Add CDK app for apiref.phpstan.org infrastructure#5658
Merged
Conversation
Collaborator
|
You've opened the pull request against the latest branch 2.2.x. PHPStan 2.2 is not going to be released for months. If your code is relevant on 2.1.x and you want it to be released sooner, please rebase your pull request and change its target to 2.1.x. |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
There was a problem hiding this comment.
zizmor found more than 20 potential problems in the proposed changes. Check the Files changed tab for more details.
Mirror the website infra modernization from phpstan/phpstan: replace the click-configured legacy stack for apiref.phpstan.org with code under apigen/infra/. - ApirefStack: private S3 bucket via OAC, CloudFront distribution (HTTP/2+3, TLS 1.2_2021), a single CloudFront Function 2.0 doing the per-version landing-page redirects that the legacy apiref-phpstan-org-viewer-request did (now with `/` -> 2.2.x as the new latest, and 301s instead of 302s for SEO), a Response Headers Policy replacing the shared secure-headers-response, and a DNS-validated ACM cert for apiref.phpstan.org. - OidcRolesStack: phpstan-apiref-infra-deploy role for the new workflow. Reuses the account-wide GitHub OIDC provider (the dist-repo CDK app created it); does not try to create a duplicate. - productionAlias context flag controls whether apiref.phpstan.org is attached to the new distribution. Stays false until the manual cutover detaches the alias from the legacy E37G1C2KWNAPBD; then flipped true. - New .github/workflows/apiref-infra.yml: test -> diff -> deploy gated on needs:[test,diff], OIDC, sticky PR diff comment. Same shape as the main-site website-infra.yml. - apiref.yml: switched off the static APIREF_AWS_* keys to OIDC via vars.APIREF_DEPLOY_ROLE_ARN, vars.APIREF_BUCKET, and vars.APIREF_DISTRIBUTION_ID. Added `!apigen/infra/**` to the path filter so infra-only edits don't trigger a (slow) ApiGen rebuild. After merge, set these repository variables in phpstan/phpstan-src: APIREF_INFRA_DEPLOY_ROLE_ARN (from PhpstanApirefOidcRoles output) APIREF_DEPLOY_ROLE_ARN (from PhpstanApirefWebsite output) APIREF_BUCKET phpstan-apiref-web APIREF_DISTRIBUTION_ID (from PhpstanApirefWebsite output) Full bootstrap + cutover + cleanup runbook in apigen/infra/README.md. Conventions and edit-this-when guide in apigen/infra/CLAUDE.md. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
ondrejmirtes
force-pushed
the
apiref-infra-cdk
branch
from
b0d26a7 to
85e8365
Compare
| run: | | ||
| aws cloudfront create-invalidation \ | ||
| --distribution-id "${{ vars.APIREF_DISTRIBUTION_ID }}" \ | ||
| --paths "/${{ github.ref_name }}/*" |
|
|
||
| - name: "Sync with S3" | ||
| run: | | ||
| aws s3 sync ./docs "s3://${{ vars.APIREF_BUCKET }}/${{ github.ref_name }}" \ |
| run: | | ||
| aws cloudfront create-invalidation \ | ||
| --distribution-id "${{ vars.APIREF_DISTRIBUTION_ID }}" \ | ||
| --paths "/${{ github.ref_name }}/*" |
| AWS_SECRET_ACCESS_KEY: ${{ secrets.APIREF_AWS_SECRET_ACCESS_KEY }} | ||
| run: | | ||
| aws cloudfront create-invalidation \ | ||
| --distribution-id "${{ vars.APIREF_DISTRIBUTION_ID }}" \ |
|
|
||
| - name: "Sync with S3" | ||
| run: | | ||
| aws s3 sync ./docs "s3://${{ vars.APIREF_BUCKET }}/${{ github.ref_name }}" \ |
|
|
||
| steps: | ||
| - name: Harden the runner (Audit all outbound calls) | ||
| uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2 |
|
|
||
| steps: | ||
| - name: Harden the runner (Audit all outbound calls) | ||
| uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2 |
| - '.github/workflows/apiref-infra.yml' | ||
| - 'apigen/infra/**' | ||
|
|
||
| concurrency: apiref-infra |
|
|
||
| - name: "Sync with S3" | ||
| run: | | ||
| aws s3 sync ./docs "s3://${{ vars.APIREF_BUCKET }}/${{ github.ref_name }}" \ |
| AWS_SECRET_ACCESS_KEY: ${{ secrets.APIREF_AWS_SECRET_ACCESS_KEY }} | ||
| run: | | ||
| aws cloudfront create-invalidation \ | ||
| --distribution-id "${{ vars.APIREF_DISTRIBUTION_ID }}" \ |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Mirror the website infra modernization from phpstan/phpstan: replace the click-configured legacy stack for apiref.phpstan.org with code under apigen/infra/.
/-> 2.2.x as the new latest, and 301s instead of 302s for SEO), a Response Headers Policy replacing the shared secure-headers-response, and a DNS-validated ACM cert for apiref.phpstan.org.!apigen/infra/**to the path filter so infra-only edits don't trigger a (slow) ApiGen rebuild.After merge, set these repository variables in phpstan/phpstan-src:
APIREF_INFRA_DEPLOY_ROLE_ARN (from PhpstanApirefOidcRoles output)
APIREF_DEPLOY_ROLE_ARN (from PhpstanApirefWebsite output)
APIREF_BUCKET phpstan-apiref-web
APIREF_DISTRIBUTION_ID (from PhpstanApirefWebsite output)
Full bootstrap + cutover + cleanup runbook in apigen/infra/README.md. Conventions and edit-this-when guide in apigen/infra/CLAUDE.md.