@intentius/chant-lexicon-pulumi 0.124.55 → 0.124.56

package/src/run.test.ts

@@ -464,7 +464,7 @@ describe("the apply entry points (#4541)", () => {
   test("anything off the list is refused before the runner", async () => {
     const { run, calls } = fake(() => "");
     const base = pulumiUpArgs({ stack: "floci" });
-    for (const extra of [["--skip-preview"], ["--refresh"], ["--show-secrets"], ["--replace", "urn:a"], ["--target-replace", "urn:a"], ["--target-dependents"], ["--exclude", "urn:a"], ["--remote"], ["--continue-on-error"], ["--config", "k=v"], ["--plan", "/tmp/p.json"]]) {
+    for (const extra of [["--skip-preview"], ["--show-secrets"], ["--replace", "urn:a"], ["--target-replace", "urn:a"], ["--target-dependents"], ["--exclude", "urn:a"], ["--remote"], ["--continue-on-error"], ["--config", "k=v"], ["--plan", "/tmp/p.json"]]) {
       await expect(runApplyPulumi(run, [...base, ...extra], "/tmp")).rejects.toThrow(/applies a Pulumi stack only as/);
     }
     for (const args of [

package/src/run.ts

@@ -28,6 +28,12 @@
  * - for a review stack alone (`pr-<n>`, INTENTIUS/plywood#15), `stack
  *   init`, `destroy --yes` and `stack rm --yes`, through
  *   {@link runReviewStackPulumi} and {@link runReviewStackPlunge} only;
+ * - for the check stage (#4633, `./check-step.ts`), `pulumi install` and
+ *   `pulumi about --json [--stack <stack>]`, or the same under `plunge`,
+ *   through {@link runCheckPulumi} alone. The install fetches the program's
+ *   dependencies and plugins; `about` reads the engine, plugins and backend.
+ *   Neither writes a stack, and both run with no forge token or cloud
+ *   credential in their environment;
  * - for a member on plunge, its engine graph (#4529, ruled on #4520), as
  *   exactly one of `plunge graph --json`, `plunge graph --json --stack
  *   <stack>`, `plunge graph --json --versions` and `plunge graph --json
@@ -294,14 +300,17 @@ export function engineRunnerAt(bin: string): PulumiRunner {
  * that is not empty and does not start with `-`; `[…]` is optional; `…`
  * repeats.
  *
- * `up` is refused with `--skip-preview`, `--refresh`, `--show-secrets`,
- * `--replace`, `--target-replace`, `--target-dependents`, `--exclude`,
- * `--remote`, `--continue-on-error`, `--config` and any flag not here, since
- * none of them is in the list.
+ * `up` is refused with `--skip-preview`, `--show-secrets`, `--replace`,
+ * `--target-replace`, `--exclude`, `--remote`, `--continue-on-error`,
+ * `--config` and any flag not here, since none of them is in the list.
+ * `--refresh` and `--target-dependents` (#4627) come in the tail's order,
+ * `--target-dependents` only after a `--target`. plunge's `up --plan`
+ * applies a saved plan whose preview did the refresh, so it takes no
+ * `--refresh`.
  */
 export const PULUMI_APPLY_COMMANDS: readonly string[] = [
-  "plunge up --plan <file> --yes --json --stack <stack> [--config-file <file>] [--target <urn>]... [--policy-pack <dir> [--policy-pack-config <file>]]...",
-  "pulumi up --yes --json --stack <stack> [--config-file <file>] [--target <urn>]... [--policy-pack <dir> [--policy-pack-config <file>]]...",
+  "plunge up --plan <file> --yes --json --stack <stack> [--config-file <file>] [--target <urn>... [--target-dependents]] [--policy-pack <dir> [--policy-pack-config <file>]]...",
+  "pulumi up --yes --json --stack <stack> [--config-file <file>] [--refresh] [--target <urn>... [--target-dependents]] [--policy-pack <dir> [--policy-pack-config <file>]]...",
 ];
 
 /** A CrossGuard pack the preview and `up` run (ruling 7: in the preview job, feeding chant's gate). */
@@ -317,13 +326,20 @@ export interface PulumiApplyTail {
   /** A scratch copy of the stack's config file, passed as `--config-file` (#4541): never `--config`, which writes the working tree's file. */
   configFile?: string;
   targets?: readonly string[];
+  /** `--refresh` (#4627): refresh the stack's state before the preview or `pulumi up`. */
+  refresh?: boolean;
+  /** `--target-dependents` (#4627): with `targets`, their dependents too. */
+  targetDependents?: boolean;
   policyPacks?: readonly PulumiPolicyPack[];
 }
 
 function tailArgs(t: PulumiApplyTail): string[] {
+  const targets = t.targets ?? [];
   return [
     ...(t.configFile ? ["--config-file", t.configFile] : []),
-    ...(t.targets ?? []).flatMap((u) => ["--target", u]),
+    ...(t.refresh ? ["--refresh"] : []),
+    ...targets.flatMap((u) => ["--target", u]),
+    ...(t.targetDependents && targets.length > 0 ? ["--target-dependents"] : []),
     ...(t.policyPacks ?? []).flatMap((p) => ["--policy-pack", p.dir, ...(p.config ? ["--policy-pack-config", p.config] : [])]),
   ];
 }
@@ -350,17 +366,21 @@ export function pulumiUpArgs(opts: { stack: string } & PulumiApplyTail): string[
 
 const isValue = (v: string | undefined): v is string => typeof v === "string" && v.length > 0 && !v.startsWith("-");
 
-/** Whether `rest` is exactly an apply tail, in its order. */
-function wellFormedTail(rest: string[]): boolean {
+/** Whether `rest` is exactly an apply tail, in its order; `refresh` says whether `--refresh` may stand in it (#4627). */
+function wellFormedTail(rest: string[], refresh = true): boolean {
   let i = 0;
   if (rest[i] === "--config-file") {
     if (!isValue(rest[i + 1])) return false;
     i += 2;
   }
+  if (refresh && rest[i] === "--refresh") i += 1;
+  let targets = 0;
   while (rest[i] === "--target") {
     if (!isValue(rest[i + 1])) return false;
     i += 2;
+    targets++;
   }
+  if (targets > 0 && rest[i] === "--target-dependents") i += 1;
   while (rest[i] === "--policy-pack") {
     if (!isValue(rest[i + 1])) return false;
     i += 2;
@@ -382,7 +402,7 @@ function allowedPlungeUp(args: string[]): boolean {
     args[4] === "--json" &&
     args[5] === "--stack" &&
     isValue(args[6]) &&
-    wellFormedTail(args.slice(7))
+    wellFormedTail(args.slice(7), false)
   );
 }
 
@@ -640,6 +660,29 @@ export async function runReleaseInstall(run: PulumiRunner, args: string[], cwd:
   return run(args, env ? { cwd, env } : { cwd });
 }
 
+/**
+ * The two argv the check stage runs for a member (#4633, `./check-step.ts`):
+ * `install` with no flag, and `about --json`, optionally with `--stack
+ * <stack>`. Under `pulumi` or `plunge`; the runner picks the binary.
+ */
+export const PULUMI_CHECK_COMMANDS: readonly string[] = ["pulumi install", "pulumi about --json [--stack <stack>]", "plunge install", "plunge about --json [--stack <stack>]"];
+
+/** Whether `args` is one of {@link PULUMI_CHECK_COMMANDS}' argv. */
+export function allowedCheck(args: readonly string[]): boolean {
+  if (args.length === 1) return args[0] === "install";
+  if (args[0] !== "about" || args[1] !== "--json") return false;
+  if (args.length === 2) return true;
+  return args.length === 4 && args[2] === "--stack" && isValue(args[3]);
+}
+
+/** Run a check-stage argv, refusing any other. The runner picks the binary. */
+export async function runCheckPulumi(run: PulumiRunner, args: string[], cwd: string, env?: Record<string, string>): Promise<{ stdout: string }> {
+  if (!allowedCheck(args)) {
+    throw new Error(`the check stage runs only ${PULUMI_CHECK_COMMANDS.join(", ")} for a Pulumi member, not ${args.join(" ")}`);
+  }
+  return run(args, env ? { cwd, env } : { cwd });
+}
+
 export { pulumiMemberEngine, readPlywoodEngine, type PulumiMemberEngine, type PulumiMemberEngineSource, type PulumiMemberEngineOptions } from "./member-engine";
 
 /** The argv chant runs for a member's applied outputs, after `pulumi` (#4455). Secrets stay blinded. */