Skip to content

Commit 6fd48ba

Browse files
svangeClaude
svange
and
Claude
committed
feat: initial commit - set up API Portal with YAML-based deployment
- Add complete AWS API Gateway Developer Portal codebase - Set up YAML-based deployment configuration (no secrets needed!) - Configure GitHub Actions workflow with OIDC authentication - Add dev environment with custom domain portal.aillc.link - Add production environment template (disabled by default) - Include branding assets and custom styling - Add Makefile for easy local development - Configure project documentation (CLAUDE.md) This deployment system uses: - YAML files for all configuration (environments/*.yaml) - OIDC for secure AWS authentication (no credentials) - File-based deployment triggers - Custom domain and TLS support Co-authored-by: Claude <[email protected]>
1 parent 1034786 commit 6fd48ba

File tree

327 files changed

+35130
-11877
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

327 files changed

+35130
-11877
lines changed

‎.claude/settings.local.json‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
{
2+
"permissions": {
3+
"allow": [
4+
"WebFetch(domain:www.augmentingintegrations.com)"
5+
],
6+
"deny": []
7+
}
8+
}

‎.github/BRANCH_PROTECTION.md‎

Lines changed: 188 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,188 @@
1+
# Branch Protection Settings for augint-api
2+
3+
This document outlines the recommended GitHub Repository Ruleset settings for the augint-api serverless Infrastructure as Code (IaC) project.
4+
5+
## Repository Ruleset Configuration
6+
7+
**Navigate to:** Settings → Rules → Rulesets → **Create repository ruleset**
8+
9+
**Note:** This repository uses GitHub's new Repository Rulesets (not classic branch protection rules) for enhanced flexibility and better auto-merge integration.
10+
11+
## Dev Branch Protection Ruleset
12+
13+
Create a ruleset named **"Development Branch Protection"** for auto-merge functionality.
14+
15+
#### Ruleset Settings
16+
17+
**General Settings:**
18+
- **Ruleset Name**: `Development Branch Protection`
19+
- **Enforcement Status**: `Active`
20+
- **Target Branches**: `Include by pattern` → `dev`
21+
- **Bypass List**:
22+
- Add GitHub Apps that need bypass (e.g., `github-actions`)
23+
- Add repository administrators for emergency access
24+
25+
#### Protection Rules
26+
27+
✅ **Restrict deletions**
28+
- Prevents accidental deletion of the dev branch
29+
30+
✅ **Require pull request before merging**
31+
- **Required number of approvals**: `0` (auto-merge handles this)
32+
- **Dismiss stale PR approvals when new commits are pushed**: `Yes`
33+
- **Require review from CODEOWNERS**: `No` (for development speed)
34+
35+
✅ **Require status checks to pass before merging**
36+
- **Require branches to be up to date before merging**: `Yes`
37+
- **Required status checks** (exact names from serverless-gitops.yaml):
38+
- `Security scanning (SAST, dependencies, licenses)`
39+
- `Run unit tests (no infrastructure)`
40+
- `Infrastructure validation (SAM validate, cfn-lint)`
41+
- `Deploy serverless API`
42+
- `Run integration tests (against deployed API)`
43+
- `Run E2E tests and smoke tests (all environments)`
44+
45+
✅ **Require conversation resolution before merging**
46+
- Ensures all discussions are resolved before merge
47+
48+
✅ **Block force pushes**
49+
- Maintains clean git history and prevents accidental overwrites
50+
51+
#### Advanced Settings
52+
53+
**Bypass permissions:**
54+
- Repository administrators can bypass in emergencies
55+
- GitHub Actions can bypass for automated processes
56+
57+
## Main Branch Protection Ruleset
58+
59+
Create a second ruleset named **"Production Branch Protection"** for production releases.
60+
61+
#### Ruleset Settings
62+
63+
**General Settings:**
64+
- **Ruleset Name**: `Production Branch Protection`
65+
- **Enforcement Status**: `Active`
66+
- **Target Branches**: `Include by pattern` → `main`
67+
68+
#### Protection Rules
69+
70+
✅ **Restrict deletions**
71+
- Prevents accidental deletion of main branch
72+
73+
✅ **Restrict pushes**
74+
- Only administrators can push directly (emergency situations only)
75+
76+
✅ **Require pull request before merging**
77+
- **Required number of approvals**: `1` (manual oversight for production)
78+
- **Dismiss stale PR approvals when new commits are pushed**: `Yes`
79+
- **Require review from CODEOWNERS**: `Yes`
80+
81+
✅ **Require status checks to pass before merging**
82+
- **Require branches to be up to date before merging**: `Yes`
83+
- **Required status checks** (same as dev branch):
84+
- `Security scanning (SAST, dependencies, licenses)`
85+
- `Run unit tests (no infrastructure)`
86+
- `Infrastructure validation (SAM validate, cfn-lint)`
87+
- `Deploy serverless API`
88+
- `Run integration tests (against deployed API)`
89+
- `Run E2E tests and smoke tests (all environments)`
90+
91+
✅ **Require conversation resolution before merging**
92+
93+
✅ **Block force pushes**
94+
95+
## Repository Settings
96+
97+
**Navigate to:** Settings → General → Pull Requests
98+
99+
### Required Settings for Auto-Merge
100+
101+
✅ **Allow auto-merge**
102+
- Enables GitHub's native auto-merge functionality
103+
104+
✅ **Allow squash merging**
105+
- Maintains clean commit history (recommended)
106+
107+
❌ **Allow merge commits** (disabled)
108+
- Prevents noisy merge commits in history
109+
110+
❌ **Allow rebase merging** (disabled)
111+
- Reduces merge strategy complexity
112+
113+
✅ **Always suggest updating pull request branches**
114+
- Helps keep branches up to date
115+
116+
✅ **Automatically delete head branches**
117+
- Cleans up feature branches after merge
118+
119+
## Status Check Names Reference
120+
121+
The exact status check names that must be configured in the ruleset (from serverless-gitops.yaml):
122+
123+
```yaml
124+
Required Status Checks:
125+
- "Security scanning (SAST, dependencies, licenses)"
126+
- "Run unit tests (no infrastructure)"
127+
- "Infrastructure validation (SAM validate, cfn-lint)"
128+
- "Deploy serverless API"
129+
- "Run integration tests (against deployed API)"
130+
- "Run E2E tests and smoke tests (all environments)"
131+
```
132+
133+
**Important:** Status check names must match exactly as they appear in the GitHub Actions workflow. Any mismatch will prevent auto-merge from working.
134+
135+
## Differences from augint-library
136+
137+
The augint-api project has additional quality gates compared to augint-library due to its Infrastructure as Code (IaC) nature:
138+
139+
| Project | Quality Gates | Additional Requirements |
140+
|---------|---------------|-------------------------|
141+
| **augint-library** | 4 gates | Unit tests, security, compliance, pre-commit |
142+
| **augint-api** | 6 gates | + Infrastructure validation, deployment, integration/E2E tests |
143+
144+
This reflects the higher complexity and risk associated with serverless infrastructure deployment.
145+
146+
## Auto-Merge Integration
147+
148+
The ruleset configuration works seamlessly with the auto-merge job in `serverless-gitops.yaml`:
149+
150+
1. **Development branches** push to GitHub
151+
2. **Pipeline runs** all 6 quality gates
152+
3. **Auto-merge job** enables GitHub auto-merge if all gates pass
153+
4. **GitHub auto-merge** waits for all required status checks
154+
5. **Automatic merge** happens when all conditions are met
155+
156+
## Troubleshooting
157+
158+
### Common Ruleset Issues
159+
160+
**Auto-merge not working:**
161+
1. Verify all 6 status checks are configured with exact names
162+
2. Check that auto-merge is enabled in repository settings
163+
3. Ensure the development branch is up to date
164+
4. Confirm the PR targets the `dev` branch
165+
166+
**Status checks not found:**
167+
1. Check job names in `.github/workflows/serverless-gitops.yaml`
168+
2. Verify the pipeline has run at least once to establish status checks
169+
3. Update ruleset with exact status check names from successful pipeline runs
170+
171+
**Emergency access needed:**
172+
1. Repository administrators can bypass rulesets
173+
2. Use "Override branch protection" option in PR interface
174+
3. Document reason for bypass in PR comments
175+
176+
## Validation
177+
178+
To verify your ruleset configuration:
179+
180+
1. Create a test branch: `feat/issue-test-auto-merge`
181+
2. Make a small change and push
182+
3. Create PR targeting `dev` branch
183+
4. Verify all 6 status checks appear and must pass
184+
5. Confirm auto-merge enables when all checks pass
185+
186+
---
187+
188+
This configuration ensures robust protection for both development and production branches while enabling efficient auto-merge workflows for routine development.

‎.github/CODEOWNERS‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
# Default: you own everything
2+
* @svange
3+
.github/ @svange

‎.github/FUNDING.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
github: [svange]

‎.github/ISSUE_TEMPLATE/bug_report.md‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
---
2+
name: "🐛 Bug report"
3+
about: Report a bug to help improve the project
4+
title: "[Bug] "
5+
labels: bug
6+
assignees: svange
7+
---
8+
9+
## 🐞 Description
10+
11+
## 📋 Steps to reproduce
12+
13+
## 📈 Expected behavior
14+
15+
## 🖥️ Environment
16+
17+
- OS:
18+
- Python version:
19+
20+
## Additional context

‎.github/ISSUE_TEMPLATE/feature_request.md‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
---
2+
name: "✨ Feature request"
3+
about: Suggest a new idea or enhancement
4+
title: "[Feature] "
5+
labels: enhancement
6+
assignees: svange
7+
---
8+
9+
## ✨ Description
10+
11+
## 🚀 Why is this useful?
12+
13+
## 🔗 Related issues or context

‎.github/PULL_REQUEST_TEMPLATE.md‎

Lines changed: 11 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,14 @@
1-
*Issue #, if available:*
1+
## 🚀 Summary
22

3-
*Description of changes:*
3+
<!-- Briefly describe what this PR does -->
44

5+
## 🔗 Related issues
56

6-
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
7+
<!-- Link to related issues, e.g. Closes #123 -->
8+
9+
## ✅ Checklist
10+
11+
- [ ] Tests added/updated
12+
- [ ] CI passing
13+
- [ ] Docs updated (if needed)
14+
- [ ] Ready for review

‎.github/SECURITY.md‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
# Security Policy
2+
3+
If you discover a security vulnerability, please report it responsibly.
4+
5+
## How to report
6+
7+
- Please contact the repository owner directly via email or GitHub issues.

‎.github/dependabot.yaml‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
version: 2
2+
updates:
3+
# GitHub Actions dependencies
4+
- package-ecosystem: github-actions
5+
directory: /
6+
schedule:
7+
interval: weekly
8+
day: monday
9+
time: "09:00"
10+
labels:
11+
- dependencies
12+
- github-actions
13+
commit-message:
14+
prefix: "ci"
15+
include: "scope"
16+
pull-request-branch-name:
17+
separator: "-"
18+
open-pull-requests-limit: 5
19+
20+
# Python dependencies - AGGRESSIVE for fast testing (daily at 6am UTC)
21+
- package-ecosystem: pip
22+
directory: /
23+
schedule:
24+
interval: "daily" # Keep daily for now, most reliable
25+
time: "06:00"
26+
labels:
27+
- dependencies
28+
- python
29+
commit-message:
30+
prefix: "build"
31+
include: "scope"
32+
pull-request-branch-name:
33+
separator: "-"
34+
groups:
35+
# Group patch and minor updates together for auto-merge
36+
python-minor-patch:
37+
patterns:
38+
- "*"
39+
update-types:
40+
- "minor"
41+
- "patch"
42+
# Keep major updates separate for careful review
43+
python-major:
44+
patterns:
45+
- "*"
46+
update-types:
47+
- "major"
48+
open-pull-requests-limit: 2 # Keep it focused for fast testing
49+
# Focus on production and main dev dependencies only
50+
allow:
51+
- dependency-type: "production"
52+
- dependency-type: "development"
53+
ignore:
54+
# Skip security group deps (they have external dependencies causing SSL issues)
55+
- dependency-name: "bandit"
56+
- dependency-name: "safety"
57+
- dependency-name: "pip-audit"
58+
- dependency-name: "licensecheck"
59+
target-branch: dev # Enterprise pattern: Dependencies flow through staging first

0 commit comments

Comments
 (0)