buildspec.yml

version: 0.2

# This CodeBuild project is run manually, on demand.
# Its only job is to execute the Python entry point (main.py), which reads the
# campaign JSON file from the repository and upserts it into Cascade CMS.
#
# The pipeline's CodeBuild project is configured with BuildSpec = "buildspec.yml"
# (resolved relative to the source root), so this file and main.py live at the
# repository root.
#
# BUILD ENVIRONMENT VARIABLES are supplied by the Pipeline/CodeBuild project.
# You can view them in the AWS Console (CodeBuild > Projects > [build run] >
# Environment Variables) or by running `printenv` during a build.
#
# The Cascade API key is stored as an SSM SecureString under the parameter-store
# hierarchy the CodeBuild role is already allowed to read
# (${PARAM_STORE_HIERARCHY}, e.g. /sam-sandbox/<STAGE>/<prefix>-<projectid>-<stageid>/).
# We fetch it with the AWS CLI in the build phase (where ${...} expands) rather
# than via env.parameter-store, which cannot interpolate the hierarchy.

phases:
  install:
    runtime-versions:
      python: latest
    commands:
      # Build environment information for debugging purposes
      - python3 --version
      - aws --version

  build:
    commands:
      # Fetch + decrypt the Cascade API key from SSM into CASCADE_API_KEY.
      # main.py / utils/services.py read this env var first (then fall back to
      # .env for local dev). The role already has read access to this hierarchy.
      # The resolved value is never echoed, so it stays out of the build log.
      - export CASCADE_API_KEY=$(aws ssm get-parameter --name "${PARAM_STORE_HIERARCHY}CascadeApiKey" --with-decryption --query Parameter.Value --output text)
      # Run the on-demand job. Uses only the Python standard library.
      # The script's exit code determines whether the build passes or fails.
      - python3 main.py