cdkd/.github/workflows/ci.yml at 1d862e3385b5b776203051fe6970e1f7733f46e9 · go-to-k/cdkd · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
name: CI
on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

jobs:
  check-build-test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - uses: voidzero-dev/setup-vp@ca1c46663915d6c1042ae23bd39ab85718bfb0fa # v1
        with:
          node-version: "24"
          cache: true
          run-install: false

      - run: vp install --frozen-lockfile
      - run: vp run check
      - run: vp run test
      - run: vp run build

      # Issue #399 — fail CI when docs/integ-coverage.md or
      # docs/_generated/integ-coverage.json is stale relative to
      # src/provisioning/register-providers.ts +
      # tests/integration/*/{lib,bin}/*.ts. Regenerate via the same
      # `vp run integ-coverage` task the contributor would run, then
      # fail-on-diff. Closes the "forgot to regenerate after editing"
      # gap that the /verify-pr skill step is the manual fallback for.
      - name: integ-coverage matrix is up-to-date
        run: |
          vp run integ-coverage
          if ! git diff --quiet -- docs/integ-coverage.md docs/_generated/integ-coverage.json; then
            echo "::error::integ-coverage matrix is stale — run \`vp run integ-coverage\` and commit the regenerated docs/integ-coverage.md + docs/_generated/integ-coverage.json"
            git --no-pager diff -- docs/integ-coverage.md docs/_generated/integ-coverage.json
            exit 1
          fi

      # Issue #398 — fail CI when the cached three-tier provider-coverage
      # audit (docs/_generated/provider-coverage.json) Tier 1 list drifts
      # from src/provisioning/register-providers.ts. Offline check (<1s,
      # no AWS calls — the full regeneration via
      # `vp run audit:coverage:regenerate` would take 10-30 min + AWS
      # CFn DescribeType throttling and stays a manual / future-cron job
      # per issue #398 Option A). Catches the "added a new provider but
      # forgot to regen the audit cache" case structurally, mirroring
      # the integ-coverage step above.
      - run: vp run audit:coverage:check

      # Issue #423 — fail CI when docs/scenario-coverage.md or
      # docs/_generated/scenario-coverage.json is stale relative to
      # the KNOWN_SCENARIOS taxonomy in
      # scripts/build-scenario-coverage-matrix.ts and the per-fixture
      # tests/integration/<name>/.scenarios.json sidecars. Same shape as
      # the integ-coverage step above. The script ALSO hard-fails on a
      # sidecar carrying an unknown tag (typo guard), so the step covers
      # both "forgot to regenerate" and "wrote a typo tag" classes.
      - name: scenario-coverage matrix is up-to-date
        run: |
          vp run scenario-coverage
          if ! git diff --quiet -- docs/scenario-coverage.md docs/_generated/scenario-coverage.json; then
            echo "::error::scenario-coverage matrix is stale — run \`vp run scenario-coverage\` and commit the regenerated docs/scenario-coverage.md + docs/_generated/scenario-coverage.json"
            git --no-pager diff -- docs/scenario-coverage.md docs/_generated/scenario-coverage.json
            exit 1
          fi

      # Fail CI when src/provisioning/unsupported-types.generated.ts is stale
      # relative to docs/_generated/provider-coverage.json (tier3). The runtime
      # pre-flight reads the generated module, so it must track the audit cache.
      # Same shape as the integ-coverage / scenario-coverage staleness guards.
      - name: unsupported-types module is up-to-date
        run: |
          vp run gen:unsupported-types
          if ! git diff --quiet -- src/provisioning/unsupported-types.generated.ts; then
            echo "::error::src/provisioning/unsupported-types.generated.ts is stale — run \`vp run gen:unsupported-types\` and commit the regenerated module"
            git --no-pager diff -- src/provisioning/unsupported-types.generated.ts
            exit 1
          fi

      # Fail CI when src/provisioning/property-coverage.generated.ts is stale
      # relative to the CFn schema fixtures + each SDK provider's
      # handledProperties / unhandledByDesign declarations. The runtime
      # property-level pre-flight (ProviderRegistry.validateResourceProperties)
      # reads the generated module, so it must track the source data.
      # The codegen writes a raw multi-line shape; the committed module is
      # Prettier-formatted, so we run `vp run format` after the codegen to
      # canonicalize before diffing (mirrors how the file was written at
      # scaffold time in 476d3c1).
      - name: property-coverage module is up-to-date
        run: |
          vp run gen:property-coverage
          vp run format
          if ! git diff --quiet -- src/provisioning/property-coverage.generated.ts; then
            echo "::error::src/provisioning/property-coverage.generated.ts is stale — run \`vp run gen:property-coverage && vp run format\` and commit the regenerated module"
            git --no-pager diff -- src/provisioning/property-coverage.generated.ts
            exit 1
          fi

      # Fail CI when docs/_generated/enrichment-coverage.{json,md} is stale
      # relative to the CFn schema fixtures + the enrichResourceAttributes
      # switch in src/provisioning/cloud-control-provider.ts. The matrix records
      # which CC-routable types' computed readOnly Fn::GetAtt attributes are
      # populated by enrichment (the bug class fixed in #844/#864/#865/#866).
      # Same diff-on-stale shape as the integ-coverage / property-coverage
      # guards above. The second step is the CRITIC: it hard-fails on a pure-CC
      # (no-SDK-provider) latent gap that is neither enriched nor allow-listed.
      - name: enrichment-coverage matrix is up-to-date
        run: |
          vp run gen:enrichment-coverage
          if ! git diff --quiet -- docs/_generated/enrichment-coverage.json docs/_generated/enrichment-coverage.md; then
            echo "::error::enrichment-coverage matrix is stale — run \`vp run gen:enrichment-coverage\` and commit the regenerated docs/_generated/enrichment-coverage.{json,md}"
            git --no-pager diff -- docs/_generated/enrichment-coverage.json docs/_generated/enrichment-coverage.md
            exit 1
          fi
      - run: vp run audit:enrichment-coverage:check

  runtime-compat:
    runs-on: ubuntu-latest
    needs: check-build-test
    strategy:
      matrix:
        node-version: [20, 22, 24]
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - uses: voidzero-dev/setup-vp@ca1c46663915d6c1042ae23bd39ab85718bfb0fa # v1
        with:
          node-version: "24"
          cache: true
          run-install: false

      - run: vp install --frozen-lockfile
      - run: vp run build
      - run: vp env exec --node ${{ matrix.node-version }} node dist/cli.js --version