cdk-preflight 0.0.132 → 0.0.134

package/.claude/skills/add-preflight-rule/SKILL.md

@@ -31,7 +31,7 @@ cdk-preflight のルール追加パイプライン。AGENTS.md の設計原則
    - fail テンプレートがデプロイに**成功**したら、それはドキュメント側の誤り（BROKEN-EXPECTATION）。ルールを削除し、証拠を issue に残して終了する。CloudFront では明文化された制約 9 件中 3 件がこれだった（2026-09-02）
    - **予想と違う理由**で失敗した場合（他アカウントの ARN、ドメイン所有権の検証など）は証拠にならない。サービスエラーが対象の制約そのものを名指しするまでテンプレートを作り直すか、除去できない交絡は `evidence` に明記する
    - `doc-only` は「再現に安価に作れないリソース（検証済み ACM 証明書、所有ドメイン等）が要る」場合に限る最終手段であって、まだ試していない制約への近道ではない。詳細は AGENTS.md の "A doc sentence is a hypothesis, not evidence" に従う
-6. **仕上げ**: `npx projen build` 全緑 → ブランチ作成 → conventional commit（`feat(rules): add <rule-id>`）→ PR 本文に: 制約の出典 / 重複チェック結果 / 実機再現ログ。
+6. **仕上げ**: `npx projen build` 全緑 → ブランチ作成 → **コミットするのは `rules/**` だけ**（`src/rules.generated.ts` は gitignore 済み、`docs/rules.md` と README のバッジ・リソース表は `bundle-docs` が main で書く。ここを触らないので PR 同士が衝突しない）→ conventional commit（`feat(rules): add <rule-id>`）→ PR 本文に: 制約の出典 / 重複チェック結果 / 実機再現ログ。
 
 ## セッションの切り方（コンテキスト予算）
 

package/.claude/skills/run-preflight-issue/SKILL.md

@@ -73,7 +73,8 @@ rule-discovery issue 1 本（例 #64 Glue + Athena）を、**棚卸しから PR
 4. **課金物の禁止**: 禁止リソース型を名指しし、「**create API を呼ぶ前に落とす**」「pass フィクスチャを作らない
    （`--fail-only`）」「既存の無料下敷きは消さない」。`絶対に課金パネルのリソースを作らない`はユーザーの明示指示
 5. **git の縛り**: `main` に直接コミットしない / ブランチを切る / **push も `gh pr create` もしない** /
-   コミットメッセージに attribution 行を入れない
+   コミットメッセージに attribution 行を入れない / **コミットするのは `rules/**` だけ**
+   （生成物は `src/rules.generated.ts` が gitignore、`docs/rules.md` と README は `bundle-docs` が main で書く）
 6. **報告の型**（下記）と「日本語で」
 7. **迷ったら減らす方向に倒せ**。中途半端なルールを 1 本入れるより、確実な本数だけ入れて残りを報告させる
 
@@ -96,6 +97,7 @@ ls rules/<svc> | wc -l                                                     # 本
 npx ts-node --transpile-only --project test/tsconfig.json scripts/rule-check.ts check <svc>   # 0 NG か
 grep -rl '<禁止リソース型>' rules/<svc> | wc -l                             # 課金物が 0 件か
 git log --oneline -1 && git branch --show-current                          # コミットがあり main でないか
+git diff --name-only origin/main.. | grep -v '^rules/' | head                # rules/ 以外を触っていないか（生成物は非コミット）
 ```
 
 B の後は課金物の実在確認も回す（例 `aws athena list-capacity-reservations`）。**食い違ったら同じエージェントに

package/.jsii

@@ -9600,6 +9600,6 @@
       "symbolId": "src/index:PreflightOptions"
     }
   },
-  "version": "0.0.132",
-  "fingerprint": "wqI7UEMjCSX+oicqyH23MeqZpkqg5eTHgnSsAuXBAcg="
+  "version": "0.0.134",
+  "fingerprint": "pAxrVkGHKZrj+c4vLAwzad5Dnt7MVMBAgHWM5gOkslw="
 }

package/AGENTS.md

@@ -78,7 +78,7 @@ The two failure modes are watched separately: **staleness** (the constraint disa
 Then:
 
 1. `rm -rf rules/<service>/<rule-id>/` — delete outright, no tombstone. `upstream: retired` exists for a rule mid-flight, not for a corpse.
-2. `npx projen bundle-rules` (regenerates `src/rules.generated.ts` and `docs/rules.md`).
+2. `npx projen bundle-rules` (regenerates `src/rules.generated.ts`; the file is gitignored, so nothing to commit).
 3. One line in the PR body naming the engine rule id that replaced it.
 
 Users pinned to an older `aws-cdk-lib` keep the old behavior by staying on the older cdk-preflight, so a deletion never leaves them uncovered.
@@ -97,7 +97,7 @@ rules/_lib/<name>.rego      # shared helpers (never emit violations); loaded bef
                             # regardless of `exclude` — so a rule may depend on a lib but never on another rule
 src/index.ts                # Preflight.apply / PreflightOptions (jsii surface — keep minimal)
 src/private/enforce.ts      # enforce-mode plugin (calls the engine directly)
-src/rules.generated.ts      # GENERATED from rules/ — never edit; run `npx projen bundle-rules`
+src/rules.generated.ts      # GENERATED from rules/ and GITIGNORED — `npx projen bundle-rules` (runs in preCompile)
 scripts/bundle-rules.ts     # generator + structural validation
 scripts/rule-check.ts       # one-process local gates: `guard` (bare engine) and `check` (fixtures, pre-bundle)
 test/                       # 4 layers: rules / loader / structure / cli
@@ -151,10 +151,16 @@ If you are a subagent running one of these phases, do not spawn further agents.
    - **Cheap screen for definition-level constraints**: some services expose their create-time validator as a free API (`aws stepfunctions validate-state-machine-definition --type STANDARD|EXPRESS` is the same validator CreateStateMachine runs). Use it to triage doc hypotheses before spending a CloudFormation deploy on each — 100 Step Functions hypotheses took minutes (2026-09-05). The real-deploy gate stays.
 3. `npx ts-node --transpile-only --project test/tsconfig.json scripts/rule-check.ts check <service|rule-id>` while iterating: it reads `rules/` straight from disk into a single engine (no bundle, no meta validation, no jest) and reports, per rule, whether the fail template fires its own rule, the pass template is silent for every rule, and neither trips a built-in ERROR/FATAL. Then `npx projen bundle-rules` and `npx jest test/rules test/structure.test.ts` (the `test/rules` pattern picks up both `rules.test.ts` and the `rules.shard*.test.ts` files that carry the per-rule table) — the duplication guard and fixture checks run there for real. Prefer `jest -t` while iterating; the full suite is ~11,400 tests / ~2.5 min on 8 cores (measured 2026-09-14), so keep it for the pre-PR run.
 4. **Real-deploy gate**: `bash bench/verify-rule.sh <rule-id>` deploys the fail template (expects CREATE to fail; records the service error message) and, where cheap, the pass template (expects success, then deletes). Paste the observed error into `meta.yaml#repro.evidence` with the date. Only `doc-only` rules may skip this, with justification.
-5. Update nothing else by hand — `docs/rules.md`, `src/rules.generated.ts`, and the parts of `README.md` between the
-   `<!-- supported-resources:start -->` markers (plus the rule-count badge) are all written by `npx projen bundle-rules`.
-   `test/structure.test.ts` fails when any of them is stale, so adding a rule that touches a new resource type cannot
-   silently leave the README's supported-resource list behind.
+5. Update nothing else by hand, and **do not commit the generated artifacts** — a rule PR touches `rules/**` and
+   nothing else. `src/rules.generated.ts` is gitignored and written by `npx projen bundle-rules`, which `preCompile`
+   spawns on every build. `docs/rules.md` and the parts of `README.md` between the `<!-- supported-resources:start -->`
+   markers (plus the rule-count badge) stay committed but are written **only** by `npx projen bundle-docs`, which the
+   release workflow's self-mutation step runs on `main`. Keeping them out of the PR diff is what makes two rule PRs
+   mergeable in either order: before this split, every pair of rule PRs conflicted on those three files and each merge
+   forced the rest to rebase and regenerate.
+
+   Consequence for a fresh clone: run `npx projen bundle-rules` once before `npx jest` or anything else that imports
+   `src/rules.generated.ts` — it does not exist until a build writes it.
 
 ## Commands
 
@@ -162,7 +168,8 @@ If you are a subagent running one of these phases, do not spawn further agents.
 |---|---|
 | Local rule gates, one process (pre-bundle) | `npx ts-node --transpile-only --project test/tsconfig.json scripts/rule-check.ts check [service\|rule-id]` |
 | Duplication guard for candidate templates | `... scripts/rule-check.ts guard <dir>` |
-| Regenerate bundle + docs | `npx projen bundle-rules` |
+| Regenerate the bundle (gitignored) | `npx projen bundle-rules` |
+| Regenerate docs/rules.md + README (main only) | `npx projen bundle-docs` |
 | Unit tests | `npx jest` |
 | Full build (jsii, lint, tests, package) | `npx projen build` |
 | Real-deploy verification for one rule | `bash bench/verify-rule.sh <rule-id>` |

package/docs/rules.md

@@ -800,9 +800,7 @@
 | `pf-codebuild-badge-not-supported-for-s3-source` | AWS::CodeBuild::Project | Build badges are not enabled on an S3 or source-less project | ERROR | none |
 | `pf-codebuild-badge-not-with-codepipeline-source` | AWS::CodeBuild::Project | Build badges are not enabled on a CODEPIPELINE project | ERROR | none |
 | `pf-codebuild-build-batch-timeout-range` | AWS::CodeBuild::Project | The batch build timeout stays between 5 and 2160 minutes | ERROR | none |
-| `pf-codebuild-cache-docker-layer-linux-only` | AWS::CodeBuild::Project | PrivilegedMode is not set on a Windows environment | ERROR | none |
 | `pf-codebuild-cache-local-requires-modes` | AWS::CodeBuild::Project | A LOCAL cache names its modes | ERROR | none |
-| `pf-codebuild-cache-location-ignored-for-local` | AWS::CodeBuild::Project | LOCAL_SOURCE_CACHE goes with a project that has a source | ERROR | none |
 | `pf-codebuild-cache-s3-requires-location` | AWS::CodeBuild::Project | An S3 cache names the bucket and prefix | ERROR | none |
 | `pf-codebuild-compute-type-environment-type` | AWS::CodeBuild::Project | The Lambda compute types go with a Lambda environment type | ERROR | none |
 | `pf-codebuild-concurrent-build-limit-range` | AWS::CodeBuild::Project | The per-project concurrent build limit is at least 1 | ERROR | none |
@@ -810,11 +808,13 @@
 | `pf-codebuild-encryption-key-region` | AWS::CodeBuild::Project | The build output encryption key lives in the project's Region | ERROR | none |
 | `pf-codebuild-environment-variable-name-reserved` | AWS::CodeBuild::Project | Environment variable names stay off the reserved CODEBUILD_ prefix | ERROR | none |
 | `pf-codebuild-environment-variable-name-unique` | AWS::CodeBuild::Project | Environment variable names are unique within a project | ERROR | none |
-| `pf-codebuild-file-system-identifier-charset` | AWS::CodeBuild::Project | A project that mounts a file system runs in privileged mode | ERROR | none |
 | `pf-codebuild-file-system-location-format` | AWS::CodeBuild::Project | An EFS mount location names the file system and the directory | ERROR | none |
+| `pf-codebuild-file-system-locations-need-privileged-mode` | AWS::CodeBuild::Project | A project that mounts a file system runs in privileged mode | ERROR | none |
 | `pf-codebuild-git-submodules-config-git-sources-only` | AWS::CodeBuild::Project | Git submodules are only configured on a git-backed source | ERROR | none |
 | `pf-codebuild-lambda-compute-no-privileged-mode` | AWS::CodeBuild::Project | PrivilegedMode is not set on the Lambda compute mode | ERROR | none |
+| `pf-codebuild-local-source-cache-needs-source` | AWS::CodeBuild::Project | LOCAL_SOURCE_CACHE goes with a project that has a source | ERROR | none |
 | `pf-codebuild-logs-s3-requires-location` | AWS::CodeBuild::Project | Enabled S3 build logs name the bucket and prefix | ERROR | none |
+| `pf-codebuild-privileged-mode-not-on-windows` | AWS::CodeBuild::Project | PrivilegedMode is not set on a Windows environment | ERROR | none |
 | `pf-codebuild-project-description-length` | AWS::CodeBuild::Project | The project description stays within 255 characters | ERROR | none |
 | `pf-codebuild-project-name-length` | AWS::CodeBuild::Project | The project name stays within 150 characters | ERROR | none |
 | `pf-codebuild-report-build-status-provider` | AWS::CodeBuild::Project | ReportBuildStatus is only set on a source provider that reports status | ERROR | none |
@@ -823,7 +823,7 @@
 | `pf-codebuild-secondary-artifact-identifier-unique` | AWS::CodeBuild::Project | Secondary artifact identifiers are unique within a project | ERROR | none |
 | `pf-codebuild-secondary-artifacts-identifier-required` | AWS::CodeBuild::Project | Every secondary artifact carries an ArtifactIdentifier | ERROR | none |
 | `pf-codebuild-secondary-artifacts-max-12` | AWS::CodeBuild::Project | A project declares at most 12 secondary artifacts | ERROR | none |
-| `pf-codebuild-secondary-artifacts-no-codepipeline` | AWS::CodeBuild::Project | Secondary artifacts publish to S3 | ERROR | none |
+| `pf-codebuild-secondary-artifacts-s3-only` | AWS::CodeBuild::Project | Secondary artifacts publish to S3 | ERROR | none |
 | `pf-codebuild-secondary-source-identifier-unique` | AWS::CodeBuild::Project | Secondary source identifiers are unique within a project | ERROR | none |
 | `pf-codebuild-secondary-sources-identifier-required` | AWS::CodeBuild::Project | Every secondary source carries a SourceIdentifier | ERROR | none |
 | `pf-codebuild-secondary-sources-max-12` | AWS::CodeBuild::Project | A project declares at most 12 secondary sources | ERROR | none |

package/lib/index.js

@@ -17,7 +17,7 @@ const rules_generated_1 = require("./rules.generated");
  * Preflight.apply(app);
  */
 class Preflight {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "cdk-preflight.Preflight", version: "0.0.132" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "cdk-preflight.Preflight", version: "0.0.134" };
     /**
      * Register the cdk-preflight rules on an App or Stage.
      */