From d948d14079d784ca3c51a830c3599bd1ffbb6a3c Mon Sep 17 00:00:00 2001
From: Anderson Nogueira <anderson.nogueira@percona.com>
Date: Fri, 7 Aug 2026 19:03:06 +0000
Subject: [PATCH] chore(justfile): run allowlist-set unattended

- Drop the interactive overwrite confirm: read -p dies under set -e in
  any non-TTY caller, so the recipe could not run from automation
- The previous value is still echoed before the write, PutParameter is
  CloudTrail-audited, and the terraform/allowlists.tf guards keep gating
  the apply
---
 justfile | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/justfile b/justfile
index 1e14fa70..83d80b3c 100644
--- a/justfile
+++ b/justfile
@@ -223,6 +223,10 @@ allowlist-show: _require-aws-profile
 # bound ONCE via quote() into shell variables before any other use; embedding
 # quote() inside a double-quoted string would let $(...) re-evaluate, so only
 # the two assignments below may interpolate the operands (docs/adr/0036).
+# Overwrites without prompting so it runs unattended. The previous value is
+# echoed first and every PutParameter is CloudTrail-audited. The 0.0.0.0/0
+# and at-least-one-valid-CIDR guards in terraform/allowlists.tf still gate
+# the apply.
 allowlist-set name cidrs: _require-aws-profile
     #!/usr/bin/env bash
     set -euo pipefail
@@ -235,8 +239,6 @@ allowlist-set name cidrs: _require-aws-profile
       --query Parameter.Value --output text | tr ',' '\n'
     echo "new:"
     tr ',' '\n' <<< "$cidrs"
-    read -r -p "overwrite $param? [y/N] " a
-    [ "$a" = "y" ]
     aws ssm put-parameter --name "$param" --type StringList \
       --value "$cidrs" --overwrite --region "${AWS_REGION:-us-east-1}"
     echo "saved. Apply it: just tf-plan && just tf-apply"