@codedrifters/configulator 0.0.422 → 0.0.423

package/lib/index.mjs

@@ -41931,6 +41931,8 @@ import { BuildWorkflow } from "projen/lib/build";
 import { GitHub as GitHub5, WorkflowSteps as WorkflowSteps2 } from "projen/lib/github";
 import { JobPermission as JobPermission5 } from "projen/lib/github/workflows-model";
 var PROD_DEPLOY_NAME = "prod-deploy";
+var DIFF_OUTPUT_FILE = "cdk-diff.txt";
+var DIFF_SUMMARY_BYTE_LIMIT = 9e5;
 var AwsDeployWorkflow = class _AwsDeployWorkflow extends Component22 {
   constructor(project, options = {}) {
     super(project);
@@ -41983,6 +41985,39 @@ var AwsDeployWorkflow = class _AwsDeployWorkflow extends Component22 {
         target.region
       ].join("-");
     };
+    /**
+     * Build the deterministic GitHub Actions job name for a target's `cdk diff`
+     * job. Mirrors {@link buildJobName} with a `diff` verb so the diff and deploy
+     * jobs for one target sort next to each other in the run view.
+     */
+    this.buildDiffJobName = (target) => {
+      return [
+        target.awsStageType,
+        target.deploymentTargetRole,
+        "diff",
+        target.project.name,
+        target.account,
+        target.region
+      ].join("-");
+    };
+    /**
+     * Build the CI artifact name for a target's captured diff.
+     *
+     * Carries every component that makes a target unique — including
+     * `deploymentTargetRole`, which two otherwise-identical targets can differ
+     * on. `actions/upload-artifact` v4+ treats artifacts as immutable and rejects
+     * a duplicate name within a run, so parallel diff jobs cannot share one.
+     */
+    this.buildDiffArtifactName = (target) => {
+      return [
+        "cdk-diff",
+        target.awsStageType,
+        target.deploymentTargetRole,
+        target.project.name,
+        target.account,
+        target.region
+      ].join("-");
+    };
     /**
      * Builds a GitHub Actions condition string that checks if the current branch
      * matches any of the provided branch patterns.
@@ -42100,6 +42135,127 @@ var AwsDeployWorkflow = class _AwsDeployWorkflow extends Component22 {
         }
       ];
     };
+    /**
+     * Steps for a target's optional `cdk diff` job.
+     *
+     * Mirrors {@link deploySteps}' toolchain and credential setup — same pnpm /
+     * Node setup, same floating `aws-cdk` install, same OIDC role — so both jobs
+     * move together when the CLI version is pinned.
+     *
+     * The `cdk diff` flags come from the {@link CdkCli} precedence chain via
+     * `diffOptionsFor(target)`, so `method`, `securityOnly`, `fail`, and the rest
+     * are consumer-controlled per stage, per account, or per target. Four options
+     * are pinned at the call site because the capture mechanism depends on them:
+     * `app` and `stackPatterns` target the built cloud assembly, and `ci` /
+     * `noColor` force the human-readable diff onto stdout without ANSI escapes
+     * (without `--ci` the CLI interleaves it into stderr alongside logs).
+     */
+    this.diffSteps = (target) => {
+      const {
+        awsStageType,
+        deploymentTargetRole,
+        account,
+        region,
+        ciDeploymentConfig,
+        awsDeploymentConfig
+      } = target;
+      const { roleArn, stackPattern } = ciDeploymentConfig ?? {};
+      const { rootCdkOut } = awsDeploymentConfig;
+      const label = `${awsStageType}/${deploymentTargetRole}/${account}/${region}`;
+      const artifactName = this.buildDiffArtifactName(target);
+      const capturedFileGuard = `always() && hashFiles('${DIFF_OUTPUT_FILE}') != ''`;
+      const runUrl = "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}";
+      return [
+        ...this.setupPnpm(),
+        ...this.setupNode(),
+        /**
+         * Install CDK
+         */
+        {
+          name: "Install CDK",
+          run: "pnpm add aws-cdk"
+        },
+        /**
+         * Configure AWS creds.
+         */
+        {
+          name: `AWS Creds ${label}`,
+          uses: "aws-actions/configure-aws-credentials@v6",
+          with: {
+            "role-to-assume": roleArn,
+            "aws-region": region,
+            "role-duration-seconds": 900
+            // 15 minutes
+          }
+        },
+        /**
+         * Run CDK Diff, capturing the output while leaving it visible in the job
+         * log. `pipefail` keeps the CLI's exit code from being masked by `tee`.
+         */
+        {
+          name: `Diff ${label}`,
+          shell: "bash",
+          run: [
+            "set -o pipefail",
+            `pnpm dlx aws-cdk ${renderCdkDiff({
+              ...awsDeploymentConfig.cdkCli.diffOptionsFor(target),
+              app: rootCdkOut,
+              ci: true,
+              noColor: true,
+              stackPatterns: stackPattern ? [stackPattern] : void 0
+            })} 2>&1 | tee ${DIFF_OUTPUT_FILE}`
+          ].join("\n")
+        },
+        /**
+         * Render the captured diff into the job summary inside a collapsed
+         * `<details>` block, truncated below GitHub's 1 MiB per-step cap — a
+         * summary that exceeds the cap is dropped in full rather than clipped.
+         */
+        ...this.diffOptions.summary ? [
+          {
+            name: `Render diff summary ${label}`,
+            if: capturedFileGuard,
+            shell: "bash",
+            run: [
+              `size=$(wc -c < ${DIFF_OUTPUT_FILE})`,
+              "{",
+              `  echo '## cdk diff \u2014 ${label}'`,
+              '  echo ""',
+              "  echo '<details><summary>cdk diff output</summary>'",
+              '  echo ""',
+              "  echo '```'",
+              `  if [ "$size" -gt ${DIFF_SUMMARY_BYTE_LIMIT} ]; then`,
+              `    head -c ${DIFF_SUMMARY_BYTE_LIMIT} ${DIFF_OUTPUT_FILE}`,
+              `    printf '\\n... truncated at ${DIFF_SUMMARY_BYTE_LIMIT} bytes ...\\n'`,
+              "  else",
+              `    cat ${DIFF_OUTPUT_FILE}`,
+              "  fi",
+              "  echo '```'",
+              '  echo ""',
+              "  echo '</details>'",
+              ...this.diffOptions.artifact ? [
+                '  echo ""',
+                `  echo 'Full diff: the \`${artifactName}\` artifact on [this run](${runUrl}).'`
+              ] : [],
+              '} >> "$GITHUB_STEP_SUMMARY"'
+            ].join("\n")
+          }
+        ] : [],
+        /**
+         * Upload the untruncated diff as a per-run artifact.
+         */
+        ...this.diffOptions.artifact ? [
+          WorkflowSteps2.uploadArtifact({
+            name: `Upload diff ${label}`,
+            if: capturedFileGuard,
+            with: {
+              name: artifactName,
+              path: DIFF_OUTPUT_FILE
+            }
+          })
+        ] : []
+      ];
+    };
     if (!(project.root instanceof MonorepoProject)) {
       throw new Error(
         "AwsDeployWorkflow requires the root project to be a MonorepoProject"
@@ -42119,6 +42275,11 @@ var AwsDeployWorkflow = class _AwsDeployWorkflow extends Component22 {
       (target) => target.awsStageType === this.awsStageType && target.ciDeployment
     ) ?? [];
     this.deployAfterTargets = options.deployAfterTargets ?? [];
+    this.diffOptions = {
+      enabled: options.diff?.enabled ?? false,
+      artifact: options.diff?.artifact ?? true,
+      summary: options.diff?.summary ?? true
+    };
     if (options.buildWorkflow && options.buildWorkflowOptions) {
       throw new Error(
         "Cannot provide both buildWorkflow and buildWorkflowOptions"
@@ -42218,6 +42379,20 @@ var AwsDeployWorkflow = class _AwsDeployWorkflow extends Component22 {
         if: jobCondition,
         steps: [...this.deploySteps(target)]
       });
+      if (this.diffOptions.enabled) {
+        const diffJobName = this.buildDiffJobName(target);
+        this.buildWorkflow.addPostBuildJob(diffJobName, {
+          name: `Diff ${this.project.name} ${target.awsStageType}/${target.deploymentTargetRole}/${target.account}/${target.region}`,
+          needs: ["build"],
+          runsOn: ["ubuntu-latest"],
+          permissions: {
+            contents: JobPermission5.READ,
+            idToken: JobPermission5.WRITE
+          },
+          if: jobCondition,
+          steps: [...this.diffSteps(target)]
+        });
+      }
     });
     addBuildCompleteJob(this.buildWorkflow);
   }