---
ci---
project: acdl
phase: 67b
milestone: v1.12
status: execute
---
/ci---
The modules-lifecycle pipeline now defaults to plan-only (fast, no AWS
mutation, no credentials, no cost) so it runs on every PR. A CI variable
ACDL_LIFECYCLE_MODE (workflow_dispatch input 'lifecycle_mode', default
'plan') overrides to 'full' for the real apply->modify->destroy against
live AWS.
Scripts: run_lifecycle_test.sh / run_lifecycle_destroy.sh /
run_l2_lifecycle_test.sh / run_l2_lifecycle_destroy.sh read the flag and
dispatch to --plan-only (plan mode) or --apply/--destroy (full mode).
Destroy is a no-op exit 0 in plan mode (nothing was applied). VPC-output
injection is gated on full mode.
Workflows: both .github + .gitea (byte-identical) expose lifecycle_mode
as a workflow_dispatch input (choice: plan/full), pass it via env:
ACDL_LIFECYCLE_MODE to every lifecycle step, skip ci-vpc-apply +
ci-vpc-destroy + Read-CI-VPC-outputs in plan mode, and run the lifecycle
+ l2-lifecycle jobs with if: always() so they execute (plan-only) even
when ci-vpc-apply is skipped.
Contract + schema: pipelines/modules-lifecycle.yml gains default_mode:
plan; the schema accepts default_mode (enum plan|full) and a richer
workflow_dispatch inputs shape.
Tests: 14 new tests in test_lifecycle_mode_flag.py (script dispatch) +
10 new tests in TestModulesLifecyclePipeline (workflow flag wiring,
byte-identity, plan-mode skips). Updated test_platform_vpc_destroy to
reflect the plan-mode skip. 516 tests pass; smoke-tested plan mode on
the s3 module (--plan-only green, no AWS apply).
Two architectural changes:
1. Created terraform/ci-vpc/ — a short-lived VPC for L1 module lifecycle
testing, separate from the long-lived platform VPC. Created before
VPC-dependent modules (alb, ecs-service, rds, uptime) are tested,
destroyed after. Outputs (vpc_id, subnet_ids, sg_id, cluster_arn) are
passed to those modules via scripts/run_lifecycle_test.sh +
run_lifecycle_destroy.sh wrappers that inject the CI VPC outputs into
the example contracts.
2. Updated the workflow to use ci-vpc-apply → lifecycle (with artifact
passing) → ci-vpc-destroy (always runs).
8 module-specific fixes:
- s3: unique bucket names (acdl-ci-s3a-simple/complex) instead of
globally-taken 'my-simple-bucket'
- kms-key: alias name with no spaces (locals.tf → alias/acdl-ci-kms)
- iam-role: example contract uses role_name (not name, which the interface
doesn't declare)
- ecs-service: example contract uses family (not name); VPC inputs
(cluster_arn, subnets, security_group) injected by CI VPC wrapper
- uptime: added subnets, security_group, cluster_arn to interface + module;
network_configuration is dynamic (only when subnets provided)
- rds: added subnet_ids input + db_subnet_group resource (conditional
on subnet_ids being non-empty)
- alb: removed hardcoded placeholder sg/subnet values from examples;
vpc_id + subnets + security_group injected by CI VPC wrapper
- cloudfront: removed invalid placeholder WAF ARN from complex example
Regression: 479 passed, 0 skipped, 5 deselected. All 24 example contracts
pass --check-only.
---ci---
project: acdl
phase: P59
milestone: v1.11
status: execute
---/ci---
Jon Chery