aws-cdk-github-oidc 4.2.4 → 4.2.5

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (13) hide show
  1. package/.jsii +2 -2
  2. package/lib/provider.js +1 -1
  3. package/lib/role.js +1 -1
  4. package/migration-test/README.md +77 -0
  5. package/migration-test/bin/app.ts +8 -0
  6. package/migration-test/cdk.json +6 -0
  7. package/migration-test/config/resource-mapping.template.json +5 -0
  8. package/migration-test/lib/migration-test-stack.ts +77 -0
  9. package/migration-test/package.json +24 -0
  10. package/migration-test/pnpm-lock.yaml +423 -0
  11. package/migration-test/pnpm-workspace.yaml +21 -0
  12. package/migration-test/scripts/run-migration.sh +179 -0
  13. package/package.json +1 -1
package/.jsii CHANGED
@@ -9075,6 +9075,6 @@
9075
9075
  "symbolId": "src/iam-role-props:RoleProps"
9076
9076
  }
9077
9077
  },
9078
- "version": "4.2.4",
9079
- "fingerprint": "KJG7bNW0ccNGKOMNCmr5lJPzXceBD9C1VDMWhKu2zfM="
9078
+ "version": "4.2.5",
9079
+ "fingerprint": "LTZU9YOlnf1mcr4UKY3KF3J2SeSq64fZPLauWde6gMI="
9080
9080
  }
package/lib/provider.js CHANGED
@@ -55,6 +55,6 @@ class GithubActionsIdentityProvider extends iam.OidcProviderNative {
55
55
  }
56
56
  exports.GithubActionsIdentityProvider = GithubActionsIdentityProvider;
57
57
  _a = JSII_RTTI_SYMBOL_1;
58
- GithubActionsIdentityProvider[_a] = { fqn: "aws-cdk-github-oidc.GithubActionsIdentityProvider", version: "4.2.4" };
58
+ GithubActionsIdentityProvider[_a] = { fqn: "aws-cdk-github-oidc.GithubActionsIdentityProvider", version: "4.2.5" };
59
59
  GithubActionsIdentityProvider.issuer = "token.actions.githubusercontent.com";
60
60
  //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicHJvdmlkZXIuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi9zcmMvcHJvdmlkZXIudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7QUFBQSxtQ0FBbUM7QUFDbkMsMkNBQTJDO0FBaUIzQzs7Ozs7Ozs7O0dBU0c7QUFDSCxNQUFhLDZCQUNYLFNBQVEsR0FBRyxDQUFDLGtCQUFrQjtJQUs5Qjs7Ozs7Ozs7Ozs7O09BWUc7SUFDSSxNQUFNLENBQUMsV0FBVyxDQUN2QixLQUFnQixFQUNoQixFQUFVO1FBRVYsTUFBTSxTQUFTLEdBQUcsR0FBRyxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUMsS0FBSyxDQUFDLENBQUMsT0FBTyxDQUFDO1FBQzlDLE1BQU0sV0FBVyxHQUFHLGdCQUFnQixTQUFTLGtCQUFrQiw2QkFBNkIsQ0FBQyxNQUFNLEVBQUUsQ0FBQztRQUN0RyxPQUFPLEdBQUcsQ0FBQyxrQkFBa0IsQ0FBQyxtQkFBbUIsQ0FBQyxLQUFLLEVBQUUsRUFBRSxFQUFFLFdBQVcsQ0FBQyxDQUFDO0lBQzVFLENBQUM7SUFFRDs7Ozs7Ozs7OztPQVVHO0lBQ0gsWUFDRSxLQUFnQixFQUNoQixFQUFVLEVBQ1YsS0FBMEM7UUFFMUMsS0FBSyxDQUFDLEtBQUssRUFBRSxFQUFFLEVBQUU7WUFDZixHQUFHLEtBQUs7WUFDUixHQUFHLEVBQUUsV0FBVyw2QkFBNkIsQ0FBQyxNQUFNLEVBQUU7WUFDdEQsU0FBUyxFQUFFLENBQUMsbUJBQW1CLENBQUM7U0FDakMsQ0FBQyxDQUFDO0lBQ0wsQ0FBQzs7QUFqREgsc0VBa0RDOzs7QUE5Q3dCLG9DQUFNLEdBQVcscUNBQXFDLENBQUMiLCJzb3VyY2VzQ29udGVudCI6WyJpbXBvcnQgKiBhcyBjZGsgZnJvbSBcImF3cy1jZGstbGliXCI7XG5pbXBvcnQgKiBhcyBpYW0gZnJvbSBcImF3cy1jZGstbGliL2F3cy1pYW1cIjtcbmltcG9ydCB7IENvbnN0cnVjdCB9IGZyb20gXCJjb25zdHJ1Y3RzXCI7XG5cbmV4cG9ydCBpbnRlcmZhY2UgR2l0aHViQWN0aW9uc0lkZW50aXR5UHJvdmlkZXJQcm9wcyB7XG4gIC8qKlxuICAgKiBUaGUgcmVtb3ZhbCBwb2xpY3kgZm9yIHRoZSBwcm92aWRlci5cbiAgICpcbiAgICogQGRlZmF1bHQgY2RrLlJlbW92YWxQb2xpY3kuREVTVFJPWVxuICAgKi9cbiAgcmVhZG9ubHkgcmVtb3ZhbFBvbGljeT86IGNkay5SZW1vdmFsUG9saWN5O1xufVxuXG4vKipcbiAqIERlc2NyaWJlcyBhIEdpdGh1YiBPcGVuSUQgQ29ubmVjdCBJZGVudGl0eSBQcm92aWRlciBmb3IgQVdTIElBTS5cbiAqL1xuZXhwb3J0IGludGVyZmFjZSBJR2l0aHViQWN0aW9uc0lkZW50aXR5UHJvdmlkZXIgZXh0ZW5kcyBpYW0uSU9pZGNQcm92aWRlciB7fVxuXG4vKipcbiAqIEdpdGh1YiBBY3Rpb25zIGFzIE9wZW5JRCBDb25uZWN0IElkZW50aXR5IFByb3ZpZGVyIGZvciBBV1MgSUFNLlxuICogVGhlcmUgY2FuIGJlIG9ubHkgb25lIChwZXIgQVdTIEFjY291bnQpLlxuICpcbiAqIFVzZSBgZnJvbUFjY291bnRgIHRvIHJldHJpZXZlIGEgcmVmZXJlbmNlIHRvIGV4aXN0aW5nIEdpdGh1YiBPSURDIHByb3ZpZGVyLlxuICpcbiAqIFVzZXMgdGhlIG5hdGl2ZSBDbG91ZEZvcm1hdGlvbiByZXNvdXJjZSBBV1M6OklBTTo6T0lEQ1Byb3ZpZGVyIChubyBMYW1iZGEgZnVuY3Rpb25zKS5cbiAqXG4gKiBAc2VlIGh0dHBzOi8vZG9jcy5naXRodWIuY29tL2VuL2FjdGlvbnMvZGVwbG95bWVudC9zZWN1cml0eS1oYXJkZW5pbmcteW91ci1kZXBsb3ltZW50cy9jb25maWd1cmluZy1vcGVuaWQtY29ubmVjdC1pbi1hbWF6b24td2ViLXNlcnZpY2VzXG4gKi9cbmV4cG9ydCBjbGFzcyBHaXRodWJBY3Rpb25zSWRlbnRpdHlQcm92aWRlclxuICBleHRlbmRzIGlhbS5PaWRjUHJvdmlkZXJOYXRpdmVcbiAgaW1wbGVtZW50cyBJR2l0aHViQWN0aW9uc0lkZW50aXR5UHJvdmlkZXJcbntcbiAgcHVibGljIHN0YXRpYyByZWFkb25seSBpc3N1ZXI6IHN0cmluZyA9IFwidG9rZW4uYWN0aW9ucy5naXRodWJ1c2VyY29udGVudC5jb21cIjtcblxuICAvKipcbiAgICogUmV0cmlldmUgYSByZWZlcmVuY2UgdG8gZXhpc3RpbmcgR2l0aHViIE9JREMgcHJvdmlkZXIgaW4geW91ciBBV1MgYWNjb3VudC5cbiAgICogQW4gQVdTIGFjY291bnQgY2FuIG9ubHkgaGF2ZSBzaW5nbGUgR2l0aHViIE9JREMgcHJvdmlkZXIgY29uZmlndXJlZCBpbnRvIGl0LFxuICAgKiBzbyBpbnRlcm5hbGx5IHRoZSByZWZlcmVuY2UgaXMgbWFkZSBieSBjb25zdHJ1Y3RpbmcgdGhlIEFSTiBmcm9tIEFXU1xuICAgKiBBY2NvdW50IElEICYgR2l0aHViIGlzc3VlciBVUkwuXG4gICAqXG4gICAqIEBwYXJhbSBzY29wZSBDREsgU3RhY2sgb3IgQ29uc3RydWN0IHRvIHdoaWNoIHRoZSBwcm92aWRlciBpcyBhc3NpZ25lZCB0b1xuICAgKiBAcGFyYW0gaWQgQ0RLIENvbnN0cnVjdCBJRCBnaXZlbiB0byB0aGUgY29uc3RydWN0XG4gICAqIEByZXR1cm5zIGEgQ0RLIENvbnN0cnVjdCByZXByZXNlbnRpbmcgdGhlIEdpdGh1YiBPSURDIHByb3ZpZGVyXG4gICAqXG4gICAqIEBleGFtcGxlXG4gICAqIEdpdGh1YkFjdGlvbnNJZGVudGl0eVByb3ZpZGVyLmZyb21BY2NvdW50KHNjb3BlLCBcIkdpdGh1YlByb3ZpZGVyXCIpO1xuICAgKi9cbiAgcHVibGljIHN0YXRpYyBmcm9tQWNjb3VudChcbiAgICBzY29wZTogQ29uc3RydWN0LFxuICAgIGlkOiBzdHJpbmcsXG4gICk6IElHaXRodWJBY3Rpb25zSWRlbnRpdHlQcm92aWRlciB7XG4gICAgY29uc3QgYWNjb3VudElkID0gY2RrLlN0YWNrLm9mKHNjb3BlKS5hY2NvdW50O1xuICAgIGNvbnN0IHByb3ZpZGVyQXJuID0gYGFybjphd3M6aWFtOjoke2FjY291bnRJZH06b2lkYy1wcm92aWRlci8ke0dpdGh1YkFjdGlvbnNJZGVudGl0eVByb3ZpZGVyLmlzc3Vlcn1gO1xuICAgIHJldHVybiBpYW0uT2lkY1Byb3ZpZGVyTmF0aXZlLmZyb21PaWRjUHJvdmlkZXJBcm4oc2NvcGUsIGlkLCBwcm92aWRlckFybik7XG4gIH1cblxuICAvKipcbiAgICogRGVmaW5lIGEgbmV3IEdpdGh1YiBPcGVuSUQgQ29ubmVjdCBJZGVudGl0eSBQcm92aWRlciBmb3IgQVdTIElBTS5cbiAgICogVGhlcmUgY2FuIGJlIG9ubHkgb25lIChwZXIgQVdTIEFjY291bnQpLlxuICAgKlxuICAgKiBAcGFyYW0gc2NvcGUgQ0RLIFN0YWNrIG9yIENvbnN0cnVjdCB0byB3aGljaCB0aGUgcHJvdmlkZXIgaXMgYXNzaWduZWQgdG9cbiAgICogQHBhcmFtIGlkIENESyBDb25zdHJ1Y3QgSUQgZ2l2ZW4gdG8gdGhlIGNvbnN0cnVjdFxuICAgKiBAcGFyYW0gcHJvcHMgb3B0aW9uYWwgcHJvcGVydGllcyBmb3IgdGhlIHByb3ZpZGVyXG4gICAqXG4gICAqIEBleGFtcGxlXG4gICAqIG5ldyBHaXRodWJBY3Rpb25zSWRlbnRpdHlQcm92aWRlcihzY29wZSwgXCJHaXRodWJQcm92aWRlclwiKTtcbiAgICovXG4gIGNvbnN0cnVjdG9yKFxuICAgIHNjb3BlOiBDb25zdHJ1Y3QsXG4gICAgaWQ6IHN0cmluZyxcbiAgICBwcm9wcz86IEdpdGh1YkFjdGlvbnNJZGVudGl0eVByb3ZpZGVyUHJvcHMsXG4gICkge1xuICAgIHN1cGVyKHNjb3BlLCBpZCwge1xuICAgICAgLi4ucHJvcHMsXG4gICAgICB1cmw6IGBodHRwczovLyR7R2l0aHViQWN0aW9uc0lkZW50aXR5UHJvdmlkZXIuaXNzdWVyfWAsXG4gICAgICBjbGllbnRJZHM6IFtcInN0cy5hbWF6b25hd3MuY29tXCJdLFxuICAgIH0pO1xuICB9XG59XG4iXX0=
package/lib/role.js CHANGED
@@ -101,5 +101,5 @@ class GithubActionsRole extends iam.Role {
101
101
  }
102
102
  exports.GithubActionsRole = GithubActionsRole;
103
103
  _a = JSII_RTTI_SYMBOL_1;
104
- GithubActionsRole[_a] = { fqn: "aws-cdk-github-oidc.GithubActionsRole", version: "4.2.4" };
104
+ GithubActionsRole[_a] = { fqn: "aws-cdk-github-oidc.GithubActionsRole", version: "4.2.5" };
105
105
  //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicm9sZS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3NyYy9yb2xlLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7Ozs7O0FBQUEsbUNBQW1DO0FBQ25DLDJDQUEyQztBQUczQyxpREFBaUQ7QUFDakQseUNBR29CO0FBb0VwQjs7Ozs7Ozs7Ozs7Ozs7Ozs7R0FpQkc7QUFDSCxNQUFhLGlCQUFrQixTQUFRLEdBQUcsQ0FBQyxJQUFJO0lBQzdDOzs7O09BSUc7SUFDSyxNQUFNLENBQUMsZ0JBQWdCLENBQzdCLEtBQTZCO1FBRTdCLE1BQU0sWUFBWSxHQUFRLEtBQUssQ0FBQztRQUNoQyxPQUFPLFlBQVksQ0FBQyxRQUFRLENBQUM7UUFDN0IsT0FBTyxZQUFZLENBQUMsS0FBSyxDQUFDO1FBQzFCLE9BQU8sWUFBWSxDQUFDLElBQUksQ0FBQztRQUN6QixPQUFPLFlBQVksQ0FBQyxNQUFNLENBQUM7UUFDM0IsT0FBTyxZQUFZLENBQUM7SUFDdEIsQ0FBQztJQUVELDhEQUE4RDtJQUN0RCxNQUFNLENBQUMsYUFBYSxDQUFDLEtBQWdCLEVBQUUsS0FBYTtRQUMxRCxJQUFJLHNCQUFtQixDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsS0FBSyxJQUFJLEVBQUUsQ0FBQztZQUM3QyxHQUFHLENBQUMsV0FBVyxDQUFDLEVBQUUsQ0FBQyxLQUFLLENBQUMsQ0FBQyxRQUFRLENBQ2hDLG9DQUFvQyxLQUFLLDBLQUEwSyxDQUNwTixDQUFDO1FBQ0osQ0FBQztJQUNILENBQUM7SUFFRCw0REFBNEQ7SUFDcEQsTUFBTSxDQUFDLFlBQVksQ0FBQyxLQUFnQixFQUFFLElBQVk7UUFDeEQsSUFBSSxJQUFJLEtBQUssRUFBRSxFQUFFLENBQUM7WUFDaEIsR0FBRyxDQUFDLFdBQVcsQ0FBQyxFQUFFLENBQUMsS0FBSyxDQUFDLENBQUMsUUFBUSxDQUNoQyxtQ0FBbUMsSUFBSSw2QkFBNkIsQ0FDckUsQ0FBQztRQUNKLENBQUM7SUFDSCxDQUFDO0lBRUQsb0RBQW9EO0lBQzVDLE1BQU0sQ0FBQyxhQUFhLENBQUMsS0FBMEI7UUFDckQsTUFBTSxFQUFFLEtBQUssRUFBRSxJQUFJLEVBQUUsTUFBTSxHQUFHLEdBQUcsRUFBRSxHQUFHLEtBQUssQ0FBQztRQUM1QyxPQUFPLFFBQVEsS0FBSyxJQUFJLElBQUksSUFBSSxNQUFNLEVBQUUsQ0FBQztJQUMzQyxDQUFDO0lBRUQ7Ozs7Ozs7Ozs7Ozs7Ozs7O09BaUJHO0lBQ0gsWUFBWSxLQUFnQixFQUFFLEVBQVUsRUFBRSxLQUE2QjtRQUNyRSxNQUFNLEVBQUUsUUFBUSxFQUFFLEtBQUssRUFBRSxJQUFJLEVBQUUsR0FBRyxLQUFLLENBQUM7UUFFeEMsc0JBQXNCO1FBQ3RCLGlCQUFpQixDQUFDLGFBQWEsQ0FBQyxLQUFLLEVBQUUsS0FBSyxDQUFDLENBQUM7UUFDOUMsaUJBQWlCLENBQUMsWUFBWSxDQUFDLEtBQUssRUFBRSxJQUFJLENBQUMsQ0FBQztRQUU1QyxpQkFBaUI7UUFDakIsTUFBTSxPQUFPLEdBQUcsaUJBQWlCLENBQUMsYUFBYSxDQUFDLEtBQUssQ0FBQyxDQUFDO1FBQ3ZELE1BQU0sU0FBUyxHQUFHLGlCQUFpQixDQUFDLGdCQUFnQixDQUFDLEtBQUssQ0FBQyxDQUFDO1FBRTVELCtCQUErQjtRQUMvQixLQUFLLENBQUMsS0FBSyxFQUFFLEVBQUUsRUFBRTtZQUNmLEdBQUcsU0FBUztZQUNaLFNBQVMsRUFBRSxJQUFJLEdBQUcsQ0FBQyxvQkFBb0IsQ0FBQyxRQUFRLENBQUMsZUFBZSxFQUFFO2dCQUNoRSxVQUFVLEVBQUU7b0JBQ1Ysb0RBQW9EO29CQUNwRCxDQUFDLEdBQUcsd0NBQTZCLENBQUMsTUFBTSxNQUFNLENBQUMsRUFBRSxPQUFPO2lCQUN6RDtnQkFDRCxZQUFZLEVBQUU7b0JBQ1osdUVBQXVFO29CQUN2RSwwS0FBMEs7b0JBQzFLLENBQUMsR0FBRyx3Q0FBNkIsQ0FBQyxNQUFNLE1BQU0sQ0FBQyxFQUFFLG1CQUFtQjtpQkFDckU7YUFDRixDQUFDO1NBQ0gsQ0FBQyxDQUFDO0lBQ0wsQ0FBQzs7QUFyRkgsOENBc0ZDIiwic291cmNlc0NvbnRlbnQiOlsiaW1wb3J0ICogYXMgY2RrIGZyb20gXCJhd3MtY2RrLWxpYlwiO1xuaW1wb3J0ICogYXMgaWFtIGZyb20gXCJhd3MtY2RrLWxpYi9hd3MtaWFtXCI7XG5pbXBvcnQgeyBDb25zdHJ1Y3QgfSBmcm9tIFwiY29uc3RydWN0c1wiO1xuaW1wb3J0IHsgUm9sZVByb3BzIH0gZnJvbSBcIi4vaWFtLXJvbGUtcHJvcHNcIjtcbmltcG9ydCBnaXRodWJVc2VybmFtZVJlZ2V4IGZyb20gXCIuL293bmVyLXJlZ2V4cFwiO1xuaW1wb3J0IHtcbiAgR2l0aHViQWN0aW9uc0lkZW50aXR5UHJvdmlkZXIsXG4gIElHaXRodWJBY3Rpb25zSWRlbnRpdHlQcm92aWRlcixcbn0gZnJvbSBcIi4vcHJvdmlkZXJcIjtcblxuLyoqXG4gKiBHaXRodWIgcmVsYXRlZCBjb25maWd1cmF0aW9uIHRoYXQgZm9ybXMgdGhlIHRydXN0IHBvbGljeSBmb3IgdGhpcyBJQU0gUm9sZS5cbiAqL1xuZXhwb3J0IGludGVyZmFjZSBHaXRodWJDb25maWd1cmF0aW9uIHtcbiAgLyoqXG4gICAqIFJlZmVyZW5jZSB0byBHaXRodWIgT3BlbklEIENvbm5lY3QgUHJvdmlkZXIgY29uZmlndXJlZCBpbiBBV1MgSUFNLlxuICAgKlxuICAgKiBFaXRoZXIgcGFzcyBhbiBjb25zdHJ1Y3QgZGVmaW5lZCBieSBgbmV3IEdpdGh1YkFjdGlvbnNJZGVudGl0eVByb3ZpZGVyYFxuICAgKiBvciBhIHJldHJpZXZlZCByZWZlcmVuY2UgZnJvbSBgR2l0aHViQWN0aW9uc0lkZW50aXR5UHJvdmlkZXIuZnJvbUFjY291bnRgLlxuICAgKiBUaGVyZSBjYW4gYmUgb25seSBvbmUgKHBlciBBV1MgQWNjb3VudCkuXG4gICAqL1xuICByZWFkb25seSBwcm92aWRlcjogSUdpdGh1YkFjdGlvbnNJZGVudGl0eVByb3ZpZGVyO1xuXG4gIC8qKlxuICAgKiBSZXBvc2l0b3J5IG93bmVyIChvcmdhbml6YXRpb24gb3IgdXNlcm5hbWUpLlxuICAgKlxuICAgKiBAZXhhbXBsZVxuICAgKiAnb2N0by1vcmcnXG4gICAqL1xuICByZWFkb25seSBvd25lcjogc3RyaW5nO1xuXG4gIC8qKlxuICAgKiBSZXBvc2l0b3J5IG5hbWUgKHNsdWcpIHdpdGhvdXQgdGhlIG93bmVyLlxuICAgKlxuICAgKiBAZXhhbXBsZVxuICAgKiAnb2N0by1yZXBvJ1xuICAgKi9cbiAgcmVhZG9ubHkgcmVwbzogc3RyaW5nO1xuXG4gIC8qKlxuICAgKiBTdWJqZWN0IGNvbmRpdGlvbiBmaWx0ZXIsIGFwcGVuZGVkIGFmdGVyIGByZXBvOiR7b3duZXJ9LyR7cmVwb306YCBzdHJpbmcgaW4gSUFNIFJvbGUgdHJ1c3QgcmVsYXRpb25zaGlwLlxuICAgKlxuICAgKiBAZGVmYXVsdFxuICAgKiAnKidcbiAgICpcbiAgICogWW91IG1heSB1c2UgdGhpcyB2YWx1ZSB0byBvbmx5IGFsbG93IEdpdGh1YiB0byBhc3N1bWUgdGhlIHJvbGUgb24gc3BlY2lmaWMgYnJhbmNoZXMsIHRhZ3MsIGVudmlyb25tZW50cywgcHVsbCByZXF1ZXN0cyBldGMuXG4gICAqIEBleGFtcGxlXG4gICAqICdyZWY6cmVmcy90YWdzL3YqJ1xuICAgKiAncmVmOnJlZnMvaGVhZHMvZGVtby1icmFuY2gnXG4gICAqICdwdWxsX3JlcXVlc3QnXG4gICAqICdlbnZpcm9ubWVudDpQcm9kdWN0aW9uJ1xuICAgKlxuICAgKiBAc2VlIGh0dHBzOi8vZG9jcy5naXRodWIuY29tL2VuL2FjdGlvbnMvZGVwbG95bWVudC9zZWN1cml0eS1oYXJkZW5pbmcteW91ci1kZXBsb3ltZW50cy9hYm91dC1zZWN1cml0eS1oYXJkZW5pbmctd2l0aC1vcGVuaWQtY29ubmVjdCNleGFtcGxlc1xuICAgKi9cbiAgcmVhZG9ubHkgZmlsdGVyPzogc3RyaW5nO1xufVxuXG4vKipcbiAqIFByb3BzIHRoYXQgZGVmaW5lIHRoZSBJQU0gUm9sZSB0aGF0IGNhbiBiZSBhc3N1bWVkIGJ5IEdpdGh1YiBBY3Rpb25zIHdvcmtmbG93XG4gKiB2aWEgR2l0aHViIE9wZW5JRCBDb25uZWN0IElkZW50aXR5IFByb3ZpZGVyLlxuICpcbiAqIEJlc2lkZXMgYEdpdGh1YkNvbmZpZ3VyYXRpb25gLCB5b3UgbWF5IHBhc3MgaW4gYW55IGBpYW0uUm9sZVByb3BzYCBleGNlcHQgYGFzc3VtZWRCeWBcbiAqIHdoaWNoIHdpbGwgYmUgZGVmaW5lZCBieSB0aGlzIGNvbnN0cnVjdCAoQ0RLIHdpbGwgZmFpbCBpZiB5b3UgZG8pLlxuICpcbiAqIEBleGFtcGxlXG4gKiB7XG4gKiAgIHByb3ZpZGVyOiBHaXRodWJBY3Rpb25zSWRlbnRpdHlQcm92aWRlci5mcm9tQWNjb3VudChzY29wZSwgXCJHaXRodWJQcm92aWRlclwiKSxcbiAqICAgb3duZXI6ICdvY3RvLW9yZycsXG4gKiAgIHJlcG86ICdvY3RvLXJlcG8nLFxuICogICBmaWx0ZXI6ICdyZWY6cmVmcy90YWdzL3YqJyxcbiAqICAgcm9sZU5hbWU6ICdNeURlcGxveVJvbGUnLFxuICogfVxuICovXG5leHBvcnQgaW50ZXJmYWNlIEdpdGh1YkFjdGlvbnNSb2xlUHJvcHNcbiAgZXh0ZW5kcyBHaXRodWJDb25maWd1cmF0aW9uLCBSb2xlUHJvcHMge31cblxuLyoqXG4gKiBEZWZpbmUgYW4gSUFNIFJvbGUgdGhhdCBjYW4gYmUgYXNzdW1lZCBieSBHaXRodWIgQWN0aW9ucyB3b3JrZmxvd1xuICogdmlhIEdpdGh1YiBPcGVuSUQgQ29ubmVjdCBJZGVudGl0eSBQcm92aWRlci5cbiAqXG4gKiBCZXNpZGVzIGBHaXRodWJDb25maWd1cmF0aW9uYCwgeW91IG1heSBwYXNzIGluIGFueSBgaWFtLlJvbGVQcm9wc2AgZXhjZXB0IGBhc3N1bWVkQnlgXG4gKiB3aGljaCB3aWxsIGJlIGRlZmluZWQgYnkgdGhpcyBjb25zdHJ1Y3QgKENESyB3aWxsIGZhaWwgaWYgeW91IGRvKS5cbiAqXG4gKiBAZXhhbXBsZVxuICogY29uc3QgdXBsb2FkUm9sZSA9IG5ldyBHaXRodWJBY3Rpb25zUm9sZShzY29wZSwgXCJVcGxvYWRSb2xlXCIsIHtcbiAqICAgcHJvdmlkZXI6IEdpdGh1YkFjdGlvbnNJZGVudGl0eVByb3ZpZGVyLmZyb21BY2NvdW50KHNjb3BlLCBcIkdpdGh1YlByb3ZpZGVyXCIpLFxuICogICBvd25lcjogJ29jdG8tb3JnJyxcbiAqICAgcmVwbzogJ29jdG8tcmVwbycsXG4gKiAgIGZpbHRlcjogJ3JlZjpyZWZzL3RhZ3MvdionLFxuICogICByb2xlTmFtZTogJ015VXBsb2FkUm9sZScsXG4gKiB9KTtcbiAqXG4gKiBteUJ1Y2tldC5ncmFudFdyaXRlKHVwbG9hZFJvbGUpO1xuICovXG5leHBvcnQgY2xhc3MgR2l0aHViQWN0aW9uc1JvbGUgZXh0ZW5kcyBpYW0uUm9sZSB7XG4gIC8qKlxuICAgKiBFeHRyYWN0cyBwcm9wcyBnaXZlbiBmb3IgdGhlIGNyZWF0ZWQgSUFNIFJvbGUgQ29uc3RydWN0LlxuICAgKiBAcGFyYW0gcHJvcHMgZm9yIHRoZSBHaXRodWJBY3Rpb25zUm9sZVxuICAgKiBAcmV0dXJucyBmb3IgdGhlIElBTSBSb2xlXG4gICAqL1xuICBwcml2YXRlIHN0YXRpYyBleHRyYWN0Um9sZVByb3BzKFxuICAgIHByb3BzOiBHaXRodWJBY3Rpb25zUm9sZVByb3BzLFxuICApOiBpYW0uUm9sZVByb3BzIHtcbiAgICBjb25zdCBleHRyYWN0UHJvcHMgPSA8YW55PnByb3BzO1xuICAgIGRlbGV0ZSBleHRyYWN0UHJvcHMucHJvdmlkZXI7XG4gICAgZGVsZXRlIGV4dHJhY3RQcm9wcy5vd25lcjtcbiAgICBkZWxldGUgZXh0cmFjdFByb3BzLnJlcG87XG4gICAgZGVsZXRlIGV4dHJhY3RQcm9wcy5maWx0ZXI7XG4gICAgcmV0dXJuIGV4dHJhY3RQcm9wcztcbiAgfVxuXG4gIC8qKiBWYWxpZGF0ZXMgdGhlIEdpdGh1YiBvd25lciAob3JnYW5pemF0aW9uIG9yIHVzZXIpIG5hbWUuICovXG4gIHByaXZhdGUgc3RhdGljIHZhbGlkYXRlT3duZXIoc2NvcGU6IENvbnN0cnVjdCwgb3duZXI6IHN0cmluZyk6IHZvaWQge1xuICAgIGlmIChnaXRodWJVc2VybmFtZVJlZ2V4LnRlc3Qob3duZXIpICE9PSB0cnVlKSB7XG4gICAgICBjZGsuQW5ub3RhdGlvbnMub2Yoc2NvcGUpLmFkZEVycm9yKFxuICAgICAgICBgSW52YWxpZCBHaXRodWIgUmVwb3NpdG9yeSBPd25lciBcIiR7b3duZXJ9XCIuIE11c3Qgb25seSBjb250YWluIGFscGhhbnVtZXJpYyBjaGFyYWN0ZXJzIG9yIGh5cGhlbnMsIGNhbm5vdCBoYXZlIG11bHRpcGxlIGNvbnNlY3V0aXZlIGh5cGhlbnMsIGNhbm5vdCBiZWdpbiBvciBlbmQgd2l0aCBhIGh5cGVuIGFuZCBtYXhpbXVtIGxlbmdodCBpcyAzOSBjaGFyYWN0ZXJzLmAsXG4gICAgICApO1xuICAgIH1cbiAgfVxuXG4gIC8qKiBWYWxpZGF0ZXMgdGhlIEdpdGh1YiByZXBvc2l0b3J5IG5hbWUgKHdpdGhvdXQgb3duZXIpLiAqL1xuICBwcml2YXRlIHN0YXRpYyB2YWxpZGF0ZVJlcG8oc2NvcGU6IENvbnN0cnVjdCwgcmVwbzogc3RyaW5nKTogdm9pZCB7XG4gICAgaWYgKHJlcG8gPT09IFwiXCIpIHtcbiAgICAgIGNkay5Bbm5vdGF0aW9ucy5vZihzY29wZSkuYWRkRXJyb3IoXG4gICAgICAgIGBJbnZhbGlkIEdpdGh1YiBSZXBvc2l0b3J5IE5hbWUgXCIke3JlcG99XCIuIE1heSBub3QgYmUgZW1wdHkgc3RyaW5nLmAsXG4gICAgICApO1xuICAgIH1cbiAgfVxuXG4gIC8qKiBGb3JtYXRzIHRoZSBgc3ViYCB2YWx1ZSB1c2VkIGluIHRydXN0IHBvbGljeS4gKi9cbiAgcHJpdmF0ZSBzdGF0aWMgZm9ybWF0U3ViamVjdChwcm9wczogR2l0aHViQ29uZmlndXJhdGlvbik6IHN0cmluZyB7XG4gICAgY29uc3QgeyBvd25lciwgcmVwbywgZmlsdGVyID0gXCIqXCIgfSA9IHByb3BzO1xuICAgIHJldHVybiBgcmVwbzoke293bmVyfS8ke3JlcG99OiR7ZmlsdGVyfWA7XG4gIH1cblxuICAvKipcbiAgICogRGVmaW5lIGFuIElBTSBSb2xlIHRoYXQgY2FuIGJlIGFzc3VtZWQgYnkgR2l0aHViIEFjdGlvbnMgd29ya2Zsb3dcbiAgICogdmlhIEdpdGh1YiBPcGVuSUQgQ29ubmVjdCBJZGVudGl0eSBQcm92aWRlci5cbiAgICpcbiAgICogQmVzaWRlcyBgR2l0aHViQ29uZmlndXJhdGlvbmAsIHlvdSBtYXkgcGFzcyBpbiBhbnkgYGlhbS5Sb2xlUHJvcHNgIGV4Y2VwdCBgYXNzdW1lZEJ5YFxuICAgKiB3aGljaCB3aWxsIGJlIGRlZmluZWQgYnkgdGhpcyBjb25zdHJ1Y3QgKENESyB3aWxsIGZhaWwgaWYgeW91IGRvKS5cbiAgICpcbiAgICogQGV4YW1wbGVcbiAgICogY29uc3QgdXBsb2FkUm9sZSA9IG5ldyBHaXRodWJBY3Rpb25zUm9sZShzY29wZSwgXCJVcGxvYWRSb2xlXCIsIHtcbiAgICogICBwcm92aWRlcjogR2l0aHViQWN0aW9uc0lkZW50aXR5UHJvdmlkZXIuZnJvbUFjY291bnQoc2NvcGUsIFwiR2l0aHViUHJvdmlkZXJcIiksXG4gICAqICAgb3duZXI6ICdvY3RvLW9yZycsXG4gICAqICAgcmVwbzogJ29jdG8tcmVwbycsXG4gICAqICAgZmlsdGVyOiAncmVmOnJlZnMvdGFncy92KicsXG4gICAqICAgcm9sZU5hbWU6ICdNeVVwbG9hZFJvbGUnLFxuICAgKiB9KTtcbiAgICpcbiAgICogbXlCdWNrZXQuZ3JhbnRXcml0ZSh1cGxvYWRSb2xlKTtcbiAgICovXG4gIGNvbnN0cnVjdG9yKHNjb3BlOiBDb25zdHJ1Y3QsIGlkOiBzdHJpbmcsIHByb3BzOiBHaXRodWJBY3Rpb25zUm9sZVByb3BzKSB7XG4gICAgY29uc3QgeyBwcm92aWRlciwgb3duZXIsIHJlcG8gfSA9IHByb3BzO1xuXG4gICAgLy8gUGVyZm9ybSB2YWxpZGF0aW9uc1xuICAgIEdpdGh1YkFjdGlvbnNSb2xlLnZhbGlkYXRlT3duZXIoc2NvcGUsIG93bmVyKTtcbiAgICBHaXRodWJBY3Rpb25zUm9sZS52YWxpZGF0ZVJlcG8oc2NvcGUsIHJlcG8pO1xuXG4gICAgLy8gUHJlcGFyZSB2YWx1ZXNcbiAgICBjb25zdCBzdWJqZWN0ID0gR2l0aHViQWN0aW9uc1JvbGUuZm9ybWF0U3ViamVjdChwcm9wcyk7XG4gICAgY29uc3Qgcm9sZVByb3BzID0gR2l0aHViQWN0aW9uc1JvbGUuZXh0cmFjdFJvbGVQcm9wcyhwcm9wcyk7XG5cbiAgICAvLyBUaGUgYWN0dWFsIElBTSBSb2xlIGNyZWF0aW9uXG4gICAgc3VwZXIoc2NvcGUsIGlkLCB7XG4gICAgICAuLi5yb2xlUHJvcHMsXG4gICAgICBhc3N1bWVkQnk6IG5ldyBpYW0uV2ViSWRlbnRpdHlQcmluY2lwYWwocHJvdmlkZXIub2lkY1Byb3ZpZGVyQXJuLCB7XG4gICAgICAgIFN0cmluZ0xpa2U6IHtcbiAgICAgICAgICAvLyBPbmx5IGFsbG93IHNwZWNpZmllZCBzdWJqZWN0cyB0byBhc3N1bWUgdGhpcyByb2xlXG4gICAgICAgICAgW2Ake0dpdGh1YkFjdGlvbnNJZGVudGl0eVByb3ZpZGVyLmlzc3Vlcn06c3ViYF06IHN1YmplY3QsXG4gICAgICAgIH0sXG4gICAgICAgIFN0cmluZ0VxdWFsczoge1xuICAgICAgICAgIC8vIEF1ZGllbmNlIGlzIGFsd2F5cyBzdHMuYW1hem9uYXdzLmNvbSB3aXRoIEFXUyBvZmZpY2lhbCBHaXRodWIgQWN0aW9uXG4gICAgICAgICAgLy8gaHR0cHM6Ly9kb2NzLmdpdGh1Yi5jb20vZW4vYWN0aW9ucy9kZXBsb3ltZW50L3NlY3VyaXR5LWhhcmRlbmluZy15b3VyLWRlcGxveW1lbnRzL2NvbmZpZ3VyaW5nLW9wZW5pZC1jb25uZWN0LWluLWFtYXpvbi13ZWItc2VydmljZXMjYWRkaW5nLXRoZS1pZGVudGl0eS1wcm92aWRlci10by1hd3NcbiAgICAgICAgICBbYCR7R2l0aHViQWN0aW9uc0lkZW50aXR5UHJvdmlkZXIuaXNzdWVyfTphdWRgXTogXCJzdHMuYW1hem9uYXdzLmNvbVwiLFxuICAgICAgICB9LFxuICAgICAgfSksXG4gICAgfSk7XG4gIH1cbn1cbiJdfQ==
package/migration-test/README.md ADDED
@@ -0,0 +1,77 @@
1
+ # Migration Test Harness
2
+
3
+ This folder contains an isolated CDK app that exercises a real migration flow for `aws-cdk-github-oidc`:
4
+
5
+ 1. `aws-cdk-github-oidc@^2` with `aws-cdk-lib@2.220.0`
6
+ 2. `aws-cdk-github-oidc@^3.1` with exact `aws-cdk-lib@2.237.0`
7
+ 3. `aws-cdk-github-oidc@^4.2` with `aws-cdk-lib@^2.237.0`
8
+
9
+ All CDK commands are executed with `pnpm exec cdk ...`.
10
+ `pnpm-workspace.yaml` in this folder mirrors the root workspace policy values.
11
+
12
+ ## Stack behavior by phase
13
+
14
+ The app reads `MIGRATION_PHASE` and switches provider implementation:
15
+
16
+ - `v2`: `new GithubActionsIdentityProvider(this, "GithubProvider")`
17
+ - `v3-retain`: same as `v2`, but with `removalPolicy: cdk.RemovalPolicy.RETAIN`
18
+ - `v4-lookup`: `GithubActionsIdentityProvider.fromAccount(this, "GithubProviderReference")`
19
+ - `v4-import`: switch back to `new GithubActionsIdentityProvider(this, "GithubProvider", { removalPolicy: RETAIN })`
20
+
21
+ ## Setup
22
+
23
+ From this directory:
24
+
25
+ ```sh
26
+ corepack use pnpm@10.19.0
27
+ pnpm install
28
+ ```
29
+
30
+ ## Run full migration flow
31
+
32
+ ```sh
33
+ pnpm run test-migration
34
+ ```
35
+
36
+ Run with automatic teardown (no prompt at the end):
37
+
38
+ ```sh
39
+ bash ./scripts/run-migration.sh --teardown
40
+ ```
41
+
42
+ Optional environment variable:
43
+
44
+ - `MIGRATION_STACK_NAME` (default: `AwsCdkGithubOidcMigrationTest`)
45
+
46
+ ## What the script does
47
+
48
+ `scripts/run-migration.sh` performs the full sequence with deploy boundaries:
49
+
50
+ 1. Install v2 + `aws-cdk-lib@2.220.0`, deploy `MIGRATION_PHASE=v2`
51
+ 2. Upgrade to v3.1 + `aws-cdk-lib@2.237.0`, diff and deploy `MIGRATION_PHASE=v3-retain`
52
+ 3. Upgrade to v4.2 + `aws-cdk-lib@^2.237.0`, diff and deploy `MIGRATION_PHASE=v4-lookup`
53
+ 4. Set `MIGRATION_PHASE=v4-import`, dynamically fetch account id via:
54
+ - `aws sts get-caller-identity --query "Account" --output text`
55
+ 5. Generate `./.tmp/resource-mapping.json` (not committed) and run:
56
+ - `pnpm exec cdk import <STACK_NAME> --resource-mapping ./.tmp/resource-mapping.json`
57
+ 6. Run `pnpm exec cdk diff` for verification
58
+
59
+ After step 6, the script asks whether to delete the test stack.
60
+ - Reply `y` or `yes` to destroy it.
61
+ - Reply `n` to keep it deployed.
62
+ - Use `--teardown` (or `--teardown=true`) to destroy without prompting.
63
+
64
+ ## Resource mapping
65
+
66
+ No AWS account IDs are stored in source control.
67
+
68
+ - Template file: `config/resource-mapping.template.json`
69
+ - Runtime file: `./.tmp/resource-mapping.json`
70
+
71
+ The generated ARN format is:
72
+
73
+ `arn:aws:iam::<ACCOUNT_ID>:oidc-provider/token.actions.githubusercontent.com`
74
+
75
+ ## Reference
76
+
77
+ - [AWS CDK `cdk import` docs](https://docs.aws.amazon.com/cdk/v2/guide/ref-cli-cmd-import.html)
package/migration-test/bin/app.ts ADDED
@@ -0,0 +1,8 @@
1
+ import * as cdk from "aws-cdk-lib";
2
+ import { MigrationTestStack } from "../lib/migration-test-stack";
3
+
4
+ const app = new cdk.App();
5
+ const stackName =
6
+ process.env.MIGRATION_STACK_NAME ?? "AwsCdkGithubOidcMigrationTest";
7
+
8
+ new MigrationTestStack(app, stackName);
package/migration-test/cdk.json ADDED
@@ -0,0 +1,6 @@
1
+ {
2
+ "app": "pnpm exec tsx bin/app.ts",
3
+ "context": {
4
+ "@aws-cdk/core:newStyleStackSynthesis": true
5
+ }
6
+ }
package/migration-test/config/resource-mapping.template.json ADDED
@@ -0,0 +1,5 @@
1
+ {
2
+ "GithubProvider1CDE27EB": {
3
+ "Arn": "arn:aws:iam::__ACCOUNT_ID__:oidc-provider/token.actions.githubusercontent.com"
4
+ }
5
+ }
package/migration-test/lib/migration-test-stack.ts ADDED
@@ -0,0 +1,77 @@
1
+ import * as cdk from "aws-cdk-lib";
2
+ import * as iam from "aws-cdk-lib/aws-iam";
3
+ import {
4
+ GithubActionsIdentityProvider,
5
+ GithubActionsRole,
6
+ IGithubActionsIdentityProvider,
7
+ } from "aws-cdk-github-oidc";
8
+ import { Construct } from "constructs";
9
+
10
+ type MigrationPhase = "v2" | "v3-retain" | "v4-lookup" | "v4-import";
11
+
12
+ function isMigrationPhase(value: string): value is MigrationPhase {
13
+ return (
14
+ value === "v2" ||
15
+ value === "v3-retain" ||
16
+ value === "v4-lookup" ||
17
+ value === "v4-import"
18
+ );
19
+ }
20
+
21
+ function resolvePhase(): MigrationPhase {
22
+ const phase = process.env.MIGRATION_PHASE ?? "v2";
23
+ if (isMigrationPhase(phase)) {
24
+ return phase;
25
+ }
26
+ throw new Error(
27
+ `Invalid MIGRATION_PHASE="${phase}". Valid values: v2, v3-retain, v4-lookup, v4-import.`,
28
+ );
29
+ }
30
+
31
+ function createProvider(
32
+ scope: Construct,
33
+ phase: MigrationPhase,
34
+ ): IGithubActionsIdentityProvider {
35
+ if (phase === "v4-lookup") {
36
+ return GithubActionsIdentityProvider.fromAccount(
37
+ scope,
38
+ "GithubProviderReference",
39
+ );
40
+ }
41
+
42
+ const shouldRetain = phase === "v3-retain" || phase === "v4-import";
43
+ const ProviderCtor = GithubActionsIdentityProvider as unknown as new (
44
+ scope: Construct,
45
+ id: string,
46
+ props?: { removalPolicy?: cdk.RemovalPolicy },
47
+ ) => IGithubActionsIdentityProvider;
48
+ return new ProviderCtor(scope, "GithubProvider", {
49
+ removalPolicy: shouldRetain ? cdk.RemovalPolicy.RETAIN : undefined,
50
+ });
51
+ }
52
+
53
+ export class MigrationTestStack extends cdk.Stack {
54
+ constructor(scope: Construct, id: string, props?: cdk.StackProps) {
55
+ super(scope, id, props);
56
+
57
+ const phase = resolvePhase();
58
+ const provider = createProvider(this, phase);
59
+
60
+ new GithubActionsRole(this, "GithubActionsRole", {
61
+ provider,
62
+ owner: "octo-org",
63
+ repo: "octo-repo",
64
+ filter: "ref:refs/heads/main",
65
+ roleName: "migration-test-github-actions-role",
66
+ description: "Role for validating aws-cdk-github-oidc migration flow",
67
+ managedPolicies: [
68
+ iam.ManagedPolicy.fromAwsManagedPolicyName("ReadOnlyAccess"),
69
+ ],
70
+ });
71
+
72
+ new cdk.CfnOutput(this, "MigrationPhase", { value: phase });
73
+ new cdk.CfnOutput(this, "ProviderArn", {
74
+ value: `arn:${cdk.Aws.PARTITION}:iam::${cdk.Aws.ACCOUNT_ID}:oidc-provider/${GithubActionsIdentityProvider.issuer}`,
75
+ });
76
+ }
77
+ }
package/migration-test/package.json ADDED
@@ -0,0 +1,24 @@
1
+ {
2
+ "name": "migration-test",
3
+ "private": true,
4
+ "packageManager": "pnpm@10.19.0",
5
+ "scripts": {
6
+ "build": "tsc --noEmit",
7
+ "cdk": "pnpm exec cdk",
8
+ "synth": "pnpm exec cdk synth",
9
+ "diff": "pnpm exec cdk diff",
10
+ "deploy": "pnpm exec cdk deploy --require-approval never",
11
+ "test-migration": "bash ./scripts/run-migration.sh"
12
+ },
13
+ "dependencies": {
14
+ "aws-cdk-github-oidc": "^2.4.1",
15
+ "aws-cdk-lib": "2.220.0",
16
+ "constructs": "^10.3.0"
17
+ },
18
+ "devDependencies": {
19
+ "@types/node": "^20",
20
+ "aws-cdk": "^2",
21
+ "tsx": "^4",
22
+ "typescript": "^5"
23
+ }
24
+ }
package/migration-test/pnpm-lock.yaml ADDED
@@ -0,0 +1,423 @@
1
+ lockfileVersion: '9.0'
2
+
3
+ settings:
4
+ autoInstallPeers: true
5
+ excludeLinksFromLockfile: false
6
+
7
+ importers:
8
+
9
+ .:
10
+ dependencies:
11
+ aws-cdk-github-oidc:
12
+ specifier: ^2.4.1
13
+ version: 2.4.1(aws-cdk-lib@2.220.0(constructs@10.6.0))(constructs@10.6.0)
14
+ aws-cdk-lib:
15
+ specifier: 2.220.0
16
+ version: 2.220.0(constructs@10.6.0)
17
+ constructs:
18
+ specifier: ^10.3.0
19
+ version: 10.6.0
20
+ devDependencies:
21
+ '@types/node':
22
+ specifier: ^20
23
+ version: 20.19.40
24
+ aws-cdk:
25
+ specifier: ^2
26
+ version: 2.1121.0
27
+ tsx:
28
+ specifier: ^4
29
+ version: 4.21.0
30
+ typescript:
31
+ specifier: ^5
32
+ version: 5.9.3
33
+
34
+ packages:
35
+
36
+ '@aws-cdk/asset-awscli-v1@2.2.242':
37
+ resolution: {integrity: sha512-4c1bAy2ISzcdKXYS1k4HYZsNrgiwbiDzj36ybwFVxEWZXVAP0dimQTCaB9fxu7sWzEjw3d+eaw6Fon+QTfTIpQ==}
38
+
39
+ '@aws-cdk/asset-node-proxy-agent-v6@2.1.1':
40
+ resolution: {integrity: sha512-We4bmHaowOPHr+IQR4/FyTGjRfjgBj4ICMjtqmJeBDWad3Q/6St12NT07leNtyuukv2qMhtSZJQorD8KpKTwRA==}
41
+
42
+ '@aws-cdk/cloud-assembly-schema@48.20.0':
43
+ resolution: {integrity: sha512-+eeiav9LY4wbF/EFuCt/vfvi/Zoxo8bf94PW5clbMraChEliq83w4TbRVy0jB9jE0v1ooFTtIjSQkowSPkfISg==}
44
+ engines: {node: '>= 18.0.0'}
45
+ bundledDependencies:
46
+ - jsonschema
47
+ - semver
48
+
49
+ '@esbuild/aix-ppc64@0.27.7':
50
+ resolution: {integrity: sha512-EKX3Qwmhz1eMdEJokhALr0YiD0lhQNwDqkPYyPhiSwKrh7/4KRjQc04sZ8db+5DVVnZ1LmbNDI1uAMPEUBnQPg==}
51
+ engines: {node: '>=18'}
52
+ cpu: [ppc64]
53
+ os: [aix]
54
+
55
+ '@esbuild/android-arm64@0.27.7':
56
+ resolution: {integrity: sha512-62dPZHpIXzvChfvfLJow3q5dDtiNMkwiRzPylSCfriLvZeq0a1bWChrGx/BbUbPwOrsWKMn8idSllklzBy+dgQ==}
57
+ engines: {node: '>=18'}
58
+ cpu: [arm64]
59
+ os: [android]
60
+
61
+ '@esbuild/android-arm@0.27.7':
62
+ resolution: {integrity: sha512-jbPXvB4Yj2yBV7HUfE2KHe4GJX51QplCN1pGbYjvsyCZbQmies29EoJbkEc+vYuU5o45AfQn37vZlyXy4YJ8RQ==}
63
+ engines: {node: '>=18'}
64
+ cpu: [arm]
65
+ os: [android]
66
+
67
+ '@esbuild/android-x64@0.27.7':
68
+ resolution: {integrity: sha512-x5VpMODneVDb70PYV2VQOmIUUiBtY3D3mPBG8NxVk5CogneYhkR7MmM3yR/uMdITLrC1ml/NV1rj4bMJuy9MCg==}
69
+ engines: {node: '>=18'}
70
+ cpu: [x64]
71
+ os: [android]
72
+
73
+ '@esbuild/darwin-arm64@0.27.7':
74
+ resolution: {integrity: sha512-5lckdqeuBPlKUwvoCXIgI2D9/ABmPq3Rdp7IfL70393YgaASt7tbju3Ac+ePVi3KDH6N2RqePfHnXkaDtY9fkw==}
75
+ engines: {node: '>=18'}
76
+ cpu: [arm64]
77
+ os: [darwin]
78
+
79
+ '@esbuild/darwin-x64@0.27.7':
80
+ resolution: {integrity: sha512-rYnXrKcXuT7Z+WL5K980jVFdvVKhCHhUwid+dDYQpH+qu+TefcomiMAJpIiC2EM3Rjtq0sO3StMV/+3w3MyyqQ==}
81
+ engines: {node: '>=18'}
82
+ cpu: [x64]
83
+ os: [darwin]
84
+
85
+ '@esbuild/freebsd-arm64@0.27.7':
86
+ resolution: {integrity: sha512-B48PqeCsEgOtzME2GbNM2roU29AMTuOIN91dsMO30t+Ydis3z/3Ngoj5hhnsOSSwNzS+6JppqWsuhTp6E82l2w==}
87
+ engines: {node: '>=18'}
88
+ cpu: [arm64]
89
+ os: [freebsd]
90
+
91
+ '@esbuild/freebsd-x64@0.27.7':
92
+ resolution: {integrity: sha512-jOBDK5XEjA4m5IJK3bpAQF9/Lelu/Z9ZcdhTRLf4cajlB+8VEhFFRjWgfy3M1O4rO2GQ/b2dLwCUGpiF/eATNQ==}
93
+ engines: {node: '>=18'}
94
+ cpu: [x64]
95
+ os: [freebsd]
96
+
97
+ '@esbuild/linux-arm64@0.27.7':
98
+ resolution: {integrity: sha512-RZPHBoxXuNnPQO9rvjh5jdkRmVizktkT7TCDkDmQ0W2SwHInKCAV95GRuvdSvA7w4VMwfCjUiPwDi0ZO6Nfe9A==}
99
+ engines: {node: '>=18'}
100
+ cpu: [arm64]
101
+ os: [linux]
102
+
103
+ '@esbuild/linux-arm@0.27.7':
104
+ resolution: {integrity: sha512-RkT/YXYBTSULo3+af8Ib0ykH8u2MBh57o7q/DAs3lTJlyVQkgQvlrPTnjIzzRPQyavxtPtfg0EopvDyIt0j1rA==}
105
+ engines: {node: '>=18'}
106
+ cpu: [arm]
107
+ os: [linux]
108
+
109
+ '@esbuild/linux-ia32@0.27.7':
110
+ resolution: {integrity: sha512-GA48aKNkyQDbd3KtkplYWT102C5sn/EZTY4XROkxONgruHPU72l+gW+FfF8tf2cFjeHaRbWpOYa/uRBz/Xq1Pg==}
111
+ engines: {node: '>=18'}
112
+ cpu: [ia32]
113
+ os: [linux]
114
+
115
+ '@esbuild/linux-loong64@0.27.7':
116
+ resolution: {integrity: sha512-a4POruNM2oWsD4WKvBSEKGIiWQF8fZOAsycHOt6JBpZ+JN2n2JH9WAv56SOyu9X5IqAjqSIPTaJkqN8F7XOQ5Q==}
117
+ engines: {node: '>=18'}
118
+ cpu: [loong64]
119
+ os: [linux]
120
+
121
+ '@esbuild/linux-mips64el@0.27.7':
122
+ resolution: {integrity: sha512-KabT5I6StirGfIz0FMgl1I+R1H73Gp0ofL9A3nG3i/cYFJzKHhouBV5VWK1CSgKvVaG4q1RNpCTR2LuTVB3fIw==}
123
+ engines: {node: '>=18'}
124
+ cpu: [mips64el]
125
+ os: [linux]
126
+
127
+ '@esbuild/linux-ppc64@0.27.7':
128
+ resolution: {integrity: sha512-gRsL4x6wsGHGRqhtI+ifpN/vpOFTQtnbsupUF5R5YTAg+y/lKelYR1hXbnBdzDjGbMYjVJLJTd2OFmMewAgwlQ==}
129
+ engines: {node: '>=18'}
130
+ cpu: [ppc64]
131
+ os: [linux]
132
+
133
+ '@esbuild/linux-riscv64@0.27.7':
134
+ resolution: {integrity: sha512-hL25LbxO1QOngGzu2U5xeXtxXcW+/GvMN3ejANqXkxZ/opySAZMrc+9LY/WyjAan41unrR3YrmtTsUpwT66InQ==}
135
+ engines: {node: '>=18'}
136
+ cpu: [riscv64]
137
+ os: [linux]
138
+
139
+ '@esbuild/linux-s390x@0.27.7':
140
+ resolution: {integrity: sha512-2k8go8Ycu1Kb46vEelhu1vqEP+UeRVj2zY1pSuPdgvbd5ykAw82Lrro28vXUrRmzEsUV0NzCf54yARIK8r0fdw==}
141
+ engines: {node: '>=18'}
142
+ cpu: [s390x]
143
+ os: [linux]
144
+
145
+ '@esbuild/linux-x64@0.27.7':
146
+ resolution: {integrity: sha512-hzznmADPt+OmsYzw1EE33ccA+HPdIqiCRq7cQeL1Jlq2gb1+OyWBkMCrYGBJ+sxVzve2ZJEVeePbLM2iEIZSxA==}
147
+ engines: {node: '>=18'}
148
+ cpu: [x64]
149
+ os: [linux]
150
+
151
+ '@esbuild/netbsd-arm64@0.27.7':
152
+ resolution: {integrity: sha512-b6pqtrQdigZBwZxAn1UpazEisvwaIDvdbMbmrly7cDTMFnw/+3lVxxCTGOrkPVnsYIosJJXAsILG9XcQS+Yu6w==}
153
+ engines: {node: '>=18'}
154
+ cpu: [arm64]
155
+ os: [netbsd]
156
+
157
+ '@esbuild/netbsd-x64@0.27.7':
158
+ resolution: {integrity: sha512-OfatkLojr6U+WN5EDYuoQhtM+1xco+/6FSzJJnuWiUw5eVcicbyK3dq5EeV/QHT1uy6GoDhGbFpprUiHUYggrw==}
159
+ engines: {node: '>=18'}
160
+ cpu: [x64]
161
+ os: [netbsd]
162
+
163
+ '@esbuild/openbsd-arm64@0.27.7':
164
+ resolution: {integrity: sha512-AFuojMQTxAz75Fo8idVcqoQWEHIXFRbOc1TrVcFSgCZtQfSdc1RXgB3tjOn/krRHENUB4j00bfGjyl2mJrU37A==}
165
+ engines: {node: '>=18'}
166
+ cpu: [arm64]
167
+ os: [openbsd]
168
+
169
+ '@esbuild/openbsd-x64@0.27.7':
170
+ resolution: {integrity: sha512-+A1NJmfM8WNDv5CLVQYJ5PshuRm/4cI6WMZRg1by1GwPIQPCTs1GLEUHwiiQGT5zDdyLiRM/l1G0Pv54gvtKIg==}
171
+ engines: {node: '>=18'}
172
+ cpu: [x64]
173
+ os: [openbsd]
174
+
175
+ '@esbuild/openharmony-arm64@0.27.7':
176
+ resolution: {integrity: sha512-+KrvYb/C8zA9CU/g0sR6w2RBw7IGc5J2BPnc3dYc5VJxHCSF1yNMxTV5LQ7GuKteQXZtspjFbiuW5/dOj7H4Yw==}
177
+ engines: {node: '>=18'}
178
+ cpu: [arm64]
179
+ os: [openharmony]
180
+
181
+ '@esbuild/sunos-x64@0.27.7':
182
+ resolution: {integrity: sha512-ikktIhFBzQNt/QDyOL580ti9+5mL/YZeUPKU2ivGtGjdTYoqz6jObj6nOMfhASpS4GU4Q/Clh1QtxWAvcYKamA==}
183
+ engines: {node: '>=18'}
184
+ cpu: [x64]
185
+ os: [sunos]
186
+
187
+ '@esbuild/win32-arm64@0.27.7':
188
+ resolution: {integrity: sha512-7yRhbHvPqSpRUV7Q20VuDwbjW5kIMwTHpptuUzV+AA46kiPze5Z7qgt6CLCK3pWFrHeNfDd1VKgyP4O+ng17CA==}
189
+ engines: {node: '>=18'}
190
+ cpu: [arm64]
191
+ os: [win32]
192
+
193
+ '@esbuild/win32-ia32@0.27.7':
194
+ resolution: {integrity: sha512-SmwKXe6VHIyZYbBLJrhOoCJRB/Z1tckzmgTLfFYOfpMAx63BJEaL9ExI8x7v0oAO3Zh6D/Oi1gVxEYr5oUCFhw==}
195
+ engines: {node: '>=18'}
196
+ cpu: [ia32]
197
+ os: [win32]
198
+
199
+ '@esbuild/win32-x64@0.27.7':
200
+ resolution: {integrity: sha512-56hiAJPhwQ1R4i+21FVF7V8kSD5zZTdHcVuRFMW0hn753vVfQN8xlx4uOPT4xoGH0Z/oVATuR82AiqSTDIpaHg==}
201
+ engines: {node: '>=18'}
202
+ cpu: [x64]
203
+ os: [win32]
204
+
205
+ '@types/node@20.19.40':
206
+ resolution: {integrity: sha512-xxx6M2IpSTnnKcR0cMvIiohkiCx20/oRPtWGbenFygKCGl3zqUzdNjQ/1V4solq1LU+dgv0nQzeGOuqkqZGg0Q==}
207
+
208
+ aws-cdk-github-oidc@2.4.1:
209
+ resolution: {integrity: sha512-zKQYPGyf5f6APG76OpOxW6P7KGY/fC6VhN1ZullxySSu6RroUH9VtVl+cJ8hYes5XvEE/ZDpx2h2fPtNwZrcVQ==}
210
+ engines: {node: '>= 16.20.0'}
211
+ peerDependencies:
212
+ aws-cdk-lib: ^2.89.0
213
+ constructs: ^10.0.0
214
+
215
+ aws-cdk-lib@2.220.0:
216
+ resolution: {integrity: sha512-mOEyPP1ymWiLnSE0xFxWjG00E1DQ5wtbcgKUmtGjxyNdoG/Qret1nDLqE43YGZEbwca43WO/a2LDuSL6+hN7Lg==}
217
+ engines: {node: '>= 18.0.0'}
218
+ peerDependencies:
219
+ constructs: ^10.0.0
220
+ bundledDependencies:
221
+ - '@balena/dockerignore'
222
+ - case
223
+ - fs-extra
224
+ - ignore
225
+ - jsonschema
226
+ - minimatch
227
+ - punycode
228
+ - semver
229
+ - table
230
+ - yaml
231
+ - mime-types
232
+
233
+ aws-cdk@2.1121.0:
234
+ resolution: {integrity: sha512-cG7CHt/SytYTfwrK+BUNQpqmS1dwhjt8z6ExKL6GK4n+8/6ZCwFzxlZWA/jUd2+Y9xPc+Q8cLKfMqGmgxEXbkg==}
235
+ engines: {node: '>= 18.0.0'}
236
+ hasBin: true
237
+
238
+ constructs@10.6.0:
239
+ resolution: {integrity: sha512-TxHOnBO5zMo/G76ykzGF/wMpEHu257TbWiIxP9K0Yv/+t70UzgBQiTqjkAsWOPC6jW91DzJI0+ehQV6xDRNBuQ==}
240
+
241
+ esbuild@0.27.7:
242
+ resolution: {integrity: sha512-IxpibTjyVnmrIQo5aqNpCgoACA/dTKLTlhMHihVHhdkxKyPO1uBBthumT0rdHmcsk9uMonIWS0m4FljWzILh3w==}
243
+ engines: {node: '>=18'}
244
+ hasBin: true
245
+
246
+ fsevents@2.3.3:
247
+ resolution: {integrity: sha512-5xoDfX+fL7faATnagmWPpbFtwh/R77WmMMqqHGS65C3vvB0YHrgF+B1YmZ3441tMj5n63k0212XNoJwzlhffQw==}
248
+ engines: {node: ^8.16.0 || ^10.6.0 || >=11.0.0}
249
+ os: [darwin]
250
+
251
+ get-tsconfig@4.14.0:
252
+ resolution: {integrity: sha512-yTb+8DXzDREzgvYmh6s9vHsSVCHeC0G3PI5bEXNBHtmshPnO+S5O7qgLEOn0I5QvMy6kpZN8K1NKGyilLb93wA==}
253
+
254
+ resolve-pkg-maps@1.0.0:
255
+ resolution: {integrity: sha512-seS2Tj26TBVOC2NIc2rOe2y2ZO7efxITtLZcGSOnHHNOQ7CkiUBfw0Iw2ck6xkIhPwLhKNLS8BO+hEpngQlqzw==}
256
+
257
+ tsx@4.21.0:
258
+ resolution: {integrity: sha512-5C1sg4USs1lfG0GFb2RLXsdpXqBSEhAaA/0kPL01wxzpMqLILNxIxIOKiILz+cdg/pLnOUxFYOR5yhHU666wbw==}
259
+ engines: {node: '>=18.0.0'}
260
+ hasBin: true
261
+
262
+ typescript@5.9.3:
263
+ resolution: {integrity: sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==}
264
+ engines: {node: '>=14.17'}
265
+ hasBin: true
266
+
267
+ undici-types@6.21.0:
268
+ resolution: {integrity: sha512-iwDZqg0QAGrg9Rav5H4n0M64c3mkR59cJ6wQp+7C4nI0gsmExaedaYLNO44eT4AtBBwjbTiGPMlt2Md0T9H9JQ==}
269
+
270
+ snapshots:
271
+
272
+ '@aws-cdk/asset-awscli-v1@2.2.242': {}
273
+
274
+ '@aws-cdk/asset-node-proxy-agent-v6@2.1.1': {}
275
+
276
+ '@aws-cdk/cloud-assembly-schema@48.20.0': {}
277
+
278
+ '@esbuild/aix-ppc64@0.27.7':
279
+ optional: true
280
+
281
+ '@esbuild/android-arm64@0.27.7':
282
+ optional: true
283
+
284
+ '@esbuild/android-arm@0.27.7':
285
+ optional: true
286
+
287
+ '@esbuild/android-x64@0.27.7':
288
+ optional: true
289
+
290
+ '@esbuild/darwin-arm64@0.27.7':
291
+ optional: true
292
+
293
+ '@esbuild/darwin-x64@0.27.7':
294
+ optional: true
295
+
296
+ '@esbuild/freebsd-arm64@0.27.7':
297
+ optional: true
298
+
299
+ '@esbuild/freebsd-x64@0.27.7':
300
+ optional: true
301
+
302
+ '@esbuild/linux-arm64@0.27.7':
303
+ optional: true
304
+
305
+ '@esbuild/linux-arm@0.27.7':
306
+ optional: true
307
+
308
+ '@esbuild/linux-ia32@0.27.7':
309
+ optional: true
310
+
311
+ '@esbuild/linux-loong64@0.27.7':
312
+ optional: true
313
+
314
+ '@esbuild/linux-mips64el@0.27.7':
315
+ optional: true
316
+
317
+ '@esbuild/linux-ppc64@0.27.7':
318
+ optional: true
319
+
320
+ '@esbuild/linux-riscv64@0.27.7':
321
+ optional: true
322
+
323
+ '@esbuild/linux-s390x@0.27.7':
324
+ optional: true
325
+
326
+ '@esbuild/linux-x64@0.27.7':
327
+ optional: true
328
+
329
+ '@esbuild/netbsd-arm64@0.27.7':
330
+ optional: true
331
+
332
+ '@esbuild/netbsd-x64@0.27.7':
333
+ optional: true
334
+
335
+ '@esbuild/openbsd-arm64@0.27.7':
336
+ optional: true
337
+
338
+ '@esbuild/openbsd-x64@0.27.7':
339
+ optional: true
340
+
341
+ '@esbuild/openharmony-arm64@0.27.7':
342
+ optional: true
343
+
344
+ '@esbuild/sunos-x64@0.27.7':
345
+ optional: true
346
+
347
+ '@esbuild/win32-arm64@0.27.7':
348
+ optional: true
349
+
350
+ '@esbuild/win32-ia32@0.27.7':
351
+ optional: true
352
+
353
+ '@esbuild/win32-x64@0.27.7':
354
+ optional: true
355
+
356
+ '@types/node@20.19.40':
357
+ dependencies:
358
+ undici-types: 6.21.0
359
+
360
+ aws-cdk-github-oidc@2.4.1(aws-cdk-lib@2.220.0(constructs@10.6.0))(constructs@10.6.0):
361
+ dependencies:
362
+ aws-cdk-lib: 2.220.0(constructs@10.6.0)
363
+ constructs: 10.6.0
364
+
365
+ aws-cdk-lib@2.220.0(constructs@10.6.0):
366
+ dependencies:
367
+ '@aws-cdk/asset-awscli-v1': 2.2.242
368
+ '@aws-cdk/asset-node-proxy-agent-v6': 2.1.1
369
+ '@aws-cdk/cloud-assembly-schema': 48.20.0
370
+ constructs: 10.6.0
371
+
372
+ aws-cdk@2.1121.0: {}
373
+
374
+ constructs@10.6.0: {}
375
+
376
+ esbuild@0.27.7:
377
+ optionalDependencies:
378
+ '@esbuild/aix-ppc64': 0.27.7
379
+ '@esbuild/android-arm': 0.27.7
380
+ '@esbuild/android-arm64': 0.27.7
381
+ '@esbuild/android-x64': 0.27.7
382
+ '@esbuild/darwin-arm64': 0.27.7
383
+ '@esbuild/darwin-x64': 0.27.7
384
+ '@esbuild/freebsd-arm64': 0.27.7
385
+ '@esbuild/freebsd-x64': 0.27.7
386
+ '@esbuild/linux-arm': 0.27.7
387
+ '@esbuild/linux-arm64': 0.27.7
388
+ '@esbuild/linux-ia32': 0.27.7
389
+ '@esbuild/linux-loong64': 0.27.7
390
+ '@esbuild/linux-mips64el': 0.27.7
391
+ '@esbuild/linux-ppc64': 0.27.7
392
+ '@esbuild/linux-riscv64': 0.27.7
393
+ '@esbuild/linux-s390x': 0.27.7
394
+ '@esbuild/linux-x64': 0.27.7
395
+ '@esbuild/netbsd-arm64': 0.27.7
396
+ '@esbuild/netbsd-x64': 0.27.7
397
+ '@esbuild/openbsd-arm64': 0.27.7
398
+ '@esbuild/openbsd-x64': 0.27.7
399
+ '@esbuild/openharmony-arm64': 0.27.7
400
+ '@esbuild/sunos-x64': 0.27.7
401
+ '@esbuild/win32-arm64': 0.27.7
402
+ '@esbuild/win32-ia32': 0.27.7
403
+ '@esbuild/win32-x64': 0.27.7
404
+
405
+ fsevents@2.3.3:
406
+ optional: true
407
+
408
+ get-tsconfig@4.14.0:
409
+ dependencies:
410
+ resolve-pkg-maps: 1.0.0
411
+
412
+ resolve-pkg-maps@1.0.0: {}
413
+
414
+ tsx@4.21.0:
415
+ dependencies:
416
+ esbuild: 0.27.7
417
+ get-tsconfig: 4.14.0
418
+ optionalDependencies:
419
+ fsevents: 2.3.3
420
+
421
+ typescript@5.9.3: {}
422
+
423
+ undici-types@6.21.0: {}
package/migration-test/pnpm-workspace.yaml ADDED
@@ -0,0 +1,21 @@
1
+ # Copied from repository root pnpm-workspace.yaml to keep identical pnpm policies
2
+ # while keeping migration-test dependency changes isolated.
3
+
4
+ minimumReleaseAge: 4320
5
+ minimumReleaseAgeExclude:
6
+ - "@alma-cdk/construct-library"
7
+ - "aws-cdk-github-oidc"
8
+ trustPolicy: no-downgrade
9
+ trustPolicyIgnoreAfter: 20160
10
+ trustPolicyExclude:
11
+ - jsii@5.9.33
12
+ - jsii@5.9.35
13
+ nodeLinker: hoisted
14
+ resolutionMode: highest
15
+ strictDepBuilds: true
16
+ onlyBuiltDependencies:
17
+ - unrs-resolver
18
+ - lefthook
19
+ - esbuild
20
+ blockExoticSubdeps: true
21
+ overrides: {}
package/migration-test/scripts/run-migration.sh ADDED
@@ -0,0 +1,179 @@
1
+ #!/usr/bin/env bash
2
+ set -euo pipefail
3
+
4
+ SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
5
+ PROJECT_DIR="$(cd "${SCRIPT_DIR}/.." && pwd)"
6
+ cd "${PROJECT_DIR}"
7
+
8
+ AUTO_TEARDOWN="false"
9
+
10
+ usage() {
11
+ cat <<EOF
12
+ Usage: ./scripts/run-migration.sh [--teardown[=true|false]]
13
+
14
+ Options:
15
+ --teardown Perform teardown automatically without asking.
16
+ --teardown=true Same as --teardown.
17
+ --teardown=false Skip automatic teardown and ask at the end.
18
+ -h, --help Show this help message.
19
+ EOF
20
+ }
21
+
22
+ while (($# > 0)); do
23
+ case "$1" in
24
+ --teardown)
25
+ if (($# > 1)) && [[ "$2" =~ ^(true|false)$ ]]; then
26
+ AUTO_TEARDOWN="$2"
27
+ shift 2
28
+ else
29
+ AUTO_TEARDOWN="true"
30
+ shift
31
+ fi
32
+ ;;
33
+ --teardown=*)
34
+ AUTO_TEARDOWN="${1#*=}"
35
+ if [[ "${AUTO_TEARDOWN}" != "true" && "${AUTO_TEARDOWN}" != "false" ]]; then
36
+ echo "Invalid value for --teardown: ${AUTO_TEARDOWN} (expected true|false)" >&2
37
+ exit 1
38
+ fi
39
+ shift
40
+ ;;
41
+ -h | --help)
42
+ usage
43
+ exit 0
44
+ ;;
45
+ *)
46
+ echo "Unknown argument: $1" >&2
47
+ usage >&2
48
+ exit 1
49
+ ;;
50
+ esac
51
+ done
52
+
53
+ STACK_NAME="${MIGRATION_STACK_NAME:-AwsCdkGithubOidcMigrationTest}"
54
+ TMP_DIR="${PROJECT_DIR}/.tmp"
55
+ RESOURCE_MAPPING_PATH="${TMP_DIR}/resource-mapping.json"
56
+ OIDC_ISSUER="token.actions.githubusercontent.com"
57
+ ACCOUNT_ID="$(aws sts get-caller-identity --query "Account" --output text)"
58
+ CALLER_ARN="$(aws sts get-caller-identity --query "Arn" --output text)"
59
+ AWS_PARTITION="$(echo "${CALLER_ARN}" | cut -d: -f2)"
60
+ OIDC_PROVIDER_ARN="arn:${AWS_PARTITION}:iam::${ACCOUNT_ID}:oidc-provider/${OIDC_ISSUER}"
61
+
62
+ cleanup_tmp_artifacts() {
63
+ rm -f "${RESOURCE_MAPPING_PATH}"
64
+ }
65
+
66
+ trap cleanup_tmp_artifacts EXIT
67
+
68
+ verify_stack_status() {
69
+ local context="$1"
70
+ shift
71
+ local status
72
+ status="$(aws cloudformation describe-stacks --stack-name "${STACK_NAME}" --query "Stacks[0].StackStatus" --output text)"
73
+
74
+ for expected in "$@"; do
75
+ if [[ "${status}" == "${expected}" ]]; then
76
+ echo "Verified stack status after ${context}: ${status}"
77
+ return 0
78
+ fi
79
+ done
80
+
81
+ echo "Unexpected stack status after ${context}: ${status}" >&2
82
+ echo "Expected one of: $*" >&2
83
+ exit 1
84
+ }
85
+
86
+ verify_oidc_provider_present() {
87
+ local context="$1"
88
+ local listed_arn
89
+ listed_arn="$(
90
+ aws iam list-open-id-connect-providers \
91
+ --query "OpenIDConnectProviderList[?Arn=='${OIDC_PROVIDER_ARN}'].Arn | [0]" \
92
+ --output text
93
+ )"
94
+
95
+ if [[ "${listed_arn}" != "${OIDC_PROVIDER_ARN}" ]]; then
96
+ echo "OIDC provider not found after ${context}: ${OIDC_PROVIDER_ARN}" >&2
97
+ exit 1
98
+ fi
99
+
100
+ local provider_url
101
+ provider_url="$(
102
+ aws iam get-open-id-connect-provider \
103
+ --open-id-connect-provider-arn "${OIDC_PROVIDER_ARN}" \
104
+ --query "Url" \
105
+ --output text
106
+ )"
107
+
108
+ if [[ "${provider_url}" != "${OIDC_ISSUER}" ]]; then
109
+ echo "OIDC provider URL mismatch after ${context}: expected ${OIDC_ISSUER}, got ${provider_url}" >&2
110
+ exit 1
111
+ fi
112
+
113
+ echo "Verified OIDC provider after ${context}: ${OIDC_PROVIDER_ARN}"
114
+ }
115
+
116
+ teardown_stack() {
117
+ echo "==> Teardown: Destroying stack ${STACK_NAME}"
118
+ MIGRATION_PHASE=v4-import MIGRATION_STACK_NAME="${STACK_NAME}" pnpm exec cdk destroy "${STACK_NAME}" --force
119
+ }
120
+
121
+ echo "Using stack: ${STACK_NAME}"
122
+ echo "Working directory: ${PROJECT_DIR}"
123
+ echo "Using account: ${ACCOUNT_ID}"
124
+ echo "Using OIDC provider ARN: ${OIDC_PROVIDER_ARN}"
125
+ echo "Auto teardown: ${AUTO_TEARDOWN}"
126
+
127
+ mkdir -p "${TMP_DIR}"
128
+
129
+ echo "==> Phase 1: Install v2 + aws-cdk-lib@2.220.0"
130
+ pnpm add aws-cdk-github-oidc@^2 aws-cdk-lib@2.220.0
131
+ MIGRATION_PHASE=v2 MIGRATION_STACK_NAME="${STACK_NAME}" pnpm exec cdk deploy "${STACK_NAME}" --require-approval never
132
+ verify_stack_status "phase 1 deploy" CREATE_COMPLETE UPDATE_COMPLETE
133
+ verify_oidc_provider_present "phase 1 deploy"
134
+
135
+ echo "==> Phase 2: Upgrade to v3.1 + aws-cdk-lib@2.237.0 with RETAIN"
136
+ pnpm add aws-cdk-github-oidc@^3.1 aws-cdk-lib@2.237.0
137
+ MIGRATION_PHASE=v3-retain MIGRATION_STACK_NAME="${STACK_NAME}" pnpm exec cdk diff "${STACK_NAME}"
138
+ MIGRATION_PHASE=v3-retain MIGRATION_STACK_NAME="${STACK_NAME}" pnpm exec cdk deploy "${STACK_NAME}" --require-approval never
139
+ verify_stack_status "phase 2 deploy" CREATE_COMPLETE UPDATE_COMPLETE
140
+ verify_oidc_provider_present "phase 2 deploy"
141
+
142
+ echo "==> Phase 3: Upgrade to v4.2 + aws-cdk-lib@^2.237.0 and lookup provider"
143
+ pnpm add aws-cdk-github-oidc@^4.2 aws-cdk-lib@^2.237.0
144
+ MIGRATION_PHASE=v4-lookup MIGRATION_STACK_NAME="${STACK_NAME}" pnpm exec cdk diff "${STACK_NAME}"
145
+ MIGRATION_PHASE=v4-lookup MIGRATION_STACK_NAME="${STACK_NAME}" pnpm exec cdk deploy "${STACK_NAME}" --require-approval never
146
+ verify_stack_status "phase 3 deploy" CREATE_COMPLETE UPDATE_COMPLETE
147
+ verify_oidc_provider_present "phase 3 deploy"
148
+
149
+ echo "==> Phase 4: Switch back to managed provider and import"
150
+ cat > "${RESOURCE_MAPPING_PATH}" <<EOF
151
+ {
152
+ "GithubProvider1CDE27EB": {
153
+ "Arn": "${OIDC_PROVIDER_ARN}"
154
+ }
155
+ }
156
+ EOF
157
+
158
+ echo "Running non-interactive import..."
159
+ printf "y\ny\n" | MIGRATION_PHASE=v4-import MIGRATION_STACK_NAME="${STACK_NAME}" pnpm exec cdk import "${STACK_NAME}" --resource-mapping "${RESOURCE_MAPPING_PATH}" --force --execute true --require-approval never
160
+ verify_stack_status "phase 4 import" IMPORT_COMPLETE
161
+ verify_oidc_provider_present "phase 4 import"
162
+
163
+ echo "==> Phase 5: Post-import verification"
164
+ MIGRATION_PHASE=v4-import MIGRATION_STACK_NAME="${STACK_NAME}" pnpm exec cdk diff "${STACK_NAME}"
165
+ verify_oidc_provider_present "phase 5 post-import diff"
166
+
167
+ echo "Migration test flow completed successfully."
168
+
169
+ if [[ "${AUTO_TEARDOWN}" == "true" ]]; then
170
+ teardown_stack
171
+ else
172
+ read -r -p "Teardown test stack now? (y/n) " teardown_answer
173
+ teardown_answer="$(printf '%s' "${teardown_answer}" | tr '[:upper:]' '[:lower:]')"
174
+ if [[ "${teardown_answer}" == "y" || "${teardown_answer}" == "yes" ]]; then
175
+ teardown_stack
176
+ else
177
+ echo "Skipping teardown. Stack remains deployed: ${STACK_NAME}"
178
+ fi
179
+ fi
package/package.json CHANGED
@@ -65,7 +65,7 @@
65
65
  "publishConfig": {
66
66
  "access": "public"
67
67
  },
68
- "version": "4.2.4",
68
+ "version": "4.2.5",
69
69
  "jest": {
70
70
  "coverageProvider": "v8",
71
71
  "testMatch": [