Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Appearance settings

fix(trust): reduce validation frequency - #531

#531
Merged
edersonbrilhante merged 2 commits into
maincisco-open/forge:mainfrom
reduce-trust-validation-frequencycisco-open/forge:reduce-trust-validation-frequencyCopy head branch name to clipboard
Jul 25, 2026
Merged

fix(trust): reduce validation frequency#531
edersonbrilhante merged 2 commits into
maincisco-open/forge:mainfrom
reduce-trust-validation-frequencycisco-open/forge:reduce-trust-validation-frequencyCopy head branch name to clipboard

Conversation

@edersonbrilhante

@edersonbrilhante edersonbrilhante commented Jul 25, 2026

Copy link
Copy Markdown
Member

Description

Reduce scheduled Forge trust validation from every 10 minutes to twice daily using rate(12 hours).

This lowers repeated IAM/STS validation from 144 runs to 2 runs per day while retaining an explicit path to invoke the preparer Lambda after tenant IAM trust changes when immediate validation is required. The source contract now pins the intended schedule.

Type of Change

  • Feature
  • Bug Fix
  • Documentation
  • Refactor
  • Other: __________

Testing

  • tofu test in modules/platform/forge_runners/forge_trust_validator — 2 passed
  • Repository pre-commit hooks for the changed files — passed

@github-actions

github-actions Bot commented Jul 25, 2026

Copy link
Copy Markdown
Contributor

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

@github-actions

github-actions Bot commented Jul 25, 2026

Copy link
Copy Markdown
Contributor

OPA/conftest tenant-isolation gate

Result: passed

Gate Result
conftest verify --policy policy/opa passed

@github-actions

github-actions Bot commented Jul 25, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Mutation test critical Lambda boundaries

Result: passed

Suite Passed Failed Errors Skipped Total Duration Result
Mutation tests 17 0 0 0 17 1.48s passed

Coverage: 40.64% (1162/2859 lines)

Lowest-covered Lambda files

File Coverage Missed lines

@github-actions

github-actions Bot commented Jul 25, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Offline IaC contract tests

Result: passed

Suite Passed Failed Errors Skipped Total Duration Result
Offline IaC contracts 12 0 0 0 12 0.22s passed

Coverage: 88.04% (243/276 lines)

Lowest-covered Lambda files

File Coverage Missed lines

@github-actions

github-actions Bot commented Jul 25, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Automation gate tests

Result: passed

Suite Passed Failed Errors Skipped Total Duration Result
Automation gate tests 25 0 0 0 25 0.75s passed

Coverage: 84.63% (655/774 lines)

Lowest-covered Lambda files

File Coverage Missed lines

@edersonbrilhante
edersonbrilhante marked this pull request as ready for review July 25, 2026 02:27
@edersonbrilhante
edersonbrilhante requested a review from a team as a code owner July 25, 2026 02:27
@edersonbrilhante
edersonbrilhante enabled auto-merge (squash) July 25, 2026 02:32
@github-actions

github-actions Bot commented Jul 25, 2026

Copy link
Copy Markdown
Contributor

OpenTofu module tests (latest-stable)

Result: passed

OpenTofu version: 1.12.5

Metric Count
Passed modules 69
Failed modules 0
Total modules 69
Module Result
modules/helpers/ami_policy passed
modules/helpers/ami_sharing passed
modules/helpers/aws_config_recording passed
modules/helpers/cloud_custodian passed
modules/helpers/cloud_formation passed
modules/helpers/dedicated_mac_hosts passed
modules/helpers/ecr passed
modules/helpers/forge_subscription passed
modules/helpers/opt_in_regions passed
modules/helpers/service_linked_roles passed
modules/helpers/storage passed
modules/infra/eks passed
modules/integrations/github_webhook_relay_destination passed
modules/integrations/github_webhook_relay_destination_receivers passed
modules/integrations/github_webhook_relay_destination_receivers/webex_webhook_relay passed
modules/integrations/splunk_aws_billing passed
modules/integrations/splunk_cloud_conf_shared passed
modules/integrations/splunk_cloud_data_manager passed
modules/integrations/splunk_cloud_data_manager/data_input passed
modules/integrations/splunk_cloud_data_manager/sec_meta_ec2_tags passed
modules/integrations/splunk_cloud_data_manager_common passed
modules/integrations/splunk_cloud_s3_runner_logs passed
modules/integrations/splunk_dependency_monitor passed
modules/integrations/splunk_o11y_aws_integration passed
modules/integrations/splunk_o11y_aws_integration_common passed
modules/integrations/splunk_o11y_conf_shared passed
modules/integrations/splunk_o11y_conf_shared/dashboards/aws_regional_health passed
modules/integrations/splunk_o11y_conf_shared/dashboards/aws_service_limits passed
modules/integrations/splunk_o11y_conf_shared/dashboards/billing passed
modules/integrations/splunk_o11y_conf_shared/dashboards/dependency_probes passed
modules/integrations/splunk_o11y_conf_shared/dashboards/dynamodb passed
modules/integrations/splunk_o11y_conf_shared/dashboards/ebs passed
modules/integrations/splunk_o11y_conf_shared/dashboards/forge_impact passed
modules/integrations/splunk_o11y_conf_shared/dashboards/k8s_control_plane passed
modules/integrations/splunk_o11y_conf_shared/dashboards/kinesis_control_plane passed
modules/integrations/splunk_o11y_conf_shared/dashboards/lambda passed
modules/integrations/splunk_o11y_conf_shared/dashboards/lambda_control_plane passed
modules/integrations/splunk_o11y_conf_shared/dashboards/opencost passed
modules/integrations/splunk_o11y_conf_shared/dashboards/runner_ec2 passed
modules/integrations/splunk_o11y_conf_shared/dashboards/runner_k8s passed
modules/integrations/splunk_o11y_conf_shared/dashboards/runner_usage passed
modules/integrations/splunk_o11y_conf_shared/dashboards/s3 passed
modules/integrations/splunk_o11y_conf_shared/dashboards/s3_control_plane passed
modules/integrations/splunk_o11y_conf_shared/dashboards/sqs passed
modules/integrations/splunk_o11y_conf_shared/dashboards/sqs_control_plane passed
modules/integrations/splunk_o11y_conf_shared/detectors/aws_regional_health passed
modules/integrations/splunk_o11y_conf_shared/detectors/dependency_probes passed
modules/integrations/splunk_o11y_conf_shared/detectors/k8s passed
modules/integrations/splunk_opencost_eks passed
modules/integrations/splunk_otel_eks passed
modules/integrations/splunk_secrets passed
modules/integrations/splunk_stuck_workflow_job_dispatcher passed
modules/integrations/teleport passed
modules/integrations/teleport/tenant passed
modules/platform/arc passed
modules/platform/arc/scale_set passed
modules/platform/arc/scale_set_controller passed
modules/platform/arc_deployment passed
modules/platform/ec2_deployment passed
modules/platform/ec2_deployment/ec2_update_runner_ssm_ami passed
modules/platform/ec2_deployment/ec2_update_runner_tags passed
modules/platform/forge_runners passed
modules/platform/forge_runners/forge_trust_validator passed
modules/platform/forge_runners/github_actions_job_logs passed
modules/platform/forge_runners/github_app_runner_group passed
modules/platform/forge_runners/github_global_lock passed
modules/platform/forge_runners/github_webhook_relay passed
modules/platform/forge_runners/github_webhook_relay/source passed
modules/platform/forge_runners/redrive_deadletter passed

@github-actions

github-actions Bot commented Jul 25, 2026

Copy link
Copy Markdown
Contributor

OpenTofu module tests (minimum-supported)

Result: passed

OpenTofu version: 1.11.0

Metric Count
Passed modules 69
Failed modules 0
Total modules 69
Module Result
modules/helpers/ami_policy passed
modules/helpers/ami_sharing passed
modules/helpers/aws_config_recording passed
modules/helpers/cloud_custodian passed
modules/helpers/cloud_formation passed
modules/helpers/dedicated_mac_hosts passed
modules/helpers/ecr passed
modules/helpers/forge_subscription passed
modules/helpers/opt_in_regions passed
modules/helpers/service_linked_roles passed
modules/helpers/storage passed
modules/infra/eks passed
modules/integrations/github_webhook_relay_destination passed
modules/integrations/github_webhook_relay_destination_receivers passed
modules/integrations/github_webhook_relay_destination_receivers/webex_webhook_relay passed
modules/integrations/splunk_aws_billing passed
modules/integrations/splunk_cloud_conf_shared passed
modules/integrations/splunk_cloud_data_manager passed
modules/integrations/splunk_cloud_data_manager/data_input passed
modules/integrations/splunk_cloud_data_manager/sec_meta_ec2_tags passed
modules/integrations/splunk_cloud_data_manager_common passed
modules/integrations/splunk_cloud_s3_runner_logs passed
modules/integrations/splunk_dependency_monitor passed
modules/integrations/splunk_o11y_aws_integration passed
modules/integrations/splunk_o11y_aws_integration_common passed
modules/integrations/splunk_o11y_conf_shared passed
modules/integrations/splunk_o11y_conf_shared/dashboards/aws_regional_health passed
modules/integrations/splunk_o11y_conf_shared/dashboards/aws_service_limits passed
modules/integrations/splunk_o11y_conf_shared/dashboards/billing passed
modules/integrations/splunk_o11y_conf_shared/dashboards/dependency_probes passed
modules/integrations/splunk_o11y_conf_shared/dashboards/dynamodb passed
modules/integrations/splunk_o11y_conf_shared/dashboards/ebs passed
modules/integrations/splunk_o11y_conf_shared/dashboards/forge_impact passed
modules/integrations/splunk_o11y_conf_shared/dashboards/k8s_control_plane passed
modules/integrations/splunk_o11y_conf_shared/dashboards/kinesis_control_plane passed
modules/integrations/splunk_o11y_conf_shared/dashboards/lambda passed
modules/integrations/splunk_o11y_conf_shared/dashboards/lambda_control_plane passed
modules/integrations/splunk_o11y_conf_shared/dashboards/opencost passed
modules/integrations/splunk_o11y_conf_shared/dashboards/runner_ec2 passed
modules/integrations/splunk_o11y_conf_shared/dashboards/runner_k8s passed
modules/integrations/splunk_o11y_conf_shared/dashboards/runner_usage passed
modules/integrations/splunk_o11y_conf_shared/dashboards/s3 passed
modules/integrations/splunk_o11y_conf_shared/dashboards/s3_control_plane passed
modules/integrations/splunk_o11y_conf_shared/dashboards/sqs passed
modules/integrations/splunk_o11y_conf_shared/dashboards/sqs_control_plane passed
modules/integrations/splunk_o11y_conf_shared/detectors/aws_regional_health passed
modules/integrations/splunk_o11y_conf_shared/detectors/dependency_probes passed
modules/integrations/splunk_o11y_conf_shared/detectors/k8s passed
modules/integrations/splunk_opencost_eks passed
modules/integrations/splunk_otel_eks passed
modules/integrations/splunk_secrets passed
modules/integrations/splunk_stuck_workflow_job_dispatcher passed
modules/integrations/teleport passed
modules/integrations/teleport/tenant passed
modules/platform/arc passed
modules/platform/arc/scale_set passed
modules/platform/arc/scale_set_controller passed
modules/platform/arc_deployment passed
modules/platform/ec2_deployment passed
modules/platform/ec2_deployment/ec2_update_runner_ssm_ami passed
modules/platform/ec2_deployment/ec2_update_runner_tags passed
modules/platform/forge_runners passed
modules/platform/forge_runners/forge_trust_validator passed
modules/platform/forge_runners/github_actions_job_logs passed
modules/platform/forge_runners/github_app_runner_group passed
modules/platform/forge_runners/github_global_lock passed
modules/platform/forge_runners/github_webhook_relay passed
modules/platform/forge_runners/github_webhook_relay/source passed
modules/platform/forge_runners/redrive_deadletter passed

@edersonbrilhante edersonbrilhante mentioned this pull request Jul 25, 2026
Merged
5 tasks
@edersonbrilhante
edersonbrilhante merged commit 5c3a009 into main Jul 25, 2026
15 checks passed
@edersonbrilhante
edersonbrilhante deleted the reduce-trust-validation-frequency branch July 25, 2026 13:40
@github-actions github-actions Bot mentioned this pull request Jul 25, 2026
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Nikolaichukr Nikolaichukr Nikolaichukr approved these changes

Assignees

@Rostislavz Rostislavz

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@edersonbrilhante @Nikolaichukr @Rostislavz
Morty Proxy This is a proxified and sanitized view of the page, visit original site.