Patch on v2.1.0.
Same py-tirith (1.2.1), same verdicts, same inputs and outputs.
What was wrong
v2.1.0 put the planned changes in the comment — but only when policies come from StackGuardian. A
credential-free run showed findings with no sign of what was changing: the platform path is handed
the plan by the CLI itself, while local mode renders its own comment and passed no plan at all.
So the mode meant to be the easiest thing to try was the only one missing the feature that release was
named for.
The fix
Local mode now passes the masked document it had already written — the same file the policies are
evaluated against — guarded to the kinds that are masked, so an untouched passthrough document is
never handed to a renderer.
Verifying it, because there is a trap
render_plan_block has three outcomes:
| input | output |
|---|---|
| no plan passed | nothing — no fence, no summary |
| a plan where nothing changes | the summary line only |
| a plan with changes | fence + summary |
The summary line is what proves a plan was passed, not the fence. A run planning against
infrastructure that is already applied is a no-op, so the correct output there is
Plan: 0 to add, 0 to change, 0 to destroy. N unchanged. and no diff block. Looking for a fence in
that case and finding none looks exactly like the bug this release fixes.
Upgrading
- uses: StackGuardian/tirith-iac-governance-action@v2.1.1v2 (py-tirith 1.2.0) and v2.1.0 are untouched. Each tag pins one CLI.