Prepare forms-processor-v6 develop deployment with OIDC v2.0.5

.circleci/config.yml

@@ -1,107 +1,143 @@
 version: 2.1
-
-jobs:
-  quality:
+executors:
+  reviewed:
     docker:
-      - image: node:26.8.1-bookworm
-      - image: postgres:16-alpine
-        environment:
-          POSTGRES_PASSWORD: forms_local
-          POSTGRES_DB: forms_processor_test
-    environment:
-      TEST_DATABASE_URL: postgresql://postgres:forms_local@localhost:5432/forms_processor_test
+    - image: cimg/aws@sha256:4cf3768db00ddf9bc439b8c84e8a60c11a14edf81c8baf76f74132144f8340d5
+commands:
+  checkout-source:
     steps:
-      - checkout
-      - run: npm ci
-      - run:
-          name: Lint, type-check, test routing and retries, and compile
-          command: |
-            npm run lint
-            npm run typecheck
-            npm test
-            npm run test:integration
-            npm run build
-  deployment-checks:
-    docker:
-      - image: cimg/python:3.13.2
+    - run:
+        name: Check out the exact public source commit over HTTPS
+        command: |
+          set -euo pipefail
+          [[ "$CIRCLE_SHA1" =~ ^[0-9a-f]{40}$ ]]
+          export GIT_CONFIG_NOSYSTEM=1 GIT_CONFIG_GLOBAL=/dev/null GIT_TERMINAL_PROMPT=0
+          git init --quiet .
+          git remote add origin https://github.com/topcoder-platform/forms-processor-v6.git
+          git -c credential.helper= fetch --quiet --depth 1 origin "$CIRCLE_SHA1"
+          git checkout --quiet --detach FETCH_HEAD
+          test "$(git rev-parse HEAD)" = "$CIRCLE_SHA1"
+  checkout-suite:
+    steps:
+    - run:
+        name: Verify deployment suite v2.0.5
+        command: |
+          set -euo pipefail
+          git init --quiet /tmp/tc-deploy-scripts
+          git -C /tmp/tc-deploy-scripts remote add origin https://github.com/topcoder-platform/tc-deploy-scripts.git
+          git -C /tmp/tc-deploy-scripts fetch --quiet --depth 1 origin refs/tags/v2.0.5
+          git -C /tmp/tc-deploy-scripts checkout --quiet --detach FETCH_HEAD
+          test "$(git -C /tmp/tc-deploy-scripts rev-parse HEAD)" = bff574ab5c0b46773e25d2af1eff76675fba2ba5
+jobs:
+  build:
+    executor: reviewed
     steps:
-      - checkout
-      - run: pip install boto3
-      - run: python3 -m unittest discover -s deploy/tests
+    - checkout-source
+    - setup_remote_docker
+    - checkout-suite
+    - run:
+        name: Build committed source without AWS or broker credentials
+        command: |
+          set -euo pipefail
+          python3 -I /tmp/tc-deploy-scripts/build_image.py --dockerfile Dockerfile --image forms-processor-v6:candidate
+          mkdir -p /tmp/release
+          docker save --output /tmp/release/image.tar forms-processor-v6:candidate
+        no_output_timeout: 30m
+    - persist_to_workspace:
+        root: /tmp/release
+        paths:
+        - image.tar
   deploy:
-    docker:
-      - image: cimg/python:3.13.2-browsers
+    executor: reviewed
     parameters:
-      deploy_env:
-        type: enum
-        enum: [DEV, PROD]
       environment:
         type: enum
-        enum: [dev, production]
+        enum:
+        - dev
+        - prod
     environment:
-      AWS_REGION: us-east-1
-      AWS_DEFAULT_REGION: us-east-1
-      AWS_STS_REGIONAL_ENDPOINTS: regional
-      AWS_RETRY_MODE: standard
-      AWS_MAX_ATTEMPTS: "10"
-      APPNAME: forms-processor-v6
-      DEPLOY_ENV: << parameters.deploy_env >>
-      DEPLOYMENT_ENVIRONMENT: << parameters.environment >>
+      DEPLOY_ENV: << parameters.environment >>
+    steps:
+    - checkout-source
+    - setup_remote_docker
+    - checkout-suite
+    - attach_workspace:
+        at: /tmp/release
+    - run:
+        name: Promote a scanned digest with repository-bound OIDC
+        command: |
+          set +x
+          set -euo pipefail
+          test -f "deploy/${DEPLOY_ENV}.json"
+          docker load --input /tmp/release/image.tar
+          python3 -I deploy/release.py "deploy/${DEPLOY_ENV}.json"
+        no_output_timeout: 45m
+  quality:
+    docker:
+    - image: node@sha256:9f94d34c787165dca03b74e5bf9c3bf90e8de79b19aa3d87fe1fa1694bf75c89
+    - image: postgres@sha256:0cefaabd882e42bcb2a2f3dc56d3ce4770560ba62fd7f197f1a2e008fd5731ab
+      environment:
+        POSTGRES_PASSWORD: forms_local
+        POSTGRES_DB: forms_processor_test
+    environment:
+      TEST_DATABASE_URL: postgresql://postgres:forms_local@localhost:5432/forms_processor_test
+    steps:
+    - checkout-source
+    - run: npm ci --install-links=true
+    - run:
+        name: Lint, type-check, test routing and retries, and compile
+        command: |
+          npm run lint
+          npm run typecheck
+          npm test
+          npm run test:integration
+          npm run build
+  deployment-checks:
+    executor: reviewed
     steps:
-      - checkout
-      - setup_remote_docker
-      - run:
-          name: Install deployment dependencies
-          command: |
-            sudo apt-get update -qq
-            sudo apt-get install -y -qq jq python3-pip
-            pip install boto3 awscli
-      - run:
-          name: Install the pinned Topcoder AWS credential helper
-          command: |
-            git -c advice.detachedHead=false clone --quiet --depth 1 --branch v1.4.20 https://github.com/topcoder-platform/tc-deploy-scripts ../buildscript
-            test "$(git -C ../buildscript rev-parse HEAD)" = 5f3745c35463ce0e2475c12269aa7a2b446456e5
-            cp ../buildscript/awsconfiguration.sh .
-      - run:
-          name: Build tested runtime image
-          command: docker buildx build --load --tag "${APPNAME}:candidate" .
-      - run:
-          name: Deploy a new task revision to the existing ECS service
-          no_output_timeout: 35m
-          command: |
-            set -euo pipefail
-            set +x
-            trap 'rm -f awsenvconf awsconfiguration.sh' EXIT
-            ./awsconfiguration.sh "$DEPLOY_ENV" "$AWS_REGION"
-            source awsenvconf
-            python3 -u deploy/release.py "$DEPLOYMENT_ENVIRONMENT" "${DEPLOYMENT_ENVIRONMENT}-${CIRCLE_SHA1}-${CIRCLE_BUILD_NUM}"
-      - store_artifacts:
-          path: deploy/release-<< parameters.environment >>.json
-          destination: release
+    - checkout-suite
+    - run:
+        name: Test the pinned deployment security and rollout checks
+        command: python3 -m unittest discover -s /tmp/tc-deploy-scripts/tests -q
 workflows:
-  build-and-deploy:
+  release:
     jobs:
-      - quality
-      - deployment-checks
-      - deploy:
-          name: deploy-dev
-          context: org-global
-          requires: [quality, deployment-checks]
-          deploy_env: DEV
-          environment: dev
-          serial-group: << pipeline.project.slug >>/deploy-dev
-          filters:
-            branches:
-              only: develop
-            tags:
-                only: /^dev-.*/
-      - deploy:
-          name: deploy-production
-          context: org-global
-          requires: [quality, deployment-checks]
-          deploy_env: PROD
-          environment: production
-          serial-group: << pipeline.project.slug >>/deploy-production
-          filters:
-            branches:
-              only: master
+    - quality
+    - deployment-checks
+    - build:
+        requires:
+        - quality
+        - deployment-checks
+    - deploy:
+        name: deploy-dev
+        environment: dev
+        requires:
+        - build
+        context: forms-processor-v6-dev-deploy
+        serial-group: << pipeline.project.slug >>/deploy-dev
+        filters:
+          branches:
+            only: develop
+          tags:
+            ignore: /.*/
+    - approve-prod:
+        type: approval
+        requires:
+        - build
+        filters:
+          branches:
+            only: master
+          tags:
+            ignore: /.*/
+    - deploy:
+        name: deploy-prod
+        environment: prod
+        requires:
+        - approve-prod
+        context: forms-processor-v6-prod-deploy
+        serial-group: << pipeline.project.slug >>/deploy-prod
+        filters:
+          branches:
+            only: master
+          tags:
+            ignore: /.*/

.gitignore

@@ -8,3 +8,7 @@ awsenvconf
 awsconfiguration.sh
 __pycache__/
 deploy/release-*.json
+
+# Infrastructure definitions and detailed AWS inventories are maintained privately.
+/deploy/iam/
+/deploy/*-baseline.json

Dockerfile

@@ -1,14 +1,14 @@
 ARG NODE_VERSION=26.12.1
 FROM node:${NODE_VERSION}-alpine AS build
 WORKDIR /app
-COPY package.json package-lock.json .npmrc ./
+COPY package.json package-lock.json ./
 COPY tools ./tools
-RUN npm ci
+RUN npm ci --install-links=true
 COPY . .
 RUN npm run lint && npm run typecheck && npm test && npm run test:dependency-compat && npm run build
 
 FROM build AS production-dependencies
-RUN npm prune --omit=dev
+RUN npm prune --install-links=true --omit=dev
 
 FROM alpine:3.24 AS runtime
 ARG NODE_VERSION

README.md

@@ -25,7 +25,7 @@ Submissions that do not opt in stay in the API and do not reach this processor.
 
 ```sh
 nvm use
-npm ci
+npm ci --install-links=true
 cp .env.example .env
 # Apply forms-api-v6 migrations to your local forms database first.
 npm run dev

deploy/MIGRATION.md

@@ -0,0 +1,42 @@
+# OIDC deployment migration
+
+This change replaces the Auth0 credential broker and SSM-to-shell deployment path with [tc-deploy-scripts v2.0.5](https://github.com/topcoder-platform/tc-deploy-scripts/releases/tag/v2.0.5), fetched by tag and verified against commit `bff574ab5c0b46773e25d2af1eff76675fba2ba5`. Build and deployment run in separate jobs. The deployer cannot read Parameter Store, Secrets Manager or decrypt KMS data, including through another assumed role. ECS continues resolving the existing runtime secret references using the execution role.
+
+## Production target
+
+The read-only inventory on 2026-11-03 verified account `409275337247`, cluster `topcoder-infrastructure`, service `forms-processor-v6`, family `forms-processor-v6`, and container `forms-processor-v6`. `prod.json` preserves the observed task/execution roles and names the proposed service-specific deployment role. [prod-baseline.json](https://github.com/topcoder-platform/v6-services-iac/blob/main/services/forms-processor-v6/deploy/prod-baseline.json) records references only; it contains no parameter values. Do not recreate the service or replace its complete task definition from this baseline.
+
+## Infrastructure prerequisites, applied separately by an administrator
+
+1. In each account, register the CircleCI OIDC issuer `https://oidc.circleci.com/org/947bef5e-1669-415d-b83c-4fc85155b7df` with client ID `947bef5e-1669-415d-b83c-4fc85155b7df`. The current production account has only the legacy Auth0 provider. Do not remove that provider until all its consumers have migrated.
+2. Review and install [iam/prod-role.cloudformation.json](https://github.com/topcoder-platform/v6-services-iac/blob/main/services/forms-processor-v6/deploy/iam/prod-role.cloudformation.json) with an administrator/IaC identity. It creates the proposed deployment role and applies the same least-privilege policy as a permissions boundary. The trust binds this CircleCI project, repository, checkout branch and configuration branch. It does not grant infrastructure creation to CircleCI. The role and matching boundary include `inspector2:ListFindings` and `inspector2:ListCoverage` restricted to the deployment region; these scan-metadata APIs require `Resource: "*"`. Secret-access denies remain explicit.
+3. Configure ECR repository `forms-processor-v6` with unconditional `IMMUTABLE` tags and supported scanning. Preserve existing enhanced scanning where enabled. Existing tags are not retagged. The release fails for MEDIUM/HIGH/CRITICAL/UNDEFINED findings, failed scans, or a mismatched digest.
+4. In the infrastructure that owns the task definition, add the reviewed container check from `prod-healthcheck.json`, keeping all roles, runtime secret references, resources, mounts and sidecars. Verify the health endpoint against the running container in dev first. Preserve circuit-breaker rollback and positive desired capacity. Remove any `RESET_DB` secret binding and plaintext secret environment entries before adoption. Keep the execution role's runtime read permissions scoped to the references that service needs.
+5. Create restricted `forms-processor-v6-dev-deploy` and `forms-processor-v6-prod-deploy` CircleCI contexts without Auth0/static AWS credentials. Restrict production to the reviewed `master` checkout and configuration ref, authorized operators, and approval job. Remove legacy credentials from project settings too: removing `org-global` alone does not remove project-level variables. Confirm `CIRCLE_OIDC_TOKEN_V3` is issued. Disable secret access for forks and SSH debugging in deployment jobs.
+
+## Development acceptance before merge/release
+
+Read-only inventory on 2026-11-04 verified `dev.json` against the actual development service, task/execution roles and image repositories. This PR targets `develop`. Matching IAM templates and detailed baselines remain private. **Keep this PR in draft until the service-specific prerequisites below are complete.** No AWS or CircleCI resources were provisioned by this refresh.
+
+- Install the service deployment role and matching permissions boundary.
+- Create the restricted empty CircleCI deployment context.
+
+Run the shared offline suite, validate the CircleCI config and IAM policies, and test a dev release plus an unhealthy-image rollback. Verify CloudTrail contains no SSM/Secrets Manager calls from the deployment principal. Remove its old broker grants only after migration. Check the runtime secret references and roles stayed unchanged. Production requires the manual approval job and a passing digest/scan/health verification.
+
+The pinned executor is `cimg/aws@sha256:4cf3768db00ddf9bc439b8c84e8a60c11a14edf81c8baf76f74132144f8340d5`. Python/AWS CLI/Buildx/Git compatibility was tested with the shared offline suite. No package installation or service build runs in the deployment job. The Dockerfile retains the existing in-image quality gates. This PR does not deploy, change IAM, rotate credentials, or claim a successful live rollout.
+
+## Processor release behavior
+
+Application lint/type checks, routing/retry unit tests, PostgreSQL integration tests and compilation remain prerequisites. Deployment tests now run the pinned shared security/rollout suite. The old SSM-discovery release implementation and its discovery-specific tests are replaced. Existing ECS runtime references are preserved byte-for-byte instead of discovering optional settings during a release; additions/removals belong in the infrastructure that owns the task. Forms API schema migration must still precede a processor release. Zero-capacity activation/bootstrap is an administrator operation: the deployer refuses it.
+
+## Infrastructure source
+
+IAM templates and detailed AWS baselines are maintained in the private [v6-services-iac service directory](https://github.com/topcoder-platform/v6-services-iac/tree/main/services/forms-processor-v6). Provision infrastructure separately with an administrator identity; application CI does not fetch that repository or install IAM. Required application manifests and health-check proposals remain here.
+
+## Dev branch refresh
+
+This PR targets `develop` and preserves its current application/dependency fixes. The shared suite is v2.0.5 (82 offline tests); service-specific adapters and their tests remain part of review. Keep this PR in draft until its documented infrastructure and integration prerequisites are met. Updating these files does not provision AWS or CircleCI resources.
+
+Source checkout uses the public HTTPS repository and verifies the exact CircleCI commit, avoiding dependency on failing SSH checkout keys. No GitHub token is added to build or deployment contexts.
+
+The credential-free builder rejects committed `.npmrc` files. Preserve the existing local compatibility dependencies with explicit `--install-links=true` npm options instead; do not reintroduce credential-capable npm configuration files.

deploy/dev-healthcheck.json

@@ -0,0 +1,14 @@
+{
+  "forms-processor-v6": {
+    "command": [
+      "CMD",
+      "node",
+      "-e",
+      "fetch('http://127.0.0.1:'+(process.env.PORT||3000)+'/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"
+    ],
+    "interval": 30,
+    "timeout": 5,
+    "retries": 3,
+    "startPeriod": 60
+  }
+}

deploy/dev.json

@@ -0,0 +1,19 @@
+{
+  "schemaVersion": 2,
+  "environment": "dev",
+  "accountId": "811668436784",
+  "region": "us-east-1",
+  "deployRoleArn": "arn:aws:iam::811668436784:role/forms-processor-v6-dev-deploy",
+  "taskRoleArn": "arn:aws:iam::811668436784:role/forms-processor-v6-dev-TaskRole-zeTo8YcPLgMU",
+  "executionRoleArn": "arn:aws:iam::811668436784:role/forms-processor-v6-dev-ExecutionRole-jvv8jQ05uWJh",
+  "cluster": "topcoder-infrastructure",
+  "service": "forms-processor-v6",
+  "taskFamily": "forms-processor-v6",
+  "circleciOrgId": "947bef5e-1669-415d-b83c-4fc85155b7df",
+  "circleciProjectId": "9abc16b0-0d52-490f-a4c0-6e3db3ede656",
+  "repository": "github.com/topcoder-platform/forms-processor-v6",
+  "branch": "develop",
+  "images": {
+    "forms-processor-v6": "forms-processor-v6"
+  }
+}

deploy/prod-healthcheck.json

@@ -0,0 +1,14 @@
+{
+  "forms-processor-v6": {
+    "command": [
+      "CMD",
+      "node",
+      "-e",
+      "fetch('http://127.0.0.1:'+(process.env.PORT||3000)+'/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"
+    ],
+    "interval": 30,
+    "timeout": 5,
+    "retries": 3,
+    "startPeriod": 60
+  }
+}

deploy/prod.json

@@ -0,0 +1,19 @@
+{
+  "schemaVersion": 2,
+  "environment": "prod",
+  "accountId": "409275337247",
+  "region": "us-east-1",
+  "deployRoleArn": "arn:aws:iam::409275337247:role/forms-processor-v6-prod-deploy",
+  "taskRoleArn": "arn:aws:iam::409275337247:role/forms-processor-v6-production-TaskRole-F7Uvj6UKRNRm",
+  "executionRoleArn": "arn:aws:iam::409275337247:role/forms-processor-v6-production-ExecutionRole-M3KAOLfyCIxx",
+  "cluster": "topcoder-infrastructure",
+  "service": "forms-processor-v6",
+  "taskFamily": "forms-processor-v6",
+  "circleciOrgId": "947bef5e-1669-415d-b83c-4fc85155b7df",
+  "circleciProjectId": "9abc16b0-0d52-490f-a4c0-6e3db3ede656",
+  "repository": "github.com/topcoder-platform/forms-processor-v6",
+  "branch": "master",
+  "images": {
+    "forms-processor-v6": "forms-processor-v6"
+  }
+}