Skip to content

Commit 1fe3840

Browse files
michaelwittwermichaelwittwer
committed
feat: initial commit based on latest version in sc-commons
https://github.com/shiftcode/sc-commons/tree/5e562f391a487f69a4c67065e196f8bc3493ed66/packages/action-cdk-synth-and-diff
0 parents  commit 1fe3840

3 files changed

Lines changed: 145 additions & 0 deletions

File tree

‎CHANGELOG.md‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
# Change Log
2+
3+
## v1.0.0
4+
Initial release of the GitHub action based on the original [cdk-synth-and-diff](https://github.com/shiftcode/sc-commons/tree/5e562f391a487f69a4c67065e196f8bc3493ed66/packages/action-cdk-synth-and-diff)
5+
in sc-commons.
6+
What changed from this version are the version of dependant actions:
7+
- aws-actions/configure-aws-credentials (requires node 24+)
8+
- corymhall/cdk-diff-action (no breaking changes, but updated to latest version)

‎README.md‎

Lines changed: 75 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
1+
# GitHub Action `cdk-synth-and-diff`
2+
![version](https://img.shields.io/github/last-commit/shiftcode/cdk-synth-and-diff-action)
3+
![version](https://img.shields.io/github/tag/shiftcode/cdk-synth-and-diff-action?label=version)
4+
5+
## Overview
6+
7+
The `cdk-synth-and-diff` action synthesizes AWS CDK templates and performs a diff against the base branch of a pull request.
8+
This helps detect destructive or unexpected changes early.
9+
10+
## Prerequisites
11+
12+
- node@>=24 for github action runner
13+
- `aws-cdk` must be installed
14+
- Install the `@shiftcode/iac-utilities` package (version >=1.0.0) in the root of your repository. This package provides
15+
the `stage-override-to-pr-base` and `aws-env-vars` commands used by the action.
16+
17+
- The Action assumes that the repository is configured to use AWS CDK in the provided `iacDir`. Ensure that the specified
18+
directory contains a valid AWS CDK project.
19+
20+
## Inputs
21+
22+
| Name | Description | Required | Default Value |
23+
|--------------------------|-------------------------------------------------------------------------|----------|-----------------------------------|
24+
| `githubToken` | GitHub token to use for the action | Yes | |
25+
| `failOnDestructiveChanges` | Whether or not destructive changes should fail the job | No | `true` |
26+
| `allowedDestroyTypes` | Comma-delimited list of resource types that are allowed to be destroyed | No | `""` |
27+
| `iacDir` | The location of the IAC package | No | `packages/iac` |
28+
| `cdkOutFilename` | The name of the `cdk.out` file | No | `pr-base.cdk.out` |
29+
| `cloudFormationTemplate` | The CloudFormation template to use for the diff | No | `""` |
30+
31+
## Usage
32+
33+
Below is an example of how to use the `cdk-synth-and-diff` action in a GitHub Actions workflow:
34+
35+
```yaml
36+
name: Example Workflow
37+
38+
on:
39+
pull_request:
40+
branches:
41+
- '**'
42+
43+
jobs:
44+
synth-and-diff:
45+
runs-on: ubuntu-latest
46+
steps:
47+
- name: Checkout Repository
48+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
49+
50+
- name: Install Dependencies
51+
run: npm ci
52+
53+
- name: CDK synth and diff with PR base branch stage
54+
if: github.event_name == 'pull_request'
55+
uses: shiftcode/cdk-synth-and-diff-action@SHA # vX.Y.Z
56+
with:
57+
failOnDestructiveChanges: false
58+
allowedDestroyTypes: 'AWS::ECS::TaskDefinition'
59+
githubToken: ${{ secrets.GITHUB_TOKEN }}
60+
cloudFormationTemplate: 'project-name-*'
61+
```
62+
63+
## Key Features
64+
65+
1. **Stage Override**: The action uses the `stage-override-to-pr-base` command to ensure the synthesized templates are
66+
based on the pull request's base branch.
67+
2. **Destructive Change Detection**: The action can fail the job if destructive changes are detected, ensuring safe
68+
deployments.
69+
3. **Customizable Allowed Destroy Types**: Consumers can specify resource types that are allowed to be destroyed during
70+
the diff process.
71+
72+
## Outputs
73+
74+
The action does not produce any explicit outputs but provides diff results for the synthesized templates in form of
75+
a comment on the pull request.

‎action.yml‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
name: cdk-synth-and-diff
2+
description: |
3+
synths and runs a diff against the PR base branch.
4+
This is useful for checking what changes would be applied if the PR were merged.
5+
To run this action you need to have the @shiftcode/branch-utilities package installed in your repository. (version >=4.1.0)
6+
inputs:
7+
githubToken:
8+
description: GitHub token to use for the diff action
9+
required: true
10+
failOnDestructiveChanges:
11+
description: Whether or not destructive changes should fail the job
12+
required: false
13+
default: "true"
14+
allowedDestroyTypes:
15+
description: Comma delimited list of resource types that are allowed to be destroyed
16+
required: false
17+
default: ""
18+
iacDir:
19+
description: The location of the IAC package
20+
required: false
21+
default: 'packages/iac'
22+
cdkOutFilename:
23+
description: The name of the cdk.out file
24+
required: false
25+
default: 'pr-base.cdk.out'
26+
cloudFormationTemplate:
27+
description: The CloudFormation template to use for the diff
28+
required: false
29+
default: ''
30+
awsConfigFilePath:
31+
description: The path to the AWS config file
32+
required: false
33+
default: './aws-accounts.config.json'
34+
runs:
35+
using: 'composite'
36+
steps:
37+
- name: CDK synth with PR base branch stage
38+
id: cdk-synth-pr-base
39+
run: |
40+
eval "$(npx stage-override-to-pr-base)"
41+
eval "$(npx aws-env-vars -c ${{ inputs.awsConfigFilePath }})"
42+
cd ${{ inputs.iacDir }}
43+
npx cdk synth ${{ inputs.cloudFormationTemplate }} -o ${{ inputs.cdkOutFilename }}
44+
ls -al ${{ inputs.cdkOutFilename }}
45+
echo "exporting pr-base SC_AWS_ACCOUNT_ID env var to GITHUB_OUTPUT"
46+
echo "SC_AWS_ACCOUNT_ID=$SC_AWS_ACCOUNT_ID" >> "$GITHUB_OUTPUT"
47+
env:
48+
GITHUB_CONTEXT: ${{ toJson(github) }}
49+
GH_TOKEN: ${{ inputs.githubToken }}
50+
shell: bash
51+
- name: Configure AWS Credentials for CDK diff plugin
52+
uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6.0.0
53+
with:
54+
role-to-assume: 'arn:aws:iam::${{ steps.cdk-synth-pr-base.outputs.SC_AWS_ACCOUNT_ID }}:role/github-action'
55+
aws-region: eu-central-1
56+
- name: CDK diff plugin
57+
uses: corymhall/cdk-diff-action@f6a58358690c94f79d5f9fa485a93a4cb5f67541 # v2.0.8
58+
with:
59+
cdkOutDir: '${{ inputs.iacDir }}/${{ inputs.cdkOutFilename }}'
60+
failOnDestructiveChanges: ${{ inputs.failOnDestructiveChanges }}
61+
allowedDestroyTypes: ${{ inputs.allowedDestroyTypes }}
62+
githubToken: ${{ inputs.githubToken }}

0 commit comments

Comments
 (0)