Deploy your first workflow

FinanceWorkflow:
  Type: Custom::RippflowWorkflow
  DeletionPolicy: Retain
  UpdateReplacePolicy: Retain
  Properties:
    ServiceToken: !Ref RippflowDeploymentServiceToken # ServiceToken output from execution-plane/deployment-service/template.json
    RetainDeployment: true
    Deployment:
      contract: scoped-deployments-v1
      installationId: production
      tenantId: finance
      namespace: reconciliation
      definition:
        name: finance-reconciliation
        version: 1.0.0
        phases:
          ingest:
            requires: []
            service: ingest
      bindings:
        ingest:
          type: lambda
          functionArn: !Ref IngestPublishedVersionArn
          invocationRoleArn: !GetAtt InvokeIngestRole.Arn
          executionRoleArn: !GetAtt IngestWorkloadRole.Arn
Outputs:
  WorkflowDeploymentId:
    Value: !GetAtt FinanceWorkflow.DeploymentId

export RIPPFLOW_DEPLOYMENT_URL="https://REPLACE.execute-api.us-east-1.amazonaws.com/v1"
export AWS_PROFILE=finance-deployer

# 1. Publish immutable scoped deployment
rippflow deploy workflow.yaml \
  --tenant finance --namespace reconciliation \
  --bindings bindings.json --json
rippflow deployments inspect "$DEPLOYMENT_ID" --json

# 2a. Start and poll a full DAG workflow execution (requires runtime-template.json / scoped-workflow-executions-v1)
rippflow deployments run "$DEPLOYMENT_ID" \
  --execution-id run-001 --input input.json --shards shards.json --json
rippflow deployments execution "$DEPLOYMENT_ID" --execution-id run-001 --json

# 2b. Dispatch and inspect a single bound phase task (Lambda or Batch)
rippflow deployments dispatch "$DEPLOYMENT_ID" \
  --phase ingest --dispatch-id run-001-ingest --input input.json --json
rippflow deployments status "$DEPLOYMENT_ID" --dispatch-id run-001-ingest --json

AWSTemplateFormatVersion: '2010-09-09'
Parameters:
  DeploymentRestApiId:
    Type: String
    Description: REST API ID extracted from the deployment stack DeploymentApiUrl output
  DeploymentStageName:
    Type: String
    Default: v1
  WorkflowDeploymentId:
    Type: String
    AllowedPattern: "^[a-f0-9]{64}$"
  TenantId:
    Type: String
    Default: finance
    AllowedPattern: "^[a-z0-9][a-z0-9_-]{0,62}$"

Resources:
  # In NativeIAM mode, /tenants/<TenantId>/ authorizes execute on matching tenant deployments.
  # In Default mode, also grant execute to EventBridgeWorkflowExecutorRole.RoleId in GrantPoliciesTableName.
  EventBridgeWorkflowExecutorRole:
    Type: AWS::IAM::Role
    Properties:
      Path: !Sub "/tenants/${TenantId}/"
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: events.amazonaws.com
            Action: sts:AssumeRole
            Condition:
              StringEquals:
                aws:SourceAccount: !Ref AWS::AccountId
      Policies:
        - PolicyName: InvokeScopedWorkflowExecution
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action: execute-api:Invoke
                Resource: !Sub "arn:${AWS::Partition}:execute-api:${AWS::Region}:${AWS::AccountId}:${DeploymentRestApiId}/${DeploymentStageName}/POST/v1/deployments/${WorkflowDeploymentId}/executions"

  # Requires runtime-template.json (scoped-workflow-executions-v1) for /executions.
  OrderPlacedWorkflowRule:
    Type: AWS::Events::Rule
    Properties:
      EventPattern:
        source: ["acme.orders"]
        detail-type: ["OrderPlaced"]
      Targets:
        - Id: StartRippflowScopedExecution
          Arn: !Sub "arn:${AWS::Partition}:execute-api:${AWS::Region}:${AWS::AccountId}:${DeploymentRestApiId}/${DeploymentStageName}/POST/v1/deployments/${WorkflowDeploymentId}/executions"
          RoleArn: !GetAtt EventBridgeWorkflowExecutorRole.Arn
          InputTransformer:
            InputPathsMap:
              eventId: "$.id"
              orderId: "$.detail.orderId"
            InputTemplate: '{"executionId":"eb-<eventId>","correlationId":"<orderId>","input":{"orderId":"<orderId>"}}'

Outputs:
  EventBridgeExecutorRoleId:
    Value: !GetAtt EventBridgeWorkflowExecutorRole.RoleId

# Derive DeploymentRestApiId from the deployment stack's DeploymentApiUrl output:
DEPLOYMENT_API_URL="$(aws cloudformation describe-stacks \
  --stack-name rippflow-deployment-runtime \
  --query "Stacks[0].Outputs[?OutputKey=='DeploymentApiUrl'].OutputValue" --output text)"
DEPLOYMENT_REST_API_ID="$(printf '%s\n' "$DEPLOYMENT_API_URL" | sed -E 's|^https://([^.]+)\.execute-api\..*$|\1|')"

aws cloudformation deploy \
  --stack-name finance-order-eventbridge-trigger \
  --template-file eventbridge-trigger.yaml \
  --capabilities CAPABILITY_IAM \
  --parameter-overrides \
    "DeploymentRestApiId=$DEPLOYMENT_REST_API_ID" \
    "WorkflowDeploymentId=$DEPLOYMENT_ID" \
    "TenantId=finance"