feat(bootstrap): mise tasks and deploy.yml integration

[scottschreckengaust]

Parent

Sub-issue 7 of #120 (RFC: Least-privilege CDK bootstrap policies as code)

Branch strategy

feat/bootstrap-cicd → targets feat/bootstrap-preflight

Estimated review time: ~20 min

Summary

Wire the preflight validator into the deployment pipeline and local task dependency chain. Ensures no deploy happens without validation — in CI or locally.

Deliverables

• Update cdk/mise.toml:
  • Add task dependency: deploy depends on preflight
  • Add //cdk:bootstrap:check task — CI-only variant (read-only, no deploy, just validation)
  • Document --force override for emergency deploys that skip preflight
• Update .github/workflows/deploy.yml:
  • Add preflight step before cdk deploy step
  • Preflight uses read-only AWS credentials (only cloudformation:DescribeStacks)
  • Preflight failure blocks the deploy with clear output
• Update .github/workflows/build.yml:
  • Add bootstrap:check step after synth
  • Validates generated cdk/bootstrap/ artifacts are up to date (no uncommitted drift)
  • Validates Aspect passes (already happens during synth, but make explicit in CI output)
• Create cdk/test/bootstrap/integration.test.ts:
  • End-to-end test: synth → aspect passes → preflight mock returns PASS → deploy would proceed
  • End-to-end test: synth → aspect passes → preflight mock returns FAIL → deploy blocked

Key design decisions

• build.yml (PR CI): runs Aspect via synth + checks generated artifacts are committed. No AWS credentials needed.
• deploy.yml (deploy CI): runs live preflight. Needs only cloudformation:DescribeStacks (not full deploy creds).
• Local mise //cdk:deploy depends on preflight — developers can't accidentally skip it. --force flag exists for emergencies but is documented as "you better know what you're doing."
• Preflight is a separate step (not embedded in deploy) so CI logs clearly show "preflight passed" vs "deploy started."

Acceptance criteria

• mise //cdk:deploy fails if preflight fails (locally)
• deploy.yml blocks deploy on preflight failure
• build.yml catches stale generated artifacts
• Force-override is documented and works
• No regression in existing CI workflows