[IAmJSD]

What

Finishes the run-block sweep from #155. On current main there were 55 ${{ }} interpolation lines left inside run: blocks across 5 workflow files (the issue's table of 159 is out of date: deploy-aws-lambda.yml, database-migration.yml and part of the deploy-* files have been cleaned up on main since it was written). This PR moves every one of them into env: and references the shell variable quoted. Afterwards the issue's parser reports 0, and zizmor's template-injection audit goes from 58 findings to 0.

file	before	after
deploy-all.yml	25	0
deploy-azure.yml	11	0
deploy-gcp.yml	8	0
deploy-aws-fargate.yml	6	0
ci.yml	5	0
total	55	0

There's one commit per workflow file, so each can be reviewed by inspection. #155 suggested one PR per file. I'm happy to split this into five PRs if you'd prefer that.

How (mechanical, no logic changes)

• Each value goes into an env: entry with the original expression copied exactly, including ${{ inputs.deploy_to || 'all' }}, so fallbacks and empty values evaluate the same way as before.
• Step-level env: is used everywhere except in two places that use job-level env::
  • deploy-all.yml notify (both steps read the same nine needs.* values).
  • ci.yml terraform-validate, where CLOUD: ${{ matrix.cloud }} is the same name and value that fix(ops): alert on failed purchases and scheduled tasks; wire monitoring per environment #1094 uses for its new step.
• Existing shell assignments are kept and now read from the env var. For example, ENVIRONMENT="${{ needs.prepare.outputs.target_environment }}" becomes ENVIRONMENT="$TARGET_ENVIRONMENT". The rest of each script is byte-identical, and the variable stays unexported, just as it was.
• ${{ env.AZURE_LOCATION }} and ${{ env.GCP_REGION }} become ${AZURE_LOCATION} and $GCP_REGION. Both are workflow-level env: entries that the runner already exports to every step, and nothing writes them to $GITHUB_ENV.
• New env names don't collide with anything the steps already use or with variables that tools read. I checked each job's existing env: and scripts/scan-shipped-image.sh, which reads no IMAGE variable.
• No set -euo pipefail was added, per the issue's 2026-08-03 note.

Deliberate quoting change (2 sites): scripts/scan-shipped-image.sh cudly:${{ github.sha }} and cd terraform/environments/${{ matrix.cloud }} were unquoted, and they're now "$IMAGE" and "terraform/environments/$CLOUD". The result only differs for a value containing whitespace, glob or shell metacharacters. github.sha is always 40 hex characters and matrix.cloud is the fixed list [aws, gcp, azure], so neither can reach that case.

ci.yml's workflow-lint comment cited "106 findings … 66 template-injection" below the zizmor threshold. It now says the pinned zizmor 1.29.0 reports 35 low findings (24 undocumented-permissions, 11 concurrency-limits), that zizmor 1.31 adds 4 low self-repository findings on deploy-all.yml's local reusable-workflow calls, and that template-injection is at zero (separate commits).

Verification

All of this was run locally on macOS. No workflow was run, so the behavioral evidence below comes from a local simulation of the runner, not from Actions.

1. Census (the issue's parser, unchanged): origin/main reports TOTAL 55, HEAD reports TOTAL 0. The origin/main run doubles as the negative control: the same parser finds the 55 hits on the pre-fix files.
2. zizmor 1.29.0 (the version CI pins):
   • zizmor --offline --persona=pedantic --min-severity=medium .github/workflows/ (the CI gate): "No findings" both before and after. Ignored findings drop from 93 to 35.
   • --format=json at --persona=pedantic: template-injection 58 → 0. At --persona=auditor: 0.
   • The 35 findings left are all low: undocumented-permissions and concurrency-limits. They're out of scope here.
3. actionlint 1.7.12 with shellcheck 0.11.0 and pyflakes 3.4.0 (same versions as the pre-commit hook): exit 0 on both origin/main and HEAD.
4. Before/after equivalence harness (fixture-level simulation, script below):
   • Setup: for every run: step that had an interpolation (19 steps), the harness renders the origin/main version by splicing values into the script text, as the runner does. It runs the HEAD version with the values passed through workflow, job and step env:. Both run under bash --noprofile --norc -e with stubbed terraform, az, bash and sleep.
   • Compared: exit code, stdout, stderr, $GITHUB_OUTPUT, $GITHUB_STEP_SUMMARY and the exact argv of each stubbed command.
   • Value scenarios: benign values; mixed results (failure, skipped, cancelled, empty deploy_to, empty vars.*); all-empty; a value unique to each expression (catches swapped env names); and multi-line values.
   • Result: 93 of 95 runs identical. The 2 differences are the deliberate github.sha quoting change above, triggered by the multi-line and metacharacter scenarios that github.sha can't produce.
   • Fail-before/pass-after: with $(touch PWNED_S) and a quote-breaking payload, the pre-fix scripts executed the payload in 28 runs. The post-fix scripts executed it in 0 of 30. The 4 matrix.cloud steps were not given payloads because the matrix is a static list.
   • Mutation probes: each of these deliberate breakages in the new files was detected as a difference: swapping two result variables, misspelling AZURE_LOCATION, wiring project_id to the wrong variable, hard-coding the cloud, dropping || 'all', and changing the IMAGE / IMAGE_TAG source.
5. git-secrets (--register-aws, repo .gitallowed) on the changed files in a fresh temporary repo: clean. trailing-whitespace and end-of-file checks: clean.

Equivalence harness (run: python3 equiv.py <repo> origin/main .github/workflows/{ci,deploy-all,deploy-aws-fargate,deploy-azure,deploy-gcp}.yml, needs PyYAML)

"""Render each changed run: step the way the Actions runner would, before
(origin/main: ${{ }} spliced into script text) and after (values passed via
env:), execute both under `bash -e` with stubbed external commands, and
compare everything observable."""
import os, re, subprocess, sys, tempfile, yaml, shutil

REPO = sys.argv[1]
BASE = sys.argv[2]
FILES = sys.argv[3:]
EXPR = re.compile(r"\$\{\{\s*(.*?)\s*\}\}")

PRELUDE = r'''
__log() { local a; { printf '%s' "$1"; shift; for a in "$@"; do printf ' %q' "$a"; done; printf '\n'; } >> "$STUBLOG"; }
terraform() { __log terraform "$@"; }
az() { __log az "$@"; echo stubval; }
bash() { __log bash "$@"; }
sleep() { __log sleep "$@"; }
date() { echo 2026-01-01T00:00:00Z; }
'''

def benign(path):
    if path.endswith(".result"): return "success"
    if "outputs.deploy-" in path: return "true"
    if path.endswith("environment") or path.endswith("target_environment"): return "dev"
    if path == "github.sha": return "0123456789abcdef0123456789abcdef01234567"
    if path == "matrix.cloud": return "aws"
    if path.endswith("app_url") or path.endswith("service_url"): return "https://app.example.com/"
    if path == "inputs.deploy_to": return "aws-gcp"
    if path.startswith("vars."): return "proj-123"
    return "val"

SCENARIOS = {
    "benign": benign,
    "mixed": lambda p: {"needs.deploy-gcp.result": "failure", "needs.deploy-azure.result": "skipped",
                        "needs.determine-deployment.outputs.deploy-aws-fargate": "false",
                        "needs.test-deployment.result": "cancelled", "inputs.deploy_to": "",
                        "vars.AZURE_LOCATION": "", "vars.GCP_PROJECT_ID": "", "matrix.cloud": "gcp"}.get(p, benign(p)),
    "empty": lambda p: "",
    # every expression gets a value unique to it, so cross-wired env names show up
    "distinct": lambda p: "aws" if p == "matrix.cloud" else "v<" + p + ">",
    "multiline": lambda p: "first line\nsecond line" if p != "matrix.cloud" else "aws",
    "payload_subst": lambda p: "$(touch PWNED_S)" if p != "matrix.cloud" else "aws",
    "payload": lambda p: '$(touch PWNED)`touch PWNED2`"; touch PWNED3; echo "' if p != "matrix.cloud" else "aws",
}

def evaluate(expr, val):
    for alt in [a.strip() for a in expr.split("||")]:
        m = re.fullmatch(r"'(.*)'", alt)
        v = m.group(1) if m else val(alt)
        if v != "": return v
    return ""

def render(template, val, wfenv):
    def sub(m):
        e = m.group(1)
        if e.startswith("env."): return wfenv.get(e[4:], "")
        if e.startswith("secrets."): return "secret-value"
        return evaluate(e, val)
    return EXPR.sub(sub, str(template))

def run(script, env, workdir):
    for d in ("terraform/environments/aws/ci-cd-permissions/tests", "terraform/environments/gcp", "terraform/environments/azure"):
        os.makedirs(os.path.join(workdir, d), exist_ok=True)
    open(os.path.join(workdir, "terraform/environments/aws/github-dev.tfvars"), "w").close()
    out_f, sum_f, log_f = (os.path.join(workdir, n) for n in ("out", "summary", "stublog"))
    for f in (out_f, sum_f, log_f): open(f, "w").close()
    full = dict(PATH=os.environ["PATH"], HOME=workdir, GITHUB_OUTPUT=out_f, GITHUB_STEP_SUMMARY=sum_f,
                STUBLOG=log_f, RUNNER_TEMP=workdir, **env)
    sp = os.path.join(workdir, "step.sh")
    open(sp, "w").write(PRELUDE + script)
    p = subprocess.run(["/bin/bash", "--noprofile", "--norc", "-e", sp], cwd=workdir, env=full,
                       capture_output=True, text=True, timeout=60)
    created = sorted(f for _, _, fs in os.walk(workdir) for f in fs if f.startswith("PWNED"))
    res = dict(rc=p.returncode, stdout=p.stdout, stderr=p.stderr.replace(workdir, "<W>"),
               output=open(out_f).read(), summary=open(sum_f).read(),
               stub=open(log_f).read().replace(workdir, "<W>"), pwned=created)
    return res

def steps(doc):
    for jn, job in doc["jobs"].items():
        for i, st in enumerate(job.get("steps") or []):
            if "run" in st: yield jn, i, job, st

total = diffs = fixed = 0
for f in FILES:
    old = yaml.safe_load(subprocess.check_output(["git", "-C", REPO, "show", f"{BASE}:{f}"], text=True))
    new = yaml.safe_load(open(os.path.join(REPO, f)))
    newsteps = {(jn, i): (job, st) for jn, i, job, st in steps(new)}
    for jn, i, ojob, ost in steps(old):
        if not EXPR.search(ost["run"]): continue
        njob, nst = newsteps[(jn, i)]
        assert nst.get("name") == ost.get("name"), (f, jn, i)
        assert not EXPR.search(nst["run"]), (f, jn, i)
        total += 1
        for sname, val in SCENARIOS.items():
            wfenv_o = {k: render(v, val, {}) for k, v in (old.get("env") or {}).items()}
            wfenv_n = {k: render(v, val, {}) for k, v in (new.get("env") or {}).items()}
            assert wfenv_o == wfenv_n
            # old: workflow+job+step env as-is, ${{ }} spliced into the script text
            env_o = dict(wfenv_o)
            for layer in (ojob.get("env") or {}, ost.get("env") or {}):
                env_o.update({k: render(v, val, wfenv_o) for k, v in layer.items()})
            script_o = render(ost["run"], val, wfenv_o)
            env_n = dict(wfenv_n)
            for layer in (njob.get("env") or {}, nst.get("env") or {}):
                env_n.update({k: render(v, val, wfenv_n) for k, v in layer.items()})
            script_n = nst["run"]
            with tempfile.TemporaryDirectory() as a, tempfile.TemporaryDirectory() as b:
                ro, rn = run(script_o, env_o, a), run(script_n, env_n, b)
            tag = f"{f} :: {jn} :: {ost.get('name')} :: {sname}"
            if sname.startswith("payload"):
                print(f"{tag}: before pwned={ro['pwned']} rc={ro['rc']} | after pwned={rn['pwned']} rc={rn['rc']}")
                if ro["pwned"] and not rn["pwned"]: fixed += 1
                if rn["pwned"]: diffs += 1; print("  !! AFTER STILL EXECUTES PAYLOAD")
                continue
            keys = [k for k in ro if ro[k] != rn[k]]
            if keys:
                diffs += 1
                print(f"DIFF {tag}: {keys}")
                for k in keys: print(f"   before {k}={ro[k]!r}\n   after  {k}={rn[k]!r}")
            else:
                print(f"same {tag} (rc={ro['rc']})")
print(f"\nsteps checked: {total}; behavior diffs on non-payload scenarios: {diffs}; payload executed before but not after: {fixed}")

Overlap with open PRs

I tested each of these with git merge-tree against this branch's head:

• fix: six small scheduled-auth, CI, OpenAPI and IaC fixes #1127 (deploy-all.yml): merged to main first and conflicted with this branch in the Check for failures step. I merged origin/main into this branch and kept fix: six small scheduled-auth, CI, OpenAPI and IaC fixes #1127's check_job allowlist unchanged, with its 5 new ${{ }} lines reading the notify job-level env instead: check_job "$DEPLOY_AWS_LAMBDA" "$DEPLOY_AWS_LAMBDA_RESULT" || FAILED=true (and the same for AWS_FARGATE, GCP and AZURE), plus if [[ "$DETERMINE_DEPLOYMENT_RESULT" != "success" ]]. A simulation of that step over 1,296 result/selection combinations matched main's version exactly.
• chore(ci): drop the unreachable Fargate caller job from deploy-all (#314) #1228 (deploy-all.yml): removes the deploy-aws-fargate caller job and its check_job line. Whichever of sec(ci): move the remaining run-block ${{ }} interpolations into env (#155) #1147 and chore(ci): drop the unreachable Fargate caller job from deploy-all (#314) #1228 merges second needs a trivial merge in that step.
• fix(iac): lock Azure Postgres against deletion and default GCP Cloud SQL protection on #1143 (ci.yml): merges cleanly, but it adds a new d=terraform/modules/database/${{ matrix.cloud }} run line, which would bring the census back to 1. After this PR merges, that line can use the job-level $CLOUD (d="terraform/modules/database/$CLOUD").
• These also touch ci.yml and merge cleanly with no new run-block interpolations: fix(scripts): make init-backend.sh write the state key CI uses #1142, ci: build and check the Docker image natively for amd64 and arm64 #1139, fix(scripts): require GCP_PROJECT_ID and TF_BACKEND_GCP in gcp-import-dev-state.sh #1119, fix(iac/azure): schedule the server tasks on AKS with CronJobs #1114, fix(ci): verify the rollback image in AWS_ACCOUNT_ID's registry #1112, sec(iac/aws): restrict the Fargate ALB to CloudFront when enable_cdn is on #1106, fix(ops): alert on failed purchases and scheduled tasks; wire monitoring per environment #1094, fix(iac/aws): route private egress through a persistent fck-nat ENI #1090, chore(iac/aws): add multi_az support and run prod RDS Multi-AZ on a non-burstable class #1086, fix(ci): bound prod down migrations so a large steps cannot run down -all #1084.
• fix(ops): alert on failed purchases and scheduled tasks; wire monitoring per environment #1094 also touches all four deploy-* files and merges cleanly. Where this PR adds entries to the same Terraform Plan env: blocks, I placed them so they don't land next to fix(ops): alert on failed purchases and scheduled tasks; wire monitoring per environment #1094's TF_VAR_alert_emails lines.
• rollback.yml is not touched. It is already clean, and fix(ci): verify the rollback image in AWS_ACCOUNT_ID's registry #1112 edits it.

Out of scope

• A CI step that runs the census parser and fails on any hit. The issue suggests making that a follow-up issue. Today the zizmor gate doesn't catch new template-injection findings, because they score low or informational and the gate's threshold is --min-severity=medium.
• Adding set -euo pipefail (a separate pass, per the issue).
• The remaining low zizmor findings (undocumented-permissions, concurrency-limits).

Closes #155

Could a maintainer please mirror the issue's triage labels onto this PR: priority/p2, severity/medium, impact/internal, type/chore, triaged, urgency/this-quarter, effort/m.

🤖 Generated with Claude Code

[coderabbitai]

Warning

Review limit reached

• Run on-demand review

_{This review includes 5 billable files and costs up to $1.25.}

Or wait 59 minutes for your next included review.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

Run configuration

• Source mode: Auto
• Repository: LeanerCloud/cloud-commitments-platform
• Branch: main
• File: .coderabbit.yaml
• Commit: 1c5787a
• Layers: Repository YAML
• Review profile: CHILL
• Plan: Advanced
• Run ID: a1d524ae-ebe6-4c55-94a3-b18f7c4f458a

Commits

Reviewing files that changed from the base of the PR and between 1c5787a and a20cf84.

Files selected for processing: 5

• .github/workflows/ci.yml
• .github/workflows/deploy-all.yml
• .github/workflows/deploy-aws-fargate.yml
• .github/workflows/deploy-azure.yml
• .github/workflows/deploy-gcp.yml

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[cristim]

Independent review (claude-cc-platform reviewer, cold brief): REQUEST_CHANGES 0d7c77f67cb48b6a27793f6f1bfdd568dbeaca9e

@IAmJSD the conversion itself is correct everywhere I checked. The only blocker is a rebase conflict with main.

1. Blocking: .github/workflows/deploy-all.yml, the Summarize / FAILED-check step (main ~L315-335). git merge-tree origin/main conflicts here. Main's fix: six small scheduled-auth, CI, OpenAPI and IaC fixes #1127 (bb2d2312) replaced the denylist with a check_job allowlist and added 5 new ${{ }} lines in that run block:

   • check_job "${{ needs.determine-deployment.outputs.deploy-aws-lambda }}" "${{ needs.deploy-aws-lambda.result }}", plus the fargate, gcp and azure variants;
   • if [[ "${{ needs.determine-deployment.result }}" != "success" ]].

   After the rebase, convert them to check_job "$DEPLOY_AWS_LAMBDA" "$DEPLOY_AWS_LAMBDA_RESULT" (and so on) and "$DETERMINE_DEPLOYMENT_RESULT"; your job-level env already defines all of these. Taking main's side would bring the run-block census back from 0 to 5. Please re-run the parser and actionlint afterwards.

2. Nit, ci.yml ~L240: the comment says "35 findings ... undocumented-permissions and concurrency-limits". zizmor on the head reports 39 non-suppressed low findings: 24 undocumented-permissions, 11 concurrency-limits and 4 self-repository. The sentence omits self-repository.

Verified:

• Census: the issue's jobs.*.steps[].run walk finds 0 hits in all 16 workflow files at the head. As a negative control, database-migration.yml on main has 54 ${{ outside run blocks.
• Linters: actionlint is clean on all 16 files. zizmor reports no template-injection findings and nothing at medium or above.
• Expressions: every moved expression is copied verbatim, including both inputs.deploy_to || 'all' sites.
• Name collisions: none with GITHUB_*, RUNNER_*, AWS_*, ARM_* or GOOGLE_*. GCP_PROJECT_ID is not read by the Google provider.
• Scope: $GCP_REGION and $AZURE_LOCATION are workflow-level env. CLOUD is job-level, from matrix.cloud. Every other variable is defined in the same step or at job level.
• Quoting: no heredoc or single-quote sites are touched. The two newly quoted call sites take a SHA and a fixed matrix value.
• Shell simulations:
  • the payload a b "q" $(touch PWNED) \id` ; x` executed through the old splice path and stays literal through the new env path;
  • a quote-breaking value in [[ "$V" == "all" ]] does not inject;
  • an unset variable under set -u fails loudly, and a manual walk found no reference missing its env entry.

[IAmJSD]

Thanks @cristim. Both findings from the review of 0d7c77f6 are addressed. The new head is 76ba95fe8d98a242311aa836e6d08707eb23be13.

1. [blocking] deploy-all.yml conflict with fix: six small scheduled-auth, CI, OpenAPI and IaC fixes #1127: fixed in merge commit 87a77483. I merged origin/main into the branch (no rebase). I took main's check_job allowlist and its comment exactly as written, and I only changed the 5 new ${{ }} lines to read the notify job-level env: .github/workflows/deploy-all.yml:356-360 (check_job "$DEPLOY_AWS_LAMBDA" "$DEPLOY_AWS_LAMBDA_RESULT", plus the fargate, gcp and azure lines and "$DETERMINE_DEPLOYMENT_RESULT"). There was no other conflict. Main's ALERT_EMAILS lines and its ci.yml and deploy-* changes merged cleanly.
2. [nit] ci.yml zizmor count: fixed in 76ba95fe at .github/workflows/ci.yml:239-245. The 35 is what CI's pinned zizmor 1.29.0 reports (24 undocumented-permissions and 11 concurrency-limits). Your 39 comes from zizmor 1.31.x: I reproduced it with 1.31.1, and 1.29.0 has no self-repository audit. The comment now gives both numbers and says the 4 self-repository findings are on deploy-all.yml's local reusable-workflow calls.

I also updated the PR body's "Overlap" section. The #1127 note is now past tense. It also says that #1228 removes the deploy-aws-fargate caller job and its check_job line, so whichever of #1147 and #1228 merges second needs a trivial merge in that step.

Verification on 76ba95fe (local, macOS, no workflow run):

• Census (the issue's jobs.*.steps[].run walk): 0 hits in all workflow files. origin/main c8bdd460 still reports 55, including the 5 check_job/determine-deployment lines.
• actionlint 1.7.12 (with shellcheck): exit 0.
• zizmor 1.29.0, CI gate (--offline --persona=pedantic --min-severity=medium): "No findings (35 ignored, 1 suppressed)".
• zizmor template-injection: 0 at both pedantic and auditor.
• Simulation of the resolved Check for failures step: I ran main's version (values spliced into the script) and the merged version (values passed through env) under bash -e, across 1,296 combinations of determine-deployment result, per-cloud selection (true/false/empty) and per-cloud result (success/failure/skipped/cancelled/empty). Exit code, stdout, stderr and the step summary were identical in every run. A quote-breaking $(touch PWNED) payload ran on main's version and stayed literal on the merged version. Three mutation probes were each caught: wiring gcp to the azure result, using the lambda result in the determine-deployment check, and passing the lambda selection to the fargate check.
• Other checks: git-secrets (--register-aws, fresh repo, isolated HOME) was clean on the 5 changed workflows, and git diff --check was clean.
• Not run: Go build, Go tests and Terraform checks, because this PR touches no Go or Terraform files.

[IAmJSD]

Independent review (IAmJSD's agent, fresh context, given only the diff, the issue and the PR text): VERDICT: APPROVE a20cf84124366c34a0c90f896b6f4266b00a9021

Blocking:

• none

Non-blocking:

• Every changed step except the ci.yml ones runs only on a deploy (deploy-all, deploy-aws-fargate, deploy-azure, deploy-gcp). Merging proves nothing about them, so the first real deploy after merge is the first time this runs on a runner. The change is mechanical and I found no wiring error (see Attacked), but please watch the first dev deploy's summary and plan steps.
• .github/workflows/deploy-gcp.yml:197: GCP_PROJECT_ID and TARGET_ENVIRONMENT are now exported into the terraform plan process environment. Neither is a name the Google provider or Terraform reads (GOOGLE_PROJECT, GOOGLE_CLOUD_PROJECT, CLOUDSDK_CORE_PROJECT and TF_VAR_* are), so it is harmless. If you want to avoid any future clash, a CUDLY_ prefix would make that explicit.
• I agree with the follow-up the issue and body suggest: a CI census step that fails on any ${{ in a run: scalar. Without it, fix(iac): lock Azure Postgres against deletion and default GCP Cloud SQL protection on #1143's new terraform/modules/database/${{ matrix.cloud }} line would bring the count back to 1.

Attacked:

• Census (the issue's YAML parser, all workflow files): origin/main 55, PR head 0, and git merge-tree --write-tree origin/main HEAD (which merges cleanly) also 0.
• zizmor 1.29.0 --persona=pedantic --format=json: template-injection 62 at the merge base, 0 at the head and 0 on the merged tree. The CI gate (--min-severity=medium) reports no findings. actionlint 1.7.12 with shellcheck exits 0 on the five changed files.
• I read every hunk by hand and checked the following:
  • Each env value is the original expression verbatim, including || 'all'.
  • Every $VAR maps to the right needs.* or steps.* source.
  • The swapped ${{ env.AZURE_LOCATION }}/${{ env.GCP_REGION }} are workflow-level env (lines 66/58).
  • Job-level env: using matrix/needs is a context GitHub allows there.
  • The check_job lines from fix: six small scheduled-auth, CI, OpenAPI and IaC fixes #1127 are wired to the matching _RESULT names.
• Fail-before: my own simulation of deploy-all.yml "Set cloud providers" with inputs.deploy_to = '"; touch PWNED; echo "'. The origin/main script executes the payload, the head script does not, and both write identical GITHUB_OUTPUT.
• No Go code changed, so I ran no go build or test.

Body-stale:

• "zizmor's template-injection audit goes from 58 findings to 0": at the current merge base, zizmor 1.29.0 reports 62 before. The "after" figure of 0 is still correct.

_{Reviewer: rB8. Bar while the maintainers are away (set by IAmJSD as acting owner): one approving independent review on the head, two for money, auth and security paths.}

[IAmJSD]

Independent review (IAmJSD's agent, fresh context, given only the diff, the issue and the PR text): VERDICT: APPROVE a20cf84124366c34a0c90f896b6f4266b00a9021

Blocking:

• none

Non-blocking:

• ci.yml terraform-validate: once current main is merged in, the job has the new job-level CLOUD: ${{ matrix.cloud }} plus two step-level CLOUD: ${{ matrix.cloud }} entries from fix(ops): alert on failed purchases and scheduled tasks; wire monitoring per environment #1094/fix(iac): lock Azure Postgres against deletion and default GCP Cloud SQL protection on #1143 (merged tree lines 958, 1022 and 1044). They have the same value and are harmless, but the step-level ones are now redundant.
• As the body says, nothing in CI stops a new run-block interpolation, because zizmor's template-injection findings score below the --min-severity=medium gate. A follow-up census step would keep this at 0.

Attacked:

• Read every hunk. Each env value is the original expression copied verbatim, including || 'all'. matrix is allowed in job-level env:. AZURE_LOCATION/GCP_REGION are workflow-level only, with no job override and no $GITHUB_ENV writer in those files, so ${{ env.X }} and $X are the same. The new names follow the existing conventions in deploy-aws-lambda/database-migration and shadow nothing a tool reads. GCP_PROJECT_ID is not a Google provider env var, and terraform only reads TF_VAR_*. The only quoting changes ("$IMAGE", "terraform/environments/$CLOUD") are on fixed-shape values.
• Census (the issue's YAML parser over jobs.*.steps[].run): 0 at the head, and 0 on git merge-tree HEAD origin/main (main has moved, and merges clean).
• zizmor 1.29.0 --offline --persona=pedantic --min-severity=medium (the CI gate): no findings on the head or the merged tree. The JSON at pedantic shows only 24 undocumented-permissions and 11 concurrency-limits, with 0 template-injection, which matches the updated ci.yml comment.
• actionlint v1.7.12 (with shellcheck on PATH): clean on the changed files and on all workflows in the merged tree. PR checks are all green. No workflow was run. The deploy-* changes only take effect on a deploy or release run, which has never fired (issue chore(ci): finish the #1641 sweep - 159 ${{ }} interpolations remain in run: blocks across 7 workflows #155).

Body-stale:

• "fix(iac): lock Azure Postgres against deletion and default GCP Cloud SQL protection on #1143 (ci.yml): merges cleanly, but it adds a new d=terraform/modules/database/${{ matrix.cloud }} run line, which would bring the census back to 1": fix(iac): lock Azure Postgres against deletion and default GCP Cloud SQL protection on #1143 has merged and main already uses "$CLOUD" there, so the merged census is 0. fix(ops): alert on failed purchases and scheduled tasks; wire monitoring per environment #1094 has also merged. chore(ci): drop the unreachable Fargate caller job from deploy-all (#314) #1228 is still open, so that note stands.

_{Reviewer: rB12. Bar while the maintainers are away (set by IAmJSD as acting owner): one approving independent review on the head, two for money, auth and security paths.}

[IAmJSD]

Local verification at a20cf84124366c34a0c90f896b6f4266b00a9021 merged onto main (51957bcf), together with #1100, #1108, #1147, #1149, #1276, #1292 in that order (combined tree bc575de3, Linux, Go 1.26.10): go build ./..., go vet with and without -tags integration, the full go test -race -short -count=1 ./..., and go test -race -tags integration -count=1 on every changed package, against Docker Postgres. All pass. CI Success and pre-commit are green on this head, with 2 approving independent review(s) on it. Nothing was run against any cloud.

[IAmJSD]

Merged by IAmJSD's agent at IAmJSD's request (IAmJSD is acting owner while the maintainers are away), under the bar IAmJSD set: 2 approving independent review(s) on a20cf841 (two required: money, auth or security path), green CI, and the combined-tree verification above. Squash-merged at exactly a20cf84124366c34a0c90f896b6f4266b00a9021.