declapract-typescript-ehmpathy 0.49.15 → 0.50.0

package/dist/.test/assets/cicd-common/declarations/practices/cicd-common/best-practice/.github/workflows/.declastruct.yml

@@ -0,0 +1,218 @@
+name: .declastruct
+
+# .what = reusable declastruct plan/apply for a wish, against either a github-app or an
+#   aws-oidc backend. one workflow, two auth models — each auth step fires only when its
+#   creds are supplied.
+# .why = declastruct wishes share the plan->artifact->apply shape regardless of backend;
+#   only the auth differs. github-provider wishes auth via a github-app token; aws-provider
+#   wishes auth via oidc role assumption (with a plan/apply role split — plan readonly, apply
+#   writer) + the ACCESS envar (read by the wish via sdk-environment). the plan is uploaded as
+#   an artifact so apply executes the EXACT plan reviewers saw.
+
+on:
+  workflow_call:
+    inputs:
+      wish-path:
+        type: string
+        description: "the path to the wish declaration"
+        required: true
+      scope:
+        type: string
+        description: "the provider backend this wish targets (github | aws)"
+        required: true
+      access:
+        type: string
+        description: "the access to provision with (test | prep | prod)"
+        required: true
+      github-environment-plan:
+        type: string
+        description: "github environment for the plan job"
+      github-environment-apply:
+        type: string
+        description: "github environment for the apply job"
+      allow-apply:
+        type: boolean
+        description: "whether the apply step is enabled. defaults to true on main"
+        default: ${{ github.ref == 'refs/heads/main' }}
+      creds-github-app-owner:
+        type: string
+        required: false
+        description: "github-app wishes: the owner of the github app to generate a token for"
+      creds-github-app-id:
+        type: string
+        required: false
+        description: "github-app wishes: the id of the github app to generate a token for"
+      creds-aws-region:
+        type: string
+        required: false
+        description: "aws wishes: the aws region for oidc auth"
+      creds-aws-role-arn-plan:
+        type: string
+        required: false
+        description: "aws wishes: oidc role arn for the plan job (readonly — DescribeParameters, no kms:Decrypt)"
+      creds-aws-role-arn-apply:
+        type: string
+        required: false
+        description: "aws wishes: oidc role arn for the apply job (writer — PutParameter, kms:Encrypt)"
+    secrets:
+      creds-github-app-private-key:
+        required: false
+        description: "github-app wishes: the private key of the github app to generate a token for"
+
+# .why = least privilege: only the jobs that assume the aws role grant id-token, at job scope
+permissions:
+  contents: read
+
+jobs:
+  install:
+    uses: ./.github/workflows/.install.yml
+
+  plan:
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+      id-token: write # required for aws oidc (unused by github-app wishes)
+    environment:
+      # deployment: false keeps the built-in gate but suppresses the auto-Deployment, so a plan
+      # run posts no "deployed to <env>" status to the PR timeline. the environment is ALWAYS
+      # declared — for prep and prod alike.
+      name: ${{ inputs.github-environment-plan }}
+      deployment: false
+    needs: [install]
+    env:
+      ACCESS: ${{ inputs.access }} # aws wishes: sdk-environment getEnvironment reads ACCESS
+    outputs:
+      has-changes-planned: ${{ steps.evaluate-plan.outputs.has-changes-planned }}
+    steps:
+      - name: checkout
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+
+      - name: set node-version
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        with:
+          node-version-file: ".nvmrc"
+
+      - name: get node-modules from cache
+        uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+        with:
+          path: ./node_modules
+          key: ${{ needs.install.outputs.node-modules-cache-key }}
+          fail-on-cache-miss: true
+
+      - name: get github auth, if creds supplied
+        if: ${{ inputs.creds-github-app-id }}
+        id: github-app-token
+        uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v2
+        with:
+          owner: ${{ inputs.creds-github-app-owner }}
+          repositories: ${{ github.event.repository.name }}
+          app-id: ${{ inputs.creds-github-app-id }}
+          private-key: ${{ secrets.creds-github-app-private-key }}
+
+      - name: get aws auth, if creds supplied
+        if: ${{ inputs.creds-aws-role-arn-plan }}
+        uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4
+        with:
+          role-to-assume: ${{ inputs.creds-aws-role-arn-plan }}
+          aws-region: ${{ inputs.creds-aws-region }}
+
+      - name: declastruct plan
+        id: plan
+        run: |
+          set -o pipefail
+          npx declastruct plan --wish ${{ inputs.wish-path }} --into ${{ inputs.wish-path }}.plan.json | tee ./plan.log
+        env:
+          GITHUB_TOKEN: ${{ steps.github-app-token.outputs.token }}
+
+      - name: evaluate plan
+        id: evaluate-plan
+        run: |
+          # declastruct prints `🎉 everything is in sync!` (LOWERCASE) when there is no diff.
+          # grep -qF: fixed-string (no char read as regex), quiet (the exit code is the whole
+          # signal), and the full phrase so an unrelated line that holds "in sync" cannot
+          # false-match. the marker is lowercase — a capital-lead grep never matches it, so the
+          # fast path would be dead code.
+          if grep -qF "everything is in sync" ./plan.log
+          then
+            echo "has-changes-planned=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "has-changes-planned=true" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: has changes planned?
+        run: echo "${{ steps.evaluate-plan.outputs.has-changes-planned }}"
+
+      - name: upload plan artifact
+        if: ${{ inputs.allow-apply == true && steps.evaluate-plan.outputs.has-changes-planned == 'true' }}
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: declastruct-${{ inputs.scope }}-${{ inputs.access }}-plan
+          path: |
+            ${{ inputs.wish-path }}.plan.json
+          retention-days: 1
+          include-hidden-files: false
+
+  apply:
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+      id-token: write # required for aws oidc (unused by github-app wishes)
+    environment:
+      # deployment: false keeps the built-in gate but suppresses the auto-Deployment, so the apply
+      # run posts no "deployed to <env>" status to the PR timeline. the environment is ALWAYS
+      # declared — for prep and prod alike.
+      name: ${{ inputs.github-environment-apply }}
+      deployment: false
+    needs: [install, plan]
+    if: ${{ inputs.allow-apply == true && needs.plan.outputs.has-changes-planned == 'true' }}
+    env:
+      ACCESS: ${{ inputs.access }} # aws wishes: sdk-environment getEnvironment reads ACCESS
+    steps:
+      - name: checkout
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+
+      - name: set node-version
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        with:
+          node-version-file: ".nvmrc"
+
+      - name: get node-modules from cache
+        uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+        with:
+          path: ./node_modules
+          key: ${{ needs.install.outputs.node-modules-cache-key }}
+          fail-on-cache-miss: true
+
+      - name: extract directory from wish-path
+        id: extract-dir
+        run: echo "wish-dir=$(dirname "${{ inputs.wish-path }}")" >> "$GITHUB_OUTPUT"
+
+      - name: download plan artifact
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+        with:
+          name: declastruct-${{ inputs.scope }}-${{ inputs.access }}-plan
+          path: ${{ steps.extract-dir.outputs.wish-dir }}
+
+      - name: get github auth, if creds supplied
+        if: ${{ inputs.creds-github-app-id }}
+        id: github-app-token
+        uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v2
+        with:
+          owner: ${{ inputs.creds-github-app-owner }}
+          repositories: ${{ github.event.repository.name }}
+          app-id: ${{ inputs.creds-github-app-id }}
+          private-key: ${{ secrets.creds-github-app-private-key }}
+
+      - name: get aws auth, if creds supplied
+        if: ${{ inputs.creds-aws-role-arn-apply }}
+        uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4
+        with:
+          role-to-assume: ${{ inputs.creds-aws-role-arn-apply }}
+          aws-region: ${{ inputs.creds-aws-region }}
+
+      - name: declastruct apply
+        run: |
+          set -o pipefail
+          npx declastruct apply --plan ${{ inputs.wish-path }}.plan.json | tee ./apply.log
+        env:
+          GITHUB_TOKEN: ${{ steps.github-app-token.outputs.token }}

package/dist/.test/assets/cicd-common/declarations/practices/cicd-common/best-practice/.github/workflows/.install.yml

@@ -0,0 +1,56 @@
+name: .install
+
+on:
+  workflow_call:
+    outputs:
+      node-modules-cache-key:
+        description: a max(stable) cache key to the node modules of this commit's dependencies
+        value: ${{ jobs.pnpm.outputs.node-modules-cache-key }}
+
+jobs:
+  pnpm:
+    runs-on: ubuntu-24.04
+    outputs:
+      node-modules-cache-key: ${{ steps.cache.outputs.cache-primary-key }}
+    steps:
+      - name: checkout
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+
+      - name: node-modules deps hash
+        id: deps-hash
+        run: |
+          NODE_VERSION=$(cat .nvmrc | tr -d '[:space:]');
+          echo "NODE_VERSION=$NODE_VERSION"
+          echo "node-version=$NODE_VERSION" >> "$GITHUB_OUTPUT"
+          PACKAGE_DEPS_HASH=$(md5sum pnpm-lock.yaml | awk '{print $1}');
+          echo "PACKAGE_DEPS_HASH=$PACKAGE_DEPS_HASH"
+          echo "package-deps-hash=$PACKAGE_DEPS_HASH" >> "$GITHUB_OUTPUT"
+
+      - name: node-modules cache check
+        uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+        id: cache
+        with:
+          path: ./node_modules
+          key: ${{ runner.os }}-node-${{ steps.deps-hash.outputs.node-version }}-pnpm-${{ steps.deps-hash.outputs.package-deps-hash }}
+          lookup-only: true
+
+      - name: node-modules cache miss setup node
+        if: steps.cache.outputs.cache-hit != 'true'
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        with:
+          node-version-file: ".nvmrc"
+
+      - name: node-modules cache miss setup pnpm
+        if: steps.cache.outputs.cache-hit != 'true'
+        uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
+
+      - name: node-modules cache miss install
+        if: steps.cache.outputs.cache-hit != 'true'
+        run: pnpm install --frozen-lockfile
+
+      - name: node-modules cache set
+        if: steps.cache.outputs.cache-hit != 'true'
+        uses: actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+        with:
+          path: ./node_modules
+          key: ${{ steps.cache.outputs.cache-primary-key }}