Skip to content

chore: drop async from every Terraform implementation - #406

Merged
grubmeshi merged 2 commits into
mainfrom
feature/terraform-drop-async
Oct 28, 2026
Merged

grubmeshi merged 2 commits into
mainfrom
feature/terraform-drop-async

Conversation

@grubmeshi

Copy link
Copy Markdown
Collaborator

🤖 Written by AI agent

Building block runner v2 always runs Terraform synchronously (meshcloud/building-block-runner#86, meshcloud/meshfed-release#11468), so the Terraform implementation has no use for async. GitHub workflows and Azure DevOps pipelines keep their own async.

This PR removes async = false from every Terraform implementation (29 modules, 2 reference architectures and the e2e of stackit/service-account-federation). The async of the GitHub and Azure DevOps implementations stays.

The provider minimums stay as they are: a configuration without async works with every provider version, because older providers default it to false, and the next provider release (v0.27.0) no longer accepts it.

Related: meshcloud/meshstack-cli#58, meshcloud/terraform-provider-meshstack#362

🤖 Generated with Claude Code

@github-actions

github-actions Bot commented Oct 28, 2026 •

Copy link
Copy Markdown
Contributor

Scorecard Check

Scorecard run on commit 0acbe69ecda10300bd941a596f426390d657755c relative to origin/main

📊 meshstack-hub Module Scorecard

Generated: 2026-10-28 | Modules scanned: 45 | Categories: 7

📋 Per-Module Category Summary

Score per category per building block. n/a = category does not apply to this module.

Module Overall Core Structure Integration AWS Backplane Azure Backplane GCP Backplane STACKIT Backplane Testing
aks/github-connector 🟢 92% 🟢 100% 🟢 100% n/a n/a n/a n/a 🟡 50%
aks/starterkit 🟢 85% 🟢 100% 🟢 93% n/a n/a n/a n/a 🔴 25%
aws/s3_bucket 🟢 91% 🟢 100% 🟢 100% 🟡 71% n/a n/a n/a 🟡 75%
azure/azure-virtual-machine-starterkit 🟡 55% 🟡 67% n/a n/a 🔴 44% n/a n/a 🟡 50%
azure/budget-alert 🟢 100% 🟢 100% 🟢 100% n/a 🟢 100% n/a n/a 🟢 100%
azure/entra-id-groups 🟢 100% 🟢 100% 🟢 100% n/a 🟢 100% n/a n/a 🟢 100%
azure/ipam-pool 🟢 100% 🟢 100% 🟢 100% n/a 🟢 100% n/a n/a 🟢 100%
azure/key-vault 🟢 100% 🟢 100% 🟢 100% n/a 🟢 100% n/a n/a 🟢 100%
azure/resource-group 🟢 100% 🟢 100% 🟢 100% n/a 🟢 100% n/a n/a 🟢 100%
azure/service-principal 🟢 100% 🟢 100% 🟢 100% n/a 🟢 100% n/a n/a 🟢 100%
azure/spoke-network 🟢 100% 🟢 100% 🟢 100% n/a 🟢 100% n/a n/a 🟢 100%
azure/storage-account 🟢 100% 🟢 100% 🟢 100% n/a 🟢 100% n/a n/a 🟢 100%
gcp/budget-alert 🟢 100% 🟢 100% 🟢 100% n/a n/a 🟢 100% n/a 🟢 100%
gcp/storage-bucket 🟢 100% 🟢 100% 🟢 100% n/a n/a 🟢 100% n/a 🟢 100%
github/repository 🟢 84% 🟢 83% 🟢 100% n/a n/a n/a n/a 🔴 25%
kubernetes/github-connector 🟢 92% 🟢 100% 🟢 100% n/a n/a n/a n/a 🟡 50%
kubernetes/ingress 🟢 92% 🟢 100% 🟢 100% n/a n/a n/a n/a 🔴 33%
kubernetes/manifest 🟢 92% 🟢 100% 🟢 100% n/a n/a n/a n/a 🟡 50%
meshstack/azure-devops-pipeline 🟢 96% 🟢 100% 🟢 92% n/a n/a n/a n/a 🟢 100%
meshstack/github-workflow 🟢 96% 🟢 83% 🟢 100% n/a n/a n/a n/a 🟢 100%
meshstack/gitlab-pipeline 🟢 100% 🟢 100% 🟢 100% n/a n/a n/a n/a 🟢 100%
meshstack/link 🟢 100% 🟢 100% 🟢 100% n/a n/a n/a n/a 🟢 100%
meshstack/manual 🟢 95% 🟢 83% 🟢 100% n/a n/a n/a n/a 🟢 100%
meshstack/noop 🟢 100% 🟢 100% 🟢 100% n/a n/a n/a n/a 🟢 100%
meshstack/workspace-starterkit 🟢 100% 🟢 100% 🟢 100% n/a n/a n/a n/a 🟢 100%
openshift/github-connector 🟢 92% 🟢 100% 🟢 100% n/a n/a n/a n/a 🟡 50%
openshift/starterkit 🟢 93% 🟢 100% 🟢 100% n/a n/a n/a n/a 🔴 33%
ske/cluster 🟢 88% 🟢 100% 🟢 100% n/a n/a n/a n/a 🔴 25%
ske/forgejo-connector 🟢 89% 🟢 100% 🟢 100% n/a n/a n/a n/a 🔴 25%
ske/ske-starterkit 🟢 97% 🟢 100% 🟢 100% n/a n/a n/a n/a 🟡 75%
stackit/ai-llm 🟢 88% 🟢 100% 🟢 100% n/a n/a n/a n/a 🔴 25%
stackit/container-registry 🟢 88% 🟢 100% 🟢 100% n/a n/a n/a n/a 🔴 25%
stackit/dns 🟢 88% 🟢 100% 🟢 100% n/a n/a n/a n/a 🔴 25%
stackit/git 🟢 88% 🟢 100% 🟢 100% n/a n/a n/a n/a 🔴 25%
stackit/git-repository 🟢 90% 🟢 100% 🟢 100% n/a n/a n/a 🔴 25% 🟢 100%
stackit/git-runner 🟢 88% 🟢 100% 🟢 100% n/a n/a n/a n/a 🔴 25%
stackit/network 🟢 100% 🟢 100% 🟢 100% n/a n/a n/a 🟢 100% 🟢 100%
stackit/network-area 🟢 100% 🟢 100% 🟢 100% n/a n/a n/a 🟢 100% 🟢 100%
stackit/project 🟢 88% 🟢 100% 🟡 76% n/a n/a n/a 🟢 100% 🟢 100%
stackit/secrets-manager 🟢 100% 🟢 100% 🟢 100% n/a n/a n/a 🟢 100% 🟢 100%
stackit/server 🟢 100% 🟢 100% 🟢 100% n/a n/a n/a 🟢 100% 🟢 100%
stackit/service-account 🟢 100% 🟢 100% 🟢 100% n/a n/a n/a 🟢 100% 🟢 100%
stackit/service-account-federation 🟢 100% 🟢 100% 🟢 100% n/a n/a n/a 🟢 100% 🟢 100%
stackit/stackit-project-starterkit 🟢 93% 🟢 100% 🟢 100% n/a n/a n/a n/a 🔴 33%
stackit/storage-bucket 🟢 100% 🟢 100% 🟢 100% n/a n/a n/a 🟢 100% 🟢 100%

⚠️ 24 modules have failing checks — failing categories are expanded below.

Core Structure — some checks failing

Basic module file structure and documentation — applies to 45 modules

Module Score 📦 🔗 📋 📝 🖼️ 📌 🚦 🎯 🩹 🧼 ❄️ 🔒
aks/github-connector 🟢 100% ✅ ✅ ➖ ✅ ✅ ✅ ➖ ✅ ➖ ➖ ➖ ✅
aks/starterkit 🟢 100% ✅ ✅ ➖ ✅ ✅ ✅ ✅ ✅ ➖ ➖ ➖ ✅
aws/s3_bucket 🟢 100% ✅ ✅ ➖ ✅ ✅ ✅ ➖ ✅ ➖ ➖ ➖ ✅
azure/azure-virtual-machine-starterkit 🟡 67% ✅ ❌ ❌ ✅ ❌ ✅ ✅ ✅ ➖ ➖ ➖ ✅
azure/budget-alert 🟢 100% ✅ ✅ ➖ ✅ ✅ ✅ ➖ ✅ ➖ ➖ ➖ ✅
azure/entra-id-groups 🟢 100% ✅ ✅ ➖ ✅ ✅ ✅ ➖ ✅ ✅ ➖ ➖ ✅
azure/ipam-pool 🟢 100% ✅ ✅ ➖ ✅ ✅ ✅ ➖ ✅ ✅ ➖ ➖ ✅
azure/key-vault 🟢 100% ✅ ✅ ➖ ✅ ✅ ✅ ➖ ✅ ✅ ➖ ➖ ✅
azure/resource-group 🟢 100% ✅ ✅ ➖ ✅ ✅ ✅ ➖ ✅ ➖ ➖ ➖ ✅
azure/service-principal 🟢 100% ✅ ✅ ➖ ✅ ✅ ✅ ➖ ✅ ✅ ➖ ➖ ✅
azure/spoke-network 🟢 100% ✅ ✅ ➖ ✅ ✅ ✅ ➖ ✅ ✅ ➖ ➖ ✅
azure/storage-account 🟢 100% ✅ ✅ ➖ ✅ ✅ ✅ ➖ ✅ ✅ ➖ ➖ ✅
gcp/budget-alert 🟢 100% ✅ ✅ ➖ ✅ ✅ ✅ ➖ ✅ ➖ ➖ ➖ ✅
gcp/storage-bucket 🟢 100% ✅ ✅ ➖ ✅ ✅ ✅ ➖ ✅ ➖ ➖ ➖ ✅
github/repository 🟢 83% ✅ ✅ ➖ ✅ ✅ ❌ ➖ ➖ ➖ ➖ ➖ ✅
kubernetes/github-connector 🟢 100% ✅ ✅ ➖ ✅ ✅ ✅ ➖ ✅ ➖ ➖ ➖ ✅
kubernetes/ingress 🟢 100% ✅ ✅ ➖ ✅ ✅ ✅ ➖ ➖ ✅ ➖ ➖ ✅
kubernetes/manifest 🟢 100% ✅ ✅ ➖ ✅ ✅ ✅ ➖ ➖ ✅ ➖ ➖ ✅
meshstack/azure-devops-pipeline 🟢 100% ✅ ✅ ➖ ✅ ✅ ➖ ➖ ✅ ➖ ➖ ➖ ✅
meshstack/github-workflow 🟢 83% ✅ ✅ ➖ ✅ ❌ ➖ ➖ ✅ ➖ ➖ ➖ ✅
meshstack/gitlab-pipeline 🟢 100% ✅ ✅ ➖ ✅ ✅ ➖ ➖ ✅ ✅ ➖ ➖ ✅
meshstack/link 🟢 100% ✅ ✅ ➖ ✅ ✅ ✅ ➖ ✅ ➖ ➖ ➖ ✅
meshstack/manual 🟢 83% ✅ ✅ ➖ ✅ ❌ ➖ ➖ ✅ ➖ ➖ ➖ ✅
meshstack/noop 🟢 100% ✅ ✅ ➖ ✅ ✅ ✅ ➖ ✅ ✅ ✅ ✅ ✅
meshstack/workspace-starterkit 🟢 100% ✅ ✅ ➖ ✅ ✅ ✅ ➖ ✅ ✅ ➖ ➖ ✅
openshift/github-connector 🟢 100% ✅ ✅ ➖ ✅ ✅ ✅ ➖ ✅ ➖ ➖ ➖ ✅
openshift/starterkit 🟢 100% ✅ ✅ ➖ ✅ ✅ ✅ ✅ ✅ ➖ ✅ ➖ ✅
ske/cluster 🟢 100% ✅ ✅ ➖ ✅ ✅ ✅ ➖ ➖ ➖ ➖ ➖ ✅
ske/forgejo-connector 🟢 100% ✅ ✅ ➖ ✅ ✅ ✅ ➖ ✅ ✅ ➖ ➖ ✅
ske/ske-starterkit 🟢 100% ✅ ✅ ➖ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ➖ ✅
stackit/ai-llm 🟢 100% ✅ ✅ ➖ ✅ ✅ ✅ ➖ ➖ ➖ ➖ ➖ ✅
stackit/container-registry 🟢 100% ✅ ✅ ➖ ✅ ✅ ✅ ➖ ➖ ➖ ✅ ➖ ✅
stackit/dns 🟢 100% ✅ ✅ ➖ ✅ ✅ ✅ ➖ ➖ ➖ ➖ ➖ ✅
stackit/git 🟢 100% ✅ ✅ ➖ ✅ ✅ ✅ ➖ ➖ ➖ ➖ ➖ ✅
stackit/git-repository 🟢 100% ✅ ✅ ➖ ✅ ✅ ✅ ➖ ✅ ➖ ➖ ➖ ✅
stackit/git-runner 🟢 100% ✅ ✅ ➖ ✅ ✅ ✅ ➖ ➖ ➖ ➖ ➖ ✅
stackit/network 🟢 100% ✅ ✅ ➖ ✅ ✅ ✅ ➖ ✅ ➖ ➖ ➖ ✅
stackit/network-area 🟢 100% ✅ ✅ ➖ ✅ ✅ ✅ ➖ ✅ ➖ ➖ ➖ ✅
stackit/project 🟢 100% ✅ ✅ ➖ ✅ ✅ ✅ ➖ ✅ ➖ ✅ ➖ ✅
stackit/secrets-manager 🟢 100% ✅ ✅ ➖ ✅ ✅ ✅ ➖ ✅ ✅ ➖ ➖ ✅
stackit/server 🟢 100% ✅ ✅ ➖ ✅ ✅ ✅ ➖ ✅ ✅ ➖ ➖ ✅
stackit/service-account 🟢 100% ✅ ✅ ➖ ✅ ✅ ✅ ➖ ✅ ➖ ➖ ➖ ✅
stackit/service-account-federation 🟢 100% ✅ ✅ ➖ ✅ ✅ ✅ ➖ ✅ ✅ ➖ ➖ ✅
stackit/stackit-project-starterkit 🟢 100% ✅ ✅ ➖ ✅ ✅ ✅ ✅ ✅ ✅ ➖ ➖ ✅
stackit/storage-bucket 🟢 100% ✅ ✅ ➖ ✅ ✅ ✅ ➖ ✅ ➖ ➖ ➖ ✅

Core Structure — Summary

Emoji Criterion Coverage Status
📦 buildingblock/ directory exists 45/45 🟢 100%
🔗 meshstack_integration.tf present 44/45 🟢 98%
📋 buildingblock/APP_TEAM_README.md present (no-integration fallback) 0/1 🔴 0%
📝 buildingblock/README.md with YAML front-matter 45/45 🟢 100%
🖼️ buildingblock/logo.png or logo.svg included 42/45 🟢 93%
📌 buildingblock/versions.tf present 40/41 🟢 98%
🚦 Child meshstack_building_block asserts a SUCCEEDED run 5/5 🟢 100%
🎯 meshStack *_ref attributes use the resource's ref output 36/36 🟢 100%
🩹 Every try() carries a comment saying why 17/17 🟢 100%
🧼 Pre-run scripts install no tools on the runner 5/5 🟢 100%
❄️ A module flake sits in nix/, is pinned, and Terraform calls it 1/1 🟢 100%
🔒 Provider versions float within one major (>= X.Y.Z, < N.0.0) 45/45 🟢 100%
Integration — some checks failing

meshstack_integration.tf conventions — applies to 44 modules

Module Score 🏷️ 🏢 📤 🔌 📎 🔀 🌱 📋 🏷️ 🧱 🏪 📖 📝 📊 🚫 🔄 🪪
aks/github-connector 🟢 100% ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ➖ ➖
aks/starterkit 🟢 93% ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ❌ ✅ ✅ ✅ ✅ ✅ ➖ ➖
aws/s3_bucket 🟢 100% ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ➖ ✅
azure/budget-alert 🟢 100% ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ➖ ✅
azure/entra-id-groups 🟢 100% ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ➖ ✅
azure/ipam-pool 🟢 100% ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ➖ ✅
azure/key-vault 🟢 100% ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ➖ ✅
azure/resource-group 🟢 100% ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ➖ ✅
azure/service-principal 🟢 100% ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ➖ ✅
azure/spoke-network 🟢 100% ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ➖ ✅
azure/storage-account 🟢 100% ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ➖ ✅
gcp/budget-alert 🟢 100% ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ➖ ✅
gcp/storage-bucket 🟢 100% ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ➖ ✅
github/repository 🟢 100% ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ➖ ➖
kubernetes/github-connector 🟢 100% ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ➖ ➖
kubernetes/ingress 🟢 100% ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ➖ ➖
kubernetes/manifest 🟢 100% ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ➖ ➖
meshstack/azure-devops-pipeline 🟢 92% ✅ ✅ ✅ ✅ ✅ ➖ ➖ ✅ ✅ ✅ ✅ ✅ ✅ ❌ ✅ ➖ ➖
meshstack/github-workflow 🟢 100% ✅ ✅ ✅ ✅ ✅ ➖ ➖ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ➖ ➖
meshstack/gitlab-pipeline 🟢 100% ✅ ✅ ✅ ✅ ✅ ➖ ➖ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ➖ ➖
meshstack/link 🟢 100% ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ➖ ➖
meshstack/manual 🟢 100% ✅ ✅ ✅ ✅ ✅ ➖ ➖ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ➖ ➖
meshstack/noop 🟢 100% ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ➖ ➖
meshstack/workspace-starterkit 🟢 100% ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ➖ ➖
openshift/github-connector 🟢 100% ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ➖ ➖
openshift/starterkit 🟢 100% ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ➖ ➖
ske/cluster 🟢 100% ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ➖ ➖
ske/forgejo-connector 🟢 100% ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ➖ ➖
ske/ske-starterkit 🟢 100% ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ➖ ➖
stackit/ai-llm 🟢 100% ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ➖ ➖
stackit/container-registry 🟢 100% ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ➖ ➖
stackit/dns 🟢 100% ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ➖ ➖
stackit/git 🟢 100% ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ➖ ➖
stackit/git-repository 🟢 100% ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ➖ ➖
stackit/git-runner 🟢 100% ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ➖ ➖
stackit/network 🟢 100% ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ➖ ✅
stackit/network-area 🟢 100% ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ➖ ✅
stackit/project 🟡 76% ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ❌ ❌ ❌ ❌ ✅ ✅ ✅
stackit/secrets-manager 🟢 100% ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ➖ ✅
stackit/server 🟢 100% ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ➖ ✅
stackit/service-account 🟢 100% ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ➖ ✅
stackit/service-account-federation 🟢 100% ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ➖ ✅
stackit/stackit-project-starterkit 🟢 100% ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ➖ ➖
stackit/storage-bucket 🟢 100% ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ➖ ✅

Integration — Summary

Emoji Criterion Coverage Status
🏷️ variable "hub" in integration 44/44 🟢 100%
🏢 variable "meshstack" in integration 44/44 🟢 100%
📤 building_block_definition output exposed 44/44 🟢 100%
🔌 meshcloud/meshstack in required_providers 44/44 🟢 100%
📎 backplane source uses var.hub.git_ref 44/44 🟢 100%
🔀 ref_name uses var.hub.git_ref 40/40 🟢 100%
🌱 BBD terraform_version >= 1.12.0 40/40 🟢 100%
📋 version_spec.draft uses var.hub.bbd_draft 44/44 🟢 100%
🏷️ BBD metadata.tags forwards var.meshstack.tags 44/44 🟢 100%
🧱 BBD input argument vars with optional() have explicit defaults 43/44 🟢 98%
🏪 BBD catalog properties are overridable 43/44 🟢 98%
📖 BBD readme field present 43/44 🟢 98%
📝 BBD readme starts with plain-text description (no heading) 43/44 🟢 98%
📊 BBD readme has shared responsibility table (✅/❌) 42/44 🟢 95%
🚫 No documentation_md output in backplane 44/44 🟢 100%
🔄 meshstack_platform has lifecycle ignore_changes = [availability] 1/1 🟢 100%
🪪 Trusts the runner's identity, not the replicator's 19/19 🟢 100%
AWS Backplane — some checks failing

AWS automation principal conventions (WIF or cross-account StackSet) — applies to 1 modules

Module Score 🔐 📌 🚫 ⚡ 🛂 📤 🌐 🧭 📚 🔑
aws/s3_bucket 🟡 71% ✅ ✅ ✅ ✅ ❌ ✅ ❌ ➖ ➖ ➖

AWS Backplane — Summary

Emoji Criterion Coverage Status
🔐 Takes oidc_provider_arn instead of creating a provider 1/1 🟢 100%
📌 oidc_provider_arn carries the shared-provider notice 1/1 🟢 100%
🚫 No aws_iam_access_key on the federation path 1/1 🟢 100%
⚡ workload_identity_federation is non-nullable 1/1 🟢 100%
🛂 Trust policy scopes :sub to the BBD's WIF subjects 0/1 🔴 0%
📤 Outputs workload_identity_federation_role as a constructed ARN 1/1 🟢 100%
🌐 Integration wires AWS_ROLE_ARN and AWS_WEB_IDENTITY_TOKEN_FILE 0/1 🔴 0%
🧭 Declares aws.management and aws.backplane aliases n/a —
📚 StackSet is SERVICE_MANAGED, auto-deploying, retaining nothing n/a —
🔑 Outputs the access key, a sensitive secret, and the target role name n/a —
Azure Backplane — some checks failing

Azure UAMI-based automation principal conventions — applies to 9 modules

Module Score 🪪 🚫 🚫 🔑 🔗 ⚡ 🧹 📤 📍
azure/azure-virtual-machine-starterkit 🔴 44% ❌ ✅ ✅ ✅ ❌ ❌ ✅ ❌ ❌
azure/budget-alert 🟢 100% ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅
azure/entra-id-groups 🟢 100% ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅
azure/ipam-pool 🟢 100% ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅
azure/key-vault 🟢 100% ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅
azure/resource-group 🟢 100% ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅
azure/service-principal 🟢 100% ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅
azure/spoke-network 🟢 100% ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅
azure/storage-account 🟢 100% ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅

Azure Backplane — Summary

Emoji Criterion Coverage Status
🪪 Uses azurerm_user_assigned_identity 8/9 🟢 89%
🚫 No azuread_application resources 9/9 🟢 100%
🚫 No azuread_service_principal resources 9/9 🟢 100%
🔑 No azuread_application_password resources 9/9 🟢 100%
🔗 Uses azurerm_federated_identity_credential 8/9 🟢 89%
⚡ workload_identity_federation is non-nullable 8/9 🟢 89%
🧹 No create_service_principal_name toggle 9/9 🟢 100%
📤 Outputs identity (client_id, principal_id, tenant_id) 8/9 🟢 89%
📍 Integration has azure_location 8/9 🟢 89%
GCP Backplane — ✅ all passing

GCP workload-identity-federation automation principal conventions — applies to 2 modules

Module Score 🔐 🚫 ⚡ 🪪 🛂 📤 ⏳ 🔌 🧹
gcp/budget-alert 🟢 100% ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅
gcp/storage-bucket 🟢 100% ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅

GCP Backplane — Summary

Emoji Criterion Coverage Status
🔐 Uses google_iam_workload_identity_pool + _provider 2/2 🟢 100%
🚫 No google_service_account_key resource 2/2 🟢 100%
⚡ workload_identity_federation is non-nullable 2/2 🟢 100%
🪪 Grants roles/iam.workloadIdentityUser on the service account 2/2 🟢 100%
🛂 Pool provider restricts google.subject via attribute_condition 2/2 🟢 100%
📤 Outputs credentials_json (sensitive) and service_account_email 2/2 🟢 100%
⏳ credentials_json waits on a time_sleep for IAM propagation 2/2 🟢 100%
🔌 google_project_service sets disable_on_destroy = false 2/2 🟢 100%
🧹 No provider "google" block in backplane/ 2/2 🟢 100%
STACKIT Backplane — some checks failing

STACKIT WIF-based automation principal conventions — applies to 9 modules

Module Score 🔐 🚫 📤 ⚡
stackit/git-repository 🔴 25% ❌ ✅ ❌ ❌
stackit/network 🟢 100% ✅ ✅ ✅ ✅
stackit/network-area 🟢 100% ✅ ✅ ✅ ✅
stackit/project 🟢 100% ✅ ✅ ✅ ✅
stackit/secrets-manager 🟢 100% ✅ ✅ ✅ ✅
stackit/server 🟢 100% ✅ ✅ ✅ ✅
stackit/service-account 🟢 100% ✅ ✅ ✅ ✅
stackit/service-account-federation 🟢 100% ✅ ✅ ✅ ✅
stackit/storage-bucket 🟢 100% ✅ ✅ ✅ ✅

STACKIT Backplane — Summary

Emoji Criterion Coverage Status
🔐 Uses stackit_service_account_federated_identity_provider 8/9 🟢 89%
🚫 No stackit_service_account_key resource 9/9 🟢 100%
📤 Outputs service_account_email (not key) 8/9 🟢 89%
⚡ WIF auth via env vars, not provider arguments 8/9 🟢 89%
Testing — some checks failing

End-to-end test coverage — applies to 45 modules

Module Score ⚙️ 🧪 🚫 ✅
aks/github-connector 🟡 50% ✅ ❌ ✅ ❌
aks/starterkit 🔴 25% ❌ ❌ ✅ ❌
aws/s3_bucket 🟡 75% ✅ ✅ ❌ ✅
azure/azure-virtual-machine-starterkit 🟡 50% ✅ ❌ ✅ ❌
azure/budget-alert 🟢 100% ✅ ✅ ✅ ✅
azure/entra-id-groups 🟢 100% ✅ ✅ ✅ ✅
azure/ipam-pool 🟢 100% ✅ ✅ ✅ ✅
azure/key-vault 🟢 100% ✅ ✅ ✅ ✅
azure/resource-group 🟢 100% ✅ ✅ ✅ ✅
azure/service-principal 🟢 100% ✅ ✅ ✅ ✅
azure/spoke-network 🟢 100% ✅ ✅ ✅ ✅
azure/storage-account 🟢 100% ✅ ✅ ✅ ✅
gcp/budget-alert 🟢 100% ✅ ✅ ✅ ✅
gcp/storage-bucket 🟢 100% ✅ ✅ ✅ ✅
github/repository 🔴 25% ❌ ❌ ✅ ❌
kubernetes/github-connector 🟡 50% ✅ ❌ ✅ ❌
kubernetes/ingress 🔴 33% ➖ ❌ ✅ ❌
kubernetes/manifest 🟡 50% ✅ ❌ ✅ ❌
meshstack/azure-devops-pipeline 🟢 100% ✅ ✅ ✅ ✅
meshstack/github-workflow 🟢 100% ✅ ✅ ✅ ✅
meshstack/gitlab-pipeline 🟢 100% ➖ ✅ ✅ ✅
meshstack/link 🟢 100% ➖ ✅ ✅ ✅
meshstack/manual 🟢 100% ➖ ✅ ✅ ✅
meshstack/noop 🟢 100% ✅ ✅ ✅ ✅
meshstack/workspace-starterkit 🟢 100% ✅ ✅ ✅ ✅
openshift/github-connector 🟡 50% ✅ ❌ ✅ ❌
openshift/starterkit 🔴 33% ➖ ❌ ✅ ❌
ske/cluster 🔴 25% ❌ ❌ ✅ ❌
ske/forgejo-connector 🔴 25% ❌ ❌ ✅ ❌
ske/ske-starterkit 🟡 75% ❌ ✅ ✅ ✅
stackit/ai-llm 🔴 25% ❌ ❌ ✅ ❌
stackit/container-registry 🔴 25% ❌ ❌ ✅ ❌
stackit/dns 🔴 25% ❌ ❌ ✅ ❌
stackit/git 🔴 25% ❌ ❌ ✅ ❌
stackit/git-repository 🟢 100% ✅ ✅ ✅ ✅
stackit/git-runner 🔴 25% ❌ ❌ ✅ ❌
stackit/network 🟢 100% ✅ ✅ ✅ ✅
stackit/network-area 🟢 100% ✅ ✅ ✅ ✅
stackit/project 🟢 100% ✅ ✅ ✅ ✅
stackit/secrets-manager 🟢 100% ✅ ✅ ✅ ✅
stackit/server 🟢 100% ✅ ✅ ✅ ✅
stackit/service-account 🟢 100% ✅ ✅ ✅ ✅
stackit/service-account-federation 🟢 100% ✅ ✅ ✅ ✅
stackit/stackit-project-starterkit 🔴 33% ➖ ❌ ✅ ❌
stackit/storage-bucket 🟢 100% ✅ ✅ ✅ ✅

Testing — Summary

Emoji Criterion Coverage Status
⚙️ backplane/ directory (optional tier) 29/39 🟡 74%
🧪 e2e/ test directory exists 28/45 🟡 62%
🚫 no .tftest.hcl outside e2e/ 44/45 🟢 98%
✅ e2e/ contains .tftest.hcl files 28/45 🟡 62%

📈 Overall Summary

Overall Average Score: 94%

Score Distribution

  • 🟢 High maturity (≥80%): 44 modules
  • 🟡 Medium maturity (50–79%): 1 modules
  • 🔴 Low maturity (<50%): 0 modules

@aws-amplify-eu-central-1

Copy link
Copy Markdown

This pull request is automatically being deployed by Amplify Hosting (learn more).

Access this pull request here: https://pr-406.d1o16zfeoh2slu.amplifyapp.com

grubmeshi and others added 2 commits October 28, 2026 14:26
meshStack provider v0.27.0 deprecates status.status on meshstack_building_block
and adds status.succeeded, status.health_status and status.action. Postconditions,
e2e assertions and the scorecard check move to them, and every touched module
requires the provider at >= 0.27.0.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
meshStack runs Terraform building blocks synchronously, and the meshstack provider removes the
attribute. Omitting it works with every provider version, so no minimum version changes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@grubmeshi
grubmeshi force-pushed the feature/terraform-drop-async branch from d6a9cc6 to eab6b81 Compare October 28, 2026 13:27
@grubmeshi
grubmeshi marked this pull request as ready for review October 28, 2026 13:27
@sonarqubecloud

Copy link
Copy Markdown

@grubmeshi
grubmeshi merged commit eab6b81 into main Oct 28, 2026
5 of 6 checks passed
@grubmeshi
grubmeshi deleted the feature/terraform-drop-async branch October 28, 2026 14:19
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant