The Step 5b kyverno-json block used a single-quoted heredoc (<<'PY') but
referenced $WORK and $CONTRACT_ID inside the Python body as literal
strings — neither variable expanded, so kj scan ran against the literal
filename "$WORK/tfshow.json" (FileNotFoundError) and recorded contractId
"$CONTRACT_ID" verbatim. The entire Step 5b plan-JSON policy pass was
silently broken whenever kj was installed (it only "worked" in the
kj-absent skip path, which the tests exercise).
Fix: pass the two values as argv (python3 - "$WORK/tfshow.json"
"$CONTRACT_ID" <<'PY') and read them via sys.argv. This preserves the
single-quoted heredoc (no shell expansion into Python source — avoids a
payload-injection vector if $CONTRACT_ID ever contained a quote) while
correctly threading the values into the engine.
---ci---
project: acdl
phase: 5
milestone: v1.25-kyverno-json
status: verify
lessons:
- P0 fix applied: Step 5b heredoc <<'PY' prevented $WORK/$CONTRACT_ID
expansion → kj scan read literal filename, Step 5b silently broken
whenever kj installed. Re-threaded via sys.argv (also closes a
payload-injection vector vs naively unquoting the heredoc).
---/ci---
Jon Chery
2cc76f4f94