@codedrifters/configulator 0.0.445 → 0.0.447

package/lib/index.mjs

@@ -34424,7 +34424,7 @@ var VERSION = {
   /**
    * Version of Astro to pin for AstroProject scaffolding.
    */
-  ASTRO_VERSION: "7.2.1",
+  ASTRO_VERSION: "7.2.2",
   /**
    * CDK CLI for workflows and command line operations.
    *
@@ -34436,7 +34436,7 @@ var VERSION = {
    *
    * CLI and lib are versioned separately, so this is the lib version.
    */
-  AWS_CDK_LIB_VERSION: "2.264.0",
+  AWS_CDK_LIB_VERSION: "2.265.0",
   /**
    * Version of the AWS Constructs library to use.
    */
@@ -42207,6 +42207,54 @@ var DEPLOY_GATE = {
    */
   PLAN_APPLY: "plan-apply"
 };
+var DEPLOY_APPROVALS = {
+  /**
+   * One approval per deploy job. The environment sits on every deploy job, so
+   * each reaches its protection rules on its own — and deploy jobs chained by
+   * `deployAfterTargets` reach them one at a time, with a full deploy between
+   * each prompt.
+   */
+  PER_TARGET: "per-target",
+  /**
+   * One approval for the whole run. A dedicated approval job carries the
+   * required-reviewer rule and every deploy job waits on it, so the operator
+   * approves once and the rest of the run proceeds unattended.
+   *
+   * Requires `approvalEnvironmentName`, and it must name a *different*
+   * environment than the deploy jobs' — the deploy jobs keep their own
+   * `environment` so their OIDC subject claims, environment-scoped secrets,
+   * and per-stack deployment history are untouched.
+   */
+  ONCE: "once"
+};
+var APPROVE_JOB_ID = "approve";
+var resolveApprovalGate = (gate, approvals, approvalEnvironmentName, environmentName, componentName) => {
+  const trimmed = approvalEnvironmentName?.trim();
+  if (approvals !== DEPLOY_APPROVALS.ONCE) {
+    if (trimmed) {
+      throw new Error(
+        `${componentName} requires \`approvals\` to be "${DEPLOY_APPROVALS.ONCE}" when \`approvalEnvironmentName\` is supplied, got "${approvalEnvironmentName}" with \`approvals\` ${approvals ? `"${approvals}"` : "unset"}`
+      );
+    }
+    return void 0;
+  }
+  if (gate !== DEPLOY_GATE.ENVIRONMENT) {
+    throw new Error(
+      `${componentName} requires \`gate\` to be "${DEPLOY_GATE.ENVIRONMENT}" when \`approvals\` is "${DEPLOY_APPROVALS.ONCE}", got ${gate ? `"${gate}"` : "no gate"}`
+    );
+  }
+  if (!trimmed) {
+    throw new Error(
+      `${componentName} requires a non-empty \`approvalEnvironmentName\` when \`approvals\` is "${DEPLOY_APPROVALS.ONCE}"`
+    );
+  }
+  if (trimmed === environmentName?.trim()) {
+    throw new Error(
+      `${componentName} requires \`approvalEnvironmentName\` to name a different environment than \`environmentName\`, got "${trimmed}" for both \u2014 a shared environment puts the reviewer rule back on every deploy job, which is the per-target prompting "${DEPLOY_APPROVALS.ONCE}" exists to remove`
+    );
+  }
+  return trimmed;
+};
 var resolveEnvironmentGate = (gate, environmentName, componentName) => {
   const trimmed = environmentName?.trim();
   if (gate === void 0) {
@@ -42835,6 +42883,35 @@ var AwsDeployWorkflow = class _AwsDeployWorkflow extends Component25 {
       }
       return conditions.join(" || ");
     };
+    /**
+     * Compose the single approval job's condition.
+     *
+     * Mirrors a deploy job's, with one difference forced by the job being shared:
+     * the branch clause is the union of every target's, rather than one target's.
+     * Without it a push to a branch no target deploys from would still pause for
+     * an approval — prompting for a deployment that can never happen, and holding
+     * the `complete` gate pending while it waits.
+     *
+     * A target with no branch filter deploys from every branch, so one of those
+     * collapses the union to no clause at all.
+     *
+     * Deliberately no `!cancelled()`, unlike the diff report: a report is wanted
+     * precisely when a diff failed, but an approval is not. GitHub's default —
+     * skip a job whose `needs` failed — is what should happen here, and it
+     * cascades to every deploy job waiting on the approval.
+     */
+    this.buildApprovalCondition = (homeRepositoryCondition) => {
+      const branchConditions = this.awsDeploymentTargets.map(
+        (target) => this.buildBranchFilterCondition(target.branches)
+      );
+      const anyBranch = branchConditions.some((condition) => !condition);
+      const branchClause = anyBranch ? void 0 : Array.from(new Set(branchConditions)).join(" || ");
+      return "${{ " + [
+        "!needs.build.outputs.self_mutation_happened",
+        ...homeRepositoryCondition ? [homeRepositoryCondition] : [],
+        ...branchClause ? [`(${branchClause})`] : []
+      ].join(" && ") + " }}";
+    };
     /**
      * Steps for a target's deploy job.
      *
@@ -43134,6 +43211,14 @@ var AwsDeployWorkflow = class _AwsDeployWorkflow extends Component25 {
       options.environmentName,
       "AwsDeployWorkflow"
     );
+    this.approvals = options.approvals ?? DEPLOY_APPROVALS.PER_TARGET;
+    this.approvalEnvironmentName = resolveApprovalGate(
+      options.gate,
+      options.approvals,
+      options.approvalEnvironmentName,
+      this.environmentName,
+      "AwsDeployWorkflow"
+    );
     this.homeRepository = options.homeRepository;
     const homeRepositoryCondition = renderHomeRepositoryCondition(
       this.homeRepository,
@@ -43271,6 +43356,7 @@ var AwsDeployWorkflow = class _AwsDeployWorkflow extends Component25 {
           needs: [
             "build",
             ...gatedOnDiff ? [DIFF_REPORT_JOB_ID] : [],
+            ...this.approvalEnvironmentName ? [APPROVE_JOB_ID] : [],
             ...this.deployAfterTargets.map((p) => {
               return this.buildJobName(p);
             })
@@ -43317,6 +43403,35 @@ var AwsDeployWorkflow = class _AwsDeployWorkflow extends Component25 {
         }))
       });
     }
+    if (this.approvalEnvironmentName && this.awsDeploymentTargets.length > 0) {
+      if (this.buildWorkflow.workflow.getJob(APPROVE_JOB_ID)) {
+        throw new Error(
+          `AwsDeployWorkflow cannot add a second \`approvals: "${DEPLOY_APPROVALS.ONCE}"\` gate to the workflow "${this.buildWorkflow.name}": the job id "${APPROVE_JOB_ID}" is already taken. One approval job releases every deploy job in the file, so give the components separate build workflows if they must be approved separately.`
+        );
+      }
+      const gatedOnDiff = this.diffOptions.enabled;
+      this.buildWorkflow.workflow.addJob(APPROVE_JOB_ID, {
+        name: `Approve ${this.project.name} ${this.awsStageType} deployment`,
+        needs: ["build", ...gatedOnDiff ? [DIFF_REPORT_JOB_ID] : []],
+        runsOn: ["ubuntu-latest"],
+        /**
+         * Nothing to read and nothing to write: the job exists so GitHub holds
+         * it at the environment's protection rules, and its only step records
+         * that it cleared them.
+         */
+        permissions: {
+          contents: JobPermission7.NONE
+        },
+        environment: this.approvalEnvironmentName,
+        if: this.buildApprovalCondition(homeRepositoryCondition),
+        steps: [
+          {
+            name: "Record approval",
+            run: `echo "Approved \u2014 releasing every ${this.awsStageType} deploy job in this run." >> "$GITHUB_STEP_SUMMARY"`
+          }
+        ]
+      });
+    }
     addBuildCompleteJob(this.buildWorkflow);
   }
   static of(project, buildWorkflow) {
@@ -44276,6 +44391,7 @@ export {
   AGENT_RULE_SCOPE,
   AGENT_TIER_ROLES,
   AGENT_TIER_VALUES,
+  APPROVE_JOB_ID,
   AUDIT_CATEGORY_ORDER,
   AgentConfig,
   ApiExtractor,
@@ -44374,6 +44490,7 @@ export {
   DEFAULT_UNBLOCK_COMMENT_TEMPLATE,
   DEFAULT_UNBLOCK_DEPENDENTS_ENABLED,
   DEFAULT_UPSTREAM_CONFIGULATOR_ENABLED,
+  DEPLOY_APPROVALS,
   DEPLOY_GATE,
   DIFF_ARTIFACT_NAME,
   DIFF_NEW_STACK_MARKER,
@@ -44614,6 +44731,7 @@ export {
   researchPipelineBundle,
   resolveAgentPaths,
   resolveAgentTiers,
+  resolveApprovalGate,
   resolveAstroProjectOutdir,
   resolveAwsCdkProjectOutdir,
   resolveBuildPolicy,