CodeArtifact provisioning check in account 581513795199 could not
complete — no AWS credentials available in the P1 execute environment
("Unable to locate credentials"). Per the task spec, provisioning is NOT
attempted (requires codeartifact:* IAM grants not confirmed for the
execute principal). Documented as a P1 blocker for the CodeArtifact mode
of the publish workflow's wheel-upload step.
docs/codeartifact-provisioning.md records:
- (a) the attempted commands (list-domains, describe-repository,
list-repositories) + the credentials-not-found error
- (b) the required IAM grants for a follow-up provisioning task:
codeartifact:CreateDomain, CreateRepository, GetRepositoryEndpoint,
GetAuthorizationToken, ReadFromRepository, PublishPackageToRepository
+ ssm:PutParameter (CAP-035) + lambda:PublishLayerVersion
- (c) the fallback: a private wheel index selected at deploy time via
the NOVA_WHEEL_INDEX env var (consumers / composite action) and
TWINE_REPOSITORY_URL + TWINE_USERNAME + TWINE_PASSWORD (publish step).
The workflow supports both CodeArtifact mode (NOVA_CODEARTIFACT_DOMAIN
set) and fallback-index mode (unset) — no single hostname is baked
into the synced workflow files.
CAP-035 invariant (SSM /nova/layer/nova-cli/version = <wheel-version>:
<layer-arn>) is unaffected by the index choice and is recorded
atomically after both the wheel upload + layer publish succeed.
---ci---
project: acdl
phase: 1
milestone: v1.28
status: execute
persona: backend-engineer
---/ci---
Jon Chery
3a09ca8ec1