feat: Add scheduled cost sync lambda

.github/workflows/ci.yml

@@ -85,6 +85,18 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: npm
+          cache-dependency-path: apps/api/package-lock.json
+
+      - name: Build scheduled sync Lambda artifact
+        working-directory: apps/api
+        run: |
+          npm ci
+          npm run build:lambda
+
       - uses: hashicorp/setup-terraform@v3
         with:
           terraform_version: 1.8.5

.github/workflows/deploy-production.yml

@@ -40,6 +40,12 @@ jobs:
       - uses: aws-actions/amazon-ecr-login@v2
         id: login-ecr
 
+      - name: Build scheduled sync Lambda artifact
+        working-directory: apps/api
+        run: |
+          npm ci
+          npm run build:lambda
+
       - name: Terraform init
         working-directory: ${{ env.TF_ENV_DIR }}
         env:
@@ -50,6 +56,7 @@ jobs:
           TF_VAR_web_bucket_name: ${{ vars.WEB_BUCKET_NAME }}
           TF_VAR_api_image_uri: bootstrap-placeholder
           TF_VAR_worker_image_uri: bootstrap-placeholder
+          TF_VAR_scheduled_sync_interval_hours: ${{ vars.SCHEDULED_SYNC_INTERVAL_HOURS || '6' }}
           TF_VAR_db_name: ${{ vars.DB_NAME }}
           TF_VAR_db_username: ${{ vars.DB_USERNAME }}
           TF_VAR_db_password: ${{ secrets.DB_PASSWORD }}
@@ -83,6 +90,7 @@ jobs:
           TF_VAR_web_bucket_name: ${{ vars.WEB_BUCKET_NAME }}
           TF_VAR_api_image_uri: bootstrap-placeholder
           TF_VAR_worker_image_uri: bootstrap-placeholder
+          TF_VAR_scheduled_sync_interval_hours: ${{ vars.SCHEDULED_SYNC_INTERVAL_HOURS || '6' }}
           TF_VAR_db_name: ${{ vars.DB_NAME }}
           TF_VAR_db_username: ${{ vars.DB_USERNAME }}
           TF_VAR_db_password: ${{ secrets.DB_PASSWORD }}
@@ -116,6 +124,7 @@ jobs:
           TF_VAR_web_bucket_name: ${{ vars.WEB_BUCKET_NAME }}
           TF_VAR_api_image_uri: ${{ steps.tf-bootstrap.outputs.repository_url }}:${{ github.sha }}
           TF_VAR_worker_image_uri: ${{ steps.tf-bootstrap.outputs.repository_url }}:${{ github.sha }}
+          TF_VAR_scheduled_sync_interval_hours: ${{ vars.SCHEDULED_SYNC_INTERVAL_HOURS || '6' }}
           TF_VAR_db_name: ${{ vars.DB_NAME }}
           TF_VAR_db_username: ${{ vars.DB_USERNAME }}
           TF_VAR_db_password: ${{ secrets.DB_PASSWORD }}

README.md

@@ -54,7 +54,7 @@ flowchart LR
     API --> Customer["Customer AWS Accounts<br/>AssumeRole"]
 ```
 
-Underflow separates the customer-facing frontend, the API, and the background worker so cost syncs, alert evaluation, and notification delivery can run independently from the UI. The backend assumes customer roles only when needed, while synced reporting data stays in PostgreSQL for fast dashboard queries.
+Underflow separates the customer-facing frontend, the API, the scheduled sync runtime, and the alert worker so cost collection, alert evaluation, and notification delivery can run independently from the UI. The backend assumes customer roles only when needed, while synced reporting data stays in PostgreSQL for fast dashboard queries.
 
 ## Why This Project Is Credible
 
@@ -99,7 +99,8 @@ Underflow is deployed as:
 
 - a React frontend served from S3 through CloudFront
 - an Express API running on ECS Fargate
-- a background worker service for sync and alert execution
+- a scheduled Lambda for verified-account cost sync
+- a background worker service for alert execution
 - a PostgreSQL database on Amazon RDS
 - AWS-managed DNS, certificates, and email infrastructure
 

apps/api/.dockerignore

@@ -1,5 +1,6 @@
 node_modules
 dist
+build
 .env
 .env.*
 coverage