[dev] [tofikwest] feat/support-gov-cloud-aws

[github-actions]

This is an automated pull request to merge feat/support-gov-cloud-aws into dev.
It was created by the [Auto Pull Request] action.

---

Summary by cubic

Adds full AWS GovCloud support with partition-aware credentials, ARNs, and regions across API and app. Enables scanning and remediation in GovCloud with correct CloudShell URLs/scripts and a simpler AWS settings setup.

• New Features

  • Partition-aware AWS utils: normalize partition, default region, parse role ARNs, infer from region, and validate config (Commercial vs GovCloud).
  • API: AWSSecurityService/executor handle aws-us-gov ARNs/regions; block unsupported services (CloudFront, Shield); default region uses partition.
  • Remediation: prompts/steps include partition/region context; ARN normalization applied across inputs.
  • Connection metadata: carry awsType; controllers parse accountId from arn:(aws|aws-us-gov):....
  • Frontend: choose AWS environment; CloudShell URL/script and remediation script adapt to partition; copy disabled until environment is selected; connection labels recognize aws-us-gov.
  • @trycompai/integration-platform: export getAwsCloudShellUrl, getAwsCloudShellScript, getAwsRemediationScript, normalizeAwsEnvironment; credentials manifest supports GovCloud.
  • Env: added SECURITY_HUB_GOVCLOUD_* variables; role-assumer ARN selection based on partition.
  • Tests: added coverage for partition utilities.
  • Refactors: cleaned up CloudTestsSection formatting and filtering; removed console logs and simplified credential updates (including awsType) in onboarding and AWS account settings.

• Migration

  • For GovCloud: set SECURITY_HUB_GOVCLOUD_ROLE_ASSUMER_ARN (and optional SECURITY_HUB_GOVCLOUD_ACCESS_KEY_ID, SECURITY_HUB_GOVCLOUD_SECRET_ACCESS_KEY, SECURITY_HUB_GOVCLOUD_SESSION_TOKEN).
  • When connecting AWS, set credentials.awsType to aws-us-gov and use GovCloud role ARNs; Commercial (aws) remains default.
  • Redeploy API with updated env vars.

^{Written for commit 44d7cbd. Summary will update on new commits.}

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated (UTC)
CompAI	🟢 Ready	View Preview	May 10, 2026, 5:53 AM

💡 Tip: Enable Workflows to automatically generate PRs for you.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
app	Ready	Preview, Comment	May 10, 2026 6:06am
comp-framework-editor	Ready	Preview, Comment	May 10, 2026 6:06am

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
portal	Skipped		May 10, 2026 6:06am

[cubic-dev-ai]

2 issues found across 22 files

Confidence score: 3/5

• There is concrete user-impact risk: in apps/app/src/app/(app)/[orgId]/integrations/[slug]/components/EmptyStateOnboarding.tsx, region-clearing is wired in CredentialSetup instead of CloudSetup, so switching AWS Commercial/GovCloud can retain stale region state and lead to incorrect selections.
• apps/app/src/app/(app)/[orgId]/integrations/[slug]/components/aws-account-settings-body.tsx still contains a production console.log that exposes connection metadata (including ARNs/account IDs) in browser logs, which should be removed before merge.
• Given two high-confidence issues with severities 7/10 and 6/10, this sits in moderate merge-risk territory until these are addressed.
• Pay close attention to apps/app/src/app/(app)/[orgId]/integrations/[slug]/components/EmptyStateOnboarding.tsx and apps/app/src/app/(app)/[orgId]/integrations/[slug]/components/aws-account-settings-body.tsx - fix AWS environment/region state handling and remove metadata-leaking debug logging.

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="apps/app/src/app/(app)/[orgId]/integrations/[slug]/components/aws-account-settings-body.tsx">

<violation number="1" location="apps/app/src/app/(app)/[orgId]/integrations/[slug]/components/aws-account-settings-body.tsx:86">
P2: Remove this debug `console.log` before merging. It leaks connection metadata (including ARNs and account IDs) to the browser console in production.</violation>
</file>

<file name="apps/app/src/app/(app)/[orgId]/integrations/[slug]/components/EmptyStateOnboarding.tsx">

<violation number="1" location="apps/app/src/app/(app)/[orgId]/integrations/[slug]/components/EmptyStateOnboarding.tsx:367">
P1: Region-clearing logic on `awsType` change is in `CredentialSetup` (which never handles AWS) instead of `CloudSetup` (which does). When a user switches between Commercial and GovCloud environments, previously-selected regions from the other partition remain in state and may be submitted.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review, or fix all with cubic.}