[mplaws]

Summary

make deploy DEVOPS_AGENT_CONNECT="orders" deploys the sample, then creates the DevOps Agent Agent Space and connects the named services to it. Without the variable, make deploy does what it did before. #201 added the Agent Space and the connect step as separate commands. This adds the one-command path for someone who wants it.

Piece	What it does
deployment/Makefile	deploy gets a first step, devops-agent-connect-preflight, and a last step. The last step runs make devops-agent (left out when DEVOPS_AGENT_SPACE_ARN is set), waits DEVOPS_AGENT_IAM_WAIT seconds (60 by default), then runs make devops-agent-connect for the services named. Both steps are empty unless DEVOPS_AGENT_CONNECT is set.
deployment/ngrh_testing/devops_agent.py, cli.py, __init__.py	New action devops-agent check. It checks that the names are services and that the AWS CLI is 2.38.0 or later. It reads nothing from the deployment, because a first deploy has none. The name parsing is split out of select_services, so check and connect accept the same names.
README.md	New paragraph, "In one command", in "Investigating with AWS DevOps Agent".
tests/	Tests for the Makefile steps, the check action, the README and the e2e workflow.

No linked issue: follow-up to #201.

Why it is opt-in

Connecting a service starts one DevOps Agent investigation for every failure mode finding the service has, and DevOps Agent bills by the agent-second. Connecting orders in a test deployment started 21 investigations in four seconds. make deploy runs no assessment, so the count is whatever the services already have, and the README says to name one service first.

Nothing connects by default. The e2e workflow runs plain make deploy and does not set the variable. A test fails if it ever does.

Behavior

• Before anything is deployed, the preflight refuses a name that is not a service, an AWS CLI older than 2.38.0, and DEVOPS_AGENT_SPACE_ARN= set to nothing. That last one takes the invoker role's access away, so it cannot go with connecting. A deploy takes about two hours, so these are found first.
• The Agent Space and the connection come last, after the NGRH model is deployed. The wait gives the invoker role's new policy time to take effect, because a connection that cannot use the policy yet is not sent again.
• With DEVOPS_AGENT_SPACE_ARN=<arn>, the Agent Space stack is not created and the services connect to that Agent Space.
• If the connection fails, the deploy is already done. make exits nonzero after the outputs are printed, and the README says to run make devops-agent-connect again.
• The names reach the recipes as one environment variable, so quotes or semicolons in them run nothing.
• make -n deploy DEVOPS_AGENT_CONNECT=orders shows the steps and runs none of them. The steps live in a make variable because make runs a recipe line that names $(MAKE) even under -n.

Testing

• pytest tests/ (Python 3.12): 1,892 passed, on this commit rebased onto main at 12389d0.
• With the variable unset, the make -n deploy plan is byte-identical to the one from main.
• The Makefile tests also pass under dash, the shell CI uses for make, in a container.
• Mutation check: breaking any of 23 things the feature relies on fails a test.
• The preflight against real AWS CLIs: 2.36.47 is refused with the install advice, and 2.38.1 passes.
• No YAML under deployment/ changes, so cfn-lint, checkov and cfn-nag see the same templates as on main.

Not tested yet

• make deploy DEVOPS_AGENT_CONNECT=... has not run against AWS end to end. The steps are covered by a stub make, a stub aws and a fake AWS. The e2e does not set the variable, so this PR's e2e run does not cover it either.
• The 60-second default for DEVOPS_AGENT_IAM_WAIT is a guess, based on the note in devops_agent.py that the role "can take a minute" to get its permissions.
• devops-agent-connect and devops-agent-disconnect against a real service, which was already open in feat(ngrh): add a DevOps Agent Agent Space and invoker access #201.

Before merging

• This PR changes deployment/**, so the e2e runs on the PR (about 4 hours in the CI account) and again after the merge to main. It should behave as in feat(ngrh): add a DevOps Agent Agent Space and invoker access #201, because it does not set the variable.
• The e2e on this PR passed on 826171f (run 39964577076). It ran plain make deploy with DEVOPS_AGENT_CONNECT unset, and nothing from the run was left in the CI account.