@codedrifters/configulator 0.0.430 → 0.0.432

package/lib/index.mjs

@@ -42230,6 +42230,7 @@ var DIFF_REPORT_JOB_ID = "diff-report";
 var DIFF_OUTPUT_DIRECTORY = "cdk-diff";
 var DIFF_PART_ARTIFACT_PREFIX = "cdk-diff-part";
 var DIFF_ARTIFACT_NAME = "cdk-diff";
+var DIFF_NEW_STACK_MARKER = "NEW STACK";
 var DIFF_PART_RETENTION_DAYS = 1;
 var DIFF_SUMMARY_BYTE_LIMIT = 9e5;
 var RUN_URL = "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}";
@@ -42305,6 +42306,11 @@ var DiffReportJob = class _DiffReportJob extends Component23 {
      * captured anything from one that simply had no changes — the latter has a
      * file, carrying the CDK CLI's own no-differences wording, rather than being
      * detected by matching on it.
+     *
+     * A capture carrying {@link DIFF_NEW_STACK_MARKER} lines has its banners
+     * lifted out of the `<details>` block and quoted under the heading, so a
+     * target that will be created from scratch reads as such without expanding
+     * anything.
      */
     this.renderSummaryStep = () => {
       if (!this.summary || this.targets.length === 0) {
@@ -42329,6 +42335,10 @@ var DiffReportJob = class _DiffReportJob extends Component23 {
             '      echo ""',
             "      continue",
             "    fi",
+            `    if grep -q '^${DIFF_NEW_STACK_MARKER}' "$file"; then`,
+            `      grep '^${DIFF_NEW_STACK_MARKER}' "$file" | sed 's/^/> **/; s/$/**/'`,
+            '      echo ""',
+            "    fi",
             "    echo '<details><summary>cdk diff output</summary>'",
             '    echo ""',
             "    echo '```'",
@@ -42548,6 +42558,7 @@ var renderSetupPnpm = (pnpmVersion) => {
 
 // src/workflows/aws-deploy-workflow.ts
 var PROD_DEPLOY_NAME = "prod-deploy";
+var BRANCH_NAME_EXPRESSION = "${{ github.head_ref || github.ref_name }}";
 var AwsDeployWorkflow = class _AwsDeployWorkflow extends Component25 {
   constructor(project, options = {}) {
     super(project);
@@ -42578,6 +42589,28 @@ var AwsDeployWorkflow = class _AwsDeployWorkflow extends Component25 {
         target.region
       ].join("-");
     };
+    /**
+     * Build a deploy job's `concurrency` setting from its job name.
+     *
+     * Two shapes, deliberately:
+     *
+     * - Unscoped (the default) stays the bare string the job has always carried,
+     *   so an existing consumer's workflow is byte-identical.
+     * - Branch-scoped spells out `cancel-in-progress: false` rather than leaning
+     *   on GitHub's default, the same way the apply job does. A group keyed on
+     *   the branch reads like a "cancel superseded pushes" group, and that is the
+     *   one thing it must not be — cancelling a half-finished `cdk deploy`
+     *   strands a CloudFormation stack mid-update.
+     */
+    this.buildDeployConcurrency = (deployJobName) => {
+      if (!this.branchScopedConcurrency) {
+        return deployJobName;
+      }
+      return {
+        group: `${deployJobName}-${BRANCH_NAME_EXPRESSION}`,
+        "cancel-in-progress": false
+      };
+    };
     /**
      * Build the deterministic GitHub Actions job name for a target's apply job.
      * Mirrors {@link buildJobName} with an `apply` verb.
@@ -42707,6 +42740,13 @@ var AwsDeployWorkflow = class _AwsDeployWorkflow extends Component25 {
          * same-target deploy. `cancel-in-progress` is spelled out rather than
          * left to GitHub's default: cancelling a half-finished `cdk deploy`
          * strands a CloudFormation stack mid-update.
+         *
+         * `branchScopedConcurrency` deliberately does not reach here. An apply is
+         * dispatched from whatever ref the operator happens to be on — unrelated
+         * to the branch the nominated plan ran against, which is the only branch
+         * that describes what is about to be deployed. Keying on the dispatch ref
+         * would hand out separate locks to applies of the same target, so the
+         * unsuffixed group stays.
          */
         concurrency: {
           group: this.buildJobName(target),
@@ -42876,6 +42916,11 @@ var AwsDeployWorkflow = class _AwsDeployWorkflow extends Component25 {
      * `app` and `stackPatterns` target the built cloud assembly, and `ci` /
      * `noColor` force the human-readable diff onto stdout without ANSI escapes
      * (without `--ci` the CLI interleaves it into stderr alongside logs).
+     *
+     * `method` is the one resolved flag not baked into the rendered command. A
+     * from-scratch target has to be classified before it can be diffed — see
+     * {@link diffProbeLines} — so the command reads the effective method from
+     * `$method`.
      */
     this.diffSteps = (target) => {
       const {
@@ -42890,6 +42935,20 @@ var AwsDeployWorkflow = class _AwsDeployWorkflow extends Component25 {
       const { rootCdkOut, cdkCli } = awsDeploymentConfig;
       const label = `${awsStageType}/${deploymentTargetRole}/${account}/${region}`;
       const outputFile = this.buildDiffOutputFile(target);
+      const stackPatterns = stackPattern ? [stackPattern] : void 0;
+      const diffCommand = [
+        `pnpm dlx "aws-cdk@${cdkCli.cliVersion}"`,
+        renderCdkDiff({
+          ...cdkCli.diffOptionsFor(target),
+          app: rootCdkOut,
+          ci: true,
+          noColor: true,
+          method: void 0,
+          stackPatterns: void 0
+        }),
+        '--method="$method"',
+        ...(stackPatterns ?? []).map((pattern) => `"${pattern}"`)
+      ].join(" ");
       return [
         ...this.setupPnpm(),
         ...this.setupNode(),
@@ -42907,11 +42966,14 @@ var AwsDeployWorkflow = class _AwsDeployWorkflow extends Component25 {
           }
         },
         /**
-         * Run CDK Diff, capturing the output while leaving it visible in the job
-         * log. `pipefail` keeps the CLI's exit code from being masked by `tee`.
+         * Classify the target's stacks, then run CDK Diff, capturing the output
+         * while leaving it visible in the job log. `pipefail` keeps the CLI's
+         * exit code from being masked by `tee`.
          *
          * The capture lands under the same path the report job will merge it
-         * back to, so a target's file name is identical in both places.
+         * back to, so a target's file name is identical in both places. It is
+         * truncated first and appended to from there, so a re-run never reads a
+         * previous attempt's banners.
          */
         {
           name: `Diff ${label}`,
@@ -42919,13 +42981,9 @@ var AwsDeployWorkflow = class _AwsDeployWorkflow extends Component25 {
           run: [
             "set -o pipefail",
             `mkdir -p ${DIFF_OUTPUT_DIRECTORY}`,
-            `pnpm dlx "aws-cdk@${cdkCli.cliVersion}" ${renderCdkDiff({
-              ...cdkCli.diffOptionsFor(target),
-              app: rootCdkOut,
-              ci: true,
-              noColor: true,
-              stackPatterns: stackPattern ? [stackPattern] : void 0
-            })} 2>&1 | tee ${outputFile}`
+            `: > ${outputFile}`,
+            ...this.diffProbeLines(target, outputFile),
+            `${diffCommand} 2>&1 | tee -a ${outputFile}`
           ].join("\n")
         },
         /**
@@ -42941,6 +42999,70 @@ var AwsDeployWorkflow = class _AwsDeployWorkflow extends Component25 {
         })
       ];
     };
+    /**
+     * Lines that classify every stack a target's pattern matches before the diff
+     * runs, so a stack that will be created from scratch is reported as such
+     * instead of failing the job.
+     *
+     * `cdk diff --method=change-set` asks CloudFormation for an `UPDATE` change
+     * set whenever the stack exists — and a `ROLLBACK_COMPLETE` /
+     * `ROLLBACK_FAILED` tombstone left by a failed first create does exist, so
+     * CloudFormation rejects the request and the job goes red. `cdk deploy`
+     * consults `stackStatus.isCreationFailure`, deletes the tombstone and
+     * recreates the stack, so the apply succeeds on exactly the stack the diff
+     * refuses to look at. Under the `plan-apply` gate that asymmetry is a hard
+     * blocker rather than a cosmetic one: the apply requires a successful plan
+     * run, so one from-scratch target blocks applying any plan for the stage.
+     *
+     * `cdk list --long --json` resolves the pattern to CloudFormation stack names
+     * out of the built assembly's manifest — no synth, no cloud call — and each
+     * name costs one `describe-stacks`, which needs only
+     * `cloudformation:DescribeStacks`. Any role that can run a change-set diff
+     * already carries it. A `cdk list` that fails contributes no names, leaving
+     * the diff to run exactly as it does today.
+     *
+     * A genuinely absent stack keeps the configured method — CDK gives it a
+     * `CREATE` change set and diffs it fine. Only a tombstone moves the method,
+     * and only to `template`, never to `auto`: `auto` would swallow a real
+     * permission failure and present a degraded diff as authoritative, which is
+     * what an explicit `change-set` pin exists to prevent. `template`
+     * over-reporting replacements is vacuous here, because every resource in a
+     * stack built from scratch is an add.
+     *
+     * The method is per invocation, not per stack — `cdk diff` diffs everything
+     * its pattern matches in one pass. A pattern matching several stacks where
+     * only one is a tombstone therefore diffs all of them with `template`, and
+     * the banner names the stack that caused it.
+     */
+    this.diffProbeLines = (target, outputFile) => {
+      const { ciDeploymentConfig, awsDeploymentConfig } = target;
+      const { stackPattern } = ciDeploymentConfig ?? {};
+      const { rootCdkOut, cdkCli } = awsDeploymentConfig;
+      const configuredMethod = cdkCli.diffOptionsFor(target).method ?? CDK_DIFF_METHOD.ChangeSet;
+      const listCommand = `pnpm dlx "aws-cdk@${cdkCli.cliVersion}" ${renderCdkList(
+        {
+          app: rootCdkOut,
+          json: true,
+          long: true,
+          stackPatterns: stackPattern ? [stackPattern] : void 0
+        }
+      )}`;
+      return [
+        `method=${configuredMethod}`,
+        "while read -r stack; do",
+        '  status=$(aws cloudformation describe-stacks --stack-name "$stack" --query "Stacks[0].StackStatus" --output text 2>/dev/null || echo NOT_FOUND)',
+        '  case "$status" in',
+        "    NOT_FOUND|REVIEW_IN_PROGRESS)",
+        `      echo "${DIFF_NEW_STACK_MARKER} \u2014 $stack does not exist yet, so this target will be created from scratch." | tee -a ${outputFile}`,
+        "      ;;",
+        "    ROLLBACK_COMPLETE|ROLLBACK_FAILED)",
+        `      method=${CDK_DIFF_METHOD.Template}`,
+        `      echo "${DIFF_NEW_STACK_MARKER} \u2014 $stack exists only as a failed-create tombstone ($status), so this target will be created from scratch. Diffing it with --method=${CDK_DIFF_METHOD.Template}." | tee -a ${outputFile}`,
+        "      ;;",
+        "  esac",
+        `done < <(${listCommand} 2>/dev/null | jq -r '.[].name' 2>/dev/null)`
+      ];
+    };
     if (!(project.root instanceof MonorepoProject)) {
       throw new Error(
         "AwsDeployWorkflow requires the root project to be a MonorepoProject"
@@ -42972,6 +43094,7 @@ var AwsDeployWorkflow = class _AwsDeployWorkflow extends Component25 {
       artifact: options.diff?.artifact ?? true,
       summary: options.diff?.summary ?? true
     };
+    this.branchScopedConcurrency = options.branchScopedConcurrency ?? false;
     this.environmentName = resolveEnvironmentGate(
       options.gate,
       options.environmentName,
@@ -43035,7 +43158,7 @@ var AwsDeployWorkflow = class _AwsDeployWorkflow extends Component25 {
        * Set GIT_BRANCH_NAME so Turborepo remote cache hashes match between local and CI.
        */
       env: {
-        GIT_BRANCH_NAME: "${{ github.head_ref || github.ref_name }}",
+        GIT_BRANCH_NAME: BRANCH_NAME_EXPRESSION,
         ...options.buildWorkflowOptions?.env,
         ...buildWorkflowOptions?.env
       },
@@ -43125,7 +43248,7 @@ var AwsDeployWorkflow = class _AwsDeployWorkflow extends Component25 {
             pullRequests: JobPermission7.WRITE
           },
           ...this.environmentName ? { environment: this.environmentName } : void 0,
-          concurrency: deployJobName,
+          concurrency: this.buildDeployConcurrency(deployJobName),
           if: jobCondition,
           steps: [...this.deploySteps(target)]
         });
@@ -44144,6 +44267,7 @@ export {
   DEFAULT_UPSTREAM_CONFIGULATOR_ENABLED,
   DEPLOY_GATE,
   DIFF_ARTIFACT_NAME,
+  DIFF_NEW_STACK_MARKER,
   DIFF_OUTPUT_DIRECTORY,
   DIFF_PART_ARTIFACT_PREFIX,
   DIFF_REPORT_JOB_ID,