[henryde]

…unner

The landing zone's STACKIT backplanes now trust the issuer, audience and token path the runner reports, instead of a hardcoded Azure audience.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[github-actions]

Scorecard Check

Scorecard run on commit 3a4232530528c3f6cbd0d4403292776699698740 relative to origin/main

📊 meshstack-hub Module Scorecard

Generated: 2026-11-06 | Modules scanned: 5 | Categories: 8

📋 Per-Module Category Summary

Score per category per module. n/a = category does not apply to this module.

Module	Overall	Core Structure	Integration	AWS Backplane	Azure Backplane	GCP Backplane	STACKIT Backplane	Shared Practices	Testing
stackit/network	🟢 94%	🟢 100%	🟢 94%	n/a	n/a	n/a	🟢 100%	🟡 75%	🟢 100%
stackit/network-area	🟢 94%	🟢 100%	🟢 94%	n/a	n/a	n/a	🟢 100%	🟡 75%	🟢 100%
stackit/project	🟢 84%	🟢 100%	🟡 72%	n/a	n/a	n/a	🟢 100%	🟡 67%	🟢 100%
stackit/service-account	🟢 94%	🟢 100%	🟢 94%	n/a	n/a	n/a	🟢 100%	🟡 75%	🟢 100%
stackit/service-account-federation	🟢 97%	🟢 100%	🟢 94%	n/a	n/a	n/a	🟢 100%	🟢 100%	🟢 100%

⚠️ 5 modules have failing checks — failing categories are expanded below.

Core Structure — ✅ all passing

Basic module file structure and documentation — applies to 5 modules

Module	Score	📦	🔗	📋	📝	🖼️	📌	🚦	🩹	🧼	❄️	🔒
stackit/network	🟢 100%	✅	✅	➖	✅	✅	✅	➖	➖	➖	➖	✅
stackit/network-area	🟢 100%	✅	✅	➖	✅	✅	✅	➖	➖	➖	➖	✅
stackit/project	🟢 100%	✅	✅	➖	✅	✅	✅	➖	➖	✅	➖	✅
stackit/service-account	🟢 100%	✅	✅	➖	✅	✅	✅	➖	➖	➖	➖	✅
stackit/service-account-federation	🟢 100%	✅	✅	➖	✅	✅	✅	➖	✅	➖	➖	✅

Core Structure — Summary

Emoji	Criterion	Coverage	Status
📦	buildingblock/ directory exists	5/5	🟢 100%
🔗	meshstack_integration.tf present	5/5	🟢 100%
📋	buildingblock/APP_TEAM_README.md present (no-integration fallback)	n/a	—
📝	buildingblock/README.md with YAML front-matter	5/5	🟢 100%
🖼️	buildingblock/logo.png or logo.svg included	5/5	🟢 100%
📌	buildingblock/versions.tf present	5/5	🟢 100%
🚦	Child meshstack_building_block asserts a SUCCEEDED run	n/a	—
🩹	Every try() carries a comment saying why	1/1	🟢 100%
🧼	Pre-run scripts install no tools on the runner	1/1	🟢 100%
❄️	A module flake sits in nix/, is pinned, and Terraform calls it	n/a	—
🔒	Provider versions float within one major (>= X.Y.Z, < N.0.0)	5/5	🟢 100%

Integration — some checks failing

meshstack_integration.tf conventions — applies to 5 modules

Module	Score	🏷️	🏢	📤	🔌	📎	🔀	🌱	📋	🏷️	🧱	🏪	📖	📝	📊	🚫	🔄	🗒️	🪪
stackit/network	🟢 94%	✅	✅	✅	✅	✅	✅	✅	✅	✅	✅	✅	✅	✅	✅	✅	➖	✅	❌
stackit/network-area	🟢 94%	✅	✅	✅	✅	✅	✅	✅	✅	✅	✅	✅	✅	✅	✅	✅	➖	✅	❌
stackit/project	🟡 72%	✅	✅	✅	✅	✅	✅	✅	✅	✅	✅	❌	❌	❌	❌	✅	✅	✅	❌
stackit/service-account	🟢 94%	✅	✅	✅	✅	✅	✅	✅	✅	✅	✅	✅	✅	✅	✅	✅	➖	✅	❌
stackit/service-account-federation	🟢 94%	✅	✅	✅	✅	✅	✅	✅	✅	✅	✅	✅	✅	✅	✅	✅	➖	✅	❌

Integration — Summary

Emoji	Criterion	Coverage	Status
🏷️	variable "hub" in integration	5/5	🟢 100%
🏢	variable "meshstack" in integration	5/5	🟢 100%
📤	building_block_definition output exposed	5/5	🟢 100%
🔌	meshcloud/meshstack in required_providers	5/5	🟢 100%
📎	backplane source uses var.hub.git_ref	5/5	🟢 100%
🔀	ref_name uses var.hub.git_ref	5/5	🟢 100%
🌱	BBD terraform_version >= 1.12.0	5/5	🟢 100%
📋	version_spec.draft uses var.hub.bbd_draft	5/5	🟢 100%
🏷️	BBD metadata.tags forwards var.meshstack.tags	5/5	🟢 100%
🧱	BBD input argument vars with optional() have explicit defaults	5/5	🟢 100%
🏪	BBD catalog properties are overridable	4/5	🟢 80%
📖	BBD readme field present	4/5	🟢 80%
📝	BBD readme starts with plain-text description (no heading)	4/5	🟢 80%
📊	BBD readme has shared responsibility table (✅/❌)	4/5	🟢 80%
🚫	No documentation_md output in backplane	5/5	🟢 100%
🔄	meshstack_platform has lifecycle ignore_changes = [availability]	1/1	🟢 100%
🗒️	Building block renders a summary	5/5	🟢 100%
🪪	Trusts the runner's identity, not the replicator's	0/5	🔴 0%

AWS Backplane — not applicable

AWS automation principal conventions (WIF or cross-account StackSet) — applies to 0 modules

No applicable modules.

Azure Backplane — not applicable

Azure UAMI-based automation principal conventions — applies to 0 modules

No applicable modules.

GCP Backplane — not applicable

GCP workload-identity-federation automation principal conventions — applies to 0 modules

No applicable modules.

STACKIT Backplane — ✅ all passing

STACKIT WIF-based automation principal conventions — applies to 5 modules

Module	Score	🔐	🚫	📤	⚡
stackit/network	🟢 100%	✅	✅	✅	✅
stackit/network-area	🟢 100%	✅	✅	✅	✅
stackit/project	🟢 100%	✅	✅	✅	✅
stackit/service-account	🟢 100%	✅	✅	✅	✅
stackit/service-account-federation	🟢 100%	✅	✅	✅	✅

STACKIT Backplane — Summary

Emoji	Criterion	Coverage	Status
🔐	Uses stackit_service_account_federated_identity_provider	5/5	🟢 100%
🚫	No stackit_service_account_key resource	5/5	🟢 100%
📤	Outputs service_account_email (not key)	5/5	🟢 100%
⚡	WIF auth via env vars, not provider arguments	5/5	🟢 100%

Shared Practices — some checks failing

Practices modules and reference architectures share — applies to 5 modules

Module	Score	🎯	🔐	🫥	🧾	🔢	🪞
stackit/network	🟡 75%	❌	✅	➖	✅	➖	✅
stackit/network-area	🟡 75%	✅	✅	➖	❌	➖	✅
stackit/project	🟡 67%	✅	✅	➖	➖	➖	❌
stackit/service-account	🟡 75%	❌	✅	➖	✅	➖	✅
stackit/service-account-federation	🟢 100%	✅	✅	➖	✅	➖	✅

Shared Practices — Summary

Emoji	Criterion	Coverage	Status
🎯	meshStack *_ref attributes take a ref, never an object built from a uuid	3/5	🟡 60%
🔐	no building block output carries a secret	5/5	🟢 100%
🫥	Sensitive building block variables are ephemeral	n/a	—
🧾	User-facing BBD inputs backed by an object or map variable are JSON with a json_schema	3/4	🟡 75%
🔢	BBD inputs and their variables are declared in display order	n/a	—
🪞	The definition owns input defaults: variables fed by required inputs have no default and are not nullable, no "" as unset	4/5	🟢 80%

Testing — ✅ all passing

End-to-end test coverage — applies to 5 modules

Module	Score	⚙️	🧪	🚫	🎭	✅
stackit/network	🟢 100%	✅	✅	✅	✅	✅
stackit/network-area	🟢 100%	✅	✅	✅	✅	✅
stackit/project	🟢 100%	✅	✅	✅	✅	✅
stackit/service-account	🟢 100%	✅	✅	✅	✅	✅
stackit/service-account-federation	🟢 100%	✅	✅	✅	✅	✅

Testing — Summary

Emoji	Criterion	Coverage	Status
⚙️	backplane/ directory (optional tier)	5/5	🟢 100%
🧪	e2e/ test directory exists	5/5	🟢 100%
🚫	no .tftest.hcl outside e2e/	5/5	🟢 100%
🎭	every .tftest.hcl runs against real infrastructure	5/5	🟢 100%
✅	e2e/ contains .tftest.hcl files	5/5	🟢 100%

📈 Overall Summary

Overall Average Score: 93%

Score Distribution

• 🟢 High maturity (≥80%): 5 modules
• 🟡 Medium maturity (50–79%): 0 modules
• 🔴 Low maturity (<50%): 0 modules

[aws-amplify-eu-central-1]

This pull request is automatically being deployed by Amplify Hosting (learn more).

Access this pull request here: https://pr-437.d1o16zfeoh2slu.amplifyapp.com