guardian/riff-raff

Riff-Raff is a deployment management platform that orchestrates software releases across AWS infrastructure, including services like S3, Lambda, CloudFormation, and Auto Scaling Groups. It provides a web interface for initiating, monitoring, and configuring deployments, supporting features such as continuous deployment from S3-based CI artifacts, scheduled cron jobs, and post-deploy webhooks. The system manages deployment lifecycles through a graph-based execution engine, handling task dependencies, concurrency limits, and safety restrictions, while persisting state in DynamoDB and PostgreSQL.

26 changes.

This period established the Riff-Raff deployment platform from scratch, implementing the core Scala-based deployment engine with support for AWS services like CloudFormation and Auto Scaling. It simultaneously delivered the initial Play Framework web application, providing a full-featured UI for managing deployments, configuring pipelines, and monitoring history. The work included setting up the foundational infrastructure, authentication, and persistence layers using DynamoDB and PostgreSQL.

29 changes.

This period focused on rewriting the core deployment engine to use a modular, graph-based architecture for task execution and dependency management. It introduced comprehensive support for riff-raff.yaml configuration, including validation, preview capabilities, and pattern-based parameters. The work also expanded the web interface with new management tools for API keys, continuous deployment, and deployment restrictions.

12 changes.

This period focused on introducing cron-based scheduled deployments with safety checks and UI configuration, alongside automated instance rotation and self-deployment capabilities. It also established robust infrastructure foundations through database schema evolutions, PostgreSQL integration tests, and automated S3 artifact housekeeping.

Introduced a new 'Restrictions' section in the web interface, allowing administrators to create, view, edit, and delete deployment restrictions. The new list page displays existing restrictions with details like project name, stage, and edit-lock status, while the creation form enables users to define an allowlist of users who can bypass the restriction, opt-in to permit continuous or scheduled deployments, and add explanatory notes for other users. This feature helps prevent undesirable deploys during project issues or security concerns.

riff-raff/app/views/restrictions · high confidence

Users can now preview the deployment plan for YAML configurations before executing them. This change introduces a new preview subsystem (Preview, PreviewCoordinator, PreviewResult) that resolves the deployment graph and tasks from a YAML artifact, allowing users to validate the intended deployment steps and parameters without triggering an actual deployment.

riff-raff/app/deployment/preview · high confidence

Users can now create, view, edit, and delete scheduled deployments via a new Schedule page. The form allows selecting a project, stage, and a Quartz-style cron expression, and includes a new field to specify the timezone for the schedule. The list view displays all configured schedules, showing the project, stage, expression, timezone, and enabled status, with links to edit or delete each entry.

riff-raff/app/views/schedule · high confidence

Riff-Raff now includes a configurable feature that automatically shuts down the application or terminates its underlying EC2 instance once all active deployments have completed. This is controlled via a switch mechanism: enabling 'shutdown-when-inactive' causes the JVM to exit with code 217 after a brief wait for pending requests, while 'terminate-instance-when-inactive' sends a Hangouts Chat notification via Anghammarad and then terminates the current EC2 instance to allow an Auto Scaling Group to launch a replacement with a newer AMI. Both modes defer action if builds are still running, ensuring no active deployments are interrupted.

riff-raff/app/lifecycle · high confidence

Users can now create, view, edit, and delete post-deploy hooks via a new web GUI. The list page displays hook details including project, stage, URL, and enabled status, while the creation form allows specifying the HTTP method and a templated POST body with support for deploy-specific token substitution. CSRF protection is enforced on all form submissions.

riff-raff/app/views/hooks · high confidence

The application now includes the D3.js library (version 2.10.3) in its public JavaScript assets. This addition provides the core functionality for creating and manipulating documents based on data, enabling features such as data-driven transformations, SVG manipulation, and visualizations like graphs of deploys over time.

riff-raff/public/javascripts · high confidence

Riff-Raff now supports automatic instance rotation on a scheduled basis (Wednesdays for CODE, Thursdays for PROD) via a new systemd timer that triggers a rotation endpoint, and includes a self-deployment mechanism allowing the service to update its own bootstrap script and application binary from S3. The deployment configuration has been updated to use an encrypted AMI with the arm64-jammy-java21 recipe, ensuring instances are provisioned with the correct infrastructure image.

riff-raff · high confidence

A new housekeeping service has been introduced to automatically tag S3 objects associated with completed deployments that exceed a configurable age threshold. The system runs nightly (defaulting to 2 AM) to identify projects and build IDs, filters for only completed deployment stages, and applies a specific tag to older artifacts. This capability is controlled by a new configuration section allowing administrators to enable/disable the feature, set the schedule time, define the tag key/value, and specify the minimum age in days before tagging occurs.

riff-raff/app/housekeeping · high confidence

The repository has been initialized with the Riff-Raff deployment platform, including an Apache 2.0 license, a README, and a CONTRIBUTING guide. Local development is now supported via a dev container and a docker-compose configuration that provisions a PostgreSQL 18 database and a local DynamoDB instance with pre-created tables. The project specifies Java 21 (Corretto), SBT 1, and Scala 2.13 as the runtime and build environment, and configures Scala Steward for automated dependency updates.

(repo-wide) · high confidence

This change introduces the initial version of the Riff-Raff application, providing a comprehensive web interface for managing software deployments. It includes controllers for initiating and monitoring deploys, viewing deployment history, and managing configuration for continuous deployment, scheduled tasks, and post-deploy hooks. The application also features a preview capability to validate deployment configurations before execution, a restrictions system to control deployment permissions, and an API for programmatic access. Authentication is handled via Google OAuth, and the UI includes documentation, user profiles, and administrative management tools for instance rotation and shutdown.

riff-raff/app/controllers · high confidence

This change introduces the initial configuration and routing structure for the Riff-Raff application, a deployment management platform. It establishes the Play Framework application settings, including Google OAuth authentication for the Guardian domain, PostgreSQL database connectivity, and logging configurations for both development and production environments. The routes file defines the core user-facing capabilities, enabling users to request and manage deployments, view deployment history and dashboards, configure continuous deployment pipelines, manage post-deploy hooks and restrictions, and utilize an API for programmatic deployment control.

riff-raff/conf · high confidence

This change introduces the initial user interface for Riff-Raff, the Guardian's deployment tool. It adds core Play Framework views including a main layout with Bootstrap styling and asset versioning, a home page displaying documentation, and custom error handling pages that display exception details and stack traces to users. The UI also includes a 'not found' page and integrates specific JavaScript libraries like jQuery, Moment.js, and Bootstrap for interactive features.

riff-raff/app/views · high confidence

Added a new restrictions module that allows administrators to define rules preventing specific deployments based on project, stage, and request source. The system supports allowlists of permitted users, locking configuration edits to the original author (with optional superuser overrides), and explicitly permitting or blocking continuous deployment and scheduled deploys for restricted stages.

riff-raff/app/restrictions · high confidence

Users can now configure cron-based scheduled deploys for specific projects and stages. The system enforces safety by skipping scheduled runs if the previous deployment was partial, failed, or still waiting, and it sends notifications to teams when a scheduled deploy fails to start. Configuration supports custom timezones for cron expressions, and the scheduler integrates with the Anghammarad notification service to alert on errors.

riff-raff/app/schedule · high confidence

The magenta-lib module now includes a new graph implementation (Graph.scala, DeploymentGraph.scala) to model and execute deployment tasks. This library allows tasks to be organized into a directed acyclic graph with StartNode and EndNode boundaries, supporting parallel execution paths and deterministic traversal via edge priorities. Users benefit from more robust handling of complex deployment dependencies, where task completion is determined by reachable nodes and execution order is strictly defined by the graph structure.

magenta-lib/src/main/scala/magenta/graph · high confidence

Users can now create, view, and delete API keys through a new web interface. The 'API keys' list page displays key details including creation date, issuer, associated application, usage statistics, and allows for key deletion. A dedicated form enables the creation of new API keys for specific applications, with CSRF protection included in both views.

riff-raff/app/views/api · high confidence

The Continuous Deployment settings page now features a dedicated form and list view for managing deployment configurations. Users can create, edit, and delete configurations via a new form that captures project name, target stage (looked up via Prism), branch name, and trigger type (Successful Build or Disabled). The list view displays all active configurations with details like last edited time and user, and includes a warning banner when a change freeze is active, which disables deploys for specific stages.

riff-raff/app/views/continuousDeployment · high confidence

Added three new view helpers to support UI rendering: MessageHelper provides methods to map deployment states to CSS classes and extract message types from report nodes; PreviewHelper exposes a method to retrieve dependency predecessors for deployment graphs, supporting the new YAML config preview capability; and htmlTooltip provides a conditional wrapper to render Bootstrap tooltips only when tooltip content is non-empty.

riff-raff/app/views/html · high confidence

Added a new \PrismLookup\ class in the \resources\ package that implements the \Lookup\ interface to retrieve host instances and credential data from the Prism service instead of direct AWS APIs. This change introduces a new mechanism for resolving deployment targets and secrets via Prism's REST endpoints, including support for role-based and static API credentials, with built-in retry logic and graceful handling of incomplete instance data.

riff-raff/app/resources · high confidence

A new S3Location abstraction has been introduced to manage S3 interactions, providing structured types for paths, objects, and artifacts. This change replaces previous ad-hoc handling with a dedicated API for listing objects and fetching content, utilizing the AWS SDK v2. It establishes a foundation for the new riff-raff.yaml-based configuration by defining how artifacts are located and accessed in S3 buckets.

magenta-lib/src/main/scala/magenta/artifact · high confidence

The web interface now includes several new view snippets to enhance the user experience. A change freeze dialog allows users to acknowledge and proceed with deployments during frozen periods. The deployment history view features a new record table with pagination, displaying deployer, stage, build ID, branch, and status (including time taken and warnings), with clickable rows and context menu actions. Deployment instances are now displayed with icons for name, action, region, and stack. A collapsible report tree visualizes deployment messages and states. Additional helper snippets support optional links, hidden input fields, and tabbed navigation.

riff-raff/app/views/snippets · high confidence

This release introduces a new set of tasks for managing Auto Scaling Group (ASG) deployments, including capacity checks, instance protection, and stabilization waits, alongside a new CloudFormation deployment strategy using change sets. The \ASGTasks.scala\ file adds tasks like \CheckGroupSize\, \ProtectCurrentInstances\, and \WaitForStabilization\ to ensure safe scaling during deployments. \ChangeSetTasks.scala\ and \UpdateCloudFormationTask.scala\ implement CloudFormation change set creation and execution, allowing for safer stack updates with better parameter logging and retry logic for concurrent updates. Additionally, \FastlyComputeTasks.scala\ adds support for deploying Fastly Compute@Edge packages, while \FastlyTasks.scala\ is updated to handle VCL file uploads and validation.

magenta-lib/src/main/scala/magenta/tasks · high confidence

A new validation interface has been added to the application, allowing users to paste Riff-Raff YAML configuration content into a form for validation. Upon successful validation, the system displays a detailed breakdown of the parsed deployments, including their type, actions, target stacks and regions, associated app, content directory, parameters, and dependencies. If validation fails, the UI presents specific error messages grouped by context to help users correct their configuration.

riff-raff/app/views/validation · high confidence

Added four new UI templates in the deployTarget view area to handle the deploy target selection workflow: selectTarget.scala.html displays a list of matching projects when multiple builds are found for a region/stack/app combination; selectVersion.scala.html allows users to choose a specific build version to redeploy to a stage, including a helpful info message if no prior deployments exist; noMatchForTarget.scala.html informs users when no matching build is found and suggests triggering a new CI build; and deployButton.scala.html provides the 'Redeploy' action link for individual records.

riff-raff/app/views/deployTarget · high confidence

Added three new shell scripts to streamline local development: \script/setup\ downloads the DEV configuration from an AWS SSM-managed S3 bucket into \\~/.gu/riff-raff.conf\; \script/start\ and \script/test\ launch the application and tests respectively using \docker compose\ and \sbt\. Both \start\ and \test\ scripts now accept a \--debug\ flag, which enables JVM debugging on port 9999 for easier interactive troubleshooting.

script · high confidence

The application introduces three new form models to handle specific user inputs: DeployParameterForm for deployment details including an update strategy, MigrationParameters for handling migration limits and actions, and UuidForm for validating UUIDs and actions. These forms provide structured data binding for their respective features, ensuring that deployment strategies, migration limits, and UUID inputs are correctly parsed and validated before processing.

riff-raff/app/controllers/forms · high confidence

The application now provides dedicated login and profile pages for users authenticating via Google. The login view displays a Google login button and shows error messages if authentication fails. The profile view displays the user's email, Google subject ID, and token expiry time, along with a table of their recent deployment records.

riff-raff/app/views/auth · high confidence

This change introduces a new notification subsystem in the \riff-raff/app/notification\ package. It adds post-deploy hooks that allow external systems to be notified via templated HTTP requests (GET/POST) after a deployment finishes, supporting variable substitution and basic authentication. It also implements failure notifications for both continuous and scheduled deployments, sending alerts via Anghammarad (primarily to Hangouts Chat with email fallback) and including specific handling for multi-account DevX projects to ensure alerts reach the correct team. Additionally, a Grafana annotation logger is added to mark deployment start, finish, and failure events in Grafana dashboards.

riff-raff/app/notification · high confidence

This change introduces several new utility components in the application's utils package. A ChangeFreeze class is added to enforce deployment freezes based on configurable date ranges and specific stages. An HstsFilter is introduced to automatically add Strict-Transport-Security headers to responses. A ScheduledAgent system is implemented to manage periodic and daily background updates using an internal Agent abstraction. Additionally, helper utilities are added for date formatting in London time, graph data zero-filling, retry logic, and VCS URL normalization for GitHub.

riff-raff/app/utils · high confidence

Users can now define deployment parameters using a list of pattern-value pairs, where each pair specifies a regular expression pattern and its corresponding value. This allows for more flexible and dynamic configuration matching within deployment types, replacing the previous single-string default approach with a structured list that supports multiple patterns.

_magenta-lib/src/main/scala/magenta/deployment\_type/param\reads · high confidence

Users can now preview the specific deployment tasks that will be executed for a given YAML configuration, build, and stage. The new preview interface displays a list of deployment targets with their associated tasks, allowing users to select or deselect individual tasks before proceeding. The view includes 'Select all' and 'Deselect all' buttons for convenience, shows task dependencies (which tasks must complete before others start), and provides options to either 'Preview with selections' or 'Deploy' the chosen subset. A loading state with humorous messages is displayed while the task graph is being resolved, and users can reset their selections to view all tasks.

riff-raff/app/views/preview · high confidence

The deployment module has been significantly simplified by removing the legacy \com.gu.deploy\ package (including \ArtifactChecker\, \Config\, \Host\, and \Utils\) and the \com.gu.deploy2\ package (including \Install\, \JsonInputFile\, \Package\, \Recipe\, and \Resolver\). Additionally, the bundled \org.fud.optparse\ command-line parsing library has been deleted. These changes remove the previous codebase for handling configuration, remote execution, and JSON-based deployment recipes, along with the internal option parser used by the old configuration system.

src/main · high confidence

The DenyReplaceDelete stack policy has been updated to include \AWS::ElasticLoadBalancingV2::TargetGroup\ in its list of sensitive resources, preventing accidental replacement or deletion of these load balancer components. Additionally, the policy generation logic now dynamically queries available AWS and private CloudFormation resource types for the specific deployment region (using a cached generator for performance), ensuring the policy only restricts resource types that actually exist in that region rather than applying a static, potentially inaccurate list.

magenta-lib/src/main/scala/magenta/tasks/stackSetPolicy · high confidence

This change introduces a series of database evolutions that establish the core RiffRaff schema (apiKey, auth, deploy, deployLog) and optimize query performance by adding specific indexes on JSONB fields such as application, startTime, status, and projectName. It also creates a read-only \service\_catalogue\ user and schema with views exposing deploy and deploy log data for external consumption, while subsequently removing the \auth\ table and its associated view to align with updated authentication requirements.

riff-raff/conf/evolutions · high confidence

The application now uses the Play 2.6+ ApplicationLoader pattern (AppLoader and AppComponents) instead of the legacy GlobalSettings approach. This change centralizes dependency injection and configuration, enabling features such as CSRF protection, Gzip filtering, and secret rotation via AWS Systems Manager Parameter Store. It also integrates IAM-based database password retrieval and configures the deployment engine with the available deployment types.

riff-raff/app · high confidence

Riff-Raff now stores continuous deployment configurations, post-deploy hook settings, scheduled deploy configurations, and deployment restrictions in DynamoDB tables (using the Scanamo library) instead of the previous storage mechanism. Additionally, the system supports dynamic database password generation via IAM authentication for PostgreSQL connections, allowing secure, rotating credentials in production environments while falling back to static passwords in non-production stages.

riff-raff/app/persistence · high confidence

The CI module has been rewritten to poll for builds and jobs directly from S3 instead of relying on TeamCity or MongoDB. A new \CIBuildPoller\ fetches \build.json\ files from an S3 bucket, parsing them into \S3Build\ objects, while a \BoundedSet\ manages the in-memory cache of recent builds. Continuous deployment is now driven by an \Observable\ stream of new builds that matches against \ContinuousDeploymentConfig\ (stored in DynamoDB) to trigger deployments, replacing the previous MongoDB-based CD loop. Additionally, a \TargetResolver\ now extracts deployment targets from the YAML artifact of each build and persists them to DynamoDB.

riff-raff/app/ci · high confidence

The application now uses a new \Config\ class in the \conf\ package to manage settings, replacing previous property-file approaches. This change introduces support for AWS SSM Parameter Store to dynamically load credentials based on service and account keys, and adds configuration sections for authentication (including Google OAuth domains and superusers), continuous deployment toggles, change freezes, and housekeeping schedules. The system also auto-detects the deployment stage via EC2 instance tags and configures AWS clients (S3, DynamoDB, SNS, SSM) with region-specific settings, defaulting to \eu-west-1\.

riff-raff/app/conf · high confidence

The documentation UI now uses new Play framework view templates to render content more consistently. A breadcrumb component displays navigation paths, while a dedicated template for deployment types renders action and parameter tables with their documentation and defaults. Markdown pages now include previous/next navigation links, and multi-section documentation pages use Bootstrap nav-pills for section navigation.

riff-raff/app/views/documentation · high confidence

This change introduces new stylesheets for the application's UI. The \graph.less\ file defines the layout and appearance of the deployment history graphs (powered by Rickshaw), including specific styles for dark mode support via \prefers-color-scheme\. The \magenta.less\ file establishes the visual theme for the 'magenta' interface, defining styles for table rows, tooltips, command output messages, and status indicators (such as the 'party parrot' animation for running states and green checkmarks for completed ones).

riff-raff/app/assets/stylesheets · high confidence

The deployment actor system has been restructured into three new components: DeployCoordinator, DeployGroupRunner, and TasksRunner. DeployCoordinator now manages concurrent deployments, enforcing a limit on the number of simultaneous deploys and preventing multiple deployments from the same project and stage from running at once, while queuing excess requests. DeployGroupRunner orchestrates the execution flow using a directed acyclic graph of tasks, ensuring that only reachable nodes are considered for completion and handling task dependencies correctly. TasksRunner executes individual deployment tasks, checking for stop signals and reporting progress. This change replaces the previous monolithic actor structure with a more modular, graph-aware approach to deployment orchestration.

riff-raff/app/deployment/actors · high confidence

The deployment interface now supports saving and selecting favorite projects via a new favorites list, with duplicate prevention and empty-input protection. Project selection uses exact matching, and switching projects automatically clears the build and branch inputs while refreshing stage and deploy information. The form now includes a timezone selector for cron expressions, a collapsible deploy log, and a mini history pane for contextual deployment history. Desktop notifications are enabled for ongoing deployments, and a warning appears when deploying non-standard branches to production. Additional improvements include CSRF handling for the stop-deploy button, preserved expand/collapse states across auto-refreshes, and basic Mixpanel tracking for verbose mode toggles.

riff-raff/app/assets/javascripts · high confidence

The deployment user interface has been significantly restructured and expanded. A new Dashboard view provides an auto-refreshing, AJAX-driven overview of recent deployments across projects and stages. The Deployment History page now features a visual graph of deploy activity, along with robust filtering by stage, status, and project, as well as pagination. The main Deploy form has been enhanced with project auto-suggest, a favorites list, and an expandable section for advanced update strategies. Additionally, users can now view detailed build information (including branch, tags, and CI status) and browse the contents of artifact files directly from the deployment view.

riff-raff/app/views/deploy · high confidence

The application's top navigation bar has been restructured to include a brand link displaying the current build version and start time, alongside a user-specific menu. When a user is logged in via Google authentication, a dropdown appears showing their name with links to their profile and a sign-out option; unauthenticated users see a login link instead. The menu items themselves now support both standard links and dropdown sub-menus, with visibility and active states determined by the current request context.

riff-raff/app/views/menu · high confidence

The deployment engine has been restructured to support more flexible configuration and clearer operational visibility. Credentials are now managed via a \KeyRing\ and \ApiCredentials\ system, allowing different keys for different apps and stages, with support for both static and role-based authentication. Host and data lookups are abstracted through a \Lookup\ trait (powered by Prism), enabling instance resolution via host groups rather than legacy methods. Deployment execution is now driven by a \DeploymentPackage\ and \DeploymentStep\ model, replacing the previous package type system, and includes a \Strategy\ enum to control whether destructive operations are allowed. Additionally, logging has been replaced by a \DeployReporter\ and \DeployReport\ system that provides structured, hierarchical message tracking with context management, run states, and London-time timestamps for better debugging and user feedback.

magenta-lib/src/main/scala/magenta · high confidence

The deployment engine has been restructured to use a new actor-based system (DeploymentEngine, DeployCoordinator, TasksRunner) for managing concurrent deploys and stop flags, replacing previous in-memory state management. Additionally, the deploy history screen now supports advanced filtering via a new DeployFilter model, allowing users to filter by project name (with optional exact match), stage, deployer, status, date range, and warning presence, along with pagination support for large history lists.

riff-raff/app/deployment · high confidence

The deployment resolution logic in the input resolver has been restructured from a monolithic approach into a series of specialized components that build and process a dependency graph. This change introduces distinct stages for resolving configuration (DeploymentResolver), validating deployment types and parameters (DeploymentTypeResolver), pruning deployments based on user selectors (DeploymentPruner), and constructing the execution graph (DeploymentGraphBuilder, DeploymentGraphActionFlattening). The main Resolver orchestrates these steps, allowing for more granular validation, support for partial deployment selection (by stack, region, or specific keys), and the flattening of multi-action deployments into individual graph nodes for parallel execution.

magenta-lib/src/main/scala/magenta/input/resolver · high confidence

The deployment type system has been restructured to use a new \Action\ model and a strongly-typed \Param\ system, replacing the previous implicit or less structured approach. This change introduces explicit registration of deployment actions (such as \deploy\, \update\, \uploadStaticFiles\) and parameters (including \publicReadAcl\, \bucketSsmLookup\, and \templateStagePaths\) within each deployment type (e.g., \AutoScaling\, \CloudFormation\, \S3\, \Lambda\). Users will see more consistent parameter validation, clearer documentation generation for each action, and support for stage-specific configurations (like \templateStagePaths\ in CloudFormation or \bucketSsmKeyStageParam\ in S3). The refactoring also standardizes how deployment steps are resolved and executed, improving maintainability and testability of the deployment logic.

_magenta-lib/src/main/scala/magenta/deployment\type · high confidence

The riff-raff.yaml parser now rejects configuration files containing unexpected fields, ensuring users are immediately notified of typos or unsupported options. Additionally, parsing errors are now aggregated and presented with clear, contextual messages (e.g., specifying the exact YAML path and nature of the error) rather than failing silently or with generic exceptions, improving the debugging experience for deployment configurations.

magenta-lib/src/main/scala/magenta/input · high confidence

The application's visual appearance has been updated by switching the Bootstrap CSS theme to Slate. This change replaces the previous stylesheet with the Slate variant from Bootswatch (based on Bootstrap v3.4.1), resulting in a darker color scheme for backgrounds, text, and interface elements.

riff-raff/public/stylesheets · high confidence

Add new testing and debugging utility pages; Added integration tests for the Postgres datastore; Added test coverage for deployment types and reporting infrastructure; Added test fixtures for deployment graph and context creation; Added tests for PrismLookup and Keyring functionality; Added tests for VCS URL normalization, graph zero-filling, and message helper; Added tests for deployment failure notifications and webhook templating; Added tests for deployment record mapping and log document tree utilities; Added tests for restriction checker logic; Added tests for scheduled deploy job validation logic; Added tests for the deployment preview functionality; Added unit tests for ArtifactHousekeeping logic; Added unit tests for CI integration components; Added unit tests for deployment actor coordination and execution; Removal of obsolete test files in src/test.

The build system has been upgraded to Play 3.0 (via sbt-plugin 3.0.11) and migrated to AWS SDK v2 (version 2.52.0), replacing the previous AWS SDK v1. This change updates core dependencies including Play, Jackson (2.22.2), and various AWS services (S3, EC2, Lambda, CloudFormation, RDS, etc.), while also pinning logback-classic to 1.6.3 to address [CVE redacted]. Additionally, the project now includes a new sbt task to generate CloudFormation type caches.

project · high confidence

The build configuration has been updated to use Scala 2.13.18 and the Netty HTTP codec library version 4.2.17.Final. This update also includes Java 21 compatibility adjustments, such as adding JVM flags to open internal modules for reflection, and configures the test environment to use Docker Compose for container management.

(dependencies) · high confidence

Written by watchdog.canine.dev from the codebase's own history, inside the signed delivery this page is composed from.

• First survey — no prior run to compare against. CAI 49.

• Code Health 88
• Architecture 89
• Maturity 51
• Readiness 45
• Security 61
• Accessibility 43

• 300 commits — 287 feature/other, 13 fixes

• project/Dependencies.scala — 118 commits
• (repo) — 107 commits
• (root) — 33 commits
• project/build.properties — 13 commits
• .github/workflows — 8 commits
• riff-raff/app — 8 commits
• project/plugins.sbt — 7 commits
• magenta-lib/src — 4 commits
• .github/CODEOWNERS — 1 commit
• .github/dependabot.yml — 1 commit

• fix: Bump AWS SDK to 2.42.26 to fix Netty CVEs
• fix: Bump play-googleauth to 42.0.0 to fix play-secret-rotation version conflict
• fix: Fix .tool-versions: guardian/setup-scala requires full corretto version string
• fix: Fix markdown rendering
• fix: Fix momentjs WebJar asset path
• fix: Merge pull request #1570 from guardian/fix/momentjs-webjar-path
• fix: Merge pull request #1576 from guardian/fix/netty-cves
• fix: Merge pull request #1596 from guardian/ja-fix-flaky-tests-v2
• fix: Merge pull request #1608 from guardian/update/security-fix
• fix: Merge pull request #1646 from guardian/update/security-fix
• fix: Merge pull request #1647 from guardian/update/security-fix
• fix: Revert jQuery to 3.7.1 and add scala-steward:off
• fix: fix: Route deployment alerts for devx::slo-alerts to DevX
• change: Add .github/CODEOWNERS file for devx-reliability-and-ops team
• change: Add central workflow which requires CORE4 labels on PRs prior to merging.
• change: Add devcontainer support
• change: Add first pass at local dynamo
• change: Add io.nettynetty-codec-http4.2.12.Final as library dependency to magenta-lib settings to resolve vulnerability
• change: Add more detail to local running documentation
• change: Add node and aws
• …and 280 more

Written by watchdog.canine.dev from the codebase's own history, inside the signed delivery this page is composed from.

guardian/riff-raff was measured the same way every project in this corpus was: the same rubric, at a pinned commit, with the result published in full. Point a surveyor at a repository you know and see whether you agree with it.