Skip to content

refactor: drop direct AWS SDK use from workflow core #744

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
intel352 merged 5 commits into from
May 20, 2026
Merged

refactor: drop direct AWS SDK use from workflow core #744

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
009c603
refactor: drop direct AWS SDK use from workflow core
intel352 May 20, 2026
a5bf4f9
docs(api): clarify AWS IAM removal note in NewRouterWithIAM
intel352 May 20, 2026
947b56b
docs(api): use correct interface name iam.IAMProvider
intel352 May 20, 2026
c2067a2
chore: run go mod tidy in example/ after AWS SDK removal
intel352 May 20, 2026
e7aead7
docs: note provider/aws/ removal in two historical planning docs
intel352 May 20, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 7 additions & 1 deletion CICD_PLAN.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -444,7 +444,13 @@ type CloudProvider interface {

### 4 Provider Plugins

**`provider/aws/plugin.go`** — AWS: EC2, ECS, EKS, ECR, CloudWatch
> **Update 2026-05-20 (PR #744):** `provider/aws/*` has been deleted from
> workflow-core; AWS IaC now lives in the external `workflow-plugin-aws`
> repo. The references below are kept as the historical phase-6 plan;
> see the migration doc at
> `docs/migrations/2026-05-15-plugin-modules-on-iac.md` for current state.

**`provider/aws/plugin.go`** — AWS: EC2, ECS, EKS, ECR, CloudWatch (extracted to workflow-plugin-aws)
**`provider/gcp/plugin.go`** — GCP: GKE, Cloud Run, GCR, Cloud Monitoring
**`provider/azure/plugin.go`** — Azure: AKS, ACI, ACR, Azure Monitor
**`provider/digitalocean/plugin.go`** — DO: DOKS, App Platform, Container Registry
Expand Down
7 changes: 6 additions & 1 deletion api/router.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -185,7 +185,12 @@ func NewRouterWithIAM(stores Stores, cfg Config, iamResolver *iam.IAMResolver) h
resolver := iamResolver
if resolver == nil {
resolver = iam.NewIAMResolver(stores.IAM)
resolver.RegisterProvider(&iam.AWSIAMProvider{})
// AWS IAM provider removed from workflow core; no in-process
// replacement is wired here. To re-enable AWS IAM, the
// embedder must construct an iam.IAMResolver, register an
// AWS-aware iam.IAMProvider impl on it (e.g., from
// workflow-plugin-aws), and pass it as iamResolver above
// rather than relying on this default branch.
resolver.RegisterProvider(&iam.KubernetesProvider{})
resolver.RegisterProvider(&iam.OIDCProvider{})
Comment on lines 185 to 195
Comment on lines 185 to 195
}
Expand Down
203 changes: 0 additions & 203 deletions artifact/s3.go
View file
Open in desktop

This file was deleted.

1 change: 0 additions & 1 deletion cmd/server/main.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,7 +44,6 @@ import (
allplugins "github.com/GoCodeAlone/workflow/plugins/all"
pluginpipeline "github.com/GoCodeAlone/workflow/plugins/pipelinesteps"
"github.com/GoCodeAlone/workflow/provider"
_ "github.com/GoCodeAlone/workflow/provider/aws"
_ "github.com/GoCodeAlone/workflow/provider/azure"
_ "github.com/GoCodeAlone/workflow/provider/digitalocean"
_ "github.com/GoCodeAlone/workflow/provider/gcp"
Expand Down
21 changes: 14 additions & 7 deletions docs/migrations/2026-05-15-plugin-modules-on-iac.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -178,11 +178,14 @@ this single transitive path** and **fail CI on any other** `cloud.google.com/go/
dep. Any new GCP SDK package (e.g. `cloud.google.com/go/storage`,
`google.golang.org/api/*`) belongs in `workflow-plugin-gcp`, not core.

This is the GCP-side mirror of Phase B's `aws-sdk-go-v2`-retention paragraph:
`provider/aws/` legitimately uses the AWS SDK for its deploy pipeline,
`provider/gcp/` legitimately uses OAuth2 ADC for service-account auth, and
both arrangements are intentional — the audit gate just guards against
scope creep beyond those known seams.
This is the GCP-side mirror of Phase B's `aws-sdk-go-v2`-retention paragraph.
**Update 2026-05-20 (PR #744):** `provider/aws/` has since been deleted along
with the remaining direct AWS SDK uses in workflow core (`iam/aws.go`,
`artifact/s3.go`, `plugin/rbac/aws.go`); `workflow-plugin-aws` is now the
in-tree home for AWS IaC. `aws-sdk-go-v2` remains in `go.mod` purely as an
indirect dep (pulled by `modular/eventbus/v2` for sts/kinesis), which is
a modular-side concern. `provider/gcp/` continues to use OAuth2 ADC for
service-account auth — that arrangement is unchanged.

## Rollback

Expand All @@ -208,6 +211,9 @@ non-test consumers.
- `go mod tidy` against the merged tree makes no net change to AWS SDK
service modules — `aws-sdk-go-v2` stays in `go.mod` because `provider/aws/`,
`plugin/rbac/aws.go`, `iam/aws.go`, and `artifact/s3.go` still import it.
**Update (PR #744, 2026-05-20):** all four of those files have since
been deleted; `aws-sdk-go-v2` now remains in `go.mod` only as an indirect
dep via `modular/eventbus/v2` (sts + kinesis).
- The `.phase-b-complete` marker arms
`scripts/audit-cloud-symbols.sh --check`'s zero-`aws-sdk-go-v2` invariant on
`module/cloud_account_aws_creds.go`.
Expand Down Expand Up @@ -256,8 +262,9 @@ Plan-1 and plan-2 manifests + per-task spec records live under
`2026-05-15-plugin-modules-on-iac.md`).

**Final invariant statement:** workflow-core now imports zero cloud-provider
SDK clients in `module/`; provider-specific surfaces (`provider/aws/`,
`provider/gcp/`'s OAuth2-only path) retain only what's needed for the
SDK clients in `module/`; provider-specific surfaces (`provider/gcp/`'s
OAuth2-only path; `provider/aws/` was removed in PR #744 and replaced by
`workflow-plugin-aws`) retain only what's needed for the
out-of-scope deploy-pipeline / credential-resolution work that #653 +
decisions/0034 explicitly carve out. Every other cloud-provider integration
crosses the engine ↔ plugin gRPC boundary.
Expand Down
3 changes: 0 additions & 3 deletions example/go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,11 +33,8 @@ require (
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.22 // indirect
github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.23 // indirect
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.8 // indirect
github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.13 // indirect
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.22 // indirect
github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.21 // indirect
github.com/aws/aws-sdk-go-v2/service/kinesis v1.43.5 // indirect
github.com/aws/aws-sdk-go-v2/service/s3 v1.99.0 // indirect
github.com/aws/aws-sdk-go-v2/service/signin v1.0.10 // indirect
github.com/aws/aws-sdk-go-v2/service/sso v1.30.16 // indirect
github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.20 // indirect
Expand Down
8 changes: 0 additions & 8 deletions example/go.sum
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -60,20 +60,12 @@ github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.22 h1:dY4kWZiSaXIzxnKlj1
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.22/go.mod h1:KIpEUx0JuRZLO7U6cbV204cWAEco2iC3l061IxlwLtI=
github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.23 h1:FPXsW9+gMuIeKmz7j6ENWcWtBGTe1kH8r9thNt5Uxx4=
github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.23/go.mod h1:7J8iGMdRKk6lw2C+cMIphgAnT8uTwBwNOsGkyOCm80U=
github.com/aws/aws-sdk-go-v2/service/iam v1.53.7 h1:n9YLiWtX3+6pTLZWvRJmtq5JIB9NA/KFelyCg5fOlTU=
github.com/aws/aws-sdk-go-v2/service/iam v1.53.7/go.mod h1:sP46Vo6MeJcM4s0ZXcG2PFmfiSyixhIuC/74W52yKuk=
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.8 h1:HtOTYcbVcGABLOVuPYaIihj6IlkqubBwFj10K5fxRek=
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.8/go.mod h1:VsK9abqQeGlzPgUr+isNWzPlK2vKe9INMLWnY65f5Xs=
github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.13 h1:JRaIgADQS/U6uXDqlPiefP32yXTda7Kqfx+LgspooZM=
github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.13/go.mod h1:CEuVn5WqOMilYl+tbccq8+N2ieCy0gVn3OtRb0vBNNM=
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.22 h1:PUmZeJU6Y1Lbvt9WFuJ0ugUK2xn6hIWUBBbKuOWF30s=
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.22/go.mod h1:nO6egFBoAaoXze24a2C0NjQCvdpk8OueRoYimvEB9jo=
github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.21 h1:ZlvrNcHSFFWURB8avufQq9gFsheUgjVD9536obIknfM=
github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.21/go.mod h1:cv3TNhVrssKR0O/xxLJVRfd2oazSnZnkUeTf6ctUwfQ=
github.com/aws/aws-sdk-go-v2/service/kinesis v1.43.5 h1:LxgRVyuY+5DEPSX7kmin/V7toE8MWZ9U8n2dqRtX+RE=
github.com/aws/aws-sdk-go-v2/service/kinesis v1.43.5/go.mod h1:eUebEBEqVfOwEyDDDbGauH4PNqDCuepRvTaNbJeWr5w=
github.com/aws/aws-sdk-go-v2/service/s3 v1.99.0 h1:hlSuz394kV0vhv9drL5lhuEFbEOEP1VyQpy15qWh1Pk=
github.com/aws/aws-sdk-go-v2/service/s3 v1.99.0/go.mod h1:uoA43SdFwacedBfSgfFSjjCvYe8aYBS7EnU5GZ/YKMM=
github.com/aws/aws-sdk-go-v2/service/signin v1.0.10 h1:a1Fq/KXn75wSzoJaPQTgZO0wHGqE9mjFnylnqEPTchA=
github.com/aws/aws-sdk-go-v2/service/signin v1.0.10/go.mod h1:p6+MXNxW7IA6dMgHfTAzljuwSKD0NCm/4lbS4t6+7vI=
github.com/aws/aws-sdk-go-v2/service/sso v1.30.16 h1:x6bKbmDhsgSZwv6q19wY/u3rLk/3FGjJWyqKcIRufpE=
Expand Down
15 changes: 4 additions & 11 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,15 +15,6 @@ require (
github.com/GoCodeAlone/yaegi v0.17.2
github.com/IBM/sarama v1.47.0
github.com/alicebob/miniredis/v2 v2.36.1
github.com/aws/aws-sdk-go-v2 v1.41.6
github.com/aws/aws-sdk-go-v2/config v1.32.16
github.com/aws/aws-sdk-go-v2/credentials v1.19.15
github.com/aws/aws-sdk-go-v2/service/cloudwatch v1.55.2
github.com/aws/aws-sdk-go-v2/service/ecs v1.76.0
github.com/aws/aws-sdk-go-v2/service/eks v1.81.2
github.com/aws/aws-sdk-go-v2/service/iam v1.53.7
github.com/aws/aws-sdk-go-v2/service/s3 v1.97.2
github.com/aws/aws-sdk-go-v2/service/sts v1.42.0
github.com/cucumber/godog v0.15.1
github.com/docker/docker v28.5.2+incompatible
github.com/expr-lang/expr v1.17.8
Expand Down Expand Up @@ -83,19 +74,21 @@ require (
github.com/Workiva/go-datastructures v1.1.7 // indirect
github.com/andybalholm/brotli v1.2.1 // indirect
github.com/armon/go-metrics v0.4.1 // indirect
github.com/aws/aws-sdk-go-v2 v1.41.6 // indirect
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.8 // indirect
github.com/aws/aws-sdk-go-v2/config v1.32.16 // indirect
github.com/aws/aws-sdk-go-v2/credentials v1.19.15 // indirect
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.22 // indirect
github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.22 // indirect
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.22 // indirect
github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.23 // indirect
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.8 // indirect
github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.12 // indirect
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.22 // indirect
github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.20 // indirect
github.com/aws/aws-sdk-go-v2/service/kinesis v1.43.4 // indirect
github.com/aws/aws-sdk-go-v2/service/signin v1.0.10 // indirect
github.com/aws/aws-sdk-go-v2/service/sso v1.30.16 // indirect
github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.20 // indirect
github.com/aws/aws-sdk-go-v2/service/sts v1.42.0 // indirect
github.com/aws/smithy-go v1.25.0 // indirect
github.com/aymanbagabas/go-osc52/v2 v2.0.1 // indirect
github.com/beorn7/perks v1.0.1 // indirect
Expand Down
14 changes: 0 additions & 14 deletions go.sum
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -68,26 +68,12 @@ github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.22 h1:dY4kWZiSaXIzxnKlj1
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.22/go.mod h1:KIpEUx0JuRZLO7U6cbV204cWAEco2iC3l061IxlwLtI=
github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.23 h1:FPXsW9+gMuIeKmz7j6ENWcWtBGTe1kH8r9thNt5Uxx4=
github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.23/go.mod h1:7J8iGMdRKk6lw2C+cMIphgAnT8uTwBwNOsGkyOCm80U=
github.com/aws/aws-sdk-go-v2/service/cloudwatch v1.55.2 h1:mleWBVIxwceEzyItUVoqMFiv6TmOP6ECPoN6WB/VWXc=
github.com/aws/aws-sdk-go-v2/service/cloudwatch v1.55.2/go.mod h1:cMApt548kNgu87UsBTNWVv+fpzjbUTFRSFjD1688SBs=
github.com/aws/aws-sdk-go-v2/service/ecs v1.76.0 h1:a5G/TgJNrpuCjZBTf8/PTN0C2B0do/ylaYVynxPSbUQ=
github.com/aws/aws-sdk-go-v2/service/ecs v1.76.0/go.mod h1:QkWmubOYmjj3cHn7A4CoUU7BKJhVeo39Gp6NH7IyhZw=
github.com/aws/aws-sdk-go-v2/service/eks v1.81.2 h1:6c/Jkyx1gYLiZGl6VPjApViaoPiYo7TDWXCMk/ZBq6c=
github.com/aws/aws-sdk-go-v2/service/eks v1.81.2/go.mod h1:xdUh6tdF9A8hc+PE84kmHbF/zsVPNiKnc6oLgulq1Eo=
github.com/aws/aws-sdk-go-v2/service/iam v1.53.7 h1:n9YLiWtX3+6pTLZWvRJmtq5JIB9NA/KFelyCg5fOlTU=
github.com/aws/aws-sdk-go-v2/service/iam v1.53.7/go.mod h1:sP46Vo6MeJcM4s0ZXcG2PFmfiSyixhIuC/74W52yKuk=
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.8 h1:HtOTYcbVcGABLOVuPYaIihj6IlkqubBwFj10K5fxRek=
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.8/go.mod h1:VsK9abqQeGlzPgUr+isNWzPlK2vKe9INMLWnY65f5Xs=
github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.12 h1:qtJZ70afD3ISKWnoX3xB0J2otEqu3LqicRcDBqsj0hQ=
github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.12/go.mod h1:v2pNpJbRNl4vEUWEh5ytQok0zACAKfdmKS51Hotc3pQ=
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.22 h1:PUmZeJU6Y1Lbvt9WFuJ0ugUK2xn6hIWUBBbKuOWF30s=
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.22/go.mod h1:nO6egFBoAaoXze24a2C0NjQCvdpk8OueRoYimvEB9jo=
github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.20 h1:siU1A6xjUZ2N8zjTHSXFhB9L/2OY8Dqs0xXiLjF30jA=
github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.20/go.mod h1:4TLZCmVJDM3FOu5P5TJP0zOlu9zWgDWU7aUxWbr+rcw=
github.com/aws/aws-sdk-go-v2/service/kinesis v1.43.4 h1:3m9iJtMtLq75jKRAfw0kapoHUlbzi0CRVigysBN/FHA=
github.com/aws/aws-sdk-go-v2/service/kinesis v1.43.4/go.mod h1:O2L6vGm4xacEuN2otHFMgn7yXXlgzFKzxrba0fy/yk8=
github.com/aws/aws-sdk-go-v2/service/s3 v1.97.2 h1:MRNiP6nqa20aEl8fQ6PJpEq11b2d40b16sm4WD7QgMU=
github.com/aws/aws-sdk-go-v2/service/s3 v1.97.2/go.mod h1:FrNA56srbsr3WShiaelyWYEo70x80mXnVZ17ZZfbeqg=
github.com/aws/aws-sdk-go-v2/service/signin v1.0.10 h1:a1Fq/KXn75wSzoJaPQTgZO0wHGqE9mjFnylnqEPTchA=
github.com/aws/aws-sdk-go-v2/service/signin v1.0.10/go.mod h1:p6+MXNxW7IA6dMgHfTAzljuwSKD0NCm/4lbS4t6+7vI=
github.com/aws/aws-sdk-go-v2/service/sso v1.30.16 h1:x6bKbmDhsgSZwv6q19wY/u3rLk/3FGjJWyqKcIRufpE=
Expand Down
Loading
Loading