feat: dynamic assume-role support, configurable placeholder image & install tofu consolidation#25

Draft

davidf-null wants to merge 24 commits into

mainfrom

feature/assume-role-support

Commits on Jun 1, 2026

feat: add dynamic assume role support via scope-configurations provider

David Fernandez
and
claude
committed
feat: add requirements module with IAM policies for Lambda scope operations

David Fernandez
and
claude
committed
chore: set ASSUME_ROLE_ARN_DEFAULT for testing

David Fernandez
and
claude
committed
fix: correct nullplatform provider version constraint in specs/tofu

David Fernandez
and
claude
committed
fix: surface sts:AssumeRole errors to stdout for visibility in NP logs

David Fernandez
and
claude
committed
fix: use exact PLACEHOLDER_IMAGE_URI when explicitly set, skip arch suffix

David Fernandez
and
claude
committed
fix: remove automatic arch suffix from placeholder image URI

David Fernandez
and
claude
committed
fix: read TOFU_STATE_BUCKET from .provider.aws_state_bucket as fallback

David Fernandez
and
claude
committed

Commits on Jun 2, 2026

fix(iam): prefix lambda execution role with np-lambda- to match requirements policy

David Fernandez
and
claude
committed
fix(tofu): surface tofu apply stderr to stdout for visibility in NP logs

David Fernandez
and
claude
committed
fix(iam): add modern CloudWatch Logs tagging actions to lambda requirements policy

David Fernandez
and
claude
committed
feat(placeholder): make placeholder image configurable via PLACEHOLDER_IMAGE_URI_DEFAULT

David Fernandez
and
claude
committed
fix(deploy): ensure Lambda pull policy on the image's ECR repo before update

David Fernandez
and
claude
committed
fix(deploy): add missing diagnose.yaml workflow for diagnose-deployment action

David Fernandez
and
claude
committed
chore: remove account-specific defaults from values.yaml

David Fernandez
and
claude
committed

Commits on Jun 3, 2026

docs: explain placeholder image config and restore PLACEHOLDER_IMAGE_URI_DEFAULT knob

David Fernandez
and
claude
committed

Commits on Jun 4, 2026

refactor(setup): consolidate install tofu under lambda/setup and merge requirements

David Fernandez
and
claude
committed

Commits on Jun 8, 2026

feat(assume-role): resolve role ARN from nullplatform IAM provider by selector

David Fernandez
and
claude
committed
chore(values): set PLACEHOLDER_IMAGE_URI_DEFAULT for this installation

David Fernandez
and
claude
committed

Commits on Jun 9, 2026

feat(workflows): assume IAM role via dedicated first step in every workflow

David Fernandez
and
claude
committed
feat(iam): make Lambda execution-role prefix configurable

David Fernandez
and
claude
committed
chore(do_tofu): remove the stderr-redirect explanation comment

David Fernandez
and
claude
committed
refactor: move install tofu module from lambda/setup to lambda/specs/tofu

David Fernandez
and
claude
committed

Commits on Jun 10, 2026

fix(specs/tofu): bump aws provider constraint to ~> 6.47.0

David Fernandez
and
claude
committed