Feature/platform enhancements

.checkov.yml

@@ -0,0 +1,36 @@
+---
+# Checkov configuration for platform IaC scanning
+# https://www.checkov.io/5.Policy%20Language/Configuration%20Reference.html
+
+compact: true
+directory:
+  - .
+framework:
+  - cloudformation
+  - terraform
+  - github_actions
+skip-framework:
+  - dockerfile
+  - secrets
+  - serverless
+  - helm
+  - kubernetes
+  - bicep
+  - arm
+  - ansible
+
+skip-path:
+  - cdk.out
+  - node_modules
+  - .git
+  - dist
+  - coverage
+
+quiet: true
+soft-fail: false
+
+output:
+  - cli
+  - sarif
+
+summary-position: bottom

.editorconfig

@@ -0,0 +1,15 @@
+root = true
+
+[*]
+indent_style = space
+indent_size = 2
+end_of_line = lf
+charset = utf-8
+trim_trailing_whitespace = true
+insert_final_newline = true
+
+[*.md]
+trim_trailing_whitespace = false
+
+[*.{yml,yaml}]
+indent_size = 2

.eslintrc.json

@@ -0,0 +1,38 @@
+{
+  "root": true,
+  "parser": "@typescript-eslint/parser",
+  "parserOptions": {
+    "ecmaVersion": 2020,
+    "sourceType": "module",
+    "project": "./tsconfig.json"
+  },
+  "plugins": ["@typescript-eslint"],
+  "extends": [
+    "eslint:recommended",
+    "plugin:@typescript-eslint/recommended"
+  ],
+  "ignorePatterns": [
+    "dist/",
+    "cdk.out/",
+    "node_modules/",
+    "*.js",
+    "*.d.ts"
+  ],
+  "rules": {
+    "@typescript-eslint/no-unused-vars": ["warn", { "argsIgnorePattern": "^_" }],
+    "@typescript-eslint/explicit-function-return-type": "off",
+    "@typescript-eslint/no-explicit-any": "warn",
+    "@typescript-eslint/no-non-null-assertion": "warn",
+    "no-console": "off",
+    "prefer-const": "error",
+    "no-var": "error"
+  },
+  "overrides": [
+    {
+      "files": ["*.test.ts"],
+      "rules": {
+        "@typescript-eslint/no-explicit-any": "off"
+      }
+    }
+  ]
+}

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,37 @@
+## Description
+
+<!-- Provide a brief summary of the changes and the problem they solve. -->
+
+## Type of Change
+
+- [ ] Bug fix
+- [ ] New feature
+- [ ] Enhancement (improvement to existing functionality)
+- [ ] Documentation update
+- [ ] Refactoring / Tech debt
+- [ ] Dependency update
+- [ ] CI/CD change
+
+## Testing
+
+- [ ] `npm run build` passes
+- [ ] `npm test` passes
+- [ ] `npm run lint` passes (if applicable)
+- [ ] `npm run synth` passes (if applicable)
+
+## Platform Impact
+
+<!--
+Check any that apply and describe the impact:
+- Platform stack changes (lib/, bin/, packages/)
+- Application construct changes
+- CI/CD workflow changes
+- Documentation changes
+-->
+
+## Checklist
+
+- [ ] My code follows the project's code style
+- [ ] I have added tests that prove my fix/feature works
+- [ ] New and existing tests pass
+- [ ] I have updated documentation as needed

.github/dependabot.yml

@@ -0,0 +1,41 @@
+version: 2
+updates:
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+    open-pull-requests-limit: 10
+    labels:
+      - dependencies
+      - automerge
+    groups:
+      aws-cdk:
+        patterns:
+          - aws-cdk
+          - aws-cdk-lib
+          - cdk-nag
+      jest:
+        patterns:
+          - jest
+          - ts-jest
+          - "@types/jest"
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+    open-pull-requests-limit: 5
+    labels:
+      - dependencies
+      - github-actions
+
+  - package-ecosystem: terraform
+    directory: /terraform
+    schedule:
+      interval: weekly
+      day: monday
+    labels:
+      - dependencies
+      - terraform

.github/workflows/drift-detection.yml

@@ -0,0 +1,81 @@
+name: drift-detection
+
+on:
+  schedule:
+    - cron: '0 6 * * 1'
+  workflow_dispatch:
+    inputs:
+      environment:
+        description: 'Environment to check for drift'
+        required: true
+        default: 'dev'
+        type: choice
+        options:
+          - dev
+          - stage
+          - prod
+
+permissions:
+  contents: read
+  issues: write
+
+jobs:
+  detect-drift:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        environment: [dev, stage, prod]
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+
+      - name: Install deps
+        run: npm ci
+
+      - name: CDK synth
+        run: npm run synth
+
+      - name: Detect drift
+        id: drift-check
+        continue-on-error: true
+        run: |
+          echo "Checking for drift in ${{ matrix.environment }}..."
+          npx cdk diff -c platformEnv=${{ matrix.environment }} 2>&1 | tee drift-output.txt
+
+          if grep -q "There were no differences" drift-output.txt; then
+            echo "drift=false" >> "$GITHUB_OUTPUT"
+            echo "No drift detected in ${{ matrix.environment }}"
+          else
+            echo "drift=true" >> "$GITHUB_OUTPUT"
+            echo "Drift detected in ${{ matrix.environment }}"
+          fi
+
+      - name: Create drift issue
+        if: steps.drift-check.outputs.drift == 'true'
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const fs = require('fs');
+            const driftOutput = fs.readFileSync('drift-output.txt', 'utf8');
+            const body = `## Drift Detected in ${{ matrix.environment }}
+
+            Drift was detected during the scheduled drift detection run.
+
+            \`\`\`
+            ${driftOutput}
+            \`\`\`
+
+            **Action Required**: Review the changes and determine if they are expected or if remediation is needed.
+            `;
+            await github.rest.issues.create({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              title: `[Drift] Infrastructure drift detected in ${process.env['ENVIRONMENT']}`,
+              body: body,
+              labels: ['drift', 'platform']
+            });

.github/workflows/platform-iac-cd.yml

@@ -0,0 +1,124 @@
+name: platform-iac-cd
+
+on:
+  push:
+    branches: [ main ]
+    paths:
+      - 'platform/**'
+      - 'packages/**'
+      - 'lib/**'
+      - 'bin/**'
+      - 'package.json'
+      - 'package-lock.json'
+      - '.github/workflows/platform-iac-cd.yml'
+
+permissions:
+  contents: read
+  id-token: write
+
+jobs:
+  diff:
+    runs-on: ubuntu-latest
+    outputs:
+      stacks: ${{ steps.cdk-diff.outputs.stacks }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+
+      - name: Install deps
+        run: npm ci
+
+      - name: CDK synth
+        run: npm run synth
+
+      - name: CDK diff
+        id: cdk-diff
+        run: |
+          npx cdk diff --fail 2>&1 | tee cdk-diff-output.txt || true
+          if grep -q "There were no differences" cdk-diff-output.txt; then
+            echo "stacks=[]" >> "$GITHUB_OUTPUT"
+          else
+            echo "stacks=changed" >> "$GITHUB_OUTPUT"
+          fi
+
+  deploy-dev:
+    needs: diff
+    if: needs.diff.outputs.stacks != '[]'
+    runs-on: ubuntu-latest
+    environment: dev
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+
+      - name: Install deps
+        run: npm ci
+
+      - name: CDK deploy to dev
+        run: npx cdk deploy --all --require-approval never -c platformEnv=dev
+        env:
+          AWS_REGION: us-east-1
+
+  deploy-stage:
+    needs: deploy-dev
+    runs-on: ubuntu-latest
+    environment: stage
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+
+      - name: Install deps
+        run: npm ci
+
+      - name: CDK synth stage
+        run: npx cdk synth -c platformEnv=stage
+
+      - name: CDK deploy to stage
+        run: npx cdk deploy --all --require-approval never -c platformEnv=stage
+        env:
+          AWS_REGION: us-east-1
+
+  deploy-prod:
+    needs: deploy-stage
+    runs-on: ubuntu-latest
+    environment: prod
+    concurrency: prod-deploy
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+
+      - name: Install deps
+        run: npm ci
+
+      - name: CDK synth prod
+        run: npx cdk synth -c platformEnv=prod
+
+      - name: Manual approval gate
+        uses: trstringer/manual-approval@v1
+        with:
+          secret: ${{ secrets.GITHUB_TOKEN }}
+          approvers: ${{ vars.PROD_APPROVERS }}
+
+      - name: CDK deploy to prod
+        run: npx cdk deploy --all --require-approval never -c platformEnv=prod
+        env:
+          AWS_REGION: us-east-1