continuous-intelligence/acdl
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 128 Wiki Activity

fix(P03 W6): deploy.yml drift fixes — AWS_DEFAULT_REGION from secret, ref v1.25, no raw NOVA_AWS_* in shell env (SPEC §5.1/§5.2)

Browse Source 
workflows-src/deploy.yml: aws-region now ${{ secrets.AWS_DEFAULT_REGION ||
'use-east-1' }} (was hardcoded us-east-1); platform checkout ref v1.25
(was v1.9, matching the consumer's @v1.25 pin). scripts/run_platform.sh
local fallback: unset raw NOVA_AWS_* + NOVA_GITEA_TOKEN after sourcing
.env.secrets (only canonical AWS_* names remain in shell env — the v1.8
blocked_env_vars guard). Re-synced to .github + .gitea.

---ci---
project: acdl
phase: 3
milestone: v1.26
status: execute
wave: W6
---
This commit is contained in:
Jon Chery
2026-08-18 23:30:31 +00:00
parent 023cc47025
commit b237b3e85b
5 changed files with 60 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/run_platform.sh
+13 -6
View File
@@ -382,12 +382,19 @@ if [ -z "${AWS_ACCESS_KEY_ID:-}" ] || [ -z "${AWS_SECRET_ACCESS_KEY:-}" ]; then
[ -f "$ENV_FILE" ] || fail ".env.secrets missing (run scripts/rotate_spike_key.sh) or set AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY env vars"
set -a
. "$ENV_FILE"
set +a
# P5 (REQ-164): dual-read fallback removed — NOVA_* only.
export AWS_ACCESS_KEY_ID="$NOVA_AWS_ACCESS_KEY_ID"
export AWS_SECRET_ACCESS_KEY="$NOVA_AWS_SECRET_ACCESS_KEY"
export AWS_DEFAULT_REGION="$AWS_DEFAULT_REGION"
fi
set +a
# P5 (REQ-164): dual-read fallback removed — NOVA_* only.
# Copy the NOVA_* secrets to the canonical AWS_* env vars, then unset
# the raw NOVA_AWS_* + the forge-token name so they do NOT linger in
# the shell env (SPEC §5.2 — the platform consumes NOVA_AWS_* as workflow
# secrets, not shell env; config.security.bash_allowlist.blocked_env_vars
# blocks NOVA_AWS_* from shell env — the v1.8 root-cause guard).
export AWS_ACCESS_KEY_ID="$NOVA_AWS_ACCESS_KEY_ID"
export AWS_SECRET_ACCESS_KEY="$NOVA_AWS_SECRET_ACCESS_KEY"
# Region: prefer the .env.secrets AWS_DEFAULT_REGION; default us-east-1.
export AWS_DEFAULT_REGION="${AWS_DEFAULT_REGION:-us-east-1}"
unset NOVA_AWS_ACCESS_KEY_ID NOVA_AWS_SECRET_ACCESS_KEY NOVA_GITEA_TOKEN
fi
echo "=== Step 3c: Checkov on static code (fail-fast, before terraform plan) ==="
# REQ-250 (v1.21): Checkov runs on the authored Terraform code BEFORE