WIP: ryansquared/new-deployment-route-5-refactor #496

Draft

ryan wants to merge 13 commits from ryansquared/new-deployment-route-5-refactor into main

ryan commented

2026-10-21 00:04:29 +00:00

Owner

No description provided.

ryan added 12 commits

2026-10-21 00:04:29 +00:00

caution-deploy-aws: own the AWS deploy modules b9c4b84bd7

Move deployment.rs, ec2.rs, and network_policy.rs (plus their test modules
and golden testdata) out of api into a dedicated AWS deploy platform crate.
api re-exports `deployment` and `ec2` so existing crate:: paths keep working;
network_policy is used only within the moved code.

Re-applied on top of origin/main after the structural rebase proved infeasible.

enclave-{build,build-nitro}, docker-builder: split enclave-builder 23276475ad

Split the evolved enclave-builder into:
* docker-builder: the application Docker image build (docker.rs).
* enclave-build: the build-mechanism interface plus shared domain types
  (manifest, prebuilt components, archive helpers, artifact types).
* enclave-build-nitro: the Nitro EIF pipeline and the prepare-components bin.

Framework template lookups and fixtures point at src/enclave-build-nitro.
Re-applied on top of origin/main.

caution-deploy, caution-deploy-aws, enclave-build-nitro: add trait layer 3d421ea626

Re-apply the interface layer on origin/main:
* caution-deploy: EnclaveDeployer, DeployArtifacts, DeployError, DeploymentResult.
* AwsNitroDeployer builds the NitroDeploymentRequest from the whole
  ConfigurationFile (shared with the deployment-lifecycle candidates via
  build_request) and consumes the mechanism-provided user-data template.
* NitroEifMechanism implements ImageBuildMechanism (AWS only) and owns the
  Nitro user-data template; dev provisioning now takes request.user_data and
  fails with MissingUserData when absent.

api: dispatch deploy through AwsNitroDeployer with a platform guard 5d688291a3

The deploy handler now derives the platform from the ConfigurationFile, checks
the build mechanism supports it and matches the deployer, builds the AWS
request via AwsNitroDeployer::build_request (also used by candidate
provisioning), and calls AwsNitroDeployer::deploy for the legacy path.

enclave-build-nitro, api: route the remote build helper through NitroEifMechanism 31a606f811

The helper now reads the enclave configuration from the checked-out repository
(CAUTION_REPO_DIR) and calls NitroEifMechanism::build with a BuildInput, instead
of receiving loose build parameters as environment variables. The API passes the
repo directory alongside the manifest.

api: drop builder userdata wiring the helper no longer reads 9e953b4061

The remote helper derives build parameters from the repository configuration,
so the CAUTION_PORTS/HTTP_PORT/E2E_MODE/DOMAIN/HTTP_UPSTREAM_PROTOCOL/
KEY_EXCHANGE/ALLOW_PLAINTEXT_FALLBACK/LOCKSMITH/EGRESS/CORS_ORIGINS exports and
the matching BuildRequest fields are removed. E2E/LOCKSMITH/EGRESS shell vars
remain for component selection.

cli: route the local build through NitroEifMechanism 2a108aac0e

build_local now constructs a BuildInput and calls NitroEifMechanism::build with
the whole ConfigurationFile instead of extracting loose fields and calling
EnclaveBuilder directly, matching the deploy and remote-helper paths.

cli: remove now-unused BuildLocalError variants 0b9238cd2d

containerfiles, Makefile, docs, {enclave-build-nitro,caution-deploy-aws}: fix refactor fallout b20a3f5a45

Round-1 review fixes:
* Containerfile.api builds enclave-build-nitro and copies the relocated
  src/enclave-build-nitro/templates (CAUTION_TEMPLATES_DIR) — a clean image
  build was broken.
* Makefile target packages and the network-policy test move to their new homes.
* Framework template resolution falls back to the pre-rename
  src/enclave-builder/templates so manifests pinning an old framework commit
  still reproduce; covered by a unit test.
* provision_deployment now requires the mechanism-provided request.user_data
  (MissingUserData), matching the sibling provisioners.
* Docs/test comments drop the removed crate name.

caution-{config,deploy}, enclave-build-nitro, api, cli: validate network policy on build and deploy paths cbd871220e

caution-deploy-aws, enclave-build-nitro, api, docs: address review nits f3aca21872

cli: restore verbose build diagnostics in build_local 5e85380816

ryan force-pushed ryansquared/new-deployment-route-5-refactor from 5e85380816 to f1856be893

2026-10-21 03:51:25 +00:00

Compare

This pull request is marked as a work in progress.

View command line instructions