Repository navigation
Replace ECS broker deployment with scoped OIDC and no parameter access - #178
Merged
Merged
Conversation
Prod - August 2026 Release 3
Fix build issue
[PROD] Update support links
…rdering [HOTFIX] PM-6007 - fix phase ordering when creating challenge
PM-6007 fix order on update -> HOTFIX master
Opportunities tweaks / Security updates
Default to new forums when creating challenge
October 2026 release 1
October 2026 Release 2
jmgasper
marked this pull request as ready for review
November 3, 2026 20:42
jmgasper
force-pushed
the
ecs-oidc-deployment-20261103
branch
from
November 3, 2026 21:25
b07133e to
1be1fe8
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Challenge API adopts separate credential-free builds and CircleCI OIDC deployment with the shared v2 suite. This PR targets
develop; production remains approval-gated onmaster. IAM templates and detailed baselines are maintained in the private v6-services-iac service directory, and have been removed from this PR branch's history.Release pin updated: this pipeline fetches tc-deploy-scripts v2.0.1 and verifies commit
4025ac9963c38581f6a19bc1369bf634b22e0245. The release includes merged PR #41, which accepts ECR's legitimate empty-findings response only with exact image identity, explicit empty results and complete pagination. Freshness/status/severity requirements and IAM permissions are unchanged. All 69 tests pass locally, in the pinned executor and in merged-commit GitHub CI. CircleCI configuration validation and the exact release checkout/commit check passed for this PR update.Dev prerequisites completed: account-level CircleCI provider and service-specific deployment role/boundary installed; ECR tags immutable without exclusions and enhanced continuous scanning preserved; container health check deployed with two healthy tasks and targets; empty dev context restricted to this project on develop, without SSH reruns or API-supplied configuration. The project environment-variable list is empty. The health-check rollout preserved the existing image, runtime roles, all secret references and service settings.
After merging to develop: verify fork-secret settings and actual OIDC v3 issuance/role assumption; run a fresh candidate image through the dev pipeline; and verify unhealthy-image rollback. The old image's scan is over 24 hours old and is still ineligible for release. No scan bypass is proposed. Production prerequisites remain separate.
Validation includes CircleCI config and release checkout verification, private IAM/CloudFormation validation and live permission simulations, and a completed administrator-applied health-check rollout. The new OIDC image-deployment pipeline and rollback test have not yet run. No credentials or parameter values are included in this PR. See
deploy/MIGRATION.mdand the private installation records for details.