@biffo/cli 0.312.2 → 0.312.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -109,6 +109,44 @@ jobs:
|
|
|
109
109
|
- name: Scale drift guard
|
|
110
110
|
if: ${{ !cancelled() }}
|
|
111
111
|
run: pnpm exec biffo-scale-guard
|
|
112
|
+
# An unsuppressed `aws lambda update-function-*` prints the whole
|
|
113
|
+
# resolved function configuration -- every env var, plaintext -- into
|
|
114
|
+
# the Actions log, and the response is never consumed (biffo-template
|
|
115
|
+
# #334). deploy.yml's own `aws lambda update-function-code` call already
|
|
116
|
+
# follows the convention (--output text --query 'LastUpdateStatus'), but
|
|
117
|
+
# nothing in this repo's own CI asserted it would keep doing so: the
|
|
118
|
+
# guard existed only in biffo-template's root ci.yml, which scans this
|
|
119
|
+
# skeleton's tree from the template side but never runs inside a
|
|
120
|
+
# scaffolded sibling's own CI, so a regression added directly to a live
|
|
121
|
+
# sibling's deploy.yml was regression-proof only by a human reading the
|
|
122
|
+
# diff (#1968). `scripts/biffo.sh` resolves the version-pinned CLI this
|
|
123
|
+
# sibling was stamped with at birth (#1109), same as every other guard
|
|
124
|
+
# invocation in this job.
|
|
125
|
+
- name: Lambda output guard
|
|
126
|
+
if: ${{ !cancelled() }}
|
|
127
|
+
# This job's working-directory default is apps/frontend (top of this
|
|
128
|
+
# job), but scripts/biffo.sh lives at the repo root -- same relative-
|
|
129
|
+
# path convention as the js-audit job's own
|
|
130
|
+
# `sh ../../scripts/js-dependency-audit.sh` below. A bare
|
|
131
|
+
# `scripts/biffo.sh` here fails unconditionally with "No such file",
|
|
132
|
+
# on every run, regardless of whether there is a real
|
|
133
|
+
# lambda-output/terraform-input violation (biffo-template#1983).
|
|
134
|
+
run: sh ../../scripts/biffo.sh check lambda-output
|
|
135
|
+
# A Terraform subcommand that can prompt for an unresolved variable
|
|
136
|
+
# without -input=false, or a workflow running Terraform at all without
|
|
137
|
+
# TF_INPUT set as a backstop, hangs forever on a GitHub Actions runner --
|
|
138
|
+
# there is no stdin to answer the prompt with (biffo-template#322).
|
|
139
|
+
# `-auto-approve` does NOT prevent this. Same gap as the lambda-output
|
|
140
|
+
# guard above: deploy.yml's terraform invocations already pass
|
|
141
|
+
# `-input=false` and the workflow-level `TF_INPUT: '0'` above already
|
|
142
|
+
# exists as a backstop, but nothing in this repo's own CI asserted
|
|
143
|
+
# either would stay true (#1968).
|
|
144
|
+
- name: Terraform-input guard
|
|
145
|
+
if: ${{ !cancelled() }}
|
|
146
|
+
# Same cwd fix as the Lambda output guard step above -- this job's
|
|
147
|
+
# working-directory default is apps/frontend, and scripts/biffo.sh
|
|
148
|
+
# lives at the repo root (biffo-template#1983).
|
|
149
|
+
run: sh ../../scripts/biffo.sh check terraform-input
|
|
112
150
|
|
|
113
151
|
e2e:
|
|
114
152
|
name: E2E (Playwright)
|