What
#1034 landed gauntlet_pin_aws_provider in live/e2e/lib/gauntlet.sh, reading the pin from live/oracle-versions.json, and wired it into the five estates the mirror lag had broken: corpus-ec2-instance-complete, corpus-iam-policy, corpus-iam-read-only-policy, corpus-sqs-basic and corpus-rds-complete-postgres. The other 22 crossing scripts, corpus-alb-complete among them, source the same library for gauntlet_stage and never call the pin helper, so their corpus module's bare hashicorp/aws requirement still resolves to whatever registry.terraform.io serves on the morning stock's cold_deploy runs, while choudoufu's stages resolve against registry.opentofu.org.
Found while rebasing the #673 repin: corpus-alb-complete re-ran on the pinned tree and the pin did not reach it. The next mirror lag will fail those 22 the way this one failed five.
TestGauntletCrossingScriptsPinOneAWSProvider in live/pins_drift_test.go was shown red for a script that drops its pin call, so it is load-bearing for the scripts it covers; it does not cover a script that never called the helper at all.
Do
Call gauntlet_pin_aws_provider in every crossing script that inits a corpus module, or move the call into the shared library's setup so a script cannot omit it. Extend the guard to fail for any live/e2e/*/run.sh that copies a corpus module and does not pin, shown red on corpus-alb-complete before the change.
Proof
The guard red on today's tree for the 22, green after, and one of them re-run with the runner's log showing 6.63.0 resolved on both sides.
Refs #1034, #673, #1023.
What
#1034 landed
gauntlet_pin_aws_providerinlive/e2e/lib/gauntlet.sh, reading the pin fromlive/oracle-versions.json, and wired it into the five estates the mirror lag had broken: corpus-ec2-instance-complete, corpus-iam-policy, corpus-iam-read-only-policy, corpus-sqs-basic and corpus-rds-complete-postgres. The other 22 crossing scripts, corpus-alb-complete among them, source the same library forgauntlet_stageand never call the pin helper, so their corpus module's barehashicorp/awsrequirement still resolves to whateverregistry.terraform.ioserves on the morning stock's cold_deploy runs, while choudoufu's stages resolve againstregistry.opentofu.org.Found while rebasing the #673 repin: corpus-alb-complete re-ran on the pinned tree and the pin did not reach it. The next mirror lag will fail those 22 the way this one failed five.
TestGauntletCrossingScriptsPinOneAWSProviderinlive/pins_drift_test.gowas shown red for a script that drops its pin call, so it is load-bearing for the scripts it covers; it does not cover a script that never called the helper at all.Do
Call
gauntlet_pin_aws_providerin every crossing script that inits a corpus module, or move the call into the shared library's setup so a script cannot omit it. Extend the guard to fail for anylive/e2e/*/run.shthat copies a corpus module and does not pin, shown red on corpus-alb-complete before the change.Proof
The guard red on today's tree for the 22, green after, and one of them re-run with the runner's log showing 6.63.0 resolved on both sides.
Refs #1034, #673, #1023.