[sgtoj]

Summary

This updates the module to deploy github-ops-app v1 (cruxstack/github-ops-app#28). It brings the module in line with the recent cruxstack Terraform module refactors, and fixes several bugs in the module itself. It contains breaking changes and will release as v1.0.0; the README's "Upgrading to v1" section lists them.

Merge order: app_version defaults to v1.0.0, the tag github-ops-app#28 will release. Merge and release that PR first, or a default build will fail to find the tag.

The PR has three commits:

• ci: pinned actions; terraform fmt, validate, and test plus tflint and example validation on every PR; dependabot (there was no config); and a fix to the release rules that turned breaking changes into minor versions.
• feat!: the module changes below.
• docs: the README.

Build

• The function is built with the cruxstack/buildkit provider instead of the docker-based artifact packager, as in the other modules. A removed block forgets the packager's resources from existing state instead of destroying them.
• source_code_hash is now set. In v0 a rebuilt binary never redeployed, because the function's file path didn't change.
• The binary is built for the function's architecture, now arm64 by default. v0 always built amd64, so an arm64 function couldn't start.
• The app version is pinned to v1.0.0, built with Go 1.27 and the lambda.norpc tag. GOTOOLCHAIN=auto lets newer app versions build.

github-ops-app v1

• Okta key ID: passed as APP_OKTA_PRIVATE_KEY_ID. v0 set APP_OKTA_KEY_ID, which the app never read.
• Sync rules: typed and validated like the app validates them, with unset fields left out of the JSON. The v0 example's rules used fields the app ignores, so they did nothing.
• github_user_field: defaults to githubUsername, as in the app. The old default, login, is usually an email address.
• Installation ID: installation_id is optional.
• New inputs and settings: base_url (GitHub Enterprise Server), Okta scopes, and log_level, plus APP_PUBLIC_URL, which the module sets for the app.
• Installer: with installer_config.enabled, the function serves /setup, creates the GitHub App, and saves its credentials to SSM under the prefix. The role may write only there.

Secrets

Each secret the module passes to the function is now an SSM SecureString parameter, and the function gets its ARN. Before, the GitHub and Okta private keys and the webhook secret, Slack token, and admin token were plaintext environment variables that anyone with lambda:GetFunctionConfiguration could read. Customer managed keys are supported. A secret given as a parameter ARN is passed as-is and made readable. ssm_config.store_secrets = false restores plain variables.

Fixes

• With stage_name = "$default", v0 set APP_BASE_PATH=/$default, which broke every route.
• The webhook_url output had a double slash with $default.
• The PR bypass footer note was only sent when a PR bypass channel was also set.
• A disabled module (enabled = false) failed to plan.
• Enabling a schedule without its feature is now an error.

The default timeout is now 600 seconds so a full sync can finish. API Gateway routes are throttled, and CORS is removed because webhooks don't use it.

Testing

• terraform test passes all 15 runs with mocked providers. They cover the environment mapping for each feature, the secret storage modes, installer mode and its IAM, the $default stage, a disabled module, and validation errors.
• terraform fmt -check, terraform validate, and tflint 0.63.1 are clean, and the complete example validates.
• The Dockerfile was built for real against github-ops-app#28's branch. It produced a package.zip with a static arm64 bootstrap.
• I have not applied the module to an AWS account.

🤖 Generated with Claude Code