Repository navigation
fix: aws - cloudfront - wafv2-enabled scope, stamp .post1 - #22
Conversation
|
| Filename | Overview |
|---|---|
| c7n/filters/waf.py | Passes WAFv2 scope through related-manager data so scope and endpoint selection remain aligned. |
| c7n/resources/waf.py | Rejects caller-supplied Scope values that conflict with the WAFv2 manager’s scope. |
| tests/test_cloudfront.py | Adds regression coverage for CloudFront-scoped ACL discovery and conflicting scope validation. |
| .github/workflows/stacklet-release.yml | Accepts .postM alpha hotfix versions, but the changed release grammar lacks automated tests. |
| pyproject.toml | Stamps the root package with the intended .post1 prerelease version. |
| uv.lock | Updates only editable workspace package versions consistently with their manifests. |
Flowchart
%%{init: {'theme': 'neutral'}}%%
flowchart LR
CF[CloudFront distribution filter] --> RM[WAFv2 resource manager]
RM --> Scope[Scope: CLOUDFRONT]
Scope --> Region[Endpoint: us-east-1]
Region --> List[List CLOUDFRONT Web ACLs]
List --> Match[Match distribution WebACL ARN]
Match --> Result[Protected distribution excluded from state:false]
Prompt To Fix All With AI
### Issue 1
.github/workflows/stacklet-release.yml:37
**Release guard remains untested**
The new `.postM` version grammar has no automated coverage, even though this manually dispatched guard previously blocked releases after an untested regex change. This is non-blocking, but tests should cover ordinary stamped prereleases, stamped post releases, missing prerelease or local segments, and `.post` without digits to prevent another publishing failure.
---
For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.Reviews (1): Last reviewed commit: "fix: aws - cloudfront - wafv2-enabled sc..." | Re-trigger Greptile
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
| version=$(grep -m1 '^version' pyproject.toml | cut -d'"' -f2) | ||
| if [[ ! "$version" =~ a[0-9]+[+][0-9a-zA-Z.]+$ ]]; then | ||
| echo "::error::cloud-custodian-prerelease must ship a stamped prerelease version (…aN+HASH); got '$version'" | ||
| if [[ ! "$version" =~ a[0-9]+(\.post[0-9]+)?[+][0-9a-zA-Z.]+$ ]]; then |
There was a problem hiding this comment.
The new .postM version grammar has no automated coverage, even though this manually dispatched guard previously blocked releases after an untested regex change. This is non-blocking, but tests should cover ordinary stamped prereleases, stamped post releases, missing prerelease or local segments, and .post without digits to prevent another publishing failure.
Knowledge Base Used: Require the release version hash stamp
Prompt To Fix With AI
This is a comment left during a code review.
Path: .github/workflows/stacklet-release.yml
Line: 37
Comment:
**Release guard remains untested**
The new `.postM` version grammar has no automated coverage, even though this manually dispatched guard previously blocked releases after an untested regex change. This is non-blocking, but tests should cover ordinary stamped prereleases, stamped post releases, missing prerelease or local segments, and `.post` without digits to prevent another publishing failure.
**Knowledge Base Used:** [Require the release version hash stamp](https://app.greptile.com/stacklet/-/custom-context/knowledge-base/stacklet/cloud-custodian-prerelease/-/reverts/incident-mitigation_10-20260821-prerelease-hash-guard-b5ad5bf.md)
---
For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!
There was a problem hiding this comment.
Valid, but not fixing on the release branch will fix on mainline (stacklet/intergration)
There was a problem hiding this comment.
That makes sense. Since this PR is limited to the release-branch hotfix, keeping the release-guard coverage follow-up on stacklet/integration avoids expanding the backport. No further change is needed here.
Tip: You can customize Greptile's behavior for this repo with .greptile/rules.md and .greptile/config.json.
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
1 issue found across 22 files
Prompt for AI agents (unresolved issues)
Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.
<file name=".github/workflows/stacklet-release.yml">
<violation number="1" location=".github/workflows/stacklet-release.yml:37">
P3: Add automated coverage for this release guard's accepted and rejected version forms, including `.postM`, missing prerelease or local segments, and `.post` without digits. Without tests, a future regex edit can block or allow an invalid release unnoticed.</violation>
</file>
Reply with feedback, questions, or to request a fix.
Fix all with cubic | Re-trigger cubic
| version=$(grep -m1 '^version' pyproject.toml | cut -d'"' -f2) | ||
| if [[ ! "$version" =~ a[0-9]+[+][0-9a-zA-Z.]+$ ]]; then | ||
| echo "::error::cloud-custodian-prerelease must ship a stamped prerelease version (…aN+HASH); got '$version'" | ||
| if [[ ! "$version" =~ a[0-9]+(\.post[0-9]+)?[+][0-9a-zA-Z.]+$ ]]; then |
There was a problem hiding this comment.
P3: Add automated coverage for this release guard's accepted and rejected version forms, including .postM, missing prerelease or local segments, and .post without digits. Without tests, a future regex edit can block or allow an invalid release unnoticed.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At .github/workflows/stacklet-release.yml, line 37:
<comment>Add automated coverage for this release guard's accepted and rejected version forms, including `.postM`, missing prerelease or local segments, and `.post` without digits. Without tests, a future regex edit can block or allow an invalid release unnoticed.</comment>
<file context>
@@ -26,15 +26,16 @@ jobs:
version=$(grep -m1 '^version' pyproject.toml | cut -d'"' -f2)
- if [[ ! "$version" =~ a[0-9]+[+][0-9a-zA-Z.]+$ ]]; then
- echo "::error::cloud-custodian-prerelease must ship a stamped prerelease version (…aN+HASH); got '$version'"
+ if [[ ! "$version" =~ a[0-9]+(\.post[0-9]+)?[+][0-9a-zA-Z.]+$ ]]; then
+ echo "::error::cloud-custodian-prerelease must ship a stamped prerelease version (…aN+HASH or …aN.postM+HASH); got '$version'"
exit 1
</file context>
There was a problem hiding this comment.
Valid, but not fixing on the release branch will fix on mainline (stacklet/intergration)
ENG-8730
what
Cherry-pick upstream
#11039
onto the 2026.08.26 release branch and stamp the workspace
0.9.52a5.post1+a83dda5c9.WafV2FilterBase._get_web_aclspassed the scope it wanted throughresources(query=...), which the wafv2 resource manager thenoverwrote with its own. It now passes the scope as resource manager
data, where the manager reads both the API
Scopeand the region tocall from.
DescribeWafV2.get_query_paramsraisesPolicyValidationErroron a conflicting caller-suppliedScoperather than discarding it, so the same mistake fails loudly.
The release workflow's
Assert prerelease versionguard accepts anoptional
.postMbetweenaNand+HASH. It still rejects aversion missing either the prerelease or the local segment, and a
.postthat is not followed by digits.why
CLOUDFRONT web ACLs are global and are only listed from us-east-1.
With the requested scope dropped in favour of the REGIONAL default,
wafv2-enablednever saw a distribution's web ACL, sostate: falsematched distributions that are in fact protected —false positives on
aws-cloudfront-waf-disabled-informfor acustomer running that policy.
2026.08.26 shipped
#10975,
which fixed the scope for the
set-wafv2action, but the filterregression was merged upstream after the cohort's c7n was stamped.
Fixes: 1f20e9f ("Wafv2 Refactor Scope Region Logic (cloud-custodian#10827)")
testing
The cherry-pick brings upstream's coverage: a distribution with a
CLOUDFRONT-scoped web ACL attached is not matched by
wafv2-enabledwithstate: false, and the filter is asserted tohave listed web ACLs with
Scope: CLOUDFRONT. A second test coversthe new conflict error when a caller passes a
Scopethat disagreeswith the resource manager's.
docs
No docs needed.
🤖 Generated with Claude Code