Merge branch 'main' into feat/96-linear-prefix-routing

isadeks · web-flow · commit 5d64b0d65abb · 2026-06-05T16:43:08.000-04:00
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
@@ -22,7 +22,7 @@ jobs:
       run_id: ${{ github.event.workflow_run.id }}
     steps:
       - name: Download deploy intent
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: deploy-intent
           run-id: ${{ github.event.workflow_run.id }}
@@ -145,7 +145,7 @@ jobs:
           persist-credentials: false
 
       - name: Download CDK artifact (${{ matrix.compute_type }})
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: cdk-${{ matrix.compute_type }}-out
           path: cdk/
@@ -220,7 +220,7 @@ jobs:
           persist-credentials: false
 
       - name: Download CDK artifact (${{ matrix.compute_type }})
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: cdk-${{ matrix.compute_type }}-out
           path: cdk/
diff --git a/agent/pyproject.toml b/agent/pyproject.toml
@@ -36,6 +36,11 @@ dependencies = [
     "cedarpy==4.8.0", #https://github.com/k9securityio/cedar-py — EXACT pin (no ^/~), parity with @cedar-policy/cedar-wasm@4.10.0
 ]
 
+[tool.uv]
+constraint-dependencies = [
+    "pyjwt>=2.13.0",  # PYSEC-2026-175/177/178/179 — transitive via mcp; remove when mcp bumps floor (#267)
+]
+
 [tool.bandit]
 exclude_dirs = ["tests", ".venv"]
 skips = [
diff --git a/agent/uv.lock b/agent/uv.lock
diff --git a/docs/guides/DEPLOYMENT_GUIDE.md b/docs/guides/DEPLOYMENT_GUIDE.md
@@ -161,6 +161,67 @@ Triggers via `workflow_run` when `build.yml` completes successfully. The pipelin
 - **Allowlist compute types**: Edit `ALLOWED_COMPUTE_TYPES` in `deploy.yml`.
 - **Deploy via PR label**: Add the `deploy:<type>` label to a PR (e.g., `deploy:agentcore`).
 
+## Known deployment issues
+
+### DNS Query Log Config replacement cascade (upgrading from pre-v0.5)
+
+**Affects:** Stacks deployed *before* the tag-exclusion fix ([#222](https://github.com/aws-samples/sample-autonomous-cloud-coding-agents/pull/222)). Stacks created after this fix are not affected.
+
+**Symptom:** `UPDATE_FAILED` on `AWS::Route53Resolver::ResolverQueryLoggingConfigAssociation` with error `InvalidRequest: Cannot create association — one already exists for this VPC`.
+
+**Root cause:** The `ResolverQueryLoggingConfig` resource is *create-only* in CloudFormation — any property change (including Tags) triggers a full replacement. Pre-fix stacks have `github:sha` and other tags on this resource. Although the new code excludes it from future tag applications, CloudFormation still attempts to *remove* the now-excluded tags from the existing resource during the update, triggering the replacement cascade:
+
+1. Config is replaced → new physical resource ID
+2. Association detects `ResolverQueryLogConfigId` changed → triggers its own replacement
+3. CloudFormation attempts Create-before-Delete on the association → Route53 Resolver rejects (one association per VPC) → `InvalidRequest`
+
+**Resolution — choose one:**
+
+#### Option A: AWS CLI disassociation (recommended)
+
+Fastest, scriptable, no console access required. Replace `<vpc-id>` with the agent VPC ID and `<region>` with your stack's region.
+
+1. List the association for your VPC to get the `ResolverQueryLogConfigId`:
+   ```bash
+   aws route53resolver list-resolver-query-log-config-associations \
+     --region <region> \
+     --query "ResolverQueryLogConfigAssociations[?ResourceId=='<vpc-id>']"
+   ```
+2. Disassociate using the `Id` from step 1:
+   ```bash
+   aws route53resolver disassociate-resolver-query-log-config \
+     --resolver-query-log-config-id <rqlc-id> \
+     --resource-id <vpc-id> \
+     --region <region>
+   ```
+3. Run `mise //cdk:deploy` — CloudFormation recreates both the config and association without the orphan tags. The pre-existing `ResolverQueryLoggingConfig` is replaced as part of the same update, so an explicit `delete-resolver-query-log-config` is not required.
+
+#### Option B: Two-phase deploy (comment-out / re-add)
+
+1. In `cdk/src/stacks/agent.ts`, comment out the `DnsFirewall` construct instantiation (~line 197):
+   ```typescript
+   // new DnsFirewall(this, 'DnsFirewall', {
+   //   vpc: agentVpc.vpc,
+   //   additionalAllowedDomains: additionalDomains,
+   //   observationMode: true,
+   // });
+   ```
+2. Deploy: `mise //cdk:deploy` — this deletes the query log config, association, firewall rules, and related resources
+3. Uncomment the `DnsFirewall` block
+4. Deploy again: `mise //cdk:deploy` — resources are recreated cleanly without tags
+
+Option B is more disruptive (two deploys, brief DNS logging gap) but requires no AWS API access beyond `cdk deploy`.
+
+#### Option C: Manual disassociation via AWS Console
+
+For users without AWS CLI access.
+
+1. Open the [Route 53 Resolver console](https://console.aws.amazon.com/route53resolver/home#/query-logging)
+2. Select the query logging configuration named `agent-dns-query-log`
+3. Under **Associated VPCs**, disassociate the VPC
+4. Delete the query logging configuration
+5. Run `mise //cdk:deploy` (or `cdk deploy`) — CloudFormation will recreate both resources without tags
+
 ## Related docs
 
 - [Quick start](./QUICK_START.md) -- Zero-to-first-PR in 6 steps.
diff --git a/docs/src/content/docs/getting-started/Deployment-guide.md b/docs/src/content/docs/getting-started/Deployment-guide.md
@@ -165,6 +165,67 @@ Triggers via `workflow_run` when `build.yml` completes successfully. The pipelin
 - **Allowlist compute types**: Edit `ALLOWED_COMPUTE_TYPES` in `deploy.yml`.
 - **Deploy via PR label**: Add the `deploy:<type>` label to a PR (e.g., `deploy:agentcore`).
 
+## Known deployment issues
+
+### DNS Query Log Config replacement cascade (upgrading from pre-v0.5)
+
+**Affects:** Stacks deployed *before* the tag-exclusion fix ([#222](https://github.com/aws-samples/sample-autonomous-cloud-coding-agents/pull/222)). Stacks created after this fix are not affected.
+
+**Symptom:** `UPDATE_FAILED` on `AWS::Route53Resolver::ResolverQueryLoggingConfigAssociation` with error `InvalidRequest: Cannot create association — one already exists for this VPC`.
+
+**Root cause:** The `ResolverQueryLoggingConfig` resource is *create-only* in CloudFormation — any property change (including Tags) triggers a full replacement. Pre-fix stacks have `github:sha` and other tags on this resource. Although the new code excludes it from future tag applications, CloudFormation still attempts to *remove* the now-excluded tags from the existing resource during the update, triggering the replacement cascade:
+
+1. Config is replaced → new physical resource ID
+2. Association detects `ResolverQueryLogConfigId` changed → triggers its own replacement
+3. CloudFormation attempts Create-before-Delete on the association → Route53 Resolver rejects (one association per VPC) → `InvalidRequest`
+
+**Resolution — choose one:**
+
+#### Option A: AWS CLI disassociation (recommended)
+
+Fastest, scriptable, no console access required. Replace `<vpc-id>` with the agent VPC ID and `<region>` with your stack's region.
+
+1. List the association for your VPC to get the `ResolverQueryLogConfigId`:
+   ```bash
+   aws route53resolver list-resolver-query-log-config-associations \
+     --region <region> \
+     --query "ResolverQueryLogConfigAssociations[?ResourceId=='<vpc-id>']"
+   ```
+2. Disassociate using the `Id` from step 1:
+   ```bash
+   aws route53resolver disassociate-resolver-query-log-config \
+     --resolver-query-log-config-id <rqlc-id> \
+     --resource-id <vpc-id> \
+     --region <region>
+   ```
+3. Run `mise //cdk:deploy` — CloudFormation recreates both the config and association without the orphan tags. The pre-existing `ResolverQueryLoggingConfig` is replaced as part of the same update, so an explicit `delete-resolver-query-log-config` is not required.
+
+#### Option B: Two-phase deploy (comment-out / re-add)
+
+1. In `cdk/src/stacks/agent.ts`, comment out the `DnsFirewall` construct instantiation (~line 197):
+   ```typescript
+   // new DnsFirewall(this, 'DnsFirewall', {
+   //   vpc: agentVpc.vpc,
+   //   additionalAllowedDomains: additionalDomains,
+   //   observationMode: true,
+   // });
+   ```
+2. Deploy: `mise //cdk:deploy` — this deletes the query log config, association, firewall rules, and related resources
+3. Uncomment the `DnsFirewall` block
+4. Deploy again: `mise //cdk:deploy` — resources are recreated cleanly without tags
+
+Option B is more disruptive (two deploys, brief DNS logging gap) but requires no AWS API access beyond `cdk deploy`.
+
+#### Option C: Manual disassociation via AWS Console
+
+For users without AWS CLI access.
+
+1. Open the [Route 53 Resolver console](https://console.aws.amazon.com/route53resolver/home#/query-logging)
+2. Select the query logging configuration named `agent-dns-query-log`
+3. Under **Associated VPCs**, disassociate the VPC
+4. Delete the query logging configuration
+5. Run `mise //cdk:deploy` (or `cdk deploy`) — CloudFormation will recreate both resources without tags
+
 ## Related docs
 
 - [Quick start](/getting-started/quick-start) -- Zero-to-first-PR in 6 steps.
