`.github/scripts/dependency-scan.sh`

1404 of 1404 statements covered (100.00%).

coveredmissednever traced by Bash (not counted)A line ending in … continues the statement above it and shares its fate.

1		#!/usr/bin/env bash
2		# =============================================================================
3		# dependency-scan.sh — check Python, Node.js, Docker, Helm, and EKS versions
4		# =============================================================================
5		#
6		# Invoked by .github/workflows/deps-scan.yml (monthly schedule).
7		#
8		# Checks for drift across:
9		#
10		# - Python packages pinned in pyproject.toml
11		# - Docker images referenced from workflows, K8s manifests, examples,
12		# local live-validation manifests, and Helm chart values
13		# - Helm chart versions from charts.yaml
14		# - EKS add-on versions from gco/stacks/constants.py (AWS creds)
15		# - EKS Kubernetes minor from cdk.json (AWS creds)
16		# - Aurora PostgreSQL engine versions (AWS creds)
17		# - EMR Serverless release labels (AWS creds)
18		# - Bedrock default model ids from cdk.json
19		# context.bedrock.mission_default_model_id (Mission sampling),
20		# context.bedrock.capacity_advisor_default_model_id (capacity advisor),
21		# context.bedrock.claude_code_default_model_id (Claude Autopilot),
22		# context.bedrock.codex_default_model_id (Codex Autopilot),
23		# context.bedrock.embedding_model_id (Mission memory), and
24		# context.vector_store.embedding_model_id (workload RAG corpus), each
25		# compared against the newest same-family release — inference profiles
26		# for the generation keys, EMBEDDING foundation models for the embedding
27		# keys (AWS creds)
28		# - Accelerator catalog and Karpenter NodePool policy (offline), plus live
29		# NVIDIA GPU / AWS Neuron EC2 catalog drift across enabled Regions (AWS creds)
30		# - Dockerfile.dev ARG pins (Node LTS major, npm, CDK CLI, kubectl,
31		# AWS CLI v2, Docker CLI, Docker Buildx, uv) and the immutable AWS CLI
32		# runtime image in gco/services/inference_monitor.py — public registries,
33		# no AWS creds needed
34		# - GCO Autopilot pins from cli/autopilot.py: CLAUDE_CODE_VERSION and
35		# CODEX_VERSION install pins vs their npm latest dist-tags, plus companion
36		# MCP server liveness (missing/deprecated/yanked on npm or PyPI) — public
37		# endpoints, no AWS creds needed
38		# - Pre-commit hook revisions in .pre-commit-config.yaml compared
39		# against the latest tag published upstream (GitHub API)
40		# - CDK enum constants from gco/stacks/constants.py compared against the
41		# installed aws-cdk-lib (LAMBDA_PYTHON_RUNTIME, LAMBDA_NODEJS_RUNTIME;
42		# the Aurora engine is a plain version string checked against live RDS)
43		# - Latest stable Python release from endoflife.date — public endpoint
44		# - CI tooling the workflows install by hand: Trivy (the install-trivy
45		# composite action's version default),
46		# actionlint (ACTIONLINT_VERSION), Helm and kubectl (HELM_VERSION /
47		# KUBECTL_VERSION), kubeconform (KUBECONFORM_VERSION), Calico
48		# (CALICO_VERSION), Metrics Server (METRICS_SERVER_VERSION), and kind + its
49		# node image — public endpoints, no AWS creds
50		# - Version consistency: ruff (pyproject / pre-commit / lint workflow),
51		# Python and Node runtime pins, npm packageManager + CDK CLI pins, every
52		# owned npm graph's lockfile/Dependabot coverage, duplicated *_VERSION
53		# workflow environment pins, every per-Lambda requirements.txt pin
54		# against the version resolved centrally, and digest-pinned images
55		# carrying two digests under one tag
56		# - Base-image security epochs (APT_SECURITY_EPOCH / DNF_SECURITY_EPOCH)
57		# older than SECURITY_EPOCH_STALE_DAYS
58		# - Suppression expiries: .trivyignore / .pip-audit-ignore /
59		# .npm-audit-ignore entries expiring within SUPPRESSION_EXPIRY_WARN_DAYS
60		# (before the CI validator hard-fails)
61		# - Lockfile freshness: direct deps in pyproject.toml missing from or pinned
62		# differently in requirements-lock.txt
63		#
64		# Ports the `.dependency-scan-script` YAML anchor from the retired
65		# GitLab pipeline into a standalone shell script. Two behavior changes:
66		#
67		# 1. Workflow file input. The GitLab version grepped `.gitlab-ci.yml` for
68		# CI image tags. This version scans every file under
69		# `$WORKFLOWS_DIR` (default: `.github/workflows`).
70		# 2. Reporting. The GitLab version POSTed directly to the GitLab issues
71		# API. This version writes a Markdown report to a file and emits
72		# `has_drift=true\|false`, `scan_complete=true\|false`, and `report_path=…`
73		# on $GITHUB_OUTPUT so the calling workflow can manage a rolling issue.
74		#
75		# Environment inputs:
76		# WORKFLOWS_DIR default: .github/workflows
77		#
78		# Outputs (via $GITHUB_OUTPUT):
79		# has_drift "true" when any version is outdated, else "false"
80		# scan_complete "false" when any check fails or is explicitly skipped,
81		# else "true"
82		# report_path path to the Markdown report (only set when has_drift=true)
83		# =============================================================================
84	26	set -uo pipefail
85
86	26	WORKFLOWS_DIR="${WORKFLOWS_DIR:-.github/workflows}"
87	52	REPORT_FILE="$(mktemp -t dep-scan-XXXXXX.md 2>/dev/null \|\| mktemp --suffix=.md)"
88	52	INCOMPLETE_REASONS_FILE="$(mktemp -t dep-scan-incomplete-XXXXXX 2>/dev/null \|\| mktemp)"
89
90		# Persist incomplete reasons to a file because many checks run in pipeline
91		# subshells. A shell variable assignment made there would be lost, while an
92		# append to this channel survives and is consumed by the final completeness
93		# predicate. Messages go to stderr so they cannot corrupt command substitutions.
94		mark_scan_incomplete() {
95	95	local reason="$1"
96	95	printf '%s\n' "$reason" >> "$INCOMPLETE_REASONS_FILE"
97	95	echo " INCOMPLETE: $reason" >&2
98		}
99
100		join_scan_incomplete_reasons() {
101	11	sort -u "$INCOMPLETE_REASONS_FILE" \
102	11	\| awk 'BEGIN { first = 1 } { if (!first) printf "; "; printf "%s", $0; first = 0 } END { print "" }'
103		}
104
105		# Source shared functions (also used by BATS tests)
106	104	SCAN_SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
107		# shellcheck source=.github/scripts/lib_dependency_scan.sh
108	26	source "${SCAN_SCRIPT_DIR}/lib_dependency_scan.sh"
109
110		# ---------------------------------------------------------------------------
111		# Report helpers
112		#
113		# Small Markdown emitters shared by every section of the drift report so the
114		# table formatting lives in one place — previously each section hand-rolled
115		# its own ``\| … \|`` header + separator, which drifted as sections were added.
116		# ``emit_md_table`` turns a pipe-delimited results file into a GitHub table;
117		# ``md_anchor`` builds the in-page heading slug the top-of-report summary
118		# links to.
119		#
120		# Thresholds for the recurring-hygiene checks. Tunable in one place:
121		# SUPPRESSION_EXPIRY_WARN_DAYS surface .trivyignore / .pip-audit-ignore /
122		# .npm-audit-ignore entries expiring within
123		# this many days
124		# (the CI validator still hard-fails on the
125		# day itself — this is the early warning).
126		# SECURITY_EPOCH_STALE_DAYS flag a Dockerfile APT/DNF security epoch
127		# older than this many days.
128		# ---------------------------------------------------------------------------
129	26	SUPPRESSION_EXPIRY_WARN_DAYS="${SUPPRESSION_EXPIRY_WARN_DAYS:-30}"
130	26	SECURITY_EPOCH_STALE_DAYS="${SECURITY_EPOCH_STALE_DAYS:-45}"
131
132		# md_anchor <title> — GitHub heading slug (lowercase, punctuation dropped,
133		# spaces → hyphens). Close enough to GitHub's own algorithm for the
134		# summary-table links to resolve.
135		md_anchor() {
136	418	printf '%s' "$1" \
137	418	\| tr '[:upper:]' '[:lower:]' \
138	418	\| sed -E 's/[^a-z0-9 -]//g; s/ /-/g'
139		}
140
141		# emit_md_table <header> <results-file> [wrap]
142		#
143		# <header> pipe-delimited column labels, e.g. "Package\|Current\|Latest"
144		# <results-file> file of pipe-delimited rows with the same column count
145		# [wrap] when "code", every non-empty cell is wrapped in backticks
146		#
147		# Prints a GitHub-flavoured Markdown table. With no wrap, cells are emitted
148		# verbatim, so a caller that wants a link in a cell just writes the
149		# ``[text](url)`` markdown straight into the results file.
150		emit_md_table() {
151	77	local header="$1" file="$2" wrap="${3:-}"
152	77	local -a cells cols
153	154	IFS='\|' read -r -a cells <<< "$header"
154	77	local head="\|" sep="\|" c
155	274	for c in "${cells[@]}"; do
156	274	head+=" ${c} \|"
157	274	sep+="---\|"
158		done
159	77	printf '%s\n%s\n' "$head" "$sep"
160	728	while IFS='\|' read -r -a cols; do
161	287	[ "${#cols[@]}" -eq 0 ] && continue
162	287	local row="\|" cell
163	982	for cell in "${cols[@]}"; do
164	1012	if [ "$wrap" = "code" ] && [ -n "$cell" ]; then
165	30	row+=" \`${cell}\` \|"
166		else
167	952	row+=" ${cell} \|"
168		fi
169		done
170	287	printf '%s\n' "$row"
171		done < "$file"
172		}
173
174		# days_until <YYYY-MM-DD> — integer days from today to the given date
175		# (negative when the date is in the past). Empty output on a malformed date.
176		days_until() {
177	76	python3 -c "
178		import datetime, sys
179		try:
180		d = datetime.date.fromisoformat(sys.argv[1])
181		except Exception:
182		sys.exit(0)
183		print((d - datetime.date.today()).days)
184		" "$1" 2>/dev/null
185		}
186
187		# days_since <YYYY-MM-DD> — integer days from the given date to today
188		# (negative when the date is in the future). Empty output on a malformed date.
189		days_since() {
190	84	python3 -c "
191		import datetime, sys
192		try:
193		d = datetime.date.fromisoformat(sys.argv[1])
194		except Exception:
195		sys.exit(0)
196		print((datetime.date.today() - d).days)
197		" "$1" 2>/dev/null
198		}
199
200		# ---------------------------------------------------------------------------
201		# Python packages
202		#
203		# We run ``pip list --outdated`` on the installed interpreter, but
204		# filter the JSON result down to packages we pin directly in
205		# ``pyproject.toml::[project.dependencies]`` or the
206		# ``[project.optional-dependencies]`` groups. Every other outdated
207		# entry is a transitive dependency — its version is controlled by
208		# something we pin (``jsii``, ``aws-cdk-lib``, ``fastmcp``,
209		# ``botocore``, …) and bumping it ourselves either does nothing or
210		# breaks the resolver. Leaving those entries in the monthly scan
211		# report was creating noise: the operator had no action to take on
212		# them beyond "wait for upstream". Filter them out so the report
213		# only lists packages we can act on.
214		#
215		# The ``[build-system]`` requires pins (the exact-pinned build backend)
216		# are appended to the same surface below via a direct PyPI lookup — pip
217		# resolves them inside build isolation, so ``pip list`` never sees them.
218		# ---------------------------------------------------------------------------
219	26	echo "=== Checking for outdated Python dependencies ==="
220	26
221	26	# Install the project with EVERY optional-dependency group, not just the
222	26	# base dependencies: ``pip list --outdated`` can only report packages that
223	26	# are installed, so a base-only install silently dropped pins that live
224	26	# exclusively in an extras group (``aws-cdk-lib`` in ``cdk``, ``playwright``
225	26	# in ``diagrams``, ``mypy`` in ``typecheck``, ...) even though
226	26	# ``extract_direct_python_deps`` already includes them in the direct-pin
227	26	# filter below. Groups are enumerated from pyproject.toml so a new extras
228	26	# group joins the surface automatically; if enumeration fails, fall back to
229	26	# the old base-only install rather than dropping the report section.
230	78	PYTHON_EXTRAS="$(extract_python_extras pyproject.toml \| paste -sd, -)"
231	26	if [ -z "$PYTHON_EXTRAS" ]; then
232	1	mark_scan_incomplete "Could not enumerate optional dependency groups from pyproject.toml."
233		fi
234	26	if [ -n "$PYTHON_EXTRAS" ]; then
235	25	echo "Installing with extras: [${PYTHON_EXTRAS}]"
236	25	if ! pip install -e ".[${PYTHON_EXTRAS}]" --quiet --root-user-action=ignore; then
237	1	mark_scan_incomplete "Python dependency installation failed."
238		fi
239		else
240	1	if ! pip install -e . --quiet --root-user-action=ignore; then
241	1	mark_scan_incomplete "Python dependency installation failed and optional groups could not be enumerated."
242		fi
243		fi
244	52	if ! OUTDATED_RAW="$(pip list --outdated --format=json)"; then
245	1	mark_scan_incomplete "pip list --outdated failed."
246	1	OUTDATED_RAW="[]"
247	50	elif ! printf '%s' "$OUTDATED_RAW" \| jq -e 'type == "array"' >/dev/null 2>&1; then
248	1	mark_scan_incomplete "pip list --outdated returned malformed JSON."
249	1	OUTDATED_RAW="[]"
250		fi
251
252		# Build a newline-separated list of PEP-503-normalised direct-dep names.
253		# An empty list disables the filter so we never silently hide drift when
254		# the TOML parse breaks. In practice the file always parses — we just
255		# can't risk a dropped report section.
256	52	DIRECT_DEPS="$(extract_direct_python_deps pyproject.toml)"
257	26	if [ -z "$DIRECT_DEPS" ]; then
258	1	mark_scan_incomplete "Could not parse direct Python dependencies from pyproject.toml."
259		fi
260
261	78	if ! OUTDATED="$(printf '%s' "$OUTDATED_RAW" \| python3 -c "
262	78	import json, re, sys
263	78	raw = sys.stdin.read()
264	78	direct = set(
265	78	line.strip() for line in '''$DIRECT_DEPS'''.splitlines() if line.strip()
266	78	)
267	78	try:
268	78	data = json.loads(raw) if raw else []
269	78	except json.JSONDecodeError:
270	78	raise SystemExit(1)
271	78	if direct:
272	78	data = [
273	78	e for e in data
274	78	if re.sub(r'[-_.]+', '-', e.get('name', '')).lower() in direct
275	78	]
276	78	print(json.dumps(data))
277	78	")"; then
278	1	mark_scan_incomplete "Could not parse or filter pip's outdated-package response."
279	1	OUTDATED="[]"
280		fi
281
282		# Build-backend pins ([build-system] requires) are Python dependencies
283		# too, but they are invisible to ``pip list --outdated``: pip resolves
284		# them inside build isolation, not in this venv (a Python 3.14 venv does
285		# not even ship setuptools). Compare each exact pin against its PyPI
286		# latest and report it through the same Python-packages surface as every
287		# other pyproject pin. Non-exact entries are skipped here — the
288		# version-consistency section flags those as a policy finding.
289	52	BUILD_SYSTEM_PINS="$(extract_build_system_pins pyproject.toml)"
290	26	if [ -z "$BUILD_SYSTEM_PINS" ]; then
291	1	mark_scan_incomplete "Could not parse [build-system] requirements from pyproject.toml."
292		else
293	100	while IFS='\|' read -r bs_name bs_version bs_raw; do
294		# Only exact pins are compared; non-exact entries surface through
295		# the version-consistency policy check instead.
296	50	if [ -z "$bs_name" ] \|\| [ -z "$bs_version" ]; then
297	1	continue
298		fi
299	95	if ! bs_latest="$(curl -fsSL --max-time 15 \
300		"https://pypi.org/pypi/${bs_name}/json" 2>/dev/null \
301		\| jq -r '.info.version // empty' 2>/dev/null)" \|\| [ -z "$bs_latest" ]; then
302	1	mark_scan_incomplete "PyPI lookup failed or returned an invalid version for build dependency ${bs_name}."
303	1	continue
304		fi
305	46	if [ "$(compare_semver "$bs_version" "$bs_latest")" = "newer" ]; then
306	12	OUTDATED="$(echo "$OUTDATED" \| jq \
307		--arg name "$bs_name" --arg cur "$bs_version" --arg latest "$bs_latest" \
308		'. + [{"name": $name, "version": $cur, "latest_version": $latest}]')"
309		fi
310		done <<< "$BUILD_SYSTEM_PINS"
311		fi
312
313	78	PYTHON_COUNT="$(echo "$OUTDATED" \| jq 'length')"
314	26	if [ "$PYTHON_COUNT" -eq 0 ]; then
315	22	echo "All Python dependencies are up to date."
316	22	PYTHON_OUTDATED=""
317		else
318	4	echo "Found $PYTHON_COUNT outdated Python package(s) (direct dependencies only — transitive bumps are upstream's job)"
319	8	echo "$OUTDATED" \| jq -r '.[] \| " - \(.name): \(.version) -> \(.latest_version)"'
320	4	PYTHON_OUTDATED="$OUTDATED"
321		fi
322
323		# ---------------------------------------------------------------------------
324		# npm packages (every repository-owned graph)
325		# ---------------------------------------------------------------------------
326		# Direct npm dependencies never had a drift surface of their own: aws-cdk and
327		# markdownlint-cli2 only leaked into the report indirectly (via the
328		# Dockerfile.dev ARG and the pre-commit hook rev), and the
329		# inference-streaming-proxy's @aws-sdk clients were reported nowhere at all.
330		# This walks the same repository-owned graphs the npm package-management
331		# check validates and compares each exact direct pin against the registry's
332		# ``latest`` dist-tag — the npm analogue of the Python Packages surface.
333	26	echo ""
334	26	echo "=== Checking for outdated npm packages ==="
335	26
336	52	NPM_RESULTS="$(mktemp)"
337	26	NPM_COUNT=0
338
339	52	NPM_PACKAGE_DIRS="$(list_npm_package_dirs .)"
340	26	if [ -z "$NPM_PACKAGE_DIRS" ]; then
341	1	mark_scan_incomplete "Could not enumerate repository-owned npm package manifests."
342		fi
343	108	while IFS= read -r package_dir; do
344	29	[ -n "$package_dir" ] \|\| continue
345	27	manifest="${package_dir}/package.json"
346	54	package_pins="$(extract_npm_direct_pins "$manifest")"
347	27	if [ -z "$package_pins" ]; then
348	1	mark_scan_incomplete "Could not parse exact npm dependency pins from ${manifest}."
349	1	continue
350		fi
351	120	while IFS='\|' read -r pkg_name pkg_version; do
352	34	[ -n "$pkg_name" ] \|\| continue
353		# Scoped names carry a '/', which must be encoded in the registry URL.
354	102	encoded_name="$(printf '%s' "$pkg_name" \| sed 's\|/\|%2F\|g')"
355	135	if ! pkg_latest="$(curl -fsSL --max-time 15 \
356		"https://registry.npmjs.org/${encoded_name}/latest" 2>/dev/null \
357		\| jq -r '.version // empty' 2>/dev/null)" \|\| [ -z "$pkg_latest" ]; then
358	1	mark_scan_incomplete "npm registry lookup failed or returned an invalid version for ${pkg_name}."
359	1	continue
360		fi
361	66	if [ "$(compare_semver "$pkg_version" "$pkg_latest")" = "newer" ]; then
362	9	echo " - ${package_dir}: ${pkg_name} ${pkg_version} -> ${pkg_latest}"
363	9	echo "${package_dir}\|${pkg_name}\|${pkg_version}\|${pkg_latest}" >> "$NPM_RESULTS"
364		fi
365		done <<< "$package_pins"
366		done <<< "$NPM_PACKAGE_DIRS"
367
368	78	NPM_COUNT="$(wc -l < "$NPM_RESULTS" \| tr -d ' ')"
369	26	if [ "$NPM_COUNT" -eq 0 ]; then
370	22	echo "All npm direct dependencies are up to date."
371		else
372	4	echo "Found $NPM_COUNT outdated npm package pin(s) across the owned graphs"
373		fi
374
375		# ---------------------------------------------------------------------------
376		# Docker image tags
377		# ---------------------------------------------------------------------------
378	26	echo ""
379	26	echo "=== Checking for outdated Docker images ==="
380	26
381	52	DOCKER_RESULTS="$(mktemp)"
382	52	ALL_IMAGES="$(mktemp)"
383
384		check_image() {
385	262	local image="$1"
386	262	local current_tag="$2"
387
388		# Only handle semver tags
389	262	if ! is_semver_tag "$current_tag"; then
390	23	return
391		fi
392		# Skip images we build in this project
393	239	if is_project_image "$image"; then
394	23	return
395		fi
396
397	216	local parsed registry repo
398	432	parsed="$(parse_image_registry "$image")"
399	648	registry="$(echo "$parsed" \| cut -d'\|' -f1)"
400	648	repo="$(echo "$parsed" \| cut -d'\|' -f2)"
401
402		# Fetch and filter separately. A registry/network failure marks the scan
403		# incomplete, while "the registry answered and nothing newer exists in
404		# this variant family" is an up-to-date pin. The previous single pipeline
405		# conflated the two under pipefail: the strict bare-semver grep matched
406		# nothing for suffix-tagged repositories (…-py3, …-cuda…, …-ubuntu…), so
407		# they reported "tag lookup failed" every month even though the registry
408		# was fine.
409	216	local raw_tags=""
410	857	if ! raw_tags="$(skopeo list-tags --retry-times 3 "docker://${registry}/${repo}" 2>/dev/null \
411		\| jq -r '.Tags[]' 2>/dev/null)" \|\| [ -z "$raw_tags" ]; then
412	14	mark_scan_incomplete "Container registry tag lookup failed for ${registry}/${repo}."
413	14	return
414		fi
415
416	202	local latest_tag
417	606	latest_tag="$(printf '%s\n' "$raw_tags" \| newer_same_variant_tag "$current_tag")" \|\| latest_tag=""
418
419	202	if [ -n "$latest_tag" ]; then
420	50	echo " - ${image}:${current_tag} -> ${latest_tag}"
421	50	echo "${image}\|${current_tag}\|${latest_tag}" >> "$DOCKER_RESULTS"
422	50	return
423		fi
424
425		# No newer family member. If the pinned tag itself is no longer listed,
426		# the pin points at something the registry stopped advertising (renamed
427		# variant scheme, withdrawn tag) — that deserves eyes, not silence.
428		# tag_listed reads the list from an argument, not a printf pipe: under
429		# pipefail, grep -q's early exit gave printf SIGPIPE on large tag lists
430		# and inverted "tag present" into a false INCOMPLETE (2026-09 scan).
431	152	if ! tag_listed "$current_tag" "$raw_tags"; then
432	5	mark_scan_incomplete "Pinned tag ${current_tag} is no longer listed by ${registry}/${repo}."
433		fi
434		}
435
436		# Collect image:tag pairs from workflow files (bare `image:` references in
437		# container specs and `uses: …@sha` are handled by Dependabot; here we look
438		# for free-form image references in run steps).
439	26	echo "Checking workflow files in $WORKFLOWS_DIR..."
440	26	if [ -d "$WORKFLOWS_DIR" ]; then
441	25	grep -rhoE "image: [a-zA-Z0-9_./-]+:[a-zA-Z0-9._-]+" "$WORKFLOWS_DIR" 2>/dev/null \
442	48	\| sed 's/image: //' >> "$ALL_IMAGES" \|\| true
443	25	grep -rhoE "[a-zA-Z0-9_./-]+:[a-zA-Z0-9._-]+" "$WORKFLOWS_DIR" 2>/dev/null \
444	25	\| grep -E '^(alpine\|hadolint\|koalaman\|semgrep\|bridgecrew\|checkmarx\|trufflesecurity\|zricethezav\|aquasec\|bats\|python):' \
445	25	\| sed 's/[[:space:]]*$//' >> "$ALL_IMAGES" \|\| true
446		fi
447
448	26	echo "Checking K8s manifest images..."
449	26	grep -rhoE "image: [a-zA-Z0-9_./-]+:[a-zA-Z0-9._-]+" lambda/kubectl-applier-simple/manifests/ 2>/dev/null \
450	53	\| grep -v '{{' \| sed 's/image: //' >> "$ALL_IMAGES" \|\| true
451
452	26	echo "Checking example manifest images..."
453	26	grep -rhoE "image: [a-zA-Z0-9_./-]+:[a-zA-Z0-9._-]+" examples/ 2>/dev/null \
454	27	\| sed 's/image: //' >> "$ALL_IMAGES" \|\| true
455
456	26	echo "Checking local live-validation manifest images..."
457	26	grep -rhoE "image: [a-zA-Z0-9_./-]+:[a-zA-Z0-9._-]+" scripts/live_release_validation/manifests/ 2>/dev/null \
458	27	\| sed 's/image: //' >> "$ALL_IMAGES" \|\| true
459
460	26	echo "Checking Helm chart value images..."
461		# Registry-aware walk over every charts.yaml values block (see
462		# extract_chart_value_images in lib_dependency_scan.sh — moved there so BATS
463		# exercises the real logic). charts.yaml always pins values images, so an
464		# empty result means the parse broke — surface that as an incomplete scan
465		# rather than silently dropping the sweep.
466	52	CHART_VALUE_IMAGES="$(extract_chart_value_images lambda/helm-installer/charts.yaml)"
467	26	if [ -n "$CHART_VALUE_IMAGES" ]; then
468	23	printf '%s\n' "$CHART_VALUE_IMAGES" >> "$ALL_IMAGES"
469		else
470	3	mark_scan_incomplete "Could not parse Helm chart value images."
471		fi
472
473		# Mooncake default image — pinned as a Python constant in cli/images.py
474		# (_DISAGGREGATED_DEFAULT_IMAGE), so it is invisible to Dependabot (docker
475		# ecosystem) and to the manifest/workflow sweeps above. Add it here so a newer
476		# upstream vLLM release shows up in the monthly drift report — the cue to
477		# validate and bump the pin.
478	26	echo "Checking Mooncake default image (cli/images.py)..."
479	52	MOONCAKE_IMAGE="$(extract_mooncake_default_image cli/images.py)"
480	26	if [ -n "$MOONCAKE_IMAGE" ]; then
481	25	echo "$MOONCAKE_IMAGE" >> "$ALL_IMAGES"
482		else
483	1	mark_scan_incomplete "Could not parse the Mooncake default image from cli/images.py."
484		fi
485
486		# The model-sync init container uses an official AWS CLI image pinned by both
487		# version and manifest-list digest. Strip only the digest for the registry tag
488		# lookup; the offline provenance contract separately requires the digest.
489	26	echo "Checking AWS CLI runtime image (gco/services/inference_monitor.py)..."
490	52	AWS_CLI_RUNTIME_IMAGE="$(extract_python_string_constant \
491		AWS_CLI_IMAGE gco/services/inference_monitor.py)"
492		# check_pinned_digest <repo:tag@sha256:digest> <origin label>
493		#
494		# Shared digest-freshness check for every digest-pinned image the repository
495		# commits: verify the tag's currently published manifest-list digest still
496		# equals the committed one. A moved digest is a drift row (the tag was
497		# re-pushed upstream — the pin is stale); an unreachable registry or an
498		# implausible response marks the scan incomplete.
499		check_pinned_digest() {
500	53	local pinned_ref="$1" origin="$2" parts repository tag committed published
501	106	if ! parts="$(split_pinned_image_ref "$pinned_ref")"; then
502	1	mark_scan_incomplete "Could not parse an immutable image reference from ${origin}."
503	1	return
504		fi
505	156	repository="$(echo "$parts" \| cut -d'\|' -f1)"
506	156	tag="$(echo "$parts" \| cut -d'\|' -f2)"
507	156	committed="$(echo "$parts" \| cut -d'\|' -f3)"
508	52	printf '%s:%s\n' "$repository" "$tag" >> "$ALL_IMAGES"
509
510	104	if ! published="$(published_manifest_digest "${repository}:${tag}")"; then
511	2	mark_scan_incomplete "Container manifest lookup failed for ${repository}:${tag}."
512	2	return
513		fi
514	50	if [ "$committed" != "$published" ]; then
515	12	echo " - ${repository}:${tag}: committed digest does not match the tag (${origin})"
516	12	echo "${repository}\|${tag}@${committed}\|${tag}@${published}" >> "$DOCKER_RESULTS"
517		fi
518		}
519
520	26	if [[ "$AWS_CLI_RUNTIME_IMAGE" =~ ^[^@]+:[^@]+@sha256:[0-9a-f]{64}$ ]]; then
521	25	check_pinned_digest "$AWS_CLI_RUNTIME_IMAGE" "gco/services/inference_monitor.py"
522		else
523	1	mark_scan_incomplete "Could not parse an immutable AWS_CLI_IMAGE from gco/services/inference_monitor.py."
524		fi
525
526		# The live-validation smoke manifests pin every image by tag AND manifest-list
527		# digest (tests/test_live_release_validation.py enforces the shape). The tag
528		# half already rides the normal drift check above; this pass keeps the digest
529		# half honest too, so an upstream same-tag re-push shows up as drift instead
530		# of silently diverging from what a validation run would actually pull.
531	26	echo "Checking live-validation smoke image digests (scripts/live_release_validation/manifests)..."
532	104	SMOKE_PINNED_REFS="$(grep -rhoE \
533		"image: [a-zA-Z0-9_./-]+:[a-zA-Z0-9._-]+@sha256:[0-9a-f]{64}" \
534		scripts/live_release_validation/manifests/ 2>/dev/null \| sed 's/^image: //' \| sort -u)"
535	26	if [ -z "$SMOKE_PINNED_REFS" ]; then
536	1	mark_scan_incomplete "No digest-pinned smoke images found under scripts/live_release_validation/manifests/."
537		else
538	53	while read -r pinned_ref; do
539	28	[ -z "$pinned_ref" ] && continue
540	28	check_pinned_digest "$pinned_ref" "live-validation smoke manifest"
541		done <<< "$SMOKE_PINNED_REFS"
542		fi
543
544	314	sort -u "$ALL_IMAGES" \| while read -r img; do
545	262	[ -z "$img" ] && continue
546	786	image="$(echo "$img" \| cut -d':' -f1)"
547	786	tag="$(echo "$img" \| cut -d':' -f2)"
548	262	check_image "$image" "$tag"
549		done
550	26	rm -f "$ALL_IMAGES"
551
552	78	DOCKER_COUNT="$(wc -l < "$DOCKER_RESULTS" \| tr -d ' ')"
553	26	[ -z "$DOCKER_COUNT" ] && DOCKER_COUNT=0
554
555		# ---------------------------------------------------------------------------
556		# Helm chart versions
557		# ---------------------------------------------------------------------------
558	26	echo ""
559	26	echo "=== Checking Helm chart versions ==="
560	26
561	52	HELM_RESULTS="$(mktemp)"
562	26	CHARTS_FILE="lambda/helm-installer/charts.yaml"
563
564	26	if [ -f "$CHARTS_FILE" ]; then
565	50	CHART_ENTRIES="$(extract_helm_charts "$CHARTS_FILE")"
566	25	if [ -z "$CHART_ENTRIES" ]; then
567	1	mark_scan_incomplete "Could not parse Helm chart pins from ${CHARTS_FILE}."
568		fi
569	200	while IFS= read -r entry; do
570	76	[ -n "$entry" ] \|\| continue
571	222	chart_name="$(echo "$entry" \| jq -r '.name // empty')"
572	222	repo_url="$(echo "$entry" \| jq -r '.repo_url // empty')"
573	222	chart="$(echo "$entry" \| jq -r '.chart // empty')"
574	222	current="$(echo "$entry" \| jq -r '.version // empty')"
575	222	use_oci="$(echo "$entry" \| jq -r '.use_oci // false')"
576	295	if [ -z "$chart_name" ] \|\| [ -z "$repo_url" ] \|\| [ -z "$chart" ] \|\| [ -z "$current" ]; then
577	1	mark_scan_incomplete "Helm chart parser emitted an incomplete record from ${CHARTS_FILE}."
578	1	continue
579		fi
580
581	73	latest=""
582	73	if [ "$use_oci" = "true" ]; then
583	132	if ! latest="$(helm show chart "${repo_url}/${chart}" 2>/dev/null \| grep '^version:' \| awk '{print $2}')" \
584	31	\|\| [ -z "$latest" ]; then
585	2	mark_scan_incomplete "Helm OCI lookup failed for ${repo_url}/${chart}."
586	2	continue
587		fi
588		else
589	40	if ! helm repo add "$chart_name" "$repo_url" --force-update > /dev/null 2>&1; then
590	1	mark_scan_incomplete "Helm repository refresh failed for ${chart_name} (${repo_url})."
591	1	continue
592		fi
593	156	if ! latest="$(helm search repo "${chart_name}/${chart}" --output json 2>/dev/null \
594		\| jq -r '.[0].version // empty')" \|\| [ -z "$latest" ]; then
595	2	mark_scan_incomplete "Helm chart lookup failed for ${chart_name}/${chart}."
596	2	continue
597		fi
598		fi
599
600	68	if [ "$current" != "$latest" ]; then
601	21	current_stripped="${current#v}"
602	21	latest_stripped="${latest#v}"
603	21	if [ "$current_stripped" != "$latest_stripped" ]; then
604	21	echo " - ${chart_name} (${chart}): ${current} -> ${latest}"
605	21	echo "${chart_name}\|${chart}\|${current}\|${latest}" >> "$HELM_RESULTS"
606		fi
607		fi
608		done <<< "$CHART_ENTRIES"
609		else
610	1	mark_scan_incomplete "${CHARTS_FILE} is missing."
611		fi
612
613	78	HELM_COUNT="$(wc -l < "$HELM_RESULTS" 2>/dev/null \| tr -d ' ')"
614	26	[ -z "$HELM_COUNT" ] && HELM_COUNT=0
615
616		# ---------------------------------------------------------------------------
617		# EKS add-on versions (best-effort — requires AWS credentials)
618		#
619		# Pre-flight: probe for usable AWS credentials. If `sts get-caller-identity`
620		# fails the scan is skipped entirely and a one-line note goes into both the
621		# console log and the Markdown report — this is more honest than silently
622		# dropping the section. Wire AWS creds through OIDC (see the deps-scan
623		# section in .github/CI.md) to enable the check.
624		# ---------------------------------------------------------------------------
625	26	echo ""
626	26	echo "=== Checking EKS add-on versions ==="
627	26
628	52	ADDON_RESULTS="$(mktemp)"
629	26	ADDON_SKIP_REASON=""
630	52	K8S_VERSION="$(extract_k8s_version "")"
631
632	26	if ! aws sts get-caller-identity >/dev/null 2>&1; then
633	3	ADDON_SKIP_REASON="No AWS credentials available (scan needs eks:DescribeAddonVersions). Configure OIDC to enable."
634	3	echo " $ADDON_SKIP_REASON"
635		else
636	46	EKS_ADDONS="$(extract_eks_addons "gco/stacks/regional_stack.py")"
637	23	if [ -z "$EKS_ADDONS" ]; then
638	1	ADDON_SKIP_REASON="Could not read EKS add-on pins from gco/stacks/regional_stack.py."
639	1	echo " $ADDON_SKIP_REASON"
640		else
641	244	while IFS='\|' read -r addon_name current_version; do
642	102	[ -z "$addon_name" ] && continue
643	204	latest="$(aws eks describe-addon-versions \
644		--addon-name "$addon_name" \
645		--kubernetes-version "$K8S_VERSION" \
646		--query 'addons[0].addonVersions[0].addonVersion' \
647		--output text 2>/dev/null)" \|\| latest=""
648
649	102	if ! [[ "$latest" =~ ^v[0-9]+\.[0-9]+\.[0-9]+-eksbuild\.[0-9]+$ ]]; then
650	2	ADDON_SKIP_REASON="EKS add-on lookup failed or returned an invalid version for ${addon_name}."
651	2	echo " $ADDON_SKIP_REASON"
652	2	break
653		fi
654	100	if [ "$current_version" != "$latest" ]; then
655	20	echo " - ${addon_name}: ${current_version} -> ${latest}"
656	20	echo "${addon_name}\|${current_version}\|${latest}" >> "$ADDON_RESULTS"
657		fi
658		done <<< "$EKS_ADDONS"
659		fi
660		fi
661
662	78	ADDON_COUNT="$(wc -l < "$ADDON_RESULTS" 2>/dev/null \| tr -d ' ')"
663	26	[ -z "$ADDON_COUNT" ] && ADDON_COUNT=0
664
665		# ---------------------------------------------------------------------------
666		# EKS Kubernetes version (best-effort — requires AWS credentials)
667		#
668		# Compares ``kubernetes_version`` in cdk.json against the latest minor
669		# available from ``aws eks describe-cluster-versions`` (filtered to
670		# ``STANDARD_SUPPORT``). If a newer minor is available, we also report
671		# when standard support for the currently-pinned minor ends so the
672		# upgrade urgency is visible in the PR.
673		#
674		# IAM action: ``eks:DescribeClusterVersions``. Same credential preflight
675		# as the EKS add-on / Aurora / EMR checks.
676		# ---------------------------------------------------------------------------
677	26	echo ""
678	26	echo "=== Checking EKS Kubernetes version ==="
679	26
680	52	EKS_K8S_RESULTS="$(mktemp)"
681	26	EKS_K8S_SKIP_REASON=""
682
683	26	if ! aws sts get-caller-identity >/dev/null 2>&1; then
684	3	EKS_K8S_SKIP_REASON="No AWS credentials available (scan needs eks:DescribeClusterVersions). Configure OIDC to enable."
685	3	echo " $EKS_K8S_SKIP_REASON"
686		else
687		# ``--version-status STANDARD_SUPPORT`` returns every minor still in
688		# standard support — we don't want to flag the extended-support
689		# lifecycle as "newer." It must be the only selector: the API rejects
690		# combining it with ``--include-all`` ("Only one of the defaultOnly,
691		# clusterVersions, includeAll or status request parameters is accepted
692		# at a time"), which is exactly how this check silently broke once.
693		# stderr is captured into the skip reason so the next API-shape change
694		# is diagnosable from the report instead of reading as a generic skip.
695	46	EKS_K8S_ERR_FILE="$(mktemp)"
696	47	CLUSTER_VERSIONS_JSON="$(aws eks describe-cluster-versions \
697		--version-status STANDARD_SUPPORT \
698		--output json 2>"$EKS_K8S_ERR_FILE")" \|\| CLUSTER_VERSIONS_JSON=""
699
700	23	if [ -z "$CLUSTER_VERSIONS_JSON" ]; then
701	3	EKS_K8S_ERR="$(head -n 1 "$EKS_K8S_ERR_FILE" 2>/dev/null \| tr -d '\r')"
702	1	EKS_K8S_SKIP_REASON="EKS Kubernetes version lookup failed${EKS_K8S_ERR:+: ${EKS_K8S_ERR}}"
703	1	[ -z "$EKS_K8S_ERR" ] && EKS_K8S_SKIP_REASON="EKS Kubernetes version lookup returned an empty response."
704	1	echo " $EKS_K8S_SKIP_REASON"
705	1	rm -f "$EKS_K8S_ERR_FILE"
706		else
707	22	rm -f "$EKS_K8S_ERR_FILE"
708		# Max of ``clusterVersion`` across all rows is the newest standard-
709		# support minor. We use Python for a proper numeric sort so 1.10
710		# beats 1.9 (sort -V already does this, but Python keeps the data
711		# wrangling in one place).
712	67	LATEST_K8S="$(echo "$CLUSTER_VERSIONS_JSON" \| python3 -c '
713		import json, sys
714		try:
715		data = json.load(sys.stdin)
716		except Exception:
717		sys.exit(0)
718		versions = sorted(
719		{row["clusterVersion"] for row in data.get("clusterVersions", [])},
720		key=lambda v: tuple(int(p) for p in v.split(".")),
721		)
722		print(versions[-1] if versions else "")
723		' 2>/dev/null)" \|\| LATEST_K8S=""
724
725	22	if [ -z "$LATEST_K8S" ]; then
726	2	EKS_K8S_SKIP_REASON="EKS Kubernetes version response contained no parseable standard-support versions."
727	2	echo " $EKS_K8S_SKIP_REASON"
728		else
729	40	CURRENT_K8S="$(extract_k8s_version "cdk.json")"
730
731	20	if [ "$CURRENT_K8S" != "$LATEST_K8S" ] \
732	6	&& [ "$(compare_semver "$CURRENT_K8S" "$LATEST_K8S")" = "newer" ]; then
733		# Grab the standard-support end date for the currently-pinned
734		# minor. Blank when EKS hasn't published one yet (brand-new release).
735	9	EOS_DATE="$(echo "$CLUSTER_VERSIONS_JSON" \| python3 -c "
736	9	import json, sys
737	9	cv = sys.argv[1]
738	9	try:
739	9	data = json.load(sys.stdin)
740	9	except Exception:
741	9	sys.exit(0)
742	9	for row in data.get('clusterVersions', []):
743	9	if row.get('clusterVersion') == cv:
744	9	ts = row.get('endOfStandardSupportDate', '')
745	9	# Strip time-of-day; the date is what the report cares about.
746	9	print(str(ts).split('T', 1)[0].split(' ', 1)[0])
747	9	break
748	9	" "$CURRENT_K8S" 2>/dev/null)" \|\| EOS_DATE=""
749
750	3	echo " - kubernetes_version: ${CURRENT_K8S} -> ${LATEST_K8S} (std support ends ${EOS_DATE:-unknown})"
751	3	echo "kubernetes_version\|${CURRENT_K8S}\|${LATEST_K8S}\|${EOS_DATE:-unknown}" >> "$EKS_K8S_RESULTS"
752		fi
753		fi
754		fi
755		fi
756
757	78	EKS_K8S_COUNT="$(wc -l < "$EKS_K8S_RESULTS" 2>/dev/null \| tr -d ' ')"
758	26	[ -z "$EKS_K8S_COUNT" ] && EKS_K8S_COUNT=0
759
760		# ---------------------------------------------------------------------------
761		# Aurora PostgreSQL engine versions (best-effort — requires AWS credentials)
762		#
763		# Checks whether the Aurora PostgreSQL engine version pinned in
764		# regional_stack.py has a newer minor or major release available.
765		# Uses the same credential gate as the EKS add-on check above.
766		# ---------------------------------------------------------------------------
767	26	echo ""
768	26	echo "=== Checking Aurora PostgreSQL engine versions ==="
769	26
770	52	AURORA_RESULTS="$(mktemp)"
771	26	AURORA_SKIP_REASON=""
772
773	26	if ! aws sts get-caller-identity >/dev/null 2>&1; then
774	3	AURORA_SKIP_REASON="No AWS credentials available (scan needs rds:DescribeDBEngineVersions). Configure OIDC to enable."
775	3	echo " $AURORA_SKIP_REASON"
776		else
777		# The pinned Aurora PostgreSQL version (AURORA_POSTGRES_VERSION in
778		# gco/stacks/constants.py — a plain version string applied through
779		# AuroraPostgresEngineVersion.of(), so no CDK enum is involved).
780	46	AURORA_VERSIONS="$(extract_aurora_versions "gco/stacks/regional_stack.py")"
781	23	if [ -z "$AURORA_VERSIONS" ]; then
782	1	AURORA_SKIP_REASON="Could not read AURORA_POSTGRES_VERSION from gco/stacks/constants.py."
783	1	echo " $AURORA_SKIP_REASON"
784		else
785	43	while read -r current_ver; do
786	22	[ -z "$current_ver" ] && continue
787	66	major="$(echo "$current_ver" \| cut -d. -f1)"
788
789		# Query the latest available engine version for this major line.
790	110	latest="$(aws rds describe-db-engine-versions \
791		--engine aurora-postgresql \
792		--query "DBEngineVersions[?starts_with(EngineVersion, '${major}.')].EngineVersion" \
793		--output text 2>/dev/null \
794		\| tr '\t' '\n' \| sort -V \| tail -1)" \|\| latest=""
795
796	22	if ! [[ "$latest" =~ ^[0-9]+\.[0-9]+(\.[0-9]+)?$ ]]; then
797	1	AURORA_SKIP_REASON="Aurora PostgreSQL engine lookup failed or returned an invalid version for major ${major}."
798	1	echo " $AURORA_SKIP_REASON"
799	1	break
800		fi
801	21	if [ "$current_ver" != "$latest" ]; then
802	4	echo " - aurora-postgresql: ${current_ver} -> ${latest}"
803	4	echo "aurora-postgresql\|${current_ver}\|${latest}" >> "$AURORA_RESULTS"
804		fi
805		done <<< "$AURORA_VERSIONS"
806		fi
807		fi
808
809	78	AURORA_COUNT="$(wc -l < "$AURORA_RESULTS" 2>/dev/null \| tr -d ' ')"
810	26	[ -z "$AURORA_COUNT" ] && AURORA_COUNT=0
811
812		# ---------------------------------------------------------------------------
813		# EMR Serverless release labels (best-effort — requires AWS credentials)
814		#
815		# Checks whether the EMR Serverless release label pinned in
816		# gco/stacks/constants.py has a newer release available. Uses the same
817		# credential gate as the EKS add-on / Aurora checks above.
818		#
819		# AWS CLI note: the `list-release-labels` subcommand lives on the classic
820		# `aws emr` service, not on `aws emr-serverless`. Classic EMR and EMR
821		# Serverless share the same release-label namespace (e.g. emr-7.13.0),
822		# so calling the classic service returns the labels usable by Serverless
823		# applications. The IAM action is ``elasticmapreduce:ListReleaseLabels``
824		# (which is what the OIDC policy grants) and is shared between the two
825		# services — the CLI routing is just a surface-level difference.
826		# ---------------------------------------------------------------------------
827	26	echo ""
828	26	echo "=== Checking EMR Serverless release labels ==="
829	26
830	52	EMR_RESULTS="$(mktemp)"
831	26	EMR_SKIP_REASON=""
832
833	26	if ! aws sts get-caller-identity >/dev/null 2>&1; then
834	3	EMR_SKIP_REASON="No AWS credentials available (scan needs elasticmapreduce:ListReleaseLabels). Configure OIDC to enable."
835	3	echo " $EMR_SKIP_REASON"
836		else
837	46	EMR_VERSIONS="$(extract_emr_versions "gco/stacks/constants.py")"
838	23	if [ -z "$EMR_VERSIONS" ]; then
839	1	EMR_SKIP_REASON="Could not read the EMR Serverless release-label pin from gco/stacks/constants.py."
840	1	echo " $EMR_SKIP_REASON"
841		else
842	41	while read -r current_label; do
843	22	[ -z "$current_label" ] && continue
844		# current_label looks like "emr-7.13.0". Filter labels to ones that
845		# start with "emr-<major>." and take the latest by semver-ish sort.
846		# Skip preview/nightly tags (``-preview``, ``-beta``, ``-rc*``). The
847		# latest release label is what we compare against.
848	66	major="$(echo "$current_label" \| sed -E 's/^emr-([0-9]+)\..*/\1/')"
849	44	release_labels="$(aws emr list-release-labels \
850		--region us-east-1 \
851		--query 'ReleaseLabels[]' --output text 2>/dev/null)" \|\| release_labels=""
852
853	43	if [ -z "$release_labels" ] \|\| [ "$release_labels" = "None" ]; then
854	1	EMR_SKIP_REASON="EMR release-label lookup failed or returned an empty response."
855	1	echo " $EMR_SKIP_REASON"
856	1	break
857		fi
858
859	128	latest="$(echo "$release_labels" \
860		\| tr '\t' '\n' \
861		\| grep -E "^emr-${major}\.[0-9]+\.[0-9]+$" \
862		\| sort -V \| tail -1)" \|\| true
863
864		# Also check whether a newer major release line exists.
865	128	latest_any="$(echo "$release_labels" \
866		\| tr '\t' '\n' \
867		\| grep -E "^emr-[0-9]+\.[0-9]+\.[0-9]+$" \
868		\| sort -V \| tail -1)" \|\| true
869
870	21	if [ -z "$latest_any" ]; then
871	2	EMR_SKIP_REASON="EMR release-label response contained no parseable stable releases."
872	2	echo " $EMR_SKIP_REASON"
873	2	break
874		fi
875	38	if [ -n "$latest" ] && [ "$current_label" != "$latest" ]; then
876	2	echo " - emr-serverless: ${current_label} -> ${latest}"
877	2	echo "emr-serverless\|${current_label}\|${latest}" >> "$EMR_RESULTS"
878	17	elif [ "$current_label" != "$latest_any" ] \
879	2	&& [ "$(compare_semver "${current_label#emr-}" "${latest_any#emr-}")" = "newer" ]; then
880		# Same minor — no new release in our pinned major — but a new
881		# major exists.
882	1	echo " - emr-serverless: ${current_label} -> ${latest_any} (new major available)"
883	1	echo "emr-serverless\|${current_label}\|${latest_any}" >> "$EMR_RESULTS"
884		fi
885		done <<< "$EMR_VERSIONS"
886		fi
887		fi
888
889	78	EMR_COUNT="$(wc -l < "$EMR_RESULTS" 2>/dev/null \| tr -d ' ')"
890	26	[ -z "$EMR_COUNT" ] && EMR_COUNT=0
891
892		# ---------------------------------------------------------------------------
893		# Bedrock default model (best-effort — requires AWS credentials)
894		#
895		# Compares each configured Bedrock model default in cdk.json —
896		# context.bedrock.mission_default_model_id (Mission sampling),
897		# context.bedrock.capacity_advisor_default_model_id (the capacity
898		# advisor), context.bedrock.claude_code_default_model_id (the session
899		# model GCO Autopilot hands to Claude Code),
900		# context.bedrock.codex_default_model_id (the session model it hands to Codex),
901		# and context.bedrock.embedding_model_id (Mission memory's text-embedding
902		# model) — against the newest release in the SAME model family. The three
903		# generation keys compare against system-defined inference profiles
904		# (aws bedrock list-inference-profiles); the embedding key is a plain
905		# foundation model, so it compares against
906		# aws bedrock list-foundation-models --by-output-modality EMBEDDING.
907		# Every consumer resolves its key through gco.bedrock, so the scan and
908		# the runtime paths cannot silently diverge; the keys are independent
909		# knobs and each gets its own drift row.
910		#
911		# Same-family scoping (see bedrock_model_family) means we only flag a newer
912		# release of the same model line (e.g. a newer global Amazon Nova Lite) — never a
913		# different tier or provider, since switching those is a human decision,
914		# not drift. When a newer release is reported, update the flagged key in
915		# cdk.json; for the Mission key also re-capture the scaffold
916		# fixture with scripts/capture_scaffold_fixtures.py. For the embedding
917		# key, remember stored vectors are only comparable to vectors from the
918		# same model: adopting a newer embedding model means re-embedding or
919		# segregating existing Mission-memory data, not just bumping the pin.
920		#
921		# IAM actions: bedrock:ListInferenceProfiles and
922		# bedrock:ListFoundationModels. Pinned to us-east-1 (the advisor +
923		# Mission sampling + Mission memory default region) regardless of the
924		# workflow's configured region. Same credential preflight as the EKS
925		# add-on / Aurora / EMR checks.
926		# ---------------------------------------------------------------------------
927	26	echo ""
928	26	echo "=== Checking Bedrock default model ==="
929	26
930	52	BEDROCK_MODEL_RESULTS="$(mktemp)"
931	26	BEDROCK_MODEL_SKIP_REASON=""
932
933	26	if ! aws sts get-caller-identity >/dev/null 2>&1; then
934	3	BEDROCK_MODEL_SKIP_REASON="No AWS credentials available (scan needs bedrock:ListInferenceProfiles). Configure OIDC to enable."
935	3	echo " $BEDROCK_MODEL_SKIP_REASON"
936		else
937	115	for BEDROCK_MODEL_LEAF in mission_default_model_id capacity_advisor_default_model_id claude_code_default_model_id codex_default_model_id embedding_model_id; do
938	230	CURRENT_BEDROCK_MODEL="$(extract_default_bedrock_model cdk.json "$BEDROCK_MODEL_LEAF")"
939	115	if [ -z "$CURRENT_BEDROCK_MODEL" ]; then
940	5	BEDROCK_MODEL_SKIP_REASON="Could not read context.bedrock.${BEDROCK_MODEL_LEAF} from cdk.json."
941	5	echo " $BEDROCK_MODEL_SKIP_REASON"
942	5	continue
943		fi
944	110	if [ "$BEDROCK_MODEL_LEAF" = "embedding_model_id" ]; then
945		# Embedding defaults are foundation models, not inference profiles.
946	44	LATEST_BEDROCK_MODEL="$(get_latest_bedrock_embedding_model "$CURRENT_BEDROCK_MODEL" us-east-1)" \|\| LATEST_BEDROCK_MODEL=""
947		else
948	176	LATEST_BEDROCK_MODEL="$(get_latest_bedrock_model "$CURRENT_BEDROCK_MODEL" us-east-1)" \|\| LATEST_BEDROCK_MODEL=""
949		fi
950	110	if [ -z "$LATEST_BEDROCK_MODEL" ]; then
951	10	BEDROCK_MODEL_SKIP_REASON="Bedrock model lookup failed or returned no active release in the model family of context.bedrock.${BEDROCK_MODEL_LEAF}."
952	10	echo " $BEDROCK_MODEL_SKIP_REASON"
953	100	elif [ "$CURRENT_BEDROCK_MODEL" != "$LATEST_BEDROCK_MODEL" ] \
954	30	&& [ "$(compare_bedrock_model "$CURRENT_BEDROCK_MODEL" "$LATEST_BEDROCK_MODEL")" = "newer" ]; then
955	15	echo " - bedrock ${BEDROCK_MODEL_LEAF}: ${CURRENT_BEDROCK_MODEL} -> ${LATEST_BEDROCK_MODEL}"
956	15	echo "context.bedrock.${BEDROCK_MODEL_LEAF}\|${CURRENT_BEDROCK_MODEL}\|${LATEST_BEDROCK_MODEL}" >> "$BEDROCK_MODEL_RESULTS"
957		fi
958		done
959		# The vector store keeps its own embedding model at
960		# context.vector_store.embedding_model_id (independent of mission memory's
961		# bedrock.embedding_model_id by design). Same foundation-model drift check,
962		# same re-embed caveat: adopting a newer model means re-ingesting the corpus.
963		# The key is optional (the block ships with defaults), so absence is not a
964		# skip condition for the whole check.
965	46	VECTOR_STORE_MODEL="$(extract_default_bedrock_model cdk.json embedding_model_id vector_store)"
966	23	if [ -n "$VECTOR_STORE_MODEL" ]; then
967	44	LATEST_VECTOR_STORE_MODEL="$(get_latest_bedrock_embedding_model "$VECTOR_STORE_MODEL" us-east-1)" \|\| LATEST_VECTOR_STORE_MODEL=""
968	22	if [ -z "$LATEST_VECTOR_STORE_MODEL" ]; then
969	2	BEDROCK_MODEL_SKIP_REASON="Bedrock model lookup failed or returned no active release in the model family of context.vector_store.embedding_model_id."
970	2	echo " $BEDROCK_MODEL_SKIP_REASON"
971	20	elif [ "$VECTOR_STORE_MODEL" != "$LATEST_VECTOR_STORE_MODEL" ] \
972	6	&& [ "$(compare_bedrock_model "$VECTOR_STORE_MODEL" "$LATEST_VECTOR_STORE_MODEL")" = "newer" ]; then
973	3	echo " - vector_store embedding_model_id: ${VECTOR_STORE_MODEL} -> ${LATEST_VECTOR_STORE_MODEL}"
974	3	echo "context.vector_store.embedding_model_id\|${VECTOR_STORE_MODEL}\|${LATEST_VECTOR_STORE_MODEL}" >> "$BEDROCK_MODEL_RESULTS"
975		fi
976		fi
977		fi
978
979	78	BEDROCK_MODEL_COUNT="$(wc -l < "$BEDROCK_MODEL_RESULTS" 2>/dev/null \| tr -d ' ')"
980	26	[ -z "$BEDROCK_MODEL_COUNT" ] && BEDROCK_MODEL_COUNT=0
981
982
983		# ---------------------------------------------------------------------------
984		# Dockerfile.dev ARG pins
985		#
986		# Checks the tooling versions pinned in ``Dockerfile.dev`` (Node.js
987		# release, AWS CDK CLI, kubectl, AWS CLI v2, Docker CLI, Docker Buildx). These ARGs sit
988		# outside the main dependency surfaces above — Dependabot watches the
989		# ``FROM python:…`` base image but not the ARG pins — so drift here has
990		# historically gone undetected until someone rebuilt the image.
991		#
992		# Each pin has its own upstream:
993		#
994		# NODE_VERSION github://nodejs/Release → schedule.json (active LTS
995		# major) + nodejs.org/dist/index.json (newest release
996		# on that major)
997		# NPM_VERSION registry.npmjs.org/npm/latest
998		# CDK_VERSION registry.npmjs.org/aws-cdk/latest
999		# KUBECTL_VERSION https://dl.k8s.io/release/stable-<minor>.txt
1000		# (minor from cdk.json::kubernetes_version)
1001		# AWSCLI_VERSION github://aws/aws-cli/tags (v2.x.y semver, no GitHub Releases)
1002		# DOCKER_VERSION github://moby/moby/releases/latest (``docker-v<ver>``)
1003		# BUILDX_VERSION github://docker/buildx/releases/latest (v<ver>)
1004		# UV_VERSION github://astral-sh/uv/releases/latest (bare semver)
1005		#
1006		# All endpoints are public — no AWS credentials needed.
1007		# ---------------------------------------------------------------------------
1008	26	echo ""
1009	26	echo "=== Checking Dockerfile.dev ARG pins ==="
1010	26
1011	52	DOCKERFILE_RESULTS="$(mktemp)"
1012	26	DOCKERFILE_PIN_FILE="Dockerfile.dev"
1013
1014		check_dockerfile_pin() {
1015	192	local name="$1" current="$2" latest=""
1016	648	case "$name" in
1017		NODE_VERSION)
1018		# Two drift signals folded into one compare. First pick the
1019		# highest major with an active LTS window from the release
1020		# schedule (lts <= today AND (end missing or end > today)),
1021		# then resolve that major's newest release from the official
1022		# dist index — the same origin the Dockerfile downloads from.
1023		# A new LTS line and a new patch on the current line both
1024		# surface as ``newer``.
1025	24	local lts_major
1026	73	lts_major="$(curl -fsSL --max-time 15 \
1027		"https://raw.githubusercontent.com/nodejs/Release/main/schedule.json" 2>/dev/null \
1028		\| python3 -c '
1029		import sys, json, datetime
1030		try:
1031		data = json.load(sys.stdin)
1032		except Exception:
1033		sys.exit(0)
1034		today = datetime.date.today().isoformat()
1035		candidates = []
1036		for k, v in data.items():
1037		if not k.startswith("v") or "lts" not in v:
1038		continue
1039		if v["lts"] > today:
1040		continue
1041		if v.get("end", "9999-12-31") <= today:
1042		continue
1043		try:
1044		candidates.append(int(k[1:]))
1045		except ValueError:
1046		continue
1047		if candidates:
1048		print(max(candidates))
1049		' 2>/dev/null)" \|\| true
1050	24	if [ -z "$lts_major" ]; then
1051	1	mark_scan_incomplete "Node.js release-schedule lookup failed or returned no active LTS major."
1052	1	return
1053		fi
1054		# index.json is newest-first per line, so the first entry whose
1055		# version sits on the LTS major is that major's latest release.
1056	69	latest="$(curl -fsSL --max-time 15 \
1057		"https://nodejs.org/dist/index.json" 2>/dev/null \
1058		\| jq -r --arg prefix "v${lts_major}." \
1059		'[.[].version \| select(startswith($prefix))][0] // empty' 2>/dev/null)" \|\| true
1060		;;
1061		CDK_VERSION)
1062	73	latest="$(curl -fsSL --max-time 15 \
1063		"https://registry.npmjs.org/aws-cdk/latest" 2>/dev/null \
1064		\| jq -r '.version // empty' 2>/dev/null)" \|\| true
1065		;;
1066		NPM_VERSION)
1067		# ``npm`` is part of the dev container's pinned tooling — the
1068		# npm bundled inside the Node dist tarball is fixed per Node
1069		# release but lags npm's own line, so the Dockerfile installs a
1070		# specific ``npm@X.Y.Z`` to keep rebuilds reproducible (same
1071		# rationale as CDK_VERSION above). The canonical "latest" is the
1072		# ``latest`` dist-tag on npmjs.org, same source CDK uses.
1073	73	latest="$(curl -fsSL --max-time 15 \
1074		"https://registry.npmjs.org/npm/latest" 2>/dev/null \
1075		\| jq -r '.version // empty' 2>/dev/null)" \|\| true
1076		;;
1077		KUBECTL_VERSION)
1078		# Match the minor line already committed to cdk.json so the pin
1079		# and the EKS cluster stay within the ±1 minor skew policy.
1080	24	local k8s_minor
1081	48	k8s_minor="$(extract_k8s_version "cdk.json")"
1082	73	latest="$(curl -fsSL --max-time 15 \
1083		"https://dl.k8s.io/release/stable-${k8s_minor}.txt" 2>/dev/null \| tr -d '[:space:]')" \|\| true
1084		;;
1085		AWSCLI_VERSION)
1086		# aws/aws-cli doesn't publish GitHub Releases for v2; tags are the
1087		# canonical source. First page (per_page=20) is newest-first;
1088		# filter to 2.x.y semver and take the top match.
1089	73	latest="$(curl -fsSL --max-time 15 \
1090		"https://api.github.com/repos/aws/aws-cli/tags?per_page=20" 2>/dev/null \
1091		\| jq -r '[.[].name \| select(test("^2\\.[0-9]+\\.[0-9]+$"))][0] // empty' 2>/dev/null)" \|\| true
1092		;;
1093		DOCKER_VERSION)
1094		# moby/moby tags releases as ``docker-v<semver>``; strip the
1095		# prefix so compare_semver can handle the value.
1096	97	latest="$(curl -fsSL --max-time 15 \
1097		"https://api.github.com/repos/moby/moby/releases/latest" 2>/dev/null \
1098		\| jq -r '.tag_name // empty' 2>/dev/null \
1099		\| sed -E 's/^(docker-)?v//')" \|\| true
1100		;;
1101		BUILDX_VERSION)
1102		# docker/buildx publishes GitHub Releases tagged v<semver>
1103		# (e.g. v0.35.0). The release tag is the canonical source;
1104		# compare_semver strips the leading v on both sides. The
1105		# Dockerfile installs the plugin binary buildx-<tag>.linux-<arch>.
1106	73	latest="$(curl -fsSL --max-time 15 \
1107		"https://api.github.com/repos/docker/buildx/releases/latest" 2>/dev/null \
1108		\| jq -r '.tag_name // empty' 2>/dev/null)" \|\| true
1109		;;
1110		UV_VERSION)
1111		# astral-sh/uv publishes GitHub Releases tagged with a bare semver
1112		# (e.g. 0.12.1). The dev container ships uv/uvx for the `gco
1113		# autopilot` companion MCP servers; bump the two SHA256 ARGs in
1114		# lockstep from the per-artifact *.sha256 release files.
1115	73	latest="$(curl -fsSL --max-time 15 \
1116		"https://api.github.com/repos/astral-sh/uv/releases/latest" 2>/dev/null \
1117		\| jq -r '.tag_name // empty' 2>/dev/null)" \|\| true
1118		;;
1119		esac
1120		# extract_dockerfile_pins only emits the names above. Should its allowlist
1121		# ever grow without a matching arm here, ``latest`` stays empty and the
1122		# pin is reported as an incomplete lookup below, rather than skipped in
1123		# silence.
1124
1125	191	if [ -z "$latest" ]; then
1126	7	mark_scan_incomplete "Upstream version lookup failed for Dockerfile.dev pin ${name}."
1127	7	return
1128		fi
1129
1130		# Every pin is a semver, NODE_VERSION included. compare_semver strips
1131		# a leading ``v`` on both sides, matching the kubectl and buildx pins
1132		# that keep the prefix.
1133	184	local relation
1134	368	relation="$(compare_semver "$current" "$latest")"
1135
1136	184	if [ "$relation" = "newer" ]; then
1137	32	echo " - ${name}: ${current} -> ${latest}"
1138	32	echo "${name}\|${current}\|${latest}" >> "$DOCKERFILE_RESULTS"
1139		fi
1140		}
1141
1142	26	if [ -f "$DOCKERFILE_PIN_FILE" ]; then
1143	50	DOCKERFILE_PINS="$(extract_dockerfile_pins "$DOCKERFILE_PIN_FILE")"
1144	25	if [ -z "$DOCKERFILE_PINS" ]; then
1145	1	mark_scan_incomplete "Could not parse tooling pins from ${DOCKERFILE_PIN_FILE}."
1146		fi
1147	436	while IFS='\|' read -r pin_name pin_value; do
1148	194	[ -z "$pin_name" ] && continue
1149	192	check_dockerfile_pin "$pin_name" "$pin_value"
1150		done <<< "$DOCKERFILE_PINS"
1151		else
1152	1	mark_scan_incomplete "$DOCKERFILE_PIN_FILE is missing."
1153		fi
1154
1155	78	DOCKERFILE_COUNT="$(wc -l < "$DOCKERFILE_RESULTS" 2>/dev/null \| tr -d ' ')"
1156	26	[ -z "$DOCKERFILE_COUNT" ] && DOCKERFILE_COUNT=0
1157
1158		# ---------------------------------------------------------------------------
1159		# GCO Autopilot pins (agent CLI releases + companion MCP servers)
1160		#
1161		# ``gco autopilot`` (cli/autopilot.py) carries three dependency surfaces that
1162		# live in Python constants, invisible to Dependabot and to every sweep above:
1163		#
1164		# CLAUDE_CODE_VERSION exact @anthropic-ai/claude-code release installed
1165		# by the default engine on first use.
1166		# CODEX_VERSION exact @openai/codex release installed by the Codex
1167		# engine on first use.
1168		# COMPANION_MCP_SERVERS the npx/uvx-launched companion MCP servers wired
1169		# into every autopilot session. Nothing pins them
1170		# (they resolve at launch), so the risk isn't
1171		# staleness — it's disappearance: a package that is
1172		# unpublished, deprecated, or yanked breaks every
1173		# new session. Each is resolved on its registry and
1174		# reported when unhealthy. This is exactly how
1175		# mcp-server-fetch and mcp-server-calculator broke
1176		# before being pruned in 2026-08.
1177		#
1178		# Remediation for companion findings: replace or drop the server in
1179		# cli/autopilot.py and the "Recommended Companion MCP Servers" tables in
1180		# gco_mcp/README.md — tests/test_cli_autopilot.py fails the PR until the two
1181		# agree. All endpoints are public — no AWS credentials needed.
1182		# ---------------------------------------------------------------------------
1183	26	echo ""
1184	26	echo "=== Checking GCO Autopilot pins ==="
1185	26
1186	52	AUTOPILOT_RESULTS="$(mktemp)"
1187	26	AUTOPILOT_SKIP_REASON=""
1188	26	AUTOPILOT_SOURCE="cli/autopilot.py"
1189
1190	26	if [ ! -f "$AUTOPILOT_SOURCE" ]; then
1191	2	AUTOPILOT_SKIP_REASON="${AUTOPILOT_SOURCE} not found."
1192	2	echo " $AUTOPILOT_SKIP_REASON"
1193		else
1194		check_autopilot_npm_pin() {
1195	48	local constant_name="$1"
1196	48	local package_name="$2"
1197	48	local extractor="$3"
1198	48	local pin="" package_status="" latest="" verdict=""
1199	48	local package_url="https://www.npmjs.com/package/${package_name}"
1200
1201	96	pin="$("$extractor" "$AUTOPILOT_SOURCE")"
1202	48	if [ -z "$pin" ]; then
1203	2	AUTOPILOT_SKIP_REASON="${constant_name} not found in ${AUTOPILOT_SOURCE}."
1204	2	echo " $AUTOPILOT_SKIP_REASON"
1205	2	return
1206		fi
1207
1208	92	package_status="$(get_registry_package_status npm "$package_name")"
1209	46	if [ -z "$package_status" ]; then
1210	2	AUTOPILOT_SKIP_REASON="npm lookup for ${package_name} failed (network)."
1211	2	echo " $AUTOPILOT_SKIP_REASON"
1212	2	return
1213		fi
1214
1215	44	latest="${package_status#*\|}"
1216	44	case "$package_status" in
1217		ok\\|*)
1218	42	if [ -n "$latest" ] \
1219	84	&& [ "$(compare_semver "$pin" "$latest")" = "newer" ]; then
1220	8	echo " - ${constant_name}: ${pin} -> ${latest}"
1221	8	echo "${package_name} (${constant_name})\|${pin}\|${latest}\|${package_url}" >> "$AUTOPILOT_RESULTS"
1222		fi
1223		;;
1224		*)
1225	2	verdict="${package_status%%\|*}"
1226	2	echo " - ${package_name}: ${verdict}"
1227	2	echo "${package_name} (${constant_name})\|${pin}\|${verdict}\|${package_url}" >> "$AUTOPILOT_RESULTS"
1228		;;
1229		esac
1230		}
1231
1232	24	check_autopilot_npm_pin \
1233		"CLAUDE_CODE_VERSION" "@anthropic-ai/claude-code" extract_claude_code_pin
1234	24	check_autopilot_npm_pin \
1235		"CODEX_VERSION" "@openai/codex" extract_codex_pin
1236
1237		# Companion MCP server liveness. Missing/deprecated/yanked is drift; a
1238		# network failure marks the scan incomplete rather than inventing findings.
1239	180	while IFS='\|' read -r companion_name companion_registry companion_package; do
1240	66	[ -z "$companion_name" ] && continue
1241	132	companion_status="$(get_registry_package_status "$companion_registry" "$companion_package")"
1242	66	if [ -z "$companion_status" ]; then
1243	4	if [ -z "$AUTOPILOT_SKIP_REASON" ]; then
1244	1	AUTOPILOT_SKIP_REASON="Registry lookup failed for ${companion_package} (${companion_registry}); companion liveness incomplete."
1245	1	echo " $AUTOPILOT_SKIP_REASON"
1246		fi
1247	4	continue
1248		fi
1249	62	case "$companion_status" in
1250		ok\\|*)
1251		;;
1252		*)
1253	4	companion_verdict="${companion_status%%\|*}"
1254	4	companion_detail="${companion_status#*\|}"
1255	6	[ -n "$companion_detail" ] && companion_verdict="${companion_verdict}: ${companion_detail}"
1256	4	if [ "$companion_registry" = "npm" ]; then
1257	2	companion_url="https://www.npmjs.com/package/${companion_package}"
1258		else
1259	2	companion_url="https://pypi.org/project/${companion_package}/"
1260		fi
1261	4	echo " - companion ${companion_name}: ${companion_verdict}"
1262	4	echo "companion ${companion_name} (${companion_registry}: ${companion_package})\|launch-time (unpinned)\|${companion_verdict}\|${companion_url}" >> "$AUTOPILOT_RESULTS"
1263		;;
1264		esac
1265		done < <(extract_companion_mcp_packages "$AUTOPILOT_SOURCE")
1266	24	fi
1267
1268	78	AUTOPILOT_COUNT="$(wc -l < "$AUTOPILOT_RESULTS" 2>/dev/null \| tr -d ' ')"
1269	26	[ -z "$AUTOPILOT_COUNT" ] && AUTOPILOT_COUNT=0
1270
1271		# ---------------------------------------------------------------------------
1272		# Pre-commit hook revisions
1273		#
1274		# Compares the ``rev:`` pinned for each ``repo:`` block in
1275		# ``.pre-commit-config.yaml`` against the latest semver-shaped tag
1276		# published by the upstream Git host. This catches drift Dependabot
1277		# can't see — pre-commit pins live in YAML, not in the package
1278		# ecosystems Dependabot monitors — and matters in practice because
1279		# stale hook pins quietly miss new lint rules and bug fixes.
1280		#
1281		# Each hook's repo URL is resolved to a tag list via the GitHub API
1282		# (the only host we use today). Full SHA-1/SHA-256 object ids are accepted as
1283		# immutable exemptions. Other unsupported refs (branches, floating labels,
1284		# prereleases) mark the scan incomplete rather than silently disappearing.
1285		# Calls are unauthenticated; we make one request per hook, which is well below
1286		# the 60 req/h public limit.
1287		# ---------------------------------------------------------------------------
1288	26	echo ""
1289	26	echo "=== Checking pre-commit hook revisions ==="
1290	26
1291	52	PRECOMMIT_RESULTS="$(mktemp)"
1292	26	PRECOMMIT_CONFIG=".pre-commit-config.yaml"
1293
1294	26	if [ -f "$PRECOMMIT_CONFIG" ]; then
1295	50	PRECOMMIT_HOOKS="$(extract_precommit_hooks "$PRECOMMIT_CONFIG")"
1296	25	if [ -z "$PRECOMMIT_HOOKS" ]; then
1297	1	mark_scan_incomplete "Could not parse hook pins from ${PRECOMMIT_CONFIG}."
1298		fi
1299	162	while IFS='\|' read -r repo current_rev; do
1300	57	[ -z "$repo" ] && continue
1301	55	[ -z "$current_rev" ] && continue
1302		# Complete Git object ids are immutable and intentionally have no release
1303		# drift lookup. Every other non-semver ref may move or cannot be compared
1304		# safely, so it makes this scan incomplete instead of receiving a blanket
1305		# "SHA" exemption.
1306	55	if is_full_git_commit_sha "$current_rev"; then
1307	1	continue
1308		fi
1309	54	if ! [[ "$current_rev" =~ ^v?[0-9]+\.[0-9]+(\.[0-9]+)?$ ]]; then
1310	1	mark_scan_incomplete "Unsupported mutable or non-semver pre-commit rev '${current_rev}' for ${repo}."
1311	1	continue
1312		fi
1313
1314	106	latest_rev="$(get_latest_precommit_hook_release "$repo")"
1315	53	if [ -z "$latest_rev" ]; then
1316	3	mark_scan_incomplete "Pre-commit tag lookup failed for ${repo}."
1317	3	continue
1318		fi
1319
1320		# Strip ``v`` so compare_semver ranks ``v0.22.1`` vs ``v0.22.2``
1321		# (and the rare unprefixed ``1.38.0`` from yamllint historically)
1322		# consistently. We keep the original ``current_rev`` / ``latest_rev``
1323		# strings in the report so the operator copy-pastes the exact
1324		# value pre-commit expects.
1325	50	if [ "$current_rev" != "$latest_rev" ] \
1326	24	&& [ "$(compare_semver "$current_rev" "$latest_rev")" = "newer" ]; then
1327	12	echo " - ${repo}: ${current_rev} -> ${latest_rev}"
1328	12	echo "${repo}\|${current_rev}\|${latest_rev}" >> "$PRECOMMIT_RESULTS"
1329		fi
1330		done <<< "$PRECOMMIT_HOOKS"
1331		else
1332	1	mark_scan_incomplete "$PRECOMMIT_CONFIG is missing."
1333		fi
1334
1335	78	PRECOMMIT_COUNT="$(wc -l < "$PRECOMMIT_RESULTS" 2>/dev/null \| tr -d ' ')"
1336	26	[ -z "$PRECOMMIT_COUNT" ] && PRECOMMIT_COUNT=0
1337
1338		# ---------------------------------------------------------------------------
1339		# CDK enum constants
1340		#
1341		# Compares the CDK-enum-name constants pinned in
1342		# ``gco/stacks/constants.py`` against the highest enum members exposed
1343		# by the installed ``aws-cdk-lib``. This catches the case where
1344		# aws-cdk-lib already supports a newer enum (because we bumped the
1345		# library, or simply because the latest published release added one)
1346		# but ``constants.py`` still pins an older one.
1347		#
1348		# Two enums are tracked today:
1349		#
1350		# - ``LAMBDA_PYTHON_RUNTIME`` → ``aws_cdk.aws_lambda.Runtime.PYTHON_X_Y``
1351		# - ``LAMBDA_NODEJS_RUNTIME`` → ``aws_cdk.aws_lambda.Runtime.NODEJS_<major>_X``
1352		#
1353		# The Aurora engine deliberately is NOT an enum: constants.py pins a plain
1354		# version string applied through ``AuroraPostgresEngineVersion.of()``, and
1355		# the "Aurora PostgreSQL engine" section validates it against the live RDS
1356		# API — the authoritative source — instead of the CDK library's catalog.
1357		#
1358		# The deps-scan workflow installs the latest ``aws-cdk-lib`` for this
1359		# section; locally the helper just reflects whatever's already on the
1360		# active interpreter. If aws-cdk-lib isn't importable we skip with a
1361		# one-line note (mirrors the AWS-creds skip pattern used elsewhere).
1362		# ---------------------------------------------------------------------------
1363	26	echo ""
1364	26	echo "=== Checking CDK enum constants ==="
1365	26
1366	52	CDK_ENUM_RESULTS="$(mktemp)"
1367	26	CDK_ENUM_SKIP_REASON=""
1368
1369	26	if ! python3 -c "import aws_cdk" 2>/dev/null; then
1370	2	CDK_ENUM_SKIP_REASON="aws-cdk-lib not importable. Install with 'pip install aws-cdk-lib' to enable."
1371	2	echo " $CDK_ENUM_SKIP_REASON"
1372		else
1373		# Lambda Python runtime enum
1374	48	LAMBDA_RT_CURRENT="$(extract_constant_value LAMBDA_PYTHON_RUNTIME)"
1375	48	LAMBDA_RT_LATEST="$(get_latest_lambda_python_runtime)"
1376	47	if [ -z "$LAMBDA_RT_CURRENT" ] \|\| [ -z "$LAMBDA_RT_LATEST" ]; then
1377	2	mark_scan_incomplete "Could not parse the current or latest Lambda Python runtime enum."
1378	22	elif [ "$LAMBDA_RT_CURRENT" != "$LAMBDA_RT_LATEST" ]; then
1379		# Convert PYTHON_3_14 → 3.14 so compare_semver can rank them.
1380	9	cur_v="$(echo "$LAMBDA_RT_CURRENT" \| sed -E 's/^PYTHON_([0-9]+)_([0-9]+)$/\1.\2/')"
1381	9	lat_v="$(echo "$LAMBDA_RT_LATEST" \| sed -E 's/^PYTHON_([0-9]+)_([0-9]+)$/\1.\2/')"
1382	6	if [ "$(compare_semver "$cur_v" "$lat_v")" = "newer" ]; then
1383	3	echo " - LAMBDA_PYTHON_RUNTIME: ${LAMBDA_RT_CURRENT} -> ${LAMBDA_RT_LATEST}"
1384	3	echo "LAMBDA_PYTHON_RUNTIME\|aws_lambda.Runtime\|${LAMBDA_RT_CURRENT}\|${LAMBDA_RT_LATEST}" >> "$CDK_ENUM_RESULTS"
1385		fi
1386		fi
1387
1388		# Lambda Node.js runtime enum
1389	48	LAMBDA_NODE_RT_CURRENT="$(extract_constant_value LAMBDA_NODEJS_RUNTIME)"
1390	48	LAMBDA_NODE_RT_LATEST="$(get_latest_lambda_nodejs_runtime)"
1391	47	if [ -z "$LAMBDA_NODE_RT_CURRENT" ] \|\| [ -z "$LAMBDA_NODE_RT_LATEST" ]; then
1392	2	mark_scan_incomplete "Could not parse the current or latest Lambda Node.js runtime enum."
1393	22	elif [ "$LAMBDA_NODE_RT_CURRENT" != "$LAMBDA_NODE_RT_LATEST" ]; then
1394	3	cur_major="${LAMBDA_NODE_RT_CURRENT#NODEJS_}"
1395	3	cur_major="${cur_major%_X}"
1396	3	lat_major="${LAMBDA_NODE_RT_LATEST#NODEJS_}"
1397	3	lat_major="${lat_major%_X}"
1398	6	if [[ "$cur_major" =~ ^[0-9]+$ ]] && [[ "$lat_major" =~ ^[0-9]+$ ]] \
1399	3	&& [ "$lat_major" -gt "$cur_major" ]; then
1400	3	echo " - LAMBDA_NODEJS_RUNTIME: ${LAMBDA_NODE_RT_CURRENT} -> ${LAMBDA_NODE_RT_LATEST}"
1401	3	echo "LAMBDA_NODEJS_RUNTIME\|aws_lambda.Runtime\|${LAMBDA_NODE_RT_CURRENT}\|${LAMBDA_NODE_RT_LATEST}" >> "$CDK_ENUM_RESULTS"
1402		fi
1403		fi
1404
1405		fi
1406
1407	78	CDK_ENUM_COUNT="$(wc -l < "$CDK_ENUM_RESULTS" 2>/dev/null \| tr -d ' ')"
1408	26	[ -z "$CDK_ENUM_COUNT" ] && CDK_ENUM_COUNT=0
1409
1410		# ---------------------------------------------------------------------------
1411		# Python release
1412		#
1413		# Compares the Lambda Python runtime constant (which encodes the major
1414		# Python version we standardise on across every Lambda in the project)
1415		# against the latest stable Python release on endoflife.date.
1416		#
1417		# This is informational drift — Lambda may not ship support for a brand-
1418		# new Python release for several months — but the signal is useful so
1419		# the operator knows when to start planning a runtime bump. It also
1420		# complements the CDK-enum check above: that check answers "what does
1421		# aws-cdk-lib expose?", this one answers "what has python.org actually
1422		# shipped?".
1423		# ---------------------------------------------------------------------------
1424	26	echo ""
1425	26	echo "=== Checking Python release ==="
1426	26
1427	52	PYTHON_RELEASE_RESULTS="$(mktemp)"
1428	26	PYTHON_RELEASE_SKIP_REASON=""
1429
1430		# Re-read in case the CDK section was skipped and never set the var.
1431	29	LAMBDA_RT_CURRENT="${LAMBDA_RT_CURRENT:-$(extract_constant_value LAMBDA_PYTHON_RUNTIME)}"
1432	52	LATEST_PYTHON="$(get_latest_python_release)"
1433
1434	26	if [ -z "$LATEST_PYTHON" ]; then
1435	2	PYTHON_RELEASE_SKIP_REASON="endoflife.date query failed (network or schema change)."
1436	2	echo " $PYTHON_RELEASE_SKIP_REASON"
1437	24	elif [ -z "$LAMBDA_RT_CURRENT" ]; then
1438	1	PYTHON_RELEASE_SKIP_REASON="Could not parse LAMBDA_PYTHON_RUNTIME for the Python release comparison."
1439	1	echo " $PYTHON_RELEASE_SKIP_REASON"
1440		else
1441	69	cur_v="$(echo "$LAMBDA_RT_CURRENT" \| sed -E 's/^PYTHON_([0-9]+)_([0-9]+)$/\1.\2/')"
1442	23	if [ "$cur_v" != "$LATEST_PYTHON" ] \
1443	10	&& [ "$(compare_semver "$cur_v" "$LATEST_PYTHON")" = "newer" ]; then
1444	4	echo " - python (LAMBDA_PYTHON_RUNTIME): ${cur_v} -> ${LATEST_PYTHON}"
1445	4	echo "python\|${cur_v}\|${LATEST_PYTHON}" >> "$PYTHON_RELEASE_RESULTS"
1446		fi
1447		fi
1448
1449	78	PYTHON_RELEASE_COUNT="$(wc -l < "$PYTHON_RELEASE_RESULTS" 2>/dev/null \| tr -d ' ')"
1450	26	[ -z "$PYTHON_RELEASE_COUNT" ] && PYTHON_RELEASE_COUNT=0
1451
1452		# ---------------------------------------------------------------------------
1453		# Ruby release
1454		#
1455		# Ruby is a CI-only toolchain: bashcov (see the Gemfile) measures which lines
1456		# of each shell script the BATS suite executes, and the unit:bats:shell job
1457		# gets its interpreter from .ruby-version via ruby/setup-ruby. Dependabot
1458		# watches the gems in Gemfile.lock but has nothing to say about the
1459		# interpreter series, so — exactly like .python-version — the pin is compared
1460		# against the newest supported series here. Informational, not a failure: a new
1461		# Ruby series is a deliberate move, not a security patch.
1462		# ---------------------------------------------------------------------------
1463	26	echo ""
1464	26	echo "=== Checking Ruby release ==="
1465	26
1466	52	RUBY_RELEASE_RESULTS="$(mktemp)"
1467	26	RUBY_RELEASE_SKIP_REASON=""
1468
1469	52	RUBY_PIN_CURRENT="$(read_ruby_version_pin .ruby-version)"
1470	52	LATEST_RUBY="$(get_latest_ruby_release)"
1471
1472	26	if [ -z "$LATEST_RUBY" ]; then
1473	2	RUBY_RELEASE_SKIP_REASON="endoflife.date query failed (network or schema change)."
1474	2	echo " $RUBY_RELEASE_SKIP_REASON"
1475	24	elif [ -z "$RUBY_PIN_CURRENT" ]; then
1476	1	RUBY_RELEASE_SKIP_REASON="Could not parse .ruby-version for the Ruby release comparison."
1477	1	echo " $RUBY_RELEASE_SKIP_REASON"
1478		else
1479	23	if [ "$RUBY_PIN_CURRENT" != "$LATEST_RUBY" ] \
1480	44	&& [ "$(compare_semver "$RUBY_PIN_CURRENT" "$LATEST_RUBY")" = "newer" ]; then
1481	4	echo " - ruby (.ruby-version): ${RUBY_PIN_CURRENT} -> ${LATEST_RUBY}"
1482	4	echo "ruby\|${RUBY_PIN_CURRENT}\|${LATEST_RUBY}" >> "$RUBY_RELEASE_RESULTS"
1483		else
1484	19	echo " .ruby-version pins ${RUBY_PIN_CURRENT}; newest supported series is ${LATEST_RUBY}."
1485		fi
1486		fi
1487
1488	78	RUBY_RELEASE_COUNT="$(wc -l < "$RUBY_RELEASE_RESULTS" 2>/dev/null \| tr -d ' ')"
1489	26	[ -z "$RUBY_RELEASE_COUNT" ] && RUBY_RELEASE_COUNT=0
1490
1491		# ---------------------------------------------------------------------------
1492		# Runner images
1493		#
1494		# `runs-on: ubuntu-latest` is not a version pin, so Dependabot has nothing to
1495		# bump and the platform underneath every job changes only when GitHub moves the
1496		# label. Two opposite mistakes are possible: staying on an explicitly pinned
1497		# image long after a newer one is generally available (and eventually on one
1498		# upstream has marked deprecated, which is a removal notice), or chasing an
1499		# image that is still in preview.
1500		#
1501		# check_runner_images.py reports those separately: `--format rows` is drift to
1502		# act on (newer GA, or deprecated), `--format notes` is context (a newer image
1503		# exists but is preview, so the current pin is deliberate). It exits 2 without
1504		# printing anything when the upstream catalog cannot be read, which is treated
1505		# as a skip here rather than as an all-clear.
1506		# ---------------------------------------------------------------------------
1507	26	echo ""
1508	26	echo "=== Checking runner images ==="
1509	26
1510	52	RUNNER_IMAGE_RESULTS="$(mktemp)"
1511	52	RUNNER_IMAGE_NOTES="$(mktemp)"
1512	26	RUNNER_IMAGE_SKIP_REASON=""
1513
1514	26	if python3 .github/scripts/check_runner_images.py --format rows > "$RUNNER_IMAGE_RESULTS" 2>/dev/null; then
1515	24	python3 .github/scripts/check_runner_images.py --format notes > "$RUNNER_IMAGE_NOTES" 2>/dev/null \|\| true
1516	50	while IFS='\|' read -r label current recommended; do
1517	1	[ -z "$label" ] && continue
1518	1	echo " - runner ${label}: ${current} -> ${recommended}"
1519		done < "$RUNNER_IMAGE_RESULTS"
1520	96	while IFS='\|' read -r label current recommended; do
1521	24	[ -z "$label" ] && continue
1522	24	echo " ${label} pins ${current}; ${recommended} exists but is still in preview."
1523		done < "$RUNNER_IMAGE_NOTES"
1524	24	if [ ! -s "$RUNNER_IMAGE_RESULTS" ]; then
1525	23	echo " every runner label in use is the newest generally-available image."
1526		fi
1527		else
1528	2	RUNNER_IMAGE_SKIP_REASON="Could not read the actions/runner-images catalog (network or upstream README change)."
1529	2	echo " $RUNNER_IMAGE_SKIP_REASON"
1530	2	: > "$RUNNER_IMAGE_RESULTS"
1531		fi
1532
1533	78	RUNNER_IMAGE_COUNT="$(wc -l < "$RUNNER_IMAGE_RESULTS" 2>/dev/null \| tr -d ' ')"
1534	26	[ -z "$RUNNER_IMAGE_COUNT" ] && RUNNER_IMAGE_COUNT=0
1535
1536		# ---------------------------------------------------------------------------
1537		# CI tooling pins (public endpoints — no AWS creds)
1538		#
1539		# The workflows install their own pinned tooling — Trivy (cve-scan.yml /
1540		# security.yml), actionlint (lint.yml), Helm + kubectl (deps-scan.yml), and
1541		# kubeconform, Calico, and Metrics Server (integration-tests.yml) — from plain
1542		# ``*_VERSION`` env strings. The integration workflow also pins kind + its node
1543		# image on the ``helm/kind-action`` step. None are ``uses:`` refs or Dockerfile
1544		# ``FROM`` lines, so Dependabot never sees them. Compare each against upstream.
1545		# ---------------------------------------------------------------------------
1546	26	echo ""
1547	26	echo "=== Checking CI tooling pins ==="
1548	26
1549	52	CI_TOOLING_RESULTS="$(mktemp)"
1550		# The kind-action lockstep check below files its finding under Version
1551		# Consistency, so that section's results file has to exist already; it is
1552		# created here, once, and the consistency section appends to it.
1553	52	CONSISTENCY_RESULTS="$(mktemp)"
1554
1555		# check_github_tool <display-name> <current-pin> <owner/repo> <ref-url>
1556		# Records drift when the pinned semver is behind the latest GitHub Release.
1557		check_github_tool() {
1558	182	local name="$1" current="$2" repo="$3" url="$4" latest=""
1559	182	if [ -z "$current" ]; then
1560	7	mark_scan_incomplete "Could not parse the committed version pin for ${name}."
1561	7	return 0
1562		fi
1563	350	latest="$(get_latest_github_release_tag "$repo")"
1564	175	if [ -z "$latest" ]; then
1565	7	mark_scan_incomplete "GitHub release lookup failed for ${name} (${repo})."
1566	7	return 0
1567		fi
1568	168	if [ "$current" != "$latest" ] \
1569	70	&& [ "$(compare_semver "$current" "$latest")" = "newer" ]; then
1570	32	echo " - ${name}: ${current} -> ${latest}"
1571	32	echo "${name}\|${current}\|${latest}\|${url}" >> "$CI_TOOLING_RESULTS"
1572		fi
1573		}
1574
1575		# Trivy (aquasecurity/trivy) — the version-input default of the
1576		# install-trivy composite action, the single pin every caller inherits.
1577	78	TRIVY_PIN="$(extract_install_trivy_pin .github/actions/install-trivy/action.yml \| head -1)"
1578	26	check_github_tool "Trivy (install-trivy action default)" "$TRIVY_PIN" "aquasecurity/trivy" \
1579		"https://github.com/aquasecurity/trivy/releases"
1580
1581		# actionlint (rhysd/actionlint) — lint.yml downloads this release archive.
1582	78	ACTIONLINT_PIN="$(extract_workflow_env_pin ACTIONLINT_VERSION \| head -1)"
1583	26	check_github_tool "actionlint (ACTIONLINT_VERSION)" "$ACTIONLINT_PIN" "rhysd/actionlint" \
1584		"https://github.com/rhysd/actionlint/releases"
1585
1586		# Helm (helm/helm) — the authenticated RUN-line pin in
1587		# lambda/helm-installer/Dockerfile, the single source every CI job derives
1588		# its HELM_VERSION/HELM_SHA256 from at runtime.
1589	104	HELM_PIN="$(extract_helm_installer_pins lambda/helm-installer/Dockerfile \| awk -F'\|' '$1=="HELM_VERSION"{print $2}' \| head -1)"
1590	26	check_github_tool "Helm (helm-installer Dockerfile)" "$HELM_PIN" "helm/helm" \
1591		"https://github.com/helm/helm/releases"
1592
1593		# kubeconform (yannh/kubeconform) — KUBECONFORM_VERSION the
1594		# integration:k8s:manifest-schema job installs to schema-validate the K8s
1595		# manifests. Plain env pin Dependabot doesn't watch; a stale kubeconform
1596		# silently validates against outdated Kubernetes schemas.
1597	78	KUBECONFORM_PIN="$(extract_workflow_env_pin KUBECONFORM_VERSION \| head -1)"
1598	26	check_github_tool "kubeconform (KUBECONFORM_VERSION)" "$KUBECONFORM_PIN" "yannh/kubeconform" \
1599		"https://github.com/yannh/kubeconform/releases"
1600
1601		# Metrics Server (kubernetes-sigs/metrics-server) — kind installs this pin so
1602		# the inference proxy HPA must reach ScalingActive, mirroring the EKS managed
1603		# add-on contract used in production.
1604	78	METRICS_SERVER_PIN="$(extract_workflow_env_pin METRICS_SERVER_VERSION \| head -1)"
1605	26	check_github_tool \
1606		"Metrics Server (METRICS_SERVER_VERSION)" \
1607		"$METRICS_SERVER_PIN" \
1608		"kubernetes-sigs/metrics-server" \
1609		"https://github.com/kubernetes-sigs/metrics-server/releases"
1610	26
1611		# Calico (projectcalico/calico) — kind installs the authenticated release
1612		# manifest so NetworkPolicy behavior is exercised by the E2E job.
1613	78	CALICO_PIN="$(extract_workflow_env_pin CALICO_VERSION \| head -1)"
1614	26	check_github_tool "Calico (CALICO_VERSION)" "$CALICO_PIN" "projectcalico/calico" \
1615		"https://github.com/projectcalico/calico/releases"
1616
1617		# kind (kubernetes-sigs/kind) — the kind binary on the kind-action step.
1618		# Both kind-action steps (cluster-e2e and examples-smoke) must pin the same
1619		# kind binary + node image; extract_kind_pins de-duplicates identical pins,
1620		# so >1 value per key means the two jobs drifted apart.
1621	52	for kind_key in kind kind-node; do
1622	156	kind_vals="$(extract_kind_pins .github/workflows/integration-tests.yml \
1623		\| awk -F'\|' -v k="$kind_key" '$1==k{print $2}')"
1624	208	kind_distinct="$(printf '%s\n' "$kind_vals" \| sed '/^$/d' \| grep -c .)"
1625	52	if [ "$kind_distinct" -gt 1 ]; then
1626	8	kind_list="$(printf '%s\n' "$kind_vals" \| sed '/^$/d' \| paste -sd',' -)"
1627	2	echo " - ${kind_key} pins disagree across kind-action steps: ${kind_list}"
1628	2	echo "${kind_key} (across kind-action steps)\|${kind_list}" >> "$CONSISTENCY_RESULTS"
1629		fi
1630		done
1631	104	KIND_PIN="$(extract_kind_pins .github/workflows/integration-tests.yml \| awk -F'\|' '$1=="kind"{print $2}' \| head -1)"
1632	26	check_github_tool "kind" "$KIND_PIN" "kubernetes-sigs/kind" \
1633		"https://github.com/kubernetes-sigs/kind/releases"
1634
1635		# kubectl — the authenticated RUN-line pin in lambda/helm-installer/
1636		# Dockerfile (the single source the CI jobs derive from); compared against
1637		# the stable release for its own minor line (dl.k8s.io), the same source
1638		# the Dockerfile.dev kubectl pin uses.
1639	104	KUBECTL_WF_PIN="$(extract_helm_installer_pins lambda/helm-installer/Dockerfile \| awk -F'\|' '$1=="KUBECTL_VERSION"{print $2}' \| head -1)"
1640	26	if [ -n "$KUBECTL_WF_PIN" ]; then
1641	75	kubectl_minor="$(echo "${KUBECTL_WF_PIN#v}" \| cut -d. -f1-2)"
1642	75	if ! kubectl_latest="$(curl -fsSL --max-time 15 \
1643		"https://dl.k8s.io/release/stable-${kubectl_minor}.txt" 2>/dev/null \| tr -d '[:space:]')" \
1644	24	\|\| [ -z "$kubectl_latest" ]; then
1645	1	mark_scan_incomplete "kubectl stable-version lookup failed for minor ${kubectl_minor}."
1646	24	elif [ "$KUBECTL_WF_PIN" != "$kubectl_latest" ] \
1647	10	&& [ "$(compare_semver "$KUBECTL_WF_PIN" "$kubectl_latest")" = "newer" ]; then
1648	5	echo " - kubectl (helm-installer Dockerfile): ${KUBECTL_WF_PIN} -> ${kubectl_latest}"
1649	5	echo "kubectl (helm-installer Dockerfile)\|${KUBECTL_WF_PIN}\|${kubectl_latest}\|https://kubernetes.io/releases/" >> "$CI_TOOLING_RESULTS"
1650		fi
1651		else
1652	1	mark_scan_incomplete "Could not parse the kubectl pin from lambda/helm-installer/Dockerfile."
1653		fi
1654
1655		# kind node image (kindest/node) — report a newer PATCH within the pinned K8s
1656		# minor only. Jumping minors is governed by the kind release, not free drift,
1657		# so scoping to the same minor avoids false "upgrade" noise.
1658	104	KIND_NODE_PIN="$(extract_kind_pins .github/workflows/integration-tests.yml \| awk -F'\|' '$1=="kind-node"{print $2}' \| head -1)"
1659	26	if [ -n "$KIND_NODE_PIN" ]; then
1660	25	node_tag="${KIND_NODE_PIN##*:}"
1661	75	node_minor="$(echo "${node_tag#v}" \| cut -d. -f1-2)"
1662	172	if ! node_latest="$(skopeo list-tags "docker://docker.io/kindest/node" 2>/dev/null \
1663		\| jq -r '.Tags[]' 2>/dev/null \
1664		\| grep -E "^v?${node_minor}\.[0-9]+$" \
1665		\| sort -V \| tail -1)" \|\| [ -z "$node_latest" ]; then
1666	3	mark_scan_incomplete "Container registry lookup failed for kindest/node minor ${node_minor}."
1667	22	elif [ "$node_tag" != "$node_latest" ] \
1668	8	&& [ "$(compare_semver "$node_tag" "$node_latest")" = "newer" ]; then
1669	4	echo " - kind node image (kindest/node): ${node_tag} -> ${node_latest}"
1670	4	echo "kind node image (kindest/node)\|${node_tag}\|${node_latest}\|https://hub.docker.com/r/kindest/node/tags" >> "$CI_TOOLING_RESULTS"
1671		fi
1672		else
1673	1	mark_scan_incomplete "Could not parse the kind node-image pin from integration-tests.yml."
1674		fi
1675
1676	78	CI_TOOLING_COUNT="$(wc -l < "$CI_TOOLING_RESULTS" 2>/dev/null \| tr -d ' ')"
1677	26	[ -z "$CI_TOOLING_COUNT" ] && CI_TOOLING_COUNT=0
1678
1679		# ---------------------------------------------------------------------------
1680		# Version consistency (no network)
1681		#
1682		# Some versions are pinned in more than one place and must move together.
1683		# The other sections answer "is this pin behind upstream?"; this one answers
1684		# "do the copies of this pin agree with each other?" — a class of drift that
1685		# otherwise only surfaces when a formatter/linter behaves differently in CI
1686		# than it does locally.
1687		#
1688		# - ruff: pyproject (dev install) vs the pre-commit hook vs the prebuilt-
1689		# binary ruff-action step in lint.yml.
1690		# - python-version across the workflows vs the project's canonical Python
1691		# (the LAMBDA_PYTHON_RUNTIME the Lambdas ship on).
1692		# - Node major across LAMBDA_NODEJS_RUNTIME, .nvmrc, every package engine,
1693		# and Dockerfile.dev; npm across every packageManager and Dockerfile.dev.
1694		# - AWS CDK CLI across the locked root npm graph and Dockerfile.dev.
1695		# - every repository-owned package.json has a lockfile, exact direct pins,
1696		# and a matching npm entry in Dependabot.
1697		# - the same tool env pin (HELM_VERSION/KUBECTL_VERSION/CALICO_*)
1698		# resolving to different values in different workflow files.
1699		# - every [build-system] requires entry in pyproject.toml is an exact
1700		# ``==`` pin (the drift itself reports through the Python surface).
1701		# - every per-Lambda requirements.txt pin agrees with the version the
1702		# repository resolves centrally (pyproject, then the lock for
1703		# transitives) — the copies that ship to production.
1704		# - no digest-pinned image carries two different digests under one tag,
1705		# which means an upstream re-push was only half applied.
1706		# ---------------------------------------------------------------------------
1707	26	echo ""
1708	26	echo "=== Checking version consistency ==="
1709	26
1710	52	RUFF_PINS="$(extract_ruff_pins pyproject.toml .pre-commit-config.yaml .github/workflows/lint.yml)"
1711	26	if [ -n "$RUFF_PINS" ]; then
1712	125	ruff_distinct="$(echo "$RUFF_PINS" \| cut -d'\|' -f2 \| sort -u \| grep -c .)"
1713	25	if [ "$ruff_distinct" -gt 1 ]; then
1714	4	detail="$(echo "$RUFF_PINS" \| awk -F'\|' '{printf "%s=%s ", $1, $2}' \| sed 's/ *$//')"
1715	1	echo " - ruff pins disagree: $detail"
1716	1	echo "ruff (pyproject / pre-commit / lint action)\|${detail}" >> "$CONSISTENCY_RESULTS"
1717		fi
1718		fi
1719
1720	78	CANON_PY="$(echo "${LAMBDA_RT_CURRENT:-}" \| sed -E 's/^PYTHON_([0-9]+)_([0-9]+)$/\1.\2/')"
1721	29	[ -z "$CANON_PY" ] && CANON_PY="$(extract_constant_value LAMBDA_PYTHON_RUNTIME \| sed -E 's/^PYTHON_([0-9]+)_([0-9]+)$/\1.\2/')"
1722	78	PY_PINS_UNIQUE="$(extract_python_version_pins "$WORKFLOWS_DIR" .python-version \| sort -u)"
1723	26	if [ -n "$PY_PINS_UNIQUE" ]; then
1724	75	py_distinct="$(echo "$PY_PINS_UNIQUE" \| grep -c .)"
1725	75	py_list="$(echo "$PY_PINS_UNIQUE" \| paste -sd',' -)"
1726	73	if [ "$py_distinct" -gt 1 ] \|\| { [ -n "$CANON_PY" ] && [ "$py_list" != "$CANON_PY" ]; }; then
1727	1	echo " - python-version pins: ${py_list} (project runtime: ${CANON_PY:-unknown})"
1728	1	echo "python-version (CI vs runtime)\|CI: ${py_list}; runtime: ${CANON_PY:-unknown}" >> "$CONSISTENCY_RESULTS"
1729		fi
1730		fi
1731
1732	158	NPM_PACKAGE_SOURCES="$(
1733		list_npm_package_dirs . \| while IFS= read -r package_dir; do
1734		[ -n "$package_dir" ] \|\| continue
1735		if [ "$package_dir" = "." ]; then
1736		echo "package.json"
1737		else
1738		echo "${package_dir}/package.json"
1739		fi
1740		done
1741		)"
1742	27
1743	105	NODE_PINS="$(extract_node_major_pins . gco/stacks/constants.py .nvmrc Dockerfile.dev \| sort -u)"
1744	52	EXPECTED_NODE_SOURCES="$(
1745		{
1746		printf '%s\n' gco/stacks/constants.py .nvmrc Dockerfile.dev
1747		printf '%s\n' "$NPM_PACKAGE_SOURCES"
1748		} \| sed '/^$/d' \| sort -u
1749		)"
1750	208	NODE_PIN_SOURCES="$(printf '%s\n' "$NODE_PINS" \| cut -d'\|' -f1 \| sed '/^$/d' \| sort -u)"
1751	104	NODE_MISSING="$(comm -23 <(printf '%s\n' "$EXPECTED_NODE_SOURCES") <(printf '%s\n' "$NODE_PIN_SOURCES"))"
1752	156	node_distinct="$(printf '%s\n' "$NODE_PINS" \| cut -d'\|' -f2 \| sed '/^$/d' \| sort -u \| grep -c .)"
1753	49	if [ -n "$NODE_MISSING" ] \|\| [ "$node_distinct" -gt 1 ]; then
1754	12	node_detail="$(printf '%s\n' "$NODE_PINS" \| awk -F'\|' '{printf "%s=%s ", $1, $2}' \| sed 's/ *$//')"
1755	3	if [ -n "$NODE_MISSING" ]; then
1756	9	node_missing_list="$(printf '%s\n' "$NODE_MISSING" \| paste -sd',' -)"
1757	3	node_detail="${node_detail}; missing=${node_missing_list}"
1758		fi
1759	3	echo " - Node.js major pins disagree or are missing: ${node_detail}"
1760	3	echo "Node.js major (runtime / packages / dev container)\|${node_detail}" >> "$CONSISTENCY_RESULTS"
1761		fi
1762
1763	78	NPM_PINS="$(extract_npm_version_pins . Dockerfile.dev \| sort -u)"
1764	52	EXPECTED_NPM_SOURCES="$(
1765		{
1766		printf '%s\n' Dockerfile.dev
1767		printf '%s\n' "$NPM_PACKAGE_SOURCES"
1768		} \| sed '/^$/d' \| sort -u
1769		)"
1770	208	NPM_PIN_SOURCES="$(printf '%s\n' "$NPM_PINS" \| cut -d'\|' -f1 \| sed '/^$/d' \| sort -u)"
1771	104	NPM_MISSING="$(comm -23 <(printf '%s\n' "$EXPECTED_NPM_SOURCES") <(printf '%s\n' "$NPM_PIN_SOURCES"))"
1772	156	npm_distinct="$(printf '%s\n' "$NPM_PINS" \| cut -d'\|' -f2 \| sed '/^$/d' \| sort -u \| grep -c .)"
1773	50	if [ -n "$NPM_MISSING" ] \|\| [ "$npm_distinct" -gt 1 ]; then
1774	12	npm_detail="$(printf '%s\n' "$NPM_PINS" \| awk -F'\|' '{printf "%s=%s ", $1, $2}' \| sed 's/ *$//')"
1775	3	if [ -n "$NPM_MISSING" ]; then
1776	6	npm_missing_list="$(printf '%s\n' "$NPM_MISSING" \| paste -sd',' -)"
1777	2	npm_detail="${npm_detail}; missing=${npm_missing_list}"
1778		fi
1779	3	echo " - npm pins disagree or are missing: ${npm_detail}"
1780	3	echo "npm (packageManager / dev container)\|${npm_detail}" >> "$CONSISTENCY_RESULTS"
1781		fi
1782
1783	78	CDK_CLI_PINS="$(extract_cdk_cli_pins . Dockerfile.dev \| sort -u)"
1784	208	CDK_CLI_MISSING="$(comm -23 \
1785		<(printf '%s\n' Dockerfile.dev package.json \| sort -u) \
1786		<(printf '%s\n' "$CDK_CLI_PINS" \| cut -d'\|' -f1 \| sed '/^$/d' \| sort -u))"
1787	156	cdk_cli_distinct="$(printf '%s\n' "$CDK_CLI_PINS" \| cut -d'\|' -f2 \| sed '/^$/d' \| sort -u \| grep -c .)"
1788	49	if [ -n "$CDK_CLI_MISSING" ] \|\| [ "$cdk_cli_distinct" -gt 1 ]; then
1789	12	cdk_detail="$(printf '%s\n' "$CDK_CLI_PINS" \| awk -F'\|' '{printf "%s=%s ", $1, $2}' \| sed 's/ *$//')"
1790	3	if [ -n "$CDK_CLI_MISSING" ]; then
1791	9	cdk_missing_list="$(printf '%s\n' "$CDK_CLI_MISSING" \| paste -sd',' -)"
1792	3	cdk_detail="${cdk_detail}; missing=${cdk_missing_list}"
1793		fi
1794	3	echo " - AWS CDK CLI pins disagree or are missing: ${cdk_detail}"
1795	3	echo "AWS CDK CLI (package / dev container)\|${cdk_detail}" >> "$CONSISTENCY_RESULTS"
1796		fi
1797
1798	52	NPM_MANAGEMENT_PROBLEMS="$(check_npm_package_management . .github/dependabot.yml)"
1799	26	if [ -n "$NPM_MANAGEMENT_PROBLEMS" ]; then
1800	4	while IFS='\|' read -r manifest problem; do
1801	1	[ -n "$manifest" ] \|\| continue
1802	1	echo " - npm dependency management: ${manifest}: ${problem}"
1803	1	echo "npm dependency management\|${manifest}: ${problem}" >> "$CONSISTENCY_RESULTS"
1804		done <<< "$NPM_MANAGEMENT_PROBLEMS"
1805		fi
1806
1807		# Every tool pinned in more than one workflow (or more than one job) must
1808		# agree. CALICO_* and METRICS_SERVER_* are here because the kind jobs install
1809		# them per job — two jobs on different Calico builds would enforce
1810		# NetworkPolicy with two different engines, and a version/checksum pair that
1811		# disagrees fails the download as what looks like a flake. The PR-time half of
1812		# this contract lives in
1813		# tests/test_supply_chain_integrity.py::test_repeated_workflow_pins_agree_across_jobs.
1814		# (Trivy is absent from this list on purpose: its pin is the install-trivy
1815		# composite action's input default, a single declaration that cannot
1816		# disagree with itself.)
1817		# (Helm and kubectl are absent from this list on purpose: their pins live
1818		# only in lambda/helm-installer/Dockerfile — workflows derive their env
1819		# copies from it at runtime, so a checked-in workflow declaration that
1820		# could disagree no longer exists. The guard below still catches a stray
1821		# reintroduced copy.)
1822	104	for consistency_var in \
1823		CALICO_VERSION CALICO_SHA256 METRICS_SERVER_VERSION METRICS_SERVER_SHA256; do
1824	208	cvals="$(extract_workflow_env_pin "$consistency_var")"
1825	312	cnum="$(echo "$cvals" \| grep -c .)"
1826	104	if [ "$cnum" -gt 1 ]; then
1827	3	clist="$(echo "$cvals" \| paste -sd',' -)"
1828	1	echo " - ${consistency_var} disagrees across workflows: ${clist}"
1829	1	echo "${consistency_var} (across workflows)\|${clist}" >> "$CONSISTENCY_RESULTS"
1830		fi
1831		done
1832
1833		# helm / kubectl pins hardcoded in lambda/helm-installer/Dockerfile RUN-line
1834		# URLs must agree with the workflow env pins (and, for kubectl, with the
1835		# Dockerfile.dev ARG). These URL literals were previously invisible to every
1836		# check — the integration-tests workflow even carries a comment noting the
1837		# Lambda copy "isn't caught by the consistency check". Now it is.
1838	52	INSTALLER_PINS="$(extract_helm_installer_pins lambda/helm-installer/Dockerfile)"
1839	26	if [ -n "$INSTALLER_PINS" ]; then
1840	50	for tool_var in HELM_VERSION KUBECTL_VERSION; do
1841	150	installer_val="$(printf '%s\n' "$INSTALLER_PINS" \| awk -F'\|' -v v="$tool_var" '$1==v{print $2}')"
1842	50	[ -n "$installer_val" ] \|\| continue
1843	50	all_vals="$installer_val"
1844		# Workflows derive their copies from the installer Dockerfile at
1845		# runtime, so a checked-in workflow declaration is itself a finding:
1846		# it would shadow the derive step's GITHUB_ENV export and drift.
1847	100	wf_vals="$(extract_workflow_env_pin "$tool_var")"
1848	50	if [ -n "$wf_vals" ]; then
1849	1	echo " - ${tool_var} is declared literally in a workflow again (should derive from the installer Dockerfile): ${wf_vals}"
1850	1	echo "${tool_var} (literal workflow copy reintroduced)\|${wf_vals}" >> "$CONSISTENCY_RESULTS"
1851	2	all_vals="$(printf '%s\n%s' "$all_vals" "$wf_vals")"
1852		fi
1853	50	if [ "$tool_var" = "KUBECTL_VERSION" ]; then
1854	75	dev_val="$(extract_dockerfile_pins Dockerfile.dev \| awk -F'\|' '$1=="KUBECTL_VERSION"{print $2}')"
1855	73	[ -n "$dev_val" ] && all_vals="$(printf '%s\n%s' "$all_vals" "$dev_val")"
1856		fi
1857	250	tool_distinct="$(printf '%s\n' "$all_vals" \| sed '/^$/d' \| sort -u \| grep -c .)"
1858	50	if [ "$tool_distinct" -gt 1 ]; then
1859	10	tool_list="$(printf '%s\n' "$all_vals" \| sed '/^$/d' \| sort -u \| paste -sd',' -)"
1860	2	echo " - ${tool_var} disagrees between helm-installer Dockerfile, workflows, and Dockerfile.dev: ${tool_list}"
1861	2	echo "${tool_var} (helm-installer Dockerfile / workflows / Dockerfile.dev)\|${tool_list}" >> "$CONSISTENCY_RESULTS"
1862		fi
1863		done
1864		fi
1865
1866		# Build-backend pins must use the same exact ``==`` shape as every other
1867		# Python dependency in pyproject.toml, or the version resolved inside
1868		# pip's build isolation floats with upstream releases. An empty result is
1869		# itself a finding — [build-system] always exists here, so nothing coming
1870		# back means the table was removed or the TOML no longer parses, and a
1871		# parse break must not silently drop the check.
1872	27	BUILD_SYSTEM_PINS="${BUILD_SYSTEM_PINS:-$(extract_build_system_pins pyproject.toml)}"
1873	26	if [ -z "$BUILD_SYSTEM_PINS" ]; then
1874	1	echo " - pyproject.toml [build-system] requires is missing or unparseable"
1875	1	echo "build-system requires (pyproject.toml)\|missing or unparseable" >> "$CONSISTENCY_RESULTS"
1876		else
1877	100	while IFS='\|' read -r bs_name bs_version bs_raw; do
1878	25	[ -n "$bs_raw" ] \|\| continue
1879	25	if [ -z "$bs_version" ]; then
1880	1	echo " - build-system requires entry is not an exact ==X.Y.Z pin: ${bs_raw}"
1881	1	echo "build-system requires (pyproject.toml)\|'${bs_raw}' must be an exact ==X.Y.Z pin" >> "$CONSISTENCY_RESULTS"
1882		fi
1883		done <<< "$BUILD_SYSTEM_PINS"
1884		fi
1885
1886		# Each Lambda is packaged independently and carries its own requirements.txt,
1887		# so a library like boto3 is pinned centrally and in up to six Lambda copies.
1888		# Nothing watched the copies: a bump applied to pyproject.toml and the lock left
1889		# them behind silently, and the handlers shipped a boto3 that nothing in CI ever
1890		# exercised. This is the one drift surface that reaches production directly, so
1891		# the report names the file and the version it must move to. The PR-time half of
1892		# this contract lives in
1893		# tests/test_integration.py::TestDependencyVersionConsistency::test_lambda_requirements_match_pyproject.
1894	52	LAMBDA_PIN_PROBLEMS="$(check_lambda_requirements_pins . pyproject.toml requirements-lock.txt)"
1895	26	if [ -n "$LAMBDA_PIN_PROBLEMS" ]; then
1896	8	while IFS='\|' read -r lambda_req lambda_problem; do
1897	2	[ -n "$lambda_req" ] \|\| continue
1898	2	echo " - Lambda runtime pin: ${lambda_req}: ${lambda_problem}"
1899	2	echo "Lambda runtime pins\|${lambda_req}: ${lambda_problem}" >> "$CONSISTENCY_RESULTS"
1900		done <<< "$LAMBDA_PIN_PROBLEMS"
1901		fi
1902
1903		# An immutable digest is only immutable where it is written down. When an
1904		# upstream tag is re-pushed and the pin is refreshed in one file but restated as
1905		# a literal in another, nothing reconciled the two until whichever test held the
1906		# stale copy happened to run. Two digests under one tag is unambiguous drift.
1907	52	IMAGE_DIGEST_PROBLEMS="$(check_image_digest_consistency .)"
1908	26	if [ -n "$IMAGE_DIGEST_PROBLEMS" ]; then
1909	4	while IFS='\|' read -r image_repo image_problem; do
1910	1	[ -n "$image_repo" ] \|\| continue
1911	1	echo " - image digest: ${image_repo}: ${image_problem}"
1912	1	echo "Image digest copies\|${image_repo}: ${image_problem}" >> "$CONSISTENCY_RESULTS"
1913		done <<< "$IMAGE_DIGEST_PROBLEMS"
1914		fi
1915
1916	78	CONSISTENCY_COUNT="$(wc -l < "$CONSISTENCY_RESULTS" 2>/dev/null \| tr -d ' ')"
1917	26	[ -z "$CONSISTENCY_COUNT" ] && CONSISTENCY_COUNT=0
1918
1919		# ---------------------------------------------------------------------------
1920		# Base-image security epochs (no network)
1921		#
1922		# The service images (Debian) and the helm-installer Lambda (AL2023) pull OS
1923		# security patches at build time behind a hand-bumped ``*_SECURITY_EPOCH``
1924		# ARG that busts the CI layer cache. Nothing else reminds anyone to move the
1925		# date, so a stale epoch silently reuses an old upgrade layer. Trivy's
1926		# container scan is the backstop; this flags an epoch older than the window
1927		# as the proactive nudge. Only the real Dockerfiles are scanned — the
1928		# generated ``*-build`` staging copies are skipped.
1929		# ---------------------------------------------------------------------------
1930	26	echo ""
1931	26	echo "=== Checking base-image security epochs ==="
1932	26
1933	52	EPOCH_RESULTS="$(mktemp)"
1934	26	EPOCH_FILES=(dockerfiles/*-dockerfile Dockerfile.dev lambda/helm-installer/Dockerfile)
1935	88	for df in "${EPOCH_FILES[@]}"; do
1936	91	[ -f "$df" ] \|\| continue
1937	423	extract_security_epochs "$df" \| while IFS='\|' read -r epoch_arg epoch_date; do
1938	84	[ -z "$epoch_date" ] && continue
1939	168	epoch_age="$(days_since "$epoch_date")"
1940	84	[ -z "$epoch_age" ] && continue
1941	84	if [ "$epoch_age" -gt "$SECURITY_EPOCH_STALE_DAYS" ]; then
1942	5	echo " - ${df} (${epoch_arg}): ${epoch_date} (${epoch_age} days old)"
1943	5	echo "${df}\|${epoch_arg}\|${epoch_date}\|${epoch_age}" >> "$EPOCH_RESULTS"
1944		fi
1945		done
1946		done
1947
1948	78	EPOCH_COUNT="$(wc -l < "$EPOCH_RESULTS" 2>/dev/null \| tr -d ' ')"
1949	26	[ -z "$EPOCH_COUNT" ] && EPOCH_COUNT=0
1950
1951		# ---------------------------------------------------------------------------
1952		# Suppression expiries (no network)
1953		#
1954		# ``.trivyignore`` / ``.pip-audit-ignore`` / ``.npm-audit-ignore`` entries
1955		# carry an ``exp:YYYY-MM-DD`` marker. The CI validators hard-fail a PR on the
1956		# day an entry expires; this surfaces entries expiring soon so they get
1957		# re-evaluated (fixed upstream? extend with a new justification?) before they
1958		# break a build.
1959		# ---------------------------------------------------------------------------
1960	26	echo ""
1961	26	echo "=== Checking suppression expiries ==="
1962	26
1963	52	SUPPRESSION_RESULTS="$(mktemp)"
1964	78	for supfile in .github/config/.trivyignore .github/config/.pip-audit-ignore .github/config/.npm-audit-ignore; do
1965	81	[ -f "$supfile" ] \|\| continue
1966	150	supbase="$(basename "$supfile")"
1967	377	parse_suppression_expiries "$supfile" \| while IFS='\|' read -r sup_id sup_date; do
1968	76	[ -z "$sup_date" ] && continue
1969	152	sup_left="$(days_until "$sup_date")"
1970	76	[ -z "$sup_left" ] && continue
1971	76	if [ "$sup_left" -le "$SUPPRESSION_EXPIRY_WARN_DAYS" ]; then
1972	3	echo " - ${supbase}: ${sup_id} expires ${sup_date} (${sup_left} days)"
1973	3	echo "${supbase}\|${sup_id}\|${sup_date}\|${sup_left}" >> "$SUPPRESSION_RESULTS"
1974		fi
1975		done
1976		done
1977
1978	78	SUPPRESSION_COUNT="$(wc -l < "$SUPPRESSION_RESULTS" 2>/dev/null \| tr -d ' ')"
1979	26	[ -z "$SUPPRESSION_COUNT" ] && SUPPRESSION_COUNT=0
1980
1981		# ---------------------------------------------------------------------------
1982		# Lockfile freshness (no network)
1983		#
1984		# ``requirements-lock.txt`` is compiled from ``pyproject.toml`` with
1985		# ``pip-compile --all-extras``. Every direct dependency must use an exact,
1986		# concrete pin and is matched to the lock by normalized name, canonical marker
1987		# identity, and version. Missing or mismatched records mean the lock is stale;
1988		# unrelated transitive pins are ignored.
1989		# ---------------------------------------------------------------------------
1990	26	echo ""
1991	26	echo "=== Checking lockfile freshness ==="
1992	26
1993	52	LOCKFILE_RESULTS="$(mktemp)"
1994	52	LOCKFILE_RAW="$(mktemp)"
1995	26	if check_lockfile_freshness pyproject.toml requirements-lock.txt > "$LOCKFILE_RAW"; then
1996	52	while IFS='\|' read -r lock_name expected_version locked_version; do
1997	2	[ -z "$lock_name" ] && continue
1998	2	if [ "$locked_version" = "<missing>" ]; then
1999	1	echo " - direct dep missing from requirements-lock.txt: ${lock_name}==${expected_version}"
2000		else
2001	1	echo " - direct dep version mismatch: ${lock_name}==${expected_version} (lock has ${locked_version})"
2002		fi
2003	2	echo "${lock_name}\|${expected_version}\|${locked_version}" >> "$LOCKFILE_RESULTS"
2004		done < "$LOCKFILE_RAW"
2005		else
2006	2	mark_scan_incomplete "Lockfile freshness validation failed; inspect its error above."
2007		fi
2008	26	rm -f "$LOCKFILE_RAW"
2009
2010	78	LOCKFILE_COUNT="$(wc -l < "$LOCKFILE_RESULTS" 2>/dev/null \| tr -d ' ')"
2011	26	[ -z "$LOCKFILE_COUNT" ] && LOCKFILE_COUNT=0
2012
2013		# ---------------------------------------------------------------------------
2014		# Accelerator catalog and Karpenter NodePools
2015		#
2016		# The deterministic check always runs and validates the reviewed catalog
2017		# against every NodePool plus the exact cdk.json capacity-history watch list.
2018		# With AWS credentials, the monthly job also compares the catalog against the
2019		# union of NVIDIA GPU / AWS Neuron types returned across enabled commercial
2020		# Regions. Ordinary policy/catalog drift joins the rolling dependency issue;
2021		# execution or parser failures become one operational finding, never a
2022		# false-clean result.
2023		# ---------------------------------------------------------------------------
2024	26	echo ""
2025	26	echo "=== Checking accelerator catalog and Karpenter NodePools ==="
2026	26
2027	52	ACCELERATOR_OFFLINE_REPORT="$(mktemp)"
2028	52	ACCELERATOR_ONLINE_REPORT="$(mktemp)"
2029	52	ACCELERATOR_ONLINE_SUMMARY="$(mktemp)"
2030	52	ACCELERATOR_OFFLINE_ERROR="$(mktemp)"
2031	52	ACCELERATOR_ONLINE_ERROR="$(mktemp)"
2032	26	ACCELERATOR_OFFLINE_COUNT=0
2033	26	ACCELERATOR_ONLINE_COUNT=0
2034	26	ACCELERATOR_SKIP_REASON=""
2035	26	ACCELERATOR_SUMMARY_SKIP_REASON=""
2036
2037		write_accelerator_operational_report() {
2038	5	local report_path="$1" title="$2" detail="$3" error_path="$4"
2039		{
2040	5	echo "## ${title}"
2041	5	echo ""
2042	5	echo "Status: OPERATIONAL ERROR."
2043	5	echo ""
2044	5	echo "### Accelerator maintenance check could not complete"
2045	5	echo ""
2046	5	echo "- Why: ${detail}"
2047	5	echo "- Recommended change: Re-run the command locally, repair the tool or credentials, and do not treat this scan as current until it succeeds."
2048	5	if [ -s "$error_path" ]; then
2049	2	echo "- Tool output:"
2050	2	sed 's/^/ /' "$error_path"
2051		fi
2052		} > "$report_path"
2053		}
2054
2055		record_accelerator_operational_error() {
2056	5	local report_path="$1" title="$2" detail="$3" error_path="$4"
2057	5	write_accelerator_operational_report "$report_path" "$title" "$detail" "$error_path"
2058	5	mark_scan_incomplete "${title}: ${detail}"
2059		}
2060
2061	26	python3 scripts/accelerator_catalog.py validate \
2062		--format markdown \
2063		--output "$ACCELERATOR_OFFLINE_REPORT" \
2064		2>"$ACCELERATOR_OFFLINE_ERROR"
2065	26	ACCELERATOR_OFFLINE_STATUS=$?
2066	26	if [ "$ACCELERATOR_OFFLINE_STATUS" -eq 0 ]; then
2067	23	echo " Offline NodePool/watch-list policy is current."
2068	3	elif [ "$ACCELERATOR_OFFLINE_STATUS" -eq 1 ]; then
2069	5	ACCELERATOR_OFFLINE_COUNT="$(grep -c '^### ' "$ACCELERATOR_OFFLINE_REPORT" \|\| true)"
2070	2	if ! [[ "$ACCELERATOR_OFFLINE_COUNT" =~ ^[1-9][0-9]*$ ]]; then
2071	1	ACCELERATOR_OFFLINE_COUNT=1
2072	1	record_accelerator_operational_error \
2073		"$ACCELERATOR_OFFLINE_REPORT" \
2074		"Offline accelerator catalog validation" \
2075		"The validator reported drift but emitted no parseable actionable findings." \
2076		"$ACCELERATOR_OFFLINE_ERROR"
2077		else
2078	1	echo " Found ${ACCELERATOR_OFFLINE_COUNT} offline accelerator policy finding(s)."
2079		fi
2080		else
2081	1	ACCELERATOR_OFFLINE_COUNT=1
2082	1	record_accelerator_operational_error \
2083		"$ACCELERATOR_OFFLINE_REPORT" \
2084		"Offline accelerator catalog validation" \
2085		"The deterministic validator exited with status ${ACCELERATOR_OFFLINE_STATUS}." \
2086		"$ACCELERATOR_OFFLINE_ERROR"
2087	1	echo " Offline accelerator validator failed operationally."
2088		fi
2089
2090	26	if ! aws sts get-caller-identity >/dev/null 2>&1; then
2091	3	ACCELERATOR_SKIP_REASON="No AWS credentials available for the online EC2 catalog check (needs ec2:DescribeRegions and ec2:DescribeInstanceTypes); offline policy validation still ran."
2092	3	echo " $ACCELERATOR_SKIP_REASON"
2093		else
2094	23	python3 scripts/accelerator_catalog.py check-online \
2095		--report "$ACCELERATOR_ONLINE_REPORT" \
2096		--json-summary \
2097		>"$ACCELERATOR_ONLINE_SUMMARY" \
2098		2>"$ACCELERATOR_ONLINE_ERROR"
2099	23	ACCELERATOR_ONLINE_STATUS=$?
2100	26	if [ "$ACCELERATOR_ONLINE_STATUS" -eq 0 ] \|\| [ "$ACCELERATOR_ONLINE_STATUS" -eq 1 ]; then
2101	44	if ACCELERATOR_ONLINE_COUNT="$(parse_accelerator_drift_count "$ACCELERATOR_ONLINE_SUMMARY")"; then
2102	40	if { [ "$ACCELERATOR_ONLINE_STATUS" -eq 0 ] && [ "$ACCELERATOR_ONLINE_COUNT" -ne 0 ]; } \
2103	22	\|\| { [ "$ACCELERATOR_ONLINE_STATUS" -eq 1 ] && [ "$ACCELERATOR_ONLINE_COUNT" -eq 0 ]; }; then
2104	1	ACCELERATOR_ONLINE_COUNT=1
2105	1	record_accelerator_operational_error \
2106		"$ACCELERATOR_ONLINE_REPORT" \
2107		"Online EC2 accelerator catalog drift" \
2108		"The command exit status disagreed with its JSON drift summary." \
2109		"$ACCELERATOR_ONLINE_ERROR"
2110	1	echo " Online accelerator scan returned an inconsistent result."
2111	20	elif [ "$ACCELERATOR_ONLINE_COUNT" -eq 0 ]; then
2112	18	echo " Live EC2 accelerator catalog is current."
2113		else
2114	2	echo " Found ${ACCELERATOR_ONLINE_COUNT} live EC2 catalog drift finding(s)."
2115		fi
2116		else
2117	1	ACCELERATOR_ONLINE_COUNT=1
2118	1	record_accelerator_operational_error \
2119		"$ACCELERATOR_ONLINE_REPORT" \
2120		"Online EC2 accelerator catalog drift" \
2121		"The online scanner emitted a missing or malformed JSON summary." \
2122		"$ACCELERATOR_ONLINE_ERROR"
2123	1	echo " Online accelerator scan summary could not be parsed."
2124		fi
2125		else
2126	1	ACCELERATOR_ONLINE_COUNT=1
2127	1	record_accelerator_operational_error \
2128		"$ACCELERATOR_ONLINE_REPORT" \
2129		"Online EC2 accelerator catalog drift" \
2130		"The online scanner exited with status ${ACCELERATOR_ONLINE_STATUS}." \
2131		"$ACCELERATOR_ONLINE_ERROR"
2132	1	echo " Online accelerator scanner failed operationally."
2133		fi
2134		fi
2135
2136	26	ACCELERATOR_COUNT=$((ACCELERATOR_OFFLINE_COUNT + ACCELERATOR_ONLINE_COUNT))
2137	29	if [ -n "$ACCELERATOR_SKIP_REASON" ] && [ "$ACCELERATOR_COUNT" -eq 0 ]; then
2138	3	ACCELERATOR_SUMMARY_SKIP_REASON="$ACCELERATOR_SKIP_REASON"
2139		fi
2140
2141		# ---------------------------------------------------------------------------
2142		# Summary + Markdown report
2143		# ---------------------------------------------------------------------------
2144	26	echo ""
2145	26	echo "=== Summary ==="
2146	26	echo "Python packages outdated: $PYTHON_COUNT"
2147	26	echo "Docker images outdated: $DOCKER_COUNT"
2148	26	echo "Helm charts outdated: $HELM_COUNT"
2149	26	if [ -n "$ADDON_SKIP_REASON" ]; then
2150	6	echo "EKS add-ons outdated: (skipped)"
2151		else
2152	20	echo "EKS add-ons outdated: $ADDON_COUNT"
2153		fi
2154	26	if [ -n "$EKS_K8S_SKIP_REASON" ]; then
2155	6	echo "EKS Kubernetes version: (skipped)"
2156		else
2157	20	echo "EKS Kubernetes version: $EKS_K8S_COUNT"
2158		fi
2159	26	if [ -n "$AURORA_SKIP_REASON" ]; then
2160	5	echo "Aurora PostgreSQL: (skipped)"
2161		else
2162	21	echo "Aurora PostgreSQL: $AURORA_COUNT"
2163		fi
2164	26	if [ -n "$EMR_SKIP_REASON" ]; then
2165	7	echo "EMR Serverless release: (skipped)"
2166		else
2167	19	echo "EMR Serverless release: $EMR_COUNT"
2168		fi
2169	26	if [ -n "$BEDROCK_MODEL_SKIP_REASON" ]; then
2170	6	echo "Bedrock default model: (skipped)"
2171		else
2172	20	echo "Bedrock default model: $BEDROCK_MODEL_COUNT"
2173		fi
2174	26	if [ -n "$ACCELERATOR_SKIP_REASON" ]; then
2175	3	echo "Accelerator catalog: ${ACCELERATOR_COUNT} (online skipped)"
2176		else
2177	23	echo "Accelerator catalog: $ACCELERATOR_COUNT"
2178		fi
2179	26	echo "Dockerfile.dev pins: $DOCKERFILE_COUNT"
2180	26	echo "Pre-commit hooks: $PRECOMMIT_COUNT"
2181	26	if [ -n "$CDK_ENUM_SKIP_REASON" ]; then
2182	2	echo "CDK enum constants: (skipped)"
2183		else
2184	24	echo "CDK enum constants: $CDK_ENUM_COUNT"
2185		fi
2186	26	if [ -n "$PYTHON_RELEASE_SKIP_REASON" ]; then
2187	3	echo "Python release: (skipped)"
2188		else
2189	23	echo "Python release: $PYTHON_RELEASE_COUNT"
2190		fi
2191	26	if [ -n "$RUBY_RELEASE_SKIP_REASON" ]; then
2192	3	echo "Ruby release: (skipped)"
2193		else
2194	23	echo "Ruby release: $RUBY_RELEASE_COUNT"
2195		fi
2196	26	if [ -n "$RUNNER_IMAGE_SKIP_REASON" ]; then
2197	2	echo "Runner images: (skipped)"
2198		else
2199	24	echo "Runner images: $RUNNER_IMAGE_COUNT"
2200		fi
2201	26	if [ -n "$AUTOPILOT_SKIP_REASON" ]; then
2202	5	echo "GCO autopilot pins: (skipped)"
2203		else
2204	21	echo "GCO autopilot pins: $AUTOPILOT_COUNT"
2205		fi
2206	26	echo "CI tooling pins: $CI_TOOLING_COUNT"
2207	26	echo "Version consistency: $CONSISTENCY_COUNT"
2208	26	echo "Base-image epochs: $EPOCH_COUNT"
2209	26	echo "Suppression expiries: $SUPPRESSION_COUNT"
2210	26	echo "Lockfile freshness: $LOCKFILE_COUNT"
2211	93	INCOMPLETE_LOOKUP_COUNT="$(sort -u "$INCOMPLETE_REASONS_FILE" 2>/dev/null \| grep -c . \|\| true)"
2212	26	echo "Incomplete lookups: ${INCOMPLETE_LOOKUP_COUNT:-0}"
2213
2214	26	SCAN_COMPLETE=true
2215	26	if ! dependency_scan_is_complete \
2216		"$INCOMPLETE_REASONS_FILE" \
2217		"$ADDON_SKIP_REASON" \
2218		"$EKS_K8S_SKIP_REASON" \
2219		"$AURORA_SKIP_REASON" \
2220		"$EMR_SKIP_REASON" \
2221		"$BEDROCK_MODEL_SKIP_REASON" \
2222		"$ACCELERATOR_SKIP_REASON" \
2223		"$AUTOPILOT_SKIP_REASON" \
2224		"$CDK_ENUM_SKIP_REASON" \
2225		"$PYTHON_RELEASE_SKIP_REASON" \
2226		"$RUBY_RELEASE_SKIP_REASON" \
2227		"$RUNNER_IMAGE_SKIP_REASON"; then
2228	15	SCAN_COMPLETE=false
2229		fi
2230
2231	70	if [ "$PYTHON_COUNT" -eq 0 ] && [ "$NPM_COUNT" -eq 0 ] && [ "$DOCKER_COUNT" -eq 0 ] \
2232	42	&& [ "$HELM_COUNT" -eq 0 ] && [ "$ADDON_COUNT" -eq 0 ] \
2233	21	&& [ "$EKS_K8S_COUNT" -eq 0 ] \
2234	42	&& [ "$AURORA_COUNT" -eq 0 ] && [ "$EMR_COUNT" -eq 0 ] \
2235	21	&& [ "$DOCKERFILE_COUNT" -eq 0 ] \
2236	21	&& [ "$AUTOPILOT_COUNT" -eq 0 ] \
2237	18	&& [ "$PRECOMMIT_COUNT" -eq 0 ] \
2238	18	&& [ "$CDK_ENUM_COUNT" -eq 0 ] \
2239	18	&& [ "$PYTHON_RELEASE_COUNT" -eq 0 ] \
2240	18	&& [ "$RUBY_RELEASE_COUNT" -eq 0 ] \
2241	18	&& [ "$RUNNER_IMAGE_COUNT" -eq 0 ] \
2242	18	&& [ "$BEDROCK_MODEL_COUNT" -eq 0 ] \
2243	18	&& [ "$ACCELERATOR_COUNT" -eq 0 ] \
2244	14	&& [ "$CI_TOOLING_COUNT" -eq 0 ] \
2245	14	&& [ "$CONSISTENCY_COUNT" -eq 0 ] \
2246	11	&& [ "$EPOCH_COUNT" -eq 0 ] \
2247	7	&& [ "$SUPPRESSION_COUNT" -eq 0 ] \
2248	7	&& [ "$LOCKFILE_COUNT" -eq 0 ]; then
2249	7	echo ""
2250	7	SKIP_NOTES=""
2251	7	if [ -n "$ADDON_SKIP_REASON" ]; then
2252	3	SKIP_NOTES="EKS add-ons skipped: $ADDON_SKIP_REASON"
2253		fi
2254	7	if [ -n "$EKS_K8S_SKIP_REASON" ]; then
2255	4	[ -n "$SKIP_NOTES" ] && SKIP_NOTES="$SKIP_NOTES; "
2256	2	SKIP_NOTES="${SKIP_NOTES}EKS Kubernetes skipped: $EKS_K8S_SKIP_REASON"
2257		fi
2258	7	if [ -n "$AURORA_SKIP_REASON" ]; then
2259	4	[ -n "$SKIP_NOTES" ] && SKIP_NOTES="$SKIP_NOTES; "
2260	2	SKIP_NOTES="${SKIP_NOTES}Aurora engine skipped: $AURORA_SKIP_REASON"
2261		fi
2262	7	if [ -n "$EMR_SKIP_REASON" ]; then
2263	4	[ -n "$SKIP_NOTES" ] && SKIP_NOTES="$SKIP_NOTES; "
2264	2	SKIP_NOTES="${SKIP_NOTES}EMR Serverless skipped: $EMR_SKIP_REASON"
2265		fi
2266	7	if [ -n "$BEDROCK_MODEL_SKIP_REASON" ]; then
2267	4	[ -n "$SKIP_NOTES" ] && SKIP_NOTES="$SKIP_NOTES; "
2268	2	SKIP_NOTES="${SKIP_NOTES}Bedrock model skipped: $BEDROCK_MODEL_SKIP_REASON"
2269		fi
2270	7	if [ -n "$ACCELERATOR_SKIP_REASON" ]; then
2271	4	[ -n "$SKIP_NOTES" ] && SKIP_NOTES="$SKIP_NOTES; "
2272	2	SKIP_NOTES="${SKIP_NOTES}Online accelerator catalog skipped: $ACCELERATOR_SKIP_REASON"
2273		fi
2274	7	if [ -n "$AUTOPILOT_SKIP_REASON" ]; then
2275	3	[ -n "$SKIP_NOTES" ] && SKIP_NOTES="$SKIP_NOTES; "
2276	2	SKIP_NOTES="${SKIP_NOTES}GCO autopilot pins skipped: $AUTOPILOT_SKIP_REASON"
2277		fi
2278	7	if [ -n "$CDK_ENUM_SKIP_REASON" ]; then
2279	2	[ -n "$SKIP_NOTES" ] && SKIP_NOTES="$SKIP_NOTES; "
2280	1	SKIP_NOTES="${SKIP_NOTES}CDK enums skipped: $CDK_ENUM_SKIP_REASON"
2281		fi
2282	7	if [ -n "$PYTHON_RELEASE_SKIP_REASON" ]; then
2283	2	[ -n "$SKIP_NOTES" ] && SKIP_NOTES="$SKIP_NOTES; "
2284	1	SKIP_NOTES="${SKIP_NOTES}Python release skipped: $PYTHON_RELEASE_SKIP_REASON"
2285		fi
2286	7	if [ -n "$RUBY_RELEASE_SKIP_REASON" ]; then
2287	2	[ -n "$SKIP_NOTES" ] && SKIP_NOTES="$SKIP_NOTES; "
2288	1	SKIP_NOTES="${SKIP_NOTES}Ruby release skipped: $RUBY_RELEASE_SKIP_REASON"
2289		fi
2290	7	if [ -n "$RUNNER_IMAGE_SKIP_REASON" ]; then
2291	2	[ -n "$SKIP_NOTES" ] && SKIP_NOTES="$SKIP_NOTES; "
2292	1	SKIP_NOTES="${SKIP_NOTES}Runner images skipped: $RUNNER_IMAGE_SKIP_REASON"
2293		fi
2294	7	if [ -s "$INCOMPLETE_REASONS_FILE" ]; then
2295	4	[ -n "$SKIP_NOTES" ] && SKIP_NOTES="$SKIP_NOTES; "
2296	6	SKIP_NOTES="${SKIP_NOTES}Incomplete checks: $(join_scan_incomplete_reasons)"
2297		fi
2298	7	if [ "$SCAN_COMPLETE" != true ]; then
2299	6	STATUS_MESSAGE="No drift was found in completed checks, but the scan is incomplete."
2300		else
2301	1	STATUS_MESSAGE="All dependencies are up to date."
2302		fi
2303	7	echo "$STATUS_MESSAGE"
2304	7	rm -f "$NPM_RESULTS" "$DOCKER_RESULTS" "$HELM_RESULTS" "$ADDON_RESULTS" "$EKS_K8S_RESULTS" "$AURORA_RESULTS" "$EMR_RESULTS" "$DOCKERFILE_RESULTS" "$AUTOPILOT_RESULTS" "$PRECOMMIT_RESULTS" "$CDK_ENUM_RESULTS" "$PYTHON_RELEASE_RESULTS" "$RUBY_RELEASE_RESULTS" "$RUNNER_IMAGE_RESULTS" "$RUNNER_IMAGE_NOTES" "$BEDROCK_MODEL_RESULTS" "$CI_TOOLING_RESULTS" "$CONSISTENCY_RESULTS" "$EPOCH_RESULTS" "$SUPPRESSION_RESULTS" "$LOCKFILE_RESULTS" "$ACCELERATOR_OFFLINE_REPORT" "$ACCELERATOR_ONLINE_REPORT" "$ACCELERATOR_ONLINE_SUMMARY" "$ACCELERATOR_OFFLINE_ERROR" "$ACCELERATOR_ONLINE_ERROR" "$INCOMPLETE_REASONS_FILE"
2305	7	if [ -n "${GITHUB_STEP_SUMMARY:-}" ]; then
2306		{
2307	7	echo "# Dependency Update Report"
2308	7	echo ""
2309	7	echo "$STATUS_MESSAGE"
2310	7	if [ -n "$SKIP_NOTES" ]; then
2311	6	echo ""
2312	6	echo "_Incomplete or skipped checks: ${SKIP_NOTES}_"
2313		fi
2314		} >> "$GITHUB_STEP_SUMMARY"
2315		fi
2316	7	if [ -n "${GITHUB_OUTPUT:-}" ]; then
2317		{
2318	7	echo "has_drift=false"
2319	7	echo "scan_complete=$SCAN_COMPLETE"
2320		} >> "$GITHUB_OUTPUT"
2321		fi
2322	7	exit 0
2323		fi
2324
2325		# summary_row <title> <count> <skip_reason> <urgency>
2326		# Emits one row of the top-of-report TL;DR table. Surfaces with drift link to
2327		# their detailed section; skipped surfaces are marked and get no urgency.
2328		summary_row() {
2329	418	local title="$1" count="$2" skip="$3" urgency="$4"
2330	418	local anchor label
2331	836	anchor="$(md_anchor "$title")"
2332	418	if [ -n "$skip" ]; then
2333	29	label="skipped"
2334	29	urgency="—"
2335	389	elif [ "$count" -gt 0 ]; then
2336	86	label="${count} update(s)"
2337	86	title="[${title}](#${anchor})"
2338	303	elif [ "$SCAN_COMPLETE" != true ]; then
2339	145	label="no drift found (incomplete scan)"
2340	145	urgency="—"
2341		else
2342	158	label="up to date"
2343	158	urgency="—"
2344		fi
2345	418	echo "\| ${title} \| ${label} \| ${urgency} \|"
2346		}
2347
2348		{
2349	19	echo "# Dependency Update Report"
2350	19	echo ""
2351	38	echo "_Generated $(date -u '+%Y-%m-%d %H:%M UTC') by the \`deps-scan\` workflow._"
2352	19	echo ""
2353	19	echo "> [!TIP]"
2354	19	echo "> Reproduce this update list programmatically, on demand: run"
2355	19	echo "> \`gco deps scan\` from a checkout (add \`--nodepools-only\` for just the"
2356	19	echo "> accelerator-catalog / NodePool freshness check, \`-o json\` for a"
2357	19	echo "> machine-readable envelope), or call the \`deps_scan\` MCP tool from an"
2358	19	echo "> agent session. Surfaces needing AWS credentials or missing host tools"
2359	19	echo "> are skipped and flagged as incomplete, exactly as in this workflow."
2360	19	echo ""
2361	19	if [ "$SCAN_COMPLETE" != true ]; then
2362	9	echo "> [!WARNING]"
2363	9	echo "> Incomplete scan. Zero-count surfaces are provisional, not confirmed current."
2364	9	if [ -s "$INCOMPLETE_REASONS_FILE" ]; then
2365	16	echo "> Recorded failures: $(join_scan_incomplete_reasons)"
2366		else
2367	1	echo "> One or more credential-dependent or optional checks were skipped; see the workflow log."
2368		fi
2369	9	echo ""
2370		fi
2371
2372		# ----- TL;DR summary -----
2373	19	echo "## Summary"
2374	19	echo ""
2375	19	echo "\| Surface \| Status \| Urgency \|"
2376	19	echo "\|---------\|--------\|---------\|"
2377	19	summary_row "Python Packages" "$PYTHON_COUNT" "" "routine"
2378	19	summary_row "npm Packages" "$NPM_COUNT" "" "routine"
2379	19	summary_row "Docker Images" "$DOCKER_COUNT" "" "routine"
2380	19	summary_row "Helm Charts" "$HELM_COUNT" "" "routine"
2381	19	summary_row "EKS Add-ons" "$ADDON_COUNT" "$ADDON_SKIP_REASON" "routine"
2382	19	summary_row "EKS Kubernetes Version" "$EKS_K8S_COUNT" "$EKS_K8S_SKIP_REASON" "act soon"
2383	19	summary_row "Aurora PostgreSQL Engine" "$AURORA_COUNT" "$AURORA_SKIP_REASON" "routine"
2384	19	summary_row "EMR Serverless" "$EMR_COUNT" "$EMR_SKIP_REASON" "routine"
2385	19	summary_row "Bedrock Default Model" "$BEDROCK_MODEL_COUNT" "$BEDROCK_MODEL_SKIP_REASON" "routine"
2386	19	summary_row "Accelerator Catalog and NodePools" "$ACCELERATOR_COUNT" "$ACCELERATOR_SUMMARY_SKIP_REASON" "act soon"
2387	19	summary_row "Dockerfile.dev Pins" "$DOCKERFILE_COUNT" "" "routine"
2388	19	summary_row "GCO Autopilot Pins" "$AUTOPILOT_COUNT" "$AUTOPILOT_SKIP_REASON" "act soon"
2389	19	summary_row "Pre-commit Hooks" "$PRECOMMIT_COUNT" "" "routine"
2390	19	summary_row "CDK Enum Constants" "$CDK_ENUM_COUNT" "$CDK_ENUM_SKIP_REASON" "routine"
2391	19	summary_row "Python Release" "$PYTHON_RELEASE_COUNT" "$PYTHON_RELEASE_SKIP_REASON" "informational"
2392	19	summary_row "Ruby Release" "$RUBY_RELEASE_COUNT" "$RUBY_RELEASE_SKIP_REASON" "informational"
2393	19	summary_row "Runner Images" "$RUNNER_IMAGE_COUNT" "$RUNNER_IMAGE_SKIP_REASON" "act soon"
2394	19	summary_row "CI Tooling" "$CI_TOOLING_COUNT" "" "act soon"
2395	19	summary_row "Version Consistency" "$CONSISTENCY_COUNT" "" "routine"
2396	19	summary_row "Base-image Security Epochs" "$EPOCH_COUNT" "" "act soon"
2397	19	summary_row "Suppression Expiries" "$SUPPRESSION_COUNT" "" "act soon"
2398	19	summary_row "Lockfile Freshness" "$LOCKFILE_COUNT" "" "routine"
2399	19	echo ""
2400	19	echo "_Urgency is a hint: act soon = security or a support/cost deadline;"
2401	19	echo "routine = bump at leisure; informational = no action yet. Only"
2402	19	echo "surfaces with drift have a detailed section below._"
2403	19	echo ""
2404
2405	19	if [ "$PYTHON_COUNT" -gt 0 ]; then
2406	4	echo "## Python Packages"
2407	4	echo ""
2408	4	echo "Direct dependencies pinned in \`pyproject.toml\` (transitive-only drift"
2409	4	echo "is excluded — those versions are controlled by upstream pins and bumping"
2410	4	echo "them ourselves either no-ops or breaks the resolver)."
2411	4	echo ""
2412	4	echo "\| Package \| Current \| Latest \| Ref \|"
2413	4	echo "\|---------\|---------\|--------\|-----\|"
2414	8	echo "$PYTHON_OUTDATED" \| jq -r '.[] \| "\| \(.name) \| \(.version) \| \(.latest_version) \| [PyPI](https://pypi.org/project/\(.name)/) \|"'
2415	4	echo ""
2416		fi
2417
2418	19	if [ "$NPM_COUNT" -gt 0 ]; then
2419	4	echo "## npm Packages"
2420	4	echo ""
2421	4	echo "Exact direct pins in every repository-owned \`package.json\` (the root"
2422	4	echo "tooling graph and \`lambda/inference-streaming-proxy\`), compared against"
2423	4	echo "each package's \`latest\` dist-tag. Transitives are excluded — those are"
2424	4	echo "controlled by the lockfiles. Bump the pin, then regenerate the graph's"
2425	4	echo "\`package-lock.json\` with the pinned npm."
2426	4	echo ""
2427	8	npm_disp="$(mktemp)"
2428	26	while IFS='\|' read -r graph pkg cur lat; do
2429	9	echo "\`${graph}\`\|${pkg}\|${cur}\|${lat}\|[npm](https://www.npmjs.com/package/${pkg})"
2430		done < "$NPM_RESULTS" > "$npm_disp"
2431	4	emit_md_table "Graph\|Package\|Current\|Latest\|Ref" "$npm_disp"
2432	4	rm -f "$npm_disp"
2433	4	echo ""
2434		fi
2435
2436	19	if [ "$DOCKER_COUNT" -gt 0 ]; then
2437	5	echo "## Docker Images"
2438	5	echo ""
2439	5	emit_md_table "Image\|Current\|Latest" "$DOCKER_RESULTS"
2440	5	echo ""
2441		fi
2442
2443	19	if [ "$HELM_COUNT" -gt 0 ]; then
2444	4	echo "## Helm Charts"
2445	4	echo ""
2446	8	helm_disp="$(mktemp)"
2447	50	while IFS='\|' read -r cname chart cur lat; do
2448	21	echo "${cname}\|${chart}\|${cur}\|${lat}\|[ArtifactHub](https://artifacthub.io/packages/search?ts_query_web=${chart})"
2449		done < "$HELM_RESULTS" > "$helm_disp"
2450	4	emit_md_table "Chart\|Name\|Current\|Latest\|Ref" "$helm_disp"
2451	4	rm -f "$helm_disp"
2452	4	echo ""
2453		fi
2454
2455	19	if [ "$ADDON_COUNT" -gt 0 ]; then
2456	4	echo "## EKS Add-ons"
2457	4	echo ""
2458	4	emit_md_table "Add-on\|Current\|Latest" "$ADDON_RESULTS"
2459	4	echo ""
2460		fi
2461
2462	19	if [ "$EKS_K8S_COUNT" -gt 0 ]; then
2463	3	echo "## EKS Kubernetes Version"
2464	3	echo ""
2465	3	echo "The Kubernetes minor pinned in \`cdk.json::kubernetes_version\` is behind"
2466	3	echo "the latest release still in EKS standard support. Upgrade before"
2467	3	echo "standard support ends to avoid the extended-support pricing uplift."
2468	3	echo ""
2469	6	eks_disp="$(mktemp)"
2470	12	while IFS='\|' read -r pin cur lat eos; do
2471	3	echo "\`${pin}\`\|${cur}\|${lat}\|${eos}"
2472		done < "$EKS_K8S_RESULTS" > "$eks_disp"
2473	3	emit_md_table "Pin\|Current\|Latest (standard support)\|Std support ends" "$eks_disp"
2474	3	rm -f "$eks_disp"
2475	3	echo ""
2476		fi
2477
2478	19	if [ "$AURORA_COUNT" -gt 0 ]; then
2479	4	echo "## Aurora PostgreSQL Engine"
2480	4	echo ""
2481	4	emit_md_table "Engine\|Current\|Latest" "$AURORA_RESULTS"
2482	4	echo ""
2483		fi
2484
2485	19	if [ "$EMR_COUNT" -gt 0 ]; then
2486	3	echo "## EMR Serverless"
2487	3	echo ""
2488	3	emit_md_table "Release\|Current\|Latest" "$EMR_RESULTS"
2489	3	echo ""
2490		fi
2491
2492	19	if [ "$BEDROCK_MODEL_COUNT" -gt 0 ]; then
2493	3	echo "## Bedrock Default Model"
2494	3	echo ""
2495	3	echo "A Bedrock model default configured in \`cdk.json\` is behind a newer"
2496	3	echo "release in the same model family. For"
2497	3	echo "\`bedrock.mission_default_model_id\` and \`bedrock.codex_default_model_id\`,"
2498	3	echo "update the value and re-capture the matching scaffold fixture"
2499	3	echo "(\`scripts/capture_scaffold_fixtures.py\`). For"
2500	3	echo "\`bedrock.capacity_advisor_default_model_id\` and"
2501	3	echo "\`bedrock.claude_code_default_model_id\`, updating the value is enough."
2502	3	echo "For the embedding keys — \`bedrock.embedding_model_id\` (Mission memory)"
2503	3	echo "and \`vector_store.embedding_model_id\` (workload RAG corpus) — stored"
2504	3	echo "vectors are only comparable to vectors from the same model: plan to"
2505	3	echo "re-embed (for the vector store, re-ingest the corpus) or segregate"
2506	3	echo "existing data before adopting the newer model."
2507	3	echo ""
2508	3	emit_md_table "Configuration key\|Current\|Latest" "$BEDROCK_MODEL_RESULTS"
2509	3	echo ""
2510		fi
2511
2512	19	if [ "$ACCELERATOR_COUNT" -gt 0 ]; then
2513	5	echo "## Accelerator Catalog and NodePools"
2514	5	echo ""
2515	5	echo "The offline check keeps reviewed lifecycle/generation policy, Karpenter"
2516	5	echo "NodePools, \`historical.watch_instance_types\`, and the Spot Placement"
2517	5	echo "Score instance pools synchronized. The online check compares the catalog"
2518	5	echo "with EC2 across enabled commercial Regions."
2519	5	echo "Follow each recommended change; review family metadata before refreshing"
2520	5	echo "the checked-in catalog."
2521	5	echo ""
2522	5	if [ -s "$ACCELERATOR_OFFLINE_REPORT" ]; then
2523	3	sed -E 's/^### /#### /; s/^## /### /' "$ACCELERATOR_OFFLINE_REPORT"
2524	3	echo ""
2525		fi
2526	5	if [ -s "$ACCELERATOR_ONLINE_REPORT" ]; then
2527	5	sed -E 's/^### /#### /; s/^## /### /' "$ACCELERATOR_ONLINE_REPORT"
2528	5	echo ""
2529		fi
2530		fi
2531
2532	19	if [ "$DOCKERFILE_COUNT" -gt 0 ]; then
2533	4	echo "## Dockerfile.dev Pins"
2534	4	echo ""
2535	4	echo "Tooling versions pinned as build-time ARGs in \`Dockerfile.dev\`."
2536	4	echo ""
2537	8	dockerfile_disp="$(mktemp)"
2538	72	while IFS='\|' read -r pin cur lat; do
2539	32	echo "\`${pin}\`\|${cur}\|${lat}"
2540		done < "$DOCKERFILE_RESULTS" > "$dockerfile_disp"
2541	4	emit_md_table "Pin\|Current\|Latest" "$dockerfile_disp"
2542	4	rm -f "$dockerfile_disp"
2543	4	echo ""
2544		fi
2545
2546	19	if [ "$AUTOPILOT_COUNT" -gt 0 ]; then
2547	7	echo "## GCO Autopilot Pins"
2548	7	echo ""
2549	7	echo "\`gco autopilot\`'s dependency surfaces in \`cli/autopilot.py\`: the"
2550	7	echo "pinned \`CLAUDE_CODE_VERSION\` and \`CODEX_VERSION\` agent CLIs"
2551	7	echo "(each compared against its npm \`latest\` dist-tag) and the launch-time"
2552	7	echo "companion MCP servers"
2553	7	echo "(reported when a package is missing, deprecated, or yanked on its"
2554	7	echo "registry — an unhealthy companion breaks every new session, so treat"
2555	7	echo "it like the removals documented in \`gco_mcp/README.md\`). When"
2556	7	echo "changing the companion set, update \`cli/autopilot.py\` and the"
2557	7	echo "\`gco_mcp/README.md\` tables together; \`tests/test_cli_autopilot.py\`"
2558	7	echo "enforces the lockstep."
2559	7	echo ""
2560	14	autopilot_disp="$(mktemp)"
2561	42	while IFS='\|' read -r surface cur stat url; do
2562	14	echo "${surface}\|\`${cur}\`\|${stat}\|[registry](${url})"
2563		done < "$AUTOPILOT_RESULTS" > "$autopilot_disp"
2564	7	emit_md_table "Surface\|Current\|Latest / status\|Ref" "$autopilot_disp"
2565	7	rm -f "$autopilot_disp"
2566	7	echo ""
2567		fi
2568
2569	19	if [ "$PRECOMMIT_COUNT" -gt 0 ]; then
2570	5	echo "## Pre-commit Hooks"
2571	5	echo ""
2572	5	echo "Hook \`rev:\` pins in \`.pre-commit-config.yaml\` are behind the latest"
2573	5	echo "tag published by their upstream repos. Bump in \`.pre-commit-config.yaml\`,"
2574	5	echo "then run \`pre-commit autoupdate\` locally (or edit by hand) and verify"
2575	5	echo "the hooks still pass."
2576	5	echo ""
2577	10	precommit_disp="$(mktemp)"
2578	34	while IFS='\|' read -r repo cur lat; do
2579	12	echo "${repo}\|\`${cur}\`\|\`${lat}\`\|[releases](${repo}/releases)"
2580		done < "$PRECOMMIT_RESULTS" > "$precommit_disp"
2581	5	emit_md_table "Repo\|Current\|Latest\|Ref" "$precommit_disp"
2582	5	rm -f "$precommit_disp"
2583	5	echo ""
2584		fi
2585
2586	19	if [ "$CDK_ENUM_COUNT" -gt 0 ]; then
2587	3	echo "## CDK Enum Constants"
2588	3	echo ""
2589	3	echo "Enum-name constants in \`gco/stacks/constants.py\` are behind the highest"
2590	3	echo "enum member exposed by the installed \`aws-cdk-lib\`. Update the constant"
2591	3	echo "in \`constants.py\` (and any related deployment notes) so new stacks"
2592	3	echo "construct the latest CDK enum."
2593	3	echo ""
2594	3	emit_md_table "Constant\|CDK enum class\|Current\|Latest" "$CDK_ENUM_RESULTS" code
2595	3	echo ""
2596		fi
2597
2598	19	if [ "$PYTHON_RELEASE_COUNT" -gt 0 ]; then
2599	4	echo "## Python Release"
2600	4	echo ""
2601	4	echo "A newer stable Python release is available on python.org than the version"
2602	4	echo "encoded by \`LAMBDA_PYTHON_RUNTIME\`. AWS Lambda may lag the upstream"
2603	4	echo "release by a few months — wait for the matching \`Runtime.PYTHON_X_Y\`"
2604	4	echo "enum to appear in \`aws-cdk-lib\` (tracked by the CDK Enum Constants"
2605	4	echo "section above) before bumping. See <https://www.python.org/downloads/>."
2606	4	echo ""
2607	4	emit_md_table "Surface\|Current\|Latest" "$PYTHON_RELEASE_RESULTS"
2608	4	echo ""
2609		fi
2610
2611	19	if [ "$RUNNER_IMAGE_COUNT" -gt 0 ]; then
2612	1	echo "## Runner Images"
2613	1	echo ""
2614	1	echo "A \`runs-on:\` label below is behind a newer generally-available image,"
2615	1	echo "or names one upstream has deprecated (a deprecated image is a removal"
2616	1	echo "notice with a date attached). Images still in preview are deliberately"
2617	1	echo "not listed here — see the notes under the skipped/collapsed section for"
2618	1	echo "those, since moving to a preview trades a stable CI platform for an"
2619	1	echo "unannounced one. Update the \`runs-on:\` value in the named workflow job."
2620	1	echo "See <https://github.com/actions/runner-images#available-images>."
2621	1	echo ""
2622	1	emit_md_table "Label\|Current image\|Recommended" "$RUNNER_IMAGE_RESULTS"
2623	1	echo ""
2624		fi
2625
2626	19	if [ "$RUBY_RELEASE_COUNT" -gt 0 ]; then
2627	4	echo "## Ruby Release"
2628	4	echo ""
2629	4	echo "A newer stable Ruby series is supported upstream than the one pinned in"
2630	4	echo "\`.ruby-version\`. Ruby is CI-only — \`bundle exec bashcov\` measures shell"
2631	4	echo "coverage in the \`unit:bats:shell\` job — so bumping is low risk, but it is"
2632	4	echo "still a deliberate move: check that \`ruby/setup-ruby\` publishes a prebuilt"
2633	4	echo "binary for the new series and that \`bashcov\` supports it, then update"
2634	4	echo "\`.ruby-version\` and re-resolve \`Gemfile.lock\`."
2635	4	echo "See <https://endoflife.date/ruby>."
2636	4	echo ""
2637	4	emit_md_table "Surface\|Current\|Latest" "$RUBY_RELEASE_RESULTS"
2638	4	echo ""
2639		fi
2640
2641		# ----- New coverage surfaces -----
2642
2643	19	if [ "$CI_TOOLING_COUNT" -gt 0 ]; then
2644	5	echo "## CI Tooling"
2645	5	echo ""
2646	5	echo "Tool versions the workflows install by hand — not \`uses:\` refs or"
2647	5	echo "Dockerfile \`FROM\` lines, so Dependabot doesn't watch them. A stale"
2648	5	echo "Trivy in particular means the CVE scan silently misses newer"
2649	5	echo "detections; bump the \`*_VERSION\` env / kind-action inputs in lockstep."
2650	5	echo ""
2651	10	ci_disp="$(mktemp)"
2652	92	while IFS='\|' read -r name cur lat url; do
2653	41	echo "${name}\|\`${cur}\`\|\`${lat}\`\|[releases](${url})"
2654		done < "$CI_TOOLING_RESULTS" > "$ci_disp"
2655	5	emit_md_table "Tool\|Current\|Latest\|Ref" "$ci_disp"
2656	5	rm -f "$ci_disp"
2657	5	echo ""
2658		fi
2659
2660	19	if [ "$CONSISTENCY_COUNT" -gt 0 ]; then
2661	4	echo "## Version Consistency"
2662	4	echo ""
2663	4	echo "These versions and dependency-management surfaces must move together."
2664	4	echo "The rows below identify missing coverage or disagreement across runtime,"
2665	4	echo "package, dev-container, pre-commit, and CI pins."
2666	4	echo ""
2667	4	emit_md_table "What\|Pinned values" "$CONSISTENCY_RESULTS"
2668	4	echo ""
2669		fi
2670
2671	19	if [ "$EPOCH_COUNT" -gt 0 ]; then
2672	5	echo "## Base-image Security Epochs"
2673	5	echo ""
2674	5	echo "The build-time \`*_SECURITY_EPOCH\` ARGs bust the CI layer cache so a"
2675	5	echo "fresh OS-security-upgrade layer is built. An epoch older than"
2676	5	echo "${SECURITY_EPOCH_STALE_DAYS} days may be reusing a stale upgrade layer —"
2677	5	echo "bump the date to force a rebuild that pulls current patches."
2678	5	echo ""
2679	10	epoch_disp="$(mktemp)"
2680	20	while IFS='\|' read -r df arg edate eage; do
2681	5	echo "\`${df}\`\|\`${arg}\`\|${edate}\|${eage}"
2682		done < "$EPOCH_RESULTS" > "$epoch_disp"
2683	5	emit_md_table "Dockerfile\|ARG\|Epoch\|Age (days)" "$epoch_disp"
2684	5	rm -f "$epoch_disp"
2685	5	echo ""
2686		fi
2687
2688	19	if [ "$SUPPRESSION_COUNT" -gt 0 ]; then
2689	3	echo "## Suppression Expiries"
2690	3	echo ""
2691	3	echo "\`.trivyignore\` / \`.pip-audit-ignore\` / \`.npm-audit-ignore\` entries"
2692	3	echo "expiring within ${SUPPRESSION_EXPIRY_WARN_DAYS} days (the CI validator hard-fails a PR on"
2693	3	echo "the expiry date). Re-evaluate each: drop it if the CVE is fixed upstream,"
2694	3	echo "or extend with a fresh justification if not."
2695	3	echo ""
2696	6	sup_disp="$(mktemp)"
2697	12	while IFS='\|' read -r sbase sid sdate sleft; do
2698	3	echo "\`${sbase}\`\|\`${sid}\`\|${sdate}\|${sleft}"
2699		done < "$SUPPRESSION_RESULTS" > "$sup_disp"
2700	3	emit_md_table "File\|ID\|Expires\|Days left" "$sup_disp"
2701	3	rm -f "$sup_disp"
2702	3	echo ""
2703		fi
2704
2705	19	if [ "$LOCKFILE_COUNT" -gt 0 ]; then
2706	2	echo "## Lockfile Freshness"
2707	2	echo ""
2708	2	echo "Direct dependencies whose exact pyproject.toml pin is missing from or"
2709	2	echo "different in requirements-lock.txt. Regenerate the lock with"
2710	2	echo "pip-compile --all-extras --strip-extras -o requirements-lock.txt pyproject.toml."
2711	2	echo ""
2712	2	emit_md_table "Dependency\|Expected\|Locked" "$LOCKFILE_RESULTS" code
2713	2	echo ""
2714		fi
2715
2716		# ----- Skipped checks (collapsed) -----
2717	19	if [ -n "${ADDON_SKIP_REASON}${EKS_K8S_SKIP_REASON}${AURORA_SKIP_REASON}${EMR_SKIP_REASON}${BEDROCK_MODEL_SKIP_REASON}${ACCELERATOR_SKIP_REASON}${AUTOPILOT_SKIP_REASON}${CDK_ENUM_SKIP_REASON}${PYTHON_RELEASE_SKIP_REASON}${RUBY_RELEASE_SKIP_REASON}${RUNNER_IMAGE_SKIP_REASON}" ] \
2718	13	\|\| [ -s "$INCOMPLETE_REASONS_FILE" ]; then
2719	9	echo "<details>"
2720	9	echo "<summary>Skipped checks</summary>"
2721	9	echo ""
2722	12	[ -n "$ADDON_SKIP_REASON" ] && echo "- EKS Add-ons: $ADDON_SKIP_REASON"
2723	13	[ -n "$EKS_K8S_SKIP_REASON" ] && echo "- EKS Kubernetes Version: $EKS_K8S_SKIP_REASON"
2724	12	[ -n "$AURORA_SKIP_REASON" ] && echo "- Aurora PostgreSQL Engine: $AURORA_SKIP_REASON"
2725	14	[ -n "$EMR_SKIP_REASON" ] && echo "- EMR Serverless: $EMR_SKIP_REASON"
2726	13	[ -n "$BEDROCK_MODEL_SKIP_REASON" ] && echo "- Bedrock Default Model: $BEDROCK_MODEL_SKIP_REASON"
2727	10	[ -n "$ACCELERATOR_SKIP_REASON" ] && echo "- Online Accelerator Catalog: $ACCELERATOR_SKIP_REASON"
2728	12	[ -n "$AUTOPILOT_SKIP_REASON" ] && echo "- GCO Autopilot Pins: $AUTOPILOT_SKIP_REASON"
2729	10	[ -n "$CDK_ENUM_SKIP_REASON" ] && echo "- CDK Enum Constants: $CDK_ENUM_SKIP_REASON"
2730	11	[ -n "$PYTHON_RELEASE_SKIP_REASON" ] && echo "- Python Release: $PYTHON_RELEASE_SKIP_REASON"
2731	11	[ -n "$RUBY_RELEASE_SKIP_REASON" ] && echo "- Ruby Release: $RUBY_RELEASE_SKIP_REASON"
2732	10	[ -n "$RUNNER_IMAGE_SKIP_REASON" ] && echo "- Runner Images: $RUNNER_IMAGE_SKIP_REASON"
2733	9	if [ -s "$INCOMPLETE_REASONS_FILE" ]; then
2734	196	while IFS= read -r incomplete_reason; do
2735	90	echo "- Incomplete lookup or parse: ${incomplete_reason}"
2736		done < <(sort -u "$INCOMPLETE_REASONS_FILE")
2737		fi
2738	9	echo ""
2739	9	echo "</details>"
2740	9	echo ""
2741		fi
2742
2743	19	echo "## Action Required"
2744	19	echo ""
2745	19	echo "1. Review changelogs for breaking changes (see the per-row Ref links)"
2746	19	echo "2. Follow accelerator findings exactly; review lifecycle/generation metadata"
2747	19	echo " before running \`python scripts/accelerator_catalog.py refresh\`"
2748	19	echo "3. Update versions in \`pyproject.toml\`, manifests, \`charts.yaml\`, or the"
2749	19	echo " pinned \`*_VERSION\` env / ARG values"
2750	19	echo "4. Regenerate \`requirements-lock.txt\` if Python deps changed"
2751	19	echo "5. Reconcile any Version Consistency rows so every copy of a pin agrees"
2752	19	echo "6. Run tests locally to verify compatibility, then open a PR"
2753	19	echo ""
2754	19	echo "---"
2755	19	echo "_Automatically created by the \`deps-scan\` workflow._"
2756		} > "$REPORT_FILE"
2757
2758	19	rm -f "$NPM_RESULTS" "$DOCKER_RESULTS" "$HELM_RESULTS" "$ADDON_RESULTS" "$EKS_K8S_RESULTS" "$AURORA_RESULTS" "$EMR_RESULTS" "$DOCKERFILE_RESULTS" "$AUTOPILOT_RESULTS" "$PRECOMMIT_RESULTS" "$CDK_ENUM_RESULTS" "$PYTHON_RELEASE_RESULTS" "$RUBY_RELEASE_RESULTS" "$RUNNER_IMAGE_RESULTS" "$RUNNER_IMAGE_NOTES" "$BEDROCK_MODEL_RESULTS" "$CI_TOOLING_RESULTS" "$CONSISTENCY_RESULTS" "$EPOCH_RESULTS" "$SUPPRESSION_RESULTS" "$LOCKFILE_RESULTS" "$ACCELERATOR_OFFLINE_REPORT" "$ACCELERATOR_ONLINE_REPORT" "$ACCELERATOR_ONLINE_SUMMARY" "$ACCELERATOR_OFFLINE_ERROR" "$ACCELERATOR_ONLINE_ERROR" "$INCOMPLETE_REASONS_FILE"
2759
2760	19	if [ -n "${GITHUB_OUTPUT:-}" ]; then
2761		{
2762	19	echo "has_drift=true"
2763	19	echo "scan_complete=$SCAN_COMPLETE"
2764	19	echo "report_path=$REPORT_FILE"
2765		} >> "$GITHUB_OUTPUT"
2766		fi
2767
2768		# Mirror the report into the workflow run's job summary so results are visible
2769		# on the Actions run page even for workflow_dispatch runs and regardless of
2770		# whether an issue is opened.
2771	19	if [ -n "${GITHUB_STEP_SUMMARY:-}" ]; then
2772	19	cat "$REPORT_FILE" >> "$GITHUB_STEP_SUMMARY"
2773		fi
2774
2775	19	echo ""
2776	19	echo "Wrote report to $REPORT_FILE"