@codedrifters/configulator 0.0.423 → 0.0.425

package/lib/index.mjs

@@ -37596,6 +37596,7 @@ var CdkCli = class _CdkCli extends Component11 {
     this.diffDefaults = options.diffDefaults ?? {};
     this.bootstrapDefaults = options.bootstrapDefaults ?? {};
     this.accountOverrides = options.accountOverrides ?? {};
+    this.cliVersion = options.cliVersion ?? project.cdkDeps.cdkCliVersion;
   }
   /**
    * Resolve the `cdk deploy` options to use against a given target.
@@ -41930,6 +41931,49 @@ import { Component as Component22 } from "projen";
 import { BuildWorkflow } from "projen/lib/build";
 import { GitHub as GitHub5, WorkflowSteps as WorkflowSteps2 } from "projen/lib/github";
 import { JobPermission as JobPermission5 } from "projen/lib/github/workflows-model";
+
+// src/workflows/deploy-gate.ts
+var DEPLOY_GATE = {
+  /**
+   * Hold each deploy job behind a GitHub environment so its protection rules —
+   * required reviewers, wait timers, deployment branch policies — apply before
+   * the job is sent to a runner.
+   */
+  ENVIRONMENT: "environment"
+};
+var resolveEnvironmentGate = (gate, environmentName, componentName) => {
+  const trimmed = environmentName?.trim();
+  if (gate === void 0) {
+    if (trimmed) {
+      throw new Error(
+        `${componentName} requires \`gate\` to be set when \`environmentName\` is supplied, got "${environmentName}" with no gate`
+      );
+    }
+    return void 0;
+  }
+  if (!trimmed) {
+    throw new Error(
+      `${componentName} requires a non-empty \`environmentName\` when \`gate\` is "${gate}"`
+    );
+  }
+  return trimmed;
+};
+
+// src/workflows/home-repository.ts
+var HOME_REPOSITORY_PATTERN = /^[A-Za-z0-9._-]+\/[A-Za-z0-9._-]+$/;
+var renderHomeRepositoryCondition = (homeRepository, componentName) => {
+  if (homeRepository === void 0) {
+    return void 0;
+  }
+  if (!HOME_REPOSITORY_PATTERN.test(homeRepository)) {
+    throw new Error(
+      `${componentName} requires \`homeRepository\` to be an \`owner/repo\` slug, got "${homeRepository}"`
+    );
+  }
+  return `github.repository == '${homeRepository}'`;
+};
+
+// src/workflows/aws-deploy-workflow.ts
 var PROD_DEPLOY_NAME = "prod-deploy";
 var DIFF_OUTPUT_FILE = "cdk-diff.txt";
 var DIFF_SUMMARY_BYTE_LIMIT = 9e5;
@@ -42056,17 +42100,18 @@ var AwsDeployWorkflow = class _AwsDeployWorkflow extends Component22 {
         awsDeploymentConfig
       } = target;
       const { roleArn, stackPattern } = ciDeploymentConfig ?? {};
-      const { rootCdkOut } = awsDeploymentConfig;
+      const { rootCdkOut, cdkCli } = awsDeploymentConfig;
       const deployJobName = this.buildJobName(target);
       return [
         ...this.setupPnpm(),
         ...this.setupNode(),
         /**
-         * Install CDK
+         * Install CDK, pinned to the same version that synthesized the cloud
+         * assembly being deployed. See {@link CdkCli.cliVersion}.
          */
         {
           name: "Install CDK",
-          run: "pnpm add aws-cdk"
+          run: `pnpm add "aws-cdk@${cdkCli.cliVersion}"`
         },
         /**
          * Configure AWS creds.
@@ -42086,8 +42131,8 @@ var AwsDeployWorkflow = class _AwsDeployWorkflow extends Component22 {
          */
         {
           name: `Deploy ${awsStageType}/${deploymentTargetRole}/${account}/${region}`,
-          run: `pnpm dlx aws-cdk ${renderCdkDeploy({
-            ...awsDeploymentConfig.cdkCli.deployOptionsFor(target),
+          run: `pnpm dlx "aws-cdk@${cdkCli.cliVersion}" ${renderCdkDeploy({
+            ...cdkCli.deployOptionsFor(target),
             app: rootCdkOut,
             stackPatterns: stackPattern ? [stackPattern] : void 0
           })} --outputs-file cdk-outputs.json`
@@ -42139,8 +42184,8 @@ var AwsDeployWorkflow = class _AwsDeployWorkflow extends Component22 {
      * Steps for a target's optional `cdk diff` job.
      *
      * Mirrors {@link deploySteps}' toolchain and credential setup — same pnpm /
-     * Node setup, same floating `aws-cdk` install, same OIDC role — so both jobs
-     * move together when the CLI version is pinned.
+     * Node setup, same version-pinned `aws-cdk` install, same OIDC role — so a
+     * diff is computed by the same CLI that will run the deploy.
      *
      * The `cdk diff` flags come from the {@link CdkCli} precedence chain via
      * `diffOptionsFor(target)`, so `method`, `securityOnly`, `fail`, and the rest
@@ -42160,7 +42205,7 @@ var AwsDeployWorkflow = class _AwsDeployWorkflow extends Component22 {
         awsDeploymentConfig
       } = target;
       const { roleArn, stackPattern } = ciDeploymentConfig ?? {};
-      const { rootCdkOut } = awsDeploymentConfig;
+      const { rootCdkOut, cdkCli } = awsDeploymentConfig;
       const label = `${awsStageType}/${deploymentTargetRole}/${account}/${region}`;
       const artifactName = this.buildDiffArtifactName(target);
       const capturedFileGuard = `always() && hashFiles('${DIFF_OUTPUT_FILE}') != ''`;
@@ -42169,11 +42214,12 @@ var AwsDeployWorkflow = class _AwsDeployWorkflow extends Component22 {
         ...this.setupPnpm(),
         ...this.setupNode(),
         /**
-         * Install CDK
+         * Install CDK, pinned to the same version that synthesized the cloud
+         * assembly being diffed. See {@link CdkCli.cliVersion}.
          */
         {
           name: "Install CDK",
-          run: "pnpm add aws-cdk"
+          run: `pnpm add "aws-cdk@${cdkCli.cliVersion}"`
         },
         /**
          * Configure AWS creds.
@@ -42197,8 +42243,8 @@ var AwsDeployWorkflow = class _AwsDeployWorkflow extends Component22 {
           shell: "bash",
           run: [
             "set -o pipefail",
-            `pnpm dlx aws-cdk ${renderCdkDiff({
-              ...awsDeploymentConfig.cdkCli.diffOptionsFor(target),
+            `pnpm dlx "aws-cdk@${cdkCli.cliVersion}" ${renderCdkDiff({
+              ...cdkCli.diffOptionsFor(target),
               app: rootCdkOut,
               ci: true,
               noColor: true,
@@ -42280,6 +42326,16 @@ var AwsDeployWorkflow = class _AwsDeployWorkflow extends Component22 {
       artifact: options.diff?.artifact ?? true,
       summary: options.diff?.summary ?? true
     };
+    this.environmentName = resolveEnvironmentGate(
+      options.gate,
+      options.environmentName,
+      "AwsDeployWorkflow"
+    );
+    this.homeRepository = options.homeRepository;
+    const homeRepositoryCondition = renderHomeRepositoryCondition(
+      this.homeRepository,
+      "AwsDeployWorkflow"
+    );
     if (options.buildWorkflow && options.buildWorkflowOptions) {
       throw new Error(
         "Cannot provide both buildWorkflow and buildWorkflowOptions"
@@ -42357,14 +42413,17 @@ var AwsDeployWorkflow = class _AwsDeployWorkflow extends Component22 {
       const branchFilterCondition = this.buildBranchFilterCondition(
         target.branches
       );
-      const jobCondition = branchFilterCondition ? "${{ " + [
+      const jobCondition = "${{ " + [
         "!needs.build.outputs.self_mutation_happened",
-        `(${branchFilterCondition})`
-      ].join(" && ") + " }}" : "${{ !needs.build.outputs.self_mutation_happened }}";
+        ...homeRepositoryCondition ? [homeRepositoryCondition] : [],
+        ...branchFilterCondition ? [`(${branchFilterCondition})`] : []
+      ].join(" && ") + " }}";
+      const gatedOnDiff = !!this.environmentName && this.diffOptions.enabled;
       this.buildWorkflow.addPostBuildJob(deployJobName, {
         name: `Deploy ${this.project.name} ${target.awsStageType}/${target.deploymentTargetRole}/${target.account}/${target.region}`,
         needs: [
           "build",
+          ...gatedOnDiff ? [this.buildDiffJobName(target)] : [],
           ...this.deployAfterTargets.map((p) => {
             return this.buildJobName(p);
           })
@@ -42375,6 +42434,7 @@ var AwsDeployWorkflow = class _AwsDeployWorkflow extends Component22 {
           idToken: JobPermission5.WRITE,
           pullRequests: JobPermission5.WRITE
         },
+        ...this.environmentName ? { environment: this.environmentName } : void 0,
         concurrency: deployJobName,
         if: jobCondition,
         steps: [...this.deploySteps(target)]
@@ -42455,7 +42515,8 @@ var AwsTeardownWorkflow = class extends Component23 {
       stageTypeTagName,
       environmentTypeTagName,
       branchNameTagName,
-      deleteBranchPatterns
+      deleteBranchPatterns,
+      homeRepository
     } = options;
     if (!repoTagName) {
       throw new Error("AwsTeardownWorkflow requires `repoTagName`");
@@ -42484,6 +42545,10 @@ var AwsTeardownWorkflow = class extends Component23 {
       deleteBranchPatterns,
       awsDestructionTargets
     );
+    const homeRepositoryCondition = renderHomeRepositoryCondition(
+      homeRepository,
+      "AwsTeardownWorkflow"
+    );
     const workflow = new GithubWorkflow(github, "teardown-dev");
     workflow.on({
       workflowDispatch: {},
@@ -42510,6 +42575,7 @@ var AwsTeardownWorkflow = class extends Component23 {
         {
           name: `Teardown Stacks in ${awsStageType}/${deploymentTargetRole}/${account}/${region}`,
           runsOn: ["ubuntu-latest"],
+          ...homeRepositoryCondition ? { if: `\${{ ${homeRepositoryCondition} }}` } : {},
           permissions: {
             contents: JobPermission6.READ,
             idToken: JobPermission6.WRITE
@@ -43363,6 +43429,7 @@ export {
   DEFAULT_UNBLOCK_COMMENT_TEMPLATE,
   DEFAULT_UNBLOCK_DEPENDENTS_ENABLED,
   DEFAULT_UPSTREAM_CONFIGULATOR_ENABLED,
+  DEPLOY_GATE,
   DOCS_SYNC_AUDIT_SCHEMA_VERSION,
   GITHUB_ISSUE_TYPES,
   GITHUB_ISSUE_TYPE_BY_TITLE_PREFIX,
@@ -43543,6 +43610,7 @@ export {
   renderFocusSection,
   renderGithubIssueTypeSection,
   renderGithubIssueTypeSectionLines,
+  renderHomeRepositoryCondition,
   renderIssueTemplateLabelsCheckerScript,
   renderIssueTemplatesBundleHook,
   renderIssueTemplatesCheckerScript,
@@ -43592,6 +43660,7 @@ export {
   resolveBuildPolicy,
   resolveBundleAgentTiers,
   resolveDefaultAgentTier,
+  resolveEnvironmentGate,
   resolveIssueDefaults,
   resolveIssueTemplates,
   resolveModelAlias,