fix: pass AWS region when fetching git identity for containerized sandbox builds

[srathod-apphelix]

Summary

Fixes containerized sandbox builds failing during edx-themes clone with "Load key invalid format" and "Permission denied (publickey)" errors.

Jira - GSRE-4246

Purpose

In the containerized path, ansible-provision.sh fetches _local_git_identity from AWS Secrets Manager using the AWS CLI before LMS container provisioning. That call did not include a region, while the non-containerized path uses Ansible aws_secret lookups with region=us-east-1.
This caused the AWS CLI to fail with "You must specify a region", so the git SSH key was never fetched correctly and an empty/invalid key was written to the sandbox host.

Changes

• Add --region "${region}" to all aws secretsmanager get-secret-value calls in ansible-provision.sh that fetch _local_git_identity.
• Applies to LMS container provisioning, edx_exams, and subscriptions container flows.
• Uses the existing region variable (defaults to us-east-1), matching non-containerized sandbox secret retrieval behavior.

[Copilot]

Pull request overview

This PR fixes containerized sandbox builds failing to clone private repos (e.g., edx-themes) by ensuring AWS Secrets Manager lookups for _local_git_identity explicitly include an AWS region, matching the behavior of the non-containerized Ansible-based secret retrieval path.

Changes:

• Add --region "${region}" to AWS CLI secretsmanager get-secret-value calls that fetch ._local_git_identity.
• Apply the region fix across LMS container provisioning as well as edx_exams and subscriptions container flows.

Comments suppressed due to low confidence (2)

util/jenkins/ansible-provision.sh:964

• Quote the secret id variable to avoid word-splitting/glob expansion in case the value is ever provided with unexpected characters (e.g., whitespace) from the environment.

    app_git_ssh_key=$(aws secretsmanager get-secret-value --region "${region}" --secret-id $configuration_secure_secret --query SecretString --output text | jq -r '._local_git_identity')

util/jenkins/ansible-provision.sh:988

• Consider quoting ${configuration_secure_secret} here for safer shell argument handling (prevents word-splitting and globbing).

    app_git_ssh_key=$(aws secretsmanager get-secret-value --region "${region}" --secret-id $configuration_secure_secret --query SecretString --output text | jq -r '._local_git_identity')

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (3)

util/jenkins/ansible-provision.sh:964

• Same as above: jq -r will return null with a zero exit code if the key is missing, and without an explicit check the script proceeds until a later SSH error. Consider failing fast with jq -e + an explicit error.

    app_git_ssh_key=$(aws secretsmanager get-secret-value --region "${region}" --secret-id "${configuration_secure_secret}" --query SecretString --output text | jq -r '._local_git_identity')

util/jenkins/ansible-provision.sh:988

• Same as above: add a fail-fast check so missing/invalid secret content doesn’t get written as an SSH key and only fail much later.

    app_git_ssh_key=$(aws secretsmanager get-secret-value --region "${region}" --secret-id "${configuration_secure_secret}" --query SecretString --output text | jq -r '._local_git_identity')

util/jenkins/ansible-provision.sh:786

• If Secrets Manager returns a SecretString that doesn’t contain ._local_git_identity (or if the AWS CLI call fails), jq -r will emit null/empty and this script will continue, leading to later, harder-to-debug SSH key errors. Consider making the extraction fail-fast with a clear error message by using jq -e and checking the pipeline exit status.

This issue also appears in the following locations of the same file:

• line 964
• line 988

      app_git_ssh_key=$(aws secretsmanager get-secret-value --region "${region}" --secret-id "${configuration_secure_secret}" --query SecretString --output text | jq -r '._local_git_identity')