@intentius/chant-lexicon-pulumi 0.124.55 → 0.124.57

package/src/run.ts

@@ -28,6 +28,12 @@
  * - for a review stack alone (`pr-<n>`, INTENTIUS/plywood#15), `stack
  *   init`, `destroy --yes` and `stack rm --yes`, through
  *   {@link runReviewStackPulumi} and {@link runReviewStackPlunge} only;
+ * - for the check stage (#4633, `./check-step.ts`), `pulumi install` and
+ *   `pulumi about --json [--stack <stack>]`, or the same under `plunge`,
+ *   through {@link runCheckPulumi} alone. The install fetches the program's
+ *   dependencies and plugins; `about` reads the engine, plugins and backend.
+ *   Neither writes a stack, and both run with no forge token or cloud
+ *   credential in their environment;
  * - for a member on plunge, its engine graph (#4529, ruled on #4520), as
  *   exactly one of `plunge graph --json`, `plunge graph --json --stack
  *   <stack>`, `plunge graph --json --versions` and `plunge graph --json
@@ -294,14 +300,17 @@ export function engineRunnerAt(bin: string): PulumiRunner {
  * that is not empty and does not start with `-`; `[…]` is optional; `…`
  * repeats.
  *
- * `up` is refused with `--skip-preview`, `--refresh`, `--show-secrets`,
- * `--replace`, `--target-replace`, `--target-dependents`, `--exclude`,
- * `--remote`, `--continue-on-error`, `--config` and any flag not here, since
- * none of them is in the list.
+ * `up` is refused with `--skip-preview`, `--show-secrets`, `--replace`,
+ * `--target-replace`, `--exclude`, `--remote`, `--continue-on-error`,
+ * `--config` and any flag not here, since none of them is in the list.
+ * `--refresh` and `--target-dependents` (#4627) come in the tail's order,
+ * `--target-dependents` only after a `--target`. plunge's `up --plan`
+ * applies a saved plan whose preview did the refresh, so it takes no
+ * `--refresh`.
  */
 export const PULUMI_APPLY_COMMANDS: readonly string[] = [
-  "plunge up --plan <file> --yes --json --stack <stack> [--config-file <file>] [--target <urn>]... [--policy-pack <dir> [--policy-pack-config <file>]]...",
-  "pulumi up --yes --json --stack <stack> [--config-file <file>] [--target <urn>]... [--policy-pack <dir> [--policy-pack-config <file>]]...",
+  "plunge up --plan <file> --yes --json --stack <stack> [--config-file <file>] [--target <urn>... [--target-dependents]] [--policy-pack <dir> [--policy-pack-config <file>]]...",
+  "pulumi up --yes --json --stack <stack> [--config-file <file>] [--refresh] [--target <urn>... [--target-dependents]] [--policy-pack <dir> [--policy-pack-config <file>]]...",
 ];
 
 /** A CrossGuard pack the preview and `up` run (ruling 7: in the preview job, feeding chant's gate). */
@@ -317,13 +326,20 @@ export interface PulumiApplyTail {
   /** A scratch copy of the stack's config file, passed as `--config-file` (#4541): never `--config`, which writes the working tree's file. */
   configFile?: string;
   targets?: readonly string[];
+  /** `--refresh` (#4627): refresh the stack's state before the preview or `pulumi up`. */
+  refresh?: boolean;
+  /** `--target-dependents` (#4627): with `targets`, their dependents too. */
+  targetDependents?: boolean;
   policyPacks?: readonly PulumiPolicyPack[];
 }
 
 function tailArgs(t: PulumiApplyTail): string[] {
+  const targets = t.targets ?? [];
   return [
     ...(t.configFile ? ["--config-file", t.configFile] : []),
-    ...(t.targets ?? []).flatMap((u) => ["--target", u]),
+    ...(t.refresh ? ["--refresh"] : []),
+    ...targets.flatMap((u) => ["--target", u]),
+    ...(t.targetDependents && targets.length > 0 ? ["--target-dependents"] : []),
     ...(t.policyPacks ?? []).flatMap((p) => ["--policy-pack", p.dir, ...(p.config ? ["--policy-pack-config", p.config] : [])]),
   ];
 }
@@ -350,17 +366,21 @@ export function pulumiUpArgs(opts: { stack: string } & PulumiApplyTail): string[
 
 const isValue = (v: string | undefined): v is string => typeof v === "string" && v.length > 0 && !v.startsWith("-");
 
-/** Whether `rest` is exactly an apply tail, in its order. */
-function wellFormedTail(rest: string[]): boolean {
+/** Whether `rest` is exactly an apply tail, in its order; `refresh` says whether `--refresh` may stand in it (#4627). */
+function wellFormedTail(rest: string[], refresh = true): boolean {
   let i = 0;
   if (rest[i] === "--config-file") {
     if (!isValue(rest[i + 1])) return false;
     i += 2;
   }
+  if (refresh && rest[i] === "--refresh") i += 1;
+  let targets = 0;
   while (rest[i] === "--target") {
     if (!isValue(rest[i + 1])) return false;
     i += 2;
+    targets++;
   }
+  if (targets > 0 && rest[i] === "--target-dependents") i += 1;
   while (rest[i] === "--policy-pack") {
     if (!isValue(rest[i + 1])) return false;
     i += 2;
@@ -382,7 +402,7 @@ function allowedPlungeUp(args: string[]): boolean {
     args[4] === "--json" &&
     args[5] === "--stack" &&
     isValue(args[6]) &&
-    wellFormedTail(args.slice(7))
+    wellFormedTail(args.slice(7), false)
   );
 }
 
@@ -624,11 +644,11 @@ export async function runReviewStackPlunge(run: PulumiRunner, args: string[], cw
 }
 
 /**
- * The install chant runs in a release's recorded copy of a program (#4542),
+ * The install chant runs in a program's directory before its first engine
+ * run, a release's recorded copy (#4542) or a job's checkout (plywood#22),
  * for `./release-copy.ts` alone: exactly `pulumi install` or `plunge
- * install`, no flag. The cut records tracked files only, so the copy has no
- * `node_modules` or virtualenv; the CLI's install follows `Pulumi.yaml`'s
- * runtime options and the recorded lockfile.
+ * install`, no flag. Neither has `node_modules` or a virtualenv; the CLI's
+ * install follows `Pulumi.yaml`'s runtime options and the lockfile.
  */
 export const PULUMI_INSTALL_COMMANDS: readonly string[] = ["pulumi install", "plunge install"];
 
@@ -640,6 +660,29 @@ export async function runReleaseInstall(run: PulumiRunner, args: string[], cwd:
   return run(args, env ? { cwd, env } : { cwd });
 }
 
+/**
+ * The two argv the check stage runs for a member (#4633, `./check-step.ts`):
+ * `install` with no flag, and `about --json`, optionally with `--stack
+ * <stack>`. Under `pulumi` or `plunge`; the runner picks the binary.
+ */
+export const PULUMI_CHECK_COMMANDS: readonly string[] = ["pulumi install", "pulumi about --json [--stack <stack>]", "plunge install", "plunge about --json [--stack <stack>]"];
+
+/** Whether `args` is one of {@link PULUMI_CHECK_COMMANDS}' argv. */
+export function allowedCheck(args: readonly string[]): boolean {
+  if (args.length === 1) return args[0] === "install";
+  if (args[0] !== "about" || args[1] !== "--json") return false;
+  if (args.length === 2) return true;
+  return args.length === 4 && args[2] === "--stack" && isValue(args[3]);
+}
+
+/** Run a check-stage argv, refusing any other. The runner picks the binary. */
+export async function runCheckPulumi(run: PulumiRunner, args: string[], cwd: string, env?: Record<string, string>): Promise<{ stdout: string }> {
+  if (!allowedCheck(args)) {
+    throw new Error(`the check stage runs only ${PULUMI_CHECK_COMMANDS.join(", ")} for a Pulumi member, not ${args.join(" ")}`);
+  }
+  return run(args, env ? { cwd, env } : { cwd });
+}
+
 export { pulumiMemberEngine, readPlywoodEngine, type PulumiMemberEngine, type PulumiMemberEngineSource, type PulumiMemberEngineOptions } from "./member-engine";
 
 /** The argv chant runs for a member's applied outputs, after `pulumi` (#4455). Secrets stay blinded. */

package/src/stack-export-snapshot.test.ts

@@ -9,7 +9,7 @@
  * `local` store in a temp directory, so no git ref is written, no engine
  * runs and nothing reaches a backend.
  */
-import { cpSync, mkdtempSync, readFileSync } from "node:fs";
+import { cpSync, mkdirSync, mkdtempSync, readFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { describe, expect, test } from "vitest";
@@ -42,6 +42,8 @@ const localStore = (): SnapshotStore => createSnapshotStore({ store: "local", di
 function unexportedStack(): string {
   const dir = tmp();
   cpSync(join(testdata, "pulumi-preview", "Pulumi.yaml"), join(dir, "Pulumi.yaml"));
+  // Installed, so the step runs no install before the preview (plywood#22).
+  mkdirSync(join(dir, "node_modules"));
   return dir;
 }