Test estate content (forecode scripts/dev/create_test_estate.py)

Author: kschandramouli

.github/CODEOWNERS

@@ -0,0 +1 @@
+* @forecode-ai/api

.github/simulate.sh

@@ -0,0 +1,57 @@
+# Simulated deploys for the ForeCode test estate. Source it before deploy commands:
+#
+#   source .github/simulate.sh
+#   helm upgrade --install web ./chart ...
+#
+# The workflow keeps real deploy commands, so ForeCode detects them exactly as it would in a customer's pipeline,
+# but while SIMULATE is "true" (the default) the deploy tools only print what they would do. Nothing is deployed and
+# no cloud credentials are needed.
+#
+# SIMULATE_FAIL_EVERY=N makes every Nth run (by GITHUB_RUN_NUMBER) fail its deploy, to give a pipeline a known change
+# failure rate. 0 (the default) never fails.
+
+SIMULATE="${SIMULATE:-true}"
+SIMULATE_FAIL_EVERY="${SIMULATE_FAIL_EVERY:-0}"
+
+_simulated() {
+  echo "[simulated] $*"
+}
+
+# Deploy tools can fail on purpose (SIMULATE_FAIL_EVERY); building and publishing artifacts never do.
+_simulated_deploy() {
+  _simulated "$@"
+  if [ "$SIMULATE_FAIL_EVERY" -gt 0 ] && [ $(( ${GITHUB_RUN_NUMBER:-1} % SIMULATE_FAIL_EVERY )) -eq 0 ]; then
+    echo "::error::simulated deploy failure (run ${GITHUB_RUN_NUMBER:-1}, every ${SIMULATE_FAIL_EVERY}th run fails)"
+    return 1
+  fi
+}
+
+if [ "$SIMULATE" = "true" ]; then
+  helm() { _simulated_deploy helm "$@"; }
+  kubectl() { _simulated_deploy kubectl "$@"; }
+  aws() { _simulated_deploy aws "$@"; }
+  sam() { _simulated_deploy sam "$@"; }
+  ssh() { _simulated_deploy ssh "$@"; }
+  scp() { _simulated scp "$@"; }
+  docker() {
+    case "$1" in
+      push|login) _simulated docker "$@" ;;
+      *) command docker "$@" ;;
+    esac
+  }
+  npm() {
+    case "$1" in
+      publish) _simulated npm "$@" ;;
+      *) command npm "$@" ;;
+    esac
+  }
+  terraform() {
+    case "$1" in
+      plan) _simulated terraform "$@" ;;
+      apply|destroy|import) _simulated_deploy terraform "$@" ;;
+      init) command terraform init -backend=false "${@:2}" ;;
+      *) command terraform "$@" ;;
+    esac
+  }
+  echo "Deploys are simulated (SIMULATE=true): deploy tools print instead of acting."
+fi

.github/workflows/deploy-stage.yml

@@ -0,0 +1,35 @@
+name: deploy-stage
+
+# Reusable: build and deploy the functions to one stage.
+on:
+  workflow_call:
+    inputs:
+      stage:
+        type: string
+        required: true
+
+permissions:
+  contents: read
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    environment: ${{ inputs.stage }}
+    permissions:
+      contents: read
+      id-token: write
+    env:
+      SIMULATE: ${{ vars.LIVE_DEPLOYS != 'true' }}
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4.0.2
+        if: vars.AWS_ROLE_ARN != ''
+        with:
+          role-to-assume: ${{ vars.AWS_ROLE_ARN }}
+          aws-region: ap-southeast-2
+      - name: Deploy with SAM
+        run: |
+          source .github/simulate.sh
+          sam build --use-container
+          sam deploy --config-env "${{ inputs.stage }}" --no-confirm-changeset --no-fail-on-empty-changeset

.github/workflows/release.yml

@@ -0,0 +1,46 @@
+name: release
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  schedule:
+    - cron: "25 23 * * 1-5"
+  workflow_dispatch:
+    inputs:
+      production:
+        description: Also deploy to production (needs approval)
+        type: boolean
+        default: false
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - name: Unit tests
+        run: python3 -m unittest discover -s tests -t .
+
+  staging:
+    if: github.event_name != 'pull_request'
+    needs: test
+    permissions:
+      contents: read
+      id-token: write
+    uses: ./.github/workflows/deploy-stage.yml
+    with:
+      stage: staging
+
+  production:
+    if: github.event_name == 'workflow_dispatch' && inputs.production
+    needs: staging
+    permissions:
+      contents: read
+      id-token: write
+    uses: ./.github/workflows/deploy-stage.yml
+    with:
+      stage: production

README.md

@@ -1,2 +1,9 @@
 # sample-functions-lambda
-ForeCode test estate: Python functions deployed to AWS Lambda with SAM
+
+Part of the ForeCode test estate. Not a real product.
+
+Python functions deployed to AWS Lambda with the AWS SAM CLI: to `staging` on every change to `main` and on a
+schedule, and to `production` when run manually (the `production` environment needs an approval). Both stages use one
+reusable deploy job, called twice.
+
+Deploys are simulated: `.github/simulate.sh` makes the deploy tools print what they would do.

functions/__init__.py

@@ -0,0 +1,15 @@
+"""Refund eligibility: called by the payments API through API Gateway."""
+
+import json
+
+REFUND_WINDOW_DAYS = 30
+
+
+def eligible(days_since_purchase: int, used: bool) -> bool:
+    return days_since_purchase <= REFUND_WINDOW_DAYS and not used
+
+
+def handler(event: dict, _context: object) -> dict:
+    body = json.loads(event.get("body") or "{}")
+    ok = eligible(int(body.get("days", 0)), bool(body.get("used", False)))
+    return {"statusCode": 200, "body": json.dumps({"eligible": ok})}

functions/refunds/__init__.py

@@ -0,0 +1,13 @@
+version = 0.1
+
+[staging.deploy.parameters]
+stack_name = "refunds-staging"
+region = "ap-southeast-2"
+capabilities = "CAPABILITY_IAM"
+parameter_overrides = "Stage=staging"
+
+[production.deploy.parameters]
+stack_name = "refunds-production"
+region = "ap-southeast-2"
+capabilities = "CAPABILITY_IAM"
+parameter_overrides = "Stage=production"

functions/refunds/handler.py

@@ -0,0 +1,23 @@
+AWSTemplateFormatVersion: "2010-09-09"
+Transform: AWS::Serverless-2016-10-31
+Description: Refund eligibility functions
+
+Parameters:
+  Stage:
+    Type: String
+    AllowedValues: [staging, production]
+
+Resources:
+  RefundsFunction:
+    Type: AWS::Serverless::Function
+    Properties:
+      FunctionName: !Sub "refunds-${Stage}"
+      CodeUri: functions/
+      Handler: refunds.handler.handler
+      Runtime: python3.13
+      MemorySize: 128
+      Timeout: 5
+      Events:
+        Check:
+          Type: Api
+          Properties: {Path: /refunds/eligible, Method: post}