Apply gate: resolve team from GitHub API for team-based roles

[Alexanderamiri]

Summary

The apply gate Lambda used the old per-app role pattern (javabin-ci-app-{repo}). Updated to resolve team from GitHub API (same as the CI broker) and assume javabin-ci-team-{team}.

Also includes the boundary ARN construction fix from PR #94.

Changes

• shared/github.py: Extracted GitHub App auth + team resolution from ci_broker into shared module
• ci_broker/handler.py: Uses shared.github.resolve_team() instead of inline copy
• apply_gate/handler.py: Uses shared.github.resolve_team() to find team, assumes javabin-ci-team-{team}
• lambdas/main.tf: Added SSM read for GitHub App creds to gate role. Switched ci_broker + apply_gate archives to source{} blocks to include shared module.
• registry.py + platform-data/main.tf: Construct boundary ARN instead of data source

Test plan

• Merge, wait for apply (deploys updated Lambdas)
• Retrigger test app CI — apply gate should resolve team and assume correct role

[github-actions]

Terraform Plan

🚧 Changes detected — Plan: 0 to add, 3 to change, 0 to destroy.

Plan output

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  ~ update in-place

Terraform will perform the following actions:

  # module.lambdas.aws_iam_role_policy.apply_gate will be updated in-place
  ~ resource "aws_iam_role_policy" "apply_gate" {
        id     = "javabin-apply-gate:javabin-apply-gate"
        name   = "javabin-apply-gate"
      ~ policy = jsonencode(
          ~ {
              ~ Statement = [
                    # (2 unchanged elements hidden)
                    {
                        Action   = "sts:AssumeRole"
                        Effect   = "Allow"
                        Resource = "arn:aws:iam::553637109631:role/javabin-ci-team-*"
                        Sid      = "AssumeTeamRoles"
                    },
                  + {
                      + Action   = "ssm:GetParameter"
                      + Effect   = "Allow"
                      + Resource = [
                          + "arn:aws:ssm:eu-central-1:553637109631:parameter/javabin/platform/github-app-id",
                          + "arn:aws:ssm:eu-central-1:553637109631:parameter/javabin/platform/github-app-key",
                        ]
                      + Sid      = "ReadGitHubAppCredentials"
                    },
                ]
                # (1 unchanged attribute hidden)
            }
        )
        # (1 unchanged attribute hidden)
    }

  # module.lambdas.aws_lambda_function.apply_gate will be updated in-place
  ~ resource "aws_lambda_function" "apply_gate" {
        id                             = "javabin-apply-gate"
      ~ last_modified                  = "2026-03-17T19:19:44.182+0000" -> (known after apply)
      ~ source_code_hash               = "GwMg5ExuEgwD7SMSO92dnOtPp3Ebpe6n8e1IcSccpkE=" -> "UIWBB5JjUuxNGDEzzQ+vqN2HzkpT9TXXMugFBFyQtJA="
        tags                           = {}
        # (21 unchanged attributes hidden)

        # (4 unchanged blocks hidden)
    }

  # module.lambdas.aws_lambda_function.ci_broker will be updated in-place
  ~ resource "aws_lambda_function" "ci_broker" {
        id                             = "javabin-ci-broker"
      ~ last_modified                  = "2026-03-17T23:12:51.000+0000" -> (known after apply)
      ~ source_code_hash               = "oPOfwimvwsRJJLhtsQE0/AFhJGK4auzPN+Qj5PXZh+s=" -> "7RJbLLtcXuSIUkIYZbx+bcKW17c0IARtwitmYk5mCoU="
        tags                           = {}
        # (21 unchanged attributes hidden)

        # (4 unchanged blocks hidden)
    }

Plan: 0 to add, 3 to change, 0 to destroy.

─────────────────────────────────────────────────────────────────────────────

Saved the plan to: tfplan

To perform exactly these actions, run the following command to apply:
    terraform apply "tfplan"

---

LLM Review

Risk: 🟢 LOW

Routine Lambda function updates with minor IAM permission additions for GitHub App credential access.

• ✅ [routine] Lambda function code updates for apply_gate and ci_broker with new source code hashes - standard deployment updates
• ✅ [routine] IAM policy expansion for apply_gate role adding ssm:GetParameter permissions for GitHub App credentials (app-id and app-key) - scoped to specific parameters
• 🔒 [security] New SSM parameter access permissions are appropriately scoped to specific GitHub App credential parameters in eu-central-1 region - follows least privilege principle
• ✅ [routine] No resources being created or destroyed - only in-place updates to existing Lambda functions and IAM policies
• ✅ [routine] No security group, network, or data store modifications - changes are isolated to compute and identity layers