@macedon-technologies/batman 1.32.0 → 1.33.0

package/templates/app/pnpm-workspace.yaml

@@ -0,0 +1,7 @@
+onlyBuiltDependencies:
+  - esbuild
+ignoredBuiltDependencies:
+  - '@parcel/watcher'
+allowBuilds:
+  esbuild: true
+  '@parcel/watcher': false

package/templates/app/src/aspects/DataDogAspect.ts

@@ -0,0 +1,14 @@
+import { IAspect } from 'aws-cdk-lib';
+import { Function } from 'aws-cdk-lib/aws-lambda';
+import { IConstruct } from 'constructs';
+import { DatadogLambda } from 'datadog-cdk-constructs-v2'; // or v1
+
+export class DataDogAspect implements IAspect {
+  constructor(private props: { datadog: DatadogLambda }) {}
+
+  visit(node: IConstruct): void {
+    if (node instanceof Function) {
+      this.props.datadog.addLambdaFunctions([node]);
+    }
+  }
+}

package/templates/app/src/constructs/Secret.ts

@@ -0,0 +1,50 @@
+// Copied from @matthewbonig/secret (MIT, https://github.com/mbonig/secret).
+// This file is generated by Batman and is yours to modify.
+import { join } from 'path';
+import { CustomResource } from 'aws-cdk-lib';
+import { Effect, PolicyStatement } from 'aws-cdk-lib/aws-iam';
+import { Runtime } from 'aws-cdk-lib/aws-lambda';
+import { NodejsFunction } from 'aws-cdk-lib/aws-lambda-nodejs';
+import { Secret as AWSSecret, SecretProps, SecretStringGenerator } from 'aws-cdk-lib/aws-secretsmanager';
+import { Provider } from 'aws-cdk-lib/custom-resources';
+import { Construct } from 'constructs';
+
+export class Secret extends AWSSecret {
+  constructor(scope: Construct, id: string, props: SecretProps) {
+    super(scope, id, {
+      ...props,
+      generateSecretString: undefined, // explicitly set this to undefined so that we never use the built-in functionality
+    });
+
+    if (props.generateSecretString?.secretStringTemplate) {
+      // now we're going to use a custom resource for this instead
+      this.createCustomResource(props.generateSecretString);
+    }
+  }
+
+  private createCustomResource(generateSecretString: SecretStringGenerator) {
+    const eventHandler = new NodejsFunction(this, 'EventHandlerFunction', {
+      runtime: Runtime.NODEJS_24_X,
+      entry: join(__dirname, 'handler/Secret.Function.ts'),
+    });
+    this.grantWrite(eventHandler);
+    this.grantRead(eventHandler);
+    eventHandler.addToRolePolicy(new PolicyStatement({
+      effect: Effect.ALLOW,
+      resources: ['*'],
+      actions: ['secretsmanager:GetRandomPassword'],
+    }));
+    const provider = new Provider(this, 'CustomResourceProvider', {
+      onEventHandler: eventHandler,
+    });
+    const customResource = new CustomResource(this, 'GenerateSecretStringCR', {
+      resourceType: 'Custom::GenerateSecretString',
+      serviceToken: provider.serviceToken,
+      properties: {
+        Secret: this.secretArn,
+        GenerateSecretString: generateSecretString,
+      },
+    });
+    customResource.node.addDependency(this);
+  }
+}

package/templates/app/src/constructs/handler/Secret.Function.ts

@@ -0,0 +1,38 @@
+// Copied from @matthewbonig/secret (MIT, https://github.com/mbonig/secret).
+// This file is generated by Batman and is yours to modify.
+import { createSecretValue } from './secret/createSecretValue';
+import { updateSecretValue } from './secret/updateSecretValue';
+
+interface CustomResource {
+  RequestType: 'Create' | 'Update' | 'Delete';
+  LogicalResourceId: string;
+  ResourceProperties: any;
+  OldResourceProperties?: any;
+  PhysicalResourceId?: string;
+}
+
+export const handler = async (event: CustomResource) => {
+  console.log('Received event:', JSON.stringify(event, null, 2));
+
+  switch (event.RequestType) {
+    case 'Create':
+      console.log(`Create secret value for secret ${event.LogicalResourceId};`);
+      await createSecretValue({
+        secretArn: event.ResourceProperties.Secret,
+        generateSecretString: event.ResourceProperties.GenerateSecretString,
+      });
+      break;
+    case 'Update':
+      console.log('Updating secret with physical id:', event.PhysicalResourceId);
+      await updateSecretValue({
+        secretArn: event.ResourceProperties.Secret,
+        generateSecretString: event.ResourceProperties.GenerateSecretString,
+        oldGenerateSecretString: event.OldResourceProperties.GenerateSecretString,
+      });
+      break;
+    case 'Delete':
+      console.log('Deleting secret with physical id:', event.PhysicalResourceId);
+      console.log('Doing nothing. deleting secrets requires no work at all.');
+      break;
+  }
+};

package/templates/app/src/constructs/handler/secret/client.ts

@@ -0,0 +1,5 @@
+// Copied from @matthewbonig/secret (MIT, https://github.com/mbonig/secret).
+// This file is generated by Batman and is yours to modify.
+import { SecretsManager } from '@aws-sdk/client-secrets-manager';
+
+export const client = new SecretsManager({});

package/templates/app/src/constructs/handler/secret/createSecretValue.ts

@@ -0,0 +1,30 @@
+// Copied from @matthewbonig/secret (MIT, https://github.com/mbonig/secret).
+// This file is generated by Batman and is yours to modify.
+import { GetRandomPasswordCommand, PutSecretValueCommand } from '@aws-sdk/client-secrets-manager';
+import { client } from './client';
+
+export async function createSecretValue({ generateSecretString, secretArn }: {
+  secretArn: any;
+  generateSecretString: any;
+}) {
+  // since this is a create, we can just write the value as-is...
+  const secretValue = JSON.parse(generateSecretString.secretStringTemplate);
+  if (generateSecretString.generateStringKey) {
+    const randomValue = await client.send(new GetRandomPasswordCommand({
+      ExcludeCharacters: generateSecretString.excludeCharacters,
+      ExcludeLowercase: generateSecretString.excludeLowercase,
+      ExcludeNumbers: generateSecretString.excludeNumbers,
+      ExcludePunctuation: generateSecretString.excludePunctuation,
+      ExcludeUppercase: generateSecretString.excludeUppercase,
+      IncludeSpace: generateSecretString.includeSpace,
+      PasswordLength: generateSecretString.passwordLength,
+      RequireEachIncludedType: generateSecretString.requireEachIncludedType,
+    }));
+    secretValue[generateSecretString.generateStringKey] = randomValue.RandomPassword;
+  }
+
+  await client.send(new PutSecretValueCommand({
+    SecretId: secretArn,
+    SecretString: JSON.stringify(secretValue),
+  }));
+}

package/templates/app/src/constructs/handler/secret/didRandomPropertiesChange.ts

@@ -0,0 +1,13 @@
+// Copied from @matthewbonig/secret (MIT, https://github.com/mbonig/secret).
+// This file is generated by Batman and is yours to modify.
+export function didRandomPropertiesChange(oldGenerateSecretString: any, generateSecretString: any) {
+  return oldGenerateSecretString.excludeCharacters !== generateSecretString.excludeCharacters ||
+    oldGenerateSecretString.excludeLowercase !== generateSecretString.excludeLowercase ||
+    oldGenerateSecretString.excludeNumbers !== generateSecretString.excludeNumbers ||
+    oldGenerateSecretString.excludePunctuation !== generateSecretString.excludePunctuation ||
+    oldGenerateSecretString.excludeUppercase !== generateSecretString.excludeUppercase ||
+    oldGenerateSecretString.includeSpace !== generateSecretString.includeSpace ||
+    oldGenerateSecretString.passwordLength !== generateSecretString.passwordLength ||
+    oldGenerateSecretString.requireEachIncludedType !== generateSecretString.requireEachIncludedType;
+
+}

package/templates/app/src/constructs/handler/secret/updateSecretValue.ts

@@ -0,0 +1,71 @@
+// Copied from @matthewbonig/secret (MIT, https://github.com/mbonig/secret).
+// This file is generated by Batman and is yours to modify.
+import {
+  GetRandomPasswordCommand,
+  GetSecretValueCommand,
+  PutSecretValueCommand,
+} from '@aws-sdk/client-secrets-manager';
+import { client } from './client';
+import { didRandomPropertiesChange } from './didRandomPropertiesChange';
+
+export async function updateSecretValue({ oldGenerateSecretString, generateSecretString, secretArn }: {
+  secretArn: any;
+  generateSecretString: any;
+  oldGenerateSecretString: any;
+}) {
+  // let's get the existing value
+  const existingSecretValue = await client.send(new GetSecretValueCommand({
+    SecretId: secretArn,
+  }));
+  // and parse the existing value
+  let parsedValue: any = {};
+
+  try {
+    parsedValue = JSON.parse(existingSecretValue.SecretString!);
+  } catch (err) {
+    // the existing value couldn't be parsed, it was probably a random string.
+    // let's go ahead and just start fresh then,
+  }
+
+  // now let's check what properties have changed
+  const newSecretStringTemplate = JSON.parse(generateSecretString.secretStringTemplate);
+  const oldSecretStringTemplate = JSON.parse(oldGenerateSecretString.secretStringTemplate);
+  for (const key in newSecretStringTemplate) {
+    if (oldSecretStringTemplate[key] === undefined) {
+      // ok, so here's something to add...
+      parsedValue[key] = newSecretStringTemplate[key];
+    }
+    if (oldSecretStringTemplate[key] !== newSecretStringTemplate[key]) {
+      // ok, so here's something to update...
+      parsedValue[key] = newSecretStringTemplate[key];
+    }
+  }
+  for (const key in oldSecretStringTemplate) {
+    if (newSecretStringTemplate[key] === undefined) {
+      // ok, so here's something to remove...
+      delete parsedValue[key];
+    }
+  }
+
+  // did anything around the GenerateStringKey change?
+  if (didRandomPropertiesChange(oldGenerateSecretString, generateSecretString)
+    || generateSecretString.generateStringKey !== oldGenerateSecretString.generateStringKey) {
+    const { RandomPassword: newRandomValue } = await client.send(new GetRandomPasswordCommand({
+      ExcludeLowercase: generateSecretString.excludeLowercase === 'true',
+      ExcludeNumbers: generateSecretString.excludeNumbers === 'true',
+      ExcludePunctuation: generateSecretString.excludePunctuation === 'true',
+      ExcludeUppercase: generateSecretString.excludeUppercase === 'true',
+      IncludeSpace: generateSecretString.includeSpace === 'true',
+      PasswordLength: +generateSecretString.passwordLength,
+      RequireEachIncludedType: generateSecretString.requireEachIncludedType === 'true',
+    }));
+    parsedValue[generateSecretString.generateStringKey] = newRandomValue;
+  }
+
+  // update the secret in AWS
+  await client.send(new PutSecretValueCommand({
+    SecretId: secretArn,
+    SecretString: JSON.stringify(parsedValue),
+  }));
+
+}

package/templates/app/swamp-bootstrap/pull-extensions.ts

@@ -0,0 +1,68 @@
+/**
+ * Pulls each swamp extension at the version pinned in
+ * extensions/models/upstream_extensions.json, so a fresh clone runs the
+ * same extensions as the rest of the team, including any the repo added
+ * itself. A repo with no lockfile yet pulls DEFAULT_EXTENSIONS at their
+ * latest stable versions, which creates the lockfile.
+ *
+ * A pull rewrites the lockfile even at an identical version, and on Windows
+ * it writes backslash paths and deletes the committed files it tracks (e.g.
+ * .claude/skills/software-factory/). So afterwards the lockfile and every
+ * git-tracked file it lists are restored from git.
+ */
+import { execFileSync } from 'node:child_process';
+import { existsSync, readFileSync } from 'node:fs';
+
+const LOCKFILE = 'extensions/models/upstream_extensions.json';
+const DEFAULT_EXTENSIONS = ['@swamp/software-factory', '@webframp/github', '@goodcraft/github'];
+
+interface LockfileEntry {
+  version: string;
+  files?: string[];
+}
+
+function readLockfile(): Record<string, LockfileEntry> | undefined {
+  if (!existsSync(LOCKFILE)) {
+    return undefined;
+  }
+  return JSON.parse(readFileSync(LOCKFILE, 'utf8')) as Record<string, LockfileEntry>;
+}
+
+function run(command: string, args: string[]): string {
+  return execFileSync(command, args, { encoding: 'utf8', stdio: ['ignore', 'pipe', 'inherit'] });
+}
+
+function pull(extension: string): void {
+  console.log(`swamp extension pull ${extension} --force`);
+  execFileSync('swamp', ['extension', 'pull', extension, '--force'], { stdio: 'inherit' });
+}
+
+function restoreTrackedFiles(lockfile: Record<string, LockfileEntry>): void {
+  const listed = Object.values(lockfile)
+    .flatMap((entry) => entry.files ?? [])
+    .map((file) => file.replace(/\\/g, '/'))
+    .filter((file) => !file.startsWith('.swamp/'));
+  const tracked = run('git', ['ls-files', '-z', '--', LOCKFILE, ...listed])
+    .split('\0')
+    .filter(Boolean);
+  if (tracked.length > 0) {
+    run('git', ['checkout', '--', ...tracked]);
+    console.log(`Restored ${tracked.length} tracked file(s) from git`);
+  }
+}
+
+function main(): void {
+  const lockfile = readLockfile();
+  if (!lockfile) {
+    console.log(`No ${LOCKFILE} yet: pulling the latest stable software-factory extensions`);
+    DEFAULT_EXTENSIONS.forEach(pull);
+    return;
+  }
+
+  for (const [name, entry] of Object.entries(lockfile)) {
+    pull(`${name}@${entry.version}`);
+  }
+  restoreTrackedFiles(lockfile);
+}
+
+main();

package/templates/app/swamp-bootstrap/tsconfig.json

@@ -0,0 +1,13 @@
+{
+  "extends": "../tsconfig.json",
+  "compilerOptions": {
+    "noEmit": true,
+    "rootDir": "."
+  },
+  "include": [
+    "*.ts"
+  ],
+  "exclude": [
+    "node_modules"
+  ]
+}

package/templates/app/test/DataDogAspect.test.ts

@@ -0,0 +1,31 @@
+import { App, Aspects, Stack } from 'aws-cdk-lib';
+import { Match, Template } from 'aws-cdk-lib/assertions';
+import { Code, Function, Runtime } from 'aws-cdk-lib/aws-lambda';
+import { DatadogLambda } from 'datadog-cdk-constructs-v2';
+import { DataDogAspect } from '../src/aspects/DataDogAspect';
+
+describe('DataDogAspect', () => {
+  test('adds every Lambda function in the stack to Datadog', () => {
+    const app = new App();
+    const stack = new Stack(app, 'TestStack', { env: { account: '111111111111', region: 'us-east-1' } });
+    const datadog = new DatadogLambda(stack, 'Datadog', {
+      nodeLayerVersion: 120,
+      extensionLayerVersion: 80,
+      site: 'datadoghq.com',
+      apiKeySecretArn: 'arn:aws:secretsmanager:us-east-1:111111111111:secret:datadog',
+    });
+    new Function(stack, 'Handler', {
+      runtime: Runtime.NODEJS_22_X,
+      handler: 'index.handler',
+      code: Code.fromInline('exports.handler = async () => {};'),
+    });
+
+    Aspects.of(stack).add(new DataDogAspect({ datadog }));
+    const template = Template.fromStack(stack);
+
+    template.hasResourceProperties('AWS::Lambda::Function', {
+      Environment: { Variables: Match.objectLike({ DD_LAMBDA_HANDLER: 'index.handler' }) },
+      Layers: Match.arrayWith([Match.stringLikeRegexp('Datadog-Extension')]),
+    });
+  });
+});

package/templates/app/test/Secret.test.ts

@@ -0,0 +1,40 @@
+import { App, Stack } from 'aws-cdk-lib';
+import { Match, Template } from 'aws-cdk-lib/assertions';
+import { Secret } from '../src/constructs/Secret';
+
+function synth(addSecret: (stack: Stack) => void): Template {
+  const app = new App({ context: { 'aws:cdk:bundling-stacks': [] } });
+  const stack = new Stack(app, 'TestStack');
+  addSecret(stack);
+  return Template.fromStack(stack);
+}
+
+describe('Secret', () => {
+  test('generates a templated secret value through a custom resource', () => {
+    const template = synth((stack) => new Secret(stack, 'Secret', {
+      generateSecretString: { secretStringTemplate: '{"username":"app"}', generateStringKey: 'password' },
+    }));
+
+    template.resourceCountIs('Custom::GenerateSecretString', 1);
+    template.hasResourceProperties('AWS::SecretsManager::Secret', {
+      GenerateSecretString: Match.objectEquals({}),
+    });
+    template.hasResourceProperties('AWS::Lambda::Function', { Runtime: 'nodejs24.x' });
+    template.hasResourceProperties('AWS::IAM::Policy', {
+      PolicyDocument: {
+        Statement: Match.arrayWith([
+          Match.objectLike({ Action: 'secretsmanager:GetRandomPassword', Effect: 'Allow', Resource: '*' }),
+        ]),
+      },
+    });
+  });
+
+  test('creates no custom resource without a secret string template', () => {
+    const template = synth((stack) => new Secret(stack, 'Secret', {
+      generateSecretString: { passwordLength: 32 },
+    }));
+
+    template.resourceCountIs('Custom::GenerateSecretString', 0);
+    template.resourceCountIs('AWS::Lambda::Function', 0);
+  });
+});

package/templates/app/test/didRandomPropertiesChange.test.ts

@@ -0,0 +1,19 @@
+import { didRandomPropertiesChange } from '../src/constructs/handler/secret/didRandomPropertiesChange';
+
+describe('didRandomPropertiesChange', () => {
+  const base = { passwordLength: 32, excludePunctuation: true, secretStringTemplate: '{}', generateStringKey: 'password' };
+
+  test('is false when only non-random properties change', () => {
+    expect(didRandomPropertiesChange(base, { ...base, secretStringTemplate: '{"a":1}', generateStringKey: 'pw' })).toBe(false);
+  });
+
+  test.each([
+    ['passwordLength', 64],
+    ['excludePunctuation', false],
+    ['excludeCharacters', '"@/'],
+    ['includeSpace', true],
+    ['requireEachIncludedType', true],
+  ])('is true when %s changes', (key, value) => {
+    expect(didRandomPropertiesChange(base, { ...base, [key]: value })).toBe(true);
+  });
+});

package/templates/app/test/tsconfig.json

@@ -0,0 +1,13 @@
+{
+  "extends": "../tsconfig.json",
+  "compilerOptions": {
+    "noEmit": true,
+    "rootDir": ".."
+  },
+  "include": [
+    "**/*.ts"
+  ],
+  "exclude": [
+    "node_modules"
+  ]
+}

package/templates/app/tsconfig.json

@@ -0,0 +1,50 @@
+{
+  "compilerOptions": {
+    "rootDir": "src",
+    "outDir": "lib",
+    "alwaysStrict": true,
+    "declaration": true,
+    "esModuleInterop": true,
+    "experimentalDecorators": true,
+    "inlineSourceMap": true,
+    "inlineSources": true,
+    "lib": [
+      "es2022"
+    ],
+    "module": "NodeNext",
+    "noEmitOnError": false,
+    "noFallthroughCasesInSwitch": false,
+    "noImplicitAny": true,
+    "noImplicitReturns": true,
+    "noImplicitThis": true,
+    "noUnusedLocals": false,
+    "noUnusedParameters": false,
+    "resolveJsonModule": true,
+    "strict": true,
+    "strictNullChecks": true,
+    "strictPropertyInitialization": false,
+    "stripInternal": true,
+    "target": "ES2022",
+    "types": [
+      "jest",
+      "jsonwebtoken",
+      "node",
+      "aws-lambda",
+      "express",
+      "pg"
+    ],
+    "moduleResolution": "nodenext",
+    "typeRoots": [
+      "./node_modules/@types"
+    ],
+    "isolatedModules": true,
+    "allowImportingTsExtensions": true
+  },
+  "include": [
+    "src/**/*.ts"
+  ],
+  "exclude": [
+    "node_modules",
+    "cdk.out"
+  ]
+}

package/openspec/changes/pr-workflow-concurrency-group/.openspec.yaml

@@ -1,2 +0,0 @@
-schema: spec-driven
-created: 2026-09-09

package/openspec/changes/pr-workflow-concurrency-group/design.md

@@ -1,47 +0,0 @@
-## Context
-
-`PrDeployWorkflow` (`.github/workflows/pr-deploy.yml`) and `PrCleanupWorkflow` (`.github/workflows/pr-cleanup.yml`) are two independent `YamlFile` constructs, each hand-authored as a literal `obj:` in `projen/src/PrDeployWorkflow.ts` and `projen/src/PrCleanupWorkflow.ts`. Both are instantiated together in every Batman app via `Application.ts`. `pr-deploy` runs on `pull_request: [opened, synchronize, reopened]` and deploys the PR's stack (`cdk deploy`); `pr-cleanup` runs on `pull_request: [closed]` and tears the same stack down (`aws cloudformation delete-stack` + wait). Neither declares a `concurrency` block, so GitHub Actions runs them in parallel with no ordering guarantee. Issue #87 documents a concrete incident: a PR was closed while its 59-resource stack was still creating, `pr-cleanup`'s delete raced the in-flight create, and the stack ended up `DELETE_FAILED` with an orphaned bucket.
-
-`ProjenWorkflowHardening.ts` establishes the precedent for this class of fix: workflows projen generates on its own get patched externally via `JsonPatch`, but hand-authored workflows like these two are edited directly in their source `obj:` literal. This change follows that same convention.
-
-## Goals / Non-Goals
-
-**Goals:**
-- Guarantee `pr-deploy` and `pr-cleanup` never execute concurrently against the same PR's stack.
-- Prefer queuing over cancellation: a run that has to wait should wait, not get killed mid-`cdk deploy`/mid-delete, since a cancelled deploy can leave CloudFormation in `UPDATE_IN_PROGRESS` and break the next run.
-- Keep the group key identical between the two workflows so they queue against each other, not just against themselves.
-
-**Non-Goals:**
-- Recovering a stack already stuck in `DELETE_FAILED`/`ROLLBACK_COMPLETE` (issue #87's "Fix 2"). That requires a separate spike to pick between reaper-style detection-and-repair and `--no-rollback` on PR-stack deploys, and is tracked as follow-up work, not this change.
-- Changing what `pr-deploy`/`pr-cleanup` each do once it's their turn to run — this change only affects *when* they're allowed to start.
-- Deduplicating/redesigning the two workflows' trigger conditions or stack-naming logic (companion issue #88).
-
-## Decisions
-
-**Concurrency group key: `pr-stack-${{ github.event.pull_request.number }}`, identical in both workflows.**
-The PR number is the natural join key — it's the one thing both workflows compute their stack identity from (via the PR's branch name), and it's available on the `pull_request` event both workflows already trigger on. A key scoped to the workflow name (GitHub's default when `concurrency.group` is omitted) would only serialize `pr-deploy` runs against each other and `pr-cleanup` runs against each other — it would *not* prevent the race between the two workflows, which is the actual bug. The group must be textually identical in both files for GitHub to treat them as the same queue.
-
-**`cancel-in-progress: false` in both workflows.**
-Alternative considered: `cancel-in-progress: true`, which is the more common concurrency-group pattern (e.g. superseding stale CI runs on new pushes). Rejected here because cancelling a `pr-deploy` run mid-`cdk deploy` leaves CloudFormation in `UPDATE_IN_PROGRESS`/`CREATE_IN_PROGRESS`, which fails the *next* deploy attempt against that stack — trading one class of race for another. Queuing (`false`) means a `pr-cleanup` triggered while `pr-deploy` is running simply waits for it to finish, then deletes the now-complete stack; a `pr-deploy` triggered while a prior `pr-deploy` is still running (e.g. rapid pushes) waits its turn instead of double-deploying.
-
-**Edit the two `YamlFile` `obj:` literals directly, not a shared external patch.**
-Alternative considered: a `ProjenWorkflowHardening`-style helper that patches `concurrency` onto both workflows post-construction. Rejected because both workflows are already hand-authored in this package (unlike the projen-builtin workflows `ProjenWorkflowHardening` targets), so there's no `JsonPatch`-vs-source-edit tension to resolve — adding a two-line `concurrency` key next to each `obj:`'s existing `name`/`on`/`permissions` keys is simpler and keeps the workflow's full shape in one place.
-
-## Risks / Trade-offs
-
-- [A PR merge/close event and a fast-follow `pr-deploy` push (e.g. re-opening) could still queue for a while if a prior run is slow] → Acceptable: queuing bounds this to "wait", never "corrupt state"; GitHub Actions queue depth for a single PR is small in practice.
-- [Non-`pull_request`-number contexts, if a workflow is ever re-triggered via `workflow_dispatch` or similar, would evaluate `github.event.pull_request.number` as empty and could collide group keys across PRs] → Out of scope: both workflows currently only trigger on `pull_request` events, so this doesn't apply today; flag it if either workflow's `on:` trigger ever expands.
-- [This change doesn't fix `DELETE_FAILED` stacks that already exist from prior races] → Those are cleaned up manually per issue #87; this change only prevents new occurrences.
-
-## Migration Plan
-
-1. Add `concurrency` to `PrDeployWorkflow`'s and `PrCleanupWorkflow`'s generated `obj:`.
-2. Add/update unit tests asserting both workflows render the same `concurrency.group` string.
-3. Run `npx projen` in this package to confirm no other synthesized output changes unexpectedly.
-4. Downstream consumers (e.g. `exman`) pick up the fix the next time they bump this package version and re-run projen synth, regenerating `.github/workflows/pr-deploy.yml` / `pr-cleanup.yml` with the new `concurrency` block. No manual migration step needed beyond the normal dependency bump.
-
-No rollback concerns: removing the `concurrency` block is a pure revert with no state to unwind.
-
-## Open Questions
-
-None — issue #87's own investigation already resolved the "queue vs. cancel" question (`cancel-in-progress: false`) and identified the exact group key needed.

package/openspec/changes/pr-workflow-concurrency-group/proposal.md

@@ -1,27 +0,0 @@
-## Why
-
-`PrDeployWorkflow` and `PrCleanupWorkflow` generate independent GitHub Actions workflows that both operate on the same CloudFormation stack (`pr-deploy` creates/updates it, `pr-cleanup` deletes it) but declare no `concurrency` block. When a PR is closed while its deploy is still in flight, `pr-cleanup` issues `aws cloudformation delete-stack` against a stack that is mid-`CREATE_IN_PROGRESS`. On 2026-09-03 this raced a 59-resource stack, cancelled the create, failed the rollback, and left the stack `DELETE_FAILED` with an orphaned S3 bucket requiring manual cleanup (see issue #87). This affects every generated Batman app, and 2 of 12 `pr-cleanup` runs failed that same day, consistent with this being a recurring class of failure rather than a one-off.
-
-## What Changes
-
-- Add a `concurrency` block to `PrDeployWorkflow`'s generated `pr-deploy.yml`, keyed on the PR number.
-- Add the identical `concurrency` block to `PrCleanupWorkflow`'s generated `pr-cleanup.yml`, keyed on the same PR-number-derived group name.
-- Use `cancel-in-progress: false` on both so a queued run waits for the in-flight run to finish rather than being cancelled mid-`cdk deploy` (which would abandon CloudFormation in `UPDATE_IN_PROGRESS` and break the next deploy).
-- Regenerate/synth downstream projects (e.g. `exman`) so the emitted workflow YAML picks up the new `concurrency` block.
-
-Out of scope: the `DELETE_FAILED`/orphaned-bucket recovery path described as "Fix 2" in issue #87 (detecting and repairing `DELETE_FAILED`/`ROLLBACK_COMPLETE` stacks, or `--no-rollback` for PR-stack deploys). The issue itself notes neither option is settled yet and calls for a separate spike; queuing via `concurrency` prevents the race that causes `DELETE_FAILED` in the first place, so it is not required to close this change.
-
-## Capabilities
-
-### New Capabilities
-- `pr-workflow-concurrency`: Generated `pr-deploy.yml` and `pr-cleanup.yml` workflows share a concurrency group so that a stack delete triggered by closing a PR is queued behind, rather than raced against, an in-flight deploy of the same stack.
-
-### Modified Capabilities
-(none — no existing specs cover PR deploy/cleanup workflow generation)
-
-## Impact
-
-- `projen/src/PrDeployWorkflow.ts` — add `concurrency` to the generated workflow object.
-- `projen/src/PrCleanupWorkflow.ts` — add matching `concurrency` to the generated workflow object.
-- `projen/src/BatmanProject.test.ts` (or equivalent) — add coverage asserting both workflows emit the same concurrency group.
-- Any downstream project generated from these projen constructs (e.g. `exman`) needs to re-run projen synth to regenerate `.github/workflows/pr-deploy.yml` and `.github/workflows/pr-cleanup.yml` with the fix.

package/openspec/changes/pr-workflow-concurrency-group/specs/pr-workflow-concurrency/spec.md

@@ -1,23 +0,0 @@
-## ADDED Requirements
-
-### Requirement: Shared concurrency group across PR deploy and cleanup workflows
-The generated `pr-deploy.yml` and `pr-cleanup.yml` workflows SHALL each declare a top-level `concurrency.group` keyed on the pull request number (`pr-stack-${{ github.event.pull_request.number }}`), and the group value SHALL be identical text in both files, so that GitHub Actions serializes runs of the two workflows against the same PR into a single queue.
-
-#### Scenario: pr-cleanup triggered while pr-deploy is still running
-- **WHEN** a PR is closed while its `pr-deploy` run for that same PR is still in progress
-- **THEN** the `pr-cleanup` run for that PR does not start until the in-progress `pr-deploy` run for that PR finishes
-
-#### Scenario: Concurrent pr-deploy runs on the same PR
-- **WHEN** two `pr-deploy` runs are triggered for the same PR in close succession (e.g. rapid pushes)
-- **THEN** the second run queues behind the first rather than executing `cdk deploy` concurrently against the same stack
-
-#### Scenario: Group keys match between workflows
-- **WHEN** the generated `pr-deploy.yml` and `pr-cleanup.yml` are compared for a given PR event
-- **THEN** their `concurrency.group` values evaluate to the same string, so GitHub Actions treats them as the same queue
-
-### Requirement: Queue instead of cancel in-flight runs
-Both `pr-deploy.yml` and `pr-cleanup.yml` SHALL set `concurrency.cancel-in-progress: false`, so that a queued run waits for the currently running workflow to finish instead of being cancelled mid-execution.
-
-#### Scenario: Queued run does not cancel an in-flight deploy
-- **WHEN** `pr-cleanup` is queued behind a running `pr-deploy` for the same PR
-- **THEN** the running `pr-deploy` job is allowed to run to completion (success or failure) rather than being cancelled by GitHub Actions

package/openspec/changes/pr-workflow-concurrency-group/tasks.md

@@ -1,15 +0,0 @@
-## 1. Add concurrency block to generated workflows
-
-- [x] 1.1 In `src/PrDeployWorkflow.ts`, add `concurrency: { group: 'pr-stack-${{ github.event.pull_request.number }}', 'cancel-in-progress': false }` to the generated `obj:` (alongside `name`, `on`, `permissions`).
-- [x] 1.2 In `src/PrCleanupWorkflow.ts`, add the identical `concurrency` block to its generated `obj:`.
-
-## 2. Test coverage
-
-- [x] 2.1 In `test/DeployWorkflows.test.ts`, add a test (or extend an existing one) asserting `pr-deploy.yml` and `pr-cleanup.yml` both render `concurrency.group: pr-stack-${{ github.event.pull_request.number }}` and `concurrency.cancel-in-progress: false`.
-- [x] 2.2 Add an assertion that the two workflows' `concurrency.group` values are textually identical, so the test fails if they ever drift apart.
-- [x] 2.3 Update `test/__snapshots__/DeployWorkflows.test.ts.snap` (and any other snapshots covering `pr-deploy.yml`/`pr-cleanup.yml`, e.g. `BatmanProject.test.ts.snap`, `BootcampProject.test.ts.snap`) by running the test suite with snapshot update, then review the diff for correctness before committing.
-
-## 3. Verify
-
-- [x] 3.1 Run the full `projen`/build test suite and confirm it passes with the updated snapshots.
-- [x] 3.2 Run `npx projen` in this package to confirm no unrelated synthesized output changes.