From 4ad6062b555e62b0aeeb373d78f256e15162e416 Mon Sep 17 00:00:00 2001
From: Mark Ridgwell <credfeto@users.noreply.github.com>
Date: Thu, 3 Sep 2026 19:54:31 +0100
Subject: [PATCH 1/2] fix: avoid cfn-lint W1030 on TaskRoleArn when TaskRole is
 unset

TaskRoleArn resolved a bare Ref to the TaskRole parameter, whose
default is an empty string. cfn-lint flags this because the resolved
value does not match the IAM Role ARN pattern. Added a HasTaskRole
condition (same fix already applied in funfair-ethereum-proxy-server)
so the property is only set when a TaskRole is actually supplied,
otherwise it resolves to AWS::NoValue.

Prompt: Run Cloud Formation Linter
1s
Run "$CFN_LINT_VENV/bin/cfn-lint" --info --include-checks I --template "$TEMPLATE"
  2026-09-03 20:37:21,269 - cfnlint.runner.template.runner - INFO - Run scan of template /build/runners/agents/build05/_work/BuildBot/BuildBot/cloudformation.json
  W1030 {'Ref': 'TaskRole'} is not a 'AWS::IAM::Role.Arn' with pattern '^arn:aws[a-zA-Z-]*:iam::\d{12}:role/.+$' when 'Ref' is resolved
  /build/runners/agents/build05/_work/BuildBot/BuildBot/cloudformation.json:282:11 we've fixed this in other repos can you apply the same fix eg. funfair-etherum-proxy-server

Claude-Session: https://claude.ai/code/session_014jXxyHtaWdgBDwrwjMRmns
---
 cloudformation.json | 24 +++++++++++++++++++++++-
 1 file changed, 23 insertions(+), 1 deletion(-)

diff --git a/cloudformation.json b/cloudformation.json
index 5952389e..dbfa780c 100644
--- a/cloudformation.json
+++ b/cloudformation.json
@@ -74,6 +74,20 @@
       "Default": "arn:aws:secretsmanager:eu-west-1:117769150821:secret:BuildBot-ph1YIJ"
     }
   },
+  "Conditions": {
+    "HasTaskRole": {
+      "Fn::Not": [
+        {
+          "Fn::Equals": [
+            {
+              "Ref": "TaskRole"
+            },
+            ""
+          ]
+        }
+      ]
+    }
+  },
   "Metadata": {
     "Application": {
       "Ref": "ApplicationName"
@@ -279,7 +293,15 @@
           "Ref": "TaskExecutionRole"
         },
         "TaskRoleArn": {
-          "Ref": "TaskRole"
+          "Fn::If": [
+            "HasTaskRole",
+            {
+              "Ref": "TaskRole"
+            },
+            {
+              "Ref": "AWS::NoValue"
+            }
+          ]
         },
         "RequiresCompatibilities": ["FARGATE"],
         "NetworkMode": "awsvpc",

From 6061b42b145bf6f55d41addc73aecebbff3e8039 Mon Sep 17 00:00:00 2001
From: Mark Ridgwell <credfeto@users.noreply.github.com>
Date: Thu, 3 Sep 2026 19:54:43 +0100
Subject: [PATCH 2/2] docs: add changelog entry for cfn-lint W1030 fix

Claude-Session: https://claude.ai/code/session_014jXxyHtaWdgBDwrwjMRmns
---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 88b5ccda..d166fb31 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -26,6 +26,7 @@ Please ADD ALL Changes to the UNRELEASED SECTION and not a specific release
 - Guard against IndexOutOfRangeException when Branches list is empty in GithubStatusNotificationHandler
 - Fixed CS0433 ambiguous xunit type conflict in test projects caused by FunFair.Test.Common now depending on the AOT-flavoured xunit v3 packages, by switching test projects to the matching xunit.v3.aot.mtp-v2 runner package
 - Added missing IncludeAssets on NuGet package references required by FunFair.BuildCheck
+- Resolved cfn-lint W1030 warning on the TaskRoleArn CloudFormation property by only setting it when a TaskRole is provided
 ### Changed
 - Dependencies - Updated NSubstitute.Analyzers.CSharp to 1.0.17
 - Switched to use minimal APIs