Fix production website deployment target

.github-env-master

@@ -1,5 +1,4 @@
-AWS_STATIC_SITE_URL=production-mlplatform-org
-CF_DIST_ID_STATIC_LO=E2U7UQCLK7G1EJ
-CLOUDFRONT_ADD_SECURITY_HEADERS_ARN=arn:aws:lambda:us-east-1:841045539419:function:cloudfront-add-security-headers:1
+AWS_STATIC_SITE_URL=mlplatform-org-prod-site
+CF_DIST_ID_STATIC_LO=E2QIA4CS9AW6Z5
 JEKYLL_ENV=production
 SITE_URL=production.mlplatform.org

.github-env-test

@@ -1,5 +1,2 @@
-AWS_STATIC_SITE_URL=mlplatform-org-prod-site
-CF_DIST_ID_STATIC_LO=E2QIA4CS9AW6Z5
-CLOUDFRONT_ADD_SECURITY_HEADERS_ARN=arn:aws:lambda:us-east-1:841045539419:function:cloudfront-add-security-headers:1
 JEKYLL_ENV=production
 SITE_URL=www.mlplatform-prev.org

.github/workflows/push.yml

@@ -29,8 +29,8 @@ jobs:
       - name: Configure AWS credentials
         uses: aws-actions/configure-aws-credentials@v4
         with:
-          role-to-assume: arn:aws:iam::841045539419:role/github-actions-oidc-role
-          aws-region: us-east-1
+          role-to-assume: arn:aws:iam::544678973306:role/Proj-github-actions-oidc-role
+          aws-region: eu-west-1
 
       - name: Initialise environment
         run: |
@@ -56,11 +56,12 @@ jobs:
       - name: Upload to S3
         run: ./tools/upload-to-s3-root.sh
 
-      - name: Set up Lambda redirect
-        run: ./tools/set-up-lambda-redirect.sh ${{ github.workspace }}/website
-
-      - name: Set up security headers
-        run: pipenv run python ./tools/lambda-security-headers.py
-
       - name: Invalidate CloudFront cache
         run: ./tools/invalidate-cloudfront.sh
+
+      - name: Verify deployed TOSA index
+        run: |
+          curl --fail --silent --show-error --location \
+            "https://${SITE_URL}/tosa/tosa_spec.html" \
+            --output /tmp/live-tosa-spec.html
+          cmp "${SITE_URL}/tosa/tosa_spec.html" /tmp/live-tosa-spec.html

.github/workflows/test.yml

@@ -1,10 +1,9 @@
-name: TestDeployment
+name: TestBuild
 
 on:
   workflow_dispatch:
 
 permissions:
-  id-token: write  # Required to request the OIDC token
   contents: read   # Required to check out the code
 
 # Cancel in-progress jobs or runs for the current workflow
@@ -24,12 +23,6 @@ jobs:
         with:
           path: website
 
-      - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@v4
-        with:
-          role-to-assume: arn:aws:iam::544678973306:role/Proj-github-actions-oidc-role
-          aws-region: eu-west-1
-
       - name: Initialise environment
         run: |
           cat ".github-env-test" >> $GITHUB_ENV
@@ -50,15 +43,3 @@ jobs:
 
       # - name: Check routing rules
       #   run: pipenv run ./tools/test-routing-rules.sh
-
-      - name: Upload to S3
-        run: ./tools/upload-to-s3-root.sh
-
-      # - name: Set up Lambda redirect
-      #   run: ./tools/set-up-lambda-redirect.sh ${{ github.workspace }}/website
-
-      # - name: Set up security headers
-      #   run: pipenv run python ./tools/lambda-security-headers.py
-
-      - name: Invalidate CloudFront cache
-        run: ./tools/invalidate-cloudfront.sh

README.md

@@ -75,13 +75,13 @@ For the Audience, select sts.amazonaws.com.
 
 Click Next.
 
-Attach Permissions: On the "Add permissions" page, search for and add the policies your workflow needs (e.g., AmazonS3FullAccess, AmazonEC2FullAccess). Note that AdministratorAccess is permissible but may be too broad.
+Attach a dedicated least-privilege policy for this deployment. The workflow needs permission to list the production bucket and to get, put, and delete objects in it. It also needs permission to create and read invalidations for the production CloudFront distribution. It does not need EC2 or administrator access.
 
-Security Best Practice: Always follow the principle of least privilege. It's better to create a custom policy with only the exact permissions your workflow needs, rather than using broad "FullAccess" policies.
+Restrict the role's OIDC trust policy to this repository and the `master` branch using the GitHub token subject `repo:MLPlatformWebsite/website:ref:refs/heads/master`. Do not grant every repository in the organisation access to the deployment role.
 
 Click Next.
 
-Name your role: github-actions-oidc-role.
+Give the role a deployment-specific name.
 
 Review and Create: Review the details and click Create role.
 

tools/upload-to-s3-root.sh

@@ -7,9 +7,10 @@ ls -l "$GITHUB_WORKSPACE/website/$SITE_URL"
 cd "$GITHUB_WORKSPACE/website/$SITE_URL" || exit 1
 # Sync HTML files with different cache settings. Using "no-cache" does *NOT* mean that the file is not
 # cached - it just forces the browser to do a quick check upstream to make sure that the page is valid.
-aws s3 sync --exclude "*" --include "*.html" --cache-control "no-cache, max-age=86400" ./ "s3://$AWS_STATIC_SITE_URL" --delete --no-progress | tee "/tmp/$GITHUB_SHA.tmp"
+# Preserve incident backups because they are operational recovery data, not generated site content.
+aws s3 sync --exclude "*" --include "*.html" --exclude "incident-backup/*" --cache-control "no-cache, max-age=86400" ./ "s3://$AWS_STATIC_SITE_URL" --delete --no-progress | tee "/tmp/$GITHUB_SHA.tmp"
 # Sync non-HTML files with "normal" cache settings.
-aws s3 sync --include "*" --exclude "*.html" --cache-control "public, max-age=86400" ./ "s3://$AWS_STATIC_SITE_URL" --delete --no-progress | tee -a "/tmp/$GITHUB_SHA.tmp"
+aws s3 sync --include "*" --exclude "*.html" --exclude "incident-backup/*" --cache-control "public, max-age=86400" ./ "s3://$AWS_STATIC_SITE_URL" --delete --no-progress | tee -a "/tmp/$GITHUB_SHA.tmp"
 # Run the metadata script to keep the search service happy about modification dates
 # for blogs and news.
 cd $DIR