action.yml

name: cdk-synth-and-diff
description: |
  synths and runs a diff against the PR base branch.
  This is useful for checking what changes would be applied if the PR were merged.
  To run this action you need to have the @shiftcode/branch-utilities package installed in your repository. (version >=4.1.0)
inputs:
  githubToken:
    description: GitHub token to use for the diff action
    required: true
  failOnDestructiveChanges:
    description: Whether or not destructive changes should fail the job
    required: false
    default: "true"
  allowedDestroyTypes:
    description: Comma delimited list of resource types that are allowed to be destroyed
    required: false
    default: ""
  iacDir:
    description: The location of the IAC package
    required: false
    default: 'packages/iac'
  cdkOutFilename:
    description: The name of the cdk.out file
    required: false
    default: 'pr-base.cdk.out'
  cloudFormationTemplate:
    description: The CloudFormation template to use for the diff
    required: false
    default: ''
  awsConfigFilePath:
    description: The path to the AWS config file
    required: false
    default: './aws-accounts.config.json'
runs:
  using: 'composite'
  steps:
    - name: CDK synth with PR base branch stage
      id: cdk-synth-pr-base
      run: |
        eval "$(npx stage-override-to-pr-base)"
        eval "$(npx aws-env-vars -c ${{ inputs.awsConfigFilePath }})"
        cd ${{ inputs.iacDir }}
        npx cdk synth ${{ inputs.cloudFormationTemplate }} -o ${{ inputs.cdkOutFilename }}
        ls -al ${{ inputs.cdkOutFilename }}
        echo "exporting pr-base SC_AWS_ACCOUNT_ID env var to GITHUB_OUTPUT"
        echo "SC_AWS_ACCOUNT_ID=$SC_AWS_ACCOUNT_ID" >> "$GITHUB_OUTPUT"
      env:
        GITHUB_CONTEXT: ${{ toJson(github) }}
        GH_TOKEN: ${{ inputs.githubToken }}
      shell: bash
    - name: Configure AWS Credentials for CDK diff plugin
      uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6.0.0
      with:
        role-to-assume: 'arn:aws:iam::${{ steps.cdk-synth-pr-base.outputs.SC_AWS_ACCOUNT_ID }}:role/github-action'
        aws-region: eu-central-1
    - name: CDK diff plugin
      uses: corymhall/cdk-diff-action@f6a58358690c94f79d5f9fa485a93a4cb5f67541 # v2.0.8
      with:
        cdkOutDir: '${{ inputs.iacDir }}/${{ inputs.cdkOutFilename }}'
        failOnDestructiveChanges: ${{ inputs.failOnDestructiveChanges }}
        allowedDestroyTypes: ${{ inputs.allowedDestroyTypes }}
        githubToken: ${{ inputs.githubToken }}