@friggframework/devtools 2.0.0--canary.517.bd5ddfc.0 → 2.0.0--canary.517.9750290.0

package/infrastructure/domains/admin-scripts/admin-script-builder.js

@@ -178,6 +178,16 @@ class AdminScriptBuilder extends InfrastructureBuilder {
     }
 
     createSchedulerResources(appDefinition, result) {
+        // Reference the executor by a constructed ARN (Fn::Sub) rather than
+        // Fn::GetAtt. GetAtt creates a CloudFormation dependency edge, and an
+        // edge from the scheduler role to the executor closed a cycle through the
+        // shared Lambda execution role (role → executor → IamRoleLambdaExecution
+        // → PassRole → role). The name is deterministic, so a Sub is safe.
+        const executorArn = {
+            'Fn::Sub':
+                'arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:${self:service}-${self:provider.stage}-adminScriptExecutor',
+        };
+
         // Create IAM role for EventBridge Scheduler
         result.resources.AdminScriptSchedulerRole = {
             Type: 'AWS::IAM::Role',
@@ -198,7 +208,7 @@ class AdminScriptBuilder extends InfrastructureBuilder {
                         Statement: [{
                             Effect: 'Allow',
                             Action: 'lambda:InvokeFunction',
-                            Resource: { 'Fn::GetAtt': ['AdminScriptExecutorLambdaFunction', 'Arn'] },
+                            Resource: executorArn,
                         }],
                     },
                 }],
@@ -213,13 +223,25 @@ class AdminScriptBuilder extends InfrastructureBuilder {
             },
         };
 
-        // Env vars consumed by the admin-script router when building the AWS
-        // scheduler adapter. Names must match admin-script-router.js exactly.
+        // SCHEDULER_PROVIDER is a constant, so it's safe on the shared provider
+        // environment inherited by every function.
         result.environment.SCHEDULER_PROVIDER = 'aws';
-        result.environment.SCHEDULER_ROLE_ARN = { 'Fn::GetAtt': ['AdminScriptSchedulerRole', 'Arn'] };
-        result.environment.ADMIN_SCRIPT_SCHEDULE_GROUP = { Ref: 'AdminScriptScheduleGroup' };
-        result.environment.ADMIN_SCRIPT_EXECUTOR_LAMBDA_ARN = {
-            'Fn::GetAtt': ['AdminScriptExecutorLambdaFunction', 'Arn'],
+
+        // The remaining vars carry resource references and are consumed ONLY by
+        // the router (it builds the AWS scheduler adapter in the schedule
+        // handlers). Scope them to the router function rather than the shared
+        // provider environment: broadcasting the executor's own ARN into every
+        // function's env made the executor depend on itself, and the role/group
+        // refs made every function depend on the scheduler role — both closed
+        // CloudFormation circular dependencies on deploy. Names must match
+        // admin-script-router.js exactly.
+        result.functions.adminScriptRouter.environment = {
+            ...(result.functions.adminScriptRouter.environment || {}),
+            SCHEDULER_ROLE_ARN: {
+                'Fn::GetAtt': ['AdminScriptSchedulerRole', 'Arn'],
+            },
+            ADMIN_SCRIPT_SCHEDULE_GROUP: { Ref: 'AdminScriptScheduleGroup' },
+            ADMIN_SCRIPT_EXECUTOR_LAMBDA_ARN: executorArn,
         };
 
         // The router manages schedules through the AWS scheduler adapter, so it

package/infrastructure/domains/admin-scripts/admin-script-builder.test.js

@@ -366,17 +366,33 @@ describe('AdminScriptBuilder', () => {
             expect(result.resources.AdminScriptScheduleGroup).toBeDefined();
             expect(result.resources.AdminScriptScheduleGroup.Type).toBe('AWS::Scheduler::ScheduleGroup');
 
-            // Check for environment variables consumed by the router's scheduler adapter
+            // SCHEDULER_PROVIDER is a constant and stays on the shared env.
             expect(result.environment.SCHEDULER_PROVIDER).toBe('aws');
-            expect(result.environment.SCHEDULER_ROLE_ARN).toEqual({
+
+            // Resource-reference env vars are scoped to the router function (not
+            // the shared provider env) to avoid CloudFormation circular deps.
+            const routerEnv = result.functions.adminScriptRouter.environment;
+            expect(routerEnv.SCHEDULER_ROLE_ARN).toEqual({
                 'Fn::GetAtt': ['AdminScriptSchedulerRole', 'Arn'],
             });
-            expect(result.environment.ADMIN_SCRIPT_SCHEDULE_GROUP).toEqual({
+            expect(routerEnv.ADMIN_SCRIPT_SCHEDULE_GROUP).toEqual({
                 Ref: 'AdminScriptScheduleGroup',
             });
-            expect(result.environment.ADMIN_SCRIPT_EXECUTOR_LAMBDA_ARN).toEqual({
-                'Fn::GetAtt': ['AdminScriptExecutorLambdaFunction', 'Arn'],
+            // Executor referenced by constructed ARN (Fn::Sub), not Fn::GetAtt,
+            // so it creates no dependency edge.
+            expect(routerEnv.ADMIN_SCRIPT_EXECUTOR_LAMBDA_ARN).toEqual({
+                'Fn::Sub':
+                    'arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:${self:service}-${self:provider.stage}-adminScriptExecutor',
             });
+
+            // Regression guard: these must NOT leak onto the shared provider env
+            // (that is what produced the circular dependency, incl. the executor
+            // self-reference).
+            expect(result.environment.SCHEDULER_ROLE_ARN).toBeUndefined();
+            expect(result.environment.ADMIN_SCRIPT_SCHEDULE_GROUP).toBeUndefined();
+            expect(
+                result.environment.ADMIN_SCRIPT_EXECUTOR_LAMBDA_ARN
+            ).toBeUndefined();
         });
 
         it('should not create scheduler resources when enableScheduling is false', async () => {
@@ -494,10 +510,15 @@ describe('AdminScriptBuilder', () => {
             const policies = result.resources.AdminScriptSchedulerRole.Properties.Policies;
 
             expect(policies[0].PolicyName).toBe('InvokeLambda');
+            // Constructed ARN (Fn::Sub), not Fn::GetAtt — a GetAtt here closes a
+            // circular dependency through the shared Lambda execution role.
             expect(policies[0].PolicyDocument.Statement[0]).toEqual({
                 Effect: 'Allow',
                 Action: 'lambda:InvokeFunction',
-                Resource: { 'Fn::GetAtt': ['AdminScriptExecutorLambdaFunction', 'Arn'] },
+                Resource: {
+                    'Fn::Sub':
+                        'arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:${self:service}-${self:provider.stage}-adminScriptExecutor',
+                },
             });
         });
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@friggframework/devtools",
   "prettier": "@friggframework/prettier-config",
-  "version": "2.0.0--canary.517.bd5ddfc.0",
+  "version": "2.0.0--canary.517.9750290.0",
   "bin": {
     "frigg": "./frigg-cli/index.js"
   },
@@ -25,9 +25,9 @@
     "@babel/eslint-parser": "^7.18.9",
     "@babel/parser": "^7.25.3",
     "@babel/traverse": "^7.25.3",
-    "@friggframework/core": "2.0.0--canary.517.bd5ddfc.0",
-    "@friggframework/schemas": "2.0.0--canary.517.bd5ddfc.0",
-    "@friggframework/test": "2.0.0--canary.517.bd5ddfc.0",
+    "@friggframework/core": "2.0.0--canary.517.9750290.0",
+    "@friggframework/schemas": "2.0.0--canary.517.9750290.0",
+    "@friggframework/test": "2.0.0--canary.517.9750290.0",
     "@hapi/boom": "^10.0.1",
     "@inquirer/prompts": "^5.3.8",
     "axios": "^1.18.0",
@@ -55,8 +55,8 @@
     "validate-npm-package-name": "^5.0.0"
   },
   "devDependencies": {
-    "@friggframework/eslint-config": "2.0.0--canary.517.bd5ddfc.0",
-    "@friggframework/prettier-config": "2.0.0--canary.517.bd5ddfc.0",
+    "@friggframework/eslint-config": "2.0.0--canary.517.9750290.0",
+    "@friggframework/prettier-config": "2.0.0--canary.517.9750290.0",
     "aws-sdk-client-mock": "^4.1.0",
     "aws-sdk-client-mock-jest": "^4.1.0",
     "jest": "^30.1.3",
@@ -88,5 +88,5 @@
   "publishConfig": {
     "access": "public"
   },
-  "gitHead": "bd5ddfc493049d1c233bce2f2b8203d50a1f129c"
+  "gitHead": "9750290bdb331b5f2d1304d7e64adc3c480f1fb7"
 }