@codyswann/lisa 4.53.2 → 4.53.4

package/cdk/create-only/.github/workflows/ci.yml

@@ -100,6 +100,26 @@ jobs:
             ROLE_NAME="DeployServiceRole"
           fi
 
+          # Say so when the compatibility escape hatch is the thing in force.
+          #
+          # Nothing provisions the read-only role for you, so the cheapest way
+          # to make a fresh repository's CI go green is to point this variable
+          # at DeployServiceRole — which restores exactly the over-privileged
+          # default the split removed. The escape hatch is easier than the fix,
+          # so without this line the path of least resistance quietly re-creates
+          # the problem and every check stays green: the identity assertion
+          # below compares against the role that was SELECTED, so it confirms
+          # the deploy role as correct and prints a tick next to it.
+          #
+          # A warning rather than a failure, deliberately. The override is
+          # documented and legitimate while a repository is being set up;
+          # failing it would break the path the comment above tells people to
+          # take. What it must not do is stay invisible.
+          if [ "${{ github.event_name }}" == "pull_request" ] \
+            && [ "$ROLE_NAME" == "DeployServiceRole" ]; then
+            echo "::warning title=Pull-request validation is holding deploy rights::This pull request assumed DeployServiceRole to run read-only checks (cdk synth, cdk diff, tests), because CDK_CI_READ_ONLY_ROLE_NAME is set to DeployServiceRole. That is the compatibility setting, not the default. While it is in force, anyone who can open a pull request against this repository can obtain deployment credentials for the target account. To fix it: create the read-only role described in .github/workflows/ci.yml in each account, then unset this repository variable."
+          fi
+
           echo "role_name=$ROLE_NAME" >> $GITHUB_OUTPUT
 
           # Map to CDK environment name.

package/cdk/create-only/.github/workflows/deploy.yml

@@ -1,7 +1,18 @@
 # Seeded by Lisa on first setup — this file is YOURS.
 # Lisa will not overwrite it. (copy-overwrite assets ARE replaced each run.)
+#
+# This workflow RELEASES. It does not deploy, and it is not missing a deploy
+# job — a CDK app deploys through the self-mutating AWS CodePipeline defined in
+# its own `lib/pipeline-stack.ts`, triggered from `main` inside AWS. Adding a
+# deploy job here would give the same stacks two racing deployers, one of which
+# rewrites the other underneath it.
+#
+# The name says only what the jobs prove, because at the call site the name is
+# the only thing visible. A green check here means RELEASED. Whether the change
+# reached an environment is a separate fact, and it is answered by CodePipeline
+# — which may still be holding at a manual approval gate — not by this run.
 
-name: 🚀 Release and Deploy
+name: 📦 Release
 
 on:
   push:
@@ -133,4 +144,3 @@ jobs:
       package_manager: 'npm'
     # No `secrets:` key: gates.yml declares none in its `workflow_call`, so
     # passing any grants everything to a callee that reads nothing (#3065).
-# Trigger staging deployment after CDK trust fix

package/dist/core/nightly-e2e-guard-behavior-certificate.js

@@ -41,9 +41,9 @@ export const NIGHTLY_E2E_GUARD_BEHAVIOR_CERTIFICATES = Object.freeze({
     }),
     dfd2fef680de5ef03e63075e8a61c62ca4d95cdfdff6201939b79c748d3397f6: Object.freeze({
         contractVersion: "1.9.0",
-        packageVersions: Object.freeze(["4.53.2"]),
+        packageVersions: Object.freeze(["4.53.4"]),
         provenances: Object.freeze([
-            "workspace package @codyswann/lisa@4.53.2 (typescript/copy-overwrite/scripts/check-nightly-e2e-health.mjs)",
+            "workspace package @codyswann/lisa@4.53.4 (typescript/copy-overwrite/scripts/check-nightly-e2e-health.mjs)",
         ]),
     }),
 });

package/dist/core/upstream-evidence-manifest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"upstream-evidence-manifest.d.ts","sourceRoot":"","sources":["../../src/core/upstream-evidence-manifest.ts"],"names":[],"mappings":"AACA,iFAAiF;AACjF,eAAO,MAAM,0BAA0B,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CA8iFpE,CAAC;AAEL,4EAA4E;AAC5E,eAAO,MAAM,yBAAyB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CA+0QjE,CAAC;AAEL,sFAAsF;AACtF,eAAO,MAAM,uBAAuB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAk6I/D,CAAC"}
+{"version":3,"file":"upstream-evidence-manifest.d.ts","sourceRoot":"","sources":["../../src/core/upstream-evidence-manifest.ts"],"names":[],"mappings":"AACA,iFAAiF;AACjF,eAAO,MAAM,0BAA0B,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CA8iFpE,CAAC;AAEL,4EAA4E;AAC5E,eAAO,MAAM,yBAAyB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAg1QjE,CAAC;AAEL,sFAAsF;AACtF,eAAO,MAAM,uBAAuB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAk6I/D,CAAC"}

package/dist/core/upstream-evidence-manifest.js

@@ -66,8 +66,8 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "cdk/copy-overwrite/tsconfig.json": "bd960df819bb1ce01163ac4b28721eea3f07d482f6c454cfea9a8dc90191033a",
     "cdk/copy-overwrite/vitest.cdk.ts": "030158b11bec4f10b39585feb98f498981f307faa1fa314c7522e6def5d73c94",
     "cdk/copy-overwrite/vitest.config.ts": "c7f309d4f43d9188b9c067cb4900b2bdbacfbd28d135a6a2e6313cb0a37b030f",
-    "cdk/create-only/.github/workflows/ci.yml": "7bd00500e4afe02cbf93f2fe3ee054cd0d9fdce53857de84d5034f9f7c8deaf8",
-    "cdk/create-only/.github/workflows/deploy.yml": "f32ec7eecc7451812213fc66f1a6fa4b360137c586d47ede06747f04eb557251",
+    "cdk/create-only/.github/workflows/ci.yml": "f66badecde1390a73455f1359f19dc6677d3134237188ac8d3c7b4405978837a",
+    "cdk/create-only/.github/workflows/deploy.yml": "eaab3860ecc75649b878dce7ca3486fadf31e381dd1191f9740b99ab7fcb5cf3",
     "cdk/create-only/cdk.json": "f89030d8fe145a1dbabd59d89ddee4e16984f222d737f7fcf6b778d911e9fe40",
     "cdk/create-only/stryker.conf.json": "9ccc4dc3fc72f8bb848794214a7784d233fa35558f12514ce16cf0fba59aa4be",
     "cdk/create-only/tsconfig.local.json": "d26253827e21fd7c41d30565fe3d339675f119e00bb24c5713a01f57ccd06602",
@@ -8425,6 +8425,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "tests/unit/config/dependabot-not-distributed.test.ts": true,
     "tests/unit/config/dependency-tree-preflight.test.ts": true,
     "tests/unit/config/deploy-template-triggers.test.ts": true,
+    "tests/unit/config/deploy-workflow-naming.test.ts": true,
     "tests/unit/config/dist-rebuild-window.test.ts": true,
     "tests/unit/config/eslint-ignore-wiki.test.ts": true,
     "tests/unit/config/eslint-no-unused-vars.test.ts": true,