feat: add CloudWatch IAM role, shielded deploy target, and CI for testnet-shielded-outputs

[luislhl]

Depends on: https://github.com/HathorNetwork/ops-tools/pull/1344

Summary

This PR adds infrastructure and CI improvements for the testnet-shielded-outputs environment:

CloudWatch IAM Role (serverless.yml)

The APIGatewayPushToCloudWatchLogs IAM role was previously required to exist manually before deployment. This PR adds it as a CloudFormation resource in the resources section, so Serverless Framework creates/manages it automatically. The TODO comment noting this gap has been removed.

Shielded Deploy Target (Makefile)

Adds a deploy-lambdas-shielded Makefile target to streamline deployments to the shielded stage:

• Region: eu-central-1
• AWS profile: testnet-shielded-outputs

CI/CD for testnet-shielded-outputs (.github/workflows/deploy.yml)

Adds automated deployment workflow for the testnet-shielded-outputs environment.

Fix: Poetry Export (pyproject.toml, Makefile)

Ensures poetry can properly export dependencies for deployment.

How to deploy

make deploy-lambdas-shielded

Summary by CodeRabbit

• Chores
  • Added deployment support for a new "shielded" testnet environment and CI workflow to run it.
  • Improved logging configuration for API gateway deployments to allow externally managed roles.
  • Updated packaging tooling to declare export-plugin support, ensuring consistent build/export behavior.

[coderabbitai]

📝 Walkthrough

Walkthrough

Adds a Makefile target and CI job for shielded testnet deployments, declares poetry-plugin-export and an ensure-install target, and changes serverless API Gateway logging to mark the role as managed externally (roleManagedExternally: true).

Changes

Shielded deployment and tooling

Layer / File(s)	Summary
Poetry plugin declaration pyproject.toml ([tool.poetry.requires-plugins])	Adds poetry-plugin-export >=1.8 to declare the export plugin requirement.
Ensure plugin & install wiring Makefile (lines ~64–81)	Adds ensure-poetry-export-plugin target that installs poetry-plugin-export if missing; install, deploy-lambdas, and deploy-lambdas-playground now depend on it.
Shielded deploy target & CI job Makefile (lines ~119–121), .github/workflows/deploy.yml (lines ~259–290)	Adds deploy-lambdas-shielded target (uses AWS_SDK_LOAD_CONFIG=1 and --aws-profile testnet-shielded-outputs) and deploy-testnet-shielded-outputs GitHub Actions job that calls the reusable deploy workflow with shielded testnet parameters.
Serverless API Gateway logging flag serverless.yml (line ~34)	Replaces explicit role ARN entry for provider.logs.restApi with roleManagedExternally: true.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly related PRs

• HathorNetwork/hathor-explorer-service#398: Related CI deploy workflow changes adding Slack notification support and reusable workflow adjustments used by this PR.

Suggested reviewers

• r4mmer
• tuliomir

Poem

🐰 I hop where deploy targets grow,
Plugins whispered in pyproject's row,
Shielded lambdas learn to fly,
CI hums beneath the sky,
Logs stay tidy while I try.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately summarizes the three main changes: adding CloudWatch IAM role handling, creating a shielded deploy target, and setting up CI for testnet-shielded-outputs.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/add-api-gateway-cloudwatch-role-and-shielded-deploy

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[Copilot]

Pull request overview

Adds infrastructure/config updates to support deploying a new shielded environment by having Serverless manage the API Gateway → CloudWatch IAM role and by adding a dedicated Makefile deploy target.

Changes:

• Adds an AWS::IAM::Role CloudFormation resource for API Gateway CloudWatch logging.
• Introduces make deploy-lambdas-shielded targeting stage shielded in eu-central-1 with the testnet-shielded-outputs AWS profile.
• Removes the TODO comment related to manually pre-creating the API Gateway CloudWatch role.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
serverless.yml	Adds CloudFormation resources for the API Gateway CloudWatch logs role and adjusts the related logs config comment.
Makefile	Adds a new deploy target for the shielded stage using a specific AWS profile/region.

Comments suppressed due to low confidence (1)

serverless.yml:1009

• CustomApiGatewayAccountCloudWatchRole is incomplete (only DependsOn is defined). As-is, this is invalid CloudFormation/YAML for a resource and will fail deployment. Either remove this stub resource or add the required Type and Properties (e.g., an AWS::ApiGateway::Account with CloudWatchRoleArn) so the template is valid.

    CustomApiGatewayAccountCloudWatchRole:
      DependsOn: ApiGatewayCloudWatchLogsRole

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[coderabbitai]

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

serverless.yml (1)

1044-1046: ⚠️ Potential issue | 🔴 Critical | ⚡ Quick win

CustomApiGatewayAccountCloudWatchRole is incomplete and will break deployment.

Line 1044 defines a resource without Type/Properties, so CloudFormation will reject the template.

🔧 Proposed fix

     CustomApiGatewayAccountCloudWatchRole:
       DependsOn: ApiGatewayCloudWatchLogsRole
+      Type: AWS::ApiGateway::Account
+      Properties:
+        CloudWatchRoleArn:
+          Fn::GetAtt:
+            - ApiGatewayCloudWatchLogsRole
+            - Arn

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@serverless.yml` around lines 1044 - 1046, The resource
CustomApiGatewayAccountCloudWatchRole is missing required CloudFormation fields
and will fail deployment; update the serverless.yml to define this resource as
an AWS::IAM::Role named CustomApiGatewayAccountCloudWatchRole (keeping the
existing DependsOn: ApiGatewayCloudWatchLogsRole) and provide the necessary
Properties including AssumeRolePolicyDocument (trust policy for
apigateway.amazonaws.com), RoleName or logical name, and inline Policies or
ManagedPolicyArns granting CloudWatch/logs permissions needed by API Gateway
(e.g., logs:CreateLogGroup, logs:CreateLogStream, logs:PutLogEvents); ensure the
property names match CloudFormation (Type and Properties) so the template
validates.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Outside diff comments:
In `@serverless.yml`:
- Around line 1044-1046: The resource CustomApiGatewayAccountCloudWatchRole is
missing required CloudFormation fields and will fail deployment; update the
serverless.yml to define this resource as an AWS::IAM::Role named
CustomApiGatewayAccountCloudWatchRole (keeping the existing DependsOn:
ApiGatewayCloudWatchLogsRole) and provide the necessary Properties including
AssumeRolePolicyDocument (trust policy for apigateway.amazonaws.com), RoleName
or logical name, and inline Policies or ManagedPolicyArns granting
CloudWatch/logs permissions needed by API Gateway (e.g., logs:CreateLogGroup,
logs:CreateLogStream, logs:PutLogEvents); ensure the property names match
CloudFormation (Type and Properties) so the template validates.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 0fd2f7ce-82a2-45de-9fef-9fdd62837e4f

📥 Commits

Reviewing files that changed from the base of the PR and between 82f096b and e3429b0.

📒 Files selected for processing (2)

• Makefile
• serverless.yml

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@serverless.yml`:
- Around line 1029-1047: The stack creates an account-scoped
AWS::ApiGateway::Account resource (CustomApiGatewayAccountCloudWatchRole)
pointing CloudWatchRoleArn at a stage-owned IAM role
(ApiGatewayCloudWatchLogsRole), which can cause race/deletion issues across
multiple stage stacks; to fix, remove creation of AWS::ApiGateway::Account from
per-stage stacks and instead provision a single account-level resource in a
dedicated foundation stack that exports the CloudWatchRoleArn, update per-stage
stacks to import/reference that exported CloudWatchRoleArn (or a parameter)
rather than creating CustomApiGatewayAccountCloudWatchRole, and if you must keep
the IAM role in CloudFormation, add DeletionPolicy: Retain to
ApiGatewayCloudWatchLogsRole to avoid accidental deletion.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 5c1a551b-ed24-40e4-97b3-4ce2ea72a5cb

📥 Commits

Reviewing files that changed from the base of the PR and between e3429b0 and 600c49d.

📒 Files selected for processing (4)

• .github/workflows/deploy.yml
• Makefile
• pyproject.toml
• serverless.yml