Merge pull request #238 from co-cddo/refactor/smoke-pack-dryrun-and-fixes

smoke pack DRY, workflow extraction, CI unblock

Author: chrisns

.env.example

@@ -0,0 +1,31 @@
+# NDX:Try AWS Scenarios — environment variables
+# Copy to .env (which is gitignored) and fill in for local work.
+
+# -----------------------------------------------------------------------------
+# Smoke-pack (scripts/smoke.sh / .github/workflows/smoke.yml)
+# -----------------------------------------------------------------------------
+
+# CFN stack name to read outputs from. Default is "all-demo" (the umbrella
+# nested stack). For scoped local runs against a single scenario, set to that
+# scenario's stack name.
+SMOKE_STACK_NAME=all-demo
+
+# us-east-1 per CLAUDE.md and the spec. The smoke account does not deploy
+# scenarios anywhere else.
+SMOKE_AWS_REGION=us-east-1
+
+# Local only: SSO profile for the smoke-test AWS account. Unset on CI; the
+# OIDC role is exported by aws-actions/configure-aws-credentials.
+# Account-specific values are committed in docs/smoke-test-account-config.yml.
+SMOKE_AWS_PROFILE=NDX/SmokeTest
+
+# Optional: webhook to receive smoke-failure notifications. If unset, CI
+# falls back to opening a GitHub issue tagged `smoke-failed` on nightly cron
+# failures only (PR-scoped failures already surface via the PR check).
+# SMOKE_FAILURE_WEBHOOK=https://...
+
+# -----------------------------------------------------------------------------
+# Portal site (existing) — see playwright.config.ts
+# -----------------------------------------------------------------------------
+
+# BASE_URL=http://localhost:8080

.github/CODEOWNERS

@@ -0,0 +1,21 @@
+# Sensitive paths require review from the ndx team. The smoke-test-deploy
+# environment's branch policy auto-approves refs/heads/main; PRs touching any
+# of these paths can't run with deploy credentials until a CODEOWNERS
+# reviewer signs off.
+
+# Smoke pack
+/.github/workflows/smoke.yml         @co-cddo/ndx
+/scripts/smoke*.sh                   @co-cddo/ndx
+/scripts/check-quarantines.mjs       @co-cddo/ndx
+/tests/smoke/**                      @co-cddo/ndx
+
+# Smoke account state
+/docs/smoke-test-account-setup.md    @co-cddo/ndx
+/docs/smoke-test-account-config.yml  @co-cddo/ndx
+
+# Renovate (guarded so config drift can't self-merge)
+/renovate.json                       @co-cddo/ndx
+/.github/workflows/renovate.yml      @co-cddo/ndx
+
+# Retention-policy lint (guarded against accidental loosening)
+/scripts/lint-retention-policies.sh  @co-cddo/ndx