PR Custody

chore(thermos): add toolkit registry SSM build runbook

@acsrujanchecks n/achecks…add-thermos-toolkit-registry-ssm-runbook → master5 files · +431 −8review: @abir-taheerreview: @anshugarg15updated 2d ago

GitHub

▸Description

Summary

add the checked-in SSM Automation document for building the Thermos toolkit registry image on an EC2 builder
add the versioned build script that fetches the GitHub deploy key and Thermos DB credentials from AWS Secrets Manager, builds apps/thermos/onprem/registry.Dockerfile, and pushes to ECR
update the registry Dockerfile and self-hosted image workflow to pass the production DB URL via BuildKit secrets instead of Docker build args
document builder prerequisites, IAM permissions, SSM document creation/update commands, and execution examples

Current AWS state

The SSM Automation document already exists in the production AWS account:
- name: Composio-BuildThermosToolkitRegistryImage
- region: us-east-1
- status: Active
- latest/default version: 7
The live document now defaults to:
- GitRef=master
- empty ImageTag means use the checked-out commit SHA, matching .github/workflows/self_hosted_image.yml
The live document validates free-form parameters with allowedPattern / allowedValues before shell execution.
The GitHub deploy private key already exists in Secrets Manager:
- prod/github-deploy-key/hermes-thermos-toolkit-registry-builder
The Thermos DB credentials secret used by default is:
- prod-rdsproxy-thermos-writer-credentials

Live SSM test

Provisioned a dedicated production EC2 builder for the test:
- instance: i-058876a42109955ca
- role/profile: ThermosToolkitRegistryBuilderRole / ThermosToolkitRegistryBuilderProfile
Successfully ran SSM Automation execution:
- execution id: 7d1a475d-7e59-4cf8-81c8-d8970eac52f9
- status: Success
- runtime: ~6 minutes
Pushed ECR image:
- repository: composio-self-host/thermos-toolkit-registry
- tag: ssm-test-7761532eae9b-20260610085750
- digest: sha256:19e617cfd932a43a9433b1f2c420f830a7b7cd11d99c26d055cc8f5d7c083674
Did not promote latest:
- latest remains on digest sha256:9794cc0142a9e7603c970903d09a7001409ce55eb71e1c49961d8637ae567b2e with tag r20260610_00

Review feedback addressed

Added SSM parameter validation to prevent shell-template injection from untrusted Automation inputs.
Replaced --build-arg SOURCE_DB=... with BuildKit --secret usage for the SSM build script and the GitHub self-hosted image workflow.
Updated apps/thermos/onprem/registry.Dockerfile to read SOURCE_DB from a required BuildKit secret mount and export it only for registry-dump.
Kept GitRef=master intentionally per operator request for this EC2/SSM path.
Fixed issues found by live SSM testing: shell runs under bash, missing HOME under SSM, force-pushed branch reset handling, and file-backed BuildKit secret passing.

Can it run before this PR merges?

Yes, but only if the SSM execution overrides GitRef to this PR branch:

GitRef=add-thermos-toolkit-registry-ssm-runbook

With the default GitRef=master, the AWS document will clone the repo and look for ops/ssm/thermos-toolkit-registry/build_thermos_toolkit_registry_image.sh. That file is not on master until this PR is merged, so the default execution path requires this GitHub change to land first.

No GitHub Actions runner is required. The build runs on the target EC2 builder through SSM.

Validation

bash -n ops/ssm/thermos-toolkit-registry/build_thermos_toolkit_registry_image.sh
YAML parse for ops/ssm/thermos-toolkit-registry/ssm-document.yaml
AWS accepted SSM document version 7
Live SSM build succeeded and pushed a non-latest test image to ECR

loading diff…