feat(cdk): Provision ECS infrastructure for tag page rendering CODE by akash1810 · Pull Request #16321 · guardian/dotcom-rendering

akash1810 · 2026-07-03T08:36:50Z

Note

Recommended to review commit by commit.
These changes update CI quite significantly; building and pushing the image to ECS is now a mandatory step.
I've redeployed main in "dangerous" mode after successfully testing this. Consequently, the screenshots won't be seen in the AWS console now.
Once merged, any open feature branches must rebase against main to avoid deleting the ECS infrastructure.

What does this change?

This change provisions the infrastructure to run tag page rendering CODE on ECS and EC2 as target groups for a single load balancer. The load balancer is configured with traffic weighting. Initially 100% of traffic is routed to EC2. Once we have a way to deterministically route requests to target groups, we'll tweak the weighting.

Why?

This is the next step to running DCR on AWS ECS. It allows us to understand if we've got the ECS configuration correct. Once happy, we'll tweak the traffic weighting and make a plan to go to PROD. Such a plan could include running through the AWS ECS Workshop as an introduction to AWS ECS.

How has this change been tested?

I've successfully deployed to CODE. After this, we can see:

A new ECS cluster:
A new target group in the load balancer:
The new target is healthy:
Logs are also appearing in Central ELK:

Open questions

Are we able to identify the costs associated with these resources to compare them to the EC2 version?

akash1810 · 2026-07-03T08:43:57Z

+  container:
+    permissions:
+      packages: write
+    needs: [production-container]
+    uses: ./.github/workflows/container.yml
+    with:
+      production-image-digest: ${{ needs.production-container.outputs.imageDigest }}


This container step is what runs cdk synth. This container is published to GitHub Packages and is used by the Commercial CI checks. I think there's an opportunity to simplify CI (as a separate task) by having the Commercial CI checks use the "production container". This would mean running cdk synth in a discrete step too, for improved readability.

fyi @guardian/commercial-dev

github-actions · 2026-07-03T08:45:21Z

Deploy build 28878 of `dotcom:rendering-all` to CODE

All deployment options

From guardian/actions-riff-raff.

github-actions · 2026-07-07T14:29:49Z

Deploy build 2073 of `dotcom:ab-testing` to CODE

All deployment options

From guardian/actions-riff-raff.

akash1810 · 2026-07-07T15:13:42Z

+        "DefaultActions": [
+          {
+            "ForwardConfig": {
+              "TargetGroups": [
+                {
+                  "TargetGroupArn": {
+                    "Ref": "TargetGroupTagpagerendering42E428EE",
+                  },
+                  "Weight": 1,
+                },
+                {
+                  "TargetGroupArn": {
+                    "Ref": "EcsTargetGroupTagpagerendering06213654",
+                  },
+                  "Weight": 0,
+                },
+              ],
+            },
+            "Type": "forward",
+          },
+        ],


This part configures the weighted routing. 100% of traffic goes to the EC2 target group and 0% to the ECS target group.

akash1810 · 2026-07-07T15:14:03Z

+				// Route all traffic to EC2
+				targetGroupWeights: {
+					ec2: 1,
+					ecs: 0,
+				},


This part configures the weighted routing. 100% of traffic goes to the EC2 target group and 0% to the ECS target group.

akash1810 · 2026-07-07T15:14:50Z

 					artifactsBucket,
 				}),
 			},
+			...(!(imageIdentifier == null) && {


Currently, this condition evaluates to true for tag-page-rendering CODE as it sets imageIdentifier within bin/cdk.ts.

Copilot

Pull request overview

Provisions ECS (Fargate) infrastructure for tag-page-rendering in CODE alongside the existing EC2 deployment, attaching both target groups to a single ALB with weighted routing (initially 100% to EC2). It also wires CI to inject a production image digest into cdk synth, and adds a local docker-compose flow for running the production build.

Changes:

Add optional imageIdentifier support to CDK stack props to enable EC2+ECS “hybrid” mode and set ALB target-group weights.
Update CI workflow ordering so a production image digest is built/published first, then passed into the container build that runs make riffraff-bundle / cdk synth.
Add snapshot coverage for the ECS-enabled CODE stack and add a docker-compose file for local prod-build runs.

Reviewed changes

Copilot reviewed 6 out of 7 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
dotcom-rendering/cdk/lib/renderingStack.ts	Adds `imageIdentifier` and conditionally configures ECS + weighted target groups in the main stack.
dotcom-rendering/cdk/bin/cdk.ts	Exports CODE props and injects `IMAGE_DIGEST` into the stack config.
dotcom-rendering/cdk/lib/renderingStack.test.ts	Adds a snapshot test for the ECS-enabled Tag Page Rendering CODE stack.
dotcom-rendering/cdk/lib/snapshots/renderingStack.test.ts.snap	Updates snapshots to include the ECS-enabled CODE template output.
docker-compose.yaml	Adds local compose setup to run the production build and send a sample request after healthcheck.
.github/workflows/container.yml	Requires a production image digest input and passes it into the bundle generation step.
.github/workflows/cicd.yml	Reorders jobs so the production digest is produced first and then fed into the container workflow.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

arelra · 2026-07-08T15:38:21Z

 	scaling: { minimumInstances: 1, maximumInstances: 3 },
 	instanceType: InstanceType.of(InstanceClass.T4G, InstanceSize.SMALL),
-});
+	imageIdentifier: process.env.IMAGE_DIGEST ?? 'DEV',


Note: In CI this environment variable is going to be passed in via the job output production-container.outputs.imageDigest.

This is correct for CI in the "real-world" (bin/cdk.ts) 👍🏽 .

In the test context (renderingStack.test.ts), the string value is hard-coded to 'sha256:12345'. Doing so means the snapshot has a static value and so doesn't need updating each time an image is published.

akash1810 · 2026-07-09T08:08:13Z

I've rebased this with #16341. Whilst logs are appearing in Central ELK (see screenshot), deployment is now failing due to #16341 (comment).

I think we could wait for guardian/cdk#2933 to land before merging this.

This changes CI in a significant way - the production image is now built and published as the first step (~2 minutes). This is because we need to pass the image digest to CDK to inject into the CloudFormation template.

Update tag page rendering CODE to provision ECS infrastructure but route no traffic to it.

gu-prout · 2026-07-09T13:36:46Z

Seen on PROD (merged by @akash1810 15 minutes and 17 seconds ago) Please check your changes!

akash1810 added the feature Departmental tracking: work on a new feature label Jul 3, 2026

akash1810 commented Jul 3, 2026

View reviewed changes

akash1810 force-pushed the aa/tag-rendering-ecs branch 2 times, most recently from d34b39d to 8a2aea9 Compare July 7, 2026 14:27

akash1810 force-pushed the aa/tag-rendering-ecs branch 3 times, most recently from 48968fd to c03f9b0 Compare July 7, 2026 15:10

akash1810 commented Jul 7, 2026

View reviewed changes

akash1810 marked this pull request as ready for review July 7, 2026 15:37

akash1810 requested a review from a team as a code owner July 7, 2026 15:37

akash1810 added the run_chromatic Runs chromatic when label is applied label Jul 7, 2026

akash1810 commented Jul 7, 2026

View reviewed changes

Comment thread docker-compose.yaml

akash1810 force-pushed the aa/tag-rendering-ecs branch 2 times, most recently from 4721ad8 to eb2eadb Compare July 8, 2026 08:22

akash1810 requested a review from Copilot July 8, 2026 10:05

Copilot started reviewing on behalf of akash1810 July 8, 2026 10:06 View session

Copilot AI reviewed Jul 8, 2026

View reviewed changes

Comment thread dotcom-rendering/cdk/lib/renderingStack.ts Outdated

Comment thread dotcom-rendering/cdk/lib/renderingStack.ts

Comment thread dotcom-rendering/cdk/lib/renderingStack.test.ts

Comment thread docker-compose.yaml Outdated

akash1810 force-pushed the aa/tag-rendering-ecs branch from eb2eadb to cff3267 Compare July 8, 2026 11:29

akash1810 commented Jul 8, 2026

View reviewed changes

Comment thread dotcom-rendering/cdk/lib/renderingStack.ts

Comment thread dotcom-rendering/cdk/lib/renderingStack.test.ts

akash1810 force-pushed the aa/tag-rendering-ecs branch 2 times, most recently from 80d50c9 to 399de07 Compare July 8, 2026 15:12

arelra reviewed Jul 8, 2026

View reviewed changes

akash1810 marked this pull request as draft July 9, 2026 07:58

akash1810 force-pushed the aa/tag-rendering-ecs branch from 399de07 to 1e9dde8 Compare July 9, 2026 09:40

akash1810 added 3 commits July 9, 2026 13:11

test(cdk): Add a snapshot test for tag page rendering CODE

c1b9e60

ci: Pass ECR image digest to CDK

5d56731

This changes CI in a significant way - the production image is now built and published as the first step (~2 minutes). This is because we need to pass the image digest to CDK to inject into the CloudFormation template.

feat(cdk): Provision ECS infrastructure for tag page rendering CODE

936cb91

Update tag page rendering CODE to provision ECS infrastructure but route no traffic to it.

gu-prout Bot added Seen-on-PROD and removed Pending-on-PROD labels Jul 9, 2026

akash1810 mentioned this pull request Jul 28, 2026

feat: Route 100% of traffic for tag-page-rendering CODE to ECS #16375

Closed

Conversation

akash1810 commented Jul 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What does this change?

Why?

How has this change been tested?

Open questions

Uh oh!

akash1810 Jul 3, 2026

Choose a reason for hiding this comment

Uh oh!

arelra Jul 8, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented Jul 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Deploy build 28878 of dotcom:rendering-all to CODE

Uh oh!

github-actions Bot commented Jul 7, 2026

Deploy build 2073 of dotcom:ab-testing to CODE

Uh oh!

akash1810 Jul 7, 2026

Choose a reason for hiding this comment

Uh oh!

akash1810 Jul 7, 2026

Choose a reason for hiding this comment

Uh oh!

akash1810 Jul 7, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

arelra Jul 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

akash1810 Jul 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

akash1810 commented Jul 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

gu-prout Bot commented Jul 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

akash1810 commented Jul 3, 2026 •

edited

Loading

github-actions Bot commented Jul 3, 2026 •

edited

Loading

Deploy build 28878 of `dotcom:rendering-all` to CODE

Deploy build 2073 of `dotcom:ab-testing` to CODE

arelra Jul 8, 2026 •

edited

Loading

akash1810 Jul 8, 2026 •

edited

Loading

akash1810 commented Jul 9, 2026 •

edited

Loading