fix(security): deploy workshop via constrained SSM document

.github/workflows/workshop.yml

@@ -160,20 +160,24 @@ jobs:
           IMAGE_ALIAS: ${{ steps.target.outputs.image_alias }}
         run: |
           set -euo pipefail
+          # Uses the constrained SSM document demohouse-workshop-deploy rather
+          # than AWS-RunShellScript. This repository is PUBLIC, and the deploy
+          # role can reach both demo instances, so sending an arbitrary command
+          # list here meant anyone able to push to a workshop branch could run
+          # arbitrary commands as root on the live demo hosts. The document
+          # hardcodes the deploy steps and constrains every parameter with an
+          # allowedPattern that SSM enforces server-side, so no shell
+          # metacharacter can reach the host. The deploy role's IAM policy now
+          # permits ssm:SendCommand ONLY on that document.
           parameters=$(jq -n \
             --arg registry "${REGISTRY}" \
             --arg tag "${GITHUB_SHA}" \
             --arg digest "${EXPECTED_DIGEST}" \
             --arg alias "${IMAGE_ALIAS}" \
-            '{commands: [
-              "set -euo pipefail",
-              "cd /opt/demohouse",
-              ("aws ecr get-login-password --region ap-southeast-1 | docker login --username AWS --password-stdin " + $registry),
-              ("ECR_REGISTRY=" + $registry + " ./scripts/deploy-workshop.sh " + $tag + " " + $digest + " " + $alias)
-            ]}')
+            '{Registry: [$registry], Tag: [$tag], Digest: [$digest], Alias: [$alias]}')
           command_id=$(aws ssm send-command \
             --instance-ids "${INSTANCE_ID}" \
-            --document-name AWS-RunShellScript \
+            --document-name demohouse-workshop-deploy \
             --comment "Workshop ${GITHUB_REF_NAME} ${GITHUB_SHA}" \
             --parameters "${parameters}" \
             --query 'Command.CommandId' \

workshops/build_workshop/README.md

@@ -6,11 +6,16 @@ with ClickPipes, conversational BI with ClickHouse Agents, observability with Cl
 (including an AI-built SRE dashboard), a break-and-fix incident lab diagnosed by an AI
 SRE, and an in-app AI chat traced to Langfuse Cloud.
 
-Learners clone the repository, then switch to `build-workshop-v1`. Maintainers create a
-feature branch, open a PR to protected `dev-build-workshop-v1`, verify
-[dev-workshop.demohouse.cloud](https://dev-workshop.demohouse.cloud), then promote
-`dev-build-workshop-v1` to protected `build-workshop-v1` for
-[workshop.demohouse.cloud](https://workshop.demohouse.cloud).
+Learners clone this repository, then switch to `build-workshop-v1`. That flow is unchanged:
+the code attendees run lives in `app/` here, in the public repo, and module 00 still starts
+with `git clone https://github.com/ClickHouse/ClickHouse_Demos.git`.
+
+> **The playbook web app has moved.** The Next.js site previously served at
+> workshop.demohouse.cloud and dev-workshop.demohouse.cloud now lives in the private
+> `ClickHouse/WorkshopHouse` repository (`site/`), and is being republished on a new
+> subdomain. Its build/deploy pipelines in this repository are disabled. Only the web app
+> moved -- the attendee-facing workshop code stays here so learners do not need access to
+> a private repository.
 
 ## Architecture
 
@@ -62,7 +67,8 @@ flowchart LR
 The published diagrams (the ClickHouse Cloud platform stack, the workshop architecture, the
 data flow, and the module flow) are generated as clean SVGs by `docs/diagrams/gen_diagrams.py`
 — edit that script and re-run it (`python3 gen_diagrams.py all`) to regenerate them, then copy
-the SVGs into `playbook/public/`.
+the SVGs into `site/public/` in the `ClickHouse/WorkshopHouse` repository (they used to go to
+`playbook/public/` here, before the playbook web app moved out).
 
 ## Workflows
 
@@ -121,7 +127,7 @@ flowchart LR
 | Path | What |
 |---|---|
 | `app/` | The foundation app participants run locally: React frontend, FastAPI backend, Postgres + data generator, ClickStack OTel overlay. Workshop entrypoint: `preflight.sh` + `docker-compose.workshop.yml` + `.env.workshop.example`. See `app/WORKSHOP_CHANGES.md`, `app/CHAT_FEATURE.md`, `app/OBSERVABILITY.md`. |
-| `playbook/` | The published follow-along playbook (Next.js + Fumadocs; dual learner/instructor tracks plus self-paced and troubleshooting pages; deploys to workshop.demohouse.cloud). Requires Node >= 22.12 to build. |
+| _(moved)_ | The published follow-along playbook has moved to the private `ClickHouse/WorkshopHouse` repository, at `site/`, with its content under `site/content/docs/build-workshop/`. Only the web app moved -- the code in `app/` that attendees run stays here, in this public repo, so `git clone` in module 00 keeps working. |
 | `docs/` | `diagrams/` — the platform, architecture, data-flow, and module-flow SVGs, generated by `gen_diagrams.py`. |
 | `infra/` | Instructor tooling via clickhousectl: the demo stack end-to-end run (`provision_workshop_stack.sh e2e`, which doubles as the dry run) and the shared-Postgres FALLBACK pool for participants whose orgs cannot create a managed Postgres. |