feat: let a foundation e2e test order from a workspace that does not own the definition

[malhussan]

A foundation smoke test sometimes has to run in its own workspace, for example when the owner workspace carries tags that a policy uses. Foundation mode now takes an optional definition_workspace for the lookup, so the test can order the released version from another workspace.

Related: meshcloud/trial-cloudfoundation#22

🤖 Generated with Claude Code

[github-actions]

Scorecard Check

Scorecard run on commit 78eb1acdfda4b073972908d96e0529570dca0291 relative to origin/main

📊 meshstack-hub Module Scorecard

Generated: 2026-10-02 | Modules scanned: 3 | Categories: 7

📋 Per-Module Category Summary

Score per category per building block. n/a = category does not apply to this module.

Module	Overall	Core Structure	Integration	AWS Backplane	Azure Backplane	GCP Backplane	STACKIT Backplane	Testing
meshstack/workspace-starterkit	🟢 100%	🟢 100%	🟢 100%	n/a	n/a	n/a	n/a	🟢 100%
ske/ske-starterkit	🟢 96%	🟢 100%	🟢 100%	n/a	n/a	n/a	n/a	🟡 75%
stackit/secrets-manager	🟢 94%	🟢 88%	🟢 94%	n/a	n/a	n/a	🟢 100%	🟢 100%

⚠️ 2 modules have failing checks — failing categories are expanded below.

Core Structure — some checks failing

Basic module file structure and documentation — applies to 3 modules

Module	Score	📦	🔗	📋	📝	🖼️	📌	🚦	🎯	🩹	🔒
meshstack/workspace-starterkit	🟢 100%	✅	✅	➖	✅	✅	✅	➖	✅	✅	✅
ske/ske-starterkit	🟢 100%	✅	✅	➖	✅	✅	✅	✅	✅	✅	✅
stackit/secrets-manager	🟢 88%	✅	✅	➖	✅	❌	✅	➖	✅	✅	✅

Core Structure — Summary

Emoji	Criterion	Coverage	Status
📦	buildingblock/ directory exists	3/3	🟢 100%
🔗	meshstack_integration.tf present	3/3	🟢 100%
📋	buildingblock/APP_TEAM_README.md present (no-integration fallback)	n/a	—
📝	buildingblock/README.md with YAML front-matter	3/3	🟢 100%
🖼️	buildingblock/logo.png included	2/3	🟡 67%
📌	buildingblock/versions.tf present	3/3	🟢 100%
🚦	Child meshstack_building_block asserts a SUCCEEDED run	1/1	🟢 100%
🎯	meshStack *_ref attributes use the resource's ref output	3/3	🟢 100%
🩹	Every try() carries a comment saying why	3/3	🟢 100%
🔒	Provider versions float within one major (>= X.Y.Z, < N.0.0)	3/3	🟢 100%

Integration — some checks failing

meshstack_integration.tf conventions — applies to 3 modules

Module	Score	🏷️	🏢	📤	🔌	📎	🔀	🌱	📋	🏷️	🧱	🏪	📖	📝	📊	🚫	🔄	🪪
meshstack/workspace-starterkit	🟢 100%	✅	✅	✅	✅	✅	✅	✅	✅	✅	✅	✅	✅	✅	✅	✅	➖	➖
ske/ske-starterkit	🟢 100%	✅	✅	✅	✅	✅	✅	✅	✅	✅	✅	✅	✅	✅	✅	✅	➖	➖
stackit/secrets-manager	🟢 94%	✅	✅	✅	✅	✅	✅	✅	✅	✅	✅	✅	✅	✅	✅	✅	➖	❌

Integration — Summary

Emoji	Criterion	Coverage	Status
🏷️	variable "hub" in integration	3/3	🟢 100%
🏢	variable "meshstack" in integration	3/3	🟢 100%
📤	building_block_definition output exposed	3/3	🟢 100%
🔌	meshcloud/meshstack in required_providers	3/3	🟢 100%
📎	backplane source uses var.hub.git_ref	3/3	🟢 100%
🔀	ref_name uses var.hub.git_ref	3/3	🟢 100%
🌱	BBD terraform_version >= 1.12.0	3/3	🟢 100%
📋	version_spec.draft uses var.hub.bbd_draft	3/3	🟢 100%
🏷️	BBD metadata.tags forwards var.meshstack.tags	3/3	🟢 100%
🧱	BBD input argument vars with optional() have explicit defaults	3/3	🟢 100%
🏪	BBD catalog properties are overridable	3/3	🟢 100%
📖	BBD readme field present	3/3	🟢 100%
📝	BBD readme starts with plain-text description (no heading)	3/3	🟢 100%
📊	BBD readme has shared responsibility table (✅/❌)	3/3	🟢 100%
🚫	No documentation_md output in backplane	3/3	🟢 100%
🔄	meshstack_platform has lifecycle ignore_changes = [availability]	n/a	—
🪪	Trusts the runner's identity, not the replicator's	0/1	🔴 0%

AWS Backplane — not applicable

AWS automation principal conventions (WIF or cross-account StackSet) — applies to 0 modules

No applicable modules.

Azure Backplane — not applicable

Azure UAMI-based automation principal conventions — applies to 0 modules

No applicable modules.

GCP Backplane — not applicable

GCP workload-identity-federation automation principal conventions — applies to 0 modules

No applicable modules.

STACKIT Backplane — ✅ all passing

STACKIT WIF-based automation principal conventions — applies to 1 modules

Module	Score	🔐	🚫	📤	⚡
stackit/secrets-manager	🟢 100%	✅	✅	✅	✅

STACKIT Backplane — Summary

Emoji	Criterion	Coverage	Status
🔐	Uses stackit_service_account_federated_identity_provider	1/1	🟢 100%
🚫	No stackit_service_account_key resource	1/1	🟢 100%
📤	Outputs service_account_email (not key)	1/1	🟢 100%
⚡	WIF auth via env vars, not provider arguments	1/1	🟢 100%

Testing — some checks failing

End-to-end test coverage — applies to 3 modules

Module	Score	⚙️	🧪	🚫	✅
meshstack/workspace-starterkit	🟢 100%	✅	✅	✅	✅
ske/ske-starterkit	🟡 75%	❌	✅	✅	✅
stackit/secrets-manager	🟢 100%	✅	✅	✅	✅

Testing — Summary

Emoji	Criterion	Coverage	Status
⚙️	backplane/ directory (optional tier)	2/3	🟡 67%
🧪	e2e/ test directory exists	3/3	🟢 100%
🚫	no .tftest.hcl outside e2e/	3/3	🟢 100%
✅	e2e/ contains .tftest.hcl files	3/3	🟢 100%

📈 Overall Summary

Overall Average Score: 97%

Score Distribution

• 🟢 High maturity (≥80%): 3 modules
• 🟡 Medium maturity (50–79%): 0 modules
• 🔴 Low maturity (<50%): 0 modules

[aws-amplify-eu-central-1]

This pull request is automatically being deployed by Amplify Hosting (learn more).

Access this pull request here: https://pr-372.d1o16zfeoh2slu.amplifyapp.com

[grubmeshi]

lgtm, feels like the right approach