Skip to content
PR Readiness Coach Walkthrough

Owner UI

The owner UI lives under upstream web/. Cognito sign-in → run history + Try it. Self-sign-up is disabled; only the invited owner email can sign in.

ClientCredentialRoutes
Amplify SPA (browser)Cognito email/password → JWT Authorization: BearerGET /runs, GET /runs/{runId}, POST /ui/analyze
GitHub Actions / CLIAPI key (x-api-key)POST /analyze

Invite the owner

Section titled “Invite the owner”

Pass the owner email on CDK deploy. For GitHub Deploy, set Actions secret PR_READY_OWNER_EMAIL (preferred); Deploy reads the secret first, then falls back to an Actions variable of the same name.

Terminal window
export PR_READY_OWNER_EMAIL=you@example.com
npx cdk deploy --require-approval never -c enableDynamo=true -c ownerEmail="$PR_READY_OWNER_EMAIL"

If the user was not created by CDK, create once:

Terminal window
POOL_ID="$(aws cloudformation describe-stacks --stack-name PrReadinessCoachStack \
  --query "Stacks[0].Outputs[?OutputKey=='CognitoUserPoolId'].OutputValue" --output text)"
aws cognito-idp admin-create-user \
  --user-pool-id "$POOL_ID" \
  --username "$PR_READY_OWNER_EMAIL" \
  --user-attributes Name=email,Value="$PR_READY_OWNER_EMAIL" Name=email_verified,Value=true \
  --desired-delivery-mediums EMAIL

Invited users start in FORCE_CHANGE_PASSWORD. Prefer signing in on the SPA (it prompts for a permanent password), or set one via console / admin-set-user-password --permanent.

Amplify Hosting (zip path)

Section titled “Amplify Hosting (zip path)”

Hosting uses Amplify zip deploy
SPA hosting path: CDK creates Amplify app/branch with auto-build off; a separate job zip-uploads the Vite build — no GitHub↔Amplify Git connection. — not a GitHub↔Amplify console connection.

  1. CDK creates an Amplify app + main branch (enableAutoBuild: false, no repository)
  2. Separate job deploy-amplify (after CDK) runs scripts/deploy-amplify.sh:
    • Reads ApiUrl + Cognito outputs from the stack
    • Builds web/ with VITE_* baked in
    • Zip-uploads (create-deployment → upload → start-deployment)
Terminal window
# After CDK deploy
npm run deploy:amplify
# App URL:
aws cloudformation describe-stacks --stack-name PrReadinessCoachStack \
  --query "Stacks[0].Outputs[?OutputKey=='AppUrl'].OutputValue" --output text

Caveats

Section titled “Caveats”
  • Vite bake-time env: VITE_API_URL / Cognito IDs are compiled into the JS bundle. The Amplify job must run after CDK so those outputs exist. Re-run deploy-amplify whenever API/Cognito outputs change.
  • Separate jobs on purpose: CDK failures stay in deploy; SPA/build/Amplify failures stay in deploy-amplify.
  • No VITE_API_KEY: browser auth is Cognito JWT only — never put the API key in Amplify / Vite env.
  • Root amplify.yml is unused for this zip path (buildSpec on the Amplify app is console-compat only).
  • After the first AppUrl is known, you may tighten API Gateway CORS from * to that origin in a follow-up.

Local UI without Amplify

Section titled “Local UI without Amplify”
Terminal window
cd web
cp .env.example .env.local   # fill Cognito + ApiUrl
npm run dev

Demo evidence

Section titled “Demo evidence”

Runs list (NOT READY / READY / READY WITH WARNINGS):

Amplify owner UI runs list showing mixed readiness verdicts

Try it — POST /ui/analyze with Cognito JWT:

Amplify Try it panel posting analyze with Cognito JWT

Cost notes

Section titled “Cost notes”

DynamoDB on-demand + ~30-day TTL; Cognito free tier covers a single user; Amplify Hosting free tier is usually enough for a private demo. Bedrock invoke cost dominates real usage.