Replace the hand-rolled HMAC in RevalidationHookRunner with core
WebhookSigner (Standard Webhooks) from QQQ 4.1.0-RC.5, and send through
core SafeHttpClient.
New cdn_revalidation_hook fields:
- signatureFormat: STANDARD_WEBHOOKS (the default for new rows) or LEGACY,
which keeps X-Revalidate-Signature byte-for-byte. A null format, as on
existing rows, stays LEGACY.
- allowPlainHttp and internalAllowlist: explicit exceptions to the SSRF
policy.
Closes#15 (architecture review QRun-IO/qqq#1150, finding F11).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Add the standard repository files (CircleCI qqq-orb pipeline where
missing, .editorconfig, .gitattributes, CODEOWNERS, Dependabot, community
pointer files, CHANGELOG, CLAUDE.md/AGENTS.md, docs/DESIGN.md), make the
Maven wrapper executable, and add the README Build/License sections.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- CloudFrontCdnProvider: PATHS/ALL batches -> CreateInvalidation with the
batch caller reference as CallerReference (idempotent), IN_PROGRESS with
the invalidation id; checkPurge -> GetInvalidation. TAG/HOST batches are
refused. Throttling, TooManyInvalidationsInProgress, 429/5xx and network
failures are retryable; AccessDenied, InvalidArgument, NoSuchDistribution
and other 4xx are permanent. No SDK-level retries.
- testConnection: GetDistributionConfig + ListInvalidations(MaxItems=1) to
prove IAM scope, optional GetDistribution for domain/status, reports
whether X-Origin-Verify is configured without reading out its value.
- importStats: CloudWatch GetMetricData (AWS/CloudFront, DistributionId +
Region=Global, daily) into the new spi CdnEdgeStat.
- readConfig + CloudFrontDriftCheck.compare against the tofu
expected_config output (docs/cloudfront-expected-config.md).
- Credentials: env vars <secretRef>_ACCESS_KEY_ID / _SECRET_ACCESS_KEY.
- Tests use a JDK HttpServer stub (WireMock cannot start: the QQQ BOM pins
Jetty 12) with hand-built fixtures; CloudWatch (RPC v2 CBOR) is mocked.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
james.maesandClaude Opus 5.5