@codyswann/lisa 4.27.3 → 4.27.4

package/cdk/create-only/.github/workflows/ci.yml

@@ -18,9 +18,17 @@ jobs:
       cdk_env: ${{ steps.env.outputs.cdk_env }}
       aws_account_id: ${{ steps.env.outputs.aws_account_id }}
       role_arn: ${{ steps.env.outputs.role_arn }}
+      role_name: ${{ steps.env.outputs.role_name }}
     steps:
       - name: 🔄 Set environment
         id: env
+        env:
+          # Non-secret REPOSITORY VARIABLE (Settings → Variables), not a secret
+          # — a role name is not sensitive and secrets are unreadable when you
+          # need to debug this. Read through `env:` rather than interpolated
+          # straight into the shell below, because `${{ vars.* }}` pasted into a
+          # `run:` body is a script-injection seam.
+          CDK_CI_READ_ONLY_ROLE_NAME: ${{ vars.CDK_CI_READ_ONLY_ROLE_NAME }}
         run: |
           # For workflow dispatch, use the input
           if [ "${{ github.event_name }}" == "workflow_dispatch" ]; then
@@ -48,25 +56,72 @@ jobs:
 
           echo "environment=$TARGET_ENV" >> $GITHUB_OUTPUT
 
+          # ─────────────────────────────────────────────────────────────────
+          # Pick the AWS identity by TRIGGER, not by environment.
+          #
+          # This job only READS — cdk synth, cdk diff, unit tests — so a pull
+          # request must not be able to obtain deploy credentials. GitHub emits
+          # the SAME OIDC subject for every pull request no matter which branch
+          # it targets:
+          #
+          #   pull_request      -> repo:<owner>/<repo>:pull_request
+          #   workflow_dispatch -> repo:<owner>/<repo>:ref:refs/heads/<branch>
+          #
+          # Because this workflow maps base branch -> account, a deploy role
+          # used here has to trust `...:pull_request` in EVERY account this
+          # repo validates against, production included. Anyone who can open a
+          # pull request could then assume the production deploy role.
+          #
+          # ⚠️ Do NOT collapse this to a single role. The branch is the whole
+          # point. A read-only role whose trust policy admits only the
+          # `pull_request` subject will REFUSE the `ref:refs/heads/<branch>`
+          # subject that workflow_dispatch presents, and the failure is opaque:
+          #
+          #   Not authorized to perform sts:AssumeRoleWithWebIdentity
+          #
+          # with nothing in it naming the subject that was rejected. You would
+          # only discover it the day you reach for the manual-dispatch path.
+          #
+          # To adopt the least-privileged default, create a role (default name
+          # CiReadOnlyServiceRole) in each account, with:
+          #   - a trust policy on the GitHub OIDC provider whose
+          #     token.actions.githubusercontent.com:sub condition is
+          #     repo:<owner>/<repo>:pull_request
+          #   - read-only permissions, plus whatever the CDK bootstrap lookup
+          #     role needs for `cdk synth` / `cdk diff`.
+          # Name it something else? Set the repository VARIABLE
+          # CDK_CI_READ_ONLY_ROLE_NAME. Haven't provisioned it yet? Set that
+          # same variable to DeployServiceRole — behaviour is then identical to
+          # a repo scaffolded before this seam existed, and nothing here breaks.
+          # ─────────────────────────────────────────────────────────────────
+          if [ "${{ github.event_name }}" == "pull_request" ]; then
+            ROLE_NAME="${CDK_CI_READ_ONLY_ROLE_NAME:-CiReadOnlyServiceRole}"
+          else
+            ROLE_NAME="DeployServiceRole"
+          fi
+
+          echo "role_name=$ROLE_NAME" >> $GITHUB_OUTPUT
+
           # Map to CDK environment name.
           # Set your per-environment AWS account IDs as repository or environment
           # secrets: AWS_ACCOUNT_ID_PRODUCTION / AWS_ACCOUNT_ID_STAGING / AWS_ACCOUNT_ID_DEV.
-          # The deploy role name defaults to DeployServiceRole; change it below if yours differs.
+          # The role name comes from the trigger-based selection above — do not
+          # hardcode one here, or the pull-request narrowing is silently undone.
           case $TARGET_ENV in
             production)
               echo "cdk_env=production" >> $GITHUB_OUTPUT
               echo "aws_account_id=${{ secrets.AWS_ACCOUNT_ID_PRODUCTION }}" >> $GITHUB_OUTPUT
-              echo "role_arn=arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID_PRODUCTION }}:role/DeployServiceRole" >> $GITHUB_OUTPUT
+              echo "role_arn=arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID_PRODUCTION }}:role/$ROLE_NAME" >> $GITHUB_OUTPUT
               ;;
             staging)
               echo "cdk_env=staging" >> $GITHUB_OUTPUT
               echo "aws_account_id=${{ secrets.AWS_ACCOUNT_ID_STAGING }}" >> $GITHUB_OUTPUT
-              echo "role_arn=arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID_STAGING }}:role/DeployServiceRole" >> $GITHUB_OUTPUT
+              echo "role_arn=arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID_STAGING }}:role/$ROLE_NAME" >> $GITHUB_OUTPUT
               ;;
             dev|*)
               echo "cdk_env=dev" >> $GITHUB_OUTPUT
               echo "aws_account_id=${{ secrets.AWS_ACCOUNT_ID_DEV }}" >> $GITHUB_OUTPUT
-              echo "role_arn=arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID_DEV }}:role/DeployServiceRole" >> $GITHUB_OUTPUT
+              echo "role_arn=arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID_DEV }}:role/$ROLE_NAME" >> $GITHUB_OUTPUT
               ;;
           esac
 
@@ -104,6 +159,26 @@ jobs:
           role-session-name: cdk-ci-checks
           aws-region: us-east-1
 
+      - name: 🪪 Verify assumed identity
+        id: verify_identity
+        env:
+          EXPECTED_ROLE: ${{ needs.determine_environment.outputs.role_name }}
+        run: |
+          # Every remaining step in this job only reads, so a silent revert to
+          # the deploy role would pass all of them. Without this assertion the
+          # over-privilege regression is invisible. sts:GetCallerIdentity needs
+          # no IAM permissions at all, so it works under the read-only role.
+          CALLER_ARN="$(aws sts get-caller-identity --query Arn --output text)"
+          case "${CALLER_ARN}" in
+            *":assumed-role/${EXPECTED_ROLE}/"*)
+              echo "✅ assumed ${EXPECTED_ROLE}"
+              ;;
+            *)
+              echo "::error::Expected to assume ${EXPECTED_ROLE}, but the caller identity is ${CALLER_ARN}"
+              exit 1
+              ;;
+          esac
+
       - name: 📋 CDK Synth
         run: |
           echo "🔍 Running CDK synth for ${{ needs.determine_environment.outputs.environment }} environment..."

package/dist/core/nightly-e2e-guard-behavior-certificate.js

@@ -20,9 +20,9 @@ export const NIGHTLY_E2E_GUARD_BEHAVIOR_CERTIFICATES = Object.freeze({
     }),
     "312e8962e21be2f3c6c6c0235b0c6159b8dc39425508b4965c7df87fb1333380": Object.freeze({
         contractVersion: "1.9.0",
-        packageVersions: Object.freeze(["4.27.3"]),
+        packageVersions: Object.freeze(["4.27.4"]),
         provenances: Object.freeze([
-            "workspace package @codyswann/lisa@4.27.3 (typescript/copy-overwrite/scripts/check-nightly-e2e-health.mjs)",
+            "workspace package @codyswann/lisa@4.27.4 (typescript/copy-overwrite/scripts/check-nightly-e2e-health.mjs)",
         ]),
     }),
     "898ee0247806c7aa6e98328662d80bcff22ff067999298865462a58daef8bb22": Object.freeze({

package/dist/core/upstream-evidence-manifest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"upstream-evidence-manifest.d.ts","sourceRoot":"","sources":["../../src/core/upstream-evidence-manifest.ts"],"names":[],"mappings":"AACA,iFAAiF;AACjF,eAAO,MAAM,0BAA0B,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CA08EpE,CAAC;AAEL,4EAA4E;AAC5E,eAAO,MAAM,yBAAyB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CA04PjE,CAAC;AAEL,sFAAsF;AACtF,eAAO,MAAM,uBAAuB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAk6I/D,CAAC"}
+{"version":3,"file":"upstream-evidence-manifest.d.ts","sourceRoot":"","sources":["../../src/core/upstream-evidence-manifest.ts"],"names":[],"mappings":"AACA,iFAAiF;AACjF,eAAO,MAAM,0BAA0B,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CA08EpE,CAAC;AAEL,4EAA4E;AAC5E,eAAO,MAAM,yBAAyB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CA44PjE,CAAC;AAEL,sFAAsF;AACtF,eAAO,MAAM,uBAAuB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAk6I/D,CAAC"}

package/dist/core/upstream-evidence-manifest.js

@@ -56,7 +56,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "cdk/copy-overwrite/tsconfig.json": "bd960df819bb1ce01163ac4b28721eea3f07d482f6c454cfea9a8dc90191033a",
     "cdk/copy-overwrite/vitest.cdk.ts": "030158b11bec4f10b39585feb98f498981f307faa1fa314c7522e6def5d73c94",
     "cdk/copy-overwrite/vitest.config.ts": "c7f309d4f43d9188b9c067cb4900b2bdbacfbd28d135a6a2e6313cb0a37b030f",
-    "cdk/create-only/.github/workflows/ci.yml": "98bd4b784a5a0a96bedc40c209f5bf5afe97fa422c200533d4544990a69a5c1a",
+    "cdk/create-only/.github/workflows/ci.yml": "2cb902c76ebd5235c8152f1fa0f2caae3a20a409ac0da747d19d29185047a418",
     "cdk/create-only/.github/workflows/deploy.yml": "f32ec7eecc7451812213fc66f1a6fa4b360137c586d47ede06747f04eb557251",
     "cdk/create-only/cdk.json": "f89030d8fe145a1dbabd59d89ddee4e16984f222d737f7fcf6b778d911e9fe40",
     "cdk/create-only/tsconfig.local.json": "d26253827e21fd7c41d30565fe3d339675f119e00bb24c5713a01f57ccd06602",
@@ -7836,6 +7836,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "tests/integration/apply-reports-unchanged-manifest.test.ts": true,
     "tests/integration/apply-unattended-preserves-host-config.test.ts": true,
     "tests/integration/bootstrap-keychain.test.ts": true,
+    "tests/integration/cdk-ci-role-selection.test.ts": true,
     "tests/integration/cli-smoke.test.ts": true,
     "tests/integration/coverage-scratch-debris.test.ts": true,
     "tests/integration/deletion-reference-guard.test.ts": true,
@@ -7946,6 +7947,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "tests/integration/standards-proof-tamper.test.ts": true,
     "tests/integration/standards-proof-timeout.test.ts": true,
     "tests/integration/standards-proof-typescript.test.ts": true,
+    "tests/integration/support/cdk-ci-role-selection-harness.ts": true,
     "tests/integration/support/maestro-android-retry-fixtures.ts": true,
     "tests/integration/support/maestro-android-retry-harness.ts": true,
     "tests/integration/support/maestro-build-step-harness.ts": true,