`.github/scripts/dependency-scan.sh`

1532 of 1532 statements covered (100.00%).

coveredmissednever traced by Bash (not counted)A line ending in … continues the statement above it and shares its fate.

1		#!/usr/bin/env bash
2		# =============================================================================
3		# dependency-scan.sh — check Python, Node.js, Docker, Helm, and EKS versions
4		# =============================================================================
5		#
6		# Invoked by .github/workflows/deps-scan.yml (monthly schedule).
7		#
8		# Checks for drift across:
9		#
10		# - Python packages pinned in pyproject.toml
11		# - Docker images referenced from workflows, K8s manifests, examples,
12		# local live-validation manifests, and Helm chart values
13		# - Helm chart versions from charts.yaml
14		# - EKS add-on versions from gco/stacks/constants.py (AWS creds)
15		# - EKS Kubernetes minor from cdk.json (AWS creds)
16		# - Aurora PostgreSQL engine versions (AWS creds)
17		# - EMR Serverless release labels (AWS creds)
18		# - Bedrock default model ids from cdk.json
19		# context.bedrock.mission_default_model_id (Mission sampling),
20		# context.bedrock.capacity_advisor_default_model_id (capacity advisor),
21		# context.bedrock.claude_code_default_model_id (Claude Autopilot),
22		# context.bedrock.codex_default_model_id (Codex Autopilot),
23		# context.bedrock.opencode_default_model_id (OpenCode Autopilot),
24		# context.bedrock.embedding_model_id (Mission memory), and
25		# context.vector_store.embedding_model_id (workload RAG corpus), each
26		# compared against the newest same-family release — inference profiles
27		# for the generation keys, EMBEDDING foundation models for the embedding
28		# keys (AWS creds)
29		# - Accelerator catalog and Karpenter NodePool policy (offline), plus live
30		# NVIDIA GPU / AWS Neuron EC2 catalog drift across enabled Regions (AWS creds)
31		# - Dockerfile.dev ARG pins (Node LTS major, npm, CDK CLI, kubectl,
32		# AWS CLI v2, Docker CLI, Docker Buildx, uv) and the immutable AWS CLI
33		# runtime image in gco/services/inference_monitor.py — public registries,
34		# no AWS creds needed
35		# - GCO Autopilot pins from cli/autopilot.py: CLAUDE_CODE_VERSION,
36		# CODEX_VERSION and OPENCODE_VERSION install pins vs their npm latest
37		# dist-tags, plus companion MCP server liveness (missing/deprecated/yanked
38		# on npm or PyPI) — public endpoints, no AWS creds needed
39		# - Pre-commit hook revisions in .pre-commit-config.yaml compared
40		# against the latest tag published upstream (GitHub API)
41		# - CDK enum constants from gco/stacks/constants.py compared against the
42		# installed aws-cdk-lib (LAMBDA_PYTHON_RUNTIME, LAMBDA_NODEJS_RUNTIME;
43		# the Aurora engine is a plain version string checked against live RDS)
44		# - Latest stable Python release from endoflife.date — public endpoint
45		# - CI tooling the workflows install by hand: Trivy (the install-trivy
46		# composite action's version default),
47		# actionlint (ACTIONLINT_VERSION), Helm and kubectl (HELM_VERSION /
48		# KUBECTL_VERSION), kubeconform (KUBECONFORM_VERSION), Calico
49		# (CALICO_VERSION), Metrics Server (METRICS_SERVER_VERSION), kind + its
50		# node image, and the Crossplane function-go-templating package
51		# post-helm-crossplane.yaml installs — public endpoints, no AWS creds
52		# - Version consistency: ruff (pyproject / pre-commit / lint workflow),
53		# Python and Node runtime pins, npm packageManager + CDK CLI pins, every
54		# owned npm graph's lockfile/Dependabot coverage, duplicated *_VERSION
55		# workflow environment pins, every per-Lambda requirements.txt pin
56		# against the version resolved centrally, and digest-pinned images
57		# carrying two digests under one tag
58		# - Base-image security epochs (APT_SECURITY_EPOCH / DNF_SECURITY_EPOCH)
59		# older than SECURITY_EPOCH_STALE_DAYS
60		# - Suppression expiries: .trivyignore / .pip-audit-ignore /
61		# .npm-audit-ignore entries expiring within SUPPRESSION_EXPIRY_WARN_DAYS
62		# (before the CI validator hard-fails)
63		# - Lockfile freshness: direct deps in pyproject.toml missing from or pinned
64		# differently in requirements-lock.txt
65		#
66		# Ports the `.dependency-scan-script` YAML anchor from the retired
67		# GitLab pipeline into a standalone shell script. Two behavior changes:
68		#
69		# 1. Workflow file input. The GitLab version grepped `.gitlab-ci.yml` for
70		# CI image tags. This version scans every file under
71		# `$WORKFLOWS_DIR` (default: `.github/workflows`).
72		# 2. Reporting. The GitLab version POSTed directly to the GitLab issues
73		# API. This version writes a Markdown report to a file and emits
74		# `has_drift=true\|false`, `scan_complete=true\|false`, and `report_path=…`
75		# on $GITHUB_OUTPUT so the calling workflow can manage a rolling issue.
76		#
77		# Environment inputs:
78		# WORKFLOWS_DIR default: .github/workflows
79		#
80		# Outputs (via $GITHUB_OUTPUT):
81		# has_drift "true" when any version is outdated, else "false"
82		# scan_complete "false" when any check fails or is explicitly skipped,
83		# else "true"
84		# report_path path to the Markdown report (only set when has_drift=true)
85		# =============================================================================
86	35	set -uo pipefail
87
88	35	WORKFLOWS_DIR="${WORKFLOWS_DIR:-.github/workflows}"
89	70	REPORT_FILE="$(mktemp -t dep-scan-XXXXXX.md 2>/dev/null \|\| mktemp --suffix=.md)"
90		# The same findings as JSON, for anything that acts on them without parsing
91		# prose (see the "Machine-readable findings" helpers in lib_dependency_scan.sh).
92		# Written on every run, drift or not, next to the Markdown report.
93	35	FINDINGS_FILE="${REPORT_FILE%.md}.json"
94	70	FINDINGS_SURFACES="$(mktemp)"
95	70	INCOMPLETE_REASONS_FILE="$(mktemp -t dep-scan-incomplete-XXXXXX 2>/dev/null \|\| mktemp)"
96
97		# Persist incomplete reasons to a file because many checks run in pipeline
98		# subshells. A shell variable assignment made there would be lost, while an
99		# append to this channel survives and is consumed by the final completeness
100		# predicate. Messages go to stderr so they cannot corrupt command substitutions.
101		mark_scan_incomplete() {
102	154	local reason="$1"
103	154	printf '%s\n' "$reason" >> "$INCOMPLETE_REASONS_FILE"
104	154	echo " INCOMPLETE: $reason" >&2
105		}
106
107		join_scan_incomplete_reasons() {
108	15	sort -u "$INCOMPLETE_REASONS_FILE" \
109	15	\| awk 'BEGIN { first = 1 } { if (!first) printf "; "; printf "%s", $0; first = 0 } END { print "" }'
110		}
111
112		# Source shared functions (also used by BATS tests)
113	140	SCAN_SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
114		# shellcheck source=.github/scripts/lib_dependency_scan.sh
115	35	source "${SCAN_SCRIPT_DIR}/lib_dependency_scan.sh"
116
117		# ---------------------------------------------------------------------------
118		# Report helpers
119		#
120		# Small Markdown emitters shared by every section of the drift report so the
121		# table formatting lives in one place — previously each section hand-rolled
122		# its own ``\| … \|`` header + separator, which drifted as sections were added.
123		# ``emit_md_table`` turns a pipe-delimited results file into a GitHub table;
124		# ``md_anchor`` builds the in-page heading slug the top-of-report summary
125		# links to.
126		#
127		# Thresholds for the recurring-hygiene checks. Tunable in one place:
128		# SUPPRESSION_EXPIRY_WARN_DAYS surface .trivyignore / .pip-audit-ignore /
129		# .npm-audit-ignore entries expiring within
130		# this many days
131		# (the CI validator still hard-fails on the
132		# day itself — this is the early warning).
133		# SECURITY_EPOCH_STALE_DAYS flag a Dockerfile APT/DNF security epoch
134		# older than this many days.
135		# ---------------------------------------------------------------------------
136	35	SUPPRESSION_EXPIRY_WARN_DAYS="${SUPPRESSION_EXPIRY_WARN_DAYS:-30}"
137	35	SECURITY_EPOCH_STALE_DAYS="${SECURITY_EPOCH_STALE_DAYS:-45}"
138
139		# md_anchor <title> — GitHub heading slug (lowercase, punctuation dropped,
140		# spaces → hyphens). Close enough to GitHub's own algorithm for the
141		# summary-table links to resolve.
142		md_anchor() {
143	529	printf '%s' "$1" \
144	529	\| tr '[:upper:]' '[:lower:]' \
145	529	\| sed -E 's/[^a-z0-9 -]//g; s/ /-/g'
146		}
147
148		# emit_md_table <header> <results-file> [wrap]
149		#
150		# <header> pipe-delimited column labels, e.g. "Package\|Current\|Latest"
151		# <results-file> file of pipe-delimited rows with the same column count
152		# [wrap] when "code", every non-empty cell is wrapped in backticks
153		#
154		# Prints a GitHub-flavoured Markdown table. With no wrap, cells are emitted
155		# verbatim, so a caller that wants a link in a cell just writes the
156		# ``[text](url)`` markdown straight into the results file.
157		emit_md_table() {
158	146	local header="$1" file="$2" wrap="${3:-}"
159	146	local -a cells cols
160	292	IFS='\|' read -r -a cells <<< "$header"
161	146	local head="\|" sep="\|" c
162	514	for c in "${cells[@]}"; do
163	514	head+=" ${c} \|"
164	514	sep+="---\|"
165		done
166	146	printf '%s\n%s\n' "$head" "$sep"
167	1426	while IFS='\|' read -r -a cols; do
168	567	[ "${#cols[@]}" -eq 0 ] && continue
169	567	local row="\|" cell
170	1958	for cell in "${cols[@]}"; do
171	2020	if [ "$wrap" = "code" ] && [ -n "$cell" ]; then
172	62	row+=" \`${cell}\` \|"
173		else
174	1896	row+=" ${cell} \|"
175		fi
176		done
177	567	printf '%s\n' "$row"
178		done < "$file"
179		}
180
181		# days_until <YYYY-MM-DD> — integer days from today to the given date
182		# (negative when the date is in the past). Empty output on a malformed date.
183		days_until() {
184	106	python3 -c "
185		import datetime, sys
186		try:
187		d = datetime.date.fromisoformat(sys.argv[1])
188		except Exception:
189		sys.exit(0)
190		print((d - datetime.date.today()).days)
191		" "$1" 2>/dev/null
192		}
193
194		# days_since <YYYY-MM-DD> — integer days from the given date to today
195		# (negative when the date is in the future). Empty output on a malformed date.
196		days_since() {
197	111	python3 -c "
198		import datetime, sys
199		try:
200		d = datetime.date.fromisoformat(sys.argv[1])
201		except Exception:
202		sys.exit(0)
203		print((datetime.date.today() - d).days)
204		" "$1" 2>/dev/null
205		}
206
207		# ---------------------------------------------------------------------------
208		# Python packages
209		#
210		# We run ``pip list --outdated`` on the installed interpreter, but
211		# filter the JSON result down to packages we pin directly in
212		# ``pyproject.toml::[project.dependencies]`` or the
213		# ``[project.optional-dependencies]`` groups. Every other outdated
214		# entry is a transitive dependency — its version is controlled by
215		# something we pin (``jsii``, ``aws-cdk-lib``, ``fastmcp``,
216		# ``botocore``, …) and bumping it ourselves either does nothing or
217		# breaks the resolver. Leaving those entries in the monthly scan
218		# report was creating noise: the operator had no action to take on
219		# them beyond "wait for upstream". Filter them out so the report
220		# only lists packages we can act on.
221		#
222		# The ``[build-system]`` requires pins (the exact-pinned build backend)
223		# are appended to the same surface below via a direct PyPI lookup — pip
224		# resolves them inside build isolation, so ``pip list`` never sees them.
225		# ---------------------------------------------------------------------------
226	35	echo "=== Checking for outdated Python dependencies ==="
227	35
228	35	# Install the project with EVERY optional-dependency group, not just the
229	35	# base dependencies: ``pip list --outdated`` can only report packages that
230	35	# are installed, so a base-only install silently dropped pins that live
231	35	# exclusively in an extras group (``aws-cdk-lib`` in ``cdk``, ``playwright``
232	35	# in ``diagrams``, ``mypy`` in ``typecheck``, ...) even though
233	35	# ``extract_direct_python_deps`` already includes them in the direct-pin
234	35	# filter below. Groups are enumerated from pyproject.toml so a new extras
235	35	# group joins the surface automatically; if enumeration fails, fall back to
236	35	# the old base-only install rather than dropping the report section.
237	105	PYTHON_EXTRAS="$(extract_python_extras pyproject.toml \| paste -sd, -)"
238	35	if [ -z "$PYTHON_EXTRAS" ]; then
239	1	mark_scan_incomplete "Could not enumerate optional dependency groups from pyproject.toml."
240		fi
241	35	if [ -n "$PYTHON_EXTRAS" ]; then
242	34	echo "Installing with extras: [${PYTHON_EXTRAS}]"
243	34	if ! pip install -e ".[${PYTHON_EXTRAS}]" --quiet --root-user-action=ignore; then
244	1	mark_scan_incomplete "Python dependency installation failed."
245		fi
246		else
247	1	if ! pip install -e . --quiet --root-user-action=ignore; then
248	1	mark_scan_incomplete "Python dependency installation failed and optional groups could not be enumerated."
249		fi
250		fi
251	70	if ! OUTDATED_RAW="$(pip list --outdated --format=json)"; then
252	1	mark_scan_incomplete "pip list --outdated failed."
253	1	OUTDATED_RAW="[]"
254	68	elif ! printf '%s' "$OUTDATED_RAW" \| jq -e 'type == "array"' >/dev/null 2>&1; then
255	1	mark_scan_incomplete "pip list --outdated returned malformed JSON."
256	1	OUTDATED_RAW="[]"
257		fi
258
259		# Build a newline-separated list of PEP-503-normalised direct-dep names.
260		# An empty list disables the filter so we never silently hide drift when
261		# the TOML parse breaks. In practice the file always parses — we just
262		# can't risk a dropped report section.
263	70	DIRECT_DEPS="$(extract_direct_python_deps pyproject.toml)"
264	35	if [ -z "$DIRECT_DEPS" ]; then
265	1	mark_scan_incomplete "Could not parse direct Python dependencies from pyproject.toml."
266		fi
267
268	105	if ! OUTDATED="$(printf '%s' "$OUTDATED_RAW" \| python3 -c "
269	105	import json, re, sys
270	105	raw = sys.stdin.read()
271	105	direct = set(
272	105	line.strip() for line in '''$DIRECT_DEPS'''.splitlines() if line.strip()
273	105	)
274	105	try:
275	105	data = json.loads(raw) if raw else []
276	105	except json.JSONDecodeError:
277	105	raise SystemExit(1)
278	105	if direct:
279	105	data = [
280	105	e for e in data
281	105	if re.sub(r'[-_.]+', '-', e.get('name', '')).lower() in direct
282	105	]
283	105	print(json.dumps(data))
284	105	")"; then
285	1	mark_scan_incomplete "Could not parse or filter pip's outdated-package response."
286	1	OUTDATED="[]"
287		fi
288
289		# Build-backend pins ([build-system] requires) are Python dependencies
290		# too, but they are invisible to ``pip list --outdated``: pip resolves
291		# them inside build isolation, not in this venv (a Python 3.14 venv does
292		# not even ship setuptools). Compare each exact pin against its PyPI
293		# latest and report it through the same Python-packages surface as every
294		# other pyproject pin. Non-exact entries are skipped here — the
295		# version-consistency section flags those as a policy finding.
296	70	BUILD_SYSTEM_PINS="$(extract_build_system_pins pyproject.toml)"
297	35	if [ -z "$BUILD_SYSTEM_PINS" ]; then
298	1	mark_scan_incomplete "Could not parse [build-system] requirements from pyproject.toml."
299		else
300	136	while IFS='\|' read -r bs_name bs_version bs_raw; do
301		# Only exact pins are compared; non-exact entries surface through
302		# the version-consistency policy check instead.
303	68	if [ -z "$bs_name" ] \|\| [ -z "$bs_version" ]; then
304	1	continue
305		fi
306	131	if ! bs_latest="$(curl -fsSL --max-time 15 "${SCAN_CURL_RETRY[@]}" \
307		"https://pypi.org/pypi/${bs_name}/json" 2>/dev/null \
308		\| jq -r '.info.version // empty' 2>/dev/null)" \|\| [ -z "$bs_latest" ]; then
309	1	mark_scan_incomplete "PyPI lookup failed or returned an invalid version for build dependency ${bs_name}."
310	1	continue
311		fi
312	64	if [ "$(compare_semver "$bs_version" "$bs_latest")" = "newer" ]; then
313	24	OUTDATED="$(echo "$OUTDATED" \| jq \
314		--arg name "$bs_name" --arg cur "$bs_version" --arg latest "$bs_latest" \
315		'. + [{"name": $name, "version": $cur, "latest_version": $latest}]')"
316		fi
317		done <<< "$BUILD_SYSTEM_PINS"
318		fi
319
320	105	PYTHON_COUNT="$(echo "$OUTDATED" \| jq 'length')"
321	35	if [ "$PYTHON_COUNT" -eq 0 ]; then
322	27	echo "All Python dependencies are up to date."
323	27	PYTHON_OUTDATED=""
324		else
325	8	echo "Found $PYTHON_COUNT outdated Python package(s) (direct dependencies only — transitive bumps are upstream's job)"
326	16	echo "$OUTDATED" \| jq -r '.[] \| " - \(.name): \(.version) -> \(.latest_version)"'
327	8	PYTHON_OUTDATED="$OUTDATED"
328		fi
329
330		# ---------------------------------------------------------------------------
331		# npm packages (every repository-owned graph)
332		# ---------------------------------------------------------------------------
333		# Direct npm dependencies never had a drift surface of their own: aws-cdk and
334		# markdownlint-cli2 only leaked into the report indirectly (via the
335		# Dockerfile.dev ARG and the pre-commit hook rev), and the
336		# inference-streaming-proxy's @aws-sdk clients were reported nowhere at all.
337		# This walks the same repository-owned graphs the npm package-management
338		# check validates and compares each exact direct pin against the registry's
339		# ``latest`` dist-tag — the npm analogue of the Python Packages surface.
340	35	echo ""
341	35	echo "=== Checking for outdated npm packages ==="
342	35
343	70	NPM_RESULTS="$(mktemp)"
344	35	NPM_COUNT=0
345
346	70	NPM_PACKAGE_DIRS="$(list_npm_package_dirs .)"
347	35	if [ -z "$NPM_PACKAGE_DIRS" ]; then
348	1	mark_scan_incomplete "Could not enumerate repository-owned npm package manifests."
349		fi
350	144	while IFS= read -r package_dir; do
351	38	[ -n "$package_dir" ] \|\| continue
352	36	manifest="${package_dir}/package.json"
353	72	package_pins="$(extract_npm_direct_pins "$manifest")"
354	36	if [ -z "$package_pins" ]; then
355	1	mark_scan_incomplete "Could not parse exact npm dependency pins from ${manifest}."
356	1	continue
357		fi
358	160	while IFS='\|' read -r pkg_name pkg_version; do
359	45	[ -n "$pkg_name" ] \|\| continue
360		# Scoped names carry a '/', which must be encoded in the registry URL.
361	135	encoded_name="$(printf '%s' "$pkg_name" \| sed 's\|/\|%2F\|g')"
362	179	if ! pkg_latest="$(curl -fsSL --max-time 15 "${SCAN_CURL_RETRY[@]}" \
363		"https://registry.npmjs.org/${encoded_name}/latest" 2>/dev/null \
364		\| jq -r '.version // empty' 2>/dev/null)" \|\| [ -z "$pkg_latest" ]; then
365	1	mark_scan_incomplete "npm registry lookup failed or returned an invalid version for ${pkg_name}."
366	1	continue
367		fi
368	88	if [ "$(compare_semver "$pkg_version" "$pkg_latest")" = "newer" ]; then
369	14	echo " - ${package_dir}: ${pkg_name} ${pkg_version} -> ${pkg_latest}"
370	14	echo "${package_dir}\|${pkg_name}\|${pkg_version}\|${pkg_latest}" >> "$NPM_RESULTS"
371		fi
372		done <<< "$package_pins"
373		done <<< "$NPM_PACKAGE_DIRS"
374
375	105	NPM_COUNT="$(wc -l < "$NPM_RESULTS" \| tr -d ' ')"
376	35	if [ "$NPM_COUNT" -eq 0 ]; then
377	27	echo "All npm direct dependencies are up to date."
378		else
379	8	echo "Found $NPM_COUNT outdated npm package pin(s) across the owned graphs"
380		fi
381
382		# ---------------------------------------------------------------------------
383		# Docker image tags
384		# ---------------------------------------------------------------------------
385	35	echo ""
386	35	echo "=== Checking for outdated Docker images ==="
387	35
388	70	DOCKER_RESULTS="$(mktemp)"
389	70	ALL_IMAGES="$(mktemp)"
390
391		check_image() {
392	375	local image="$1"
393	375	local current_tag="$2"
394
395		# Only handle semver tags
396	375	if ! is_semver_tag "$current_tag"; then
397	32	return
398		fi
399		# Skip images we build in this project
400	343	if is_project_image "$image"; then
401	32	return
402		fi
403
404	311	local parsed registry repo
405	622	parsed="$(parse_image_registry "$image")"
406	933	registry="$(echo "$parsed" \| cut -d'\|' -f1)"
407	933	repo="$(echo "$parsed" \| cut -d'\|' -f2)"
408
409		# Fetch and filter separately. A registry/network failure marks the scan
410		# incomplete, while "the registry answered and nothing newer exists in
411		# this variant family" is an up-to-date pin. The previous single pipeline
412		# conflated the two under pipefail: the strict bare-semver grep matched
413		# nothing for suffix-tagged repositories (…-py3, …-cuda…, …-ubuntu…), so
414		# they reported "tag lookup failed" every month even though the registry
415		# was fine.
416	311	local raw_tags=""
417	1228	if ! raw_tags="$(skopeo list-tags "${SCAN_SKOPEO_RETRY[@]}" "docker://${registry}/${repo}" 2>/dev/null \
418		\| jq -r '.Tags[]' 2>/dev/null)" \|\| [ -z "$raw_tags" ]; then
419	24	mark_scan_incomplete "Container registry tag lookup failed for ${registry}/${repo}."
420	24	return
421		fi
422
423	287	local latest_tag
424	861	latest_tag="$(printf '%s\n' "$raw_tags" \| newer_same_variant_tag "$current_tag")" \|\| latest_tag=""
425
426	287	if [ -n "$latest_tag" ]; then
427	71	echo " - ${image}:${current_tag} -> ${latest_tag}"
428	71	echo "${image}\|${current_tag}\|${latest_tag}" >> "$DOCKER_RESULTS"
429	71	return
430		fi
431
432		# No newer family member. If the pinned tag itself is no longer listed,
433		# the pin points at something the registry stopped advertising (renamed
434		# variant scheme, withdrawn tag) — that deserves eyes, not silence.
435		# tag_listed reads the list from an argument, not a printf pipe: under
436		# pipefail, grep -q's early exit gave printf SIGPIPE on large tag lists
437		# and inverted "tag present" into a false INCOMPLETE (2026-09 scan).
438	216	if ! tag_listed "$current_tag" "$raw_tags"; then
439	13	mark_scan_incomplete "Pinned tag ${current_tag} is no longer listed by ${registry}/${repo}."
440		fi
441		}
442
443		# Collect image:tag pairs from workflow files (bare `image:` references in
444		# container specs and `uses: …@sha` are handled by Dependabot; here we look
445		# for free-form image references in run steps).
446	35	echo "Checking workflow files in $WORKFLOWS_DIR..."
447	35	if [ -d "$WORKFLOWS_DIR" ]; then
448	34	grep -rhoE "image: [a-zA-Z0-9_./-]+:[a-zA-Z0-9._-]+" "$WORKFLOWS_DIR" 2>/dev/null \
449	66	\| sed 's/image: //' >> "$ALL_IMAGES" \|\| true
450	34	grep -rhoE "[a-zA-Z0-9_./-]+:[a-zA-Z0-9._-]+" "$WORKFLOWS_DIR" 2>/dev/null \
451	34	\| grep -E '^(alpine\|hadolint\|koalaman\|semgrep\|bridgecrew\|checkmarx\|trufflesecurity\|zricethezav\|aquasec\|bats\|python):' \
452	34	\| sed 's/[[:space:]]*$//' >> "$ALL_IMAGES" \|\| true
453		fi
454
455	35	echo "Checking K8s manifest images..."
456	35	grep -rhoE "image: [a-zA-Z0-9_./-]+:[a-zA-Z0-9._-]+" lambda/kubectl-applier-simple/manifests/ 2>/dev/null \
457	71	\| grep -v '{{' \| sed 's/image: //' >> "$ALL_IMAGES" \|\| true
458
459	35	echo "Checking example manifest images..."
460	35	grep -rhoE "image: [a-zA-Z0-9_./-]+:[a-zA-Z0-9._-]+" examples/ 2>/dev/null \
461	36	\| sed 's/image: //' >> "$ALL_IMAGES" \|\| true
462
463	35	echo "Checking local live-validation manifest images..."
464	35	grep -rhoE "image: [a-zA-Z0-9_./-]+:[a-zA-Z0-9._-]+" scripts/live_release_validation/manifests/ 2>/dev/null \
465	36	\| sed 's/image: //' >> "$ALL_IMAGES" \|\| true
466
467	35	echo "Checking Helm chart value images..."
468		# Registry-aware walk over every charts.yaml values block (see
469		# extract_chart_value_images in lib_dependency_scan.sh — moved there so BATS
470		# exercises the real logic). charts.yaml always pins values images, so an
471		# empty result means the parse broke — surface that as an incomplete scan
472		# rather than silently dropping the sweep.
473	70	CHART_VALUE_IMAGES="$(extract_chart_value_images lambda/helm-installer/charts.yaml)"
474	35	if [ -n "$CHART_VALUE_IMAGES" ]; then
475	32	printf '%s\n' "$CHART_VALUE_IMAGES" >> "$ALL_IMAGES"
476		else
477	3	mark_scan_incomplete "Could not parse Helm chart value images."
478		fi
479
480		# Mooncake default image — pinned as a Python constant in cli/images.py
481		# (_DISAGGREGATED_DEFAULT_IMAGE), so it is invisible to Dependabot (docker
482		# ecosystem) and to the manifest/workflow sweeps above. Add it here so a newer
483		# upstream vLLM release shows up in the monthly drift report — the cue to
484		# validate and bump the pin.
485	35	echo "Checking Mooncake default image (cli/images.py)..."
486	70	MOONCAKE_IMAGE="$(extract_mooncake_default_image cli/images.py)"
487	35	if [ -n "$MOONCAKE_IMAGE" ]; then
488	34	echo "$MOONCAKE_IMAGE" >> "$ALL_IMAGES"
489		else
490	1	mark_scan_incomplete "Could not parse the Mooncake default image from cli/images.py."
491		fi
492
493		# The model-sync init container uses an official AWS CLI image pinned by both
494		# version and manifest-list digest. Strip only the digest for the registry tag
495		# lookup; the offline provenance contract separately requires the digest.
496	35	echo "Checking AWS CLI runtime image (gco/services/inference_monitor.py)..."
497	70	AWS_CLI_RUNTIME_IMAGE="$(extract_python_string_constant \
498		AWS_CLI_IMAGE gco/services/inference_monitor.py)"
499		# check_pinned_digest <repo:tag@sha256:digest> <origin label> [sweep]
500		#
501		# Shared digest-freshness check for every digest-pinned image the repository
502		# commits: verify the tag's currently published manifest-list digest still
503		# equals the committed one. A moved digest is a drift row (the tag was
504		# re-pushed upstream — the pin is stale); an unreachable registry or an
505		# implausible response marks the scan incomplete. The tag also joins the
506		# image sweep below unless <sweep> is ``no``, for a pin whose release drift
507		# another section already reports (the Crossplane Function package's GitHub
508		# release check), so the same release is not reported twice.
509		check_pinned_digest() {
510	138	local pinned_ref="$1" origin="$2" sweep="${3:-yes}" parts repository tag committed published
511	276	if ! parts="$(split_pinned_image_ref "$pinned_ref")"; then
512	1	mark_scan_incomplete "Could not parse an immutable image reference from ${origin}."
513	1	return
514		fi
515	411	repository="$(echo "$parts" \| cut -d'\|' -f1)"
516	411	tag="$(echo "$parts" \| cut -d'\|' -f2)"
517	411	committed="$(echo "$parts" \| cut -d'\|' -f3)"
518	137	if [ "$sweep" != "no" ]; then
519	70	printf '%s:%s\n' "$repository" "$tag" >> "$ALL_IMAGES"
520		fi
521
522	274	if ! published="$(published_manifest_digest "${repository}:${tag}")"; then
523	4	mark_scan_incomplete "Container manifest lookup failed for ${repository}:${tag}."
524	4	return
525		fi
526	133	if [ "$committed" != "$published" ]; then
527	37	echo " - ${repository}:${tag}: committed digest does not match the tag (${origin})"
528	37	echo "${repository}\|${tag}@${committed}\|${tag}@${published}" >> "$DOCKER_RESULTS"
529		fi
530		}
531
532	35	if [[ "$AWS_CLI_RUNTIME_IMAGE" =~ ^[^@]+:[^@]+@sha256:[0-9a-f]{64}$ ]]; then
533	34	check_pinned_digest "$AWS_CLI_RUNTIME_IMAGE" "gco/services/inference_monitor.py"
534		else
535	1	mark_scan_incomplete "Could not parse an immutable AWS_CLI_IMAGE from gco/services/inference_monitor.py."
536		fi
537
538		# The live-validation smoke manifests pin every image by tag AND manifest-list
539		# digest (tests/test_live_release_validation.py enforces the shape). The tag
540		# half already rides the normal drift check above; this pass keeps the digest
541		# half honest too, so an upstream same-tag re-push shows up as drift instead
542		# of silently diverging from what a validation run would actually pull.
543	35	echo "Checking live-validation smoke image digests (scripts/live_release_validation/manifests)..."
544	140	SMOKE_PINNED_REFS="$(grep -rhoE \
545		"image: [a-zA-Z0-9_./-]+:[a-zA-Z0-9._-]+@sha256:[0-9a-f]{64}" \
546		scripts/live_release_validation/manifests/ 2>/dev/null \| sed 's/^image: //' \| sort -u)"
547	35	if [ -z "$SMOKE_PINNED_REFS" ]; then
548	1	mark_scan_incomplete "No digest-pinned smoke images found under scripts/live_release_validation/manifests/."
549		else
550	71	while read -r pinned_ref; do
551	37	[ -z "$pinned_ref" ] && continue
552	37	check_pinned_digest "$pinned_ref" "live-validation smoke manifest"
553		done <<< "$SMOKE_PINNED_REFS"
554		fi
555
556		# The Crossplane Function package post-helm-crossplane.yaml installs is pinned
557		# by release tag AND image-index digest, because Crossplane re-resolves a bare
558		# tag against the registry on every reconcile. Its release drift is the GitHub
559		# release check's (CI tooling, below), so it stays out of the tag sweep; this
560		# pass keeps the digest bound to the tag it names.
561	35	echo "Checking the Crossplane function package digest (post-helm-crossplane.yaml)..."
562	70	FUNCTION_PACKAGE_REFS="$(extract_crossplane_function_packages \
563		lambda/kubectl-applier-simple/manifests/post-helm-crossplane.yaml function-go-templating)"
564	35	if [ -z "$FUNCTION_PACKAGE_REFS" ]; then
565	1	mark_scan_incomplete "Could not parse the Crossplane function-go-templating package from post-helm-crossplane.yaml."
566		else
567	68	while read -r package_ref; do
568	34	check_pinned_digest "$package_ref" "lambda/kubectl-applier-simple/manifests/post-helm-crossplane.yaml" no
569		done <<< "$FUNCTION_PACKAGE_REFS"
570		fi
571
572		# The kind node image CI boots its clusters from is pinned by tag AND digest:
573		# kind rebuilds and re-pushes the same version tag for every kind release, so
574		# the tag alone names a different image after each one. A newer patch within
575		# the pinned minor is the CI tooling check's (below), which also reports a
576		# pin that carries no digest; this pass keeps the digest bound to the tag it
577		# names, out of the tag sweep for the same reason as the Function package.
578	35	echo "Checking the kind node image digest (integration-tests.yml)..."
579	140	KIND_NODE_IMAGE_REF="$(extract_kind_pins .github/workflows/integration-tests.yml \| awk -F'\|' '$1=="kind-node"{print $2}' \| head -1)"
580	35	if split_pinned_image_ref "$KIND_NODE_IMAGE_REF" >/dev/null; then
581	33	check_pinned_digest "$KIND_NODE_IMAGE_REF" ".github/workflows/integration-tests.yml KIND_NODE_IMAGE" no
582		fi
583
584		# One lookup per distinct image: ``python:3.14.8-slim`` and
585		# ``docker.io/library/python:3.14.8-slim`` are the same Docker Hub tag, and
586		# listing them separately doubled both the report row and the registry calls.
587	445	dedupe_image_refs < "$ALL_IMAGES" \| while read -r img; do
588	375	[ -z "$img" ] && continue
589	1125	image="$(echo "$img" \| cut -d':' -f1)"
590	1125	tag="$(echo "$img" \| cut -d':' -f2)"
591	375	check_image "$image" "$tag"
592		done
593	35	rm -f "$ALL_IMAGES"
594
595	105	DOCKER_COUNT="$(wc -l < "$DOCKER_RESULTS" \| tr -d ' ')"
596	35	[ -z "$DOCKER_COUNT" ] && DOCKER_COUNT=0
597
598		# ---------------------------------------------------------------------------
599		# Helm chart versions
600		# ---------------------------------------------------------------------------
601	35	echo ""
602	35	echo "=== Checking Helm chart versions ==="
603	35
604	70	HELM_RESULTS="$(mktemp)"
605	35	CHARTS_FILE="lambda/helm-installer/charts.yaml"
606
607	35	if [ -f "$CHARTS_FILE" ]; then
608	68	CHART_ENTRIES="$(extract_helm_charts "$CHARTS_FILE")"
609	34	if [ -z "$CHART_ENTRIES" ]; then
610	1	mark_scan_incomplete "Could not parse Helm chart pins from ${CHARTS_FILE}."
611		fi
612	322	while IFS= read -r entry; do
613	128	[ -n "$entry" ] \|\| continue
614	378	chart_name="$(echo "$entry" \| jq -r '.name // empty')"
615	378	repo_url="$(echo "$entry" \| jq -r '.repo_url // empty')"
616	378	chart="$(echo "$entry" \| jq -r '.chart // empty')"
617	378	current="$(echo "$entry" \| jq -r '.version // empty')"
618	378	use_oci="$(echo "$entry" \| jq -r '.use_oci // false')"
619	503	if [ -z "$chart_name" ] \|\| [ -z "$repo_url" ] \|\| [ -z "$chart" ] \|\| [ -z "$current" ]; then
620	1	mark_scan_incomplete "Helm chart parser emitted an incomplete record from ${CHARTS_FILE}."
621	1	continue
622		fi
623
624	125	latest=""
625	125	if [ "$use_oci" = "true" ]; then
626	272	if ! latest="$(with_retries 3 helm show chart "${repo_url}/${chart}" 2>/dev/null \| grep '^version:' \| awk '{print $2}')" \
627	64	\|\| [ -z "$latest" ]; then
628	4	mark_scan_incomplete "Helm OCI lookup failed for ${repo_url}/${chart}."
629	4	continue
630		fi
631		else
632	57	if ! with_retries 3 helm repo add "$chart_name" "$repo_url" --force-update > /dev/null 2>&1; then
633	1	mark_scan_incomplete "Helm repository refresh failed for ${chart_name} (${repo_url})."
634	1	continue
635		fi
636	224	if ! latest="$(with_retries 3 helm search repo "${chart_name}/${chart}" --output json 2>/dev/null \
637		\| jq -r '.[0].version // empty')" \|\| [ -z "$latest" ]; then
638	2	mark_scan_incomplete "Helm chart lookup failed for ${chart_name}/${chart}."
639	2	continue
640		fi
641		fi
642
643	118	if [ "$current" != "$latest" ]; then
644	38	current_stripped="${current#v}"
645	38	latest_stripped="${latest#v}"
646	38	if [ "$current_stripped" != "$latest_stripped" ]; then
647	38	echo " - ${chart_name} (${chart}): ${current} -> ${latest}"
648	38	echo "${chart_name}\|${chart}\|${current}\|${latest}" >> "$HELM_RESULTS"
649		fi
650		fi
651		done <<< "$CHART_ENTRIES"
652		else
653	1	mark_scan_incomplete "${CHARTS_FILE} is missing."
654		fi
655
656	105	HELM_COUNT="$(wc -l < "$HELM_RESULTS" 2>/dev/null \| tr -d ' ')"
657	35	[ -z "$HELM_COUNT" ] && HELM_COUNT=0
658
659		# ---------------------------------------------------------------------------
660		# EKS add-on versions (best-effort — requires AWS credentials)
661		#
662		# Pre-flight: probe for usable AWS credentials. If `sts get-caller-identity`
663		# fails the scan is skipped entirely and a one-line note goes into both the
664		# console log and the Markdown report — this is more honest than silently
665		# dropping the section. Wire AWS creds through OIDC (see the deps-scan
666		# section in .github/CI.md) to enable the check.
667		# ---------------------------------------------------------------------------
668	35	echo ""
669	35	echo "=== Checking EKS add-on versions ==="
670	35
671	70	ADDON_RESULTS="$(mktemp)"
672	35	ADDON_SKIP_REASON=""
673	70	K8S_VERSION="$(extract_k8s_version "")"
674
675	35	if ! aws sts get-caller-identity >/dev/null 2>&1; then
676	3	ADDON_SKIP_REASON="No AWS credentials available (scan needs eks:DescribeAddonVersions). Configure OIDC to enable."
677	3	echo " $ADDON_SKIP_REASON"
678		else
679	64	EKS_ADDONS="$(extract_eks_addons "gco/stacks/regional_stack.py")"
680	32	if [ -z "$EKS_ADDONS" ]; then
681	1	ADDON_SKIP_REASON="Could not read EKS add-on pins from gco/stacks/regional_stack.py."
682	1	echo " $ADDON_SKIP_REASON"
683		else
684	352	while IFS='\|' read -r addon_name current_version; do
685	147	[ -z "$addon_name" ] && continue
686	294	latest="$(aws eks describe-addon-versions \
687		--addon-name "$addon_name" \
688		--kubernetes-version "$K8S_VERSION" \
689		--query 'addons[0].addonVersions[0].addonVersion' \
690		--output text 2>/dev/null)" \|\| latest=""
691
692	147	if ! [[ "$latest" =~ ^v[0-9]+\.[0-9]+\.[0-9]+-eksbuild\.[0-9]+$ ]]; then
693	2	ADDON_SKIP_REASON="EKS add-on lookup failed or returned an invalid version for ${addon_name}."
694	2	echo " $ADDON_SKIP_REASON"
695	2	break
696		fi
697	145	if [ "$current_version" != "$latest" ]; then
698	40	echo " - ${addon_name}: ${current_version} -> ${latest}"
699	40	echo "${addon_name}\|${current_version}\|${latest}" >> "$ADDON_RESULTS"
700		fi
701		done <<< "$EKS_ADDONS"
702		fi
703		fi
704
705	105	ADDON_COUNT="$(wc -l < "$ADDON_RESULTS" 2>/dev/null \| tr -d ' ')"
706	35	[ -z "$ADDON_COUNT" ] && ADDON_COUNT=0
707
708		# ---------------------------------------------------------------------------
709		# EKS Kubernetes version (best-effort — requires AWS credentials)
710		#
711		# Compares ``kubernetes_version`` in cdk.json against the latest minor
712		# available from ``aws eks describe-cluster-versions`` (filtered to
713		# ``STANDARD_SUPPORT``). If a newer minor is available, we also report
714		# when standard support for the currently-pinned minor ends so the
715		# upgrade urgency is visible in the PR.
716		#
717		# IAM action: ``eks:DescribeClusterVersions``. Same credential preflight
718		# as the EKS add-on / Aurora / EMR checks.
719		# ---------------------------------------------------------------------------
720	35	echo ""
721	35	echo "=== Checking EKS Kubernetes version ==="
722	35
723	70	EKS_K8S_RESULTS="$(mktemp)"
724	35	EKS_K8S_SKIP_REASON=""
725
726	35	if ! aws sts get-caller-identity >/dev/null 2>&1; then
727	3	EKS_K8S_SKIP_REASON="No AWS credentials available (scan needs eks:DescribeClusterVersions). Configure OIDC to enable."
728	3	echo " $EKS_K8S_SKIP_REASON"
729		else
730		# ``--version-status STANDARD_SUPPORT`` returns every minor still in
731		# standard support — we don't want to flag the extended-support
732		# lifecycle as "newer." It must be the only selector: the API rejects
733		# combining it with ``--include-all`` ("Only one of the defaultOnly,
734		# clusterVersions, includeAll or status request parameters is accepted
735		# at a time"), which is exactly how this check silently broke once.
736		# stderr is captured into the skip reason so the next API-shape change
737		# is diagnosable from the report instead of reading as a generic skip.
738	64	EKS_K8S_ERR_FILE="$(mktemp)"
739	65	CLUSTER_VERSIONS_JSON="$(aws eks describe-cluster-versions \
740		--version-status STANDARD_SUPPORT \
741		--output json 2>"$EKS_K8S_ERR_FILE")" \|\| CLUSTER_VERSIONS_JSON=""
742
743	32	if [ -z "$CLUSTER_VERSIONS_JSON" ]; then
744	3	EKS_K8S_ERR="$(head -n 1 "$EKS_K8S_ERR_FILE" 2>/dev/null \| tr -d '\r')"
745	1	EKS_K8S_SKIP_REASON="EKS Kubernetes version lookup failed${EKS_K8S_ERR:+: ${EKS_K8S_ERR}}"
746	1	[ -z "$EKS_K8S_ERR" ] && EKS_K8S_SKIP_REASON="EKS Kubernetes version lookup returned an empty response."
747	1	echo " $EKS_K8S_SKIP_REASON"
748	1	rm -f "$EKS_K8S_ERR_FILE"
749		else
750	31	rm -f "$EKS_K8S_ERR_FILE"
751		# Max of ``clusterVersion`` across all rows is the newest standard-
752		# support minor. We use Python for a proper numeric sort so 1.10
753		# beats 1.9 (sort -V already does this, but Python keeps the data
754		# wrangling in one place).
755	94	LATEST_K8S="$(echo "$CLUSTER_VERSIONS_JSON" \| python3 -c '
756		import json, sys
757		try:
758		data = json.load(sys.stdin)
759		except Exception:
760		sys.exit(0)
761		versions = sorted(
762		{row["clusterVersion"] for row in data.get("clusterVersions", [])},
763		key=lambda v: tuple(int(p) for p in v.split(".")),
764		)
765		print(versions[-1] if versions else "")
766		' 2>/dev/null)" \|\| LATEST_K8S=""
767
768	31	if [ -z "$LATEST_K8S" ]; then
769	2	EKS_K8S_SKIP_REASON="EKS Kubernetes version response contained no parseable standard-support versions."
770	2	echo " $EKS_K8S_SKIP_REASON"
771		else
772	58	CURRENT_K8S="$(extract_k8s_version "cdk.json")"
773
774	29	if [ "$CURRENT_K8S" != "$LATEST_K8S" ] \
775	14	&& [ "$(compare_semver "$CURRENT_K8S" "$LATEST_K8S")" = "newer" ]; then
776		# Grab the standard-support end date for the currently-pinned
777		# minor. Blank when EKS hasn't published one yet (brand-new release).
778	21	EOS_DATE="$(echo "$CLUSTER_VERSIONS_JSON" \| python3 -c "
779	21	import json, sys
780	21	cv = sys.argv[1]
781	21	try:
782	21	data = json.load(sys.stdin)
783	21	except Exception:
784	21	sys.exit(0)
785	21	for row in data.get('clusterVersions', []):
786	21	if row.get('clusterVersion') == cv:
787	21	ts = row.get('endOfStandardSupportDate', '')
788	21	# Strip time-of-day; the date is what the report cares about.
789	21	print(str(ts).split('T', 1)[0].split(' ', 1)[0])
790	21	break
791	21	" "$CURRENT_K8S" 2>/dev/null)" \|\| EOS_DATE=""
792
793	7	echo " - kubernetes_version: ${CURRENT_K8S} -> ${LATEST_K8S} (std support ends ${EOS_DATE:-unknown})"
794	7	echo "kubernetes_version\|${CURRENT_K8S}\|${LATEST_K8S}\|${EOS_DATE:-unknown}" >> "$EKS_K8S_RESULTS"
795		fi
796		fi
797		fi
798		fi
799
800	105	EKS_K8S_COUNT="$(wc -l < "$EKS_K8S_RESULTS" 2>/dev/null \| tr -d ' ')"
801	35	[ -z "$EKS_K8S_COUNT" ] && EKS_K8S_COUNT=0
802
803		# ---------------------------------------------------------------------------
804		# Aurora PostgreSQL engine versions (best-effort — requires AWS credentials)
805		#
806		# Checks whether the Aurora PostgreSQL engine version pinned in
807		# regional_stack.py has a newer minor or major release available.
808		# Uses the same credential gate as the EKS add-on check above.
809		# ---------------------------------------------------------------------------
810	35	echo ""
811	35	echo "=== Checking Aurora PostgreSQL engine versions ==="
812	35
813	70	AURORA_RESULTS="$(mktemp)"
814	35	AURORA_SKIP_REASON=""
815
816	35	if ! aws sts get-caller-identity >/dev/null 2>&1; then
817	3	AURORA_SKIP_REASON="No AWS credentials available (scan needs rds:DescribeDBEngineVersions). Configure OIDC to enable."
818	3	echo " $AURORA_SKIP_REASON"
819		else
820		# The pinned Aurora PostgreSQL version (AURORA_POSTGRES_VERSION in
821		# gco/stacks/constants.py — a plain version string applied through
822		# AuroraPostgresEngineVersion.of(), so no CDK enum is involved).
823	64	AURORA_VERSIONS="$(extract_aurora_versions "gco/stacks/regional_stack.py")"
824	32	if [ -z "$AURORA_VERSIONS" ]; then
825	1	AURORA_SKIP_REASON="Could not read AURORA_POSTGRES_VERSION from gco/stacks/constants.py."
826	1	echo " $AURORA_SKIP_REASON"
827		else
828	61	while read -r current_ver; do
829	31	[ -z "$current_ver" ] && continue
830	93	major="$(echo "$current_ver" \| cut -d. -f1)"
831
832		# Query the latest available engine version for this major line.
833	155	latest="$(aws rds describe-db-engine-versions \
834		--engine aurora-postgresql \
835		--query "DBEngineVersions[?starts_with(EngineVersion, '${major}.')].EngineVersion" \
836		--output text 2>/dev/null \
837		\| tr '\t' '\n' \| sort -V \| tail -1)" \|\| latest=""
838
839	31	if ! [[ "$latest" =~ ^[0-9]+\.[0-9]+(\.[0-9]+)?$ ]]; then
840	1	AURORA_SKIP_REASON="Aurora PostgreSQL engine lookup failed or returned an invalid version for major ${major}."
841	1	echo " $AURORA_SKIP_REASON"
842	1	break
843		fi
844	30	if [ "$current_ver" != "$latest" ]; then
845	8	echo " - aurora-postgresql: ${current_ver} -> ${latest}"
846	8	echo "aurora-postgresql\|${current_ver}\|${latest}" >> "$AURORA_RESULTS"
847		fi
848		done <<< "$AURORA_VERSIONS"
849		fi
850		fi
851
852	105	AURORA_COUNT="$(wc -l < "$AURORA_RESULTS" 2>/dev/null \| tr -d ' ')"
853	35	[ -z "$AURORA_COUNT" ] && AURORA_COUNT=0
854
855		# ---------------------------------------------------------------------------
856		# EMR Serverless release labels (best-effort — requires AWS credentials)
857		#
858		# Checks whether the EMR Serverless release label pinned in
859		# gco/stacks/constants.py has a newer release available. Uses the same
860		# credential gate as the EKS add-on / Aurora checks above.
861		#
862		# AWS CLI note: the `list-release-labels` subcommand lives on the classic
863		# `aws emr` service, not on `aws emr-serverless`. Classic EMR and EMR
864		# Serverless share the same release-label namespace (e.g. emr-7.13.0),
865		# so calling the classic service returns the labels usable by Serverless
866		# applications. The IAM action is ``elasticmapreduce:ListReleaseLabels``
867		# (which is what the OIDC policy grants) and is shared between the two
868		# services — the CLI routing is just a surface-level difference.
869		#
870		# Two label families are in play. The classic line is ``emr-N.x.y``; the
871		# current major line is the "AWS runtime for Apache Spark", ``emr-spark-N.x.y``
872		# (``emr-spark-8.0.0`` GA, then ``emr-spark-8.1.0``), which the service lists
873		# on the last page of a paged response. ``list_emr_release_labels`` follows
874		# every page and ``newest_emr_label`` ranks by version across both families,
875		# so a newer patch in the pinned line and a newer major in either family are
876		# both reported (the latter as "new major available"). Both families are
877		# valid release labels for the ``type: SPARK`` application GCO creates.
878		# ---------------------------------------------------------------------------
879	35	echo ""
880	35	echo "=== Checking EMR Serverless release labels ==="
881	35
882	70	EMR_RESULTS="$(mktemp)"
883	35	EMR_SKIP_REASON=""
884
885	35	if ! aws sts get-caller-identity >/dev/null 2>&1; then
886	3	EMR_SKIP_REASON="No AWS credentials available (scan needs elasticmapreduce:ListReleaseLabels). Configure OIDC to enable."
887	3	echo " $EMR_SKIP_REASON"
888		else
889	64	EMR_VERSIONS="$(extract_emr_versions "gco/stacks/constants.py")"
890	32	if [ -z "$EMR_VERSIONS" ]; then
891	1	EMR_SKIP_REASON="Could not read the EMR Serverless release-label pin from gco/stacks/constants.py."
892	1	echo " $EMR_SKIP_REASON"
893		else
894	60	while read -r current_label; do
895	31	[ -z "$current_label" ] && continue
896		# current_label is "emr-7.14.0" or "emr-spark-8.1.0". Within the pinned
897		# major line, the newest GA label is a routine bump; the newest GA label
898		# across both families is the new-major signal. Preview, beta and
899		# release-candidate labels carry a suffix and never qualify.
900	62	current_version="$(emr_label_version "$current_label")"
901	31	major="${current_version%%.*}"
902	62	release_labels="$(list_emr_release_labels us-east-1)" \|\| release_labels=""
903
904	31	if [ -z "$release_labels" ]; then
905	1	EMR_SKIP_REASON="EMR release-label lookup failed or returned an empty response."
906	1	echo " $EMR_SKIP_REASON"
907	1	break
908		fi
909
910	60	latest="$(newest_emr_label "$major" <<< "$release_labels")"
911	60	latest_any="$(newest_emr_label <<< "$release_labels")"
912
913	30	if [ -z "$latest_any" ]; then
914	1	EMR_SKIP_REASON="EMR release-label response contained no parseable stable releases."
915	1	echo " $EMR_SKIP_REASON"
916	1	break
917		fi
918
919	57	if [ -n "$latest" ] && [ "$current_label" != "$latest" ] \
920	18	&& [ "$(compare_semver "$current_version" "$(emr_label_version "$latest")")" = "newer" ]; then
921	6	echo " - emr-serverless: ${current_label} -> ${latest}"
922	6	echo "emr-serverless\|${current_label}\|${latest}" >> "$EMR_RESULTS"
923	23	elif [ "$current_label" != "$latest_any" ] \
924	6	&& [ "$(compare_semver "$current_version" "$(emr_label_version "$latest_any")")" = "newer" ]; then
925		# No newer release in the pinned major line, but a newer major exists
926		# (today that is the emr-spark-8.x.y family).
927	1	echo " - emr-serverless: ${current_label} -> ${latest_any} (new major available)"
928	1	echo "emr-serverless\|${current_label}\|${latest_any}" >> "$EMR_RESULTS"
929		fi
930		done <<< "$EMR_VERSIONS"
931		fi
932		fi
933
934	105	EMR_COUNT="$(wc -l < "$EMR_RESULTS" 2>/dev/null \| tr -d ' ')"
935	35	[ -z "$EMR_COUNT" ] && EMR_COUNT=0
936
937		# ---------------------------------------------------------------------------
938		# Bedrock default model (best-effort — requires AWS credentials)
939		#
940		# Compares each configured Bedrock model default in cdk.json —
941		# context.bedrock.mission_default_model_id (Mission sampling),
942		# context.bedrock.capacity_advisor_default_model_id (the capacity
943		# advisor), context.bedrock.claude_code_default_model_id (the session
944		# model GCO Autopilot hands to Claude Code),
945		# context.bedrock.codex_default_model_id (the session model it hands to Codex),
946		# context.bedrock.opencode_default_model_id (the session model it hands to
947		# OpenCode), and context.bedrock.embedding_model_id (Mission memory's
948		# text-embedding model) — against the newest release in the SAME model
949		# family. The generation keys compare against system-defined inference profiles
950		# (aws bedrock list-inference-profiles); the embedding key is a plain
951		# foundation model, so it compares against
952		# aws bedrock list-foundation-models --by-output-modality EMBEDDING.
953		# Every consumer resolves its key through gco.bedrock, so the scan and
954		# the runtime paths cannot silently diverge; the keys are independent
955		# knobs and each gets its own drift row.
956		#
957		# Same-family scoping (see bedrock_model_family) means we only flag a newer
958		# release of the same model line (e.g. a newer global Amazon Nova Lite) — never a
959		# different tier or provider, since switching those is a human decision,
960		# not drift. When a newer release is reported, update the flagged key in
961		# cdk.json; for the Mission key also re-capture the scaffold
962		# fixture with scripts/capture_scaffold_fixtures.py. For the embedding
963		# key, remember stored vectors are only comparable to vectors from the
964		# same model: adopting a newer embedding model means re-embedding or
965		# segregating existing Mission-memory data, not just bumping the pin.
966		#
967		# IAM actions: bedrock:ListInferenceProfiles and
968		# bedrock:ListFoundationModels. Pinned to us-east-1 (the advisor +
969		# Mission sampling + Mission memory default region) regardless of the
970		# workflow's configured region. Same credential preflight as the EKS
971		# add-on / Aurora / EMR checks.
972		# ---------------------------------------------------------------------------
973	35	echo ""
974	35	echo "=== Checking Bedrock default model ==="
975	35
976	70	BEDROCK_MODEL_RESULTS="$(mktemp)"
977	35	BEDROCK_MODEL_SKIP_REASON=""
978
979	35	if ! aws sts get-caller-identity >/dev/null 2>&1; then
980	3	BEDROCK_MODEL_SKIP_REASON="No AWS credentials available (scan needs bedrock:ListInferenceProfiles). Configure OIDC to enable."
981	3	echo " $BEDROCK_MODEL_SKIP_REASON"
982		else
983	192	for BEDROCK_MODEL_LEAF in mission_default_model_id capacity_advisor_default_model_id claude_code_default_model_id codex_default_model_id opencode_default_model_id embedding_model_id; do
984	384	CURRENT_BEDROCK_MODEL="$(extract_default_bedrock_model cdk.json "$BEDROCK_MODEL_LEAF")"
985	192	if [ -z "$CURRENT_BEDROCK_MODEL" ]; then
986	6	BEDROCK_MODEL_SKIP_REASON="Could not read context.bedrock.${BEDROCK_MODEL_LEAF} from cdk.json."
987	6	echo " $BEDROCK_MODEL_SKIP_REASON"
988	6	continue
989		fi
990	186	if [ "$BEDROCK_MODEL_LEAF" = "embedding_model_id" ]; then
991		# Embedding defaults are foundation models, not inference profiles.
992	62	LATEST_BEDROCK_MODEL="$(get_latest_bedrock_embedding_model "$CURRENT_BEDROCK_MODEL" us-east-1)" \|\| LATEST_BEDROCK_MODEL=""
993		else
994	310	LATEST_BEDROCK_MODEL="$(get_latest_bedrock_model "$CURRENT_BEDROCK_MODEL" us-east-1)" \|\| LATEST_BEDROCK_MODEL=""
995		fi
996	186	if [ -z "$LATEST_BEDROCK_MODEL" ]; then
997	12	BEDROCK_MODEL_SKIP_REASON="Bedrock model lookup failed or returned no active release in the model family of context.bedrock.${BEDROCK_MODEL_LEAF}."
998	12	echo " $BEDROCK_MODEL_SKIP_REASON"
999	174	elif [ "$CURRENT_BEDROCK_MODEL" != "$LATEST_BEDROCK_MODEL" ] \
1000	84	&& [ "$(compare_bedrock_model "$CURRENT_BEDROCK_MODEL" "$LATEST_BEDROCK_MODEL")" = "newer" ]; then
1001	42	echo " - bedrock ${BEDROCK_MODEL_LEAF}: ${CURRENT_BEDROCK_MODEL} -> ${LATEST_BEDROCK_MODEL}"
1002	42	echo "context.bedrock.${BEDROCK_MODEL_LEAF}\|${CURRENT_BEDROCK_MODEL}\|${LATEST_BEDROCK_MODEL}" >> "$BEDROCK_MODEL_RESULTS"
1003		fi
1004		done
1005		# The vector store keeps its own embedding model at
1006		# context.vector_store.embedding_model_id (independent of mission memory's
1007		# bedrock.embedding_model_id by design). Same foundation-model drift check,
1008		# same re-embed caveat: adopting a newer model means re-ingesting the corpus.
1009		# The key is optional (the block ships with defaults), so absence is not a
1010		# skip condition for the whole check.
1011	64	VECTOR_STORE_MODEL="$(extract_default_bedrock_model cdk.json embedding_model_id vector_store)"
1012	32	if [ -n "$VECTOR_STORE_MODEL" ]; then
1013	62	LATEST_VECTOR_STORE_MODEL="$(get_latest_bedrock_embedding_model "$VECTOR_STORE_MODEL" us-east-1)" \|\| LATEST_VECTOR_STORE_MODEL=""
1014	31	if [ -z "$LATEST_VECTOR_STORE_MODEL" ]; then
1015	2	BEDROCK_MODEL_SKIP_REASON="Bedrock model lookup failed or returned no active release in the model family of context.vector_store.embedding_model_id."
1016	2	echo " $BEDROCK_MODEL_SKIP_REASON"
1017	29	elif [ "$VECTOR_STORE_MODEL" != "$LATEST_VECTOR_STORE_MODEL" ] \
1018	14	&& [ "$(compare_bedrock_model "$VECTOR_STORE_MODEL" "$LATEST_VECTOR_STORE_MODEL")" = "newer" ]; then
1019	7	echo " - vector_store embedding_model_id: ${VECTOR_STORE_MODEL} -> ${LATEST_VECTOR_STORE_MODEL}"
1020	7	echo "context.vector_store.embedding_model_id\|${VECTOR_STORE_MODEL}\|${LATEST_VECTOR_STORE_MODEL}" >> "$BEDROCK_MODEL_RESULTS"
1021		fi
1022		fi
1023		fi
1024
1025	105	BEDROCK_MODEL_COUNT="$(wc -l < "$BEDROCK_MODEL_RESULTS" 2>/dev/null \| tr -d ' ')"
1026	35	[ -z "$BEDROCK_MODEL_COUNT" ] && BEDROCK_MODEL_COUNT=0
1027
1028
1029		# ---------------------------------------------------------------------------
1030		# Dockerfile.dev ARG pins
1031		#
1032		# Checks the tooling versions pinned in ``Dockerfile.dev`` (Node.js
1033		# release, AWS CDK CLI, kubectl, AWS CLI v2, Docker CLI, Docker Buildx). These ARGs sit
1034		# outside the main dependency surfaces above — Dependabot watches the
1035		# ``FROM python:…`` base image but not the ARG pins — so drift here has
1036		# historically gone undetected until someone rebuilt the image.
1037		#
1038		# Each pin has its own upstream:
1039		#
1040		# NODE_VERSION github://nodejs/Release → schedule.json (active LTS
1041		# major) + nodejs.org/dist/index.json (newest release
1042		# on that major)
1043		# NPM_VERSION registry.npmjs.org/npm/latest
1044		# CDK_VERSION registry.npmjs.org/aws-cdk/latest
1045		# KUBECTL_VERSION https://dl.k8s.io/release/stable-<minor>.txt
1046		# (minor from cdk.json::kubernetes_version)
1047		# AWSCLI_VERSION github://aws/aws-cli/tags (v2.x.y semver, no GitHub Releases)
1048		# DOCKER_VERSION github://moby/moby/releases/latest (``docker-v<ver>``)
1049		# BUILDX_VERSION github://docker/buildx/releases/latest (v<ver>)
1050		# UV_VERSION github://astral-sh/uv/releases/latest (bare semver)
1051		# SESSION_MANAGER_PLUGIN_VERSION
1052		# github://aws/session-manager-plugin/releases/latest
1053		# (bare four-part version, e.g. 1.2.896.0)
1054		#
1055		# All endpoints are public — no AWS credentials needed.
1056		# ---------------------------------------------------------------------------
1057	35	echo ""
1058	35	echo "=== Checking Dockerfile.dev ARG pins ==="
1059	35
1060	70	DOCKERFILE_RESULTS="$(mktemp)"
1061	35	DOCKERFILE_PIN_FILE="Dockerfile.dev"
1062
1063		check_dockerfile_pin() {
1064	297	local name="$1" current="$2" latest=""
1065	1023	case "$name" in
1066		NODE_VERSION)
1067		# Two drift signals folded into one compare. First pick the
1068		# highest major with an active LTS window from the release
1069		# schedule (lts <= today AND (end missing or end > today)),
1070		# then resolve that major's newest release from the official
1071		# dist index — the same origin the Dockerfile downloads from.
1072		# A new LTS line and a new patch on the current line both
1073		# surface as ``newer``.
1074	33	local lts_major
1075	100	lts_major="$(curl -fsSL --max-time 15 "${SCAN_CURL_RETRY[@]}" \
1076		"https://raw.githubusercontent.com/nodejs/Release/main/schedule.json" 2>/dev/null \
1077		\| python3 -c '
1078		import sys, json, datetime
1079		try:
1080		data = json.load(sys.stdin)
1081		except Exception:
1082		sys.exit(0)
1083		today = datetime.date.today().isoformat()
1084		candidates = []
1085		for k, v in data.items():
1086		if not k.startswith("v") or "lts" not in v:
1087		continue
1088		if v["lts"] > today:
1089		continue
1090		if v.get("end", "9999-12-31") <= today:
1091		continue
1092		try:
1093		candidates.append(int(k[1:]))
1094		except ValueError:
1095		continue
1096		if candidates:
1097		print(max(candidates))
1098		' 2>/dev/null)" \|\| true
1099	33	if [ -z "$lts_major" ]; then
1100	1	mark_scan_incomplete "Node.js release-schedule lookup failed or returned no active LTS major."
1101	1	return
1102		fi
1103		# index.json is newest-first per line, so the first entry whose
1104		# version sits on the LTS major is that major's latest release.
1105	96	latest="$(curl -fsSL --max-time 15 "${SCAN_CURL_RETRY[@]}" \
1106		"https://nodejs.org/dist/index.json" 2>/dev/null \
1107		\| jq -r --arg prefix "v${lts_major}." \
1108		'[.[].version \| select(startswith($prefix))][0] // empty' 2>/dev/null)" \|\| true
1109		;;
1110		CDK_VERSION)
1111	100	latest="$(curl -fsSL --max-time 15 "${SCAN_CURL_RETRY[@]}" \
1112		"https://registry.npmjs.org/aws-cdk/latest" 2>/dev/null \
1113		\| jq -r '.version // empty' 2>/dev/null)" \|\| true
1114		;;
1115		NPM_VERSION)
1116		# ``npm`` is part of the dev container's pinned tooling — the
1117		# npm bundled inside the Node dist tarball is fixed per Node
1118		# release but lags npm's own line, so the Dockerfile installs a
1119		# specific ``npm@X.Y.Z`` to keep rebuilds reproducible (same
1120		# rationale as CDK_VERSION above). The canonical "latest" is the
1121		# ``latest`` dist-tag on npmjs.org, same source CDK uses.
1122	100	latest="$(curl -fsSL --max-time 15 "${SCAN_CURL_RETRY[@]}" \
1123		"https://registry.npmjs.org/npm/latest" 2>/dev/null \
1124		\| jq -r '.version // empty' 2>/dev/null)" \|\| true
1125		;;
1126		KUBECTL_VERSION)
1127		# Match the minor line already committed to cdk.json so the pin
1128		# and the EKS cluster stay within the ±1 minor skew policy.
1129	33	local k8s_minor
1130	66	k8s_minor="$(extract_k8s_version "cdk.json")"
1131	100	latest="$(curl -fsSL --max-time 15 "${SCAN_CURL_RETRY[@]}" \
1132		"https://dl.k8s.io/release/stable-${k8s_minor}.txt" 2>/dev/null \| tr -d '[:space:]')" \|\| true
1133		;;
1134		AWSCLI_VERSION)
1135		# aws/aws-cli doesn't publish GitHub Releases for v2; tags are the
1136		# canonical source. First page (per_page=20) is newest-first;
1137		# filter to 2.x.y semver and take the top match.
1138	102	latest="$(github_api_get \
1139		"https://api.github.com/repos/aws/aws-cli/tags?per_page=20" \
1140		\| jq -r '[.[].name \| select(test("^2\\.[0-9]+\\.[0-9]+$"))][0] // empty' 2>/dev/null)" \|\| true
1141		;;
1142		DOCKER_VERSION)
1143		# moby/moby tags releases as ``docker-v<semver>``; strip the
1144		# prefix so compare_semver can handle the value.
1145	135	latest="$(github_api_get \
1146		"https://api.github.com/repos/moby/moby/releases/latest" \
1147		\| jq -r '.tag_name // empty' 2>/dev/null \
1148		\| sed -E 's/^(docker-)?v//')" \|\| true
1149		;;
1150		BUILDX_VERSION)
1151		# docker/buildx publishes GitHub Releases tagged v<semver>
1152		# (e.g. v0.35.0). The release tag is the canonical source;
1153		# compare_semver strips the leading v on both sides. The
1154		# Dockerfile installs the plugin binary buildx-<tag>.linux-<arch>.
1155	102	latest="$(github_api_get \
1156		"https://api.github.com/repos/docker/buildx/releases/latest" \
1157		\| jq -r '.tag_name // empty' 2>/dev/null)" \|\| true
1158		;;
1159		UV_VERSION)
1160		# astral-sh/uv publishes GitHub Releases tagged with a bare semver
1161		# (e.g. 0.12.1). The dev container ships uv/uvx for the `gco
1162		# autopilot` companion MCP servers; bump the two SHA256 ARGs in
1163		# lockstep from the per-artifact *.sha256 release files.
1164	102	latest="$(github_api_get \
1165		"https://api.github.com/repos/astral-sh/uv/releases/latest" \
1166		\| jq -r '.tag_name // empty' 2>/dev/null)" \|\| true
1167		;;
1168		SESSION_MANAGER_PLUGIN_VERSION)
1169		# aws/session-manager-plugin tags releases with the bare four-part
1170		# version the S3 download path embeds (1.2.896.0). Bump the two
1171		# SESSION_MANAGER_PLUGIN_SHA256_* ARGs from the new .deb packages.
1172	102	latest="$(github_api_get \
1173		"https://api.github.com/repos/aws/session-manager-plugin/releases/latest" \
1174		\| jq -r '.tag_name // empty' 2>/dev/null)" \|\| true
1175		;;
1176		esac
1177		# extract_dockerfile_pins only emits the names above. Should its allowlist
1178		# ever grow without a matching arm here, ``latest`` stays empty and the
1179		# pin is reported as an incomplete lookup below, rather than skipped in
1180		# silence.
1181
1182	296	if [ -z "$latest" ]; then
1183	33	case "$name" in
1184		AWSCLI_VERSION\|DOCKER_VERSION\|BUILDX_VERSION\|UV_VERSION\|SESSION_MANAGER_PLUGIN_VERSION)
1185	30	mark_scan_incomplete "Upstream version lookup failed for Dockerfile.dev pin ${name}$(github_api_failure_hint)."
1186		;;
1187		*)
1188	3	mark_scan_incomplete "Upstream version lookup failed for Dockerfile.dev pin ${name}."
1189		;;
1190		esac
1191	18	return
1192		fi
1193
1194		# Every pin is a semver, NODE_VERSION included. compare_semver strips
1195		# a leading ``v`` on both sides, matching the kubectl and buildx pins
1196		# that keep the prefix.
1197	278	local relation
1198	556	relation="$(compare_semver "$current" "$latest")"
1199
1200	278	if [ "$relation" = "newer" ]; then
1201	72	echo " - ${name}: ${current} -> ${latest}"
1202	72	echo "${name}\|${current}\|${latest}" >> "$DOCKERFILE_RESULTS"
1203		fi
1204		}
1205
1206	35	if [ -f "$DOCKERFILE_PIN_FILE" ]; then
1207	68	DOCKERFILE_PINS="$(extract_dockerfile_pins "$DOCKERFILE_PIN_FILE")"
1208	34	if [ -z "$DOCKERFILE_PINS" ]; then
1209	1	mark_scan_incomplete "Could not parse tooling pins from ${DOCKERFILE_PIN_FILE}."
1210		fi
1211	664	while IFS='\|' read -r pin_name pin_value; do
1212	299	[ -z "$pin_name" ] && continue
1213	297	check_dockerfile_pin "$pin_name" "$pin_value"
1214		done <<< "$DOCKERFILE_PINS"
1215		else
1216	1	mark_scan_incomplete "$DOCKERFILE_PIN_FILE is missing."
1217		fi
1218
1219	105	DOCKERFILE_COUNT="$(wc -l < "$DOCKERFILE_RESULTS" 2>/dev/null \| tr -d ' ')"
1220	35	[ -z "$DOCKERFILE_COUNT" ] && DOCKERFILE_COUNT=0
1221
1222		# ---------------------------------------------------------------------------
1223		# GCO Autopilot pins (agent CLI releases + companion MCP servers)
1224		#
1225		# ``gco autopilot`` (cli/autopilot.py) carries four dependency surfaces that
1226		# live in Python constants, invisible to Dependabot and to every sweep above:
1227		#
1228		# CLAUDE_CODE_VERSION exact @anthropic-ai/claude-code release installed
1229		# by the default engine on first use.
1230		# CODEX_VERSION exact @openai/codex release installed by the Codex
1231		# engine on first use.
1232		# OPENCODE_VERSION exact opencode-ai release installed by the
1233		# OpenCode engine on first use.
1234		# COMPANION_MCP_SERVERS the npx/uvx-launched companion MCP servers wired
1235		# into every autopilot session. Nothing pins them
1236		# (they resolve at launch), so the risk isn't
1237		# staleness — it's disappearance: a package that is
1238		# unpublished, deprecated, or yanked breaks every
1239		# new session. Each is resolved on its registry and
1240		# reported when unhealthy. This is exactly how
1241		# mcp-server-fetch and mcp-server-calculator broke
1242		# before being pruned in 2026-08.
1243		#
1244		# Remediation for companion findings: replace or drop the server in
1245		# cli/autopilot.py and the "Recommended Companion MCP Servers" tables in
1246		# gco_mcp/README.md — tests/test_cli_autopilot.py fails the PR until the two
1247		# agree. All endpoints are public — no AWS credentials needed.
1248		# ---------------------------------------------------------------------------
1249	35	echo ""
1250	35	echo "=== Checking GCO Autopilot pins ==="
1251	35
1252	70	AUTOPILOT_RESULTS="$(mktemp)"
1253	35	AUTOPILOT_SKIP_REASON=""
1254	35	AUTOPILOT_SOURCE="cli/autopilot.py"
1255
1256	35	if [ ! -f "$AUTOPILOT_SOURCE" ]; then
1257	2	AUTOPILOT_SKIP_REASON="${AUTOPILOT_SOURCE} not found."
1258	2	echo " $AUTOPILOT_SKIP_REASON"
1259		else
1260		check_autopilot_npm_pin() {
1261	99	local constant_name="$1"
1262	99	local package_name="$2"
1263	99	local extractor="$3"
1264	99	local pin="" package_status="" latest="" verdict=""
1265	99	local package_url="https://www.npmjs.com/package/${package_name}"
1266
1267	198	pin="$("$extractor" "$AUTOPILOT_SOURCE")"
1268	99	if [ -z "$pin" ]; then
1269	3	AUTOPILOT_SKIP_REASON="${constant_name} not found in ${AUTOPILOT_SOURCE}."
1270	3	echo " $AUTOPILOT_SKIP_REASON"
1271	3	return
1272		fi
1273
1274	192	package_status="$(get_registry_package_status npm "$package_name")"
1275	96	if [ -z "$package_status" ]; then
1276	3	AUTOPILOT_SKIP_REASON="npm lookup for ${package_name} failed (network)."
1277	3	echo " $AUTOPILOT_SKIP_REASON"
1278	3	return
1279		fi
1280
1281	93	latest="${package_status#*\|}"
1282	93	case "$package_status" in
1283		ok\\|*)
1284	90	if [ -n "$latest" ] \
1285	180	&& [ "$(compare_semver "$pin" "$latest")" = "newer" ]; then
1286	24	echo " - ${constant_name}: ${pin} -> ${latest}"
1287	24	echo "${package_name} (${constant_name})\|${pin}\|${latest}\|${package_url}" >> "$AUTOPILOT_RESULTS"
1288		fi
1289		;;
1290		*)
1291	3	verdict="${package_status%%\|*}"
1292	3	echo " - ${package_name}: ${verdict}"
1293	3	echo "${package_name} (${constant_name})\|${pin}\|${verdict}\|${package_url}" >> "$AUTOPILOT_RESULTS"
1294		;;
1295		esac
1296		}
1297
1298	33	check_autopilot_npm_pin \
1299		"CLAUDE_CODE_VERSION" "@anthropic-ai/claude-code" extract_claude_code_pin
1300	33	check_autopilot_npm_pin \
1301		"CODEX_VERSION" "@openai/codex" extract_codex_pin
1302	33	check_autopilot_npm_pin \
1303		"OPENCODE_VERSION" "opencode-ai" extract_opencode_pin
1304
1305		# Companion MCP server liveness. Missing/deprecated/yanked is drift; a
1306		# network failure marks the scan incomplete rather than inventing findings.
1307	234	while IFS='\|' read -r companion_name companion_registry companion_package; do
1308	84	[ -z "$companion_name" ] && continue
1309	168	companion_status="$(get_registry_package_status "$companion_registry" "$companion_package")"
1310	84	if [ -z "$companion_status" ]; then
1311	4	if [ -z "$AUTOPILOT_SKIP_REASON" ]; then
1312	1	AUTOPILOT_SKIP_REASON="Registry lookup failed for ${companion_package} (${companion_registry}); companion liveness incomplete."
1313	1	echo " $AUTOPILOT_SKIP_REASON"
1314		fi
1315	4	continue
1316		fi
1317	80	case "$companion_status" in
1318		ok\\|*)
1319		;;
1320		*)
1321	4	companion_verdict="${companion_status%%\|*}"
1322	4	companion_detail="${companion_status#*\|}"
1323	6	[ -n "$companion_detail" ] && companion_verdict="${companion_verdict}: ${companion_detail}"
1324	4	if [ "$companion_registry" = "npm" ]; then
1325	2	companion_url="https://www.npmjs.com/package/${companion_package}"
1326		else
1327	2	companion_url="https://pypi.org/project/${companion_package}/"
1328		fi
1329	4	echo " - companion ${companion_name}: ${companion_verdict}"
1330	4	echo "companion ${companion_name} (${companion_registry}: ${companion_package})\|launch-time (unpinned)\|${companion_verdict}\|${companion_url}" >> "$AUTOPILOT_RESULTS"
1331		;;
1332		esac
1333		done < <(extract_companion_mcp_packages "$AUTOPILOT_SOURCE")
1334	33	fi
1335
1336	105	AUTOPILOT_COUNT="$(wc -l < "$AUTOPILOT_RESULTS" 2>/dev/null \| tr -d ' ')"
1337	35	[ -z "$AUTOPILOT_COUNT" ] && AUTOPILOT_COUNT=0
1338
1339		# ---------------------------------------------------------------------------
1340		# Pre-commit hook revisions
1341		#
1342		# Compares the ``rev:`` pinned for each ``repo:`` block in
1343		# ``.pre-commit-config.yaml`` against the latest semver-shaped tag
1344		# published by the upstream Git host. Dependabot has a pre-commit
1345		# ecosystem, but .github/dependabot.yml leaves it off on purpose: the
1346		# ruff, mypy, and yamllint hooks stay in lockstep with their pins in
1347		# requirements-lock.txt, which Dependabot does not manage, so this
1348		# report is what surfaces hook drift. It matters in practice because
1349		# stale hook pins quietly miss new lint rules and bug fixes.
1350		#
1351		# Each hook's repo URL is resolved to a tag list via the GitHub API
1352		# (the only host we use today). Full SHA-1/SHA-256 object ids are accepted as
1353		# immutable exemptions. Other unsupported refs (branches, floating labels,
1354		# prereleases) mark the scan incomplete rather than silently disappearing.
1355		# Calls are unauthenticated; we make one request per hook, which is well below
1356		# the 60 req/h public limit.
1357		# ---------------------------------------------------------------------------
1358	35	echo ""
1359	35	echo "=== Checking pre-commit hook revisions ==="
1360	35
1361	70	PRECOMMIT_RESULTS="$(mktemp)"
1362	35	PRECOMMIT_CONFIG=".pre-commit-config.yaml"
1363
1364	35	if [ -f "$PRECOMMIT_CONFIG" ]; then
1365	68	PRECOMMIT_HOOKS="$(extract_precommit_hooks "$PRECOMMIT_CONFIG")"
1366	34	if [ -z "$PRECOMMIT_HOOKS" ]; then
1367	1	mark_scan_incomplete "Could not parse hook pins from ${PRECOMMIT_CONFIG}."
1368		fi
1369	216	while IFS='\|' read -r repo current_rev; do
1370	75	[ -z "$repo" ] && continue
1371	73	[ -z "$current_rev" ] && continue
1372		# Complete Git object ids are immutable and intentionally have no release
1373		# drift lookup. Every other non-semver ref may move or cannot be compared
1374		# safely, so it makes this scan incomplete instead of receiving a blanket
1375		# "SHA" exemption.
1376	73	if is_full_git_commit_sha "$current_rev"; then
1377	1	continue
1378		fi
1379	72	if ! [[ "$current_rev" =~ ^v?[0-9]+\.[0-9]+(\.[0-9]+)?$ ]]; then
1380	1	mark_scan_incomplete "Unsupported mutable or non-semver pre-commit rev '${current_rev}' for ${repo}."
1381	1	continue
1382		fi
1383
1384	142	latest_rev="$(get_latest_precommit_hook_release "$repo")"
1385	71	if [ -z "$latest_rev" ]; then
1386	14	mark_scan_incomplete "Pre-commit tag lookup failed for ${repo}$(github_api_failure_hint)."
1387	7	continue
1388		fi
1389
1390		# Strip ``v`` so compare_semver ranks ``v0.22.1`` vs ``v0.22.2``
1391		# (and the rare unprefixed ``1.38.0`` from yamllint historically)
1392		# consistently. We keep the original ``current_rev`` / ``latest_rev``
1393		# strings in the report so the operator copy-pastes the exact
1394		# value pre-commit expects.
1395	64	if [ "$current_rev" != "$latest_rev" ] \
1396	40	&& [ "$(compare_semver "$current_rev" "$latest_rev")" = "newer" ]; then
1397	20	echo " - ${repo}: ${current_rev} -> ${latest_rev}"
1398	20	echo "${repo}\|${current_rev}\|${latest_rev}" >> "$PRECOMMIT_RESULTS"
1399		fi
1400		done <<< "$PRECOMMIT_HOOKS"
1401		else
1402	1	mark_scan_incomplete "$PRECOMMIT_CONFIG is missing."
1403		fi
1404
1405	105	PRECOMMIT_COUNT="$(wc -l < "$PRECOMMIT_RESULTS" 2>/dev/null \| tr -d ' ')"
1406	35	[ -z "$PRECOMMIT_COUNT" ] && PRECOMMIT_COUNT=0
1407
1408		# ---------------------------------------------------------------------------
1409		# CDK enum constants
1410		#
1411		# Compares the CDK-enum-name constants pinned in
1412		# ``gco/stacks/constants.py`` against the highest enum members exposed
1413		# by the installed ``aws-cdk-lib``. This catches the case where
1414		# aws-cdk-lib already supports a newer enum (because we bumped the
1415		# library, or simply because the latest published release added one)
1416		# but ``constants.py`` still pins an older one.
1417		#
1418		# Two enums are tracked today:
1419		#
1420		# - ``LAMBDA_PYTHON_RUNTIME`` → ``aws_cdk.aws_lambda.Runtime.PYTHON_X_Y``
1421		# - ``LAMBDA_NODEJS_RUNTIME`` → ``aws_cdk.aws_lambda.Runtime.NODEJS_<major>_X``
1422		#
1423		# The Aurora engine deliberately is NOT an enum: constants.py pins a plain
1424		# version string applied through ``AuroraPostgresEngineVersion.of()``, and
1425		# the "Aurora PostgreSQL engine" section validates it against the live RDS
1426		# API — the authoritative source — instead of the CDK library's catalog.
1427		#
1428		# The deps-scan workflow installs the latest ``aws-cdk-lib`` for this
1429		# section; locally the helper just reflects whatever's already on the
1430		# active interpreter. If aws-cdk-lib isn't importable we skip with a
1431		# one-line note (mirrors the AWS-creds skip pattern used elsewhere).
1432		# ---------------------------------------------------------------------------
1433	35	echo ""
1434	35	echo "=== Checking CDK enum constants ==="
1435	35
1436	70	CDK_ENUM_RESULTS="$(mktemp)"
1437	35	CDK_ENUM_SKIP_REASON=""
1438
1439	35	if ! python3 -c "import aws_cdk" 2>/dev/null; then
1440	2	CDK_ENUM_SKIP_REASON="aws-cdk-lib not importable. Install with 'pip install aws-cdk-lib' to enable."
1441	2	echo " $CDK_ENUM_SKIP_REASON"
1442		else
1443		# Lambda Python runtime enum
1444	66	LAMBDA_RT_CURRENT="$(extract_constant_value LAMBDA_PYTHON_RUNTIME)"
1445	66	LAMBDA_RT_LATEST="$(get_latest_lambda_python_runtime)"
1446	65	if [ -z "$LAMBDA_RT_CURRENT" ] \|\| [ -z "$LAMBDA_RT_LATEST" ]; then
1447	2	mark_scan_incomplete "Could not parse the current or latest Lambda Python runtime enum."
1448	31	elif [ "$LAMBDA_RT_CURRENT" != "$LAMBDA_RT_LATEST" ]; then
1449		# Convert PYTHON_3_14 → 3.14 so compare_semver can rank them.
1450	21	cur_v="$(echo "$LAMBDA_RT_CURRENT" \| sed -E 's/^PYTHON_([0-9]+)_([0-9]+)$/\1.\2/')"
1451	21	lat_v="$(echo "$LAMBDA_RT_LATEST" \| sed -E 's/^PYTHON_([0-9]+)_([0-9]+)$/\1.\2/')"
1452	14	if [ "$(compare_semver "$cur_v" "$lat_v")" = "newer" ]; then
1453	7	echo " - LAMBDA_PYTHON_RUNTIME: ${LAMBDA_RT_CURRENT} -> ${LAMBDA_RT_LATEST}"
1454	7	echo "LAMBDA_PYTHON_RUNTIME\|aws_lambda.Runtime\|${LAMBDA_RT_CURRENT}\|${LAMBDA_RT_LATEST}" >> "$CDK_ENUM_RESULTS"
1455		fi
1456		fi
1457
1458		# Lambda Node.js runtime enum
1459	66	LAMBDA_NODE_RT_CURRENT="$(extract_constant_value LAMBDA_NODEJS_RUNTIME)"
1460	66	LAMBDA_NODE_RT_LATEST="$(get_latest_lambda_nodejs_runtime)"
1461	65	if [ -z "$LAMBDA_NODE_RT_CURRENT" ] \|\| [ -z "$LAMBDA_NODE_RT_LATEST" ]; then
1462	2	mark_scan_incomplete "Could not parse the current or latest Lambda Node.js runtime enum."
1463	31	elif [ "$LAMBDA_NODE_RT_CURRENT" != "$LAMBDA_NODE_RT_LATEST" ]; then
1464	7	cur_major="${LAMBDA_NODE_RT_CURRENT#NODEJS_}"
1465	7	cur_major="${cur_major%_X}"
1466	7	lat_major="${LAMBDA_NODE_RT_LATEST#NODEJS_}"
1467	7	lat_major="${lat_major%_X}"
1468	14	if [[ "$cur_major" =~ ^[0-9]+$ ]] && [[ "$lat_major" =~ ^[0-9]+$ ]] \
1469	7	&& [ "$lat_major" -gt "$cur_major" ]; then
1470	7	echo " - LAMBDA_NODEJS_RUNTIME: ${LAMBDA_NODE_RT_CURRENT} -> ${LAMBDA_NODE_RT_LATEST}"
1471	7	echo "LAMBDA_NODEJS_RUNTIME\|aws_lambda.Runtime\|${LAMBDA_NODE_RT_CURRENT}\|${LAMBDA_NODE_RT_LATEST}" >> "$CDK_ENUM_RESULTS"
1472		fi
1473		fi
1474
1475		fi
1476
1477	105	CDK_ENUM_COUNT="$(wc -l < "$CDK_ENUM_RESULTS" 2>/dev/null \| tr -d ' ')"
1478	35	[ -z "$CDK_ENUM_COUNT" ] && CDK_ENUM_COUNT=0
1479
1480		# ---------------------------------------------------------------------------
1481		# Python release
1482		#
1483		# Compares the Lambda Python runtime constant (which encodes the major
1484		# Python version we standardise on across every Lambda in the project)
1485		# against the latest stable Python release on endoflife.date.
1486		#
1487		# This is informational drift — Lambda may not ship support for a brand-
1488		# new Python release for several months — but the signal is useful so
1489		# the operator knows when to start planning a runtime bump. It also
1490		# complements the CDK-enum check above: that check answers "what does
1491		# aws-cdk-lib expose?", this one answers "what has python.org actually
1492		# shipped?".
1493		# ---------------------------------------------------------------------------
1494	35	echo ""
1495	35	echo "=== Checking Python release ==="
1496	35
1497	70	PYTHON_RELEASE_RESULTS="$(mktemp)"
1498	35	PYTHON_RELEASE_SKIP_REASON=""
1499
1500		# Re-read in case the CDK section was skipped and never set the var.
1501	38	LAMBDA_RT_CURRENT="${LAMBDA_RT_CURRENT:-$(extract_constant_value LAMBDA_PYTHON_RUNTIME)}"
1502	70	LATEST_PYTHON="$(get_latest_python_release)"
1503
1504	35	if [ -z "$LATEST_PYTHON" ]; then
1505	2	PYTHON_RELEASE_SKIP_REASON="endoflife.date query failed (network or schema change)."
1506	2	echo " $PYTHON_RELEASE_SKIP_REASON"
1507	33	elif [ -z "$LAMBDA_RT_CURRENT" ]; then
1508	1	PYTHON_RELEASE_SKIP_REASON="Could not parse LAMBDA_PYTHON_RUNTIME for the Python release comparison."
1509	1	echo " $PYTHON_RELEASE_SKIP_REASON"
1510		else
1511	96	cur_v="$(echo "$LAMBDA_RT_CURRENT" \| sed -E 's/^PYTHON_([0-9]+)_([0-9]+)$/\1.\2/')"
1512	32	if [ "$cur_v" != "$LATEST_PYTHON" ] \
1513	18	&& [ "$(compare_semver "$cur_v" "$LATEST_PYTHON")" = "newer" ]; then
1514	8	echo " - python (LAMBDA_PYTHON_RUNTIME): ${cur_v} -> ${LATEST_PYTHON}"
1515	8	echo "python\|${cur_v}\|${LATEST_PYTHON}" >> "$PYTHON_RELEASE_RESULTS"
1516		fi
1517		fi
1518
1519	105	PYTHON_RELEASE_COUNT="$(wc -l < "$PYTHON_RELEASE_RESULTS" 2>/dev/null \| tr -d ' ')"
1520	35	[ -z "$PYTHON_RELEASE_COUNT" ] && PYTHON_RELEASE_COUNT=0
1521
1522		# ---------------------------------------------------------------------------
1523		# Ruby release
1524		#
1525		# Ruby is a CI-only toolchain: bashcov (see the Gemfile) measures which lines
1526		# of each shell script the BATS suite executes, and the unit:bats:shell job
1527		# gets its interpreter from .ruby-version via ruby/setup-ruby. Dependabot
1528		# watches the gems in Gemfile.lock but has nothing to say about the
1529		# interpreter series, so — exactly like .python-version — the pin is compared
1530		# against the newest supported series here. Informational, not a failure: a new
1531		# Ruby series is a deliberate move, not a security patch.
1532		# ---------------------------------------------------------------------------
1533	35	echo ""
1534	35	echo "=== Checking Ruby release ==="
1535	35
1536	70	RUBY_RELEASE_RESULTS="$(mktemp)"
1537	35	RUBY_RELEASE_SKIP_REASON=""
1538
1539	70	RUBY_PIN_CURRENT="$(read_ruby_version_pin .ruby-version)"
1540	70	LATEST_RUBY="$(get_latest_ruby_release)"
1541
1542	35	if [ -z "$LATEST_RUBY" ]; then
1543	2	RUBY_RELEASE_SKIP_REASON="endoflife.date query failed (network or schema change)."
1544	2	echo " $RUBY_RELEASE_SKIP_REASON"
1545	33	elif [ -z "$RUBY_PIN_CURRENT" ]; then
1546	1	RUBY_RELEASE_SKIP_REASON="Could not parse .ruby-version for the Ruby release comparison."
1547	1	echo " $RUBY_RELEASE_SKIP_REASON"
1548		else
1549	32	if [ "$RUBY_PIN_CURRENT" != "$LATEST_RUBY" ] \
1550	62	&& [ "$(compare_semver "$RUBY_PIN_CURRENT" "$LATEST_RUBY")" = "newer" ]; then
1551	8	echo " - ruby (.ruby-version): ${RUBY_PIN_CURRENT} -> ${LATEST_RUBY}"
1552	8	echo "ruby\|${RUBY_PIN_CURRENT}\|${LATEST_RUBY}" >> "$RUBY_RELEASE_RESULTS"
1553		else
1554	24	echo " .ruby-version pins ${RUBY_PIN_CURRENT}; newest supported series is ${LATEST_RUBY}."
1555		fi
1556		fi
1557
1558	105	RUBY_RELEASE_COUNT="$(wc -l < "$RUBY_RELEASE_RESULTS" 2>/dev/null \| tr -d ' ')"
1559	35	[ -z "$RUBY_RELEASE_COUNT" ] && RUBY_RELEASE_COUNT=0
1560
1561		# ---------------------------------------------------------------------------
1562		# Ubuntu LTS base (Slinky Slurm images)
1563		#
1564		# Slinky publishes every Slurm image per Ubuntu LTS base
1565		# (``<slurm>-ubuntu24.04``, ``<slurm>-ubuntu26.04``) and GCO pins one base
1566		# through SLURM_IMAGE_TAG in gco/slurm_config.py. The image sweep above
1567		# deliberately compares within a tag's variant family — a newer Slurm patch
1568		# on the same base is drift there, a newer base never is — so without this
1569		# section the pin could ride an Ubuntu release towards end of life with
1570		# nothing in the report saying so. The cue fires once the newest LTS has
1571		# shipped its first point release (get_latest_ubuntu_lts) and the registry
1572		# carries the pinned Slurm version on that base; until upstream publishes
1573		# that variant there is nothing to move to, and the section says so without
1574		# a finding. Informational: changing base is a deliberate move (re-run the
1575		# live Slurm validation), not a security patch.
1576		# ---------------------------------------------------------------------------
1577	35	echo ""
1578	35	echo "=== Checking Ubuntu LTS base (Slurm images) ==="
1579	35
1580	70	UBUNTU_LTS_RESULTS="$(mktemp)"
1581	35	UBUNTU_LTS_SKIP_REASON=""
1582
1583	70	SLURM_IMAGE_TAG_CURRENT="$(extract_python_string_constant SLURM_IMAGE_TAG gco/slurm_config.py)"
1584	70	SLURM_IMAGE_UBUNTU="$(ubuntu_variant_release "$SLURM_IMAGE_TAG_CURRENT")"
1585		# The registry probe uses slurmd: every Slinky daemon image shares the one
1586		# tag, and the chart-values walk above already yielded its repository.
1587	140	SLURMD_REPOSITORY="$(printf '%s\n' "${CHART_VALUE_IMAGES:-}" \| sed -nE 's#^([^\|]/slurmd):.$#\1#p' \| head -1)"
1588	35	if [ -z "$SLURM_IMAGE_TAG_CURRENT" ]; then
1589	1	UBUNTU_LTS_SKIP_REASON="Could not parse SLURM_IMAGE_TAG from gco/slurm_config.py for the Ubuntu LTS comparison."
1590	1	echo " $UBUNTU_LTS_SKIP_REASON"
1591	34	elif [ -z "$SLURM_IMAGE_UBUNTU" ]; then
1592	1	echo " SLURM_IMAGE_TAG ${SLURM_IMAGE_TAG_CURRENT} is not an Ubuntu variant; nothing to compare."
1593		else
1594	66	LATEST_UBUNTU_LTS="$(get_latest_ubuntu_lts)"
1595	33	if [ -z "$LATEST_UBUNTU_LTS" ]; then
1596	2	UBUNTU_LTS_SKIP_REASON="endoflife.date query failed (network or schema change)."
1597	2	echo " $UBUNTU_LTS_SKIP_REASON"
1598	62	elif [ "$(compare_semver "$SLURM_IMAGE_UBUNTU" "$LATEST_UBUNTU_LTS")" != "newer" ]; then
1599	23	echo " Slurm images are on ubuntu${SLURM_IMAGE_UBUNTU}; newest adoptable Ubuntu LTS is ${LATEST_UBUNTU_LTS}."
1600	8	elif [ -z "$SLURMD_REPOSITORY" ]; then
1601	1	UBUNTU_LTS_SKIP_REASON="Could not find the slurmd image repository in lambda/helm-installer/charts.yaml for the Ubuntu LTS comparison."
1602	1	echo " $UBUNTU_LTS_SKIP_REASON"
1603		else
1604	7	UBUNTU_LTS_CANDIDATE="${SLURM_IMAGE_TAG_CURRENT%-ubuntu*}-ubuntu${LATEST_UBUNTU_LTS}"
1605	7	slurmd_tags=""
1606	27	if ! slurmd_tags="$(skopeo list-tags "${SCAN_SKOPEO_RETRY[@]}" "docker://${SLURMD_REPOSITORY}" 2>/dev/null \
1607		\| jq -r '.Tags[]' 2>/dev/null)" \|\| [ -z "$slurmd_tags" ]; then
1608	1	mark_scan_incomplete "Container registry tag lookup failed for ${SLURMD_REPOSITORY} (Ubuntu LTS comparison)."
1609	6	elif tag_listed "$UBUNTU_LTS_CANDIDATE" "$slurmd_tags"; then
1610	5	echo " - SLURM_IMAGE_TAG (gco/slurm_config.py): ${SLURM_IMAGE_TAG_CURRENT} -> ${UBUNTU_LTS_CANDIDATE} (Ubuntu ${LATEST_UBUNTU_LTS} LTS)"
1611	5	echo "SLURM_IMAGE_TAG (gco/slurm_config.py)\|${SLURM_IMAGE_TAG_CURRENT}\|${UBUNTU_LTS_CANDIDATE}" >> "$UBUNTU_LTS_RESULTS"
1612		else
1613	1	echo " Ubuntu ${LATEST_UBUNTU_LTS} LTS is adoptable, but ${SLURMD_REPOSITORY} does not publish ${UBUNTU_LTS_CANDIDATE} yet; nothing to move to."
1614		fi
1615		fi
1616		fi
1617
1618	105	UBUNTU_LTS_COUNT="$(wc -l < "$UBUNTU_LTS_RESULTS" 2>/dev/null \| tr -d ' ')"
1619	35	[ -z "$UBUNTU_LTS_COUNT" ] && UBUNTU_LTS_COUNT=0
1620
1621		# ---------------------------------------------------------------------------
1622		# Runner images
1623		#
1624		# `runs-on: ubuntu-latest` is not a version pin, so Dependabot has nothing to
1625		# bump and the platform underneath every job changes only when GitHub moves the
1626		# label. Two opposite mistakes are possible: staying on an explicitly pinned
1627		# image long after a newer one is generally available (and eventually on one
1628		# upstream has marked deprecated, which is a removal notice), or chasing an
1629		# image that is still in preview.
1630		#
1631		# check_runner_images.py reports those separately: `--format rows` is drift to
1632		# act on (newer GA, or deprecated), `--format notes` is context (a newer image
1633		# exists but is preview, so the current pin is deliberate). It exits 2 without
1634		# printing anything when the upstream catalog cannot be read, which is treated
1635		# as a skip here rather than as an all-clear.
1636		# ---------------------------------------------------------------------------
1637	35	echo ""
1638	35	echo "=== Checking runner images ==="
1639	35
1640	70	RUNNER_IMAGE_RESULTS="$(mktemp)"
1641	70	RUNNER_IMAGE_NOTES="$(mktemp)"
1642	35	RUNNER_IMAGE_SKIP_REASON=""
1643
1644	35	if python3 .github/scripts/check_runner_images.py --format rows > "$RUNNER_IMAGE_RESULTS" 2>/dev/null; then
1645	33	python3 .github/scripts/check_runner_images.py --format notes > "$RUNNER_IMAGE_NOTES" 2>/dev/null \|\| true
1646	68	while IFS='\|' read -r label current recommended; do
1647	1	[ -z "$label" ] && continue
1648	1	echo " - runner ${label}: ${current} -> ${recommended}"
1649		done < "$RUNNER_IMAGE_RESULTS"
1650	132	while IFS='\|' read -r label current recommended; do
1651	33	[ -z "$label" ] && continue
1652	33	echo " ${label} pins ${current}; ${recommended} exists but is still in preview."
1653		done < "$RUNNER_IMAGE_NOTES"
1654	33	if [ ! -s "$RUNNER_IMAGE_RESULTS" ]; then
1655	32	echo " every runner label in use is the newest generally-available image."
1656		fi
1657		else
1658	2	RUNNER_IMAGE_SKIP_REASON="Could not read the actions/runner-images catalog (network or upstream README change)."
1659	2	echo " $RUNNER_IMAGE_SKIP_REASON"
1660	2	: > "$RUNNER_IMAGE_RESULTS"
1661		fi
1662
1663	105	RUNNER_IMAGE_COUNT="$(wc -l < "$RUNNER_IMAGE_RESULTS" 2>/dev/null \| tr -d ' ')"
1664	35	[ -z "$RUNNER_IMAGE_COUNT" ] && RUNNER_IMAGE_COUNT=0
1665
1666		# ---------------------------------------------------------------------------
1667		# CI tooling pins (public endpoints — no AWS creds)
1668		#
1669		# The workflows install their own pinned tooling — Trivy (cve-scan.yml /
1670		# security.yml), actionlint (lint.yml), Helm + kubectl (deps-scan.yml), and
1671		# kubeconform, Calico, and Metrics Server (integration-tests.yml) — from plain
1672		# ``*_VERSION`` env strings. The integration workflow also pins kind + its node
1673		# image on the ``helm/kind-action`` step. None are ``uses:`` refs or Dockerfile
1674		# ``FROM`` lines, so Dependabot never sees them. Compare each against upstream.
1675		# ---------------------------------------------------------------------------
1676	35	echo ""
1677	35	echo "=== Checking CI tooling pins ==="
1678	35
1679	70	CI_TOOLING_RESULTS="$(mktemp)"
1680		# The kind-action lockstep check below files its finding under Version
1681		# Consistency, so that section's results file has to exist already; it is
1682		# created here, once, and the consistency section appends to it.
1683	70	CONSISTENCY_RESULTS="$(mktemp)"
1684
1685		# check_github_tool <display-name> <current-pin> <owner/repo> <ref-url>
1686		# Records drift when the pinned semver is behind the latest GitHub Release.
1687		check_github_tool() {
1688	280	local name="$1" current="$2" repo="$3" url="$4" latest=""
1689	280	if [ -z "$current" ]; then
1690	8	mark_scan_incomplete "Could not parse the committed version pin for ${name}."
1691	8	return 0
1692		fi
1693	544	latest="$(get_latest_github_release_tag "$repo")"
1694	272	if [ -z "$latest" ]; then
1695	48	mark_scan_incomplete "GitHub release lookup failed for ${name} (${repo})$(github_api_failure_hint)."
1696	24	return 0
1697		fi
1698	248	if [ "$current" != "$latest" ] \
1699	144	&& [ "$(compare_semver "$current" "$latest")" = "newer" ]; then
1700	69	echo " - ${name}: ${current} -> ${latest}"
1701	69	echo "${name}\|${current}\|${latest}\|${url}" >> "$CI_TOOLING_RESULTS"
1702		fi
1703		}
1704
1705		# Trivy (aquasecurity/trivy) — the version-input default of the
1706		# install-trivy composite action, the single pin every caller inherits.
1707	105	TRIVY_PIN="$(extract_install_trivy_pin .github/actions/install-trivy/action.yml \| head -1)"
1708	35	check_github_tool "Trivy (install-trivy action default)" "$TRIVY_PIN" "aquasecurity/trivy" \
1709		"https://github.com/aquasecurity/trivy/releases"
1710
1711		# actionlint (rhysd/actionlint) — lint.yml downloads this release archive.
1712	105	ACTIONLINT_PIN="$(extract_workflow_env_pin ACTIONLINT_VERSION \| head -1)"
1713	35	check_github_tool "actionlint (ACTIONLINT_VERSION)" "$ACTIONLINT_PIN" "rhysd/actionlint" \
1714		"https://github.com/rhysd/actionlint/releases"
1715
1716		# Helm (helm/helm) — the authenticated RUN-line pin in
1717		# lambda/helm-installer/Dockerfile, the single source every CI job derives
1718		# its HELM_VERSION/HELM_SHA256 from at runtime.
1719	140	HELM_PIN="$(extract_helm_installer_pins lambda/helm-installer/Dockerfile \| awk -F'\|' '$1=="HELM_VERSION"{print $2}' \| head -1)"
1720	35	check_github_tool "Helm (helm-installer Dockerfile)" "$HELM_PIN" "helm/helm" \
1721		"https://github.com/helm/helm/releases"
1722
1723		# kubeconform (yannh/kubeconform) — KUBECONFORM_VERSION the
1724		# integration:k8s:manifest-schema job installs to schema-validate the K8s
1725		# manifests. Plain env pin Dependabot doesn't watch; a stale kubeconform
1726		# silently validates against outdated Kubernetes schemas.
1727	105	KUBECONFORM_PIN="$(extract_workflow_env_pin KUBECONFORM_VERSION \| head -1)"
1728	35	check_github_tool "kubeconform (KUBECONFORM_VERSION)" "$KUBECONFORM_PIN" "yannh/kubeconform" \
1729		"https://github.com/yannh/kubeconform/releases"
1730
1731		# Metrics Server (kubernetes-sigs/metrics-server) — kind installs this pin so
1732		# the inference proxy HPA must reach ScalingActive, mirroring the EKS managed
1733		# add-on contract used in production.
1734	105	METRICS_SERVER_PIN="$(extract_workflow_env_pin METRICS_SERVER_VERSION \| head -1)"
1735	35	check_github_tool \
1736		"Metrics Server (METRICS_SERVER_VERSION)" \
1737		"$METRICS_SERVER_PIN" \
1738		"kubernetes-sigs/metrics-server" \
1739		"https://github.com/kubernetes-sigs/metrics-server/releases"
1740	35
1741		# Calico (projectcalico/calico) — kind installs the authenticated release
1742		# manifest so NetworkPolicy behavior is exercised by the E2E job.
1743	105	CALICO_PIN="$(extract_workflow_env_pin CALICO_VERSION \| head -1)"
1744	35	check_github_tool "Calico (CALICO_VERSION)" "$CALICO_PIN" "projectcalico/calico" \
1745		"https://github.com/projectcalico/calico/releases"
1746
1747		# Crossplane function-go-templating (crossplane-contrib/function-go-templating)
1748		# — the composition Function package post-helm-crossplane.yaml installs when
1749		# helm.crossplane is on. The Argo CD, Crossplane and Crossview charts (and
1750		# Crossview's image) are charts.yaml pins the Helm sections above cover; this
1751		# xpkg reference is the one add-on pin outside charts.yaml, and it is not an
1752		# ``image:`` line, so no image sweep would notice it ageing.
1753	105	FUNCTION_GO_TEMPLATING_PIN="$(extract_crossplane_function_pin \
1754		lambda/kubectl-applier-simple/manifests/post-helm-crossplane.yaml function-go-templating \
1755		\| head -1)"
1756	35	check_github_tool "Crossplane function-go-templating (post-helm-crossplane.yaml)" \
1757		"$FUNCTION_GO_TEMPLATING_PIN" "crossplane-contrib/function-go-templating" \
1758		"https://github.com/crossplane-contrib/function-go-templating/releases"
1759
1760		# kind (kubernetes-sigs/kind) — the kind binary on the kind-action step.
1761		# Both kind-action steps (cluster-e2e and examples-smoke) must pin the same
1762		# kind binary + node image; extract_kind_pins de-duplicates identical pins,
1763		# so >1 value per key means the two jobs drifted apart.
1764	70	for kind_key in kind kind-node; do
1765	210	kind_vals="$(extract_kind_pins .github/workflows/integration-tests.yml \
1766		\| awk -F'\|' -v k="$kind_key" '$1==k{print $2}')"
1767	280	kind_distinct="$(printf '%s\n' "$kind_vals" \| sed '/^$/d' \| grep -c .)"
1768	70	if [ "$kind_distinct" -gt 1 ]; then
1769	8	kind_list="$(printf '%s\n' "$kind_vals" \| sed '/^$/d' \| paste -sd',' -)"
1770	2	echo " - ${kind_key} pins disagree across kind-action steps: ${kind_list}"
1771	2	echo "${kind_key} (across kind-action steps)\|${kind_list}" >> "$CONSISTENCY_RESULTS"
1772		fi
1773		done
1774	140	KIND_PIN="$(extract_kind_pins .github/workflows/integration-tests.yml \| awk -F'\|' '$1=="kind"{print $2}' \| head -1)"
1775	35	check_github_tool "kind" "$KIND_PIN" "kubernetes-sigs/kind" \
1776		"https://github.com/kubernetes-sigs/kind/releases"
1777
1778		# kubectl — the authenticated RUN-line pin in lambda/helm-installer/
1779		# Dockerfile (the single source the CI jobs derive from); compared against
1780		# the stable release for its own minor line (dl.k8s.io), the same source
1781		# the Dockerfile.dev kubectl pin uses.
1782	140	KUBECTL_WF_PIN="$(extract_helm_installer_pins lambda/helm-installer/Dockerfile \| awk -F'\|' '$1=="KUBECTL_VERSION"{print $2}' \| head -1)"
1783	35	if [ -n "$KUBECTL_WF_PIN" ]; then
1784	102	kubectl_minor="$(echo "${KUBECTL_WF_PIN#v}" \| cut -d. -f1-2)"
1785	102	if ! kubectl_latest="$(curl -fsSL --max-time 15 "${SCAN_CURL_RETRY[@]}" \
1786		"https://dl.k8s.io/release/stable-${kubectl_minor}.txt" 2>/dev/null \| tr -d '[:space:]')" \
1787	33	\|\| [ -z "$kubectl_latest" ]; then
1788	1	mark_scan_incomplete "kubectl stable-version lookup failed for minor ${kubectl_minor}."
1789	33	elif [ "$KUBECTL_WF_PIN" != "$kubectl_latest" ] \
1790	18	&& [ "$(compare_semver "$KUBECTL_WF_PIN" "$kubectl_latest")" = "newer" ]; then
1791	9	echo " - kubectl (helm-installer Dockerfile): ${KUBECTL_WF_PIN} -> ${kubectl_latest}"
1792	9	echo "kubectl (helm-installer Dockerfile)\|${KUBECTL_WF_PIN}\|${kubectl_latest}\|https://kubernetes.io/releases/" >> "$CI_TOOLING_RESULTS"
1793		fi
1794		else
1795	1	mark_scan_incomplete "Could not parse the kubectl pin from lambda/helm-installer/Dockerfile."
1796		fi
1797
1798		# kind node image (kindest/node) — report a newer PATCH within the pinned K8s
1799		# minor only. Jumping minors is governed by the kind release, not free drift,
1800		# so scoping to the same minor avoids false "upgrade" noise. The pin is tag
1801		# AND digest (the digest half is checked in the Docker section above), so the
1802		# tag is taken from the split reference, never from the text after the last
1803		# colon, which for a digest-pinned image is the digest.
1804	140	KIND_NODE_PIN="$(extract_kind_pins .github/workflows/integration-tests.yml \| awk -F'\|' '$1=="kind-node"{print $2}' \| head -1)"
1805	35	if [ -n "$KIND_NODE_PIN" ]; then
1806	68	if kind_node_parts="$(split_pinned_image_ref "$KIND_NODE_PIN")"; then
1807	99	node_tag="$(echo "$kind_node_parts" \| cut -d'\|' -f2)"
1808		else
1809		# Tag only: still check the tag for a newer patch, and say that the pin
1810		# names a different image after every kind release until a digest binds it.
1811	1	node_tag="${KIND_NODE_PIN##*:}"
1812	1	echo " - kind node image (integration-tests.yml): ${KIND_NODE_PIN} is not pinned by digest"
1813	1	echo "kind node image (integration-tests.yml)\|${KIND_NODE_PIN} is not pinned by digest; use the kindest/node:<tag>@sha256:<digest> reference from the kind release notes" >> "$CONSISTENCY_RESULTS"
1814		fi
1815	102	node_minor="$(echo "${node_tag#v}" \| cut -d. -f1-2)"
1816	233	if ! node_latest="$(skopeo list-tags "${SCAN_SKOPEO_RETRY[@]}" "docker://docker.io/kindest/node" 2>/dev/null \
1817		\| jq -r '.Tags[]' 2>/dev/null \
1818		\| grep -E "^v?${node_minor}\.[0-9]+$" \
1819		\| sort -V \| tail -1)" \|\| [ -z "$node_latest" ]; then
1820	5	mark_scan_incomplete "Container registry lookup failed for kindest/node minor ${node_minor}."
1821	29	elif [ "$node_tag" != "$node_latest" ] \
1822	12	&& [ "$(compare_semver "$node_tag" "$node_latest")" = "newer" ]; then
1823	6	echo " - kind node image (kindest/node): ${node_tag} -> ${node_latest}"
1824	6	echo "kind node image (kindest/node)\|${node_tag}\|${node_latest}\|https://hub.docker.com/r/kindest/node/tags" >> "$CI_TOOLING_RESULTS"
1825		fi
1826		else
1827	1	mark_scan_incomplete "Could not parse the kind node-image pin from integration-tests.yml."
1828		fi
1829
1830	105	CI_TOOLING_COUNT="$(wc -l < "$CI_TOOLING_RESULTS" 2>/dev/null \| tr -d ' ')"
1831	35	[ -z "$CI_TOOLING_COUNT" ] && CI_TOOLING_COUNT=0
1832
1833		# ---------------------------------------------------------------------------
1834		# Version consistency (no network)
1835		#
1836		# Some versions are pinned in more than one place and must move together.
1837		# The other sections answer "is this pin behind upstream?"; this one answers
1838		# "do the copies of this pin agree with each other?" — a class of drift that
1839		# otherwise only surfaces when a formatter/linter behaves differently in CI
1840		# than it does locally.
1841		#
1842		# - ruff: pyproject (dev install) vs the pre-commit hook vs the prebuilt-
1843		# binary ruff-action step in lint.yml.
1844		# - python-version across the workflows vs the project's canonical Python
1845		# (the LAMBDA_PYTHON_RUNTIME the Lambdas ship on).
1846		# - Node major across LAMBDA_NODEJS_RUNTIME, .nvmrc, every package engine,
1847		# and Dockerfile.dev; npm across every packageManager and Dockerfile.dev.
1848		# - AWS CDK CLI across the locked root npm graph and Dockerfile.dev.
1849		# - every repository-owned package.json has a lockfile, exact direct pins,
1850		# and a matching npm entry in Dependabot.
1851		# - the same tool env pin (HELM_VERSION/KUBECTL_VERSION/CALICO_*)
1852		# resolving to different values in different workflow files.
1853		# - every [build-system] requires entry in pyproject.toml is an exact
1854		# ``==`` pin (the drift itself reports through the Python surface).
1855		# - every per-Lambda requirements.txt pin agrees with the version the
1856		# repository resolves centrally (pyproject, then the lock for
1857		# transitives) — the copies that ship to production.
1858		# - no digest-pinned image carries two different digests under one tag,
1859		# which means an upstream re-push was only half applied.
1860		# ---------------------------------------------------------------------------
1861	35	echo ""
1862	35	echo "=== Checking version consistency ==="
1863	35
1864	70	RUFF_PINS="$(extract_ruff_pins pyproject.toml .pre-commit-config.yaml .github/workflows/lint.yml)"
1865	35	if [ -n "$RUFF_PINS" ]; then
1866	170	ruff_distinct="$(echo "$RUFF_PINS" \| cut -d'\|' -f2 \| sort -u \| grep -c .)"
1867	34	if [ "$ruff_distinct" -gt 1 ]; then
1868	4	detail="$(echo "$RUFF_PINS" \| awk -F'\|' '{printf "%s=%s ", $1, $2}' \| sed 's/ *$//')"
1869	1	echo " - ruff pins disagree: $detail"
1870	1	echo "ruff (pyproject / pre-commit / lint action)\|${detail}" >> "$CONSISTENCY_RESULTS"
1871		fi
1872		fi
1873
1874	105	CANON_PY="$(echo "${LAMBDA_RT_CURRENT:-}" \| sed -E 's/^PYTHON_([0-9]+)_([0-9]+)$/\1.\2/')"
1875	38	[ -z "$CANON_PY" ] && CANON_PY="$(extract_constant_value LAMBDA_PYTHON_RUNTIME \| sed -E 's/^PYTHON_([0-9]+)_([0-9]+)$/\1.\2/')"
1876	105	PY_PINS_UNIQUE="$(extract_python_version_pins "$WORKFLOWS_DIR" .python-version \| sort -u)"
1877	35	if [ -n "$PY_PINS_UNIQUE" ]; then
1878	102	py_distinct="$(echo "$PY_PINS_UNIQUE" \| grep -c .)"
1879	102	py_list="$(echo "$PY_PINS_UNIQUE" \| paste -sd',' -)"
1880	100	if [ "$py_distinct" -gt 1 ] \|\| { [ -n "$CANON_PY" ] && [ "$py_list" != "$CANON_PY" ]; }; then
1881	1	echo " - python-version pins: ${py_list} (project runtime: ${CANON_PY:-unknown})"
1882	1	echo "python-version (CI vs runtime)\|CI: ${py_list}; runtime: ${CANON_PY:-unknown}" >> "$CONSISTENCY_RESULTS"
1883		fi
1884		fi
1885
1886	212	NPM_PACKAGE_SOURCES="$(
1887		list_npm_package_dirs . \| while IFS= read -r package_dir; do
1888		[ -n "$package_dir" ] \|\| continue
1889		if [ "$package_dir" = "." ]; then
1890		echo "package.json"
1891		else
1892		echo "${package_dir}/package.json"
1893		fi
1894		done
1895		)"
1896	36
1897	141	NODE_PINS="$(extract_node_major_pins . gco/stacks/constants.py .nvmrc Dockerfile.dev \| sort -u)"
1898	70	EXPECTED_NODE_SOURCES="$(
1899		{
1900		printf '%s\n' gco/stacks/constants.py .nvmrc Dockerfile.dev
1901		printf '%s\n' "$NPM_PACKAGE_SOURCES"
1902		} \| sed '/^$/d' \| sort -u
1903		)"
1904	280	NODE_PIN_SOURCES="$(printf '%s\n' "$NODE_PINS" \| cut -d'\|' -f1 \| sed '/^$/d' \| sort -u)"
1905	140	NODE_MISSING="$(comm -23 <(printf '%s\n' "$EXPECTED_NODE_SOURCES") <(printf '%s\n' "$NODE_PIN_SOURCES"))"
1906	210	node_distinct="$(printf '%s\n' "$NODE_PINS" \| cut -d'\|' -f2 \| sed '/^$/d' \| sort -u \| grep -c .)"
1907	67	if [ -n "$NODE_MISSING" ] \|\| [ "$node_distinct" -gt 1 ]; then
1908	12	node_detail="$(printf '%s\n' "$NODE_PINS" \| awk -F'\|' '{printf "%s=%s ", $1, $2}' \| sed 's/ *$//')"
1909	3	if [ -n "$NODE_MISSING" ]; then
1910	9	node_missing_list="$(printf '%s\n' "$NODE_MISSING" \| paste -sd',' -)"
1911	3	node_detail="${node_detail}; missing=${node_missing_list}"
1912		fi
1913	3	echo " - Node.js major pins disagree or are missing: ${node_detail}"
1914	3	echo "Node.js major (runtime / packages / dev container)\|${node_detail}" >> "$CONSISTENCY_RESULTS"
1915		fi
1916
1917	105	NPM_PINS="$(extract_npm_version_pins . Dockerfile.dev \| sort -u)"
1918	70	EXPECTED_NPM_SOURCES="$(
1919		{
1920		printf '%s\n' Dockerfile.dev
1921		printf '%s\n' "$NPM_PACKAGE_SOURCES"
1922		} \| sed '/^$/d' \| sort -u
1923		)"
1924	280	NPM_PIN_SOURCES="$(printf '%s\n' "$NPM_PINS" \| cut -d'\|' -f1 \| sed '/^$/d' \| sort -u)"
1925	140	NPM_MISSING="$(comm -23 <(printf '%s\n' "$EXPECTED_NPM_SOURCES") <(printf '%s\n' "$NPM_PIN_SOURCES"))"
1926	210	npm_distinct="$(printf '%s\n' "$NPM_PINS" \| cut -d'\|' -f2 \| sed '/^$/d' \| sort -u \| grep -c .)"
1927	68	if [ -n "$NPM_MISSING" ] \|\| [ "$npm_distinct" -gt 1 ]; then
1928	12	npm_detail="$(printf '%s\n' "$NPM_PINS" \| awk -F'\|' '{printf "%s=%s ", $1, $2}' \| sed 's/ *$//')"
1929	3	if [ -n "$NPM_MISSING" ]; then
1930	6	npm_missing_list="$(printf '%s\n' "$NPM_MISSING" \| paste -sd',' -)"
1931	2	npm_detail="${npm_detail}; missing=${npm_missing_list}"
1932		fi
1933	3	echo " - npm pins disagree or are missing: ${npm_detail}"
1934	3	echo "npm (packageManager / dev container)\|${npm_detail}" >> "$CONSISTENCY_RESULTS"
1935		fi
1936
1937	105	CDK_CLI_PINS="$(extract_cdk_cli_pins . Dockerfile.dev \| sort -u)"
1938	280	CDK_CLI_MISSING="$(comm -23 \
1939		<(printf '%s\n' Dockerfile.dev package.json \| sort -u) \
1940		<(printf '%s\n' "$CDK_CLI_PINS" \| cut -d'\|' -f1 \| sed '/^$/d' \| sort -u))"
1941	210	cdk_cli_distinct="$(printf '%s\n' "$CDK_CLI_PINS" \| cut -d'\|' -f2 \| sed '/^$/d' \| sort -u \| grep -c .)"
1942	67	if [ -n "$CDK_CLI_MISSING" ] \|\| [ "$cdk_cli_distinct" -gt 1 ]; then
1943	12	cdk_detail="$(printf '%s\n' "$CDK_CLI_PINS" \| awk -F'\|' '{printf "%s=%s ", $1, $2}' \| sed 's/ *$//')"
1944	3	if [ -n "$CDK_CLI_MISSING" ]; then
1945	9	cdk_missing_list="$(printf '%s\n' "$CDK_CLI_MISSING" \| paste -sd',' -)"
1946	3	cdk_detail="${cdk_detail}; missing=${cdk_missing_list}"
1947		fi
1948	3	echo " - AWS CDK CLI pins disagree or are missing: ${cdk_detail}"
1949	3	echo "AWS CDK CLI (package / dev container)\|${cdk_detail}" >> "$CONSISTENCY_RESULTS"
1950		fi
1951
1952	70	NPM_MANAGEMENT_PROBLEMS="$(check_npm_package_management . .github/dependabot.yml)"
1953	35	if [ -n "$NPM_MANAGEMENT_PROBLEMS" ]; then
1954	4	while IFS='\|' read -r manifest problem; do
1955	1	[ -n "$manifest" ] \|\| continue
1956	1	echo " - npm dependency management: ${manifest}: ${problem}"
1957	1	echo "npm dependency management\|${manifest}: ${problem}" >> "$CONSISTENCY_RESULTS"
1958		done <<< "$NPM_MANAGEMENT_PROBLEMS"
1959		fi
1960
1961		# Every tool pinned in more than one workflow (or more than one job) must
1962		# agree. CALICO_* and METRICS_SERVER_* are here because the kind jobs install
1963		# them per job — two jobs on different Calico builds would enforce
1964		# NetworkPolicy with two different engines, and a version/checksum pair that
1965		# disagrees fails the download as what looks like a flake. The PR-time half of
1966		# this contract lives in
1967		# tests/test_supply_chain_integrity.py::test_repeated_workflow_pins_agree_across_jobs.
1968		# (Trivy is absent from this list on purpose: its pin is the install-trivy
1969		# composite action's input default, a single declaration that cannot
1970		# disagree with itself.)
1971		# (Helm and kubectl are absent from this list on purpose: their pins live
1972		# only in lambda/helm-installer/Dockerfile — workflows derive their env
1973		# copies from it at runtime, so a checked-in workflow declaration that
1974		# could disagree no longer exists. The guard below still catches a stray
1975		# reintroduced copy.)
1976	140	for consistency_var in \
1977		CALICO_VERSION CALICO_SHA256 METRICS_SERVER_VERSION METRICS_SERVER_SHA256; do
1978	280	cvals="$(extract_workflow_env_pin "$consistency_var")"
1979	420	cnum="$(echo "$cvals" \| grep -c .)"
1980	140	if [ "$cnum" -gt 1 ]; then
1981	3	clist="$(echo "$cvals" \| paste -sd',' -)"
1982	1	echo " - ${consistency_var} disagrees across workflows: ${clist}"
1983	1	echo "${consistency_var} (across workflows)\|${clist}" >> "$CONSISTENCY_RESULTS"
1984		fi
1985		done
1986
1987		# helm / kubectl pins hardcoded in lambda/helm-installer/Dockerfile RUN-line
1988		# URLs must agree with the workflow env pins (and, for kubectl, with the
1989		# Dockerfile.dev ARG). These URL literals were previously invisible to every
1990		# check — the integration-tests workflow even carries a comment noting the
1991		# Lambda copy "isn't caught by the consistency check". Now it is.
1992	70	INSTALLER_PINS="$(extract_helm_installer_pins lambda/helm-installer/Dockerfile)"
1993	35	if [ -n "$INSTALLER_PINS" ]; then
1994	68	for tool_var in HELM_VERSION KUBECTL_VERSION; do
1995	204	installer_val="$(printf '%s\n' "$INSTALLER_PINS" \| awk -F'\|' -v v="$tool_var" '$1==v{print $2}')"
1996	68	[ -n "$installer_val" ] \|\| continue
1997	68	all_vals="$installer_val"
1998		# Workflows derive their copies from the installer Dockerfile at
1999		# runtime, so a checked-in workflow declaration is itself a finding:
2000		# it would shadow the derive step's GITHUB_ENV export and drift.
2001	136	wf_vals="$(extract_workflow_env_pin "$tool_var")"
2002	68	if [ -n "$wf_vals" ]; then
2003	1	echo " - ${tool_var} is declared literally in a workflow again (should derive from the installer Dockerfile): ${wf_vals}"
2004	1	echo "${tool_var} (literal workflow copy reintroduced)\|${wf_vals}" >> "$CONSISTENCY_RESULTS"
2005	2	all_vals="$(printf '%s\n%s' "$all_vals" "$wf_vals")"
2006		fi
2007	68	if [ "$tool_var" = "KUBECTL_VERSION" ]; then
2008	102	dev_val="$(extract_dockerfile_pins Dockerfile.dev \| awk -F'\|' '$1=="KUBECTL_VERSION"{print $2}')"
2009	100	[ -n "$dev_val" ] && all_vals="$(printf '%s\n%s' "$all_vals" "$dev_val")"
2010		fi
2011	340	tool_distinct="$(printf '%s\n' "$all_vals" \| sed '/^$/d' \| sort -u \| grep -c .)"
2012	68	if [ "$tool_distinct" -gt 1 ]; then
2013	10	tool_list="$(printf '%s\n' "$all_vals" \| sed '/^$/d' \| sort -u \| paste -sd',' -)"
2014	2	echo " - ${tool_var} disagrees between helm-installer Dockerfile, workflows, and Dockerfile.dev: ${tool_list}"
2015	2	echo "${tool_var} (helm-installer Dockerfile / workflows / Dockerfile.dev)\|${tool_list}" >> "$CONSISTENCY_RESULTS"
2016		fi
2017		done
2018		fi
2019
2020		# The kubernetes Python client is generated per Kubernetes minor, and the
2021		# PR-time guard lets it trail cdk.json's minor by one so the cluster can move
2022		# before upstream ships the matching client. Nothing else would remind anyone
2023		# to close that gap, so it is a consistency finding until the client catches
2024		# up (or, should the guard ever be bypassed, when it leads or lags further).
2025	70	K8S_CLIENT_PIN="$(extract_kubernetes_client_pin pyproject.toml)"
2026	105	K8S_CLIENT_PROBLEM="$(check_kubernetes_client_skew "$K8S_CLIENT_PIN" "$(extract_k8s_version cdk.json)")"
2027	35	if [ -n "$K8S_CLIENT_PROBLEM" ]; then
2028	3	echo " - kubernetes client vs cluster: ${K8S_CLIENT_PROBLEM}"
2029	3	echo "kubernetes Python client (pyproject.toml / cdk.json)\|${K8S_CLIENT_PROBLEM}" >> "$CONSISTENCY_RESULTS"
2030		fi
2031
2032		# Build-backend pins must use the same exact ``==`` shape as every other
2033		# Python dependency in pyproject.toml, or the version resolved inside
2034		# pip's build isolation floats with upstream releases. An empty result is
2035		# itself a finding — [build-system] always exists here, so nothing coming
2036		# back means the table was removed or the TOML no longer parses, and a
2037		# parse break must not silently drop the check.
2038	36	BUILD_SYSTEM_PINS="${BUILD_SYSTEM_PINS:-$(extract_build_system_pins pyproject.toml)}"
2039	35	if [ -z "$BUILD_SYSTEM_PINS" ]; then
2040	1	echo " - pyproject.toml [build-system] requires is missing or unparseable"
2041	1	echo "build-system requires (pyproject.toml)\|missing or unparseable" >> "$CONSISTENCY_RESULTS"
2042		else
2043	136	while IFS='\|' read -r bs_name bs_version bs_raw; do
2044	34	[ -n "$bs_raw" ] \|\| continue
2045	34	if [ -z "$bs_version" ]; then
2046	1	echo " - build-system requires entry is not an exact ==X.Y.Z pin: ${bs_raw}"
2047	1	echo "build-system requires (pyproject.toml)\|'${bs_raw}' must be an exact ==X.Y.Z pin" >> "$CONSISTENCY_RESULTS"
2048		fi
2049		done <<< "$BUILD_SYSTEM_PINS"
2050		fi
2051
2052		# Each Lambda is packaged independently and carries its own requirements.txt,
2053		# so a library like boto3 is pinned centrally and in up to six Lambda copies.
2054		# Nothing watched the copies: a bump applied to pyproject.toml and the lock left
2055		# them behind silently, and the handlers shipped a boto3 that nothing in CI ever
2056		# exercised. This is the one drift surface that reaches production directly, so
2057		# the report names the file and the version it must move to. The PR-time half of
2058		# this contract lives in
2059		# tests/test_integration.py::TestDependencyVersionConsistency::test_lambda_requirements_match_pyproject.
2060	70	LAMBDA_PIN_PROBLEMS="$(check_lambda_requirements_pins . pyproject.toml requirements-lock.txt)"
2061	35	if [ -n "$LAMBDA_PIN_PROBLEMS" ]; then
2062	8	while IFS='\|' read -r lambda_req lambda_problem; do
2063	2	[ -n "$lambda_req" ] \|\| continue
2064	2	echo " - Lambda runtime pin: ${lambda_req}: ${lambda_problem}"
2065	2	echo "Lambda runtime pins\|${lambda_req}: ${lambda_problem}" >> "$CONSISTENCY_RESULTS"
2066		done <<< "$LAMBDA_PIN_PROBLEMS"
2067		fi
2068
2069		# An immutable digest is only immutable where it is written down. When an
2070		# upstream tag is re-pushed and the pin is refreshed in one file but restated as
2071		# a literal in another, nothing reconciled the two until whichever test held the
2072		# stale copy happened to run. Two digests under one tag is unambiguous drift.
2073	70	IMAGE_DIGEST_PROBLEMS="$(check_image_digest_consistency .)"
2074	35	if [ -n "$IMAGE_DIGEST_PROBLEMS" ]; then
2075	4	while IFS='\|' read -r image_repo image_problem; do
2076	1	[ -n "$image_repo" ] \|\| continue
2077	1	echo " - image digest: ${image_repo}: ${image_problem}"
2078	1	echo "Image digest copies\|${image_repo}: ${image_problem}" >> "$CONSISTENCY_RESULTS"
2079		done <<< "$IMAGE_DIGEST_PROBLEMS"
2080		fi
2081
2082	105	CONSISTENCY_COUNT="$(wc -l < "$CONSISTENCY_RESULTS" 2>/dev/null \| tr -d ' ')"
2083	35	[ -z "$CONSISTENCY_COUNT" ] && CONSISTENCY_COUNT=0
2084
2085		# ---------------------------------------------------------------------------
2086		# Base-image security epochs (no network)
2087		#
2088		# The service images (Debian) and the helm-installer Lambda (AL2023) pull OS
2089		# security patches at build time behind a hand-bumped ``*_SECURITY_EPOCH``
2090		# ARG that busts the CI layer cache. Nothing else reminds anyone to move the
2091		# date, so a stale epoch silently reuses an old upgrade layer. Trivy's
2092		# container scan is the backstop; this flags an epoch older than the window
2093		# as the proactive nudge. Only the real Dockerfiles are scanned — the
2094		# generated ``*-build`` staging copies are skipped.
2095		# ---------------------------------------------------------------------------
2096	35	echo ""
2097	35	echo "=== Checking base-image security epochs ==="
2098	35
2099	70	EPOCH_RESULTS="$(mktemp)"
2100	35	EPOCH_FILES=(dockerfiles/Dockerfile.* Dockerfile.dev lambda/helm-installer/Dockerfile)
2101	115	for df in "${EPOCH_FILES[@]}"; do
2102	118	[ -f "$df" ] \|\| continue
2103	558	extract_security_epochs "$df" \| while IFS='\|' read -r epoch_arg epoch_date; do
2104	111	[ -z "$epoch_date" ] && continue
2105	222	epoch_age="$(days_since "$epoch_date")"
2106	111	[ -z "$epoch_age" ] && continue
2107	111	if [ "$epoch_age" -gt "$SECURITY_EPOCH_STALE_DAYS" ]; then
2108	3	echo " - ${df} (${epoch_arg}): ${epoch_date} (${epoch_age} days old)"
2109	3	echo "${df}\|${epoch_arg}\|${epoch_date}\|${epoch_age}" >> "$EPOCH_RESULTS"
2110		fi
2111		done
2112		done
2113
2114	105	EPOCH_COUNT="$(wc -l < "$EPOCH_RESULTS" 2>/dev/null \| tr -d ' ')"
2115	35	[ -z "$EPOCH_COUNT" ] && EPOCH_COUNT=0
2116
2117		# ---------------------------------------------------------------------------
2118		# Suppression expiries (no network)
2119		#
2120		# ``.trivyignore`` / ``.pip-audit-ignore`` / ``.npm-audit-ignore`` entries
2121		# carry an ``exp:YYYY-MM-DD`` marker. The CI validators hard-fail a PR on the
2122		# day an entry expires; this surfaces entries expiring soon so they get
2123		# re-evaluated (fixed upstream? extend with a new justification?) before they
2124		# break a build.
2125		# ---------------------------------------------------------------------------
2126	35	echo ""
2127	35	echo "=== Checking suppression expiries ==="
2128	35
2129	70	SUPPRESSION_RESULTS="$(mktemp)"
2130	105	for supfile in .github/config/.trivyignore .github/config/.pip-audit-ignore .github/config/.npm-audit-ignore; do
2131	108	[ -f "$supfile" ] \|\| continue
2132	204	supbase="$(basename "$supfile")"
2133	518	parse_suppression_expiries "$supfile" \| while IFS='\|' read -r sup_id sup_date; do
2134	106	[ -z "$sup_date" ] && continue
2135	212	sup_left="$(days_until "$sup_date")"
2136	106	[ -z "$sup_left" ] && continue
2137	106	if [ "$sup_left" -le "$SUPPRESSION_EXPIRY_WARN_DAYS" ]; then
2138	21	echo " - ${supbase}: ${sup_id} expires ${sup_date} (${sup_left} days)"
2139	21	echo "${supbase}\|${sup_id}\|${sup_date}\|${sup_left}" >> "$SUPPRESSION_RESULTS"
2140		fi
2141		done
2142		done
2143
2144	105	SUPPRESSION_COUNT="$(wc -l < "$SUPPRESSION_RESULTS" 2>/dev/null \| tr -d ' ')"
2145	35	[ -z "$SUPPRESSION_COUNT" ] && SUPPRESSION_COUNT=0
2146
2147		# ---------------------------------------------------------------------------
2148		# Lockfile freshness (no network)
2149		#
2150		# ``requirements-lock.txt`` is compiled from ``pyproject.toml`` with
2151		# ``pip-compile --all-extras``. Every direct dependency must use an exact,
2152		# concrete pin and is matched to the lock by normalized name, canonical marker
2153		# identity, and version. Missing or mismatched records mean the lock is stale;
2154		# unrelated transitive pins are ignored.
2155		# ---------------------------------------------------------------------------
2156	35	echo ""
2157	35	echo "=== Checking lockfile freshness ==="
2158	35
2159	70	LOCKFILE_RESULTS="$(mktemp)"
2160	70	LOCKFILE_RAW="$(mktemp)"
2161	35	if check_lockfile_freshness pyproject.toml requirements-lock.txt > "$LOCKFILE_RAW"; then
2162	70	while IFS='\|' read -r lock_name expected_version locked_version; do
2163	2	[ -z "$lock_name" ] && continue
2164	2	if [ "$locked_version" = "<missing>" ]; then
2165	1	echo " - direct dep missing from requirements-lock.txt: ${lock_name}==${expected_version}"
2166		else
2167	1	echo " - direct dep version mismatch: ${lock_name}==${expected_version} (lock has ${locked_version})"
2168		fi
2169	2	echo "${lock_name}\|${expected_version}\|${locked_version}" >> "$LOCKFILE_RESULTS"
2170		done < "$LOCKFILE_RAW"
2171		else
2172	2	mark_scan_incomplete "Lockfile freshness validation failed; inspect its error above."
2173		fi
2174	35	rm -f "$LOCKFILE_RAW"
2175
2176	105	LOCKFILE_COUNT="$(wc -l < "$LOCKFILE_RESULTS" 2>/dev/null \| tr -d ' ')"
2177	35	[ -z "$LOCKFILE_COUNT" ] && LOCKFILE_COUNT=0
2178
2179		# ---------------------------------------------------------------------------
2180		# Accelerator catalog and Karpenter NodePools
2181		#
2182		# The deterministic check always runs and validates the reviewed catalog
2183		# against every NodePool plus the exact cdk.json capacity-history watch list.
2184		# With AWS credentials, the monthly job also compares the catalog against the
2185		# union of NVIDIA GPU / AWS Neuron types returned across enabled commercial
2186		# Regions. Ordinary policy/catalog drift joins the rolling dependency issue;
2187		# execution or parser failures become one operational finding, never a
2188		# false-clean result.
2189		# ---------------------------------------------------------------------------
2190	35	echo ""
2191	35	echo "=== Checking accelerator catalog and Karpenter NodePools ==="
2192	35
2193	70	ACCELERATOR_OFFLINE_REPORT="$(mktemp)"
2194	70	ACCELERATOR_ONLINE_REPORT="$(mktemp)"
2195	70	ACCELERATOR_ONLINE_SUMMARY="$(mktemp)"
2196	70	ACCELERATOR_OFFLINE_ERROR="$(mktemp)"
2197	70	ACCELERATOR_ONLINE_ERROR="$(mktemp)"
2198	35	ACCELERATOR_OFFLINE_COUNT=0
2199	35	ACCELERATOR_ONLINE_COUNT=0
2200	35	ACCELERATOR_SKIP_REASON=""
2201	35	ACCELERATOR_SUMMARY_SKIP_REASON=""
2202
2203		write_accelerator_operational_report() {
2204	5	local report_path="$1" title="$2" detail="$3" error_path="$4"
2205		{
2206	5	echo "## ${title}"
2207	5	echo ""
2208	5	echo "Status: OPERATIONAL ERROR."
2209	5	echo ""
2210	5	echo "### Accelerator maintenance check could not complete"
2211	5	echo ""
2212	5	echo "- Why: ${detail}"
2213	5	echo "- Recommended change: Re-run the command locally, repair the tool or credentials, and do not treat this scan as current until it succeeds."
2214	5	if [ -s "$error_path" ]; then
2215	2	echo "- Tool output:"
2216	2	sed 's/^/ /' "$error_path"
2217		fi
2218		} > "$report_path"
2219		}
2220
2221		record_accelerator_operational_error() {
2222	5	local report_path="$1" title="$2" detail="$3" error_path="$4"
2223	5	write_accelerator_operational_report "$report_path" "$title" "$detail" "$error_path"
2224	5	mark_scan_incomplete "${title}: ${detail}"
2225		}
2226
2227	35	python3 scripts/accelerator_catalog.py validate \
2228		--format markdown \
2229		--output "$ACCELERATOR_OFFLINE_REPORT" \
2230		2>"$ACCELERATOR_OFFLINE_ERROR"
2231	35	ACCELERATOR_OFFLINE_STATUS=$?
2232	35	if [ "$ACCELERATOR_OFFLINE_STATUS" -eq 0 ]; then
2233	32	echo " Offline NodePool/watch-list policy is current."
2234	3	elif [ "$ACCELERATOR_OFFLINE_STATUS" -eq 1 ]; then
2235	5	ACCELERATOR_OFFLINE_COUNT="$(grep -c '^### ' "$ACCELERATOR_OFFLINE_REPORT" \|\| true)"
2236	2	if ! [[ "$ACCELERATOR_OFFLINE_COUNT" =~ ^[1-9][0-9]*$ ]]; then
2237	1	ACCELERATOR_OFFLINE_COUNT=1
2238	1	record_accelerator_operational_error \
2239		"$ACCELERATOR_OFFLINE_REPORT" \
2240		"Offline accelerator catalog validation" \
2241		"The validator reported drift but emitted no parseable actionable findings." \
2242		"$ACCELERATOR_OFFLINE_ERROR"
2243		else
2244	1	echo " Found ${ACCELERATOR_OFFLINE_COUNT} offline accelerator policy finding(s)."
2245		fi
2246		else
2247	1	ACCELERATOR_OFFLINE_COUNT=1
2248	1	record_accelerator_operational_error \
2249		"$ACCELERATOR_OFFLINE_REPORT" \
2250		"Offline accelerator catalog validation" \
2251		"The deterministic validator exited with status ${ACCELERATOR_OFFLINE_STATUS}." \
2252		"$ACCELERATOR_OFFLINE_ERROR"
2253	1	echo " Offline accelerator validator failed operationally."
2254		fi
2255
2256	35	if ! aws sts get-caller-identity >/dev/null 2>&1; then
2257	3	ACCELERATOR_SKIP_REASON="No AWS credentials available for the online EC2 catalog check (needs ec2:DescribeRegions and ec2:DescribeInstanceTypes); offline policy validation still ran."
2258	3	echo " $ACCELERATOR_SKIP_REASON"
2259		else
2260	32	python3 scripts/accelerator_catalog.py check-online \
2261		--report "$ACCELERATOR_ONLINE_REPORT" \
2262		--json-summary \
2263		>"$ACCELERATOR_ONLINE_SUMMARY" \
2264		2>"$ACCELERATOR_ONLINE_ERROR"
2265	32	ACCELERATOR_ONLINE_STATUS=$?
2266	35	if [ "$ACCELERATOR_ONLINE_STATUS" -eq 0 ] \|\| [ "$ACCELERATOR_ONLINE_STATUS" -eq 1 ]; then
2267	62	if ACCELERATOR_ONLINE_COUNT="$(parse_accelerator_drift_count "$ACCELERATOR_ONLINE_SUMMARY")"; then
2268	58	if { [ "$ACCELERATOR_ONLINE_STATUS" -eq 0 ] && [ "$ACCELERATOR_ONLINE_COUNT" -ne 0 ]; } \
2269	31	\|\| { [ "$ACCELERATOR_ONLINE_STATUS" -eq 1 ] && [ "$ACCELERATOR_ONLINE_COUNT" -eq 0 ]; }; then
2270	1	ACCELERATOR_ONLINE_COUNT=1
2271	1	record_accelerator_operational_error \
2272		"$ACCELERATOR_ONLINE_REPORT" \
2273		"Online EC2 accelerator catalog drift" \
2274		"The command exit status disagreed with its JSON drift summary." \
2275		"$ACCELERATOR_ONLINE_ERROR"
2276	1	echo " Online accelerator scan returned an inconsistent result."
2277	29	elif [ "$ACCELERATOR_ONLINE_COUNT" -eq 0 ]; then
2278	27	echo " Live EC2 accelerator catalog is current."
2279		else
2280	2	echo " Found ${ACCELERATOR_ONLINE_COUNT} live EC2 catalog drift finding(s)."
2281		fi
2282		else
2283	1	ACCELERATOR_ONLINE_COUNT=1
2284	1	record_accelerator_operational_error \
2285		"$ACCELERATOR_ONLINE_REPORT" \
2286		"Online EC2 accelerator catalog drift" \
2287		"The online scanner emitted a missing or malformed JSON summary." \
2288		"$ACCELERATOR_ONLINE_ERROR"
2289	1	echo " Online accelerator scan summary could not be parsed."
2290		fi
2291		else
2292	1	ACCELERATOR_ONLINE_COUNT=1
2293	1	record_accelerator_operational_error \
2294		"$ACCELERATOR_ONLINE_REPORT" \
2295		"Online EC2 accelerator catalog drift" \
2296		"The online scanner exited with status ${ACCELERATOR_ONLINE_STATUS}." \
2297		"$ACCELERATOR_ONLINE_ERROR"
2298	1	echo " Online accelerator scanner failed operationally."
2299		fi
2300		fi
2301
2302	35	ACCELERATOR_COUNT=$((ACCELERATOR_OFFLINE_COUNT + ACCELERATOR_ONLINE_COUNT))
2303	38	if [ -n "$ACCELERATOR_SKIP_REASON" ] && [ "$ACCELERATOR_COUNT" -eq 0 ]; then
2304	3	ACCELERATOR_SUMMARY_SKIP_REASON="$ACCELERATOR_SKIP_REASON"
2305		fi
2306
2307		# ---------------------------------------------------------------------------
2308		# Summary + Markdown report
2309		# ---------------------------------------------------------------------------
2310	35	echo ""
2311	35	echo "=== Summary ==="
2312	35	echo "Python packages outdated: $PYTHON_COUNT"
2313	35	echo "Docker images outdated: $DOCKER_COUNT"
2314	35	echo "Helm charts outdated: $HELM_COUNT"
2315	35	if [ -n "$ADDON_SKIP_REASON" ]; then
2316	6	echo "EKS add-ons outdated: (skipped)"
2317		else
2318	29	echo "EKS add-ons outdated: $ADDON_COUNT"
2319		fi
2320	35	if [ -n "$EKS_K8S_SKIP_REASON" ]; then
2321	6	echo "EKS Kubernetes version: (skipped)"
2322		else
2323	29	echo "EKS Kubernetes version: $EKS_K8S_COUNT"
2324		fi
2325	35	if [ -n "$AURORA_SKIP_REASON" ]; then
2326	5	echo "Aurora PostgreSQL: (skipped)"
2327		else
2328	30	echo "Aurora PostgreSQL: $AURORA_COUNT"
2329		fi
2330	35	if [ -n "$EMR_SKIP_REASON" ]; then
2331	6	echo "EMR Serverless release: (skipped)"
2332		else
2333	29	echo "EMR Serverless release: $EMR_COUNT"
2334		fi
2335	35	if [ -n "$BEDROCK_MODEL_SKIP_REASON" ]; then
2336	6	echo "Bedrock default model: (skipped)"
2337		else
2338	29	echo "Bedrock default model: $BEDROCK_MODEL_COUNT"
2339		fi
2340	35	if [ -n "$ACCELERATOR_SKIP_REASON" ]; then
2341	3	echo "Accelerator catalog: ${ACCELERATOR_COUNT} (online skipped)"
2342		else
2343	32	echo "Accelerator catalog: $ACCELERATOR_COUNT"
2344		fi
2345	35	echo "Dockerfile.dev pins: $DOCKERFILE_COUNT"
2346	35	echo "Pre-commit hooks: $PRECOMMIT_COUNT"
2347	35	if [ -n "$CDK_ENUM_SKIP_REASON" ]; then
2348	2	echo "CDK enum constants: (skipped)"
2349		else
2350	33	echo "CDK enum constants: $CDK_ENUM_COUNT"
2351		fi
2352	35	if [ -n "$PYTHON_RELEASE_SKIP_REASON" ]; then
2353	3	echo "Python release: (skipped)"
2354		else
2355	32	echo "Python release: $PYTHON_RELEASE_COUNT"
2356		fi
2357	35	if [ -n "$RUBY_RELEASE_SKIP_REASON" ]; then
2358	3	echo "Ruby release: (skipped)"
2359		else
2360	32	echo "Ruby release: $RUBY_RELEASE_COUNT"
2361		fi
2362	35	if [ -n "$UBUNTU_LTS_SKIP_REASON" ]; then
2363	4	echo "Ubuntu LTS base: (skipped)"
2364		else
2365	31	echo "Ubuntu LTS base: $UBUNTU_LTS_COUNT"
2366		fi
2367	35	if [ -n "$RUNNER_IMAGE_SKIP_REASON" ]; then
2368	2	echo "Runner images: (skipped)"
2369		else
2370	33	echo "Runner images: $RUNNER_IMAGE_COUNT"
2371		fi
2372	35	if [ -n "$AUTOPILOT_SKIP_REASON" ]; then
2373	5	echo "GCO autopilot pins: (skipped)"
2374		else
2375	30	echo "GCO autopilot pins: $AUTOPILOT_COUNT"
2376		fi
2377	35	echo "CI tooling pins: $CI_TOOLING_COUNT"
2378	35	echo "Version consistency: $CONSISTENCY_COUNT"
2379	35	echo "Base-image epochs: $EPOCH_COUNT"
2380	35	echo "Suppression expiries: $SUPPRESSION_COUNT"
2381	35	echo "Lockfile freshness: $LOCKFILE_COUNT"
2382	125	INCOMPLETE_LOOKUP_COUNT="$(sort -u "$INCOMPLETE_REASONS_FILE" 2>/dev/null \| grep -c . \|\| true)"
2383	35	echo "Incomplete lookups: ${INCOMPLETE_LOOKUP_COUNT:-0}"
2384
2385	35	SCAN_COMPLETE=true
2386	35	if ! dependency_scan_is_complete \
2387		"$INCOMPLETE_REASONS_FILE" \
2388		"$ADDON_SKIP_REASON" \
2389		"$EKS_K8S_SKIP_REASON" \
2390		"$AURORA_SKIP_REASON" \
2391		"$EMR_SKIP_REASON" \
2392		"$BEDROCK_MODEL_SKIP_REASON" \
2393		"$ACCELERATOR_SKIP_REASON" \
2394		"$AUTOPILOT_SKIP_REASON" \
2395		"$CDK_ENUM_SKIP_REASON" \
2396		"$PYTHON_RELEASE_SKIP_REASON" \
2397		"$RUBY_RELEASE_SKIP_REASON" \
2398		"$UBUNTU_LTS_SKIP_REASON" \
2399		"$RUNNER_IMAGE_SKIP_REASON"; then
2400	20	SCAN_COMPLETE=false
2401		fi
2402
2403		# ----- Machine-readable findings -----
2404		# One record per surface, in the order of the summary table below, with the
2405		# columns named the way the Markdown tables label them. Rows are the same
2406		# pipe-delimited results the tables render; the Python surface is already
2407		# JSON and the accelerator surface carries its two Markdown reports.
2408	105	PYTHON_FINDINGS="$(printf '%s' "${PYTHON_OUTDATED:-[]}" \
2409		\| jq '[.[] \| {name: .name, current: .version, latest: .latest_version}]')"
2410	35	findings_surface_json "Python Packages" "routine" "$PYTHON_COUNT" "" "$PYTHON_FINDINGS"
2411	35	findings_surface "npm Packages" "routine" "$NPM_COUNT" "" "graph\|package\|current\|latest" "$NPM_RESULTS"
2412	35	findings_surface "Docker Images" "routine" "$DOCKER_COUNT" "" "image\|current\|latest" "$DOCKER_RESULTS"
2413	35	findings_surface "Helm Charts" "routine" "$HELM_COUNT" "" "chart\|name\|current\|latest" "$HELM_RESULTS"
2414	35	findings_surface "EKS Add-ons" "routine" "$ADDON_COUNT" "$ADDON_SKIP_REASON" "addon\|current\|latest" "$ADDON_RESULTS"
2415	35	findings_surface "EKS Kubernetes Version" "act soon" "$EKS_K8S_COUNT" "$EKS_K8S_SKIP_REASON" "pin\|current\|latest\|standard_support_ends" "$EKS_K8S_RESULTS"
2416	35	findings_surface "Aurora PostgreSQL Engine" "routine" "$AURORA_COUNT" "$AURORA_SKIP_REASON" "engine\|current\|latest" "$AURORA_RESULTS"
2417	35	findings_surface "EMR Serverless" "routine" "$EMR_COUNT" "$EMR_SKIP_REASON" "release\|current\|latest" "$EMR_RESULTS"
2418	35	findings_surface "Bedrock Default Model" "routine" "$BEDROCK_MODEL_COUNT" "$BEDROCK_MODEL_SKIP_REASON" "key\|current\|latest" "$BEDROCK_MODEL_RESULTS"
2419	70	ACCELERATOR_EXTRA="$(jq -n --rawfile offline "$ACCELERATOR_OFFLINE_REPORT" --rawfile online "$ACCELERATOR_ONLINE_REPORT" \
2420		'{offline_report_markdown: $offline, online_report_markdown: $online}')"
2421	35	findings_surface_json "Accelerator Catalog and NodePools" "act soon" "$ACCELERATOR_COUNT" "$ACCELERATOR_SUMMARY_SKIP_REASON" "[]" "$ACCELERATOR_EXTRA"
2422	35	findings_surface "Dockerfile.dev Pins" "routine" "$DOCKERFILE_COUNT" "" "pin\|current\|latest" "$DOCKERFILE_RESULTS"
2423	35	findings_surface "GCO Autopilot Pins" "act soon" "$AUTOPILOT_COUNT" "$AUTOPILOT_SKIP_REASON" "surface\|current\|latest\|url" "$AUTOPILOT_RESULTS"
2424	35	findings_surface "Pre-commit Hooks" "routine" "$PRECOMMIT_COUNT" "" "repo\|current\|latest" "$PRECOMMIT_RESULTS"
2425	35	findings_surface "CDK Enum Constants" "routine" "$CDK_ENUM_COUNT" "$CDK_ENUM_SKIP_REASON" "constant\|enum_class\|current\|latest" "$CDK_ENUM_RESULTS"
2426	35	findings_surface "Python Release" "informational" "$PYTHON_RELEASE_COUNT" "$PYTHON_RELEASE_SKIP_REASON" "surface\|current\|latest" "$PYTHON_RELEASE_RESULTS"
2427	35	findings_surface "Ruby Release" "informational" "$RUBY_RELEASE_COUNT" "$RUBY_RELEASE_SKIP_REASON" "surface\|current\|latest" "$RUBY_RELEASE_RESULTS"
2428	35	findings_surface "Ubuntu LTS Base" "informational" "$UBUNTU_LTS_COUNT" "$UBUNTU_LTS_SKIP_REASON" "surface\|current\|latest" "$UBUNTU_LTS_RESULTS"
2429	35	findings_surface "Runner Images" "act soon" "$RUNNER_IMAGE_COUNT" "$RUNNER_IMAGE_SKIP_REASON" "label\|current\|latest" "$RUNNER_IMAGE_RESULTS"
2430	35	findings_surface "CI Tooling" "act soon" "$CI_TOOLING_COUNT" "" "tool\|current\|latest\|url" "$CI_TOOLING_RESULTS"
2431	35	findings_surface "Version Consistency" "routine" "$CONSISTENCY_COUNT" "" "what\|pinned_values" "$CONSISTENCY_RESULTS"
2432	35	findings_surface "Base-image Security Epochs" "act soon" "$EPOCH_COUNT" "" "dockerfile\|arg\|epoch\|age_days" "$EPOCH_RESULTS"
2433	35	findings_surface "Suppression Expiries" "act soon" "$SUPPRESSION_COUNT" "" "file\|id\|expires\|days_left" "$SUPPRESSION_RESULTS"
2434	35	findings_surface "Lockfile Freshness" "routine" "$LOCKFILE_COUNT" "" "dependency\|expected\|locked" "$LOCKFILE_RESULTS"
2435
2436	89	if [ "$PYTHON_COUNT" -eq 0 ] && [ "$NPM_COUNT" -eq 0 ] && [ "$DOCKER_COUNT" -eq 0 ] \
2437	50	&& [ "$HELM_COUNT" -eq 0 ] && [ "$ADDON_COUNT" -eq 0 ] \
2438	25	&& [ "$EKS_K8S_COUNT" -eq 0 ] \
2439	50	&& [ "$AURORA_COUNT" -eq 0 ] && [ "$EMR_COUNT" -eq 0 ] \
2440	25	&& [ "$DOCKERFILE_COUNT" -eq 0 ] \
2441	25	&& [ "$AUTOPILOT_COUNT" -eq 0 ] \
2442	22	&& [ "$PRECOMMIT_COUNT" -eq 0 ] \
2443	22	&& [ "$CDK_ENUM_COUNT" -eq 0 ] \
2444	22	&& [ "$PYTHON_RELEASE_COUNT" -eq 0 ] \
2445	22	&& [ "$RUBY_RELEASE_COUNT" -eq 0 ] \
2446	22	&& [ "$UBUNTU_LTS_COUNT" -eq 0 ] \
2447	22	&& [ "$RUNNER_IMAGE_COUNT" -eq 0 ] \
2448	22	&& [ "$BEDROCK_MODEL_COUNT" -eq 0 ] \
2449	22	&& [ "$ACCELERATOR_COUNT" -eq 0 ] \
2450	18	&& [ "$CI_TOOLING_COUNT" -eq 0 ] \
2451	18	&& [ "$CONSISTENCY_COUNT" -eq 0 ] \
2452	15	&& [ "$EPOCH_COUNT" -eq 0 ] \
2453	12	&& [ "$SUPPRESSION_COUNT" -eq 0 ] \
2454	12	&& [ "$LOCKFILE_COUNT" -eq 0 ]; then
2455	12	echo ""
2456	12	SKIP_NOTES=""
2457	12	if [ -n "$ADDON_SKIP_REASON" ]; then
2458	3	SKIP_NOTES="EKS add-ons skipped: $ADDON_SKIP_REASON"
2459		fi
2460	12	if [ -n "$EKS_K8S_SKIP_REASON" ]; then
2461	4	[ -n "$SKIP_NOTES" ] && SKIP_NOTES="$SKIP_NOTES; "
2462	2	SKIP_NOTES="${SKIP_NOTES}EKS Kubernetes skipped: $EKS_K8S_SKIP_REASON"
2463		fi
2464	12	if [ -n "$AURORA_SKIP_REASON" ]; then
2465	4	[ -n "$SKIP_NOTES" ] && SKIP_NOTES="$SKIP_NOTES; "
2466	2	SKIP_NOTES="${SKIP_NOTES}Aurora engine skipped: $AURORA_SKIP_REASON"
2467		fi
2468	12	if [ -n "$EMR_SKIP_REASON" ]; then
2469	4	[ -n "$SKIP_NOTES" ] && SKIP_NOTES="$SKIP_NOTES; "
2470	2	SKIP_NOTES="${SKIP_NOTES}EMR Serverless skipped: $EMR_SKIP_REASON"
2471		fi
2472	12	if [ -n "$BEDROCK_MODEL_SKIP_REASON" ]; then
2473	4	[ -n "$SKIP_NOTES" ] && SKIP_NOTES="$SKIP_NOTES; "
2474	2	SKIP_NOTES="${SKIP_NOTES}Bedrock model skipped: $BEDROCK_MODEL_SKIP_REASON"
2475		fi
2476	12	if [ -n "$ACCELERATOR_SKIP_REASON" ]; then
2477	4	[ -n "$SKIP_NOTES" ] && SKIP_NOTES="$SKIP_NOTES; "
2478	2	SKIP_NOTES="${SKIP_NOTES}Online accelerator catalog skipped: $ACCELERATOR_SKIP_REASON"
2479		fi
2480	12	if [ -n "$AUTOPILOT_SKIP_REASON" ]; then
2481	3	[ -n "$SKIP_NOTES" ] && SKIP_NOTES="$SKIP_NOTES; "
2482	2	SKIP_NOTES="${SKIP_NOTES}GCO autopilot pins skipped: $AUTOPILOT_SKIP_REASON"
2483		fi
2484	12	if [ -n "$CDK_ENUM_SKIP_REASON" ]; then
2485	2	[ -n "$SKIP_NOTES" ] && SKIP_NOTES="$SKIP_NOTES; "
2486	1	SKIP_NOTES="${SKIP_NOTES}CDK enums skipped: $CDK_ENUM_SKIP_REASON"
2487		fi
2488	12	if [ -n "$PYTHON_RELEASE_SKIP_REASON" ]; then
2489	2	[ -n "$SKIP_NOTES" ] && SKIP_NOTES="$SKIP_NOTES; "
2490	1	SKIP_NOTES="${SKIP_NOTES}Python release skipped: $PYTHON_RELEASE_SKIP_REASON"
2491		fi
2492	12	if [ -n "$RUBY_RELEASE_SKIP_REASON" ]; then
2493	2	[ -n "$SKIP_NOTES" ] && SKIP_NOTES="$SKIP_NOTES; "
2494	1	SKIP_NOTES="${SKIP_NOTES}Ruby release skipped: $RUBY_RELEASE_SKIP_REASON"
2495		fi
2496	12	if [ -n "$UBUNTU_LTS_SKIP_REASON" ]; then
2497	2	[ -n "$SKIP_NOTES" ] && SKIP_NOTES="$SKIP_NOTES; "
2498	1	SKIP_NOTES="${SKIP_NOTES}Ubuntu LTS base skipped: $UBUNTU_LTS_SKIP_REASON"
2499		fi
2500	12	if [ -n "$RUNNER_IMAGE_SKIP_REASON" ]; then
2501	2	[ -n "$SKIP_NOTES" ] && SKIP_NOTES="$SKIP_NOTES; "
2502	1	SKIP_NOTES="${SKIP_NOTES}Runner images skipped: $RUNNER_IMAGE_SKIP_REASON"
2503		fi
2504	12	if [ -s "$INCOMPLETE_REASONS_FILE" ]; then
2505	6	[ -n "$SKIP_NOTES" ] && SKIP_NOTES="$SKIP_NOTES; "
2506	10	SKIP_NOTES="${SKIP_NOTES}Incomplete checks: $(join_scan_incomplete_reasons)"
2507		fi
2508	12	if [ "$SCAN_COMPLETE" != true ]; then
2509	8	STATUS_MESSAGE="No drift was found in completed checks, but the scan is incomplete."
2510		else
2511	4	STATUS_MESSAGE="All dependencies are up to date."
2512		fi
2513	12	echo "$STATUS_MESSAGE"
2514	12	write_findings_document "$FINDINGS_FILE" "$SCAN_COMPLETE" false "$INCOMPLETE_REASONS_FILE"
2515	12	rm -f "$FINDINGS_SURFACES"
2516	12	rm -f "$NPM_RESULTS" "$DOCKER_RESULTS" "$HELM_RESULTS" "$ADDON_RESULTS" "$EKS_K8S_RESULTS" "$AURORA_RESULTS" "$EMR_RESULTS" "$DOCKERFILE_RESULTS" "$AUTOPILOT_RESULTS" "$PRECOMMIT_RESULTS" "$CDK_ENUM_RESULTS" "$PYTHON_RELEASE_RESULTS" "$RUBY_RELEASE_RESULTS" "$UBUNTU_LTS_RESULTS" "$RUNNER_IMAGE_RESULTS" "$RUNNER_IMAGE_NOTES" "$BEDROCK_MODEL_RESULTS" "$CI_TOOLING_RESULTS" "$CONSISTENCY_RESULTS" "$EPOCH_RESULTS" "$SUPPRESSION_RESULTS" "$LOCKFILE_RESULTS" "$ACCELERATOR_OFFLINE_REPORT" "$ACCELERATOR_ONLINE_REPORT" "$ACCELERATOR_ONLINE_SUMMARY" "$ACCELERATOR_OFFLINE_ERROR" "$ACCELERATOR_ONLINE_ERROR" "$INCOMPLETE_REASONS_FILE"
2517	12	if [ -n "${GITHUB_STEP_SUMMARY:-}" ]; then
2518		{
2519	12	echo "# Dependency Update Report"
2520	12	echo ""
2521	12	echo "$STATUS_MESSAGE"
2522	12	if [ -n "$SKIP_NOTES" ]; then
2523	8	echo ""
2524	8	echo "_Incomplete or skipped checks: ${SKIP_NOTES}_"
2525		fi
2526		} >> "$GITHUB_STEP_SUMMARY"
2527		fi
2528	12	if [ -n "${GITHUB_OUTPUT:-}" ]; then
2529		{
2530	12	echo "has_drift=false"
2531	12	echo "scan_complete=$SCAN_COMPLETE"
2532	12	echo "findings_path=$FINDINGS_FILE"
2533		} >> "$GITHUB_OUTPUT"
2534		fi
2535	12	echo "Wrote findings to $FINDINGS_FILE"
2536	12	exit 0
2537		fi
2538
2539		# summary_row <title> <count> <skip_reason> <urgency>
2540		# Emits one row of the top-of-report TL;DR table. Surfaces with drift link to
2541		# their detailed section; skipped surfaces are marked and get no urgency.
2542		summary_row() {
2543	529	local title="$1" count="$2" skip="$3" urgency="$4"
2544	529	local anchor label
2545	1058	anchor="$(md_anchor "$title")"
2546	529	if [ -n "$skip" ]; then
2547	31	label="skipped"
2548	31	urgency="—"
2549	498	elif [ "$count" -gt 0 ]; then
2550	159	label="${count} update(s)"
2551	159	title="[${title}](#${anchor})"
2552	339	elif [ "$SCAN_COMPLETE" != true ]; then
2553	172	label="no drift found (incomplete scan)"
2554	172	urgency="—"
2555		else
2556	167	label="up to date"
2557	167	urgency="—"
2558		fi
2559	529	echo "\| ${title} \| ${label} \| ${urgency} \|"
2560		}
2561
2562	23	write_findings_document "$FINDINGS_FILE" "$SCAN_COMPLETE" true "$INCOMPLETE_REASONS_FILE"
2563	23	rm -f "$FINDINGS_SURFACES"
2564
2565		{
2566	23	echo "# Dependency Update Report"
2567	23	echo ""
2568	46	echo "_Generated $(date -u '+%Y-%m-%d %H:%M UTC') by the \`deps-scan\` workflow._"
2569	23	echo ""
2570	23	echo "> [!TIP]"
2571	23	echo "> Reproduce this update list programmatically, on demand: run"
2572	23	echo "> \`gco deps scan\` from a checkout (add \`--nodepools-only\` for just the"
2573	23	echo "> accelerator-catalog / NodePool freshness check, \`-o json\` for a"
2574	23	echo "> machine-readable envelope), or call the \`deps_scan\` MCP tool from an"
2575	23	echo "> agent session. Surfaces needing AWS credentials or missing host tools"
2576	23	echo "> are skipped and flagged as incomplete, exactly as in this workflow."
2577	23	echo ""
2578	23	if [ "$SCAN_COMPLETE" != true ]; then
2579	12	echo "> [!WARNING]"
2580	12	echo "> Incomplete scan. Zero-count surfaces are provisional, not confirmed current."
2581	12	if [ -s "$INCOMPLETE_REASONS_FILE" ]; then
2582	20	echo "> Recorded failures: $(join_scan_incomplete_reasons)"
2583		else
2584	2	echo "> One or more credential-dependent or optional checks were skipped; see the workflow log."
2585		fi
2586	12	echo ""
2587		fi
2588
2589		# ----- TL;DR summary -----
2590	23	echo "## Summary"
2591	23	echo ""
2592	23	echo "\| Surface \| Status \| Urgency \|"
2593	23	echo "\|---------\|--------\|---------\|"
2594	23	summary_row "Python Packages" "$PYTHON_COUNT" "" "routine"
2595	23	summary_row "npm Packages" "$NPM_COUNT" "" "routine"
2596	23	summary_row "Docker Images" "$DOCKER_COUNT" "" "routine"
2597	23	summary_row "Helm Charts" "$HELM_COUNT" "" "routine"
2598	23	summary_row "EKS Add-ons" "$ADDON_COUNT" "$ADDON_SKIP_REASON" "routine"
2599	23	summary_row "EKS Kubernetes Version" "$EKS_K8S_COUNT" "$EKS_K8S_SKIP_REASON" "act soon"
2600	23	summary_row "Aurora PostgreSQL Engine" "$AURORA_COUNT" "$AURORA_SKIP_REASON" "routine"
2601	23	summary_row "EMR Serverless" "$EMR_COUNT" "$EMR_SKIP_REASON" "routine"
2602	23	summary_row "Bedrock Default Model" "$BEDROCK_MODEL_COUNT" "$BEDROCK_MODEL_SKIP_REASON" "routine"
2603	23	summary_row "Accelerator Catalog and NodePools" "$ACCELERATOR_COUNT" "$ACCELERATOR_SUMMARY_SKIP_REASON" "act soon"
2604	23	summary_row "Dockerfile.dev Pins" "$DOCKERFILE_COUNT" "" "routine"
2605	23	summary_row "GCO Autopilot Pins" "$AUTOPILOT_COUNT" "$AUTOPILOT_SKIP_REASON" "act soon"
2606	23	summary_row "Pre-commit Hooks" "$PRECOMMIT_COUNT" "" "routine"
2607	23	summary_row "CDK Enum Constants" "$CDK_ENUM_COUNT" "$CDK_ENUM_SKIP_REASON" "routine"
2608	23	summary_row "Python Release" "$PYTHON_RELEASE_COUNT" "$PYTHON_RELEASE_SKIP_REASON" "informational"
2609	23	summary_row "Ruby Release" "$RUBY_RELEASE_COUNT" "$RUBY_RELEASE_SKIP_REASON" "informational"
2610	23	summary_row "Ubuntu LTS Base" "$UBUNTU_LTS_COUNT" "$UBUNTU_LTS_SKIP_REASON" "informational"
2611	23	summary_row "Runner Images" "$RUNNER_IMAGE_COUNT" "$RUNNER_IMAGE_SKIP_REASON" "act soon"
2612	23	summary_row "CI Tooling" "$CI_TOOLING_COUNT" "" "act soon"
2613	23	summary_row "Version Consistency" "$CONSISTENCY_COUNT" "" "routine"
2614	23	summary_row "Base-image Security Epochs" "$EPOCH_COUNT" "" "act soon"
2615	23	summary_row "Suppression Expiries" "$SUPPRESSION_COUNT" "" "act soon"
2616	23	summary_row "Lockfile Freshness" "$LOCKFILE_COUNT" "" "routine"
2617	23	echo ""
2618	23	echo "_Urgency is a hint: act soon = security or a support/cost deadline;"
2619	23	echo "routine = bump at leisure; informational = no action yet. Only"
2620	23	echo "surfaces with drift have a detailed section below._"
2621	23	echo ""
2622
2623	23	if [ "$PYTHON_COUNT" -gt 0 ]; then
2624	8	echo "## Python Packages"
2625	8	echo ""
2626	8	echo "Direct dependencies pinned in \`pyproject.toml\` (transitive-only drift"
2627	8	echo "is excluded — those versions are controlled by upstream pins and bumping"
2628	8	echo "them ourselves either no-ops or breaks the resolver)."
2629	8	echo ""
2630	8	echo "\| Package \| Current \| Latest \| Ref \|"
2631	8	echo "\|---------\|---------\|--------\|-----\|"
2632	16	echo "$PYTHON_OUTDATED" \| jq -r '.[] \| "\| \(.name) \| \(.version) \| \(.latest_version) \| [PyPI](https://pypi.org/project/\(.name)/) \|"'
2633	8	echo ""
2634		fi
2635
2636	23	if [ "$NPM_COUNT" -gt 0 ]; then
2637	8	echo "## npm Packages"
2638	8	echo ""
2639	8	echo "Exact direct pins in every repository-owned \`package.json\` (the root"
2640	8	echo "tooling graph and \`lambda/inference-streaming-proxy\`), compared against"
2641	8	echo "each package's \`latest\` dist-tag. Transitives are excluded — those are"
2642	8	echo "controlled by the lockfiles. Bump the pin, then regenerate the graph's"
2643	8	echo "\`package-lock.json\` with the pinned npm."
2644	8	echo ""
2645	16	npm_disp="$(mktemp)"
2646	44	while IFS='\|' read -r graph pkg cur lat; do
2647	14	echo "\`${graph}\`\|${pkg}\|${cur}\|${lat}\|[npm](https://www.npmjs.com/package/${pkg})"
2648		done < "$NPM_RESULTS" > "$npm_disp"
2649	8	emit_md_table "Graph\|Package\|Current\|Latest\|Ref" "$npm_disp"
2650	8	rm -f "$npm_disp"
2651	8	echo ""
2652		fi
2653
2654	23	if [ "$DOCKER_COUNT" -gt 0 ]; then
2655	10	echo "## Docker Images"
2656	10	echo ""
2657	10	emit_md_table "Image\|Current\|Latest" "$DOCKER_RESULTS"
2658	10	echo ""
2659		fi
2660
2661	23	if [ "$HELM_COUNT" -gt 0 ]; then
2662	8	echo "## Helm Charts"
2663	8	echo ""
2664	16	helm_disp="$(mktemp)"
2665	92	while IFS='\|' read -r cname chart cur lat; do
2666	38	echo "${cname}\|${chart}\|${cur}\|${lat}\|[ArtifactHub](https://artifacthub.io/packages/search?ts_query_web=${chart})"
2667		done < "$HELM_RESULTS" > "$helm_disp"
2668	8	emit_md_table "Chart\|Name\|Current\|Latest\|Ref" "$helm_disp"
2669	8	rm -f "$helm_disp"
2670	8	echo ""
2671		fi
2672
2673	23	if [ "$ADDON_COUNT" -gt 0 ]; then
2674	8	echo "## EKS Add-ons"
2675	8	echo ""
2676	8	emit_md_table "Add-on\|Current\|Latest" "$ADDON_RESULTS"
2677	8	echo ""
2678		fi
2679
2680	23	if [ "$EKS_K8S_COUNT" -gt 0 ]; then
2681	7	echo "## EKS Kubernetes Version"
2682	7	echo ""
2683	7	echo "The Kubernetes minor pinned in \`cdk.json::kubernetes_version\` is behind"
2684	7	echo "the latest release still in EKS standard support. Upgrade before"
2685	7	echo "standard support ends to avoid the extended-support pricing uplift."
2686	7	echo ""
2687	14	eks_disp="$(mktemp)"
2688	28	while IFS='\|' read -r pin cur lat eos; do
2689	7	echo "\`${pin}\`\|${cur}\|${lat}\|${eos}"
2690		done < "$EKS_K8S_RESULTS" > "$eks_disp"
2691	7	emit_md_table "Pin\|Current\|Latest (standard support)\|Std support ends" "$eks_disp"
2692	7	rm -f "$eks_disp"
2693	7	echo ""
2694		fi
2695
2696	23	if [ "$AURORA_COUNT" -gt 0 ]; then
2697	8	echo "## Aurora PostgreSQL Engine"
2698	8	echo ""
2699	8	emit_md_table "Engine\|Current\|Latest" "$AURORA_RESULTS"
2700	8	echo ""
2701		fi
2702
2703	23	if [ "$EMR_COUNT" -gt 0 ]; then
2704	7	echo "## EMR Serverless"
2705	7	echo ""
2706	7	emit_md_table "Release\|Current\|Latest" "$EMR_RESULTS"
2707	7	echo ""
2708		fi
2709
2710	23	if [ "$BEDROCK_MODEL_COUNT" -gt 0 ]; then
2711	7	echo "## Bedrock Default Model"
2712	7	echo ""
2713	7	echo "A Bedrock model default configured in \`cdk.json\` is behind a newer"
2714	7	echo "release in the same model family. For"
2715	7	echo "\`bedrock.mission_default_model_id\`, \`bedrock.codex_default_model_id\`"
2716	7	echo "and \`bedrock.opencode_default_model_id\`, update the value and"
2717	7	echo "re-capture the matching scaffold fixture"
2718	7	echo "(\`scripts/capture_scaffold_fixtures.py\`). For"
2719	7	echo "\`bedrock.capacity_advisor_default_model_id\` and"
2720	7	echo "\`bedrock.claude_code_default_model_id\`, updating the value is enough."
2721	7	echo "For the embedding keys — \`bedrock.embedding_model_id\` (Mission memory)"
2722	7	echo "and \`vector_store.embedding_model_id\` (workload RAG corpus) — stored"
2723	7	echo "vectors are only comparable to vectors from the same model: plan to"
2724	7	echo "re-embed (for the vector store, re-ingest the corpus) or segregate"
2725	7	echo "existing data before adopting the newer model."
2726	7	echo ""
2727	7	emit_md_table "Configuration key\|Current\|Latest" "$BEDROCK_MODEL_RESULTS"
2728	7	echo ""
2729		fi
2730
2731	23	if [ "$ACCELERATOR_COUNT" -gt 0 ]; then
2732	5	echo "## Accelerator Catalog and NodePools"
2733	5	echo ""
2734	5	echo "The offline check keeps reviewed lifecycle/generation policy, Karpenter"
2735	5	echo "NodePools, \`historical.watch_instance_types\`, and the Spot Placement"
2736	5	echo "Score instance pools synchronized. The online check compares the catalog"
2737	5	echo "with EC2 across enabled commercial Regions."
2738	5	echo "Follow each recommended change; review family metadata before refreshing"
2739	5	echo "the checked-in catalog."
2740	5	echo ""
2741	5	if [ -s "$ACCELERATOR_OFFLINE_REPORT" ]; then
2742	3	sed -E 's/^### /#### /; s/^## /### /' "$ACCELERATOR_OFFLINE_REPORT"
2743	3	echo ""
2744		fi
2745	5	if [ -s "$ACCELERATOR_ONLINE_REPORT" ]; then
2746	5	sed -E 's/^### /#### /; s/^## /### /' "$ACCELERATOR_ONLINE_REPORT"
2747	5	echo ""
2748		fi
2749		fi
2750
2751	23	if [ "$DOCKERFILE_COUNT" -gt 0 ]; then
2752	8	echo "## Dockerfile.dev Pins"
2753	8	echo ""
2754	8	echo "Tooling versions pinned as build-time ARGs in \`Dockerfile.dev\`."
2755	8	echo ""
2756	16	dockerfile_disp="$(mktemp)"
2757	160	while IFS='\|' read -r pin cur lat; do
2758	72	echo "\`${pin}\`\|${cur}\|${lat}"
2759		done < "$DOCKERFILE_RESULTS" > "$dockerfile_disp"
2760	8	emit_md_table "Pin\|Current\|Latest" "$dockerfile_disp"
2761	8	rm -f "$dockerfile_disp"
2762	8	echo ""
2763		fi
2764
2765	23	if [ "$AUTOPILOT_COUNT" -gt 0 ]; then
2766	11	echo "## GCO Autopilot Pins"
2767	11	echo ""
2768	11	echo "\`gco autopilot\`'s dependency surfaces in \`cli/autopilot.py\`: the"
2769	11	echo "pinned \`CLAUDE_CODE_VERSION\`, \`CODEX_VERSION\` and \`OPENCODE_VERSION\`"
2770	11	echo "agent CLIs (each compared against its npm \`latest\` dist-tag) and the"
2771	11	echo "launch-time"
2772	11	echo "companion MCP servers"
2773	11	echo "(reported when a package is missing, deprecated, or yanked on its"
2774	11	echo "registry — an unhealthy companion breaks every new session, so treat"
2775	11	echo "it like the removals documented in \`gco_mcp/README.md\`). When"
2776	11	echo "changing the companion set, update \`cli/autopilot.py\` and the"
2777	11	echo "\`gco_mcp/README.md\` tables together; \`tests/test_cli_autopilot.py\`"
2778	11	echo "enforces the lockstep."
2779	11	echo ""
2780	22	autopilot_disp="$(mktemp)"
2781	84	while IFS='\|' read -r surface cur stat url; do
2782	31	echo "${surface}\|\`${cur}\`\|${stat}\|[registry](${url})"
2783		done < "$AUTOPILOT_RESULTS" > "$autopilot_disp"
2784	11	emit_md_table "Surface\|Current\|Latest / status\|Ref" "$autopilot_disp"
2785	11	rm -f "$autopilot_disp"
2786	11	echo ""
2787		fi
2788
2789	23	if [ "$PRECOMMIT_COUNT" -gt 0 ]; then
2790	9	echo "## Pre-commit Hooks"
2791	9	echo ""
2792	9	echo "Hook \`rev:\` pins in \`.pre-commit-config.yaml\` are behind the latest"
2793	9	echo "tag published by their upstream repos. Bump in \`.pre-commit-config.yaml\`,"
2794	9	echo "then run \`pre-commit autoupdate\` locally (or edit by hand) and verify"
2795	9	echo "the hooks still pass."
2796	9	echo ""
2797	18	precommit_disp="$(mktemp)"
2798	58	while IFS='\|' read -r repo cur lat; do
2799	20	echo "${repo}\|\`${cur}\`\|\`${lat}\`\|[releases](${repo}/releases)"
2800		done < "$PRECOMMIT_RESULTS" > "$precommit_disp"
2801	9	emit_md_table "Repo\|Current\|Latest\|Ref" "$precommit_disp"
2802	9	rm -f "$precommit_disp"
2803	9	echo ""
2804		fi
2805
2806	23	if [ "$CDK_ENUM_COUNT" -gt 0 ]; then
2807	7	echo "## CDK Enum Constants"
2808	7	echo ""
2809	7	echo "Enum-name constants in \`gco/stacks/constants.py\` are behind the highest"
2810	7	echo "enum member exposed by the installed \`aws-cdk-lib\`. Update the constant"
2811	7	echo "in \`constants.py\` (and any related deployment notes) so new stacks"
2812	7	echo "construct the latest CDK enum."
2813	7	echo ""
2814	7	emit_md_table "Constant\|CDK enum class\|Current\|Latest" "$CDK_ENUM_RESULTS" code
2815	7	echo ""
2816		fi
2817
2818	23	if [ "$PYTHON_RELEASE_COUNT" -gt 0 ]; then
2819	8	echo "## Python Release"
2820	8	echo ""
2821	8	echo "A newer stable Python release is available on python.org than the version"
2822	8	echo "encoded by \`LAMBDA_PYTHON_RUNTIME\`. AWS Lambda may lag the upstream"
2823	8	echo "release by a few months — wait for the matching \`Runtime.PYTHON_X_Y\`"
2824	8	echo "enum to appear in \`aws-cdk-lib\` (tracked by the CDK Enum Constants"
2825	8	echo "section above) before bumping. See <https://www.python.org/downloads/>."
2826	8	echo ""
2827	8	emit_md_table "Surface\|Current\|Latest" "$PYTHON_RELEASE_RESULTS"
2828	8	echo ""
2829		fi
2830
2831	23	if [ "$RUNNER_IMAGE_COUNT" -gt 0 ]; then
2832	1	echo "## Runner Images"
2833	1	echo ""
2834	1	echo "A \`runs-on:\` label below is behind a newer generally-available image,"
2835	1	echo "or names one upstream has deprecated (a deprecated image is a removal"
2836	1	echo "notice with a date attached). Images still in preview are deliberately"
2837	1	echo "not listed here — see the notes under the skipped/collapsed section for"
2838	1	echo "those, since moving to a preview trades a stable CI platform for an"
2839	1	echo "unannounced one. Update the \`runs-on:\` value in the named workflow job."
2840	1	echo "See <https://github.com/actions/runner-images#available-images>."
2841	1	echo ""
2842	1	emit_md_table "Label\|Current image\|Recommended" "$RUNNER_IMAGE_RESULTS"
2843	1	echo ""
2844		fi
2845
2846	23	if [ "$RUBY_RELEASE_COUNT" -gt 0 ]; then
2847	8	echo "## Ruby Release"
2848	8	echo ""
2849	8	echo "A newer stable Ruby series is supported upstream than the one pinned in"
2850	8	echo "\`.ruby-version\`. Ruby is CI-only — \`bundle exec bashcov\` measures shell"
2851	8	echo "coverage in the \`unit:bats:shell\` job — so bumping is low risk, but it is"
2852	8	echo "still a deliberate move: check that \`ruby/setup-ruby\` publishes a prebuilt"
2853	8	echo "binary for the new series and that \`bashcov\` supports it, then update"
2854	8	echo "\`.ruby-version\` and re-resolve \`Gemfile.lock\`."
2855	8	echo "See <https://endoflife.date/ruby>."
2856	8	echo ""
2857	8	emit_md_table "Surface\|Current\|Latest" "$RUBY_RELEASE_RESULTS"
2858	8	echo ""
2859		fi
2860
2861	23	if [ "$UBUNTU_LTS_COUNT" -gt 0 ]; then
2862	5	echo "## Ubuntu LTS Base"
2863	5	echo ""
2864	5	echo "The Slinky Slurm images are pinned to an older Ubuntu LTS base than the"
2865	5	echo "newest one that has shipped its first point release, and the registry"
2866	5	echo "already publishes the pinned Slurm version on the newer base. The image"
2867	5	echo "sweep never suggests this move because it compares within a tag's variant"
2868	5	echo "family; changing base is a deliberate step: update \`SLURM_IMAGE_TAG\` in"
2869	5	echo "\`gco/slurm_config.py\` and every image tag in \`lambda/helm-installer/charts.yaml\`"
2870	5	echo "together (the unit suite holds them in lockstep), then re-run the live Slurm"
2871	5	echo "validation before shipping. See <https://endoflife.date/ubuntu> and"
2872	5	echo "<https://github.com/orgs/SlinkyProject/packages>."
2873	5	echo ""
2874	5	emit_md_table "Surface\|Current\|Latest" "$UBUNTU_LTS_RESULTS"
2875	5	echo ""
2876		fi
2877
2878		# ----- New coverage surfaces -----
2879
2880	23	if [ "$CI_TOOLING_COUNT" -gt 0 ]; then
2881	9	echo "## CI Tooling"
2882	9	echo ""
2883	9	echo "Tool versions the workflows install by hand — not \`uses:\` refs or"
2884	9	echo "Dockerfile \`FROM\` lines, so Dependabot doesn't watch them. A stale"
2885	9	echo "Trivy in particular means the CVE scan silently misses newer"
2886	9	echo "detections; bump the \`*_VERSION\` env / kind-action inputs in lockstep."
2887	9	echo ""
2888	18	ci_disp="$(mktemp)"
2889	186	while IFS='\|' read -r name cur lat url; do
2890	84	echo "${name}\|\`${cur}\`\|\`${lat}\`\|[releases](${url})"
2891		done < "$CI_TOOLING_RESULTS" > "$ci_disp"
2892	9	emit_md_table "Tool\|Current\|Latest\|Ref" "$ci_disp"
2893	9	rm -f "$ci_disp"
2894	9	echo ""
2895		fi
2896
2897	23	if [ "$CONSISTENCY_COUNT" -gt 0 ]; then
2898	7	echo "## Version Consistency"
2899	7	echo ""
2900	7	echo "These versions and dependency-management surfaces must move together."
2901	7	echo "The rows below identify missing coverage or disagreement across runtime,"
2902	7	echo "package, dev-container, pre-commit, and CI pins."
2903	7	echo ""
2904	7	emit_md_table "What\|Pinned values" "$CONSISTENCY_RESULTS"
2905	7	echo ""
2906		fi
2907
2908	23	if [ "$EPOCH_COUNT" -gt 0 ]; then
2909	3	echo "## Base-image Security Epochs"
2910	3	echo ""
2911	3	echo "The build-time \`*_SECURITY_EPOCH\` ARGs bust the CI layer cache so a"
2912	3	echo "fresh OS-security-upgrade layer is built. An epoch older than"
2913	3	echo "${SECURITY_EPOCH_STALE_DAYS} days may be reusing a stale upgrade layer —"
2914	3	echo "bump the date to force a rebuild that pulls current patches."
2915	3	echo ""
2916	6	epoch_disp="$(mktemp)"
2917	12	while IFS='\|' read -r df arg edate eage; do
2918	3	echo "\`${df}\`\|\`${arg}\`\|${edate}\|${eage}"
2919		done < "$EPOCH_RESULTS" > "$epoch_disp"
2920	3	emit_md_table "Dockerfile\|ARG\|Epoch\|Age (days)" "$epoch_disp"
2921	3	rm -f "$epoch_disp"
2922	3	echo ""
2923		fi
2924
2925	23	if [ "$SUPPRESSION_COUNT" -gt 0 ]; then
2926	5	echo "## Suppression Expiries"
2927	5	echo ""
2928	5	echo "\`.trivyignore\` / \`.pip-audit-ignore\` / \`.npm-audit-ignore\` entries"
2929	5	echo "expiring within ${SUPPRESSION_EXPIRY_WARN_DAYS} days (the CI validator hard-fails a PR on"
2930	5	echo "the expiry date). Re-evaluate each: drop it if the CVE is fixed upstream,"
2931	5	echo "or extend with a fresh justification if not."
2932	5	echo ""
2933	10	sup_disp="$(mktemp)"
2934	52	while IFS='\|' read -r sbase sid sdate sleft; do
2935	21	echo "\`${sbase}\`\|\`${sid}\`\|${sdate}\|${sleft}"
2936		done < "$SUPPRESSION_RESULTS" > "$sup_disp"
2937	5	emit_md_table "File\|ID\|Expires\|Days left" "$sup_disp"
2938	5	rm -f "$sup_disp"
2939	5	echo ""
2940		fi
2941
2942	23	if [ "$LOCKFILE_COUNT" -gt 0 ]; then
2943	2	echo "## Lockfile Freshness"
2944	2	echo ""
2945	2	echo "Direct dependencies whose exact pyproject.toml pin is missing from or"
2946	2	echo "different in requirements-lock.txt. Regenerate the lock with"
2947	2	echo "pip-compile --all-extras --strip-extras -o requirements-lock.txt pyproject.toml."
2948	2	echo ""
2949	2	emit_md_table "Dependency\|Expected\|Locked" "$LOCKFILE_RESULTS" code
2950	2	echo ""
2951		fi
2952
2953		# ----- Skipped checks (collapsed) -----
2954	23	if [ -n "${ADDON_SKIP_REASON}${EKS_K8S_SKIP_REASON}${AURORA_SKIP_REASON}${EMR_SKIP_REASON}${BEDROCK_MODEL_SKIP_REASON}${ACCELERATOR_SKIP_REASON}${AUTOPILOT_SKIP_REASON}${CDK_ENUM_SKIP_REASON}${PYTHON_RELEASE_SKIP_REASON}${RUBY_RELEASE_SKIP_REASON}${UBUNTU_LTS_SKIP_REASON}${RUNNER_IMAGE_SKIP_REASON}" ] \
2955	16	\|\| [ -s "$INCOMPLETE_REASONS_FILE" ]; then
2956	12	echo "<details>"
2957	12	echo "<summary>Skipped checks</summary>"
2958	12	echo ""
2959	15	[ -n "$ADDON_SKIP_REASON" ] && echo "- EKS Add-ons: $ADDON_SKIP_REASON"
2960	16	[ -n "$EKS_K8S_SKIP_REASON" ] && echo "- EKS Kubernetes Version: $EKS_K8S_SKIP_REASON"
2961	15	[ -n "$AURORA_SKIP_REASON" ] && echo "- Aurora PostgreSQL Engine: $AURORA_SKIP_REASON"
2962	16	[ -n "$EMR_SKIP_REASON" ] && echo "- EMR Serverless: $EMR_SKIP_REASON"
2963	16	[ -n "$BEDROCK_MODEL_SKIP_REASON" ] && echo "- Bedrock Default Model: $BEDROCK_MODEL_SKIP_REASON"
2964	13	[ -n "$ACCELERATOR_SKIP_REASON" ] && echo "- Online Accelerator Catalog: $ACCELERATOR_SKIP_REASON"
2965	15	[ -n "$AUTOPILOT_SKIP_REASON" ] && echo "- GCO Autopilot Pins: $AUTOPILOT_SKIP_REASON"
2966	13	[ -n "$CDK_ENUM_SKIP_REASON" ] && echo "- CDK Enum Constants: $CDK_ENUM_SKIP_REASON"
2967	14	[ -n "$PYTHON_RELEASE_SKIP_REASON" ] && echo "- Python Release: $PYTHON_RELEASE_SKIP_REASON"
2968	14	[ -n "$RUBY_RELEASE_SKIP_REASON" ] && echo "- Ruby Release: $RUBY_RELEASE_SKIP_REASON"
2969	15	[ -n "$UBUNTU_LTS_SKIP_REASON" ] && echo "- Ubuntu LTS Base: $UBUNTU_LTS_SKIP_REASON"
2970	13	[ -n "$RUNNER_IMAGE_SKIP_REASON" ] && echo "- Runner Images: $RUNNER_IMAGE_SKIP_REASON"
2971	12	if [ -s "$INCOMPLETE_REASONS_FILE" ]; then
2972	258	while IFS= read -r incomplete_reason; do
2973	119	echo "- Incomplete lookup or parse: ${incomplete_reason}"
2974		done < <(sort -u "$INCOMPLETE_REASONS_FILE")
2975		fi
2976	12	echo ""
2977	12	echo "</details>"
2978	12	echo ""
2979		fi
2980
2981	23	echo "## Action Required"
2982	23	echo ""
2983	23	echo "1. Review changelogs for breaking changes (see the per-row Ref links)"
2984	23	echo "2. Follow accelerator findings exactly; review lifecycle/generation metadata"
2985	23	echo " before running \`python scripts/accelerator_catalog.py refresh\`"
2986	23	echo "3. Update versions in \`pyproject.toml\`, manifests, \`charts.yaml\`, or the"
2987	23	echo " pinned \`*_VERSION\` env / ARG values"
2988	23	echo "4. Regenerate \`requirements-lock.txt\` if Python deps changed"
2989	23	echo "5. Reconcile any Version Consistency rows so every copy of a pin agrees"
2990	23	echo "6. Run tests locally to verify compatibility, then open a PR"
2991	23	echo ""
2992	23	echo "The findings below are the same report as JSON, for a script or an agent"
2993	23	echo "session that acts on them: \`gco deps scan -o json\` returns the document"
2994	23	echo "under \`findings\`, and every run uploads it as the"
2995	23	echo "\`dependency-scan-findings\` artifact."
2996	23	echo ""
2997	23	emit_findings_embed "$FINDINGS_FILE"
2998	23	echo ""
2999	23	echo "---"
3000	23	echo "_Automatically created by the \`deps-scan\` workflow._"
3001		} > "$REPORT_FILE"
3002
3003	23	rm -f "$NPM_RESULTS" "$DOCKER_RESULTS" "$HELM_RESULTS" "$ADDON_RESULTS" "$EKS_K8S_RESULTS" "$AURORA_RESULTS" "$EMR_RESULTS" "$DOCKERFILE_RESULTS" "$AUTOPILOT_RESULTS" "$PRECOMMIT_RESULTS" "$CDK_ENUM_RESULTS" "$PYTHON_RELEASE_RESULTS" "$RUBY_RELEASE_RESULTS" "$UBUNTU_LTS_RESULTS" "$RUNNER_IMAGE_RESULTS" "$RUNNER_IMAGE_NOTES" "$BEDROCK_MODEL_RESULTS" "$CI_TOOLING_RESULTS" "$CONSISTENCY_RESULTS" "$EPOCH_RESULTS" "$SUPPRESSION_RESULTS" "$LOCKFILE_RESULTS" "$ACCELERATOR_OFFLINE_REPORT" "$ACCELERATOR_ONLINE_REPORT" "$ACCELERATOR_ONLINE_SUMMARY" "$ACCELERATOR_OFFLINE_ERROR" "$ACCELERATOR_ONLINE_ERROR" "$INCOMPLETE_REASONS_FILE"
3004
3005	23	if [ -n "${GITHUB_OUTPUT:-}" ]; then
3006		{
3007	23	echo "has_drift=true"
3008	23	echo "scan_complete=$SCAN_COMPLETE"
3009	23	echo "report_path=$REPORT_FILE"
3010	23	echo "findings_path=$FINDINGS_FILE"
3011		} >> "$GITHUB_OUTPUT"
3012		fi
3013
3014		# Mirror the report into the workflow run's job summary so results are visible
3015		# on the Actions run page even for workflow_dispatch runs and regardless of
3016		# whether an issue is opened.
3017	23	if [ -n "${GITHUB_STEP_SUMMARY:-}" ]; then
3018	23	cat "$REPORT_FILE" >> "$GITHUB_STEP_SUMMARY"
3019		fi
3020
3021	23	echo ""
3022	23	echo "Wrote report to $REPORT_FILE"
3023	23	echo "Wrote findings to $FINDINGS_FILE"