@codyswann/lisa 4.79.1 → 4.80.0

package/plugins/src/base/scripts/install-remote-agent-aws.mjs

@@ -335,9 +335,11 @@ a name carrying the owner prevents it.
 
 \`default\` is the one name that cannot be namespaced. The setup script writes
 it for this project only when nothing else already owns it; if another Lisa
-project or the operator's own configuration holds it, the script stops and says
-so rather than repointing every unqualified \`aws\` command. Pass
-\`LISA_AWS_CLAIM_DEFAULT_PROFILE=1\` to take it over deliberately.
+project or the operator's own configuration holds it, the script still writes
+every named profile and verifies them as a normal run would, leaves
+\`[default]\` untouched, and exits non-zero saying so rather than repointing
+every unqualified \`aws\` command. Use the named profiles it lists, or pass
+\`LISA_AWS_CLAIM_DEFAULT_PROFILE=1\` to take \`[default]\` over deliberately.
 
 Production and shared profiles are observer-only. Production repair remains a
 human-driven local-workstation operation.

package/plugins/src/base/scripts/remote-agent-aws-setup.sh

@@ -598,12 +598,22 @@ if [ -n "$legacy_sections" ]; then
   fi
 fi
 
+# Decided here, enforced at the end. Refusing `[default]` must not also refuse
+# the named profiles: they are namespaced, carry no collision risk, and are the
+# remedy the refusal points the operator at. Refusing before writing them told
+# the operator to use profiles that did not exist, leaving the takeover override
+# as the only real path — the outcome this guard exists to discourage. So every
+# named profile is written and verified first, `[default]` alone is left
+# untouched, and the run still exits non-zero: what the operator asked for
+# (a ready workstation with this project's default) did not happen, and a
+# caller that continued on success would run unqualified `aws` commands in the
+# operator's account believing they reached this project's.
 default_owner="$(default_profile_owner)"
+claim_default=1
 case "$default_owner" in
   ours | legacy | unclaimed) ;;
   *)
-    [ "${LISA_AWS_CLAIM_DEFAULT_PROFILE:-0}" = "1" ] || fail \
-      "refusing to overwrite the [default] AWS profile in ${config_file}: it belongs to ${default_owner}, not to ${PROFILE_NAMESPACE}. Overwriting it would silently repoint every unqualified aws command at this project's accounts. Use the named profiles instead (${profile_names}), or set LISA_AWS_CLAIM_DEFAULT_PROFILE=1 to take it over deliberately."
+    [ "${LISA_AWS_CLAIM_DEFAULT_PROFILE:-0}" = "1" ] || claim_default=0
     ;;
 esac
 
@@ -629,11 +639,13 @@ while IFS="$(printf '\t')" read -r stage role_arn region; do
 done < <(printf '%s' "$profiles_json" | jq -r 'to_entries[] | [.key, .value.roleArn, .value.region] | @tsv')
 
 default_profile="${PROFILE_NAMESPACE}-agent-${default_stage}"
-aws configure set role_arn "$default_role_arn" --profile default
-aws configure set source_profile "$BOOTSTRAP_PROFILE" --profile default
-aws configure set external_id "$external_id" --profile default
-aws configure set role_session_name "$session_name" --profile default
-aws configure set region "$default_region" --profile default
+if [ "$claim_default" = "1" ]; then
+  aws configure set role_arn "$default_role_arn" --profile default
+  aws configure set source_profile "$BOOTSTRAP_PROFILE" --profile default
+  aws configure set external_id "$external_id" --profile default
+  aws configure set role_session_name "$session_name" --profile default
+  aws configure set region "$default_region" --profile default
+fi
 
 chmod 600 "$credentials_file" "$config_file"
 
@@ -674,4 +686,26 @@ if [ -n "$legacy_names" ]; then
   fi
 fi
 
+if [ "$claim_default" = "0" ]; then
+  if [ "${LISA_AWS_SKIP_VERIFY:-0}" = "1" ]; then
+    named_state="were written but not verified (LISA_AWS_SKIP_VERIFY=1)"
+  elif [ "${LISA_AWS_VERIFY_ALL_PROFILES:-0}" = "1" ]; then
+    named_state="were written and verified"
+  else
+    # Only the default stage's account is proved without VERIFY_ALL, so the
+    # message names exactly that one rather than vouching for all of them.
+    named_state="were written; ${default_profile} was verified (set LISA_AWS_VERIFY_ALL_PROFILES=1 to verify every one)"
+  fi
+  # The trap the override walks into when `[default]` is static keys rather
+  # than a config-side profile: claiming rewrites only the config file, so the
+  # keys stay, and `[default]` ends up holding a role and an unrelated account's
+  # keys at once. Which wins depends on each tool's credential precedence. The
+  # key material itself is never echoed.
+  static_keys_note=""
+  if [ -n "$(profile_setting_value "$credentials_file" "default" "aws_access_key_id")" ]; then
+    static_keys_note=" Note: ${credentials_file} holds long-lived access keys under [default]. Claiming rewrites only ${config_file} and does not remove them, so [default] would carry both this project's role and those keys, and which one a tool uses depends on its credential precedence."
+  fi
+  fail "refusing to overwrite the [default] AWS profile in ${config_file}: it belongs to ${default_owner}, not to ${PROFILE_NAMESPACE}. Overwriting it would silently repoint every unqualified aws command at this project's accounts. [default] was left untouched; this project's named profiles ${named_state} (${profile_names}). Use them instead, for example AWS_PROFILE=${default_profile} or --profile ${default_profile}, or set LISA_AWS_CLAIM_DEFAULT_PROFILE=1 to take [default] over deliberately.${static_keys_note}"
+fi
+
 echo "remote-agent-aws-setup: ready (${session_name}; namespace=${PROFILE_NAMESPACE} via ${namespace_source}; default=${default_profile} in account ${default_expected_account}; profiles=${profile_names})"

package/plugins/src/base/skills/lisa-setup-remote-aws/SKILL.md

@@ -53,8 +53,13 @@ two bundles declaring the same stages overwrite each other in the shared
 malformed. The name is the only place the owner can be recorded.
 
 `default` cannot be namespaced. The script claims it only when nothing else
-owns it, and otherwise stops and names the current owner;
-`LISA_AWS_CLAIM_DEFAULT_PROFILE=1` takes it over deliberately.
+owns it. Otherwise it still writes every named profile and verifies them as a
+normal run would (the default stage, or every stage under
+`LISA_AWS_VERIFY_ALL_PROFILES=1`), leaves `[default]` untouched, and exits
+non-zero naming the current owner and the named profiles to use instead (for example `AWS_PROFILE=<project>-agent-dev`);
+`LISA_AWS_CLAIM_DEFAULT_PROFILE=1` takes `[default]` over deliberately. When the
+owner is long-lived keys under `[default]` in `~/.aws/credentials`, the message
+also says that claiming would not remove them.
 
 Readiness is an account check, not a liveness check. `sts:GetCallerIdentity`
 succeeding proves the credentials work, not that they reached the intended

package/scripts/check-required-check-promotions.mjs

@@ -139,7 +139,11 @@ import fs from "node:fs";
 import path from "node:path";
 import yaml from "js-yaml";
 
-import { readGates } from "../all/copy-overwrite/scripts/lisa-gates.mjs";
+import {
+  REGISTRY,
+  jobBackedGates,
+  readGates,
+} from "../all/copy-overwrite/scripts/lisa-gates.mjs";
 import { invokedAsScript } from "./lib/invoked-as-script.mjs";
 import { buildRulesetPayload } from "./lisa-ruleset-payload.mjs";
 
@@ -363,7 +367,7 @@ export function collectDeclaredContexts(root) {
  * jobs it declares, and whether it actually runs on every pull request.
  *
  * @param {string} absolute - absolute path to the workflow YAML.
- * @returns {{ jobs: Map<string, string>, onPullRequest: boolean, pathFilterKeys: string[] } | null}
+ * @returns {{ jobs: Map<string, string>, matrixJobs: Set<string>, onPullRequest: boolean, pathFilterKeys: string[] } | null}
  *   the parsed facts, or null when the file is absent or unparseable.
  */
 export function readWorkflow(absolute) {
@@ -395,10 +399,13 @@ export function readWorkflow(absolute) {
       ? ["paths", "paths-ignore"].filter(key => key in pullRequest)
       : [];
   const jobs = new Map();
+  const matrixJobs = new Set();
   for (const [id, job] of Object.entries(doc.jobs ?? {})) {
     jobs.set(id, typeof job?.name === "string" ? job.name : id);
+    const matrix = job?.strategy?.matrix;
+    if (typeof matrix === "object" && matrix !== null) matrixJobs.add(id);
   }
-  return { jobs, onPullRequest, pathFilterKeys };
+  return { jobs, matrixJobs, onPullRequest, pathFilterKeys };
 }
 
 /**
@@ -674,9 +681,109 @@ function calledJobProblems(entry, root, calledName) {
       },
     ];
   }
+  if (entry.job_id === DECLARED_GATES_JOB) {
+    return declaredGateLegProblems(called, entry, calledName, root);
+  }
   return jobNameProblems(called, entry.job_id, calledName, "called");
 }
 
+/** The matrix job that posts one context per declared gate leg. */
+const DECLARED_GATES_JOB = "declared_gates";
+
+/** The literal `name:` that makes each matrix leg post its gate's label. */
+const MATRIX_LABEL_NAME = "${{ matrix.label }}";
+
+/**
+ * Verify a context posted by a `declared_gates` matrix leg rather than by a
+ * hand-written job (#3052).
+ *
+ * A leg has no static `name:` to compare — it is named by the registry label
+ * of the gate it runs. So the entry names that gate, and the guard checks the
+ * three facts that together mean the leg posts this exact string: the matrix
+ * job exists and is named by `matrix.label`, the gate's registry label is the
+ * context half, and no hand-written job still owns the gate. The last one
+ * matters because `momentLegs` emits no leg for a job-backed gate, so a ledger
+ * pointing at a leg that cannot exist would vouch for a context nothing posts.
+ *
+ * @param {{ jobs: Map<string, string>, matrixJobs: Set<string> }} called - parsed called workflow.
+ * @param {object} entry - the ledger entry.
+ * @param {string} calledName - the expected called-job display name.
+ * @param {string} root - absolute repository root.
+ * @returns {{ rule: string, detail: string }[]} problems, empty when sound.
+ */
+function declaredGateLegProblems(called, entry, calledName, root) {
+  // A job named by `matrix.label` with no `strategy.matrix` has no legs, so it
+  // posts no context at all — the name alone proves nothing.
+  if (
+    called.jobs.get(DECLARED_GATES_JOB) !== MATRIX_LABEL_NAME ||
+    !called.matrixJobs.has(DECLARED_GATES_JOB)
+  ) {
+    return [
+      {
+        rule: "called-job-missing",
+        detail: `no '${DECLARED_GATES_JOB}' matrix job named '${MATRIX_LABEL_NAME}' in the called workflow, so no declared gate leg posts '${calledName}'`,
+      },
+    ];
+  }
+  const gate = entry.gate;
+  const label =
+    typeof gate === "string" && Object.hasOwn(REGISTRY, gate)
+      ? REGISTRY[gate].label
+      : undefined;
+  if (label === undefined) {
+    return [
+      {
+        rule: "leg-gate-missing",
+        detail: `a '${DECLARED_GATES_JOB}' entry must name the registry gate whose leg posts the context; got ${JSON.stringify(gate)}`,
+      },
+    ];
+  }
+  if (label !== calledName) {
+    return [
+      {
+        rule: "called-job-name-mismatch",
+        detail: `gate '${gate}' posts '${label}' but the context expects '${calledName}'`,
+      },
+    ];
+  }
+  if (jobBackedGates().includes(gate)) {
+    return [
+      {
+        rule: "leg-gate-job-backed",
+        detail: `gate '${gate}' is still owned by a hand-written job, so the runner emits no leg for it`,
+      },
+    ];
+  }
+  return legDeclarationProblems(root, gate, calledName);
+}
+
+/**
+ * Whether this repository declares the gate at a level that makes its leg run.
+ *
+ * A leg exists only for a gate the project DECLARES at pull-request. A ledger
+ * entry pointing at a leg for an undeclared gate vouches for a context nothing
+ * posts, and a required context that never posts holds every pull request.
+ *
+ * @param {string} root - absolute repository root.
+ * @param {string} gate - the gate whose leg posts the context.
+ * @param {string} calledName - the expected called-job display name.
+ * @returns {{ rule: string, detail: string }[]} problems, empty when sound.
+ */
+function legDeclarationProblems(root, gate, calledName) {
+  const declared = readGates(root).gates?.[gate]?.["pull-request"];
+  const level =
+    typeof declared === "object" && declared !== null
+      ? declared.level
+      : declared;
+  if (level === "required" || level === "optional") return [];
+  return [
+    {
+      rule: "leg-gate-undeclared",
+      detail: `gate '${gate}' is not declared at pull-request in .lisa.config.json (found ${JSON.stringify(declared ?? null)}), so no leg posts '${calledName}'`,
+    },
+  ];
+}
+
 /**
  * Read the promotion ledger.
  *

package/scripts/two-channel-couplings.json

@@ -103,7 +103,7 @@
   },
   "inspected": {
     "workflows": 26,
-    "steps": 824,
+    "steps": 765,
     "couplings": 36,
     "inventory": 186
   },