WEB-11460: Add SSM secret seeding and placeholder-guard make helpers

[lewissmithweb]

Summary

Adds shared make helpers to support the RFC #356.1 model: seed AWS SSM Parameter Store secrets out-of-band and guard a deploy against unset placeholders. Living in the shared helpers means every repo inherits it. Parameters follow the RFC convention /ecs/<env>/<service>/<KEY>, with the service segment defaulting to the repo name so no per-repo config is needed.

Changes

• AC1 — make ssm_sync: ssm_sync / ssm_sync_<env> reads a committed key-name list and, per key, creates a placeholder SecureString only when the parameter is missing (checked via get-parameter); the seed put-parameter deliberately omits --overwrite, so an existing value is never touched.
• AC2 — make ssm_put: ssm_put / ssm_put_<env> runs put-parameter --type SecureString --overwrite for a single KEY/VALUE — create-or-update.
• AC3 — sentinel: placeholders use the recognisable PENDING sentinel (SSM_PLACEHOLDER, overridable).
• AC4 — CI guard: ssm_guard / ssm_guard_<env> fails (non-zero) when any referenced key is missing or still holds the sentinel, so a placeholder cannot reach a deployed task. It reads values --with-decryption and never prints them.
• AC5 — docs: new docs/ssm.md documents every target and config knob; the README "further reading" list gains an ssm entry.
• Added a Docker/AWS-free test harness test/ssm.sh (mirrors test/php_tests_worktree.sh) wired into .github/workflows/test.yaml.

Out of scope: no ssm.keys file is committed here — the key-name list belongs to each consuming repo.

How to test

• ./test/ssm.sh — all assertions pass (also runs in CI).
• Render a recipe: make -f ssm.mk -n ssm_sync_production → confirm the /ecs/production/<service> path and PENDING sentinel.
• With AWS creds: make ssm_sync_<env> seeds missing keys only; make ssm_guard_<env> exits non-zero while any key is still PENDING; KEY=... VALUE=... make ssm_put_<env> sets a real value.

Deployment notes

Consuming repos opt in by adding ssm to their MAKE_FILES and committing an ssm.keys list. ssm_guard in CI needs ssm:GetParameter + KMS decrypt; ssm_sync/ssm_put need ssm:PutParameter.

Closes WEB-11460

[coderabbitai]

Warning

Review limit reached

You’ve reached a temporary PR review limit under our Fair Usage Limits Policy.

Your recent review volume is higher than typical usage, so adaptive limits are currently applied.

Next review available in: 29 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: d455fe96-d2e0-4ba0-b099-5938091c2400

📥 Commits

Reviewing files that changed from the base of the PR and between f973412 and 1c4d0c9.

📒 Files selected for processing (2)

• docs/ssm.md
• test/ssm.sh

📝 Walkthrough

• Added safer management of AWS SSM secrets.
• Missing secrets receive a PENDING placeholder without changing existing values.
• Added commands to create, update, synchronise, and check secrets.
• Added checks that block use of missing or unfinished secrets without exposing secret values.
• Added documentation and README guidance.
• Added automated tests that do not contact AWS and run in CI.
• Consuming repositories must provide ssm.keys and enable ssm in MAKE_FILES.

Walkthrough

Changes

The change adds AWS SSM SecureString Make helpers, usage documentation, offline validation, and a CI workflow step.

SSM Parameter Store integration

Layer / File(s)	Summary
SSM helpers and usage documentation ssm.mk, docs/ssm.md, README.md	ssm.mk adds configuration, ssm_put, ssm_sync, and ssm_guard. The documentation describes parameter paths, placeholders, targets, and guard behaviour.
Offline validation and CI execution test/ssm.sh, .github/workflows/test.yaml	test/ssm.sh validates rendered recipes without AWS access. CI runs the new test script.

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 3

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@docs/ssm.md`:
- Line 21: Update the setup section in docs/ssm.md to include a Makefile example
that opts into ssm.mk through MAKE_FILES before the configuration sections. Show
consumers where to add ssm to MAKE_FILES so the documented targets become
available.
- Around line 59-64: Update the fenced code block containing the ssm.keys
example to specify the text language on its opening fence, while leaving the
listed keys unchanged.

In `@test/ssm.sh`:
- Around line 90-93: Extend the `ssm_guard` test in `test/ssm.sh` to execute the
exported guard program with a fake `aws` command returning a known placeholder,
capture both stdout and stderr, and assert neither contains the placeholder
value. Preserve the existing decryption and comparison assertions while adding
explicit output-leak checks.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: d0ffdc2e-936f-461a-b9ea-b3b96032a7ba

📥 Commits

Reviewing files that changed from the base of the PR and between 1ab6920 and f973412.

📒 Files selected for processing (5)

• .github/workflows/test.yaml
• README.md
• docs/ssm.md
• ssm.mk
• test/ssm.sh