shahar1 commented on PR #66: URL: https://github.com/apache/airflow-ci-infra/pull/66#issuecomment-6368076195
Thanks for the review. Replies are in the threads; the fixes are in 8a3f8aa, and 94d9939 is docs only. In short: - **Fixed:** 1 (an `AttachRolePolicy` guardrail plus exact template versions; this also covers `RunnerCustomPolicy`, which would have put admin on the runners), 4, 5 (narrowed `paths` filter instead of `-detailed-exitcode`), 6. The apply role also gets `cloudformation:TagResource`/`UntagResource` on the stack, because the provider sends the default tags on every `UpdateStack`. - **Left open with reasoning:** 2 (Terraform 1.16.2 only warns when the `env:/` listing is denied) and 3 (`aws:SourceArn` isn't documented for stack service roles, and if it's missing every apply fails; proposed to test during bootstrap). - **Process note:** added as bootstrap step 3 in `terraform/runs-on-access/README.rst`. Before the roles are created, check `runs-on-prod` with `gh api …/environments/runs-on-prod` and its `deployment-branch-policies`. Expect a `required_reviewers` rule with `prevent_self_review` and only `main`; stop otherwise. Today `gh api repos/apache/airflow-ci-infra/environments` returns none, as expected before merge. Each fix was checked with `aws iam simulate-custom-policy` against the rendered policies, and verified by two independent reviews. Still blocked on [INFRA-28572](https://issues.apache.org/jira/browse/INFRA-28572). --- Drafted-by: Claude Code (Opus 5.5) (no human review before posting) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
