fix(ci): order the re-pointed payment-method functions before the NONE data source deletes

.github/workflows/deploy-shared.yml

@@ -230,6 +230,13 @@ jobs:
           #   - list_my_shares: resolver switched from Lambda DS to pipeline (#334)
           #   - list_shares_by_profile / list_invites_by_profile: retired the single-step
           #     owner verifier for the two-phase owner pair (#547)
+          #   - inject_global_payment_methods / set_owner_account_id_in_stash /
+          #     filter_payment_methods_by_access: re-pointed to the shared NoneDataSource
+          #     when the two per-purpose NONE data sources were consolidated (#750). The
+          #     re-pointing deletes the config edge that ordered the data source destroys
+          #     after the function updates, so the full apply destroys the still-referenced
+          #     data sources first and AWS refuses with "Data source is still in use by
+          #     functions". Targeting the functions releases the references out of band.
           # Keep this target list in sync with scripts/ephemeral-env.sh.
           "$GITHUB_WORKSPACE/scripts/appsync-ensure-resolver-order.sh" \
             -t module.appsync.aws_appsync_resolver.create_order \
@@ -240,7 +247,10 @@ jobs:
             -t module.appsync.aws_appsync_resolver.update_my_account \
             -t module.appsync.aws_appsync_resolver.list_my_shares \
             -t module.appsync.aws_appsync_resolver.list_shares_by_profile \
-            -t module.appsync.aws_appsync_resolver.list_invites_by_profile
+            -t module.appsync.aws_appsync_resolver.list_invites_by_profile \
+            -t module.appsync.aws_appsync_function.inject_global_payment_methods \
+            -t module.appsync.aws_appsync_function.set_owner_account_id_in_stash \
+            -t module.appsync.aws_appsync_function.filter_payment_methods_by_access
 
       # One-time migration (#665): the custom CloudFront response headers
       # policies `security` and `auth_security` were retired in favour of the

scripts/ephemeral-env.sh

@@ -144,7 +144,10 @@ case "$ACTION" in
     #   create_order (pipeline fn set), validate_payment_method_appsync (data_source switch #299),
     #   create_seller_profile (#300), create_campaign (#301), update_my_account (#298),
     #   list_my_shares (#334), list_shares_by_profile / list_invites_by_profile (single-step
-    #   owner verifier retired for the two-phase owner pair #547).
+    #   owner verifier retired for the two-phase owner pair #547), and the three payment-method
+    #   functions re-pointed to the shared NoneDataSource when the two per-purpose NONE data
+    #   sources were consolidated (#750) — that re-pointing removed the config edge ordering
+    #   the NONE data source destroys after the function updates.
     "$ROOT_DIR/scripts/appsync-ensure-resolver-order.sh" \
       -d "$ENV_DIR" \
       -t module.appsync.aws_appsync_resolver.create_order \
@@ -156,6 +159,9 @@ case "$ACTION" in
       -t module.appsync.aws_appsync_resolver.list_my_shares \
       -t module.appsync.aws_appsync_resolver.list_shares_by_profile \
       -t module.appsync.aws_appsync_resolver.list_invites_by_profile \
+      -t module.appsync.aws_appsync_function.inject_global_payment_methods \
+      -t module.appsync.aws_appsync_function.set_owner_account_id_in_stash \
+      -t module.appsync.aws_appsync_function.filter_payment_methods_by_access \
       -- -var="environment=$RUN_ID"
 
     tofu apply -input=false -auto-approve -var="environment=$RUN_ID"

tests/unit/test_ephemeral_deploy_resolver_parity.py

@@ -1,11 +1,46 @@
 """Parity guard: ephemeral-env.sh and deploy-shared.yml keep the same resolver targets."""
 
+import re
 from pathlib import Path
 
 REPO_ROOT = Path(__file__).resolve().parents[2]
-TARGET = "module.appsync.aws_appsync_resolver.public_create_order"
+EPHEMERAL = REPO_ROOT / "scripts" / "ephemeral-env.sh"
+DEPLOY = REPO_ROOT / ".github" / "workflows" / "deploy-shared.yml"
+
+TARGET_RE = re.compile(r"-t\s+(module\.appsync\.(?:aws_appsync_resolver|aws_appsync_function)\.[A-Za-z0-9_]+)")
+
+# The three payment-method functions re-pointed to the shared NoneDataSource when
+# the two per-purpose NONE data sources were consolidated (#750). Without these
+# targets the full apply destroys the still-referenced NONE data sources before
+# re-pointing the functions and AWS refuses every Deploy Production run.
+NONE_DS_FUNCTION_TARGETS = (
+    "module.appsync.aws_appsync_function.inject_global_payment_methods",
+    "module.appsync.aws_appsync_function.set_owner_account_id_in_stash",
+    "module.appsync.aws_appsync_function.filter_payment_methods_by_access",
+)
+
+
+def _targets(path: Path) -> set[str]:
+    return set(TARGET_RE.findall(path.read_text()))
+
+
+def test_target_sets_match() -> None:
+    ephemeral, deploy = _targets(EPHEMERAL), _targets(DEPLOY)
+    assert ephemeral == deploy, (
+        "appsync-ensure-resolver-order.sh target lists diverged: "
+        f"only in scripts/ephemeral-env.sh: {sorted(ephemeral - deploy)}; "
+        f"only in .github/workflows/deploy-shared.yml: {sorted(deploy - ephemeral)}"
+    )
+
+
+def test_none_ds_function_targets_in_both() -> None:
+    ephemeral, deploy = _targets(EPHEMERAL), _targets(DEPLOY)
+    for target in NONE_DS_FUNCTION_TARGETS:
+        assert target in ephemeral
+        assert target in deploy
 
 
 def test_public_create_order_target_in_both() -> None:
-    assert TARGET in (REPO_ROOT / "scripts" / "ephemeral-env.sh").read_text()
-    assert TARGET in (REPO_ROOT / ".github" / "workflows" / "deploy-shared.yml").read_text()
+    target = "module.appsync.aws_appsync_resolver.public_create_order"
+    assert target in _targets(EPHEMERAL)
+    assert target in _targets(DEPLOY)