------------------------------------------------- | ||
| it("is a no-op on Delete", async () => { | ||
| await handler(makeEvent("Delete"), mockContext, jest.fn()); |
| status: "APPROVED", | ||
| }); | ||
|
|
||
| await handler(makeEvent(), mockContext, jest.fn()); |
| status: "APPROVED", | ||
| }); | ||
|
|
||
| await handler(makeEvent(), mockContext, jest.fn()); |
| status: "APPROVED", | ||
| }); | ||
|
|
||
| await handler(makeEvent(), mockContext, jest.fn()); |
| status: "APPROVED", | ||
| }); | ||
|
|
||
| await handler(makeEvent(), mockContext, jest.fn()); |
| status: "APPROVED", | ||
| }); | ||
|
|
||
| await handler(makeEvent("Update"), mockContext, jest.fn()); |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Seeds an approved smoke echo tool in non-production environments via a CloudFormation custom resource in
services-stack. The seeder:tools/smoke-echo-tool/index.jstoTOOLS_BUCKETwith SHA-256 content-hash idempotency (skips upload when the hash matches the existing S3 object's metadata tag).RegistryService(not the legacy DynamoDB tools table) and callssubmitForApproval(), which auto-approves immediately whenautoApprovalis configured on the registry.Prod exclusion — dual gate: CDK
if (props.environment !== 'prod')omits the Lambda + custom resource from the prod template entirely; the handler itself checksENVIRONMENT === 'prod'and exits early.Bucket key match — seeder writes
tools/smoke-echo-tool/index.js(S3_KEY = tools/${TOOL_ID}/index.js); tool-sandbox loads`tools/${toolId}/index.js`— identical pattern.Least-privilege grants — S3:
PutObject,GetObject,HeadObjectontools/*only. Registry:CreateRegistryRecord,GetRegistryRecord,ListRegistryRecords,SubmitRegistryRecordForApprovalscoped to the registry ARN.5 files changed, 14 unit tests + CDK stack assertions covering happy path, idempotency, prod exclusion, and Delete no-op.
Verification
npx tsc --noEmitnpx jest --silentnpm run split:gatesENVIRONMENT=test)split-baseline/)Deployment note
Deploys with the services stack (
citadel-services-{env}).After deploy, the tool appears in Agent Tools with status APPROVED. Clicking Run with
{"message":"hi"}echoes{"message":"hi","tool":"smoke-echo-tool","ts":"..."}.Approval status: the tool seeds as APPROVED because the registry has
autoApprovalconfigured (via the registry provisioner'sAutoApprovalRules). If auto-approval is later disabled, the tool will seed as PENDING_APPROVAL and must be approved once via the Approvals UI.