Draft: switch AWS deployment from Serverless to CDK

.env.example

@@ -1,2 +1,2 @@
-S3_BUCKET_PREFIX=hackingstudio-code4maus-projects
+S3_BUCKET_PREFIX=pmdm-projectbucket
 AWS_REGION=eu-central-1

.github/workflows/_deploy-gated.yml

@@ -0,0 +1,124 @@
+# Deployment-Workflow mit Bestätigung, angedacht für staging und prod
+# Job "plan": führt `cdk synth` aus und schreibt die Ánderungen bzw. das Diff in den Job-Output.
+#   cdk.out wird als Artefakt gespeichert
+# Job "apply": lädt das neue Template (bzw. cdk.out) herunter und deployt es 
+
+name: deploy (gated)
+
+on:
+  workflow_call:
+    inputs:
+      stage:
+        description: CDK-Stage (staging | prod)
+        required: true
+        type: string
+      environment:
+        description: Github-Environment (Approval-Gate + Secrets)
+        required: true
+        type: string
+
+permissions:
+  contents: read
+
+env:
+  AWS_REGION: eu-central-1
+  NODE_OPTIONS: --max-old-space-size=4096
+
+jobs:
+  # ---- Plan: synth + diff, ohne etwas zu verändern -------------------------
+  plan:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Node 24 einrichten
+        uses: actions/setup-node@v4
+        with:
+          node-version: 24
+          cache: yarn
+
+      - name: AWS-Credentials
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID_2026 }}
+          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY_2026 }}
+          aws-region: ${{ env.AWS_REGION }}
+
+      - name: Frontend-Dependencies installieren
+        run: yarn install --frozen-lockfile --ignore-optional
+
+      - name: Frontend bauen
+        run: yarn build
+        env:
+          NODE_ENV: production
+
+      - name: CDK-Dependencies installieren
+        run: npm ci
+        working-directory: cdk
+
+      - name: CDK synth
+        run: npx cdk synth --context stage=${{ inputs.stage }}
+        working-directory: cdk
+
+      # diff gegen den deployten Stack (change-set-basiert = autoritativ) in die
+      # Run-Summary schreiben, damit Reviewer:innen es VOR der Freigabe sehen.
+      - name: CDK diff → Summary
+        working-directory: cdk
+        run: |
+          npx cdk diff --app cdk.out "MausApp-${{ inputs.stage }}" 2>&1 | tee diff.txt
+          {
+            echo "## CDK diff (${{ inputs.stage }})"
+            echo '```'
+            cat diff.txt
+            echo '```'
+          } >> "$GITHUB_STEP_SUMMARY"
+
+      - name: Cloud Assembly sichern
+        uses: actions/upload-artifact@v4
+        with:
+          name: cloud-assembly-${{ inputs.stage }}
+          path: cdk/cdk.out
+          retention-days: 5
+
+  # ---- Apply: deployt exakt das geplante Assembly, nach Approval ------------
+  apply:
+    needs: plan
+    runs-on: ubuntu-latest
+    # Das Environment ist das Gate: hat es einen Required Reviewer (prod),
+    # pausiert der Run hier, bis freigegeben wird.
+    environment: ${{ inputs.environment }}
+    concurrency:
+      group: deploy-${{ inputs.stage }}
+      cancel-in-progress: false
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Node 24 einrichten
+        uses: actions/setup-node@v4
+        with:
+          node-version: 24
+          cache: yarn
+
+      - name: AWS-Credentials
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID_2026 }}
+          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY_2026 }}
+          aws-region: ${{ env.AWS_REGION }}
+
+      # Nur die CDK-CLI wird gebraucht; nicht neu bauen/synthen.
+      - name: CDK-Dependencies installieren
+        run: npm ci
+        working-directory: cdk
+
+      - name: Cloud Assembly laden
+        uses: actions/download-artifact@v4
+        with:
+          name: cloud-assembly-${{ inputs.stage }}
+          path: cdk/cdk.out
+
+      - name: CDK deploy (exakt das reviewte Assembly)
+        working-directory: cdk
+        run: npx cdk deploy --app cdk.out "MausApp-${{ inputs.stage }}" --require-approval never

.github/workflows/_deploy.yml

@@ -0,0 +1,72 @@
+# Baut Assets und `cdk deploy`t direkt, ohne Bestätigung
+# intendiert für dev
+name: deploy
+
+on:
+  workflow_call:
+    inputs:
+      stage:
+        description: CDK-Stage (dev / staging / prod)
+        required: true
+        type: string
+      environment:
+        description: GitHub-Environment
+        required: true
+        type: string
+
+permissions:
+  contents: read
+
+jobs:
+  deploy:
+    runs-on: ubuntu-26.04 # noch in Test -> latest lieber vermeiden
+    #runs-on: ubuntu-latest
+    environment: ${{ inputs.environment }}
+    # verhindert überlappende Deploys auf dieselbe Stage
+    concurrency:
+      group: deploy-${{ inputs.stage }}
+      cancel-in-progress: false
+    env:
+      AWS_REGION: eu-central-1
+      NODE_OPTIONS: --max-old-space-size=4096
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Node 24 einrichten
+        uses: actions/setup-node@v4
+        with:
+          node-version: 24
+          cache: yarn
+
+      - name: AWS-Credentials
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID_2026 }}
+          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY_2026 }}
+          aws-region: ${{ env.AWS_REGION }}
+
+      # Frontend-Projekt (yarn). --ignore-optional überspringt native
+      # optional-deps (printer/snappy), die für den Build nicht gebraucht werden
+      - name: Frontend-Dependencies installieren
+        run: yarn install --frozen-lockfile --ignore-optional
+
+      - name: Frontend bauen
+        run: yarn build
+        env:
+          NODE_ENV: production
+
+      # CDK-Projekt (npm). esbuild für das Lambda-Bundling wird aus dem
+      # Repo-Root (yarn) aufgelöst und muss dort nicht erneut installiert werden
+      - name: CDK-Dependencies installieren
+        run: npm ci
+        working-directory: cdk
+
+      # Loggt das diff -> keine Bestätigung nötig
+      - name: CDK diff
+        run: npx cdk diff --context stage=${{ inputs.stage }}
+        working-directory: cdk
+
+      - name: CDK deploy
+        run: npx cdk deploy --context stage=${{ inputs.stage }} --require-approval never
+        working-directory: cdk

.github/workflows/deploy-dev.yml

@@ -0,0 +1,19 @@
+# Push auf develop -> Deploy auf Stage dev. Zusätzlich manuell per
+# workflow_dispatch (praktisch, um einen Feature-Branch gegen dev zu testen).
+name: Deploy dev
+
+on:
+  push:
+    branches: [develop]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  deploy:
+    uses: ./.github/workflows/_deploy.yml
+    with:
+      stage: dev
+      environment: dev
+    secrets: inherit

.github/workflows/deploy-production.yml

@@ -0,0 +1,19 @@
+# Push auf production -> Plan/Approve/Apply auf Stage prod.
+# Das GitHub-Environment "prod" braucht einen Required Reviewer, damit der
+# Apply-Job erst nach manueller Freigabe läuft.
+name: Deploy production
+
+on:
+  push:
+    branches: [production]
+
+permissions:
+  contents: read
+
+jobs:
+  deploy:
+    uses: ./.github/workflows/_deploy-gated.yml
+    with:
+      stage: prod
+      environment: prod
+    secrets: inherit

.github/workflows/deploy-staging.yml

@@ -0,0 +1,17 @@
+# Push auf staging -> Plan/Approve/Apply auf Stage staging.
+name: Deploy staging
+
+on:
+  push:
+    branches: [staging]
+
+permissions:
+  contents: read
+
+jobs:
+  deploy:
+    uses: ./.github/workflows/_deploy-gated.yml
+    with:
+      stage: staging
+      environment: staging
+    secrets: inherit

.github/workflows/pr-checks.yml

@@ -0,0 +1,44 @@
+# Validierung für Pull Requests gegen develop/staging/production – OHNE Deploy und ohne
+# AWS-Credentials. Baut das Frontend und synthetisiert den CDK-Stack, um Bundling-,
+# Config- und Template-Fehler vor dem Merge zu fangen.
+name: PR checks
+
+on:
+  pull_request:
+    branches: [develop, staging, production]
+
+permissions:
+  contents: read
+
+jobs:
+  validate:
+    runs-on: ubuntu-latest
+    env:
+      NODE_OPTIONS: --max-old-space-size=4096
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Node 24 einrichten
+        uses: actions/setup-node@v4
+        with:
+          node-version: 24
+          cache: yarn
+
+      - name: Frontend-Dependencies installieren
+        run: yarn install --frozen-lockfile --ignore-optional
+
+      - name: Frontend bauen
+        run: yarn build
+        env:
+          NODE_ENV: production
+
+      - name: CDK-Dependencies installieren
+        run: npm ci
+        working-directory: cdk
+
+      # synth braucht keine AWS-Credentials (keine fromLookup-Aufrufe im Stack).
+      # dev ist vollständig konfiguriert und dient hier als Validierungs-Stage.
+      - name: CDK synth
+        run: npx cdk synth --context stage=dev
+        working-directory: cdk

cdk/.gitignore

@@ -0,0 +1,8 @@
+*.js
+!jest.config.js
+*.d.ts
+node_modules
+
+# CDK asset staging directory
+.cdk.staging
+cdk.out

cdk/.npmignore

@@ -0,0 +1,6 @@
+*.ts
+!*.d.ts
+
+# CDK asset staging directory
+.cdk.staging
+cdk.out