feat: preflight-check batch:TagResource when tags are configured#53
feat: preflight-check batch:TagResource when tags are configured#53nh13 wants to merge 2 commits into
Conversation
|
Warning Review limit reached
Next review available in: 50 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (5)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
74290a0 to
ab4de23
Compare
…role Run a best-effort validation in __post_init__, before any job is submitted, so a definitively misconfigured setup fails fast with a clear error instead of leaving jobs stuck forever: - _queue_problems(): inspect the configured job queue and its compute environment(s); report a disabled/invalid queue or compute environment, a fatal queue status (INVALID/DELETING/DELETED), or maxvCpus=0. - _preflight_validate(): raise WorkflowError on any confirmed problem, then check the job role. - _validate_job_role(): iam:GetRole existence check; NoSuchEntity fails fast, anything else (most importantly a missing iam:GetRole permission) degrades. The check is conservative about uncertainty: a transient API error, a queue mid-update, or a missing describe/iam permission degrades to a debug message and the workflow proceeds. Only a confirmed-bad configuration blocks. Documented in docs/further.md; the workflow-level mocked test short-circuits preflight the same way it short-circuits platform detection.
When tags are set (via --aws-batch-tags or SNAKEMAKE_AWS_BATCH_JOB_TAGS), every job is tagged at submit time, so a missing batch:TagResource surfaces as an opaque AccessDenied an hour into the run. Extend _preflight_validate with a non-destructive tag/untag round-trip on the job queue ARN so the permission gap fails fast at startup instead. Only a permissions error raises; any other error (or no tags / no queue ARN) degrades to a no-op. Adds tag_resource/untag_resource wrappers to BatchClient and documents the batch:TagResource/UntagResource needs.
ab4de23 to
bfb28d8
Compare
1 participant
🔗 Stacked on #49 (preflight validation). This branch includes #49's commit, so the diff shows the preflight subsystem plus this change until #49 merges — then it slims to just this feature. Merge after #49.
When tags are configured (via
--aws-batch-tagsor theSNAKEMAKE_AWS_BATCH_JOB_TAGSenvironment variable), every job is tagged at submit time — so a missingbatch:TagResourcepermission surfaces as an opaqueAccessDeniedan hour into the run. Extend_preflight_validatewith a non-destructive tag/untag round-trip on the job-queue ARN so the gap fails fast at startup instead.Only a permissions error raises a
WorkflowError; any other error (or no tags configured / no queue ARN) degrades to a no-op. Addstag_resource/untag_resourcewrappers toBatchClient, 6 tests, and documents thebatch:TagResource/batch:UntagResourceneeds.Coordination: once this and #48 (minimal IAM policy docs) both land, #48's IAM section should add
batch:UntagResourceto the tags add-on.