Use team-prefixed names for ECR and ECS in CI workflows#96
Merged
Conversation
The boundary policy is tagged team=javabin (org default), not shared.
Instead of looking it up via iam:GetPolicy (which the cross-team deny
blocks), construct the deterministic ARN from the account ID and project.
- Remove data source from platform-data module
- Use expr:arn:aws:iam::${env:AWS_ACCOUNT_ID}:policy/... in registry
- Revert boundary.tf tags override (org default_tags are correct)
The gate was using the old per-app role pattern (javabin-ci-app-{repo}).
Updated to resolve team via GitHub API and assume javabin-ci-team-{team},
matching the broker's team-based model.
- Extract GitHub App auth + team resolution to shared/github.py
- Update ci_broker and apply_gate to use shared module
- Add SSM read permission for GitHub App credentials to gate role
- Switch both Lambda archives to source{} blocks for shared inclusion
docker-build: ECR repo is now {team}-{repo_name}, not just {repo_name}
ecs-deploy: ECS service is now {team}-{repo_name}
Both get the team from the broker output (already resolved via GitHub API).
Also moved all context expressions to env vars for injection safety.
Terraform Plan✅ No changes — infrastructure is up to date. Plan output |
Alexanderamiri
added a commit
that referenced
this pull request
May 9, 2026
## Summary
docker-build and ecs-deploy workflows used the bare repo name for ECR
repos and ECS services. With team-prefixed naming, they need
`{team}-{repo_name}`.
Both get the team from the CI broker output (already resolved via GitHub
API).
## Test plan
- [ ] Merge, retrigger test app CI — docker build should push to
`testteam-platform-test-app` ECR repo
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
docker-build and ecs-deploy workflows used the bare repo name for ECR repos and ECS services. With team-prefixed naming, they need
{team}-{repo_name}.Both get the team from the CI broker output (already resolved via GitHub API).
Test plan
testteam-platform-test-appECR repo