fix/cdk-deprov
needs attentiond159446 · incrementalPR #193reviewed 2026-07-07 03:47 UTC1H · 5M · 7L · 4I- Purpose
- Fix IAM role quota exhaustion (999/1000 in dev account) caused by orphaned CDK stacks from deleted preview branches
- Goal
- Add OIDC-authenticated AWS teardown to preview-deprovision.yml so branch-scoped Batu*-{slug}-dev stacks are deleted on branch delete
- Sub-goals
- SG-1: CDK teardown on branch delete (enumerate Batu*-{slug}-dev stacks, delete-stack, wait, clean SSM)
- SG-2: Curl hardening with shared CURL_RETRY env var across provision and deprovision
- What
- DRYed curl retry flags into a shared CURL_RETRY workflow-level env var in both provision and deprovision. Fixed a missing space in $CURL_RETRY expansion that was producing malformed curl arguments in provision.
- Why
- Incremental improvement over prior per-call retry additions: reduces drift risk and adds retry hardening to deprovision workflow which had none
- Areas
- .github/workflows/preview-deprovision.yml+227−7.github/workflows/preview-provision.yml+13−7
- Blast
- 2 CI workflow files, +240/-14 lines on the branch. No app code, no domain logic, no migrations.
Findings · 17
correctness6
--retry-all-errors retries 4xx when -f is active (binary download)
.github/workflows/preview-deprovision.yml:50
curl -fsSL $CURL_RETRY causes 4xx to be retried 3x; comment says '4xx fail fast' which is only true for no-f API calls
--retry-max-time 180 exhausted before single 120s attempt can retry
.github/workflows/preview-deprovision.yml:17
First 120s attempt leaves only 60s for retries; need ~366s for 3 full retries of binary download
$CURL_RETRY unquoted — IFS word-splitting fragile
.github/workflows/preview-deprovision.yml:17
Works with default IFS but breaks silently if any step changes IFS; bash array pattern would be canonical
Provision retry reduced 5→3 with no rationale comment
.github/workflows/preview-provision.yml:36
LATEST_VERSION silently empty if GitHub API errors without -f
.github/workflows/preview-deprovision.yml:50
No rationale comment for 5→3 retry reduction in provision
.github/workflows/preview-provision.yml
security1
Unquoted $CURL_RETRY word-splits — fragile for future maintainers
.github/workflows/preview-deprovision.yml
conventions5
CURL_RETRY name ambiguous — CURL_RETRY_FLAGS clearer
.github/workflows/preview-deprovision.yml:17
Workflow-level env mixes secrets and constants
.github/workflows/preview-provision.yml
.branch/scope.md belongs to feat/soft-launch, not fix/cdk-deprov
.branch/scope.md
Comment says GET/DELETE but one call is DELETE-with-body
.github/workflows/preview-deprovision.yml:15
CURL_RETRY string duplicated verbatim across two workflow files
.github/workflows/preview-provision.yml
improvement5
preview-db-reset.yml Supabase CLI install lacks retry
.github/workflows/preview-db-reset.yml
Bare curl identical to pre-hardening pattern; transient GitHub Releases hiccup fails db-reset silently
pr-checks.yml Supabase CLI install lacks retry
.github/workflows/pr-checks.yml
Runs on every PR; transient failure fails all PR checks until re-push
seed-e2e-user.yml admin key fetch lacks retry
.github/workflows/seed-e2e-user.yml
api.supabase.com call with bare curl; transient 5xx blocks E2E setup
--retry-delay 2 is fixed, not exponential
.github/workflows/preview-provision.yml
e2e.yml readiness-gate polling loop no --connect-timeout
.github/workflows/e2e.yml
History · 6 commits
- d159446needs attentionincremental1H · 5M · 7L2026-07-07 03:47current
- 5ec41e1needs attentionincremental3H · 4M · 6L2026-07-07 03:23
- 9814d4dneeds attentionincremental1H · 3M · 5L2026-07-05 05:43
- 9e87f75needs attentionincremental0H · 1M · 2L2026-07-05 05:17
- 02936b3blockedincremental1H · 0M · 4L2026-07-05 04:53
- 4407258needs attentionfull0H · 3M · 4L2026-07-05 04:27