The fix worth reading
A specific failure no longer hides the stack's other failures. Nine status reasons - a taken or invalid bucket name, the code storage quota, a stabilization timeout, an in-use export, reserved concurrency, a nested stack, an API with no methods, a prohibited trust-policy field - suppressed the generic resource-failure rule for the whole log. So a stack that failed one of those and an unrelated resource reported only the first, and the other failure vanished from the report. Stacks rarely fail exactly one resource, so this was dropping exactly the evidence people run the tool to get.
Those nine now exclude their own line instead. Three reasons still suppress the whole rule, because CloudFormation prints them on a separate line from the CREATE_FAILED event they explain, where excluding the reason line would report one failure twice - that trade-off is documented next to the code.
A new interaction guard pairs all 48 rule fixtures against each other and fails if any rule starts hiding another unexpectedly. The original bug passed every individual rule's tests; this is what would have caught it.
New rules
- A nested (embedded) stack failed - the root cause is in the child stack's events, including the warning that rollback can delete those events before anyone reads them. Closes #23, contributed in #57.
- Reserved concurrency below the account minimum - an account-level ceiling rather than a template or permissions problem, common on fresh or burst-limited accounts. Closes #22, contributed in #58.
The catalog is now 48 rules.
Also in this release
- An empty log says it is empty instead of reporting "no supported pattern found", across the CLI, the Action's job summary, batch mode, and the evidence packet. A deploy step that dies before writing output is routine, and the old wording sent people looking for a missing rule instead of the step that never ran.
- Redaction covers the CamelCase
"SecretAccessKey"/"SessionToken"keys thataws stsoutput prints, presigned-URL signatures, Slack tokens, and PEM private-key blocks. - The catalog gate rejects patterns that backtrack catastrophically, so a future rule cannot hang the CI job of whoever runs it.
- Large logs report the expected wait instead of running silently for a minute.
- A scheduled check watches every rule's documentation link for rot.
Full details in CHANGELOG.md. Thanks to @waterlemonnn for both rules in this release.
