liamjd/SBOMViewer
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

infra #2

Merged
liamjd merged 4 commits from infra into main 2026-07-27 20:40:32 +01:00
Conversation 0 Commits 4 Files changed 9 +362
liamjd commented 2026-07-27 20:39:25 +01:00
Owner
Copy link

Build basic AWS infrastructure with S3 bucket using Opentofu

Build basic AWS infrastructure with S3 bucket using Opentofu
One bucket in eu-west-2 serving the built SPA through S3 static website
hosting, plus a deploy IAM user. index.html is both index and error
document, which is what makes SPA deep links resolve and what
adapter-static's fallback was configured to pair with.

No CloudFront, per the deployment decision: the site is therefore HTTP
only on an amazonaws.com hostname with no custom certificate. Nothing
sensitive crosses the wire — BOMs never leave the browser — but the app
itself is served over plaintext, so the README states the tradeoff rather
than leaving it implicit.

Website hosting needs anonymous reads, so the public-access block lifts
only block_public_policy and restrict_public_buckets; ACLs stay disabled
under BucketOwnerEnforced and the bucket policy is the sole public grant.

The deploy user's access key is deliberately not a resource here — that
secret would land in terraform.tfstate in plaintext, and state is local.
README documents creating it out of band, along with the two-pass sync
that caches hashed assets forever and index.html never.

Provider lock file is committed so CI resolves the same versions.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Runs on pushes to main and on demand. Lints, type-checks, tests, builds,
then syncs build/ to the S3 website bucket. Reads AWS_ACCESS_KEY_ID and
AWS_SECRET_ACCESS_KEY from repository secrets — the names the AWS CLI
reads from the environment, so no mapping step is needed. Region and
bucket are not secret and stay inline.

The sync is three passes because order decides what a visitor sees
mid-deploy. Hashed assets upload first, adding only; then index.html
swaps, which is the moment the new version goes live; then the previous
build's assets are pruned, once nothing references them. Doing it in one
pass with --delete would briefly serve an index.html whose assets are
either missing or already deleted.

Checks run before the sync deliberately: there is no staging bucket and
no rollback, so a broken build would otherwise replace a working site.

pnpm is pinned via packageManager so corepack resolves the same version
CI and local development use.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
liamjd merged commit 65897a9696 into main 2026-07-27 20:40:32 +01:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
liamjd/SBOMViewer!2
No description provided.