feat(#653): Phase 3 — tombstone platform/providers/aws/ + promote eks CI gate#662
Merged
Conversation
…tone Consumer trace confirms platform/providers/aws/ is build-tag-gated dead code (//go:build aws, zero external callers, no CI coverage). Disposition (b) with action: document the three-layer provider architecture, then delete the dead AWS implementation. platform.Provider interface and DockerCompose/ Mock implementations are unchanged. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Clarify CI gate task: promote service/eks to strict ban step + go.mod gate (Phase 2 ci.yml:418 hands this off explicitly); list packages exclusive to deleted tree (ec2/dynamodb/elb/rds/sqs/iam) for banning - Fix Assumption 4+5: eks stays in go.mod (provider/aws/ uses it); only packages exclusively in the build-tag-gated tree can be banned - Correct ADR number 0020 → 0032 (latest is 0031) - Drop legacyaws scope item (package catalogs YAML types, not Go packages) - Drop DOCUMENTATION.md item (platform/provider.go doc comment is canonical) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…ver tombstone 4 tasks: T1 delete 24 files, T2 go mod tidy (5 exclusive AWS SDK deps), T3 promote service/eks CI gate from lenient to strict + add ec2/dynamodb/ elb/rds/sqs to banned list, T4 three-layer provider architecture doc + ADR-0032. Single PR on feat/issue-653-phase3-aws-drivers. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…namodb/elb/rds/sqs)
…ds/sqs to strict ban
Contributor
There was a problem hiding this comment.
Pull request overview
This PR completes Issue #653 Phase 3 by tombstoning the unused, aws-build-tag-gated platform/providers/aws implementation, tightening CI guards to prevent removed AWS SDK service packages from re-entering the core repo, and documenting the repo’s three distinct “provider” abstractions.
Changes:
- Deleted the entire
platform/providers/aws/provider + drivers implementation (and its unit tests). - Removed now-unused AWS SDK v2 service dependencies from
go.mod/go.sumand extended the module-level “absent package” regression test. - Promoted/updated the CI “aws-sdk-banned” gate and added provider-architecture documentation + ADR/plan docs.
Reviewed changes
Copilot reviewed 32 out of 33 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
| .github/workflows/ci.yml | Updates the aws-sdk-banned grep/go.mod gates and tightens service/eks enforcement to only allow usage under provider/. |
| decisions/0032-platform-provider-aws-tombstone.md | Adds ADR-0032 documenting the decision to remove the dead platform/providers/aws tree. |
| docs/plans/2026-05-13-issue-653-phase3-aws-drivers.md | Adds the Phase 3 implementation plan documentation (with scope-lock). |
| docs/plans/2026-05-13-issue-653-phase3-aws-drivers.md.scope-lock | Adds the plan scope-lock hash. |
| docs/plans/2026-05-13-issue-653-phase3-aws-drivers-design.md | Adds Phase 3 design notes / disposition analysis for the deleted AWS platform provider tree. |
| go.mod | Removes unused AWS SDK service deps (ec2/dynamodb/elasticloadbalancingv2/rds/sqs) and related indirects after deletion. |
| go.sum | Drops checksums for removed dependencies after go mod tidy. |
| module/aws_absent_test.go | Extends the “AWS service packages absent from module/” regression gate to include newly freed packages. |
| platform/provider.go | Adds a GoDoc explanation of the three-layer provider architecture and where AWS now belongs. |
| platform/providers/aws/aws_config.go | Deleted: aws-tag-gated AWS SDK config alias used only by the removed platform AWS provider. |
| platform/providers/aws/capability_mapper.go | Deleted: aws-tag-gated capability-to-resource mapping for the removed platform AWS provider. |
| platform/providers/aws/credential_broker.go | Deleted: aws-tag-gated STS-based credential broker for the removed platform AWS provider. |
| platform/providers/aws/credential_broker_test.go | Deleted: tests for the removed credential broker. |
| platform/providers/aws/driver_factories.go | Deleted: factory bridge between provider and drivers subpackage for the removed platform AWS provider. |
| platform/providers/aws/provider.go | Deleted: aws-tag-gated platform.Provider AWS implementation. |
| platform/providers/aws/provider_test.go | Deleted: tests for the removed AWSProvider. |
| platform/providers/aws/state_store.go | Deleted: aws-tag-gated S3/DynamoDB state store implementation. |
| platform/providers/aws/state_store_test.go | Deleted: tests for the removed state store. |
| platform/providers/aws/drivers/alb.go | Deleted: aws-tag-gated ALB resource driver. |
| platform/providers/aws/drivers/alb_test.go | Deleted: tests for the removed ALB driver. |
| platform/providers/aws/drivers/eks_cluster.go | Deleted: aws-tag-gated EKS cluster driver. |
| platform/providers/aws/drivers/eks_cluster_test.go | Deleted: tests for the removed EKS cluster driver. |
| platform/providers/aws/drivers/eks_nodegroup.go | Deleted: aws-tag-gated EKS nodegroup driver. |
| platform/providers/aws/drivers/eks_nodegroup_test.go | Deleted: tests for the removed EKS nodegroup driver. |
| platform/providers/aws/drivers/helpers.go | Deleted: helper utilities (diff/int/bool/string slice helpers) used by removed drivers. |
| platform/providers/aws/drivers/iam.go | Deleted: aws-tag-gated IAM role driver. |
| platform/providers/aws/drivers/iam_test.go | Deleted: tests for the removed IAM driver. |
| platform/providers/aws/drivers/rds.go | Deleted: aws-tag-gated RDS driver. |
| platform/providers/aws/drivers/rds_test.go | Deleted: tests for the removed RDS driver. |
| platform/providers/aws/drivers/sqs.go | Deleted: aws-tag-gated SQS driver. |
| platform/providers/aws/drivers/sqs_test.go | Deleted: tests for the removed SQS driver. |
| platform/providers/aws/drivers/vpc.go | Deleted: aws-tag-gated VPC driver. |
| platform/providers/aws/drivers/vpc_test.go | Deleted: tests for the removed VPC driver. |
Comments suppressed due to low confidence (2)
docs/plans/2026-05-13-issue-653-phase3-aws-drivers-design.md:150
- This bullet lists
service/iamas “exclusive to the deleted tree” / safe to ban, but aws-sdk-go-v2/service/iam is still imported by iam/aws.go and plugin/rbac/aws.go in core. Update the list to removeservice/iam(and any related wording) so it matches the current repo reality.
- Promote `service/eks` CI gate: move from lenient-allowed-in-platform step to strict ban step + go.mod gate (Phase 2 CI comment at ci.yml:417–418 hands this off to Phase 3)
- Add banned packages exclusive to the deleted tree: `service/ec2`, `service/dynamodb`, `service/elasticloadbalancingv2`, `service/rds`, `service/sqs`, `service/iam` — these are not present in `provider/aws/` or anywhere else
docs/plans/2026-05-13-issue-653-phase3-aws-drivers-design.md:166
- Assumption #4 states
service/iamis only used by the build-tag-gated platform/providers/aws tree and implies it can be removed from go.mod/go.sum, but core still imports aws-sdk-go-v2/service/iam (iam/aws.go, plugin/rbac/aws.go). Please correct this assumption (and any downstream conclusions) to avoid suggesting an unsafe dependency removal/ban.
3. **`platform.Provider` interface is preserved** — confirmed: `DockerComposeProvider` and the pipeline step consumers remain.
4. **AWS SDK packages exclusive to this tree are not in go.mod/go.sum** — `ec2`, `dynamodb`, `elasticloadbalancingv2`, `rds`, `sqs`, `iam` are only used by the build-tag-gated `platform/providers/aws/` tree. `service/eks` IS in go.mod because `provider/aws/plugin.go` (no build tag) uses it; it must not be removed from go.mod in Phase 3 since `provider/aws/` is kept. `service/s3` also needs verification: check if it appears outside this tree.
5. **`service/eks` promotion is safe** — after `platform/providers/aws/drivers/eks_cluster.go` and `eks_nodegroup.go` are deleted, the only remaining callers of `service/eks` are in `provider/aws/` (deploy pipeline). The Phase 2 CI gate correctly anticipates this: the lenient step (`--exclude-dir=platform`) can be tightened to remove the `--exclude-dir=platform` exclusion, because the only remaining legitimate `eks` caller (`provider/aws/`) is still excluded by `--exclude-dir=provider`.
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
⏱ Benchmark Results✅ No significant performance regressions detected. benchstat comparison (baseline → PR)
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
platform/providers/aws/(build-tag-gated//go:build aws, zero external callers, no CI coverage, ~2,000 LOC of dead code)go.mod: ec2, dynamodb, elasticloadbalancingv2, rds, sqsservice/eksnow strictly banned outsideprovider/(ECS/EKS deploy pipeline)platform/provider.go+ ADR-0032Design
See: docs/plans/2026-05-13-issue-653-phase3-aws-drivers-design.md
Implementation Plan
See: docs/plans/2026-05-13-issue-653-phase3-aws-drivers.md
Scope Manifest
PR Count: 1
Tasks: 4
Status: Locked 2026-05-13T18:30:00Z
Changes
Task 1 — Delete
platform/providers/aws/+ absent-package gate (commit 835480a)platform/providers/aws/andplatform/providers/aws/drivers/module/aws_absent_test.goto assert ec2, dynamodb, elasticloadbalancingv2, rds, sqs are absent frommodule/go build ./...andgo test ./platform/...green after deletionTask 2 —
go mod tidyremoves 5 exclusive AWS SDK deps (commit 5475f4d)go mod tidy: ec2, dynamodb, elasticloadbalancingv2, rds, sqs removed fromgo.modprovider/aws/,iam/aws.go,plugin/rbac/aws.go, etc.)Task 3 — Promote
service/eksCI gate (commit f80030e)--exclude-dir=platformfrom eks grep gate (platform/providers/aws/ no longer exists)--exclude="nosql_dynamodb.go"to avoid false positive on doc comment (line 13 is a godoc comment, not an import)Task 4 — Three-layer provider architecture doc + ADR-0032 (commit 940066b)
platform/provider.godistinguishingplatform.Provider,interfaces.IaCProvider, andprovider.CloudProviderdecisions/0032-platform-provider-aws-tombstone.md(ADR accepted, references issue Audit AWS SDK usage in workflow core (RBAC/secrets/artifact stay; IaC drivers reviewed for plugin move) #653 Phase 1/2 and ADR-0024)Prior phases
platform.aws_*module types from engine coreTest Notes
Two pre-existing test failures on
cmd/wfctl(TestInfraMultiEnv_E2E— missing DO plugin binary,TestFallbackRuns) exist onorigin/mainand are unrelated to Phase 3 changes. Verified by running the same test suite againstorigin/mainbefore any Phase 3 code was applied.🤖 Generated with Claude Code