@codedrifters/configulator 0.0.423 → 0.0.425

package/lib/index.js

@@ -277,6 +277,7 @@ __export(index_exports, {
   DEFAULT_UNBLOCK_COMMENT_TEMPLATE: () => DEFAULT_UNBLOCK_COMMENT_TEMPLATE,
   DEFAULT_UNBLOCK_DEPENDENTS_ENABLED: () => DEFAULT_UNBLOCK_DEPENDENTS_ENABLED,
   DEFAULT_UPSTREAM_CONFIGULATOR_ENABLED: () => DEFAULT_UPSTREAM_CONFIGULATOR_ENABLED,
+  DEPLOY_GATE: () => DEPLOY_GATE,
   DOCS_SYNC_AUDIT_SCHEMA_VERSION: () => DOCS_SYNC_AUDIT_SCHEMA_VERSION,
   GITHUB_ISSUE_TYPES: () => GITHUB_ISSUE_TYPES,
   GITHUB_ISSUE_TYPE_BY_TITLE_PREFIX: () => GITHUB_ISSUE_TYPE_BY_TITLE_PREFIX,
@@ -457,6 +458,7 @@ __export(index_exports, {
   renderFocusSection: () => renderFocusSection,
   renderGithubIssueTypeSection: () => renderGithubIssueTypeSection,
   renderGithubIssueTypeSectionLines: () => renderGithubIssueTypeSectionLines,
+  renderHomeRepositoryCondition: () => renderHomeRepositoryCondition,
   renderIssueTemplateLabelsCheckerScript: () => renderIssueTemplateLabelsCheckerScript,
   renderIssueTemplatesBundleHook: () => renderIssueTemplatesBundleHook,
   renderIssueTemplatesCheckerScript: () => renderIssueTemplatesCheckerScript,
@@ -506,6 +508,7 @@ __export(index_exports, {
   resolveBuildPolicy: () => resolveBuildPolicy,
   resolveBundleAgentTiers: () => resolveBundleAgentTiers,
   resolveDefaultAgentTier: () => resolveDefaultAgentTier,
+  resolveEnvironmentGate: () => resolveEnvironmentGate,
   resolveIssueDefaults: () => resolveIssueDefaults,
   resolveIssueTemplates: () => resolveIssueTemplates,
   resolveModelAlias: () => resolveModelAlias,
@@ -37971,6 +37974,7 @@ var CdkCli = class _CdkCli extends import_projen11.Component {
     this.diffDefaults = options.diffDefaults ?? {};
     this.bootstrapDefaults = options.bootstrapDefaults ?? {};
     this.accountOverrides = options.accountOverrides ?? {};
+    this.cliVersion = options.cliVersion ?? project.cdkDeps.cdkCliVersion;
   }
   /**
    * Resolve the `cdk deploy` options to use against a given target.
@@ -42292,6 +42296,49 @@ var import_projen26 = require("projen");
 var import_build = require("projen/lib/build");
 var import_github6 = require("projen/lib/github");
 var import_workflows_model5 = require("projen/lib/github/workflows-model");
+
+// src/workflows/deploy-gate.ts
+var DEPLOY_GATE = {
+  /**
+   * Hold each deploy job behind a GitHub environment so its protection rules —
+   * required reviewers, wait timers, deployment branch policies — apply before
+   * the job is sent to a runner.
+   */
+  ENVIRONMENT: "environment"
+};
+var resolveEnvironmentGate = (gate, environmentName, componentName) => {
+  const trimmed = environmentName?.trim();
+  if (gate === void 0) {
+    if (trimmed) {
+      throw new Error(
+        `${componentName} requires \`gate\` to be set when \`environmentName\` is supplied, got "${environmentName}" with no gate`
+      );
+    }
+    return void 0;
+  }
+  if (!trimmed) {
+    throw new Error(
+      `${componentName} requires a non-empty \`environmentName\` when \`gate\` is "${gate}"`
+    );
+  }
+  return trimmed;
+};
+
+// src/workflows/home-repository.ts
+var HOME_REPOSITORY_PATTERN = /^[A-Za-z0-9._-]+\/[A-Za-z0-9._-]+$/;
+var renderHomeRepositoryCondition = (homeRepository, componentName) => {
+  if (homeRepository === void 0) {
+    return void 0;
+  }
+  if (!HOME_REPOSITORY_PATTERN.test(homeRepository)) {
+    throw new Error(
+      `${componentName} requires \`homeRepository\` to be an \`owner/repo\` slug, got "${homeRepository}"`
+    );
+  }
+  return `github.repository == '${homeRepository}'`;
+};
+
+// src/workflows/aws-deploy-workflow.ts
 var PROD_DEPLOY_NAME = "prod-deploy";
 var DIFF_OUTPUT_FILE = "cdk-diff.txt";
 var DIFF_SUMMARY_BYTE_LIMIT = 9e5;
@@ -42418,17 +42465,18 @@ var AwsDeployWorkflow = class _AwsDeployWorkflow extends import_projen26.Compone
         awsDeploymentConfig
       } = target;
       const { roleArn, stackPattern } = ciDeploymentConfig ?? {};
-      const { rootCdkOut } = awsDeploymentConfig;
+      const { rootCdkOut, cdkCli } = awsDeploymentConfig;
       const deployJobName = this.buildJobName(target);
       return [
         ...this.setupPnpm(),
         ...this.setupNode(),
         /**
-         * Install CDK
+         * Install CDK, pinned to the same version that synthesized the cloud
+         * assembly being deployed. See {@link CdkCli.cliVersion}.
          */
         {
           name: "Install CDK",
-          run: "pnpm add aws-cdk"
+          run: `pnpm add "aws-cdk@${cdkCli.cliVersion}"`
         },
         /**
          * Configure AWS creds.
@@ -42448,8 +42496,8 @@ var AwsDeployWorkflow = class _AwsDeployWorkflow extends import_projen26.Compone
          */
         {
           name: `Deploy ${awsStageType}/${deploymentTargetRole}/${account}/${region}`,
-          run: `pnpm dlx aws-cdk ${renderCdkDeploy({
-            ...awsDeploymentConfig.cdkCli.deployOptionsFor(target),
+          run: `pnpm dlx "aws-cdk@${cdkCli.cliVersion}" ${renderCdkDeploy({
+            ...cdkCli.deployOptionsFor(target),
             app: rootCdkOut,
             stackPatterns: stackPattern ? [stackPattern] : void 0
           })} --outputs-file cdk-outputs.json`
@@ -42501,8 +42549,8 @@ var AwsDeployWorkflow = class _AwsDeployWorkflow extends import_projen26.Compone
      * Steps for a target's optional `cdk diff` job.
      *
      * Mirrors {@link deploySteps}' toolchain and credential setup — same pnpm /
-     * Node setup, same floating `aws-cdk` install, same OIDC role — so both jobs
-     * move together when the CLI version is pinned.
+     * Node setup, same version-pinned `aws-cdk` install, same OIDC role — so a
+     * diff is computed by the same CLI that will run the deploy.
      *
      * The `cdk diff` flags come from the {@link CdkCli} precedence chain via
      * `diffOptionsFor(target)`, so `method`, `securityOnly`, `fail`, and the rest
@@ -42522,7 +42570,7 @@ var AwsDeployWorkflow = class _AwsDeployWorkflow extends import_projen26.Compone
         awsDeploymentConfig
       } = target;
       const { roleArn, stackPattern } = ciDeploymentConfig ?? {};
-      const { rootCdkOut } = awsDeploymentConfig;
+      const { rootCdkOut, cdkCli } = awsDeploymentConfig;
       const label = `${awsStageType}/${deploymentTargetRole}/${account}/${region}`;
       const artifactName = this.buildDiffArtifactName(target);
       const capturedFileGuard = `always() && hashFiles('${DIFF_OUTPUT_FILE}') != ''`;
@@ -42531,11 +42579,12 @@ var AwsDeployWorkflow = class _AwsDeployWorkflow extends import_projen26.Compone
         ...this.setupPnpm(),
         ...this.setupNode(),
         /**
-         * Install CDK
+         * Install CDK, pinned to the same version that synthesized the cloud
+         * assembly being diffed. See {@link CdkCli.cliVersion}.
          */
         {
           name: "Install CDK",
-          run: "pnpm add aws-cdk"
+          run: `pnpm add "aws-cdk@${cdkCli.cliVersion}"`
         },
         /**
          * Configure AWS creds.
@@ -42559,8 +42608,8 @@ var AwsDeployWorkflow = class _AwsDeployWorkflow extends import_projen26.Compone
           shell: "bash",
           run: [
             "set -o pipefail",
-            `pnpm dlx aws-cdk ${renderCdkDiff({
-              ...awsDeploymentConfig.cdkCli.diffOptionsFor(target),
+            `pnpm dlx "aws-cdk@${cdkCli.cliVersion}" ${renderCdkDiff({
+              ...cdkCli.diffOptionsFor(target),
               app: rootCdkOut,
               ci: true,
               noColor: true,
@@ -42642,6 +42691,16 @@ var AwsDeployWorkflow = class _AwsDeployWorkflow extends import_projen26.Compone
       artifact: options.diff?.artifact ?? true,
       summary: options.diff?.summary ?? true
     };
+    this.environmentName = resolveEnvironmentGate(
+      options.gate,
+      options.environmentName,
+      "AwsDeployWorkflow"
+    );
+    this.homeRepository = options.homeRepository;
+    const homeRepositoryCondition = renderHomeRepositoryCondition(
+      this.homeRepository,
+      "AwsDeployWorkflow"
+    );
     if (options.buildWorkflow && options.buildWorkflowOptions) {
       throw new Error(
         "Cannot provide both buildWorkflow and buildWorkflowOptions"
@@ -42719,14 +42778,17 @@ var AwsDeployWorkflow = class _AwsDeployWorkflow extends import_projen26.Compone
       const branchFilterCondition = this.buildBranchFilterCondition(
         target.branches
       );
-      const jobCondition = branchFilterCondition ? "${{ " + [
+      const jobCondition = "${{ " + [
         "!needs.build.outputs.self_mutation_happened",
-        `(${branchFilterCondition})`
-      ].join(" && ") + " }}" : "${{ !needs.build.outputs.self_mutation_happened }}";
+        ...homeRepositoryCondition ? [homeRepositoryCondition] : [],
+        ...branchFilterCondition ? [`(${branchFilterCondition})`] : []
+      ].join(" && ") + " }}";
+      const gatedOnDiff = !!this.environmentName && this.diffOptions.enabled;
       this.buildWorkflow.addPostBuildJob(deployJobName, {
         name: `Deploy ${this.project.name} ${target.awsStageType}/${target.deploymentTargetRole}/${target.account}/${target.region}`,
         needs: [
           "build",
+          ...gatedOnDiff ? [this.buildDiffJobName(target)] : [],
           ...this.deployAfterTargets.map((p) => {
             return this.buildJobName(p);
           })
@@ -42737,6 +42799,7 @@ var AwsDeployWorkflow = class _AwsDeployWorkflow extends import_projen26.Compone
           idToken: import_workflows_model5.JobPermission.WRITE,
           pullRequests: import_workflows_model5.JobPermission.WRITE
         },
+        ...this.environmentName ? { environment: this.environmentName } : void 0,
         concurrency: deployJobName,
         if: jobCondition,
         steps: [...this.deploySteps(target)]
@@ -42817,7 +42880,8 @@ var AwsTeardownWorkflow = class extends import_projen27.Component {
       stageTypeTagName,
       environmentTypeTagName,
       branchNameTagName,
-      deleteBranchPatterns
+      deleteBranchPatterns,
+      homeRepository
     } = options;
     if (!repoTagName) {
       throw new Error("AwsTeardownWorkflow requires `repoTagName`");
@@ -42846,6 +42910,10 @@ var AwsTeardownWorkflow = class extends import_projen27.Component {
       deleteBranchPatterns,
       awsDestructionTargets
     );
+    const homeRepositoryCondition = renderHomeRepositoryCondition(
+      homeRepository,
+      "AwsTeardownWorkflow"
+    );
     const workflow = new import_github7.GithubWorkflow(github, "teardown-dev");
     workflow.on({
       workflowDispatch: {},
@@ -42872,6 +42940,7 @@ var AwsTeardownWorkflow = class extends import_projen27.Component {
         {
           name: `Teardown Stacks in ${awsStageType}/${deploymentTargetRole}/${account}/${region}`,
           runsOn: ["ubuntu-latest"],
+          ...homeRepositoryCondition ? { if: `\${{ ${homeRepositoryCondition} }}` } : {},
           permissions: {
             contents: import_workflows_model6.JobPermission.READ,
             idToken: import_workflows_model6.JobPermission.WRITE
@@ -43726,6 +43795,7 @@ export const collections = {
   DEFAULT_UNBLOCK_COMMENT_TEMPLATE,
   DEFAULT_UNBLOCK_DEPENDENTS_ENABLED,
   DEFAULT_UPSTREAM_CONFIGULATOR_ENABLED,
+  DEPLOY_GATE,
   DOCS_SYNC_AUDIT_SCHEMA_VERSION,
   GITHUB_ISSUE_TYPES,
   GITHUB_ISSUE_TYPE_BY_TITLE_PREFIX,
@@ -43906,6 +43976,7 @@ export const collections = {
   renderFocusSection,
   renderGithubIssueTypeSection,
   renderGithubIssueTypeSectionLines,
+  renderHomeRepositoryCondition,
   renderIssueTemplateLabelsCheckerScript,
   renderIssueTemplatesBundleHook,
   renderIssueTemplatesCheckerScript,
@@ -43955,6 +44026,7 @@ export const collections = {
   resolveBuildPolicy,
   resolveBundleAgentTiers,
   resolveDefaultAgentTier,
+  resolveEnvironmentGate,
   resolveIssueDefaults,
   resolveIssueTemplates,
   resolveModelAlias,