bin/aws-semaphore-agent.jsboots the CDK app and passes stack parameters.lib/hosts stack logic and helpers for AMI hashes, GitHub keys, and SSH key rotation.lambdas/packages runtime handlers (agent-scaler,az-rebalance-suspender,ssh-keys-updater) deployed with the stack.packer/contains OS-specific templates and Ansible roles; reuseci/build-ami.shfor repeatable builds.- Supporting automation lives in
ci/,goss/, and the Jest suite undertest/.
- Use
DOCUMENTATION.mdfor architecture context, dependency maps, and troubleshooting cues before triaging incidents or planning new work.
- Install dependencies with
npm installand export AWS credentials before invoking CDK. npm run synthemits the CloudFormation template intocdk.outfor fast validation.npm run diffcompares the stack with AWS; attach its output to infrastructure PRs.npm run deploy(ornpm run deploy:ci) pushes the stack; follow withnpm run destroyfor clean teardown.- AMIs are baked via
make packer.build PACKER_OS=linux UBUNTU_VERSION=noble SOURCE_AMI=ami-xxxxoncemake packer.validatesucceeds.
- JavaScript sources use 2-space indentation, single quotes, and
const/letsemantics; mirror the patterns inlib/*.js. - Export CommonJS modules via
module.exportsand match exports to filenames (for examplegithub-keys.jsexposesgithubKeys). - Keep new folders lowercase-hyphenated and favor small helpers over inline logic to retain declarative stacks.
- Use Jest (
npm test) with files suffixed.test.jsundertest/; follow the structure inargument-store.test.js. - Mock AWS services with CDK assertions or spies and avoid live AWS calls in unit suites.
- Add regression tests for every Lambda or stack behaviour change and run them locally before pushing.
- Follow the conventional commit style already in history (
feat(packer/linux): support jammy) to signal scope and intent. - Squash noisy work-in-progress commits before review; keep messages imperative and under 72 characters.
- PRs should include a succinct summary, relevant
npm run diffor Packer logs, linked issues, and note any operational impact.
- Never commit AWS credentials or Semaphore tokens; reference parameters managed in SSM or KMS instead.
- Keep
execution-policy.jsonand IAM statements least-privileged, and request review when adding new permissions or dedicated hosts.