fix(ci): deploy against the bootstrap artefact stores, not the superseded ones

[bradwindy]

The problem

Commit 3fa8f68 put the deploy-artefact stores under IaC in the separate nzimageapi-bootstrap stack, and wired local deploys to them via samconfig.toml. CI was never wired up:

• sam deploy still passed --resolve-s3, so it reused the SAM-auto-created aws-sam-cli-managed-default-... bucket.
• --image-repositories came from the CONVERTER_ECR_REPO environment variable (production, set 2026-07-09), which still held the pre-migration companion-stack repo nzimageapi40221342/jp2converterfunctione92cbfdcrepo.

So every CI deploy kept pushing a ~195 MB image into the unmanaged repo and a zip into the unmanaged bucket, which is the exact cost problem 3fa8f68 set out to solve. Confirmed against the account: the most recent push to the old repo is from today's CI deploy, while the bootstrap repo has only the one image from the local deploy that created it.

The fix

samconfig.toml is gitignored, so CI cannot read the wiring. A new Resolve bootstrap artefact stores step reads the two values from the bootstrap stack's outputs at deploy time and passes them to sam deploy as --s3-bucket and --image-repositories.

Reading the stack rather than adding a second GitHub variable is the point of the change: a hand-maintained copy going stale is what caused this in the first place.

If the stack is missing or either output is absent, the step fails the job with a pointer to the bootstrap-deploy command, so a misconfigured deploy never reaches the push. || outputs='[]' and jq '.[]?' keep the missing-stack and empty-outputs cases on that guarded path instead of aborting on a raw ValidationError under set -e.

Verification

The step body was simulated against a stubbed aws:

Case	Result
Stack missing (aws exits 255)	AWS error printed, guard fires, exit 1
Stack exists, outputs null	guard fires, exit 1
Outputs present, one key missing	guard fires, exit 1
Both outputs present	resolves, writes GITHUB_OUTPUT correctly

Against the live stack it returns nzimageapi-sam-artifacts-... and .../nzimageapi/jp2converter. YAML parses. The deploy role carries PowerUserAccess, so cloudformation:DescribeStacks is permitted, and ubuntu-24.04-arm preinstalls both the AWS CLI and jq.

The real proof is the deploy this PR triggers on merge: its artefacts should land in the bootstrap bucket and repo, and nothing new should appear in the superseded ones.

Follow-ups (agreed, not in this PR)

• Delete the now-unreferenced CONVERTER_ECR_REPO environment variable.
• Retire the superseded ECR repo and aws-sam-cli-managed-default bucket once a CI deploy against the bootstrap stores is confirmed.

🤖 Generated with Claude Code

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: f070d13f-52b9-45a0-8b68-f71b7e9f7539

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}