From f844feab7fb7f6c48043bbf691878162bd8bd581 Mon Sep 17 00:00:00 2001 From: Jon Chery Date: Wed, 12 Aug 2026 21:09:11 +0000 Subject: [PATCH] chore(bootstrap): migrate ACDL_* env vars to NOVA_* (complete the v1.15 P5 rename) --- .ciagent/config.json | 4 ++-- terraform/bootstrap/apply_iam_baseline.py | 14 ++++++------- terraform/bootstrap/create_iam_user.py | 22 +++++++++++++-------- terraform/bootstrap/create_state_backend.py | 16 ++++++++++----- 4 files changed, 34 insertions(+), 22 deletions(-) diff --git a/.ciagent/config.json b/.ciagent/config.json index acbcece..5e78a05 100644 --- a/.ciagent/config.json +++ b/.ciagent/config.json @@ -59,7 +59,7 @@ }, "git": { "branching_strategy": "flat", - "_branching_strategy_note": "ACDL uses flat workflow (committed directly to main per established convention since v1.0). The 'phase' strategy is advisory; CIAgent uses milestone/phase branches for v1.14 but the project convention is flat.", + "_branching_strategy_note": "Nova uses flat workflow (committed directly to main per established convention since v1.0; renamed ACDL→Nova in v1.15). The 'phase' strategy is advisory; CIAgent uses milestone/phase branches for v1.14 but the project convention is flat.", "auto_commit": true, "auto_push": true }, @@ -67,7 +67,7 @@ "sources": [".env", ".env.secrets", ".env.*"], "disallow": ["shell_env", "netrc", "keychain", "rc_files", "global_config"], "scopes": { - "gitea": "ACDL_GITEA_TOKEN", + "gitea": "NOVA_GITEA_TOKEN", "github": "GITHUB_TOKEN", "gitlab": "GITLAB_TOKEN", "openai": "OPENAI_API_KEY", diff --git a/terraform/bootstrap/apply_iam_baseline.py b/terraform/bootstrap/apply_iam_baseline.py index c38e09d..dbdbfc9 100644 --- a/terraform/bootstrap/apply_iam_baseline.py +++ b/terraform/bootstrap/apply_iam_baseline.py @@ -5,15 +5,15 @@ policy if absent (or creates a new version if the policy document differs), attaches it to the spike-runner user, deletes any leftover inline policy, and re-creates the OIDC act_runner role if absent. -Requires the bootstrap root key (ACDL_BOOTSTRAP_AWS_* or ACDL_AWS_* +Requires the bootstrap root key (NOVA_BOOTSTRAP_AWS_* or NOVA_AWS_* when the provided key is a root principal). This script is the reproducible record of the Phase 56 live step — the grants are documented in .ciagent/IAM_POLICY.md and regression-tested by tests/test_iam_policy_baseline.py. Usage: - export ACDL_BOOTSTRAP_AWS_ACCESS_KEY_ID= - export ACDL_BOOTSTRAP_AWS_SECRET_ACCESS_KEY= + export NOVA_BOOTSTRAP_AWS_ACCESS_KEY_ID= + export NOVA_BOOTSTRAP_AWS_SECRET_ACCESS_KEY= export AWS_DEFAULT_REGION=us-east-1 python3 terraform/bootstrap/apply_iam_baseline.py """ @@ -30,7 +30,7 @@ import boto3 ROOT = Path(__file__).resolve().parent.parent.parent POLICY_PATH = ROOT / "terraform" / "bootstrap" / "spike_runner_policy.json" -ACCOUNT = os.environ.get("ACDL_AWS_ACCOUNT_ID", "581513795199") +ACCOUNT = os.environ.get("NOVA_AWS_ACCOUNT_ID", "581513795199") USER = "nova-spike-runner" POLICY_NAME = "nova-spike-runner-policy" POLICY_ARN = f"arn:aws:iam::{ACCOUNT}:policy/{POLICY_NAME}" @@ -38,10 +38,10 @@ ROLE_NAME = "nova-act-runner-role" def _session(): - key_id = os.environ.get("ACDL_BOOTSTRAP_AWS_ACCESS_KEY_ID") or os.environ.get("ACDL_AWS_ACCESS_KEY_ID") - secret = os.environ.get("ACDL_BOOTSTRAP_AWS_SECRET_ACCESS_KEY") or os.environ.get("ACDL_AWS_SECRET_ACCESS_KEY") + key_id = os.environ.get("NOVA_BOOTSTRAP_AWS_ACCESS_KEY_ID") or os.environ.get("NOVA_AWS_ACCESS_KEY_ID") + secret = os.environ.get("NOVA_BOOTSTRAP_AWS_SECRET_ACCESS_KEY") or os.environ.get("NOVA_AWS_SECRET_ACCESS_KEY") if not key_id or not secret: - sys.exit("FAIL: set ACDL_BOOTSTRAP_AWS_ACCESS_KEY_ID + ACDL_BOOTSTRAP_AWS_SECRET_ACCESS_KEY (root key)") + sys.exit("FAIL: set NOVA_BOOTSTRAP_AWS_ACCESS_KEY_ID + NOVA_BOOTSTRAP_AWS_SECRET_ACCESS_KEY (root key)") region = os.environ.get("AWS_DEFAULT_REGION", "us-east-1") return boto3.Session(aws_access_key_id=key_id, aws_secret_access_key=secret, region_name=region) diff --git a/terraform/bootstrap/create_iam_user.py b/terraform/bootstrap/create_iam_user.py index 434e872..5e2ff18 100644 --- a/terraform/bootstrap/create_iam_user.py +++ b/terraform/bootstrap/create_iam_user.py @@ -3,12 +3,14 @@ Idempotent: skips user creation if the user exists; creates an initial access key if none active exists. Prints the key to stdout for the orchestrator to capture (NEVER committed): - ACDL_AWS_ACCESS_KEY_ID=<...> - ACDL_AWS_SECRET_ACCESS_KEY=<...> + NOVA_AWS_ACCESS_KEY_ID=<...> + NOVA_AWS_SECRET_ACCESS_KEY=<...> Run with the bootstrap root key in env: - ACDL_BOOTSTRAP_AWS_ACCESS_KEY_ID / ACDL_BOOTSTRAP_AWS_SECRET_ACCESS_KEY - AWS_DEFAULT_REGION (defaults to us-east-1) + NOVA_BOOTSTRAP_AWS_ACCESS_KEY_ID / NOVA_BOOTSTRAP_AWS_SECRET_ACCESS_KEY + (falls back to NOVA_AWS_ACCESS_KEY_ID / NOVA_AWS_SECRET_ACCESS_KEY when + the provided key is a root principal). AWS_DEFAULT_REGION (defaults + to us-east-1). The inline policy is read from spike_runner_policy.json (next to this file). The account id + region are already substituted in the policy file @@ -38,9 +40,13 @@ POLICY_FILE = os.path.join(os.path.dirname(__file__), "spike_runner_policy.json" def main(): + key_id = os.environ.get("NOVA_BOOTSTRAP_AWS_ACCESS_KEY_ID") or os.environ.get("NOVA_AWS_ACCESS_KEY_ID") + secret = os.environ.get("NOVA_BOOTSTRAP_AWS_SECRET_ACCESS_KEY") or os.environ.get("NOVA_AWS_SECRET_ACCESS_KEY") + if not key_id or not secret: + sys.exit("FAIL: set NOVA_BOOTSTRAP_AWS_ACCESS_KEY_ID + NOVA_BOOTSTRAP_AWS_SECRET_ACCESS_KEY (root key)") session = boto3.Session( - aws_access_key_id=os.environ["ACDL_BOOTSTRAP_AWS_ACCESS_KEY_ID"], - aws_secret_access_key=os.environ["ACDL_BOOTSTRAP_AWS_SECRET_ACCESS_KEY"], + aws_access_key_id=key_id, + aws_secret_access_key=secret, region_name=REGION, ) iam = session.client("iam") @@ -71,8 +77,8 @@ def main(): print(" (use scripts/rotate_spike_key.sh to rotate)") return new_key = iam.create_access_key(UserName=USER_NAME)["AccessKey"] - print("ACDL_AWS_ACCESS_KEY_ID=" + new_key["AccessKeyId"]) - print("ACDL_AWS_SECRET_ACCESS_KEY=" + new_key["SecretAccessKey"]) + print("NOVA_AWS_ACCESS_KEY_ID=" + new_key["AccessKeyId"]) + print("NOVA_AWS_SECRET_ACCESS_KEY=" + new_key["SecretAccessKey"]) print(f"iam: created initial access key {new_key['AccessKeyId']} for {USER_NAME}", file=sys.stderr) diff --git a/terraform/bootstrap/create_state_backend.py b/terraform/bootstrap/create_state_backend.py index 90a711e..e33a426 100644 --- a/terraform/bootstrap/create_state_backend.py +++ b/terraform/bootstrap/create_state_backend.py @@ -6,8 +6,10 @@ evidence outbox (D-P08-1). Run with the bootstrap root key in env: - ACDL_BOOTSTRAP_AWS_ACCESS_KEY_ID / ACDL_BOOTSTRAP_AWS_SECRET_ACCESS_KEY - AWS_DEFAULT_REGION (defaults to us-east-1) + NOVA_BOOTSTRAP_AWS_ACCESS_KEY_ID / NOVA_BOOTSTRAP_AWS_SECRET_ACCESS_KEY + (falls back to NOVA_AWS_ACCESS_KEY_ID / NOVA_AWS_SECRET_ACCESS_KEY when + the provided key is a root principal). AWS_DEFAULT_REGION (defaults + to us-east-1). Writes terraform/bootstrap/.bootstrap_state.json (gitignored bookkeeping). @@ -30,15 +32,19 @@ import boto3 REGION = os.environ.get("AWS_DEFAULT_REGION", "us-east-1") -ACCOUNT_ID = os.environ.get("ACDL_AWS_ACCOUNT_ID", "581513795199") +ACCOUNT_ID = os.environ.get("NOVA_AWS_ACCOUNT_ID", "581513795199") STATE_BUCKET = f"nova-tfstate-{ACCOUNT_ID}-us-east-1" OUTBOX_TABLE = "nova-outbox" def main(): + key_id = os.environ.get("NOVA_BOOTSTRAP_AWS_ACCESS_KEY_ID") or os.environ.get("NOVA_AWS_ACCESS_KEY_ID") + secret = os.environ.get("NOVA_BOOTSTRAP_AWS_SECRET_ACCESS_KEY") or os.environ.get("NOVA_AWS_SECRET_ACCESS_KEY") + if not key_id or not secret: + sys.exit("FAIL: set NOVA_BOOTSTRAP_AWS_ACCESS_KEY_ID + NOVA_BOOTSTRAP_AWS_SECRET_ACCESS_KEY (root key)") session = boto3.Session( - aws_access_key_id=os.environ["ACDL_BOOTSTRAP_AWS_ACCESS_KEY_ID"], - aws_secret_access_key=os.environ["ACDL_BOOTSTRAP_AWS_SECRET_ACCESS_KEY"], + aws_access_key_id=key_id, + aws_secret_access_key=secret, region_name=REGION, ) s3 = session.client("s3", region_name=REGION)