From 514a559cf60ef7c0f3263bd37833d31527d2793b Mon Sep 17 00:00:00 2001 From: lewissmithweb Date: Mon, 10 Aug 2026 16:01:30 +0100 Subject: [PATCH] WEB-11460: Fix ssm.mk shell call under GNU Make 3.81 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The SSM_REPO_NAME derivation used `#` as the sed delimiter inside $(shell ...). GNU Make 3.81 (the macOS default) mis-tokenises the `#` as a comment when the expression is expanded, aborting with "unterminated call to function `shell'". This only surfaced for consumers that don't set SSM_SERVICE (so the derivation actually runs) — e.g. showcase via `-include`. Switch the sed delimiter to `,` so no `#` appears in the shell call, and add a regression assertion that renders a target WITHOUT pinning SSM_SERVICE, so the derivation path is exercised (the existing assertions all pinned it, masking the bug). Co-Authored-By: Claude Opus 4.8 --- ssm.mk | 2 +- test/ssm.sh | 15 +++++++++++++++ 2 files changed, 16 insertions(+), 1 deletion(-) diff --git a/ssm.mk b/ssm.mk index 0e6eddf..dc9a291 100644 --- a/ssm.mk +++ b/ssm.mk @@ -10,7 +10,7 @@ SSM_ENV ?= # Service segment of the parameter path. Defaults to the repo name (git remote # basename, else the working-directory name) so every repo that inherits these # helpers targets its own path without configuration. -SSM_REPO_NAME = $(shell git config --get remote.origin.url 2>/dev/null | sed -E 's#.*/##; s#\.git$$##') +SSM_REPO_NAME = $(shell git config --get remote.origin.url 2>/dev/null | sed -E 's,.*/,,; s,\.git$$,,') SSM_SERVICE ?= $(if $(SSM_REPO_NAME),$(SSM_REPO_NAME),$(notdir $(CURDIR))) # Parameter path convention from RFC #356.1: /ecs///. diff --git a/test/ssm.sh b/test/ssm.sh index 170e766..1f70a53 100755 --- a/test/ssm.sh +++ b/test/ssm.sh @@ -69,6 +69,21 @@ echo "ssm_guard_production recipe:"; printf '%s\n' "$guard" | sed 's/^/ | /'; e expect "ssm_guard derives env from the stem" "ENV='production'" "$guard" expect "ssm_guard runs the guard program" 'sh -eu -c "$SSM_GUARD"' "$guard" +# --- 1b. derived-service render guard (regression) ----------------------------- +# When a consumer does NOT set SSM_SERVICE (the common case), it is derived via +# $(shell ...) in SSM_REPO_NAME — and a malformed shell call there (e.g. a `#` +# inside it, which GNU Make 3.81 mis-tokenises) aborts with "unterminated call to +# function". The rest of this file always pins SSM_SERVICE, which short-circuits +# that expansion, so render once WITHOUT it to exercise the derivation path. +incdir=$(mktemp -d -t ssm_inc.XXXXXX) +cp "$repo_root/ssm.mk" "$incdir/ssm.mk" +printf -- '-include %s/ssm.mk\n' "$incdir" > "$incdir/Makefile" +inc=$(make -C "$incdir" -n ssm_guard_test AWS_REGION=eu-west-1 2>&1 || true) +rm -rf "$incdir" +echo +refute "SSM_REPO_NAME shell call is well-formed" "unterminated call to function" "$inc" +expect "renders with a derived service prefix" "/ecs/test/" "$inc" + # --- 2. the exported shell programs -------------------------------------------- helper=$(mktemp -t ssm_helper.XXXXXX)