@codedrifters/configulator 0.0.422 → 0.0.424

package/lib/index.js

@@ -457,6 +457,7 @@ __export(index_exports, {
   renderFocusSection: () => renderFocusSection,
   renderGithubIssueTypeSection: () => renderGithubIssueTypeSection,
   renderGithubIssueTypeSectionLines: () => renderGithubIssueTypeSectionLines,
+  renderHomeRepositoryCondition: () => renderHomeRepositoryCondition,
   renderIssueTemplateLabelsCheckerScript: () => renderIssueTemplateLabelsCheckerScript,
   renderIssueTemplatesBundleHook: () => renderIssueTemplatesBundleHook,
   renderIssueTemplatesCheckerScript: () => renderIssueTemplatesCheckerScript,
@@ -37971,6 +37972,7 @@ var CdkCli = class _CdkCli extends import_projen11.Component {
     this.diffDefaults = options.diffDefaults ?? {};
     this.bootstrapDefaults = options.bootstrapDefaults ?? {};
     this.accountOverrides = options.accountOverrides ?? {};
+    this.cliVersion = options.cliVersion ?? project.cdkDeps.cdkCliVersion;
   }
   /**
    * Resolve the `cdk deploy` options to use against a given target.
@@ -42292,7 +42294,25 @@ var import_projen26 = require("projen");
 var import_build = require("projen/lib/build");
 var import_github6 = require("projen/lib/github");
 var import_workflows_model5 = require("projen/lib/github/workflows-model");
+
+// src/workflows/home-repository.ts
+var HOME_REPOSITORY_PATTERN = /^[A-Za-z0-9._-]+\/[A-Za-z0-9._-]+$/;
+var renderHomeRepositoryCondition = (homeRepository, componentName) => {
+  if (homeRepository === void 0) {
+    return void 0;
+  }
+  if (!HOME_REPOSITORY_PATTERN.test(homeRepository)) {
+    throw new Error(
+      `${componentName} requires \`homeRepository\` to be an \`owner/repo\` slug, got "${homeRepository}"`
+    );
+  }
+  return `github.repository == '${homeRepository}'`;
+};
+
+// src/workflows/aws-deploy-workflow.ts
 var PROD_DEPLOY_NAME = "prod-deploy";
+var DIFF_OUTPUT_FILE = "cdk-diff.txt";
+var DIFF_SUMMARY_BYTE_LIMIT = 9e5;
 var AwsDeployWorkflow = class _AwsDeployWorkflow extends import_projen26.Component {
   constructor(project, options = {}) {
     super(project);
@@ -42345,6 +42365,39 @@ var AwsDeployWorkflow = class _AwsDeployWorkflow extends import_projen26.Compone
         target.region
       ].join("-");
     };
+    /**
+     * Build the deterministic GitHub Actions job name for a target's `cdk diff`
+     * job. Mirrors {@link buildJobName} with a `diff` verb so the diff and deploy
+     * jobs for one target sort next to each other in the run view.
+     */
+    this.buildDiffJobName = (target) => {
+      return [
+        target.awsStageType,
+        target.deploymentTargetRole,
+        "diff",
+        target.project.name,
+        target.account,
+        target.region
+      ].join("-");
+    };
+    /**
+     * Build the CI artifact name for a target's captured diff.
+     *
+     * Carries every component that makes a target unique — including
+     * `deploymentTargetRole`, which two otherwise-identical targets can differ
+     * on. `actions/upload-artifact` v4+ treats artifacts as immutable and rejects
+     * a duplicate name within a run, so parallel diff jobs cannot share one.
+     */
+    this.buildDiffArtifactName = (target) => {
+      return [
+        "cdk-diff",
+        target.awsStageType,
+        target.deploymentTargetRole,
+        target.project.name,
+        target.account,
+        target.region
+      ].join("-");
+    };
     /**
      * Builds a GitHub Actions condition string that checks if the current branch
      * matches any of the provided branch patterns.
@@ -42383,17 +42436,18 @@ var AwsDeployWorkflow = class _AwsDeployWorkflow extends import_projen26.Compone
         awsDeploymentConfig
       } = target;
       const { roleArn, stackPattern } = ciDeploymentConfig ?? {};
-      const { rootCdkOut } = awsDeploymentConfig;
+      const { rootCdkOut, cdkCli } = awsDeploymentConfig;
       const deployJobName = this.buildJobName(target);
       return [
         ...this.setupPnpm(),
         ...this.setupNode(),
         /**
-         * Install CDK
+         * Install CDK, pinned to the same version that synthesized the cloud
+         * assembly being deployed. See {@link CdkCli.cliVersion}.
          */
         {
           name: "Install CDK",
-          run: "pnpm add aws-cdk"
+          run: `pnpm add "aws-cdk@${cdkCli.cliVersion}"`
         },
         /**
          * Configure AWS creds.
@@ -42413,8 +42467,8 @@ var AwsDeployWorkflow = class _AwsDeployWorkflow extends import_projen26.Compone
          */
         {
           name: `Deploy ${awsStageType}/${deploymentTargetRole}/${account}/${region}`,
-          run: `pnpm dlx aws-cdk ${renderCdkDeploy({
-            ...awsDeploymentConfig.cdkCli.deployOptionsFor(target),
+          run: `pnpm dlx "aws-cdk@${cdkCli.cliVersion}" ${renderCdkDeploy({
+            ...cdkCli.deployOptionsFor(target),
             app: rootCdkOut,
             stackPatterns: stackPattern ? [stackPattern] : void 0
           })} --outputs-file cdk-outputs.json`
@@ -42462,6 +42516,128 @@ var AwsDeployWorkflow = class _AwsDeployWorkflow extends import_projen26.Compone
         }
       ];
     };
+    /**
+     * Steps for a target's optional `cdk diff` job.
+     *
+     * Mirrors {@link deploySteps}' toolchain and credential setup — same pnpm /
+     * Node setup, same version-pinned `aws-cdk` install, same OIDC role — so a
+     * diff is computed by the same CLI that will run the deploy.
+     *
+     * The `cdk diff` flags come from the {@link CdkCli} precedence chain via
+     * `diffOptionsFor(target)`, so `method`, `securityOnly`, `fail`, and the rest
+     * are consumer-controlled per stage, per account, or per target. Four options
+     * are pinned at the call site because the capture mechanism depends on them:
+     * `app` and `stackPatterns` target the built cloud assembly, and `ci` /
+     * `noColor` force the human-readable diff onto stdout without ANSI escapes
+     * (without `--ci` the CLI interleaves it into stderr alongside logs).
+     */
+    this.diffSteps = (target) => {
+      const {
+        awsStageType,
+        deploymentTargetRole,
+        account,
+        region,
+        ciDeploymentConfig,
+        awsDeploymentConfig
+      } = target;
+      const { roleArn, stackPattern } = ciDeploymentConfig ?? {};
+      const { rootCdkOut, cdkCli } = awsDeploymentConfig;
+      const label = `${awsStageType}/${deploymentTargetRole}/${account}/${region}`;
+      const artifactName = this.buildDiffArtifactName(target);
+      const capturedFileGuard = `always() && hashFiles('${DIFF_OUTPUT_FILE}') != ''`;
+      const runUrl = "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}";
+      return [
+        ...this.setupPnpm(),
+        ...this.setupNode(),
+        /**
+         * Install CDK, pinned to the same version that synthesized the cloud
+         * assembly being diffed. See {@link CdkCli.cliVersion}.
+         */
+        {
+          name: "Install CDK",
+          run: `pnpm add "aws-cdk@${cdkCli.cliVersion}"`
+        },
+        /**
+         * Configure AWS creds.
+         */
+        {
+          name: `AWS Creds ${label}`,
+          uses: "aws-actions/configure-aws-credentials@v6",
+          with: {
+            "role-to-assume": roleArn,
+            "aws-region": region,
+            "role-duration-seconds": 900
+            // 15 minutes
+          }
+        },
+        /**
+         * Run CDK Diff, capturing the output while leaving it visible in the job
+         * log. `pipefail` keeps the CLI's exit code from being masked by `tee`.
+         */
+        {
+          name: `Diff ${label}`,
+          shell: "bash",
+          run: [
+            "set -o pipefail",
+            `pnpm dlx "aws-cdk@${cdkCli.cliVersion}" ${renderCdkDiff({
+              ...cdkCli.diffOptionsFor(target),
+              app: rootCdkOut,
+              ci: true,
+              noColor: true,
+              stackPatterns: stackPattern ? [stackPattern] : void 0
+            })} 2>&1 | tee ${DIFF_OUTPUT_FILE}`
+          ].join("\n")
+        },
+        /**
+         * Render the captured diff into the job summary inside a collapsed
+         * `<details>` block, truncated below GitHub's 1 MiB per-step cap — a
+         * summary that exceeds the cap is dropped in full rather than clipped.
+         */
+        ...this.diffOptions.summary ? [
+          {
+            name: `Render diff summary ${label}`,
+            if: capturedFileGuard,
+            shell: "bash",
+            run: [
+              `size=$(wc -c < ${DIFF_OUTPUT_FILE})`,
+              "{",
+              `  echo '## cdk diff \u2014 ${label}'`,
+              '  echo ""',
+              "  echo '<details><summary>cdk diff output</summary>'",
+              '  echo ""',
+              "  echo '```'",
+              `  if [ "$size" -gt ${DIFF_SUMMARY_BYTE_LIMIT} ]; then`,
+              `    head -c ${DIFF_SUMMARY_BYTE_LIMIT} ${DIFF_OUTPUT_FILE}`,
+              `    printf '\\n... truncated at ${DIFF_SUMMARY_BYTE_LIMIT} bytes ...\\n'`,
+              "  else",
+              `    cat ${DIFF_OUTPUT_FILE}`,
+              "  fi",
+              "  echo '```'",
+              '  echo ""',
+              "  echo '</details>'",
+              ...this.diffOptions.artifact ? [
+                '  echo ""',
+                `  echo 'Full diff: the \`${artifactName}\` artifact on [this run](${runUrl}).'`
+              ] : [],
+              '} >> "$GITHUB_STEP_SUMMARY"'
+            ].join("\n")
+          }
+        ] : [],
+        /**
+         * Upload the untruncated diff as a per-run artifact.
+         */
+        ...this.diffOptions.artifact ? [
+          import_github6.WorkflowSteps.uploadArtifact({
+            name: `Upload diff ${label}`,
+            if: capturedFileGuard,
+            with: {
+              name: artifactName,
+              path: DIFF_OUTPUT_FILE
+            }
+          })
+        ] : []
+      ];
+    };
     if (!(project.root instanceof MonorepoProject)) {
       throw new Error(
         "AwsDeployWorkflow requires the root project to be a MonorepoProject"
@@ -42481,6 +42657,16 @@ var AwsDeployWorkflow = class _AwsDeployWorkflow extends import_projen26.Compone
       (target) => target.awsStageType === this.awsStageType && target.ciDeployment
     ) ?? [];
     this.deployAfterTargets = options.deployAfterTargets ?? [];
+    this.diffOptions = {
+      enabled: options.diff?.enabled ?? false,
+      artifact: options.diff?.artifact ?? true,
+      summary: options.diff?.summary ?? true
+    };
+    this.homeRepository = options.homeRepository;
+    const homeRepositoryCondition = renderHomeRepositoryCondition(
+      this.homeRepository,
+      "AwsDeployWorkflow"
+    );
     if (options.buildWorkflow && options.buildWorkflowOptions) {
       throw new Error(
         "Cannot provide both buildWorkflow and buildWorkflowOptions"
@@ -42558,10 +42744,11 @@ var AwsDeployWorkflow = class _AwsDeployWorkflow extends import_projen26.Compone
       const branchFilterCondition = this.buildBranchFilterCondition(
         target.branches
       );
-      const jobCondition = branchFilterCondition ? "${{ " + [
+      const jobCondition = "${{ " + [
         "!needs.build.outputs.self_mutation_happened",
-        `(${branchFilterCondition})`
-      ].join(" && ") + " }}" : "${{ !needs.build.outputs.self_mutation_happened }}";
+        ...homeRepositoryCondition ? [homeRepositoryCondition] : [],
+        ...branchFilterCondition ? [`(${branchFilterCondition})`] : []
+      ].join(" && ") + " }}";
       this.buildWorkflow.addPostBuildJob(deployJobName, {
         name: `Deploy ${this.project.name} ${target.awsStageType}/${target.deploymentTargetRole}/${target.account}/${target.region}`,
         needs: [
@@ -42580,6 +42767,20 @@ var AwsDeployWorkflow = class _AwsDeployWorkflow extends import_projen26.Compone
         if: jobCondition,
         steps: [...this.deploySteps(target)]
       });
+      if (this.diffOptions.enabled) {
+        const diffJobName = this.buildDiffJobName(target);
+        this.buildWorkflow.addPostBuildJob(diffJobName, {
+          name: `Diff ${this.project.name} ${target.awsStageType}/${target.deploymentTargetRole}/${target.account}/${target.region}`,
+          needs: ["build"],
+          runsOn: ["ubuntu-latest"],
+          permissions: {
+            contents: import_workflows_model5.JobPermission.READ,
+            idToken: import_workflows_model5.JobPermission.WRITE
+          },
+          if: jobCondition,
+          steps: [...this.diffSteps(target)]
+        });
+      }
     });
     addBuildCompleteJob(this.buildWorkflow);
   }
@@ -42642,7 +42843,8 @@ var AwsTeardownWorkflow = class extends import_projen27.Component {
       stageTypeTagName,
       environmentTypeTagName,
       branchNameTagName,
-      deleteBranchPatterns
+      deleteBranchPatterns,
+      homeRepository
     } = options;
     if (!repoTagName) {
       throw new Error("AwsTeardownWorkflow requires `repoTagName`");
@@ -42671,6 +42873,10 @@ var AwsTeardownWorkflow = class extends import_projen27.Component {
       deleteBranchPatterns,
       awsDestructionTargets
     );
+    const homeRepositoryCondition = renderHomeRepositoryCondition(
+      homeRepository,
+      "AwsTeardownWorkflow"
+    );
     const workflow = new import_github7.GithubWorkflow(github, "teardown-dev");
     workflow.on({
       workflowDispatch: {},
@@ -42697,6 +42903,7 @@ var AwsTeardownWorkflow = class extends import_projen27.Component {
         {
           name: `Teardown Stacks in ${awsStageType}/${deploymentTargetRole}/${account}/${region}`,
           runsOn: ["ubuntu-latest"],
+          ...homeRepositoryCondition ? { if: `\${{ ${homeRepositoryCondition} }}` } : {},
           permissions: {
             contents: import_workflows_model6.JobPermission.READ,
             idToken: import_workflows_model6.JobPermission.WRITE
@@ -43731,6 +43938,7 @@ export const collections = {
   renderFocusSection,
   renderGithubIssueTypeSection,
   renderGithubIssueTypeSectionLines,
+  renderHomeRepositoryCondition,
   renderIssueTemplateLabelsCheckerScript,
   renderIssueTemplatesBundleHook,
   renderIssueTemplatesCheckerScript,