@codyswann/lisa 4.53.3 → 4.53.5

package/cdk/create-only/.github/workflows/ci.yml

@@ -100,6 +100,26 @@ jobs:
             ROLE_NAME="DeployServiceRole"
           fi
 
+          # Say so when the compatibility escape hatch is the thing in force.
+          #
+          # Nothing provisions the read-only role for you, so the cheapest way
+          # to make a fresh repository's CI go green is to point this variable
+          # at DeployServiceRole — which restores exactly the over-privileged
+          # default the split removed. The escape hatch is easier than the fix,
+          # so without this line the path of least resistance quietly re-creates
+          # the problem and every check stays green: the identity assertion
+          # below compares against the role that was SELECTED, so it confirms
+          # the deploy role as correct and prints a tick next to it.
+          #
+          # A warning rather than a failure, deliberately. The override is
+          # documented and legitimate while a repository is being set up;
+          # failing it would break the path the comment above tells people to
+          # take. What it must not do is stay invisible.
+          if [ "${{ github.event_name }}" == "pull_request" ] \
+            && [ "$ROLE_NAME" == "DeployServiceRole" ]; then
+            echo "::warning title=Pull-request validation is holding deploy rights::This pull request assumed DeployServiceRole to run read-only checks (cdk synth, cdk diff, tests), because CDK_CI_READ_ONLY_ROLE_NAME is set to DeployServiceRole. That is the compatibility setting, not the default. While it is in force, anyone who can open a pull request against this repository can obtain deployment credentials for the target account. To fix it: create the read-only role described in .github/workflows/ci.yml in each account, then unset this repository variable."
+          fi
+
           echo "role_name=$ROLE_NAME" >> $GITHUB_OUTPUT
 
           # Map to CDK environment name.

package/dist/core/nightly-e2e-guard-behavior-certificate.js

@@ -41,9 +41,9 @@ export const NIGHTLY_E2E_GUARD_BEHAVIOR_CERTIFICATES = Object.freeze({
     }),
     dfd2fef680de5ef03e63075e8a61c62ca4d95cdfdff6201939b79c748d3397f6: Object.freeze({
         contractVersion: "1.9.0",
-        packageVersions: Object.freeze(["4.53.3"]),
+        packageVersions: Object.freeze(["4.53.5"]),
         provenances: Object.freeze([
-            "workspace package @codyswann/lisa@4.53.3 (typescript/copy-overwrite/scripts/check-nightly-e2e-health.mjs)",
+            "workspace package @codyswann/lisa@4.53.5 (typescript/copy-overwrite/scripts/check-nightly-e2e-health.mjs)",
         ]),
     }),
 });

package/dist/core/upstream-evidence-manifest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"upstream-evidence-manifest.d.ts","sourceRoot":"","sources":["../../src/core/upstream-evidence-manifest.ts"],"names":[],"mappings":"AACA,iFAAiF;AACjF,eAAO,MAAM,0BAA0B,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CA8iFpE,CAAC;AAEL,4EAA4E;AAC5E,eAAO,MAAM,yBAAyB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAg1QjE,CAAC;AAEL,sFAAsF;AACtF,eAAO,MAAM,uBAAuB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAk6I/D,CAAC"}
+{"version":3,"file":"upstream-evidence-manifest.d.ts","sourceRoot":"","sources":["../../src/core/upstream-evidence-manifest.ts"],"names":[],"mappings":"AACA,iFAAiF;AACjF,eAAO,MAAM,0BAA0B,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CA8iFpE,CAAC;AAEL,4EAA4E;AAC5E,eAAO,MAAM,yBAAyB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAk1QjE,CAAC;AAEL,sFAAsF;AACtF,eAAO,MAAM,uBAAuB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAk6I/D,CAAC"}

package/dist/core/upstream-evidence-manifest.js

@@ -66,7 +66,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "cdk/copy-overwrite/tsconfig.json": "bd960df819bb1ce01163ac4b28721eea3f07d482f6c454cfea9a8dc90191033a",
     "cdk/copy-overwrite/vitest.cdk.ts": "030158b11bec4f10b39585feb98f498981f307faa1fa314c7522e6def5d73c94",
     "cdk/copy-overwrite/vitest.config.ts": "c7f309d4f43d9188b9c067cb4900b2bdbacfbd28d135a6a2e6313cb0a37b030f",
-    "cdk/create-only/.github/workflows/ci.yml": "7bd00500e4afe02cbf93f2fe3ee054cd0d9fdce53857de84d5034f9f7c8deaf8",
+    "cdk/create-only/.github/workflows/ci.yml": "f66badecde1390a73455f1359f19dc6677d3134237188ac8d3c7b4405978837a",
     "cdk/create-only/.github/workflows/deploy.yml": "eaab3860ecc75649b878dce7ca3486fadf31e381dd1191f9740b99ab7fcb5cf3",
     "cdk/create-only/cdk.json": "f89030d8fe145a1dbabd59d89ddee4e16984f222d737f7fcf6b778d911e9fe40",
     "cdk/create-only/stryker.conf.json": "9ccc4dc3fc72f8bb848794214a7784d233fa35558f12514ce16cf0fba59aa4be",
@@ -118,7 +118,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "expo/copy-overwrite/jest.setup.pre.js": "8bd71ed2d461de77c55bef123e5e782d51ce7d4e5a38bfc0c662f0b86d506f9d",
     "expo/copy-overwrite/jest.setup.ts": "826ab9387f73b19f1faa2ee4263344a64f6fa34fa872ba1162fef9d81406e556",
     "expo/copy-overwrite/knip.json": "054a6ac5289168f5b19ad705ca7dd0083a7feea1114d79014fbc72ed2a6f5a76",
-    "expo/copy-overwrite/plugins/withAndroidSplashNoClientExit.js": "2575c267e996901964dfca4d2b0bc2446d16eadbb9dd95bb653346507c29f83e",
+    "expo/copy-overwrite/plugins/withAndroidSplashNoClientExit.js": "7ecb5c9ef3150eab01d3a3be02aab06a558a1d4ca6140220bbed5e65913adad0",
     "expo/copy-overwrite/scripts/bdd-matrix.mjs": "8611fa2329660bcb1cbffaf70091c35d49f1635c13d89b85a68fbbe7ec25e69e",
     "expo/copy-overwrite/scripts/bdd/baseline.mjs": "721d6111e210fd2419f125b3ebe775757ad2927b758571023524999c67e31a59",
     "expo/copy-overwrite/scripts/bdd/contract.mjs": "7b47fd4a705aecd7c898f7fbbda4689d3fceda2dfe1bc959a06941f119d2e313",
@@ -1232,11 +1232,11 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "tsconfig/phaser.json": "5919bceaa8b12c772407021522fa63bfdf73063c23dba4d4d427d77562db6e21",
     "tsconfig/spec.json": "632851ffa0fc7185f8d78b508b1d31bf39440907fad3a91ad174cc4ab93383ab",
     "tsconfig/typescript.json": "8cf66a6535640e0a723e24bdf7a2d8e58a634c451f0754875c7880811381a914",
-    "typescript/copy-contents/.husky/commit-msg": "1885cc0f655a5a336078db510ceb8854582c628cb813c14fd052a1f6aa3bab07",
+    "typescript/copy-contents/.husky/commit-msg": "2cc323494b919a6d29231dee56a64ced5f5d37b31470f692b0336706e71a92fc",
     "typescript/copy-contents/.husky/post-checkout": "f3abc4528e12d3ad2bc48b236d19f105e2817595c744156a558c62ae5551ccfb",
     "typescript/copy-contents/.husky/post-merge": "8155564c7aed71d04bada189d66623e32a00d80598a8194782b6ecabec5134c0",
-    "typescript/copy-contents/.husky/pre-commit": "d5f85c0b5d9a0277389c1ae96aec30db603ee38637d4ab749a659bb031d06d93",
-    "typescript/copy-contents/.husky/pre-push": "20cbd929137965bddf19c280d69eec7b214f227b986e15347c9a1d04fac4d3e5",
+    "typescript/copy-contents/.husky/pre-commit": "170a599896e3cf0773fcbc9fa12d49051a864698220b70e8f4b1ea6cca063365",
+    "typescript/copy-contents/.husky/pre-push": "a80f2b79a3ef7a7c742642a48e1472abb3b53ad755609cc590aa0dde4300db9f",
     "typescript/copy-contents/.husky/prepare-commit-msg": "4a719c20da65653f266e7c8a346b5546ad05f1dfa34665fc7fec47e89d2f58d1",
     "typescript/copy-overwrite/.claude/hooks/worktree-create.sh": "888cfd16bd1ac04f9f8a835eae62f8bd2c956de654bce12ce9a6a52947b121ca",
     "typescript/copy-overwrite/.github/GITHUB_ACTIONS.md": "4289146bae8e112049387d4be86941c563b02376a06f0238364aaf3e61c2b127",
@@ -8624,6 +8624,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "tests/unit/health/deterministic.test.ts": true,
     "tests/unit/health/drift-tickets.test.ts": true,
     "tests/unit/health/expo-splash-inspection.test.ts": true,
+    "tests/unit/health/expo-splash-tag-migration.test.ts": true,
     "tests/unit/health/gitignore.test.ts": true,
     "tests/unit/health/package-surfaces.test.ts": true,
     "tests/unit/health/ruleset-reach-inspection.test.ts": true,
@@ -8703,6 +8704,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "tests/unit/hooks/hook-stdin-epipe.test.ts": true,
     "tests/unit/hooks/hook-tooling-fail-closed.test.ts": true,
     "tests/unit/hooks/host-enforcement-fallback.test.ts": true,
+    "tests/unit/hooks/husky-package-manager-detection.test.ts": true,
     "tests/unit/hooks/husky-resolver-lookup.test.ts": true,
     "tests/unit/hooks/inject-resolved-config-completeness.test.ts": true,
     "tests/unit/hooks/inject-resolved-config-names-subject.test.ts": true,