continuous-intelligence/acdl
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 128 Wiki Activity

fix(P30): temp dir isolation + forge-agnostic APIs + static-key override (P1-8, P1-9, S1)

Browse Source 
---ci---
project: acdl
phase: 30
milestone: v1.8
status: execute
---/ci---

P1-8: run_platform.sh now emits adapter output to $WORK/tf (per-run temp
dir), not the committed terraform/spike/ directory. The committed
terraform/spike/*.tf files are removed — they were scratch artifacts.
Deploy workflow artifact upload path updated to /tmp/acdl_platform_run_v18/tf/.
P1-9: contract_ingestor.py now reads GITHUB_API_BASE env for forge-agnostic
API URLs. _forge_type() detects GitHub vs Gitea. Search URL is branched
(GitHub uses /search/issues, Gitea uses /repos/{owner}/{repo}/issues).
S1: Deploy workflow configure-aws-credentials step restructured as a single
conditional step. OIDC when no static key (role-to-assume), static-key
when ACDL_AWS_ACCESS_KEY_ID present (access-key-id/secret-access-key inputs).
Both deploy workflows remain byte-identical.

Tests: +8 (292 -> 300). All pass. run_platform.sh --check-only green.
This commit is contained in:
Jon Chery
2026-07-22 22:08:23 +00:00
parent 843cd17b97
commit 1e4133e11a
9 changed files with 121 additions and 162 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/run_platform.sh
+14 -13
View File
@@ -86,8 +86,9 @@ stream() {
}
CONTRACT_ID="11111111-1111-1111-1111-111111111111" # spike fixed UUID
WORK="/tmp/acdl_platform_run_v17"
rm -rf "$WORK"; mkdir -p "$WORK"
WORK="/tmp/acdl_platform_run_v18"
TF_DIR="$WORK/tf"
rm -rf "$WORK"; mkdir -p "$TF_DIR"
echo "=== Step 0: environment onboarding check ==="
if [ -f "$CONTRACT" ]; then
@@ -118,14 +119,14 @@ python3 core/contract_resolver.py "$CONTRACT" "$WORK/stack.json" || fail "resolv
python3 -c "import json; d=json.load(open('$WORK/stack.json')); print(f'stack: {d[\"stack\"][\"name\"]} {d[\"stack\"][\"kind\"]} {len(d[\"resources\"])} resource(s)')"
echo ""
echo "=== Step 3: adapter compiles stack -> terraform/spike/*.tf ==="
python3 adapters/terraform/adapter.py "$WORK/stack.json" terraform/spike || fail "adapter failed"
echo "adapter: emitted terraform/spike/{main.tf,terraform.tf,providers.tf}"
echo "=== Step 3: adapter compiles stack -> $TF_DIR/*.tf ==="
python3 adapters/terraform/adapter.py "$WORK/stack.json" "$TF_DIR" || fail "adapter failed"
echo "adapter: emitted $TF_DIR/{main.tf,terraform.tf,providers.tf}"
if [ "$QUIET" = "0" ]; then
echo ""
echo "--- emitted terraform/spike/main.tf ---"
cat terraform/spike/main.tf
echo "--- emitted $TF_DIR/main.tf ---"
cat "$TF_DIR/main.tf"
echo "--- end main.tf ---"
fi
@@ -137,7 +138,7 @@ import json, os
d = json.load(open('$WORK/stack.json'))
assert d['stack']['name'], 'stack name missing'
assert len(d['resources']) >= 1, 'expected at least 1 resource'
tf_dir = 'terraform/spike'
tf_dir = '$TF_DIR'
for f in ('main.tf', 'terraform.tf', 'providers.tf'):
assert os.path.isfile(os.path.join(tf_dir, f)), f'{f} missing'
main = open(os.path.join(tf_dir, 'main.tf')).read()
@@ -166,7 +167,7 @@ export AWS_SECRET_ACCESS_KEY="$ACDL_AWS_SECRET_ACCESS_KEY"
export AWS_DEFAULT_REGION="$AWS_DEFAULT_REGION"
echo "=== Step 4: terraform init + validate + plan -lock=false (real AWS) ==="
cd terraform/spike
cd "$TF_DIR"
echo ""
echo "--- terraform init ---"
@@ -191,11 +192,11 @@ if [ "$PLAN_ONLY" = "1" ]; then
fi
echo ""
echo "=== Step 5: run Checkov on terraform/spike/main.tf ==="
echo "=== Step 5: run Checkov on $TF_DIR/main.tf ==="
if [ "$QUIET" = "0" ]; then
checkov -f terraform/spike/main.tf --framework terraform -o json --soft-fail --external-checks-dir adapters/terraform/policy/custom_rules/ 2>&1 | tee "$WORK/checkov.json"
checkov -f "$TF_DIR/main.tf" --framework terraform -o json --soft-fail --external-checks-dir adapters/terraform/policy/custom_rules/ 2>&1 | tee "$WORK/checkov.json"
else
checkov -f terraform/spike/main.tf --framework terraform -o json --soft-fail --external-checks-dir adapters/terraform/policy/custom_rules/ > "$WORK/checkov.json" 2> "$WORK/checkov.err"
checkov -f "$TF_DIR/main.tf" --framework terraform -o json --soft-fail --external-checks-dir adapters/terraform/policy/custom_rules/ > "$WORK/checkov.json" 2> "$WORK/checkov.err"
fi
[ -s "$WORK/checkov.json" ] || fail "checkov produced no output"
echo ""
@@ -266,7 +267,7 @@ echo "=== Step 9: publish outputs to SSM + GitHub PR comment ==="
# Read terraform outputs (if apply ran) and publish to SSM + format a PR comment.
# In --check-only mode, skip (no terraform apply runs).
if [ "$CHECK_ONLY" = "0" ]; then
cd terraform/spike
cd "$TF_DIR"
TF_OUTPUTS=$(terraform output -json 2>/dev/null || echo "{}")
cd "$ROOT"
python3 <<PY > "$WORK/outputs_step.json" 2>/dev/null || true