@codedrifters/configulator 0.0.428 → 0.0.429

package/lib/index.mjs

@@ -41927,61 +41927,15 @@ import { merge as merge4 } from "ts-deepmerge";
 
 // src/workflows/aws-deploy-workflow.ts
 var import_utils11 = __toESM(require_lib());
-import { Component as Component22 } from "projen";
+import { Component as Component24 } from "projen";
 import { BuildWorkflow } from "projen/lib/build";
-import { GitHub as GitHub5, GithubWorkflow, WorkflowSteps as WorkflowSteps2 } from "projen/lib/github";
-import { JobPermission as JobPermission5 } from "projen/lib/github/workflows-model";
-
-// src/workflows/deploy-gate.ts
-var DEPLOY_GATE = {
-  /**
-   * Hold each deploy job behind a GitHub environment so its protection rules —
-   * required reviewers, wait timers, deployment branch policies — apply before
-   * the job is sent to a runner.
-   */
-  ENVIRONMENT: "environment",
-  /**
-   * Split the workflow in two. A **plan** workflow builds and diffs but never
-   * deploys; a dispatch-only **apply** workflow deploys the exact cloud
-   * assembly a nominated plan run produced.
-   *
-   * Needs no protection rule, so unlike {@link DEPLOY_GATE.ENVIRONMENT} it
-   * works on every GitHub plan. `environmentName` is optional here and layers
-   * an environment onto the apply jobs.
-   */
-  PLAN_APPLY: "plan-apply"
-};
-var resolveEnvironmentGate = (gate, environmentName, componentName) => {
-  const trimmed = environmentName?.trim();
-  if (gate === void 0) {
-    if (trimmed) {
-      throw new Error(
-        `${componentName} requires \`gate\` to be set when \`environmentName\` is supplied, got "${environmentName}" with no gate`
-      );
-    }
-    return void 0;
-  }
-  if (gate === DEPLOY_GATE.ENVIRONMENT && !trimmed) {
-    throw new Error(
-      `${componentName} requires a non-empty \`environmentName\` when \`gate\` is "${gate}"`
-    );
-  }
-  return trimmed;
-};
+import { GitHub as GitHub6, WorkflowSteps as WorkflowSteps2 } from "projen/lib/github";
+import { JobPermission as JobPermission6 } from "projen/lib/github/workflows-model";
 
-// src/workflows/home-repository.ts
-var HOME_REPOSITORY_PATTERN = /^[A-Za-z0-9._-]+\/[A-Za-z0-9._-]+$/;
-var renderHomeRepositoryCondition = (homeRepository, componentName) => {
-  if (homeRepository === void 0) {
-    return void 0;
-  }
-  if (!HOME_REPOSITORY_PATTERN.test(homeRepository)) {
-    throw new Error(
-      `${componentName} requires \`homeRepository\` to be an \`owner/repo\` slug, got "${homeRepository}"`
-    );
-  }
-  return `github.repository == '${homeRepository}'`;
-};
+// src/workflows/apply-workflow.ts
+import { Component as Component22 } from "projen";
+import { GithubWorkflow } from "projen/lib/github";
+import { JobPermission as JobPermission5 } from "projen/lib/github/workflows-model";
 
 // src/workflows/plan-apply.ts
 var VALIDATE_PLAN_JOB_ID = "validate-plan";
@@ -42082,11 +42036,244 @@ var renderPlanValidationScript = (options) => {
   ].join("\n");
 };
 
+// src/workflows/apply-workflow.ts
+var ApplyWorkflow = class _ApplyWorkflow extends Component22 {
+  constructor(project, github, options) {
+    super(project);
+    /**
+     * Every attached component's targets, in attach order. Held as targets rather
+     * than branches because `AwsDeploymentTarget.branches` is mutable — the
+     * branch union is read at `preSynthesize`, once every component has attached.
+     */
+    this.attachedTargets = [];
+    /**
+     * Attach another component's apply jobs to this workflow.
+     *
+     * Every setting the shared `validate-plan` job bakes in must match what the
+     * workflow was created with — there is one validation job for the whole file,
+     * so a disagreement cannot be honoured and is rejected rather than resolved
+     * in favour of whichever component happened to be constructed first.
+     */
+    this.attach = (options) => {
+      const { componentName } = options;
+      const name = this.workflow.name;
+      if (options.planWorkflowName !== this.contract.planWorkflowName) {
+        throw new Error(
+          `${componentName} cannot attach to the apply workflow "${name}": it plans from build workflow "${options.planWorkflowName}", but that apply workflow only accepts runs of "${this.contract.planWorkflowName}". Every component sharing an apply workflow must share one build workflow.`
+        );
+      }
+      this.requireAgreement(
+        componentName,
+        "requireCurrentHead",
+        options.requireCurrentHead,
+        this.contract.requireCurrentHead
+      );
+      this.requireAgreement(
+        componentName,
+        "verifyArtifactDigest",
+        options.verifyArtifactDigest,
+        this.contract.verifyArtifactDigest
+      );
+      this.attachedTargets.push(...options.awsDeploymentTargets);
+    };
+    /**
+     * Reject a boolean `planApply` setting that differs from the one this
+     * workflow was created with.
+     */
+    this.requireAgreement = (componentName, option, supplied, expected) => {
+      if (supplied === expected) {
+        return;
+      }
+      throw new Error(
+        `${componentName} cannot attach to the apply workflow "${this.workflow.name}": \`planApply.${option}\` is ${supplied} here and ${expected} on the components already attached. The setting is baked into the one shared \`${VALIDATE_PLAN_JOB_ID}\` job, so every component sharing an apply workflow must agree on it.`
+      );
+    };
+    /**
+     * Render the validation job every apply job depends on.
+     *
+     * `allowedBranches` is the union of every attached target's branches, deduped
+     * and left in attach order. The apply run's own `github.ref` says nothing
+     * about what was planned, so the list is checked against the *plan run's*
+     * `head_branch` rather than against a workflow-level branch filter.
+     */
+    this.renderValidateJob = () => {
+      const { planWorkflowName, requireCurrentHead, verifyArtifactDigest } = this.contract;
+      const allowedBranches = Array.from(
+        new Set(
+          this.attachedTargets.flatMap(
+            (target) => target.branches.map((b) => b.branch)
+          )
+        )
+      );
+      return {
+        name: "Validate plan run",
+        runsOn: ["ubuntu-latest"],
+        permissions: {
+          actions: JobPermission5.READ,
+          contents: JobPermission5.READ
+        },
+        ...this.homeRepositoryCondition ? { if: `\${{ ${this.homeRepositoryCondition} }}` } : {},
+        outputs: {
+          head_sha: { stepId: "validate_plan_run", outputName: "head_sha" },
+          head_branch: { stepId: "validate_plan_run", outputName: "head_branch" },
+          ...verifyArtifactDigest ? {
+            artifact_digest: {
+              stepId: "validate_plan_run",
+              outputName: "artifact_digest"
+            }
+          } : {}
+        },
+        steps: [
+          {
+            name: "Validate plan run",
+            id: "validate_plan_run",
+            uses: "actions/github-script@v9",
+            /**
+             * The dispatch input reaches the script through the environment
+             * rather than a `${{ }}` interpolation, so a crafted run id cannot
+             * inject JavaScript into the validation itself.
+             */
+            env: {
+              PLAN_RUN_ID: `\${{ inputs.${PLAN_RUN_ID_INPUT} }}`
+            },
+            with: {
+              script: renderPlanValidationScript({
+                planWorkflowPath: `.github/workflows/${planWorkflowName}.yml`,
+                allowedBranches,
+                requireCurrentHead,
+                verifyArtifactDigest
+              })
+            }
+          }
+        ]
+      };
+    };
+    const { applyWorkflowName } = options;
+    if (github.tryFindWorkflow(applyWorkflowName)) {
+      throw new Error(
+        `${options.componentName} cannot create the apply workflow "${applyWorkflowName}" because a workflow with that name already exists. Set \`planApply.applyWorkflow\` to share the existing one, or \`planApply.applyWorkflowName\` to something unique.`
+      );
+    }
+    this.contract = {
+      planWorkflowName: options.planWorkflowName,
+      requireCurrentHead: options.requireCurrentHead,
+      verifyArtifactDigest: options.verifyArtifactDigest
+    };
+    this.homeRepositoryCondition = options.homeRepositoryCondition;
+    this.attachedTargets.push(...options.awsDeploymentTargets);
+    this.workflow = new GithubWorkflow(github, applyWorkflowName);
+    this.workflow.on({
+      workflowDispatch: {
+        inputs: {
+          [PLAN_RUN_ID_INPUT]: {
+            description: "Run id of the plan workflow run to apply. Its build artifact is deployed verbatim.",
+            required: true,
+            type: "string"
+          }
+        }
+      }
+    });
+    this.workflow.addJob(VALIDATE_PLAN_JOB_ID, this.renderValidateJob());
+  }
+  static of(project, workflow) {
+    const isDefined = (c) => c instanceof _ApplyWorkflow && c.workflow === workflow;
+    return project.components.find(isDefined);
+  }
+  preSynthesize() {
+    this.workflow.updateJob(VALIDATE_PLAN_JOB_ID, this.renderValidateJob());
+    super.preSynthesize();
+  }
+};
+
+// src/workflows/deploy-gate.ts
+var DEPLOY_GATE = {
+  /**
+   * Hold each deploy job behind a GitHub environment so its protection rules —
+   * required reviewers, wait timers, deployment branch policies — apply before
+   * the job is sent to a runner.
+   */
+  ENVIRONMENT: "environment",
+  /**
+   * Split the workflow in two. A **plan** workflow builds and diffs but never
+   * deploys; a dispatch-only **apply** workflow deploys the exact cloud
+   * assembly a nominated plan run produced.
+   *
+   * Needs no protection rule, so unlike {@link DEPLOY_GATE.ENVIRONMENT} it
+   * works on every GitHub plan. `environmentName` is optional here and layers
+   * an environment onto the apply jobs.
+   */
+  PLAN_APPLY: "plan-apply"
+};
+var resolveEnvironmentGate = (gate, environmentName, componentName) => {
+  const trimmed = environmentName?.trim();
+  if (gate === void 0) {
+    if (trimmed) {
+      throw new Error(
+        `${componentName} requires \`gate\` to be set when \`environmentName\` is supplied, got "${environmentName}" with no gate`
+      );
+    }
+    return void 0;
+  }
+  if (gate === DEPLOY_GATE.ENVIRONMENT && !trimmed) {
+    throw new Error(
+      `${componentName} requires a non-empty \`environmentName\` when \`gate\` is "${gate}"`
+    );
+  }
+  return trimmed;
+};
+
+// src/workflows/home-repository.ts
+import { Component as Component23 } from "projen";
+var HOME_REPOSITORY_PATTERN = /^[A-Za-z0-9._-]+\/[A-Za-z0-9._-]+$/;
+var renderHomeRepositoryCondition = (homeRepository, componentName) => {
+  if (homeRepository === void 0) {
+    return void 0;
+  }
+  if (!HOME_REPOSITORY_PATTERN.test(homeRepository)) {
+    throw new Error(
+      `${componentName} requires \`homeRepository\` to be an \`owner/repo\` slug, got "${homeRepository}"`
+    );
+  }
+  return `github.repository == '${homeRepository}'`;
+};
+var describePin = (homeRepository) => homeRepository === void 0 ? "unset" : `"${homeRepository}"`;
+var WorkflowHomeRepository = class _WorkflowHomeRepository extends Component23 {
+  static of(project, workflow) {
+    const isDefined = (c) => c instanceof _WorkflowHomeRepository && c.workflow === workflow;
+    return project.components.find(isDefined);
+  }
+  /**
+   * Record a pin against a workflow, throwing when it disagrees with what an
+   * earlier component declared for the same one.
+   *
+   * @param project - Project the record is attached to. Use the root project,
+   * so components on sibling sub-projects find each other.
+   */
+  static require(project, options) {
+    const { workflow, workflowName, homeRepository, componentName } = options;
+    const existing = _WorkflowHomeRepository.of(project, workflow);
+    if (!existing) {
+      return new _WorkflowHomeRepository(project, options);
+    }
+    if (existing.homeRepository !== homeRepository) {
+      throw new Error(
+        `${componentName} requires every component sharing the workflow "${workflowName}" to declare the same \`homeRepository\`, got ${describePin(homeRepository)} here and ${describePin(existing.homeRepository)} already declared. The pin guards every job in one workflow file, so it cannot differ between them.`
+      );
+    }
+    return existing;
+  }
+  constructor(project, options) {
+    super(project);
+    this.workflow = options.workflow;
+    this.homeRepository = options.homeRepository;
+  }
+};
+
 // src/workflows/aws-deploy-workflow.ts
 var PROD_DEPLOY_NAME = "prod-deploy";
 var DIFF_OUTPUT_FILE = "cdk-diff.txt";
 var DIFF_SUMMARY_BYTE_LIMIT = 9e5;
-var AwsDeployWorkflow = class _AwsDeployWorkflow extends Component22 {
+var AwsDeployWorkflow = class _AwsDeployWorkflow extends Component24 {
   constructor(project, options = {}) {
     super(project);
     this.project = project;
@@ -42186,83 +42373,28 @@ var AwsDeployWorkflow = class _AwsDeployWorkflow extends Component22 {
       ].join("-");
     };
     /**
-     * Create the dispatch-only apply workflow and its validation job.
+     * Join an apply workflow another `AwsDeployWorkflow` already created, so this
+     * component's apply jobs land in that file rather than a second one.
      *
-     * The workflow file name defaults to the plan workflow's name suffixed with
-     * `-apply`. A name already in use throws rather than silently colliding on
-     * the underlying `.github/workflows/<name>.yml` file — the usual cause is two
-     * `AwsDeployWorkflow`s sharing one build workflow, and the fix is an explicit
-     * `planApply.applyWorkflowName`.
+     * Rejects a `GithubWorkflow` that is not an apply workflow: attaching to an
+     * arbitrary one would add apply jobs depending on a `validate-plan` job that
+     * does not exist there, which GitHub rejects only at run time.
      */
-    this.createApplyWorkflow = (github, homeRepositoryCondition) => {
-      const { applyWorkflowName, requireCurrentHead, verifyArtifactDigest } = this.planApplyOptions;
-      if (github.tryFindWorkflow(applyWorkflowName)) {
+    this.attachApplyWorkflow = (workflow) => {
+      const shared = ApplyWorkflow.of(this.rootProject, workflow);
+      if (!shared) {
         throw new Error(
-          `AwsDeployWorkflow cannot create the apply workflow "${applyWorkflowName}" because a workflow with that name already exists. Set \`planApply.applyWorkflowName\` to something unique.`
+          `AwsDeployWorkflow cannot attach to the workflow "${workflow.name}" because it is not an apply workflow. Pass the \`applyWorkflow\` of an AwsDeployWorkflow built with the \`plan-apply\` gate.`
         );
       }
-      const workflow = new GithubWorkflow(github, applyWorkflowName);
-      workflow.on({
-        workflowDispatch: {
-          inputs: {
-            [PLAN_RUN_ID_INPUT]: {
-              description: "Run id of the plan workflow run to apply. Its build artifact is deployed verbatim.",
-              required: true,
-              type: "string"
-            }
-          }
-        }
-      });
-      const allowedBranches = Array.from(
-        new Set(
-          this.awsDeploymentTargets.flatMap(
-            (target) => target.branches.map((b) => b.branch)
-          )
-        )
-      );
-      workflow.addJob(VALIDATE_PLAN_JOB_ID, {
-        name: "Validate plan run",
-        runsOn: ["ubuntu-latest"],
-        permissions: {
-          actions: JobPermission5.READ,
-          contents: JobPermission5.READ
-        },
-        ...homeRepositoryCondition ? { if: `\${{ ${homeRepositoryCondition} }}` } : {},
-        outputs: {
-          head_sha: { stepId: "validate_plan_run", outputName: "head_sha" },
-          head_branch: { stepId: "validate_plan_run", outputName: "head_branch" },
-          ...verifyArtifactDigest ? {
-            artifact_digest: {
-              stepId: "validate_plan_run",
-              outputName: "artifact_digest"
-            }
-          } : {}
-        },
-        steps: [
-          {
-            name: "Validate plan run",
-            id: "validate_plan_run",
-            uses: "actions/github-script@v9",
-            /**
-             * The dispatch input reaches the script through the environment
-             * rather than a `${{ }}` interpolation, so a crafted run id cannot
-             * inject JavaScript into the validation itself.
-             */
-            env: {
-              PLAN_RUN_ID: `\${{ inputs.${PLAN_RUN_ID_INPUT} }}`
-            },
-            with: {
-              script: renderPlanValidationScript({
-                planWorkflowPath: `.github/workflows/${this.buildWorkflow.name}.yml`,
-                allowedBranches,
-                requireCurrentHead,
-                verifyArtifactDigest
-              })
-            }
-          }
-        ]
+      shared.attach({
+        planWorkflowName: this.buildWorkflow.name,
+        requireCurrentHead: this.planApplyOptions.requireCurrentHead,
+        verifyArtifactDigest: this.planApplyOptions.verifyArtifactDigest,
+        awsDeploymentTargets: this.awsDeploymentTargets,
+        componentName: "AwsDeployWorkflow"
       });
-      return workflow;
+      return shared;
     };
     /**
      * Register one target's apply job on the apply workflow.
@@ -42297,9 +42429,9 @@ var AwsDeployWorkflow = class _AwsDeployWorkflow extends Component22 {
         ],
         runsOn: ["ubuntu-latest"],
         permissions: {
-          actions: JobPermission5.READ,
-          contents: JobPermission5.READ,
-          idToken: JobPermission5.WRITE
+          actions: JobPermission6.READ,
+          contents: JobPermission6.READ,
+          idToken: JobPermission6.WRITE
         },
         ...this.environmentName ? { environment: this.environmentName } : void 0,
         /**
@@ -42582,7 +42714,7 @@ var AwsDeployWorkflow = class _AwsDeployWorkflow extends Component22 {
       );
     }
     this.rootProject = project.root;
-    const github = GitHub5.of(this.rootProject);
+    const github = GitHub6.of(this.rootProject);
     if (!github) {
       throw new Error(
         "AwsDeployWorkflow requires a GitHub component in the root project"
@@ -42689,16 +42821,40 @@ var AwsDeployWorkflow = class _AwsDeployWorkflow extends Component22 {
         ...buildWorkflowOptions?.preBuildSteps ?? []
       ]
     });
+    WorkflowHomeRepository.require(this.rootProject, {
+      workflow: this.buildWorkflow,
+      workflowName: this.buildWorkflow.name,
+      homeRepository: this.homeRepository,
+      componentName: "AwsDeployWorkflow"
+    });
+    const sharedApplyWorkflow = options.planApply?.applyWorkflow;
+    if (sharedApplyWorkflow && options.planApply?.applyWorkflowName) {
+      throw new Error(
+        "Cannot provide both planApply.applyWorkflow and planApply.applyWorkflowName: the workflow being joined already has a name."
+      );
+    }
     this.planApplyOptions = {
-      applyWorkflowName: options.planApply?.applyWorkflowName ?? `${this.buildWorkflow.name}-apply`,
+      applyWorkflowName: sharedApplyWorkflow?.name ?? options.planApply?.applyWorkflowName ?? `${this.buildWorkflow.name}-apply`,
       requireCurrentHead: options.planApply?.requireCurrentHead ?? false,
       verifyArtifactDigest: options.planApply?.verifyArtifactDigest ?? false
     };
     if (isPlanApply) {
-      this.applyWorkflow = this.createApplyWorkflow(
-        github,
-        homeRepositoryCondition
-      );
+      const applyWorkflow = sharedApplyWorkflow ? this.attachApplyWorkflow(sharedApplyWorkflow) : new ApplyWorkflow(this.rootProject, github, {
+        applyWorkflowName: this.planApplyOptions.applyWorkflowName,
+        planWorkflowName: this.buildWorkflow.name,
+        requireCurrentHead: this.planApplyOptions.requireCurrentHead,
+        verifyArtifactDigest: this.planApplyOptions.verifyArtifactDigest,
+        homeRepositoryCondition,
+        awsDeploymentTargets: this.awsDeploymentTargets,
+        componentName: "AwsDeployWorkflow"
+      });
+      this.applyWorkflow = applyWorkflow.workflow;
+      WorkflowHomeRepository.require(this.rootProject, {
+        workflow: applyWorkflow.workflow,
+        workflowName: this.planApplyOptions.applyWorkflowName,
+        homeRepository: this.homeRepository,
+        componentName: "AwsDeployWorkflow"
+      });
     }
     this.awsDeploymentTargets.forEach((target) => {
       const deployJobName = this.buildJobName(target);
@@ -42725,9 +42881,9 @@ var AwsDeployWorkflow = class _AwsDeployWorkflow extends Component22 {
           ],
           runsOn: ["ubuntu-latest"],
           permissions: {
-            contents: JobPermission5.READ,
-            idToken: JobPermission5.WRITE,
-            pullRequests: JobPermission5.WRITE
+            contents: JobPermission6.READ,
+            idToken: JobPermission6.WRITE,
+            pullRequests: JobPermission6.WRITE
           },
           ...this.environmentName ? { environment: this.environmentName } : void 0,
           concurrency: deployJobName,
@@ -42742,8 +42898,8 @@ var AwsDeployWorkflow = class _AwsDeployWorkflow extends Component22 {
           needs: ["build"],
           runsOn: ["ubuntu-latest"],
           permissions: {
-            contents: JobPermission5.READ,
-            idToken: JobPermission5.WRITE
+            contents: JobPermission6.READ,
+            idToken: JobPermission6.WRITE
           },
           if: jobCondition,
           steps: [...this.diffSteps(target)]
@@ -42779,9 +42935,9 @@ var AwsDeployWorkflow = class _AwsDeployWorkflow extends Component22 {
 };
 
 // src/workflows/aws-teardown-workflow.ts
-import { Component as Component23 } from "projen";
-import { GitHub as GitHub6, GithubWorkflow as GithubWorkflow2 } from "projen/lib/github";
-import { JobPermission as JobPermission6 } from "projen/lib/github/workflows-model";
+import { Component as Component25 } from "projen";
+import { GitHub as GitHub7, GithubWorkflow as GithubWorkflow3 } from "projen/lib/github";
+import { JobPermission as JobPermission7 } from "projen/lib/github/workflows-model";
 var DEFAULT_TEARDOWN_BRANCH_PATTERNS = [
   "feat/*",
   "fix/*",
@@ -42801,7 +42957,7 @@ var resolveBranchPatterns = (explicit, targets) => {
   }
   return [...DEFAULT_TEARDOWN_BRANCH_PATTERNS];
 };
-var AwsTeardownWorkflow = class extends Component23 {
+var AwsTeardownWorkflow = class extends Component25 {
   constructor(rootProject, options) {
     super(rootProject);
     this.rootProject = rootProject;
@@ -42831,7 +42987,7 @@ var AwsTeardownWorkflow = class extends Component23 {
         "AwsTeardownWorkflow requires the root project to be a MonorepoProject"
       );
     }
-    const github = GitHub6.of(this.rootProject);
+    const github = GitHub7.of(this.rootProject);
     if (!github) {
       throw new Error(
         "AwsTeardownWorkflow requires a GitHub component in the root project"
@@ -42845,7 +43001,7 @@ var AwsTeardownWorkflow = class extends Component23 {
       homeRepository,
       "AwsTeardownWorkflow"
     );
-    const workflow = new GithubWorkflow2(github, "teardown-dev");
+    const workflow = new GithubWorkflow3(github, "teardown-dev");
     workflow.on({
       workflowDispatch: {},
       schedule: [
@@ -42873,8 +43029,8 @@ var AwsTeardownWorkflow = class extends Component23 {
           runsOn: ["ubuntu-latest"],
           ...homeRepositoryCondition ? { if: `\${{ ${homeRepositoryCondition} }}` } : {},
           permissions: {
-            contents: JobPermission6.READ,
-            idToken: JobPermission6.WRITE
+            contents: JobPermission7.READ,
+            idToken: JobPermission7.WRITE
           },
           env: {
             REPO: "${{ github.repository }}",
@@ -43638,6 +43794,7 @@ export {
   AUDIT_CATEGORY_ORDER,
   AgentConfig,
   ApiExtractor,
+  ApplyWorkflow,
   AstroConfig,
   AstroOutput,
   AstroProject,
@@ -43792,6 +43949,7 @@ export {
   VERSION_NPM_PACKAGES,
   VSCodeConfig,
   Vitest,
+  WorkflowHomeRepository,
   addApproveMergeUpgradeWorkflow,
   addBuildCompleteJob,
   addPlaywright,