fix(P03 W6): deploy.yml drift fixes — AWS_DEFAULT_REGION from secret, ref v1.25, no raw NOVA_AWS_* in shell env (SPEC §5.1/§5.2)

workflows-src/deploy.yml: aws-region now ${{ secrets.AWS_DEFAULT_REGION ||
'use-east-1' }} (was hardcoded us-east-1); platform checkout ref v1.25
(was v1.9, matching the consumer's @v1.25 pin). scripts/run_platform.sh
local fallback: unset raw NOVA_AWS_* + NOVA_GITEA_TOKEN after sourcing
.env.secrets (only canonical AWS_* names remain in shell env — the v1.8
blocked_env_vars guard). Re-synced to .github + .gitea.

---ci---
project: acdl
phase: 3
milestone: v1.26
status: execute
wave: W6
---

.gitea/workflows/deploy.yml

@@ -82,7 +82,7 @@ jobs:
         with:
           repository: acdl/acdl
           path: platform
-          ref: v1.9
+          ref: v1.25
 
       - uses: actions/setup-python@v5
         with:
@@ -104,7 +104,7 @@ jobs:
         with:
           # P4 (REQ-163): IAM role renamed acdl-deploy- → nova-deploy-.
           role-to-assume: ${{ secrets.NOVA_AWS_ACCESS_KEY_ID == '' && format('arn:aws:iam::{0}:role/nova-deploy-{1}', secrets.NOVA_AWS_ACCOUNT_ID, github.repository_id) || '' }}
-          aws-region: us-east-1
+          aws-region: ${{ secrets.AWS_DEFAULT_REGION || 'us-east-1' }}
           access-key-id: ${{ secrets.NOVA_AWS_ACCESS_KEY_ID }}
           secret-access-key: ${{ secrets.NOVA_AWS_SECRET_ACCESS_KEY }}
 

.github/workflows/deploy.yml

@@ -82,7 +82,7 @@ jobs:
         with:
           repository: acdl/acdl
           path: platform
-          ref: v1.9
+          ref: v1.25
 
       - uses: actions/setup-python@v5
         with:
@@ -104,7 +104,7 @@ jobs:
         with:
           # P4 (REQ-163): IAM role renamed acdl-deploy- → nova-deploy-.
           role-to-assume: ${{ secrets.NOVA_AWS_ACCESS_KEY_ID == '' && format('arn:aws:iam::{0}:role/nova-deploy-{1}', secrets.NOVA_AWS_ACCOUNT_ID, github.repository_id) || '' }}
-          aws-region: us-east-1
+          aws-region: ${{ secrets.AWS_DEFAULT_REGION || 'us-east-1' }}
           access-key-id: ${{ secrets.NOVA_AWS_ACCESS_KEY_ID }}
           secret-access-key: ${{ secrets.NOVA_AWS_SECRET_ACCESS_KEY }}
 

scripts/run_platform.sh

@@ -382,12 +382,19 @@ if [ -z "${AWS_ACCESS_KEY_ID:-}" ] || [ -z "${AWS_SECRET_ACCESS_KEY:-}" ]; then
   [ -f "$ENV_FILE" ] || fail ".env.secrets missing (run scripts/rotate_spike_key.sh) or set AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY env vars"
   set -a
   . "$ENV_FILE"
-   set +a
-   # P5 (REQ-164): dual-read fallback removed — NOVA_* only.
-   export AWS_ACCESS_KEY_ID="$NOVA_AWS_ACCESS_KEY_ID"
-   export AWS_SECRET_ACCESS_KEY="$NOVA_AWS_SECRET_ACCESS_KEY"
-   export AWS_DEFAULT_REGION="$AWS_DEFAULT_REGION"
- fi
+  set +a
+  # P5 (REQ-164): dual-read fallback removed — NOVA_* only.
+  # Copy the NOVA_* secrets to the canonical AWS_* env vars, then unset
+  # the raw NOVA_AWS_* + the forge-token name so they do NOT linger in
+  # the shell env (SPEC §5.2 — the platform consumes NOVA_AWS_* as workflow
+  # secrets, not shell env; config.security.bash_allowlist.blocked_env_vars
+  # blocks NOVA_AWS_* from shell env — the v1.8 root-cause guard).
+  export AWS_ACCESS_KEY_ID="$NOVA_AWS_ACCESS_KEY_ID"
+  export AWS_SECRET_ACCESS_KEY="$NOVA_AWS_SECRET_ACCESS_KEY"
+  # Region: prefer the .env.secrets AWS_DEFAULT_REGION; default us-east-1.
+  export AWS_DEFAULT_REGION="${AWS_DEFAULT_REGION:-us-east-1}"
+  unset NOVA_AWS_ACCESS_KEY_ID NOVA_AWS_SECRET_ACCESS_KEY NOVA_GITEA_TOKEN
+fi
 
 echo "=== Step 3c: Checkov on static code (fail-fast, before terraform plan) ==="
 # REQ-250 (v1.21): Checkov runs on the authored Terraform code BEFORE

tests/test_deploy_workflow_env_input.py

@@ -74,3 +74,44 @@ def test_run_platform_sh_has_environment_flag():
     assert "ENVIRONMENT_OVERRIDE" in text
     assert "NOVA_ENVIRONMENT_OVERRIDE" in text
     assert "ACDL_ENVIRONMENT_OVERRIDE" not in text
+
+
+def test_deploy_workflow_aws_region_from_secret_with_fallback():
+    """SPEC §5.2: aws-region is read from the AWS_DEFAULT_REGION secret (not
+    hardcoded). The ``|| 'us-east-1'`` fallback preserves backwards-compat
+    for consumers that haven't set the secret."""
+    text = GITHUB.read_text()
+    assert "aws-region: ${{ secrets.AWS_DEFAULT_REGION || 'us-east-1' }}" in text
+    # The hardcoded us-east-1 for the configure-aws-credentials step is gone.
+    assert "aws-region: us-east-1" not in text
+
+
+def test_deploy_workflow_platform_checkout_ref_matches_milestone():
+    """SPEC §7.2: the platform checkout ref matches the consumer's @v1.25
+    pin (the current v1.26 milestone's floating tag)."""
+    import yaml
+    wf = yaml.safe_load(GITHUB.read_text())
+    if True in wf:
+        wf["on"] = wf[True]
+    deploy_job = wf["jobs"]["deploy"]
+    checkout_steps = [s for s in deploy_job["steps"]
+                      if "checkout" in s.get("uses", "")]
+    platform_checkout = next(
+        (s for s in checkout_steps if s.get("with", {}).get("path") == "platform"),
+        None)
+    assert platform_checkout is not None, "must have a platform repo checkout"
+    assert platform_checkout["with"]["ref"] == "v1.25", \
+        "platform checkout ref must be v1.25 (matching the consumer's @v1.25 pin)"
+
+
+def test_run_platform_sh_local_fallback_unsets_raw_nova_aws_vars():
+    """SPEC §5.2: the local .env.secrets fallback must NOT leave raw
+    NOVA_AWS_* / the forge-token name in the shell env — only the
+    canonical AWS_* names. This is the v1.8 blocked_env_vars guard."""
+    text = (ROOT / "scripts" / "run_platform.sh").read_text()
+    # The fallback exports the canonical AWS_* names...
+    assert 'export AWS_ACCESS_KEY_ID="$NOVA_AWS_ACCESS_KEY_ID"' in text
+    assert 'export AWS_SECRET_ACCESS_KEY="$NOVA_AWS_SECRET_ACCESS_KEY"' in text
+    assert 'export AWS_DEFAULT_REGION="${AWS_DEFAULT_REGION:-us-east-1}"' in text
+    # ...then unsets the raw NOVA_AWS_* + the forge-token name.
+    assert "unset NOVA_AWS_ACCESS_KEY_ID NOVA_AWS_SECRET_ACCESS_KEY NOVA_GITEA_TOKEN" in text

workflows-src/deploy.yml

@@ -82,7 +82,7 @@ jobs:
         with:
           repository: acdl/acdl
           path: platform
-          ref: v1.9
+          ref: v1.25
 
       - uses: actions/setup-python@v5
         with:
@@ -104,7 +104,7 @@ jobs:
         with:
           # P4 (REQ-163): IAM role renamed acdl-deploy- → nova-deploy-.
           role-to-assume: ${{ secrets.NOVA_AWS_ACCESS_KEY_ID == '' && format('arn:aws:iam::{0}:role/nova-deploy-{1}', secrets.NOVA_AWS_ACCOUNT_ID, github.repository_id) || '' }}
-          aws-region: us-east-1
+          aws-region: ${{ secrets.AWS_DEFAULT_REGION || 'us-east-1' }}
           access-key-id: ${{ secrets.NOVA_AWS_ACCESS_KEY_ID }}
           secret-access-key: ${{ secrets.NOVA_AWS_SECRET_ACCESS_KEY }}