chore: update base files

.github/dependabot.yml

@@ -0,0 +1,34 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: monthly
+    groups:
+      github-actions:
+        patterns:
+          - "*"
+    cooldown:
+      default-days: 30
+
+  - package-ecosystem: uv
+    directory: /
+    schedule:
+      interval: monthly
+    groups:
+      python-dependencies:
+        patterns:
+          - "*"
+    cooldown:
+      default-days: 30
+
+  - package-ecosystem: pre-commit
+    directory: /
+    schedule:
+      interval: monthly
+    groups:
+      pre-commit:
+        patterns:
+          - "*"
+    cooldown:
+      default-days: 30

.github/workflows/deploy.yaml

@@ -8,9 +8,6 @@ on:
   push:
     branches:
       - main
-  pull_request:
-    branches:
-      - main
   workflow_dispatch:
     inputs:
       stage:
@@ -37,36 +34,26 @@ jobs:
       STAGE: ${{ inputs.stage || 'dev'}}
       OWNER: ${{ github.actor }}
       STAC_REGISTER_SERVICE_ID: ${{ vars.STAC_REGISTER_SERVICE_ID }}
-    
+
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v6
-        with:
-          node-version: 24
-
-      - name: Install AWS CDK CLI
-        run: npm install -g aws-cdk
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v7
-        with:
-          version: "latest"
+        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
 
       - name: Install dependencies
-        run: uv sync
+        run: uv sync --locked
 
       - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@v6
+        uses: aws-actions/configure-aws-credentials@254c19bd240aabef8777f48595e9d2d7b972184b # v6.2.1
         with:
           role-to-assume: ${{ vars.DEPLOY_ROLE }}
           aws-region: ${{ inputs.aws_region || vars.AWS_REGION }}
 
       - name: CDK Synth
-        run: uv run cdk synth
+        run: uv run npx cdk synth
 
       - name: CDK Deploy
         if: github.event_name == 'workflow_dispatch'
-        run: uv run cdk deploy --require-approval never --all
+        run: uv run npx cdk deploy --require-approval never --all

.github/workflows/pr.yaml

@@ -0,0 +1,38 @@
+name: Pull Request Workflow
+
+permissions:
+  id-token: write
+  contents: read
+
+on:
+  pull_request:
+    branches:
+      - main
+
+jobs:
+  validate:
+    if: github.event.pull_request.head.repo.fork == false
+    runs-on: ubuntu-latest
+    env:
+      STAGE: dev
+      OWNER: ${{ github.actor }}
+      STAC_REGISTER_SERVICE_ID: ${{ vars.STAC_REGISTER_SERVICE_ID }}
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+
+      - name: Install dependencies
+        run: uv sync --locked
+
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@254c19bd240aabef8777f48595e9d2d7b972184b # v6.2.1
+        with:
+          role-to-assume: ${{ vars.DEPLOY_ROLE }}
+          aws-region: us-west-2
+
+      - name: CDK Diff
+        run: uv run npx cdk diff --ci

.gitignore

@@ -8,6 +8,10 @@ __pycache__/
 cdk.out/
 
 # Environment files
+.venv
 .env
 .env.local
 .env.*.local
+
+.DS_Store
+.*cache

.pre-commit-config.yaml

@@ -2,15 +2,41 @@
 # Please run `pre-commit run --all-files` when adding or changing entries.
 
 repos:
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v6.0.0
+    hooks:
+      - id: check-yaml
+      - id: trailing-whitespace
+
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.9.9
+    rev: v0.16.4
     hooks:
-      - id: ruff
-        args: [ --fix ]
+      - id: ruff-check
+        args: [--fix]
       - id: ruff-format
+        types_or: [python, pyi, pyproject]
+
+  - repo: https://github.com/DavidAnson/markdownlint-cli2
+    rev: v0.23.2
+    hooks:
+      - id: markdownlint-cli2
+        args:
+        - "--fix"
+        - "--config"
+        - "pyproject.toml"
+        - "--configPointer"
+        - "/tool/markdownlint-cli2"
+
+  - repo: https://github.com/astral-sh/uv-pre-commit
+    rev: 0.12.5
+    hooks:
+      - id: uv-lock
+
   - repo: https://github.com/pre-commit/mirrors-mypy
-    rev: v1.15.0
+    rev: v2.3.1
     hooks:
       - id: mypy
         additional_dependencies:
-        - types-requests
+          - types-requests
+          - pydantic>=2.13.4
+          - pydantic-settings>=2.15.0

LICENSE

@@ -186,10 +186,11 @@
       same "printed page" as the copyright notice for easier
       identification within third-party archives.
 
-   Copyright (c) 2022 California Institute of Technology (“Caltech”) U.S. Government sponsorship acknowledged,
-   and United States Government as represented by the Administrator of the National Aeronautics and Space Administration. 
-   All rights reserved.
+   Copyright (c) 2022 California Institute of Technology (“Caltech”) U.S. Government
+   sponsorship acknowledged, and United States Government as represented by the
+   Administrator of the National Aeronautics and Space Administration.
 
+   All rights reserved.
 
    Licensed under the Apache License, Version 2.0 (the "License");
    you may not use this file except in compliance with the License.

README.md

@@ -2,32 +2,41 @@
 
 This codebase stores the IaC for authentication and common IAM roles used for the MAAP STAC infrastructure.
 
-Note : Managing cognito users should be done via the console.
+Note : Managing individual cognito users should be done via the console.
 
-## Deploying
+## Contributing
 
-### Requirements
+### 1. Prerequisites
 
-- `docker` is running
-- the AWS CDK CLI is installed
-- [`uv`](https://docs.astral.sh/uv/) is installed
+First, ensure you have [uv](https://docs.astral.sh/uv/getting-started/installation/#standalone-installer) installed. You can install it using one of the official commands:
 
-### Installation
+* **pip:** Suggested: `pipx install uv` or `pip install uv`
+* **Homebrew:** `brew install uv`
+* **macOS/Linux:** `curl -LsSf https://astral.sh | sh`
+* **Windows:** `powershell -c "irm https://astral.sh | iex"`
 
-```bash
-uv sync
-```
+### 2. Development Setup
 
-Locally Run Synthesis:
-```bash
-# Set environment variables for local testing
-export STAGE=dev
-export OWNER=myname
-export STAC_REGISTER_SERVICE_ID=my-service-id
+1. **Fork and clone** the repository.
+2. **Install project dependencies** (this automatically sets up a virtual environment):
 
-# Test the CDK synthesis locally
-uv run cdk synth --all
-```
+   ```bash
+   uv sync
+   ```
+
+3. **Install the pre-commit hooks** so your code is automatically linted before every commit:
+
+   ```bash
+   uv run pre-commit install
+   ```
+
+### 3. Verification Commands
+
+* **Manually run lints across all files:**
+
+  ```bash
+  uv run pre-commit run --all-files
+  ```
 
 ## Cognito resources
 

config.py

@@ -1,10 +1,11 @@
 from getpass import getuser
 
-import pydantic
+from pydantic import Field
+from pydantic_settings import BaseSettings
 
 
-class Config(pydantic.BaseSettings):
-    stage: str = pydantic.Field(
+class Config(BaseSettings):
+    stage: str = Field(
         description=" ".join(
             [
                 "Stage of deployment (e.g. 'dev', 'prod').",
@@ -14,15 +15,15 @@ class Config(pydantic.BaseSettings):
         ),
         default_factory=getuser,
     )
-    stac_register_service_id: str = pydantic.Field(
+    stac_register_service_id: str = Field(
         description=" ".join(
             [
                 "name of the service id with the stack:register scope.",
             ]
         ),
         default_factory=getuser,
     )
-    owner: str = pydantic.Field(
+    owner: str = Field(
         description=" ".join(
             [
                 "Name of primary contact for Cloudformation Stack.",

infra/AuthStack.py

@@ -1,6 +1,7 @@
 import json
-from enum import Enum
-from typing import Any, Dict, Optional, Sequence
+from collections.abc import Sequence
+from enum import StrEnum
+from typing import Any
 
 from aws_cdk import (
     CfnOutput,
@@ -18,7 +19,7 @@
 from constructs import Construct
 
 
-class BucketPermissions(str, Enum):
+class BucketPermissions(StrEnum):
     read_only = "r"
     read_write = "wr"
 
@@ -175,8 +176,8 @@ def _get_client_secret(
     def _create_secret(
         self,
         service_id: str,
-        secret_dict: Dict[Any, Any],
-        replica_regions: Optional[Sequence[str]] = None,
+        secret_dict: dict[Any, Any],
+        replica_regions: Sequence[str] | None = None,
     ):
         """
         Create a secret to represent service credentials.
@@ -214,8 +215,8 @@ def _create_secret(
     def add_resource_server(
         self,
         resource_id: str,
-        supported_scopes: Dict[str, str],
-    ) -> Dict[str, cognito.OAuthScope]:
+        supported_scopes: dict[str, str],
+    ) -> dict[str, cognito.OAuthScope]:
         """
         The resource server represents something that a client would like to be able to
         access. Each scope represents a resource/action granted to an application.
@@ -247,8 +248,8 @@ def add_resource_server(
     def add_user_client(
         self,
         service_id: str,
-        name: Optional[str] = None,
-        replica_regions: Optional[Sequence[str]] = None,
+        name: str | None = None,
+        replica_regions: Sequence[str] | None = None,
     ) -> cognito.UserPoolClient:
         client = self.userpool.add_client(
             service_id,
@@ -273,7 +274,7 @@ def add_service_client(
         self,
         service_id: str,
         scopes: Sequence[cognito.OAuthScope],
-        replica_regions: Optional[Sequence[str]] = None,
+        replica_regions: Sequence[str] | None = None,
     ) -> cognito.UserPoolClient:
         """
         Adds a client to the user pool that represents a service (ie not individual
@@ -329,7 +330,7 @@ def add_cognito_group(
         self,
         group_name: str,
         description: str,
-        bucket_permissions: Dict[str, BucketPermissions],
+        bucket_permissions: dict[str, BucketPermissions],
     ) -> cognito.CfnUserPoolGroup:
         identity_pool_id = self.identitypool.identity_pool_id
         role = iam.Role(