[cristim]

refs #53

What

resolveAccountID in the OpenSearch client memoised the first GetCallerIdentity error behind a sync.Once, so one throttle or timeout disabled post-purchase tagging for the client's lifetime. It now caches only a successful lookup (mutex) and retries after a failure.

The audit also listed Redshift; origin/main no longer has that cache there.

Proof

• TestResolveAccountID_RetriesAfterTransientFailure fails on origin/main (error sticks) and passes with the fix.
• Mutation (cache the value on the error path): the test fails on call count.
• go test -race -count=1 ./... in providers/aws with GOWORK=off and with the workspace; golangci-lint v2.10.1 clean.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Bug Fixes
  • OpenSearch post-purchase tagging can recover from temporary AWS account-ID lookup failures, such as throttling or timeouts. Failed lookups are retried on later requests, while a successful lookup is cached to avoid repeated calls.

[coderabbitai]

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: LeanerCloud/cloud-commitments-go
• Branch: fix/53-sts-retry
• File: .coderabbit.yaml
• Commit: 9977972
• Layers: Repository YAML
• Review profile: CHILL
• Plan: Essentials
• Run ID: 5ce3a6bf-6b41-45a7-b1a9-c3a8204a0e13

Commits

Reviewing files that changed from the base of the PR and between f010a74 and 9977972.

Files selected for processing: 3

• CHANGELOG.md
• providers/aws/services/opensearch/client.go
• providers/aws/services/opensearch/client_test.go

Included review availability: This review used your included allowance. 0 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 3 reviews per hour.

Walkthrough

OpenSearch account-ID resolution now retries after STS lookup errors instead of caching the error. It caches a successful account ID, and a test verifies that later calls reuse it without another STS request.

Changes: OpenSearch account-ID lookup

Layer / File(s)	Summary
Retryable lookup and successful caching providers/aws/services/opensearch/client.go, providers/aws/services/opensearch/client_test.go, CHANGELOG.md	The client serializes account-ID lookups with a mutex. Lookup errors are not cached, while a successful account ID is cached. The test verifies retry after a throttling error and reuse of the successful result. The changelog records the behavior.

Priority: Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix · Severity of issue fixed: Medium

Suggested labels: priority/p2, severity/medium, triaged, urgency/this-quarter, impact/few, effort/s, type/bug

Merge Risk: Minimal · up to 99779

No issue identified in the account-lookup retry change prevents merging after normal checks.

Pre-merge checks: 4 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 50.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 2 functions across 2 files. (1 skipped: 1…	Write docstrings for the functions missing them to satisfy the coverage threshold.

Passed checks: 4 passed

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main change: retrying the AWS OpenSearch STS account lookup after a transient failure.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 50.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 2 functions across 2 files. (1 skipped: 1 unsupported.)

Resolution

Write docstrings for the functions missing them to satisfy the coverage threshold.

Finishing Touches: 💡 1

📝 Generate docstrings: 💡

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}