fix(golden): short-circuit --new when both pins already exist + content-aware artifact digest

Two correctness fixes for the regen CLI and the harness it drives:

1. update_goldens.py --new: peek at expected.{build,package}.yaml before
   running _generate. When both already exist, skip the case entirely
   instead of running the full build+package pipeline and discarding the
   result. Add a regression test that monkeypatches _generate to raise so
   any future re-introduction of the wasted call is caught.

2. harness._packageable_replacement: include resource_id in the digest
   salt. After the build pass replaces local paths with
   <<BUILT_ARTIFACT>>, `current` is constant — so every Lambda Code in
   the corpus collapsed to the same S3Key, and a regression that swapped
   two functions' artifacts would have gone undetected. Salting on
   resource_id makes per-resource digests distinct (Alpha vs Beta within
   one template, etc.). Pins regenerated to reflect the new digests.

Author: bnusunny

tests/golden/harness.py

@@ -347,25 +347,31 @@ def _rewrite_artifacts_to_s3(template: Dict[str, Any], uploader, template_dir: s
     walker only triggers when the current value is a plain string
     (placeholder or path) — intrinsic function dicts (Fn::Sub etc.) survive.
     """
-    for _resource_id, prop_path, resource in _walk_artifact_properties(template):
+    for resource_id, prop_path, resource in _walk_artifact_properties(template):
         current = _get_at_path(resource, prop_path)
         # Skip if not a path or placeholder; intrinsic dicts (Fn::Sub) etc. survive.
         if not isinstance(current, str):
             continue
         rtype = resource.get("Type")
-        replacement = _packageable_replacement(rtype, prop_path, current, template_dir)
+        replacement = _packageable_replacement(
+            rtype, prop_path, current, template_dir, resource_id
+        )
         _set_at_path(resource, prop_path, replacement)
 
 
 def _packageable_replacement(
-    rtype: str, prop_path: str, current: Any, template_dir: str
+    rtype: str, prop_path: str, current: Any, template_dir: str, resource_id: str
 ) -> Any:
     """Compute the deterministic replacement for an artifact property.
 
     Returns either a dict ({"S3Bucket": ..., "S3Key": ...}) or a string
     ("s3://...") depending on the resource type. Sentinel: hashes
-    "<current>|<rtype>|<prop_path>" so each case has a stable URI without
-    needing real file content.
+    "<current>|<rtype>|<prop_path>|<resource_id>" so each resource gets a
+    distinct URI even when ``current`` is the constant
+    ``BUILT_ARTIFACT_PLACEHOLDER`` after the build pass. Including
+    ``resource_id`` is what makes the digest content-aware: without it,
+    every Lambda Code in the corpus would collapse to the same S3Key and a
+    regression that swapped two functions' artifacts would go undetected.
 
     Shapes covered (extend as new corpus cases require new shapes):
       - AWS::Lambda::Function .Code      -> {"S3Bucket": ..., "S3Key": ...}
@@ -374,7 +380,7 @@ def _packageable_replacement(
       - All other artifact properties     -> "s3://<bucket>/<sha256>"
     """
     digest = hashlib.sha256(
-        f"{current}|{rtype}|{prop_path}".encode("utf-8")
+        f"{current}|{rtype}|{prop_path}|{resource_id}".encode("utf-8")
     ).hexdigest()
     # Lambda image — must check before the .Code dict shape
     if rtype == "AWS::Lambda::Function" and prop_path == "Code.ImageUri":

tests/golden/templates/language_extensions/foreach_static_zip/expected.package.yaml

@@ -4,7 +4,7 @@ Resources:
     Properties:
       Code:
         S3Bucket: golden-bucket
-        S3Key: cbe90f4157bf2048dddade15fccab9bb6ea1ff37413fe0f78b7543e206e8910d
+        S3Key: 5e959f785bd23fcb9c18696f2b6855d4c9fbe5130a1e06aff5c4aa4d0091383c
       Handler: app.handler
       Role:
         Fn::GetAtt:
@@ -36,7 +36,7 @@ Resources:
     Properties:
       Code:
         S3Bucket: golden-bucket
-        S3Key: cbe90f4157bf2048dddade15fccab9bb6ea1ff37413fe0f78b7543e206e8910d
+        S3Key: 0169c64c6d32a8001c8f727f32f9b538ba4e1479e47262b4258f969a345a3f51
       Handler: app.handler
       Role:
         Fn::GetAtt:

tests/golden/templates/packageable_resources/lambda_function_zip/expected.package.yaml

@@ -4,7 +4,7 @@ Resources:
     Properties:
       Code:
         S3Bucket: golden-bucket
-        S3Key: cbe90f4157bf2048dddade15fccab9bb6ea1ff37413fe0f78b7543e206e8910d
+        S3Key: 17c3a49c87d6d228b7f4e7b016472d9da14ad548c986f67d3cc3c42365dabcf4
       FunctionName: hello
       Handler: app.handler
       MemorySize: 128

tests/golden/templates/sam_resources/serverless_function_zip/expected.package.yaml

@@ -4,7 +4,7 @@ Resources:
     Properties:
       Code:
         S3Bucket: golden-bucket
-        S3Key: cbe90f4157bf2048dddade15fccab9bb6ea1ff37413fe0f78b7543e206e8910d
+        S3Key: 17c3a49c87d6d228b7f4e7b016472d9da14ad548c986f67d3cc3c42365dabcf4
       Handler: app.handler
       MemorySize: 128
       Role:

tests/golden/test_update_goldens.py

@@ -88,3 +88,17 @@ def test_new_only_writes_missing_pins(isolated_corpus):
     assert (sam_case / "expected.build.yaml").exists()
     # LE case stays stale (--new does not touch existing pins)
     assert le_pin.read_text() == "STALE\n"
+
+
+def test_new_short_circuits_when_all_pins_exist(isolated_corpus, monkeypatch):
+    """When every case is fully pinned, --new must not invoke _generate."""
+    # Pre-pin everything (uses real _generate).
+    update_goldens.main([])
+
+    # Now poison _generate so a single call would blow up.
+    def boom(*_args, **_kwargs):
+        raise AssertionError("_generate must not be called when all pins exist under --new")
+
+    monkeypatch.setattr(update_goldens, "_generate", boom)
+    rc = update_goldens.main(["--new"])
+    assert rc == 0

tests/golden/update_goldens.py

@@ -111,14 +111,26 @@ def main(argv: Optional[List[str]] = None) -> int:
 
     for case_dir in _iter_cases(args.filter):
         case_rel = str(case_dir.relative_to(TEMPLATES_ROOT))
+
+        # --new fast path: if both pins already exist, skip the build+package
+        # pipeline entirely. Only invoke _generate when at least one pin is
+        # missing, then write only the missing files.
+        if args.new:
+            build_existing = _existing(case_dir, "build")
+            pkg_existing = _existing(case_dir, "package")
+            if build_existing is not None and pkg_existing is not None:
+                continue
+            build_yaml, pkg_yaml = _generate(case_dir)
+            if build_existing is None:
+                (case_dir / "expected.build.yaml").write_text(build_yaml, encoding="utf-8")
+            if pkg_existing is None:
+                (case_dir / "expected.package.yaml").write_text(pkg_yaml, encoding="utf-8")
+            continue
+
         build_yaml, pkg_yaml = _generate(case_dir)
 
         for kind, generated in (("build", build_yaml), ("package", pkg_yaml)):
             existing = _existing(case_dir, kind)
-            if args.new:
-                if existing is None:
-                    (case_dir / f"expected.{kind}.yaml").write_text(generated, encoding="utf-8")
-                continue
             if dry_run:
                 if existing != generated:
                     any_diff = True