fix(provisioning): retry KMS fresh-principal policy + bind EC2 IAM instance profile post-launch #1975
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| jobs: | |
| check-build-test: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 | |
| - uses: voidzero-dev/setup-vp@ca1c46663915d6c1042ae23bd39ab85718bfb0fa # v1 | |
| with: | |
| node-version: "24" | |
| cache: true | |
| run-install: false | |
| - run: vp install --frozen-lockfile | |
| - run: vp run check | |
| - run: vp run test | |
| - run: vp run build | |
| # Issue #399 — fail CI when docs/integ-coverage.md or | |
| # docs/_generated/integ-coverage.json is stale relative to | |
| # src/provisioning/register-providers.ts + | |
| # tests/integration/*/{lib,bin}/*.ts. Regenerate via the same | |
| # `vp run integ-coverage` task the contributor would run, then | |
| # fail-on-diff. Closes the "forgot to regenerate after editing" | |
| # gap that the /verify-pr skill step is the manual fallback for. | |
| - name: integ-coverage matrix is up-to-date | |
| run: | | |
| vp run integ-coverage | |
| if ! git diff --quiet -- docs/integ-coverage.md docs/_generated/integ-coverage.json; then | |
| echo "::error::integ-coverage matrix is stale — run \`vp run integ-coverage\` and commit the regenerated docs/integ-coverage.md + docs/_generated/integ-coverage.json" | |
| git --no-pager diff -- docs/integ-coverage.md docs/_generated/integ-coverage.json | |
| exit 1 | |
| fi | |
| # Issue #398 — fail CI when the cached three-tier provider-coverage | |
| # audit (docs/_generated/provider-coverage.json) Tier 1 list drifts | |
| # from src/provisioning/register-providers.ts. Offline check (<1s, | |
| # no AWS calls — the full regeneration via | |
| # `vp run audit:coverage:regenerate` would take 10-30 min + AWS | |
| # CFn DescribeType throttling and stays a manual / future-cron job | |
| # per issue #398 Option A). Catches the "added a new provider but | |
| # forgot to regen the audit cache" case structurally, mirroring | |
| # the integ-coverage step above. | |
| - run: vp run audit:coverage:check | |
| # Issue #423 — fail CI when docs/scenario-coverage.md or | |
| # docs/_generated/scenario-coverage.json is stale relative to | |
| # the KNOWN_SCENARIOS taxonomy in | |
| # scripts/build-scenario-coverage-matrix.ts and the per-fixture | |
| # tests/integration/<name>/.scenarios.json sidecars. Same shape as | |
| # the integ-coverage step above. The script ALSO hard-fails on a | |
| # sidecar carrying an unknown tag (typo guard), so the step covers | |
| # both "forgot to regenerate" and "wrote a typo tag" classes. | |
| - name: scenario-coverage matrix is up-to-date | |
| run: | | |
| vp run scenario-coverage | |
| if ! git diff --quiet -- docs/scenario-coverage.md docs/_generated/scenario-coverage.json; then | |
| echo "::error::scenario-coverage matrix is stale — run \`vp run scenario-coverage\` and commit the regenerated docs/scenario-coverage.md + docs/_generated/scenario-coverage.json" | |
| git --no-pager diff -- docs/scenario-coverage.md docs/_generated/scenario-coverage.json | |
| exit 1 | |
| fi | |
| # Fail CI when src/provisioning/unsupported-types.generated.ts is stale | |
| # relative to docs/_generated/provider-coverage.json (tier3). The runtime | |
| # pre-flight reads the generated module, so it must track the audit cache. | |
| # Same shape as the integ-coverage / scenario-coverage staleness guards. | |
| - name: unsupported-types module is up-to-date | |
| run: | | |
| vp run gen:unsupported-types | |
| if ! git diff --quiet -- src/provisioning/unsupported-types.generated.ts; then | |
| echo "::error::src/provisioning/unsupported-types.generated.ts is stale — run \`vp run gen:unsupported-types\` and commit the regenerated module" | |
| git --no-pager diff -- src/provisioning/unsupported-types.generated.ts | |
| exit 1 | |
| fi | |
| # Fail CI when src/provisioning/property-coverage.generated.ts is stale | |
| # relative to the CFn schema fixtures + each SDK provider's | |
| # handledProperties / unhandledByDesign declarations. The runtime | |
| # property-level pre-flight (ProviderRegistry.validateResourceProperties) | |
| # reads the generated module, so it must track the source data. | |
| # The codegen writes a raw multi-line shape; the committed module is | |
| # Prettier-formatted, so we run `vp run format` after the codegen to | |
| # canonicalize before diffing (mirrors how the file was written at | |
| # scaffold time in 476d3c1). | |
| - name: property-coverage module is up-to-date | |
| run: | | |
| vp run gen:property-coverage | |
| vp run format | |
| if ! git diff --quiet -- src/provisioning/property-coverage.generated.ts; then | |
| echo "::error::src/provisioning/property-coverage.generated.ts is stale — run \`vp run gen:property-coverage && vp run format\` and commit the regenerated module" | |
| git --no-pager diff -- src/provisioning/property-coverage.generated.ts | |
| exit 1 | |
| fi | |
| runtime-compat: | |
| runs-on: ubuntu-latest | |
| needs: check-build-test | |
| strategy: | |
| matrix: | |
| node-version: [20, 22, 24] | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 | |
| - uses: voidzero-dev/setup-vp@ca1c46663915d6c1042ae23bd39ab85718bfb0fa # v1 | |
| with: | |
| node-version: "24" | |
| cache: true | |
| run-install: false | |
| - run: vp install --frozen-lockfile | |
| - run: vp run build | |
| - run: vp env exec --node ${{ matrix.node-version }} node dist/cli.js --version |