@prism-d1/cli 1.0.83 → 1.0.85

package/dist/assets/coding-agent/tools/git_ops.py

@@ -0,0 +1,197 @@
+"""Git operations exposed to the agent as a single Strands tool.
+
+Every git invocation goes through `subprocess.run` with an argv list and never
+`shell=True`. The agent supplies branch names and commit messages, so treating
+them as shell strings would let a crafted issue body run arbitrary commands.
+
+`push` is deliberately absent. Pushing is a privileged step that belongs to the
+PR-creation path where credentials live, not to a general-purpose git tool the
+model can call at will.
+"""
+
+from __future__ import annotations
+
+import re
+import subprocess
+from pathlib import Path
+
+from strands import tool
+
+# Branch names: git's own rules, tightened. No leading/trailing dots or slashes,
+# no '..', no characters git rejects, nothing that could be read as a flag.
+_BRANCH_OK = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._/-]{0,99}$")
+_TIMEOUT_SECONDS = 60
+
+
+class GitError(RuntimeError):
+    """A git command failed or was rejected before running."""
+
+
+def _run(args: list[str], cwd: Path) -> str:
+    """Run a git command and return stdout, raising GitError on failure."""
+    try:
+        proc = subprocess.run(
+            ["git", *args],
+            cwd=str(cwd),
+            capture_output=True,
+            text=True,
+            timeout=_TIMEOUT_SECONDS,
+            check=False,
+        )
+    except subprocess.TimeoutExpired as exc:
+        raise GitError(f"git {args[0]} timed out after {_TIMEOUT_SECONDS}s") from exc
+    except FileNotFoundError as exc:
+        raise GitError("git is not installed or not on PATH") from exc
+
+    if proc.returncode != 0:
+        detail = (proc.stderr or proc.stdout).strip()
+        raise GitError(f"git {' '.join(args)} failed: {detail}")
+    return proc.stdout.strip()
+
+
+def _validate_branch(name: str) -> str:
+    name = name.strip()
+    if not _BRANCH_OK.match(name) or ".." in name or name.endswith((".", "/", ".lock")):
+        raise GitError(
+            f"Invalid branch name {name!r}. Use letters, digits, dot, dash, "
+            "underscore and slash; start with a letter or digit."
+        )
+    return name
+
+
+def _validate_paths(paths: list[str], repo_path: Path) -> list[str]:
+    """Resolve each path and confirm it stays inside the repository.
+
+    Rejects absolute paths, traversal, and symlinks that point outside the repo.
+    """
+    resolved: list[str] = []
+    repo_real = repo_path.resolve()
+    for raw in paths:
+        candidate = (repo_real / raw).resolve()
+        try:
+            candidate.relative_to(repo_real)
+        except ValueError as exc:
+            raise GitError(f"Path escapes the repository: {raw!r}") from exc
+        if not candidate.exists():
+            raise GitError(f"Path does not exist: {raw!r}")
+        resolved.append(str(candidate.relative_to(repo_real)))
+    return resolved
+
+
+
+def _resolve_repo(path: Path) -> Path | None:
+    """Return the git repository enclosing `path`, or None if there is none.
+
+    Uses git's own answer rather than walking for a `.git` directory, so
+    worktrees and submodules resolve the way git itself sees them.
+    """
+    try:
+        proc = subprocess.run(
+            ["git", "rev-parse", "--show-toplevel"],
+            cwd=str(path), capture_output=True, text=True,
+            timeout=_TIMEOUT_SECONDS, check=False,
+        )
+    except (OSError, subprocess.SubprocessError):
+        return None
+    if proc.returncode != 0 or not proc.stdout.strip():
+        return None
+    return Path(proc.stdout.strip())
+
+
+@tool
+def git_ops(
+    action: str,
+    repo_path: str,
+    branch: str | None = None,
+    message: str | None = None,
+    paths: list[str] | None = None,
+) -> str:
+    """Perform a git operation in the target repository.
+
+    Use this to create a working branch, inspect what you have changed, stage
+    specific files, and commit. Pushing is handled separately by create_pr.
+
+    Args:
+        action: One of "status", "diff", "current_branch", "create_branch",
+            "stage", "commit", "log".
+        repo_path: Absolute path to the repository working tree.
+        branch: Branch name. Required for "create_branch".
+        message: Commit message. Required for "commit".
+        paths: Repository-relative file paths. Required for "stage". Name each
+            file explicitly; there is no "stage everything" option.
+
+    Returns:
+        Command output, or a short confirmation for actions with no output.
+    """
+    repo = Path(repo_path)
+    # Resolved rather than tested for a `.git` child, because a target is often a
+    # subdirectory of its repository -- PRISM's own sample-app sits inside a
+    # monorepo, and customer monorepos are the same shape.
+    #
+    # Requiring `.git` here caused a genuinely bad failure, observed rather than
+    # imagined: this tool refused with "not a git repository", and the agent --
+    # which also has a shell -- routed around the refusal by running `git init`
+    # and committing all 54 files as "Initial commit". A refusing tool is not a
+    # constraint on something that can run arbitrary commands; it is only a
+    # suggestion. So the tool has to be able to do the right thing rather than
+    # merely decline to do the wrong one.
+    resolved = _resolve_repo(repo)
+    if resolved is None:
+        return (
+            f"ERROR: {repo_path} is not inside a git repository. Do NOT run "
+            f"`git init` -- that would create a new repository and commit "
+            f"everything, which is never the fix. Report the problem instead."
+        )
+    repo = resolved
+
+    try:
+        if action == "status":
+            out = _run(["status", "--porcelain=v1"], repo)
+            return out or "(working tree clean)"
+
+        if action == "diff":
+            out = _run(["diff", "--stat", "HEAD"], repo)
+            return out or "(no changes against HEAD)"
+
+        if action == "current_branch":
+            return _run(["rev-parse", "--abbrev-ref", "HEAD"], repo)
+
+        if action == "log":
+            return _run(["log", "--oneline", "-10"], repo)
+
+        if action == "create_branch":
+            if not branch:
+                return "ERROR: create_branch requires a branch name"
+            safe = _validate_branch(branch)
+            _run(["checkout", "-b", safe], repo)
+            return f"Created and switched to branch {safe}"
+
+        if action == "stage":
+            if not paths:
+                return (
+                    "ERROR: stage requires an explicit list of paths. "
+                    "Name each file you changed."
+                )
+            safe_paths = _validate_paths(paths, repo)
+            _run(["add", "--", *safe_paths], repo)
+            return f"Staged {len(safe_paths)} file(s): {', '.join(safe_paths)}"
+
+        if action == "commit":
+            if not message or not message.strip():
+                return "ERROR: commit requires a non-empty message"
+            staged = _run(["diff", "--cached", "--name-only"], repo)
+            if not staged:
+                return "ERROR: nothing staged. Stage your changed files first."
+            # -m takes the message as a separate argv element, so newlines and
+            # quotes in the message are data, not shell syntax.
+            _run(["commit", "-m", message], repo)
+            sha = _run(["rev-parse", "HEAD"], repo)
+            return f"Committed {sha[:8]} with files:\n{staged}"
+
+        return (
+            f"ERROR: unknown action {action!r}. Valid actions: status, diff, "
+            "current_branch, create_branch, stage, commit, log"
+        )
+
+    except GitError as exc:
+        return f"ERROR: {exc}"

package/dist/assets/github-workflows/prism-agent-eval.yml

@@ -23,6 +23,11 @@ on:
       - '**/agent*.py'
       - '**/agent*.ts'
 
+
+env:
+  PRISM_AWS_REGION: us-west-2
+  PRISM_REPO: github.com/${{ github.repository }}
+
 permissions:
   id-token: write
   contents: read
@@ -41,7 +46,7 @@ jobs:
         uses: aws-actions/configure-aws-credentials@b47578312673ae6fa5b5096b330d9fbac3d116df # v4.2.1
         with:
           role-to-assume: ${{ secrets.PRISM_METRICS_ROLE_ARN }}
-          aws-region: us-west-2
+          aws-region: ${{ env.PRISM_AWS_REGION }}
 
       - name: Read team ID from .prism/config.json
         id: prism-config
@@ -263,7 +268,7 @@ jobs:
 
           EVAL_EVENT=$(jq -n \
             --arg team_id "${{ steps.prism-config.outputs.team_id }}" \
-            --arg repo "${{ github.repository }}" \
+            --arg repo "${PRISM_REPO}" \
             --arg timestamp "${TIMESTAMP}" \
             --argjson score "${SCORE:-0}" \
             --arg result "${{ steps.eval.outputs.result }}" \
@@ -298,7 +303,7 @@ jobs:
             }')
 
           aws events put-events \
-            --region us-west-2 \
+            --region $PRISM_AWS_REGION \
             --entries "[{
               \"Source\": \"prism.d1.velocity\",
               \"DetailType\": \"prism.d1.agent.eval\",

package/dist/assets/github-workflows/prism-ai-metrics.yml

@@ -33,6 +33,11 @@ on:
     types: [closed]
     branches: [main, master]
 
+
+env:
+  PRISM_AWS_REGION: us-west-2
+  PRISM_REPO: github.com/${{ github.repository }}
+
 permissions:
   id-token: write
   contents: read
@@ -54,7 +59,7 @@ jobs:
         uses: aws-actions/configure-aws-credentials@b47578312673ae6fa5b5096b330d9fbac3d116df # v4.2.1
         with:
           role-to-assume: ${{ secrets.PRISM_METRICS_ROLE_ARN }}
-          aws-region: us-west-2
+          aws-region: ${{ env.PRISM_AWS_REGION }}
 
       - name: Read team ID from .prism/config.json
         id: prism-config
@@ -101,6 +106,11 @@ jobs:
           COMMIT_SHAS=$(git rev-list --no-merges "${BASE_SHA}..${HEAD_SHA}" 2>/dev/null | head -50 | jq -R . | jq -sc . || echo '[]')
           TOTAL_COMMITS=$(git rev-list --no-merges --count "${BASE_SHA}..${HEAD_SHA}" 2>/dev/null || echo 0)
 
+          # Per-commit author emails (parallel array to COMMIT_SHAS). Used by
+          # the metrics-processor to seed COMMIT# items with the correct user
+          # field so /v1/productivity can attribute human commits per-developer.
+          COMMIT_AUTHORS=$(git rev-list --no-merges "${BASE_SHA}..${HEAD_SHA}" 2>/dev/null | head -50 | while read sha; do git log -1 --format='%ae' "$sha"; done | jq -R . | jq -sc . || echo '[]')
+
           # --- Lead time: PR open → merge. From the event payload, not git, so
           # it is unaffected by rebases and squashes.
           CREATED_TS=$(date -d "${CREATED_AT}" +%s 2>/dev/null || date -jf "%Y-%m-%dT%H:%M:%SZ" "${CREATED_AT}" +%s)
@@ -119,6 +129,7 @@ jobs:
           fi
 
           echo "commit_shas=${COMMIT_SHAS}" >> "$GITHUB_OUTPUT"
+          echo "commit_authors=${COMMIT_AUTHORS}" >> "$GITHUB_OUTPUT"
           echo "total_commits=${TOTAL_COMMITS}" >> "$GITHUB_OUTPUT"
           echo "lead_time_seconds=${LEAD_TIME_SECONDS}" >> "$GITHUB_OUTPUT"
           echo "is_failure_fix=${IS_FAILURE_FIX}" >> "$GITHUB_OUTPUT"
@@ -150,12 +161,13 @@ jobs:
 
           PR_EVENT=$(jq -n \
             --arg team_id "${{ steps.prism-config.outputs.team_id }}" \
-            --arg repo "${{ github.repository }}" \
+            --arg repo "${PRISM_REPO}" \
             --arg timestamp "${TIMESTAMP}" \
             --argjson lead_time_seconds "${{ steps.facts.outputs.lead_time_seconds }}" \
             --argjson is_failure_fix "${{ steps.facts.outputs.is_failure_fix }}" \
             --argjson total_commits "${{ steps.facts.outputs.total_commits }}" \
             --argjson commit_shas '${{ steps.facts.outputs.commit_shas }}' \
+            --argjson commit_authors '${{ steps.facts.outputs.commit_authors }}' \
             --arg pr_number "${{ github.event.pull_request.number }}" \
             --arg pr_author "${{ github.event.pull_request.user.login }}" \
             --argjson approved "${{ steps.reviews.outputs.approved }}" \
@@ -180,12 +192,13 @@ jobs:
                 "reviews_approved": $approved,
                 "reviews_changes_requested": $changes_requested,
                 "total_commits": $total_commits,
-                "commit_shas": $commit_shas
+                "commit_shas": $commit_shas,
+                "commit_authors": $commit_authors
               }
             }')
 
           aws events put-events \
-            --region us-west-2 \
+            --region $PRISM_AWS_REGION \
             --entries "[{
               \"Source\": \"prism.d1.velocity\",
               \"DetailType\": \"prism.d1.pr\",
@@ -207,7 +220,7 @@ jobs:
           # carrying it on both double-counted the DeploymentFrequency metric.
           DEPLOY_EVENT=$(jq -n \
             --arg team_id "${{ steps.prism-config.outputs.team_id }}" \
-            --arg repo "${{ github.repository }}" \
+            --arg repo "${PRISM_REPO}" \
             --arg timestamp "${TIMESTAMP}" \
             '{
               "team_id": $team_id,
@@ -225,7 +238,7 @@ jobs:
             }')
 
           aws events put-events \
-            --region us-west-2 \
+            --region $PRISM_AWS_REGION \
             --entries "[{
               \"Source\": \"prism.d1.velocity\",
               \"DetailType\": \"prism.d1.deploy\",

package/dist/assets/github-workflows/prism-eval-gate-kiro.yml

@@ -15,6 +15,11 @@ on:
     types: [opened, synchronize, reopened]
     branches: [main, master]
 
+
+env:
+  PRISM_AWS_REGION: us-west-2
+  PRISM_REPO: github.com/${{ github.repository }}
+
 permissions:
   id-token: write
   contents: read
@@ -213,15 +218,15 @@ jobs:
         uses: aws-actions/configure-aws-credentials@b47578312673ae6fa5b5096b330d9fbac3d116df # v4.2.1
         with:
           role-to-assume: ${{ env.METRICS_ROLE_ARN }}
-          aws-region: us-west-2
+          aws-region: ${{ env.PRISM_AWS_REGION }}
         continue-on-error: true
 
       - name: Emit prism.d1.eval event
         if: steps.aws-creds.outcome == 'success'
         env:
-          AWS_REGION: us-west-2
+          AWS_REGION: ${{ env.PRISM_AWS_REGION }}
           TEAM_ID: ${{ steps.prism-config.outputs.team_id }}
-          REPO: ${{ github.repository }}
+          REPO: ${{ env.PRISM_REPO }}
           REVIEW_SCORE: ${{ steps.review.outputs.score }}
           REVIEW_RESULT: ${{ steps.review.outputs.result }}
           REVIEW_FINDINGS: ${{ steps.review.outputs.findings }}
@@ -249,17 +254,17 @@ jobs:
               eval:{score:($score|tonumber),result:$result,rubric:"kiro-headless",
                     findings:($findings|tonumber),high_findings:($high|tonumber),
                     pr_number:($pr_number|tonumber),method:"kiro-headless"}}')
-          aws events put-events --region us-west-2 --entries \
+          aws events put-events --region $PRISM_AWS_REGION --entries \
             "[{\"Source\":\"prism.d1.velocity\",\"DetailType\":\"prism.d1.eval\",\"EventBusName\":\"prism-d1-metrics\",\"Detail\":$(echo "${DETAIL}" | jq -Rs '.')}]" || true
 
       - name: AWS Continuum security scan (Tier 2 -- deterministic)
         id: security-gate
         if: steps.aws-creds.outcome == 'success'
         env:
-          AWS_REGION: us-west-2
+          AWS_REGION: ${{ env.PRISM_AWS_REGION }}
           BASE_SHA: ${{ github.event.pull_request.base.sha }}
           HEAD_SHA: ${{ github.sha }}
-          REPO: ${{ github.repository }}
+          REPO: ${{ env.PRISM_REPO }}
           PR_NUMBER: ${{ github.event.pull_request.number }}
         run: |
           # Config is read FIRST, on purpose. "Continuum was never deployed" is a
@@ -407,9 +412,9 @@ jobs:
         if: steps.security-gate.outputs.skipped != 'true' && steps.security-gate.outputs.findings != '0' && steps.security-gate.outputs.findings != ''
         continue-on-error: true
         env:
-          AWS_REGION: us-west-2
+          AWS_REGION: ${{ env.PRISM_AWS_REGION }}
           TEAM_ID: ${{ steps.prism-config.outputs.team_id }}
-          REPO: ${{ github.repository }}
+          REPO: ${{ env.PRISM_REPO }}
           PR_NUMBER: ${{ github.event.pull_request.number }}
           BASE_SHA: ${{ github.event.pull_request.base.sha }}
           HEAD_SHA: ${{ github.sha }}
@@ -458,7 +463,7 @@ jobs:
           if [ "$TOTAL" -gt 0 ]; then
             # EventBridge accepts max 10 entries per call
             for i in $(seq 0 10 $((TOTAL - 1))); do
-              aws events put-events --region us-west-2 \
+              aws events put-events --region $PRISM_AWS_REGION \
                 --entries "$(echo "${ENTRIES}" | jq -c ".[$i:$((i+10))]")" || true
             done
             echo "Emitted ${TOTAL} Continuum finding events to EventBridge"

package/dist/assets/github-workflows/prism-eval-gate.yml

@@ -16,6 +16,11 @@ on:
     types: [opened, synchronize, reopened]
     branches: [main, master]
 
+
+env:
+  PRISM_AWS_REGION: us-west-2
+  PRISM_REPO: github.com/${{ github.repository }}
+
 permissions:
   id-token: write
   contents: read
@@ -34,7 +39,7 @@ jobs:
         uses: aws-actions/configure-aws-credentials@b47578312673ae6fa5b5096b330d9fbac3d116df # v4.2.1
         with:
           role-to-assume: ${{ secrets.PRISM_METRICS_ROLE_ARN }}
-          aws-region: us-west-2
+          aws-region: ${{ env.PRISM_AWS_REGION }}
 
       - name: Read team ID
         id: prism-config
@@ -201,7 +206,7 @@ jobs:
           TIMESTAMP=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
           EVAL_EVENT=$(jq -n \
             --arg team_id "${{ steps.prism-config.outputs.team_id }}" \
-            --arg repo "${{ github.repository }}" \
+            --arg repo "${PRISM_REPO}" \
             --arg timestamp "${TIMESTAMP}" \
             --argjson score "${{ steps.eval.outputs.avg_score }}" \
             --arg result "${{ steps.eval.outputs.overall_result }}" \
@@ -217,7 +222,7 @@ jobs:
               eval: {total_files: $total_files, pass_count: $pass_count, fail_count: $fail_count,
                      result: $result, pr_number: ($pr_number | tonumber), hallucinations_caught: $hallucinations}
             }')
-          aws events put-events --region us-west-2 --entries "[{
+          aws events put-events --region $PRISM_AWS_REGION --entries "[{
             \"Source\":\"prism.d1.velocity\",\"DetailType\":\"prism.d1.eval\",
             \"EventBusName\":\"prism-d1-metrics\",
             \"Detail\":$(echo "${EVAL_EVENT}" | jq -c '.' | jq -Rs '.')}]"
@@ -238,7 +243,7 @@ jobs:
       - name: AWS Continuum diff scan
         id: security-gate
         env:
-          AWS_REGION: us-west-2
+          AWS_REGION: ${{ env.PRISM_AWS_REGION }}
         run: |
           echo "::group::Retrieve Continuum config from SSM"
           AGENT_SPACE_ID=$(aws ssm get-parameter --name /prism/continuum/agent-space-id --query Parameter.Value --output text 2>/dev/null || echo "")
@@ -414,10 +419,10 @@ jobs:
       - name: Emit Continuum findings to EventBridge
         if: steps.security-gate.outputs.findings != '0' && steps.security-gate.outputs.skipped != 'true'
         env:
-          AWS_REGION: us-west-2
+          AWS_REGION: ${{ env.PRISM_AWS_REGION }}
         run: |
           PR_NUMBER="${{ github.event.pull_request.number }}"
-          REPO="${{ github.repository }}"
+          REPO="${PRISM_REPO}"
           TEAM_ID="${{ steps.prism-config.outputs.team_id }}"
           FINDINGS='${{ steps.security-gate.outputs.findings_json }}'
 

package/dist/assets/gitlab-workflows/prism-agent-eval.yml

@@ -6,7 +6,7 @@
 #
 # Required setup:
 #   - CI/CD variable PRISM_METRICS_ROLE_ARN (IAM role with bedrock:InvokeModel + events:PutEvents)
-#   - CI/CD variable AWS_REGION (default: us-west-2)
+#   - PRISM_AWS_REGION variable in the variables: block below controls the region
 #   - .prism/config.json committed to the repo
 #   - .prism/eval-harness/ installed (run: prism-cli bootstrapper install-eval-harness)
 #   - (Optional) Agent entry point supports --mock flag for dry-run execution
@@ -26,7 +26,9 @@ prism-agent-eval:
         - "**/*agent*.py"
         - "**/*agent*.ts"
   variables:
-    AWS_DEFAULT_REGION: us-west-2
+    PRISM_AWS_REGION: us-west-2
+    AWS_DEFAULT_REGION: $PRISM_AWS_REGION
+    PRISM_REPO: ${CI_SERVER_HOST}/${CI_PROJECT_PATH}
   before_script:
     - apt-get update -qq && apt-get install -y -qq jq bc git curl unzip
     - curl -s "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o /tmp/awscliv2.zip
@@ -133,7 +135,7 @@ prism-agent-eval:
       # Emit event
       TIMESTAMP=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
       EVAL_EVENT=$(jq -n \
-        --arg team_id "${TEAM_ID}" --arg repo "${CI_PROJECT_PATH}" --arg timestamp "${TIMESTAMP}" \
+        --arg team_id "${TEAM_ID}" --arg repo "${PRISM_REPO}" --arg timestamp "${TIMESTAMP}" \
         --argjson score "${SCORE:-0}" --arg result "${RESULT}" --argjson file_count "${FILE_COUNT}" \
         --arg mr_iid "${CI_MERGE_REQUEST_IID}" --arg mock_ran "${MOCK_RAN}" \
         '{team_id:$team_id, repo:$repo, timestamp:$timestamp, prism_level:3,

package/dist/assets/gitlab-workflows/prism-ai-metrics.yml

@@ -32,7 +32,9 @@ prism-ai-metrics:
   rules:
     - if: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH && $CI_PIPELINE_SOURCE == "push"'
   variables:
-    AWS_DEFAULT_REGION: us-west-2
+    PRISM_AWS_REGION: us-west-2
+    AWS_DEFAULT_REGION: $PRISM_AWS_REGION
+    PRISM_REPO: ${CI_SERVER_HOST}/${CI_PROJECT_PATH}
   before_script:
     - yum install -y -q jq git
     - git fetch --unshallow || true
@@ -113,7 +115,7 @@ prism-ai-metrics:
       # shape — the processor only persists a known section list.
       PR_EVENT=$(jq -n \
         --arg team_id "${TEAM_ID}" \
-        --arg repo "${CI_PROJECT_PATH}" \
+        --arg repo "${PRISM_REPO}" \
         --arg timestamp "${TIMESTAMP}" \
         --argjson lead_time_seconds "${LEAD_TIME_SECONDS}" \
         --argjson is_failure_fix "${IS_FAILURE_FIX}" \
@@ -140,7 +142,7 @@ prism-ai-metrics:
 
       # Sole deployment signal — deployment_frequency lives ONLY on this event.
       # Carrying it on prism.d1.pr as well double-counted the metric.
-      DEPLOY_EVENT=$(jq -n --arg team_id "${TEAM_ID}" --arg repo "${CI_PROJECT_PATH}" --arg timestamp "${TIMESTAMP}" \
+      DEPLOY_EVENT=$(jq -n --arg team_id "${TEAM_ID}" --arg repo "${PRISM_REPO}" --arg timestamp "${TIMESTAMP}" \
         '{team_id: $team_id, repo: $repo, timestamp: $timestamp, prism_level: 2,
          metric: {name: "deployment", value: 1, unit: "count"},
          dora: {deployment_frequency: 1}}')

package/dist/assets/gitlab-workflows/prism-eval-gate.yml

@@ -6,7 +6,7 @@
 #
 # Required setup:
 #   - CI/CD variable PRISM_METRICS_ROLE_ARN (IAM role with bedrock:InvokeModel + events:PutEvents)
-#   - CI/CD variable AWS_REGION (default: us-west-2)
+#   - PRISM_AWS_REGION variable in the variables: block below controls the region
 #   - .prism/eval-harness/ directory in your repo (run: prism-cli bootstrapper install-eval-harness)
 #   - At least one rubric JSON in .prism/eval-harness/rubrics/
 
@@ -21,7 +21,9 @@ prism-eval-gate:
   rules:
     - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
   variables:
-    AWS_DEFAULT_REGION: us-west-2
+    PRISM_AWS_REGION: us-west-2
+    AWS_DEFAULT_REGION: $PRISM_AWS_REGION
+    PRISM_REPO: ${CI_SERVER_HOST}/${CI_PROJECT_PATH}
   before_script:
     - yum install -y -q jq bc git
     - git fetch --unshallow || true
@@ -139,7 +141,7 @@ prism-eval-gate:
       # Emit event
       TIMESTAMP=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
       EVAL_EVENT=$(jq -n \
-        --arg team_id "${TEAM_ID}" --arg repo "${CI_PROJECT_PATH}" --arg timestamp "${TIMESTAMP}" \
+        --arg team_id "${TEAM_ID}" --arg repo "${PRISM_REPO}" --arg timestamp "${TIMESTAMP}" \
         --argjson score "${AVG_SCORE}" --arg result "${OVERALL}" \
         --argjson total_files "${TOTAL_FILES}" --argjson pass_count "${PASS_COUNT}" \
         --argjson fail_count "${FAIL_COUNT}" --argjson hallucinations "${TOTAL_HALLUCINATIONS}" \