parity: terraform provider coverage for ~470 resource types (34 emulator fixes), profile-driven perf, leak fixes, over-wide Lists, 65 unimplemented ops

.github/workflows/ci.yml

@@ -139,6 +139,10 @@ jobs:
 
   govulncheck:
     runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:

.golangci.yml

@@ -575,6 +575,10 @@ linters:
       # Same reasoning as opsworks/sdk_roundtrip_test.go above.
       - path: 'opsworks/list_filter_params_test.go'
         linters: [ staticcheck ]
+      # Same reasoning: the terraform fixture asserts OpsWorks state through the
+      # deprecated typed client.
+      - path: 'test/terraform/mega_batch9_test.go'
+        linters: [ staticcheck ]
       # Same reasoning as opsworks/sdk_roundtrip_test.go above -- typed
       # coverage (gopherstack-n3zi).
       - path: 'opsworks/sdk_roundtrip_resource_coverage_test.go'
@@ -583,6 +587,11 @@ linters:
       # tier-1 campaign (gopherstack-xhu2t).
       - path: 'opsworks/sdk_roundtrip_stack_field_fixes_test.go'
         linters: [ staticcheck ]
+      # Same reasoning as opsworks/sdk_roundtrip_test.go above -- the
+      # Docker-backed test/integration/ suite (services/opsworks/PARITY.md's
+      # A-bar requirement) drives the same deprecated SDK client end to end.
+      - path: 'test/integration/opsworks_test.go'
+        linters: [ staticcheck ]
       # mediapackage's RotateChannelCredentials is deprecated (superseded by
       # RotateIngestEndpointCredentials), but is still a real, listed op this
       # file must drive through a real client for typed coverage
@@ -632,6 +641,12 @@ linters:
       # expected and unavoidable.
       - path: 'guardduty/realclient_detector_findings_and_member_management_test.go'
         linters: [ staticcheck ]
+      # CustomerMasterKeySpec is KeySpec's deprecated predecessor, but
+      # aws_kms_key's customer_master_key_spec argument still sends it on the
+      # wire (gopherstack-101r) -- this file must set it through the real
+      # client to cover CreateKey's fallback for real terraform traffic.
+      - path: 'kms/customer_master_key_spec_test.go'
+        linters: [ staticcheck ]
       - path: 'pkgs/service/cloudtrail_capture_test.go'
         linters: [ testpackage ]
       - path: 'pkgs/service/registry_test.go'

cli.go

@@ -342,7 +342,6 @@ type CLI struct {
 	applicationautoscalingHandler service.Registerable
 	batchHandler                  service.Registerable
 	bedrockHandler                service.Registerable
-	bedrockAgentsHandler          service.Registerable
 	bedrockruntimeHandler         service.Registerable
 	ceHandler                     service.Registerable
 	cloudcontrolHandler           service.Registerable
@@ -1648,11 +1647,6 @@ func (c *CLI) GetBatchHandler() service.Registerable { return c.batchHandler }
 //nolint:ireturn // architecturally required to return interface
 func (c *CLI) GetBedrockHandler() service.Registerable { return c.bedrockHandler }
 
-// GetBedrockAgentsHandler returns the Bedrock Agents handler.
-//
-//nolint:ireturn // architecturally required to return interface
-func (c *CLI) GetBedrockAgentsHandler() service.Registerable { return c.bedrockAgentsHandler }
-
 // GetBedrockRuntimeHandler returns the Bedrock Runtime handler.
 //
 //nolint:ireturn // architecturally required to return interface
@@ -2752,7 +2746,6 @@ func storeCLIExtendedHandlers(cli *CLI, byName map[string]service.Registerable)
 	cli.applicationautoscalingHandler = byName["ApplicationAutoscaling"]
 	cli.batchHandler = byName["Batch"]
 	cli.bedrockHandler = byName["Bedrock"]
-	cli.bedrockAgentsHandler = byName["BedrockAgents"]
 	cli.bedrockruntimeHandler = byName["BedrockRuntime"]
 	cli.ecrHandler = byName["ECR"]
 	cli.ecsHandler = byName["ECS"]
@@ -3757,13 +3750,15 @@ func wireStorageAndSecretsIntegrations(byName map[string]service.Registerable) {
 	// resource (gopherstack-0o0q).
 	wireBackupS3(byName["Backup"], byName["S3"])
 
-	// Wire CodePipeline → CodeBuild/Lambda so a Build/CodeBuild action's
-	// ProjectName and an Invoke/Lambda action's FunctionName actually reach
-	// their backend, instead of every non-Approval action being marked
-	// Succeeded unconditionally with no cross-service call at all
-	// (gopherstack-cb9l).
+	// Wire CodePipeline → CodeBuild/Lambda/CodeDeploy so a Build/CodeBuild
+	// action's ProjectName, an Invoke/Lambda action's FunctionName, and a
+	// Deploy/CodeDeploy action's ApplicationName/DeploymentGroupName
+	// actually reach their backend, instead of every non-Approval action
+	// being marked Succeeded unconditionally with no cross-service call at
+	// all (gopherstack-cb9l).
 	wireCodePipelineCodeBuild(byName["CodePipeline"], byName["CodeBuild"])
 	wireCodePipelineLambda(byName["CodePipeline"], byName["Lambda"])
+	wireCodePipelineCodeDeploy(byName["CodePipeline"], byName["CodeDeploy"])
 }
 
 // wireAppConfigDeployments wires the AppConfigData backend as AppConfig's
@@ -3996,7 +3991,6 @@ func getRemainingServiceProviders() []service.Provider {
 		&applicationautoscalingbackend.Provider{},
 		&batchbackend.Provider{},
 		&bedrockbackend.Provider{},
-		&bedrockbackend.AgentsProvider{},
 		&bedrockruntimebackend.Provider{},
 		&cebackend.Provider{},
 		&cloudcontrolbackend.Provider{},
@@ -6568,6 +6562,42 @@ func wireCodePipelineLambda(codepipelineReg, lambdaReg service.Registerable) {
 	cpH.Backend.SetLambdaBackend(lambdaBk)
 }
 
+// wireCodePipelineCodeDeploy connects the CodePipeline backend to CodeDeploy
+// so a Deploy/CodeDeploy action's ApplicationName/DeploymentGroupName
+// actually starts a deployment and fails the action when either doesn't
+// exist, instead of every non-Approval action being marked Succeeded
+// unconditionally with no cross-service call at all (gopherstack-cb9l).
+// codedeploy.InMemoryBackend's CreateDeployment takes a codedeploy-specific
+// DeploymentOptions and returns a *Deployment, so
+// codepipelineCodeDeployAdapter supplies the zero value CodePipeline's
+// Deploy action has no per-run overrides for and discards the deployment
+// record.
+func wireCodePipelineCodeDeploy(codepipelineReg, codeDeployReg service.Registerable) {
+	cpH, ok := codepipelineReg.(*codepipelinebackend.Handler)
+	if !ok {
+		return
+	}
+
+	cdH, cdOk := codeDeployReg.(*codedeploybackend.Handler)
+	if !cdOk {
+		return
+	}
+
+	cpH.Backend.SetCodeDeployBackend(&codepipelineCodeDeployAdapter{backend: cdH.Backend})
+}
+
+// codepipelineCodeDeployAdapter adapts the CodeDeploy backend to the
+// codepipeline.CodeDeployStarter interface.
+type codepipelineCodeDeployAdapter struct {
+	backend *codedeploybackend.InMemoryBackend
+}
+
+func (a *codepipelineCodeDeployAdapter) CreateDeployment(applicationName, deploymentGroupName string) error {
+	_, err := a.backend.CreateDeployment(applicationName, deploymentGroupName, codedeploybackend.DeploymentOptions{})
+
+	return err
+}
+
 // wireTextractS3 connects the Textract backend to S3 so a Document/
 // DocumentLocation naming an S3Object that doesn't exist surfaces
 // InvalidS3ObjectException, instead of every request being processed

cli_asg_ec2_wiring_test.go

@@ -65,7 +65,7 @@ func TestWireAutoScalingEC2_ScaleOutCreatesRealEC2Instance(t *testing.T) {
 	}
 
 	// --- Scale-in: reducing DesiredCapacity must terminate the removed instance in EC2 too. ---
-	require.NoError(t, asgBk.SetDesiredCapacity("wiring-test-asg", 1))
+	require.NoError(t, asgBk.SetDesiredCapacity("wiring-test-asg", 1, false))
 
 	groups, err := asgBk.DescribeAutoScalingGroups([]string{"wiring-test-asg"}, nil)
 	require.NoError(t, err)

cli_test.go

@@ -1027,7 +1027,15 @@ func TestWireResourceGroupsTagging_CrossServiceResources(t *testing.T) {
 				t.Helper()
 
 				redshiftBk := redshiftbackend.NewInMemoryBackend(accountID, region)
-				_, err := redshiftBk.CreateCluster("wiring-test-cluster", "dc2.large", "dev", "admin", nil, "")
+				_, err := redshiftBk.CreateCluster(
+					"wiring-test-cluster",
+					"dc2.large",
+					"dev",
+					"admin",
+					nil,
+					"",
+					redshiftbackend.CreateClusterOptions{},
+				)
 				require.NoError(t, err)
 				require.NoError(t, redshiftBk.CreateTags(
 					"wiring-test-cluster", map[string]string{wantTagKey: wantTagValue},
@@ -2487,7 +2495,15 @@ func TestWireResourceGroupsTagging_TagResourcesRoundTrip(t *testing.T) {
 				t.Helper()
 
 				redshiftBk := redshiftbackend.NewInMemoryBackend(accountID, region)
-				_, err := redshiftBk.CreateCluster("roundtrip-cluster", "dc2.large", "dev", "admin", nil, "")
+				_, err := redshiftBk.CreateCluster(
+					"roundtrip-cluster",
+					"dc2.large",
+					"dev",
+					"admin",
+					nil,
+					"",
+					redshiftbackend.CreateClusterOptions{},
+				)
 				require.NoError(t, err)
 
 				wireTaggingRedshift(bk, redshiftbackend.NewHandler(redshiftBk))

cmd/enumcheck/literal_test.go

@@ -84,16 +84,16 @@ func build() map[string]any {
 			// real shape: services/apigateway/export.go's OpenAPI "type"
 			// key, which collides in name only with API Gateway's own
 			// DocumentationPartType/AuthorizerType/IntegrationType. Neither
-			// candidate has DISSOCIATED, so this is needs-review, not clean.
-			name: "ambiguous key with non-universal value is needs review",
+			// candidate has DISSOCIATED, so this is unresolved, not clean.
+			name: "ambiguous key with non-universal value is unresolved",
 			src: `package svc
 func build() map[string]any {
 	return map[string]any{"DomainPackageStatus": "DISSOCIATED"}
 }`,
 			wireKeys: map[string]wireKeyFact{
 				"DomainPackageStatus": {Enums: []string{"DomainPackageStatus", "OtherStatus"}},
 			},
-			wantKind:  kindAmbiguousKey,
+			wantKind:  kindUnresolved,
 			wantValue: "DISSOCIATED",
 		},
 		{
@@ -111,15 +111,15 @@ func build() map[string]any {
 		{
 			// real shape: comprehend's "ErrorCode", a plain *string on one
 			// struct and types.PageBasedErrorCode on an unrelated one.
-			name: "polymorphic key with non-member value is needs review",
+			name: "polymorphic key with non-member value is unresolved",
 			src: `package svc
 func build() map[string]any {
 	return map[string]any{"DomainPackageStatus": "DISSOCIATED"}
 }`,
 			wireKeys: map[string]wireKeyFact{
 				"DomainPackageStatus": {Enums: []string{"DomainPackageStatus"}, Polymorphic: true},
 			},
-			wantKind:  kindAmbiguousKey,
+			wantKind:  kindUnresolved,
 			wantValue: "DISSOCIATED",
 		},
 		{
@@ -139,8 +139,10 @@ func build() map[string]any {
 			// of two of the key's candidates (Status, DelegatedAdminStatus)
 			// but not of the EcrRescanDurationStatus actually in play, so
 			// the all-or-nothing filter dropped this bug silently -- this is
-			// exactly the shape the ambiguous-key tier exists to catch.
-			name: "inspector2 rescanDurationState status reuse is needs review",
+			// exactly the shape the unresolved tier exists to surface (never
+			// as a confident finding: which candidate applies here is
+			// unknown without a struct-field identity to resolve through).
+			name: "inspector2 rescanDurationState status reuse is unresolved, not a confident finding",
 			src: `package svc
 const keyStatus = "status"
 const statusEnabled = "ENABLED"
@@ -150,7 +152,7 @@ func build() map[string]any {
 			wireKeys: map[string]wireKeyFact{
 				"status": {Enums: []string{"Status", "DelegatedAdminStatus", "EcrRescanDurationStatus"}},
 			},
-			wantKind:  kindAmbiguousKey,
+			wantKind:  kindUnresolved,
 			wantValue: "ENABLED",
 		},
 		{