declapract-typescript-ehmpathy 0.49.11 → 0.49.13

package/dist/practices/cicd-common/declastruct-insync-grep.declapract.integration.test.ts

@@ -0,0 +1,49 @@
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+
+import { given, then, when } from 'test-fns';
+
+/**
+ * .what = clamps #561: the .declastruct.yml apply-gate greps the LOWERCASE marker declastruct
+ *         actually emits (`🎉 everything is in sync!`), so the in-sync fast path is live, not dead.
+ * .why  = declastruct's marker is lowercase (planChanges.ts: `context.log.info('🎉 everything is in
+ *         sync!')`). a capital-E `Everything is in sync` grep is case-sensitive and never matches, so
+ *         every plan falls to the has-changes-planned=true arm — a fast path dead its whole life. it
+ *         fails SAFE (over-gates), so no alarm ever fired; a clamp is the only thing that keeps the
+ *         grep tied to the tool's real output.
+ * .teeth = revert the grep to `grep "Everything is in sync"` (capital E) and the "greps the
+ *          lowercase marker" assertion reddens.
+ * .note = the subject is the shipped TEMPLATE, read from __dirname. this file sits at the practice
+ *         ROOT, so declapract never emits it (per the #583 relocation convention).
+ */
+describe('cicd-common .declastruct.yml in-sync grep', () => {
+  given('the shipped .declastruct.yml', () => {
+    const yml = readFileSync(
+      join(__dirname, 'best-practice/.github/workflows/.declastruct.yml'),
+      'utf8',
+    );
+
+    when('the apply-gate grep is read', () => {
+      // declastruct emits this literal phrase, lowercase; the workflow must match it verbatim
+      const markerLower = 'everything is in sync';
+      const markerCapital = 'Everything is in sync';
+
+      then('it greps the lowercase marker declastruct actually emits', () => {
+        expect(yml).toContain(`grep -qF "${markerLower}"`);
+      });
+
+      then('it does NOT grep the capital-E form that never matches (#561)', () => {
+        expect(yml).not.toContain(markerCapital);
+      });
+
+      then('the emitted apply-gate grep line matches snapshot', () => {
+        // snapshot the caller-faced contract itself, so a reword that keeps the
+        // marker token green (a re-ordered -qF, a re-phrased fallback) reddens a vibecheck
+        const grepLine = yml
+          .split('\n')
+          .find((line) => line.includes('grep -qF "'));
+        expect(grepLine?.trim()).toMatchSnapshot('declastruct apply-gate grep');
+      });
+    });
+  });
+});

package/dist/practices/cicd-common/report-slow-tests.play.declapract.integration.test.ts

@@ -0,0 +1,144 @@
+import { spawnSync } from 'node:child_process';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+
+import { given, then, useBeforeAll, when } from 'test-fns';
+
+/**
+ * .what = integration test for the report-slow-tests shell the .test.yml workflow shells out to.
+ * .why  = the prior inline report filtered on `perfStats.runtime`, a key jest 30 dropped — so it
+ *         matched zero rows and went silent-green for its whole life (radio #602). this clamps the
+ *         go-forward: it reads endTime-startTime, ranks by wall-clock, and — the whole point of the
+ *         fix — fails LOUD if a future schema change zeroes the durations again, never silent-green.
+ * .how  = spawn the shipped best-practice/.github/workflows/report-slow-tests.sh against fixture
+ *         jest-results.json files, with GITHUB_STEP_SUMMARY pointed at a temp file, and assert the
+ *         exit code, the summary table, and the stdout annotations.
+ * .note = subject is the SHIPPED shell template. this file sits at the PRACTICE ROOT (not under
+ *         best-practice/), so declapract's loader — which walks only best-practice/ for templates —
+ *         never reads it as a declaration and never copies it to a consumer. it is the play-test
+ *         counterpart to husky/check.timestamps.play.declapract.integration.test.ts.
+ */
+
+// the shell under test (the distributed best-practice template)
+const scriptPath = path.join(
+  __dirname,
+  'best-practice/.github/workflows/report-slow-tests.sh',
+);
+
+// write a fixture jest-results.json + a fresh summary sink into a temp dir; return their paths
+const genFixture = (
+  jestResults: unknown,
+): { resultsPath: string; summaryPath: string } => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'report-slow-tests-'));
+  const resultsPath = path.join(dir, 'jest-results.json');
+  const summaryPath = path.join(dir, 'step-summary.md');
+  fs.writeFileSync(resultsPath, JSON.stringify(jestResults));
+  fs.writeFileSync(summaryPath, '');
+  return { resultsPath, summaryPath };
+};
+
+// spawn the report against a fixture; return exit code + stdout + the summary file contents
+const runReport = (
+  jestResults: unknown,
+): { code: number | null; stdout: string; summary: string } => {
+  const { resultsPath, summaryPath } = genFixture(jestResults);
+  const res = spawnSync('bash', [scriptPath, resultsPath], {
+    encoding: 'utf-8',
+    env: { ...process.env, GITHUB_STEP_SUMMARY: summaryPath },
+  });
+  return {
+    code: res.status,
+    stdout: res.stdout,
+    summary: fs.readFileSync(summaryPath, 'utf-8'),
+  };
+};
+
+describe('report-slow-tests', () => {
+  given('[case1] a report with a slow (>30s), a medium (>10s), and a fast file', () => {
+    when('[t0] the report runs', () => {
+      const result = useBeforeAll(() =>
+        runReport({
+          testResults: [
+            { name: '/repo/src/medium.test.ts', startTime: 1000, endTime: 16000 }, // 15s
+            { name: '/repo/src/fast.test.ts', startTime: 1000, endTime: 3000 }, // 2s
+            { name: '/repo/src/slow.test.ts', startTime: 1000, endTime: 41000 }, // 40s
+          ],
+        }),
+      );
+
+      then('it exits 0', () => {
+        expect(result.code).toEqual(0);
+      });
+
+      then('the summary carries the ranked table', () => {
+        expect(result.summary).toContain('### slowest test files');
+        expect(result.summary).toContain('| duration | file |');
+      });
+
+      then('the slowest file is ranked first in the table', () => {
+        const slowIdx = result.summary.indexOf('/repo/src/slow.test.ts');
+        const mediumIdx = result.summary.indexOf('/repo/src/medium.test.ts');
+        const fastIdx = result.summary.indexOf('/repo/src/fast.test.ts');
+        expect(slowIdx).toBeGreaterThan(-1);
+        expect(slowIdx).toBeLessThan(mediumIdx);
+        expect(mediumIdx).toBeLessThan(fastIdx);
+      });
+
+      then('it emits a warn annotation for the >30s file', () => {
+        expect(result.stdout).toContain(
+          '::warning file=/repo/src/slow.test.ts::slow test: 40s',
+        );
+      });
+
+      then('it emits a notice annotation for the >10s file', () => {
+        expect(result.stdout).toContain(
+          '::notice file=/repo/src/medium.test.ts::test duration: 15s',
+        );
+      });
+
+      then('it emits no annotation for the fast file', () => {
+        expect(result.stdout).not.toContain('/repo/src/fast.test.ts::');
+      });
+    });
+  });
+
+  given('[case2] a non-empty report whose durations are all zero (schema drift)', () => {
+    // the exact silent-death #602 fixed: testResults present, but no real duration to be read.
+    when('[t0] the report runs', () => {
+      const result = useBeforeAll(() =>
+        runReport({
+          testResults: [
+            { name: '/repo/src/a.test.ts', startTime: 1000, endTime: 1000 },
+            { name: '/repo/src/b.test.ts', startTime: 2000, endTime: 2000 },
+          ],
+        }),
+      );
+
+      then('it fails loud with exit 1 (never silent-green)', () => {
+        expect(result.code).toEqual(1);
+      });
+
+      then('it prints an error annotation that names the schema drift', () => {
+        expect(result.stdout).toContain('::error::');
+        expect(result.stdout).toContain('jest --json duration schema');
+        expect(result.stdout).toContain('#602');
+      });
+    });
+  });
+
+  given('[case3] an empty shard (0 test files)', () => {
+    when('[t0] the report runs', () => {
+      const result = useBeforeAll(() => runReport({ testResults: [] }));
+
+      then('it exits 0 (an empty shard is legitimate)', () => {
+        expect(result.code).toEqual(0);
+      });
+
+      then('the summary states the empty-shard state explicitly', () => {
+        expect(result.summary).toContain('0 test files');
+        expect(result.summary).toContain('empty shard');
+      });
+    });
+  });
+});

package/dist/practices/cicd-package/best-practice/.github/workflows/provision.yml

@@ -25,7 +25,8 @@ jobs:
       wish-path: provision/github.repo/resources.ts
       scope: github
       access: prod # github repo settings are inherently a prod resource
-      github-environment-apply: prod
+      github-environment-plan: production-on-else-plan
+      github-environment-apply: ${{ (github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/')) && 'production-on-main' || 'production-on-else-apply' }} # main/tag => on-main; else => on-else-apply
       creds-github-app-owner: ${{ github.repository_owner }}
       creds-github-app-id: ${{ vars.DECLASTRUCT_GITHUB_CONFORMER_APP_ID }}
     secrets:

package/dist/practices/cicd-service/.declapract.integration.test.ts

@@ -0,0 +1,175 @@
+import { readFileSync } from 'node:fs';
+
+import { given, then, useBeforeAll, when } from 'test-fns';
+import yaml from 'yaml';
+
+/**
+ * .what = two clamps on the `deploy.yml` caller:
+ *         1. caller↔callee reconciliation — the caller must pass the `pagerduty-integration-key`
+ *            secret the `.deploy-sls.yml` callee DECLARES and USES, so a prod deploy/acceptance
+ *            failure actually pages (D29 / #573).
+ *         2. prod test-gate precedence — the prod job's `if:` must bind the `needs.test` gate to
+ *            EVERY trigger branch, so a tag push cannot deploy to prod on a failed test (i014 r11).
+ * .why  = (1) the callee marks the secret `required: false`, so github never errors when a caller
+ *         omits it — the omission is SILENT. the callee's `alarm on failure` step gates on
+ *         `if: failure() && env.PAGERDUTY_INTEGRATION_KEY`, so an unpassed secret leaves the step
+ *         SKIPPED and every prod alert dead. the current template shipped a `prod` job with no
+ *         `secrets:` block, and `deploy.yml` is EQUALS — so `declapract fix` STRIPPED the
+ *         pass-through a consumer had, so its alerts died by conformance. this clamp is the guard
+ *         github cannot be: it reconciles the caller's pass-through against the callee's declaration.
+ *         (2) github-actions `&&` binds tighter than `||`, so an `if:` written
+ *         `(tag) || (access==prod) && always() && (test ok)` parses as `tag || (access && always &&
+ *         test)` — the test gate binds ONLY to the access branch, so a `v*` TAG PUSH deploys to prod
+ *         even when `test` FAILED. the correct shape wraps both trigger branches in one outer group:
+ *         `((tag) || access==prod) && always() && (test ok)`. this is the silent-break class the wish
+ *         fights — an untested build reaches prod, every gate green. the clamp reads the raw `if:`
+ *         and reddens on the un-grouped (bug) shape.
+ * .note = a filesystem walk → integration suite per `rule.forbid.unit.remote-boundaries`; no
+ *         credential, no network — the boundary alone classifies it.
+ * .note = the secret clamp is scoped to the `prod` job by design. the callee marks the secret
+ *         `required: false` and the org convention alerts under prod access alone (a prep failure that pages
+ *         prod would be noise), so a `prep` job legitimately omits it. the reconciliation asserts
+ *         the ONE call that matters.
+ */
+
+const WORKFLOWS_DIR = `${__dirname}/best-practice/.github/workflows`;
+const PAGERDUTY_SECRET = 'pagerduty-integration-key';
+
+/**
+ * .what = whether the prod job's collapsed `if:` wraps BOTH trigger branches in ONE outer group
+ *         that the ` && always()` test-gate binds over — the correct precedence.
+ * .why  = a pure transformer leaf, named so the assertion below reads intent rather than a raw
+ *         precedence regex a reader must simulate. the buggy single-group shape opens one paren
+ *         `(startsWith`; the correct shape opens a second, OUTER paren `((startsWith` the
+ *         ` && always()` gate closes over, so the gate binds to the tag-push branch too, not the
+ *         access branch alone. mirrors the peer cicd-app-react-native-expo prod-gate clamp.
+ */
+const isProdGateGroupedCorrectly = (input: { collapsedIf: string }): boolean =>
+  /\(\(startsWith\(github\.ref, 'refs\/tags\/'\).*\|\| github\.event\.inputs\.access == 'prod'\) &&\s*always\(\)/.test(
+    input.collapsedIf,
+  );
+
+const readWorkflow = (input: { file: string }): { text: string; parsed: any } => {
+  const text = readFileSync(`${WORKFLOWS_DIR}/${input.file}`, 'utf-8');
+  return { text, parsed: yaml.parse(text) };
+};
+
+describe('cicd-service — deploy caller↔callee secret reconciliation (D29 clamp)', () => {
+  given('[case1] the `.deploy-sls.yml` callee and the `deploy.yml` caller', () => {
+    const scene = useBeforeAll(() => ({
+      callee: readWorkflow({ file: '.deploy-sls.yml' }),
+      caller: readWorkflow({ file: 'deploy.yml' }),
+    }));
+
+    when('[t0] the callee declares and uses the pagerduty secret', () => {
+      then('it declares the secret under `workflow_call.secrets`', () => {
+        // guard the shape so an absent `on.workflow_call` fails as a clean red, not a
+        // raw TypeError — this file is a durable sentry, a crash undermines that role
+        const workflowCall = scene.callee.parsed.on?.workflow_call;
+        expect(workflowCall).toBeDefined();
+        const declared = workflowCall?.secrets ?? {};
+        expect(Object.keys(declared)).toContain(PAGERDUTY_SECRET);
+      });
+
+      then('it USES the secret in a step (so an unpassed value is a live gap)', () => {
+        expect(scene.callee.text).toContain(`secrets.${PAGERDUTY_SECRET}`);
+      });
+    });
+
+    when('[t1] the caller invokes the callee for the prod deploy', () => {
+      then('the prod job passes the pagerduty secret through', () => {
+        // guard the shape: an absent `jobs.prod` fails as a clean red, not a raw TypeError
+        const prodJob = scene.caller.parsed.jobs?.prod;
+        expect(prodJob).toBeDefined();
+        // teeth: a `prod` job with no `secrets:` block (the shipped defect) leaves this undefined,
+        // so the assertion reddens — which is exactly the state that killed prod alerts.
+        const prodSecrets = prodJob?.secrets ?? {};
+        expect(Object.keys(prodSecrets)).toContain(PAGERDUTY_SECRET);
+      });
+
+      then('the prod job actually calls `.deploy-sls.yml`', () => {
+        // guard the shape: a `prod` job absent a `uses:` key leaves this undefined, so assert it
+        // is a string first — else `.toContain` on undefined throws a raw TypeError, not a clean
+        // red. this file is a durable sentry; a crash undermines that role (r7 i012 nitpick).
+        // guards the assertion above from vacuity — it reconciles a REAL call, not a renamed job
+        const prodUses = scene.caller.parsed.jobs?.prod?.uses;
+        expect(typeof prodUses).toBe('string');
+        expect(prodUses).toContain('.deploy-sls.yml');
+      });
+    });
+
+    when('[t2] the prod job gates on the test result across every trigger branch', () => {
+      // github-actions `&&` binds tighter than `||`. so a prod `if:` written
+      //   (tag) || (access==prod) && always() && (test ok)
+      // parses as  tag || (access && always && test)  — the test gate binds ONLY to the access
+      // branch, and a `v*` TAG PUSH deploys to prod on a FAILED test. the correct shape wraps
+      // both trigger branches in one OUTER group the gate applies to:
+      //   ((tag) || access==prod) && always() && (test ok)
+      // `scene` is a useBeforeAll proxy — read it only inside a `then` (post-setup), never at the
+      // `when` body level, so each `then` derives the collapsed `if:` string itself.
+      const collapseProdIf = (): string =>
+        (scene.caller.parsed.jobs?.prod?.if ?? '').replace(/\s+/g, ' ').trim();
+
+      then('the two trigger branches sit in one outer group the test-gate binds to', () => {
+        const collapsed = collapseProdIf();
+        // guard the shape: an absent `if` leaves collapsed empty, a clean red not a crash
+        expect(collapsed.length).toBeGreaterThan(0);
+        // teeth: revert the outer paren and isProdGateGroupedCorrectly reddens.
+        expect(isProdGateGroupedCorrectly({ collapsedIf: collapsed })).toEqual(
+          true,
+        );
+      });
+
+      then('the buggy per-branch group (access alone in parens after `||`) is absent', () => {
+        // teeth: the precedence bug wraps the access branch in its OWN parens after the `||`
+        // (`|| (github.event.inputs.access == 'prod') &&`), which lets the tag branch stand alone.
+        // the correct shape leaves the access branch bare inside the outer group.
+        expect(collapseProdIf()).not.toContain(
+          "|| (github.event.inputs.access == 'prod') &&",
+        );
+      });
+
+      then('the test-result gate itself is present (guards the above from vacuity)', () => {
+        expect(collapseProdIf()).toContain(
+          "always() && (needs.test.result == 'success' || needs.test.result == 'skipped')",
+        );
+      });
+    });
+
+    when('[t3] the emitted prod-job contract is snapshotted for review', () => {
+      // the regex + toContain clamps above prove the SHAPE; this snapshots the emitted
+      // contract itself so a reviewer vibechecks the actual `if:` gate and `secrets:`
+      // pass-through, and any drift (a reword, an operand reshuffle, a dropped secret)
+      // shows as a diff. per rule.require.contract-snapshot-exhaustiveness.
+      then('the prod job `if:` gate matches snapshot', () => {
+        const prodIf = scene.caller.parsed.jobs?.prod?.if ?? '';
+        expect(prodIf).toMatchSnapshot('deploy.yml prod job if: (test-gate precedence)');
+      });
+
+      then('the prod job `secrets:` pass-through matches snapshot', () => {
+        const prodSecrets = scene.caller.parsed.jobs?.prod?.secrets ?? {};
+        expect(yaml.stringify(prodSecrets)).toMatchSnapshot(
+          'deploy.yml prod job secrets: (pagerduty pass-through)',
+        );
+      });
+
+      then('the callee alarm-on-failure step matches snapshot', () => {
+        // the pass-through only pages if the callee still gates an alarm step on the secret;
+        // snapshot the CONTIGUOUS `alarm on failure` step block — not a line-filter join across the
+        // whole file, which spliced the `secrets:` declaration (6-space indent) and this step's
+        // env/with lines (10-space indent) into an unparseable, mis-indented fragment. the whole
+        // step is valid, uniformly-based yaml, and it still shows both secret usages, so a drop of
+        // the step (or of its secret reference) stays diff-visible.
+        const alarmBlock =
+          scene.callee.text.match(
+            /[ \t]*- name: alarm on failure[\s\S]*?pagerduty-dedup-key: github_workflow_failed\n/,
+          )?.[0] ?? '';
+        // guard vacuity: an empty match would snapshot '' and pass silently on a renamed step
+        expect(alarmBlock.length).toBeGreaterThan(0);
+        expect(alarmBlock).toMatchSnapshot(
+          '.deploy-sls.yml alarm-on-failure step',
+        );
+      });
+    });
+  });
+});

package/dist/practices/cicd-service/.test/assets/demo-repo-pre-stamped-nords/.github/workflows/provision.yml

@@ -0,0 +1,110 @@
+name: provision
+
+on:
+  push:
+    tags:
+      - v*
+    branches:
+      - "main"
+      - "master"
+  pull_request:
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }} # per [workflow] x [branch, tag]
+  cancel-in-progress: true #  cancel workflows for non-latest commits
+
+permissions:
+  id-token: write # required for oidc; a called workflow cannot exceed its caller's grant
+  contents: read
+
+jobs:
+  aws-test-terraform:
+    uses: ./.github/workflows/.terraform.yml
+    with:
+      working-directory: provision/aws/environments/test
+      github-environment-plan: test
+      github-environment-apply: test
+      creds-aws-region: us-east-1
+      creds-aws-role-arn-plan: ${{ vars.CREDS_CICD_AWS_PREP_OIDC_ROLE_ARN }}
+      creds-aws-role-arn-apply: ${{ vars.CREDS_CICD_AWS_PREP_OIDC_ROLE_ARN }}
+
+  aws-prep-terraform:
+    uses: ./.github/workflows/.terraform.yml
+    with:
+      working-directory: provision/aws/environments/prep
+      github-environment-plan: prep
+      github-environment-apply: prep
+      creds-aws-region: us-east-1
+      creds-aws-role-arn-plan: ${{ vars.CREDS_CICD_AWS_PREP_OIDC_ROLE_ARN }}
+      creds-aws-role-arn-apply: ${{ vars.CREDS_CICD_AWS_PREP_OIDC_ROLE_ARN }}
+
+  aws-prod-terraform:
+    uses: ./.github/workflows/.terraform.yml
+    with:
+      working-directory: provision/aws/environments/prod
+      github-environment-plan: production-on-else-plan
+      github-environment-apply: production-on-main # tags cut from main; carries the tag v* deploy policy
+      allow-apply: ${{ startsWith(github.ref, 'refs/tags/') }} # only apply to prod on tags
+      creds-aws-region: us-east-1
+      creds-aws-role-arn-plan: ${{ vars.CREDS_CICD_AWS_PROD_OIDC_PLAN_ROLE_ARN }}
+      creds-aws-role-arn-apply: ${{ vars.CREDS_CICD_AWS_PROD_OIDC_APPLY_ROLE_ARN }}
+
+  github:
+    uses: ./.github/workflows/.declastruct.yml
+    with:
+      wish-path: provision/github.repo/resources.ts
+      scope: github
+      access: prod # github repo settings are inherently a prod resource
+      github-environment-plan: prod
+      github-environment-apply: prod
+      creds-github-app-owner: ${{ github.repository_owner }}
+      creds-github-app-id: ${{ vars.DECLASTRUCT_GITHUB_CONFORMER_APP_ID }}
+    secrets:
+      creds-github-app-private-key: ${{ secrets.DECLASTRUCT_GITHUB_CONFORMER_APP_PRIVATE_KEY }}
+
+  sql-schema-prep:
+    uses: ./.github/workflows/.sql-schema-control.yml
+    with:
+      access: prep
+      github-environment-plan: prep
+      github-environment-apply: prep
+      creds-aws-region: us-east-1
+      creds-aws-role-arn-plan: ${{ vars.CREDS_CICD_AWS_PREP_OIDC_ROLE_ARN }}
+      creds-aws-role-arn-apply: ${{ vars.CREDS_CICD_AWS_PREP_OIDC_ROLE_ARN }}
+
+  sql-schema-prod:
+    uses: ./.github/workflows/.sql-schema-control.yml
+    with:
+      access: prod
+      github-environment-plan: production-on-else-plan
+      github-environment-apply: production-on-main # tags cut from main; carries the tag v* deploy policy
+      allow-apply: ${{ startsWith(github.ref, 'refs/tags/') }} # only apply to prod on tags
+      creds-aws-region: us-east-1
+      creds-aws-role-arn-plan: ${{ vars.CREDS_CICD_AWS_PROD_OIDC_PLAN_ROLE_ARN }}
+      creds-aws-role-arn-apply: ${{ vars.CREDS_CICD_AWS_PROD_OIDC_APPLY_ROLE_ARN }}
+
+  aws-prep-declastruct:
+    uses: ./.github/workflows/.declastruct.yml
+    with:
+      wish-path: provision/aws/resources.ts
+      scope: aws
+      access: prep
+      github-environment-plan: prep
+      github-environment-apply: prep
+      creds-aws-region: us-east-1
+      creds-aws-role-arn-plan: ${{ vars.CREDS_CICD_AWS_PREP_OIDC_ROLE_ARN }}
+      creds-aws-role-arn-apply: ${{ vars.CREDS_CICD_AWS_PREP_OIDC_ROLE_ARN }}
+
+  aws-prod-declastruct:
+    uses: ./.github/workflows/.declastruct.yml
+    with:
+      wish-path: provision/aws/resources.ts
+      scope: aws
+      access: prod
+      github-environment-plan: production-on-else-plan
+      github-environment-apply: production-on-main # tags cut from main; carries the tag v* deploy policy
+      allow-apply: ${{ startsWith(github.ref, 'refs/tags/') }} # only apply to prod on tags
+      creds-aws-region: us-east-1
+      creds-aws-role-arn-plan: ${{ vars.CREDS_CICD_AWS_PROD_OIDC_PLAN_ROLE_ARN }}
+      creds-aws-role-arn-apply: ${{ vars.CREDS_CICD_AWS_PROD_OIDC_APPLY_ROLE_ARN }}

package/dist/practices/cicd-service/.test/assets/demo-repo-pre-stamped-nords/declapract.use.nords.yml

@@ -0,0 +1,20 @@
+declarations: 'declarations/declapract.declare.yml'
+useCase: service-without-rds
+variables:
+  organizationName: 'test-org'
+  projectName: 'test-project'
+  infrastructureNamespaceId: 'testns'
+  slackWebhookUrl: 'https://hooks.slack.example.com/test'
+  awsAccountId:
+    prep: '123456789012'
+    prod: '123456789012'
+  databaseName: 'testdb'
+  databaseUserName:
+    cicdUser: 'cicd_user'
+    serviceUser: 'service_user'
+  databaseTunnelHost:
+    prep: 'tunnel.prep.example.com'
+    prod: 'tunnel.prod.example.com'
+  databaseClusterHost:
+    prep: 'cluster.prep.example.com'
+    prod: 'cluster.prod.example.com'

package/dist/practices/cicd-service/.test/assets/demo-repo-pre-stamped-nords/declapract.use.rds.yml

@@ -0,0 +1,20 @@
+declarations: 'declarations/declapract.declare.yml'
+useCase: service-with-rds
+variables:
+  organizationName: 'test-org'
+  projectName: 'test-project'
+  infrastructureNamespaceId: 'testns'
+  slackWebhookUrl: 'https://hooks.slack.example.com/test'
+  awsAccountId:
+    prep: '123456789012'
+    prod: '123456789012'
+  databaseName: 'testdb'
+  databaseUserName:
+    cicdUser: 'cicd_user'
+    serviceUser: 'service_user'
+  databaseTunnelHost:
+    prep: 'tunnel.prep.example.com'
+    prod: 'tunnel.prod.example.com'
+  databaseClusterHost:
+    prep: 'cluster.prep.example.com'
+    prod: 'cluster.prod.example.com'

package/dist/practices/cicd-service/.test/assets/demo-repo-pre-stamped-nords/package.json

@@ -0,0 +1,4 @@
+{
+  "name": "test-project",
+  "version": "1.0.0"
+}

package/dist/practices/cicd-service/.test/assets/demo-repo-service/declapract.use.nords.yml

@@ -0,0 +1,20 @@
+declarations: 'declarations/declapract.declare.yml'
+useCase: service-without-rds
+variables:
+  organizationName: 'test-org'
+  projectName: 'test-project'
+  infrastructureNamespaceId: 'testns'
+  slackWebhookUrl: 'https://hooks.slack.example.com/test'
+  awsAccountId:
+    prep: '123456789012'
+    prod: '123456789012'
+  databaseName: 'testdb'
+  databaseUserName:
+    cicdUser: 'cicd_user'
+    serviceUser: 'service_user'
+  databaseTunnelHost:
+    prep: 'tunnel.prep.example.com'
+    prod: 'tunnel.prod.example.com'
+  databaseClusterHost:
+    prep: 'cluster.prep.example.com'
+    prod: 'cluster.prod.example.com'

package/dist/practices/cicd-service/.test/assets/demo-repo-service/declapract.use.rds.yml

@@ -0,0 +1,20 @@
+declarations: 'declarations/declapract.declare.yml'
+useCase: service-with-rds
+variables:
+  organizationName: 'test-org'
+  projectName: 'test-project'
+  infrastructureNamespaceId: 'testns'
+  slackWebhookUrl: 'https://hooks.slack.example.com/test'
+  awsAccountId:
+    prep: '123456789012'
+    prod: '123456789012'
+  databaseName: 'testdb'
+  databaseUserName:
+    cicdUser: 'cicd_user'
+    serviceUser: 'service_user'
+  databaseTunnelHost:
+    prep: 'tunnel.prep.example.com'
+    prod: 'tunnel.prod.example.com'
+  databaseClusterHost:
+    prep: 'cluster.prep.example.com'
+    prod: 'cluster.prod.example.com'

package/dist/practices/cicd-service/.test/assets/demo-repo-service/package.json

@@ -0,0 +1,4 @@
+{
+  "name": "test-project",
+  "version": "1.0.0"
+}

package/dist/practices/cicd-service/__snapshots__/.declapract.integration.test.ts.snap

@@ -0,0 +1,24 @@
+// Jest Snapshot v1, https://jestjs.io/docs/snapshot-testing
+
+exports[`cicd-service — deploy caller↔callee secret reconciliation (D29 clamp) given: [case1] the \`.deploy-sls.yml\` callee and the \`deploy.yml\` caller when: [t3] the emitted prod-job contract is snapshotted for review then: the callee alarm-on-failure step matches snapshot: .deploy-sls.yml alarm-on-failure step 1`] = `
+"      - name: alarm on failure
+        env:
+          PAGERDUTY_INTEGRATION_KEY: \${{ secrets.pagerduty-integration-key }}
+        if: failure() && env.PAGERDUTY_INTEGRATION_KEY
+        uses: Entle/action-pagerduty-alert@e6ca54cd88948b8a50f5bb1071dfa5bdb149ce7e # 0.2.0 — https://github.com/marketplace/actions/pagerduty-alert
+        with:
+          pagerduty-integration-key: "\${{ secrets.pagerduty-integration-key }}"
+          pagerduty-dedup-key: github_workflow_failed
+"
+`;
+
+exports[`cicd-service — deploy caller↔callee secret reconciliation (D29 clamp) given: [case1] the \`.deploy-sls.yml\` callee and the \`deploy.yml\` caller when: [t3] the emitted prod-job contract is snapshotted for review then: the prod job \`if:\` gate matches snapshot: deploy.yml prod job if: (test-gate precedence) 1`] = `
+"((startsWith(github.ref, 'refs/tags/') && github.event_name != 'workflow_dispatch') || github.event.inputs.access == 'prod') &&
+always() && (needs.test.result == 'success' || needs.test.result == 'skipped')
+"
+`;
+
+exports[`cicd-service — deploy caller↔callee secret reconciliation (D29 clamp) given: [case1] the \`.deploy-sls.yml\` callee and the \`deploy.yml\` caller when: [t3] the emitted prod-job contract is snapshotted for review then: the prod job \`secrets:\` pass-through matches snapshot: deploy.yml prod job secrets: (pagerduty pass-through) 1`] = `
+"pagerduty-integration-key: \${{ secrets.PAGERDUTY_INTEGRATION_KEY }}
+"
+`;

package/dist/practices/cicd-service/__snapshots__/acceptanceContempFleetGuard.declapract.integration.test.ts.snap

@@ -0,0 +1,13 @@
+// Jest Snapshot v1, https://jestjs.io/docs/snapshot-testing
+
+exports[`contemp-only acceptance guard — the shipped deploy template cannot re-split into a dual fleet fan-out given: [case2] the acceptance-job block as a whole when: [t0] the block is read from the shipped deploy template then: the acceptance-job block matches snapshot (a reworded step reddens): deploy-sls acceptance-job block 1`] = `
+"      # acceptance targets the contemp fleet — the service's own access-tier slug (-prep- at prep,
+      # -prod- at prod). dual-publish ships the SAME artifact under the ancient (-dev-) slug too, so
+      # a run against contemp proves the deployed code; the ancient slug is an alias for inbound
+      # callers still on the old name, never a second target to test. contemp maps to the deployed
+      # access at both prep and prod, so one run covers every tier this job deploys — no
+      # per-fleet fan-out, no per-tier skip.
+      - name: test:acceptance
+        run: ACCESS=\${{ inputs.access }} npm run test:acceptance
+"
+`;

package/dist/practices/cicd-service/__snapshots__/insync-grep.declapract.integration.test.ts.snap

@@ -0,0 +1,5 @@
+// Jest Snapshot v1, https://jestjs.io/docs/snapshot-testing
+
+exports[`cicd-service apply-gate in-sync greps given: the shipped .sql-schema-control.yml when: the apply-gate grep is read then: the emitted apply-gate grep line matches snapshot: sql-schema-control apply-gate grep 1`] = `"if grep "connect ETIMEDOUT" ./plan.log"`;
+
+exports[`cicd-service apply-gate in-sync greps given: the shipped .terraform.yml when: the apply-gate grep is read then: the emitted apply-gate grep line matches snapshot: terraform apply-gate grep 1`] = `"if grep "infrastructure matches the configuration" ./plan.log"`;