Migrate guardfiles to value-source grammar on next cli-guard bump #115

New issue

Closed

opened 2026-06-17 20:56:25 +00:00 by coilysiren · 0 comments

coilysiren commented

2026-06-17 20:56:25 +00:00

Owner

cli-guard #150 replaced the hardcoded SSM grammar with a pluggable value <provider> "<addr>" registry (landed in cli-guard main, commit 1f1ba4b). On the next bump, ward's guardfiles fail to parse until migrated.

Required edits (cmd/ward-kdl/*.guardfile.kdl)

ssm "/path" -> value ssm "/path" in every header-token / bearer / query-param param block. Affects forgejo, tailscale, trello, open-webui guardfiles.
open-webui base-url: base-url { ssm "..." } -> base-url { value ssm "..." }.
Regenerate the consumer main.go (specverb-gen gen/run): the new template builds a providerRegistry() wiring ssm + tailscale and gates the AWS SDK import on actual ssm use. No hand-written Token:/BaseURLFn wiring remains.

Optional cleanup

The tailscale provider now resolves a device to its IPv4 live (tailscale ip -4 <name>). open-webui's base-url could drop its SSM URL entry for base-url { value tailscale "open-webui" }.

cli-guard ships env/file/literal built-ins too, if any secret is better read from the environment than SSM.

cli-guard [#150](https://forgejo.coilysiren.me/coilyco-flight-deck/cli-guard/issues/150) replaced the hardcoded SSM grammar with a pluggable `value <provider> "<addr>"` registry (landed in cli-guard main, commit 1f1ba4b). On the next bump, ward's guardfiles fail to parse until migrated. ## Required edits (cmd/ward-kdl/*.guardfile.kdl) - `ssm "/path"` -> `value ssm "/path"` in every `header-token` / `bearer` / `query-param param` block. Affects forgejo, tailscale, trello, open-webui guardfiles. - open-webui base-url: `base-url { ssm "..." }` -> `base-url { value ssm "..." }`. - Regenerate the consumer main.go (`specverb-gen gen`/`run`): the new template builds a `providerRegistry()` wiring ssm + tailscale and gates the AWS SDK import on actual ssm use. No hand-written `Token:`/`BaseURLFn` wiring remains. ## Optional cleanup - The `tailscale` provider now resolves a device to its IPv4 live (`tailscale ip -4 <name>`). open-webui's base-url could drop its SSM URL entry for `base-url { value tailscale "open-webui" }`. cli-guard ships `env`/`file`/`literal` built-ins too, if any secret is better read from the environment than SSM.

coilysiren referenced this issue from a commit

2026-06-17 21:09:40 +00:00

chore(ward-kdl): migrate guardfiles to cli-guard value-source grammar

coilysiren closed this issue

2026-06-17 21:09:40 +00:00

coilysiren referenced this issue

2026-06-17 21:24:13 +00:00

brew upgrade ward fails: 'ArgumentError: no time information in ""' (blocks all releases) #116