feat!: use cloud-front function alongside with lamda-at-edge

Author: krishanthisera

.github/dependabot.yml

@@ -7,7 +7,13 @@ version: 2
 updates:
 - package-ecosystem: "npm" # See documentation for possible values
   directories:
-  - "modules/lambda-at-edge/edge-functions"
-  - "modules/lambda-at-edge/edge-functions/packages/**" # Location of package manifests
+  - "lib/lambda-at-edge"
+  - "lib/lambda-at-edge/packages/**"
+  - "lib/cloudfront-functions"
+  - "lib/cloudfront-functions/packages/**" # Location of package manifests
+  schedule:
+    interval: "weekly"
+- package-ecosystem: "github-actions"
+  directory: "/"
   schedule:
     interval: "weekly"

.github/workflows/release-cloudfront-functions.yml

@@ -23,13 +23,13 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
           persist-credentials: false
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
           node-version-file: lib/cloudfront-functions/.nvmrc
           registry-url: https://npm.pkg.github.com

.github/workflows/release-lambda-at-edge.yml

@@ -32,13 +32,13 @@ jobs:
           - response-handler
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
           persist-credentials: false
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
           node-version-file: lib/lambda-at-edge/.nvmrc
           registry-url: https://npm.pkg.github.com
@@ -52,6 +52,28 @@ jobs:
         run: yarn build
         working-directory: lib/lambda-at-edge
 
+      # --- S3 mirror publish (DISABLED) -------------------------------------
+      # This repo does not deploy the Lambda@Edge functions, so a release only
+      # publishes the npm tarball to GitHub Packages + a GitHub Release. The
+      # optional S3 mirror step -- which copied build/index.js to
+      # s3://$EDGE_ARTIFACTS_BUCKET/lambda-at-edge/<fn>/<version>.zip for the
+      # Terraform edge-functions module to deploy from -- is turned off in two
+      # coupled places; re-enable BOTH together:
+      #   1. this "Configure AWS credentials" step, and
+      #   2. the "@semantic-release/exec" plugin block in every
+      #      lib/lambda-at-edge/packages/*/.releaserc.json (currently removed).
+      # Keeping the exec block without these credentials makes `aws s3 cp` fail,
+      # which fails the whole semantic-release run (no npm publish either).
+      # Also needs repo secrets EDGE_PUBLISHER_AWS_ACCESS_KEY_ID /
+      # EDGE_PUBLISHER_AWS_SECRET_ACCESS_KEY and repo var EDGE_ARTIFACTS_BUCKET.
+      # - name: Configure AWS credentials
+      #   uses: aws-actions/configure-aws-credentials@v6
+      #   with:
+      #     aws-access-key-id: ${{ secrets.EDGE_PUBLISHER_AWS_ACCESS_KEY_ID }}
+      #     aws-secret-access-key: ${{ secrets.EDGE_PUBLISHER_AWS_SECRET_ACCESS_KEY }}
+      #     aws-region: us-east-1
+      # --------------------------------------------------------------------
+
       - name: Release
         run: npx --no-install semantic-release
         working-directory: lib/lambda-at-edge/packages/${{ matrix.package }}

.github/workflows/test.yml

@@ -3,29 +3,39 @@ name: Test
 on:
   push:
     branches:
-      - master
+      - main
   pull_request:
 
 jobs:
   test:
-    name: Run Tests
+    name: Run Tests (${{ matrix.workspace }})
     runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        workspace:
+          - lib/lambda-at-edge
+          - lib/cloudfront-functions
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
-          node-version: "20"
+          node-version-file: ${{ matrix.workspace }}/.nvmrc
           cache: yarn
-          cache-dependency-path: modules/lambda-at-edge/edge-functions/yarn.lock
+          cache-dependency-path: ${{ matrix.workspace }}/yarn.lock
 
       - name: Install dependencies
-        run: yarn install
-        working-directory: modules/lambda-at-edge/edge-functions
+        run: yarn install --frozen-lockfile
+        working-directory: ${{ matrix.workspace }}
+
+      - name: Build
+        run: yarn build
+        working-directory: ${{ matrix.workspace }}
 
       - name: Run tests
         run: yarn test
-        working-directory: modules/lambda-at-edge/edge-functions
+        working-directory: ${{ matrix.workspace }}

.gitignore

@@ -45,6 +45,12 @@ terraform.rc
 **/*.tgz
 **/.eslintcache
 
+# Exception: the built uri-rewrite CloudFront Function bundle is committed and
+# consumed directly by the edge-functions Terraform module (kept fresh by a
+# pre-commit hook).
+!lib/cloudfront-functions/packages/uri-rewrite/build/
+!lib/cloudfront-functions/packages/uri-rewrite/build/index.js
+
 # ---- OS / editor ----
 **/.DS_Store
 Thumbs.db

.pre-commit-config.yaml

@@ -10,12 +10,12 @@ repos:
     - --hook-config=--add-to-existing-file=true
     - --hook-config=--create-file-if-not-exist=true
   - id: terraform_docs
-    name: terraform_docs (lambda-at-edge module)
+    name: terraform_docs (edge-functions module)
     args:
     - --hook-config=--path-to-file=README.md
     - --hook-config=--add-to-existing-file=true
     - --hook-config=--create-file-if-not-exist=true
-    files: ^modules/lambda-at-edge/
+    files: ^modules/edge-functions/
   - id: terraform_providers_lock
     args:
     - --args=-platform=linux_amd64
@@ -26,3 +26,16 @@ repos:
   rev: v6.0.0
   hooks:
   - id: check-merge-conflict
+
+- repo: local
+  hooks:
+  # The edge-functions Terraform module consumes the committed uri-rewrite
+  # CloudFront Function bundle directly. Rebuild it from source on any change so
+  # the committed artifact is never stale.
+  - id: build-uri-rewrite
+    name: build uri-rewrite CloudFront Function
+    language: system
+    entry: make build-uri-rewrite-committed
+    pass_filenames: false
+    require_serial: true
+    files: ^lib/cloudfront-functions/(packages/uri-rewrite/(src/|esbuild\.js|package\.json|tsconfig\.json)|yarn\.lock|package\.json)

Makefile

@@ -4,6 +4,10 @@
 LAMBDA_DIR := lib/lambda-at-edge
 CF_DIR     := lib/cloudfront-functions
 
+LAMBDA_FUNCTIONS      := filter-function prerender-proxy geo-redirect response-handler
+SEED_VERSION          ?= 1.0.0
+EDGE_ARTIFACTS_BUCKET  ?= $(shell terraform output -raw edge_artifacts_bucket 2>/dev/null)
+
 ##@ General
 
 .PHONY: help
@@ -96,6 +100,11 @@ build-response-handler: ## Build response-handler (Lambda@Edge)
 build-uri-rewrite: ## Build uri-rewrite (CloudFront Function)
 	cd $(CF_DIR) && yarn workspace @krishanthisera/uri-rewrite build
 
+.PHONY: build-uri-rewrite-committed
+build-uri-rewrite-committed: ## Rebuild + stage the committed uri-rewrite bundle (used by pre-commit)
+	cd $(CF_DIR) && yarn install --frozen-lockfile --silent && yarn workspace @krishanthisera/uri-rewrite build
+	git add $(CF_DIR)/packages/uri-rewrite/build/index.js
+
 ##@ Lint
 
 .PHONY: lint
@@ -109,12 +118,16 @@ lint-fix: ## Run linters and fix issues (Lambda@Edge)
 ##@ Format
 
 .PHONY: format
-format: ## Check code formatting (Lambda@Edge)
+format: ## Check code formatting (Lambda@Edge + Terraform/HCL)
 	cd $(LAMBDA_DIR) && yarn format:check
+	@echo "Checking Terraform/HCL formatting..."
+	terraform fmt -check -recursive
 
 .PHONY: format-fix
-format-fix: ## Fix code formatting (Lambda@Edge)
+format-fix: ## Fix code formatting (Lambda@Edge + Terraform/HCL)
 	cd $(LAMBDA_DIR) && yarn format:fix
+	@echo "Formatting Terraform/HCL..."
+	terraform fmt -recursive
 
 ##@ Release
 
@@ -152,6 +165,19 @@ tf-docs: ## Regenerate Terraform documentation (requires terraform-docs)
 	terraform-docs markdown table --output-file README.md --output-mode inject .
 	terraform-docs markdown table --output-file modules/edge-functions/README.md --output-mode inject modules/edge-functions
 
+.PHONY: mirror-seed
+mirror-seed: build-lambda ## One-time: upload locally-built Lambda@Edge bundles to the artifacts bucket (EDGE_ARTIFACTS_BUCKET=... , SEED_VERSION=1.0.0)
+	@test -n "$(EDGE_ARTIFACTS_BUCKET)" || { echo "EDGE_ARTIFACTS_BUCKET is empty - apply the bucket first or pass it explicitly"; exit 1; }
+	@for fn in $(LAMBDA_FUNCTIONS); do \
+		tmp=$$(mktemp -d); \
+		cp $(LAMBDA_DIR)/packages/$$fn/build/index.js $$tmp/index.js; \
+		( cd $$tmp && zip -q fn.zip index.js ); \
+		echo "-> s3://$(EDGE_ARTIFACTS_BUCKET)/lambda-at-edge/$$fn/$(SEED_VERSION).zip"; \
+		aws s3 cp $$tmp/fn.zip s3://$(EDGE_ARTIFACTS_BUCKET)/lambda-at-edge/$$fn/$(SEED_VERSION).zip; \
+		rm -rf $$tmp; \
+	done
+	@echo "✓ seeded $(LAMBDA_FUNCTIONS) at $(SEED_VERSION)"
+
 ##@ Development
 
 .PHONY: dev
@@ -184,6 +210,8 @@ clean: ## Clean build artifacts
 	cd $(LAMBDA_DIR) && rm -rf packages/*/build function_archives .turbo packages/*/.turbo
 	@echo "Cleaning CloudFront Functions build artifacts..."
 	cd $(CF_DIR) && rm -rf packages/*/build .turbo packages/*/.turbo
+	@echo "Restoring the committed uri-rewrite bundle (consumed by Terraform)..."
+	cd $(CF_DIR) && yarn workspace @krishanthisera/uri-rewrite build
 	@echo "✓ Build artifacts cleaned"
 
 .PHONY: clean-all