diff --git a/.github/workflows/deploy-shared.yml b/.github/workflows/deploy-shared.yml index 86ca6046..67f85f9c 100644 --- a/.github/workflows/deploy-shared.yml +++ b/.github/workflows/deploy-shared.yml @@ -230,6 +230,13 @@ jobs: # - list_my_shares: resolver switched from Lambda DS to pipeline (#334) # - list_shares_by_profile / list_invites_by_profile: retired the single-step # owner verifier for the two-phase owner pair (#547) + # - inject_global_payment_methods / set_owner_account_id_in_stash / + # filter_payment_methods_by_access: re-pointed to the shared NoneDataSource + # when the two per-purpose NONE data sources were consolidated (#750). The + # re-pointing deletes the config edge that ordered the data source destroys + # after the function updates, so the full apply destroys the still-referenced + # data sources first and AWS refuses with "Data source is still in use by + # functions". Targeting the functions releases the references out of band. # Keep this target list in sync with scripts/ephemeral-env.sh. "$GITHUB_WORKSPACE/scripts/appsync-ensure-resolver-order.sh" \ -t module.appsync.aws_appsync_resolver.create_order \ @@ -240,7 +247,10 @@ jobs: -t module.appsync.aws_appsync_resolver.update_my_account \ -t module.appsync.aws_appsync_resolver.list_my_shares \ -t module.appsync.aws_appsync_resolver.list_shares_by_profile \ - -t module.appsync.aws_appsync_resolver.list_invites_by_profile + -t module.appsync.aws_appsync_resolver.list_invites_by_profile \ + -t module.appsync.aws_appsync_function.inject_global_payment_methods \ + -t module.appsync.aws_appsync_function.set_owner_account_id_in_stash \ + -t module.appsync.aws_appsync_function.filter_payment_methods_by_access # One-time migration (#665): the custom CloudFront response headers # policies `security` and `auth_security` were retired in favour of the diff --git a/scripts/ephemeral-env.sh b/scripts/ephemeral-env.sh index 4c9ef2ba..f6059c49 100755 --- a/scripts/ephemeral-env.sh +++ b/scripts/ephemeral-env.sh @@ -144,7 +144,10 @@ case "$ACTION" in # create_order (pipeline fn set), validate_payment_method_appsync (data_source switch #299), # create_seller_profile (#300), create_campaign (#301), update_my_account (#298), # list_my_shares (#334), list_shares_by_profile / list_invites_by_profile (single-step - # owner verifier retired for the two-phase owner pair #547). + # owner verifier retired for the two-phase owner pair #547), and the three payment-method + # functions re-pointed to the shared NoneDataSource when the two per-purpose NONE data + # sources were consolidated (#750) — that re-pointing removed the config edge ordering + # the NONE data source destroys after the function updates. "$ROOT_DIR/scripts/appsync-ensure-resolver-order.sh" \ -d "$ENV_DIR" \ -t module.appsync.aws_appsync_resolver.create_order \ @@ -156,6 +159,9 @@ case "$ACTION" in -t module.appsync.aws_appsync_resolver.list_my_shares \ -t module.appsync.aws_appsync_resolver.list_shares_by_profile \ -t module.appsync.aws_appsync_resolver.list_invites_by_profile \ + -t module.appsync.aws_appsync_function.inject_global_payment_methods \ + -t module.appsync.aws_appsync_function.set_owner_account_id_in_stash \ + -t module.appsync.aws_appsync_function.filter_payment_methods_by_access \ -- -var="environment=$RUN_ID" tofu apply -input=false -auto-approve -var="environment=$RUN_ID" diff --git a/tests/unit/test_ephemeral_deploy_resolver_parity.py b/tests/unit/test_ephemeral_deploy_resolver_parity.py index 3976b0d4..e2e5e790 100644 --- a/tests/unit/test_ephemeral_deploy_resolver_parity.py +++ b/tests/unit/test_ephemeral_deploy_resolver_parity.py @@ -1,11 +1,46 @@ """Parity guard: ephemeral-env.sh and deploy-shared.yml keep the same resolver targets.""" +import re from pathlib import Path REPO_ROOT = Path(__file__).resolve().parents[2] -TARGET = "module.appsync.aws_appsync_resolver.public_create_order" +EPHEMERAL = REPO_ROOT / "scripts" / "ephemeral-env.sh" +DEPLOY = REPO_ROOT / ".github" / "workflows" / "deploy-shared.yml" + +TARGET_RE = re.compile(r"-t\s+(module\.appsync\.(?:aws_appsync_resolver|aws_appsync_function)\.[A-Za-z0-9_]+)") + +# The three payment-method functions re-pointed to the shared NoneDataSource when +# the two per-purpose NONE data sources were consolidated (#750). Without these +# targets the full apply destroys the still-referenced NONE data sources before +# re-pointing the functions and AWS refuses every Deploy Production run. +NONE_DS_FUNCTION_TARGETS = ( + "module.appsync.aws_appsync_function.inject_global_payment_methods", + "module.appsync.aws_appsync_function.set_owner_account_id_in_stash", + "module.appsync.aws_appsync_function.filter_payment_methods_by_access", +) + + +def _targets(path: Path) -> set[str]: + return set(TARGET_RE.findall(path.read_text())) + + +def test_target_sets_match() -> None: + ephemeral, deploy = _targets(EPHEMERAL), _targets(DEPLOY) + assert ephemeral == deploy, ( + "appsync-ensure-resolver-order.sh target lists diverged: " + f"only in scripts/ephemeral-env.sh: {sorted(ephemeral - deploy)}; " + f"only in .github/workflows/deploy-shared.yml: {sorted(deploy - ephemeral)}" + ) + + +def test_none_ds_function_targets_in_both() -> None: + ephemeral, deploy = _targets(EPHEMERAL), _targets(DEPLOY) + for target in NONE_DS_FUNCTION_TARGETS: + assert target in ephemeral + assert target in deploy def test_public_create_order_target_in_both() -> None: - assert TARGET in (REPO_ROOT / "scripts" / "ephemeral-env.sh").read_text() - assert TARGET in (REPO_ROOT / ".github" / "workflows" / "deploy-shared.yml").read_text() + target = "module.appsync.aws_appsync_resolver.public_create_order" + assert target in _targets(EPHEMERAL) + assert target in _targets(DEPLOY)