Merge remote-tracking branch 'origin/main' into maxDeliverySeconds

.github/workflows/codecov.yml

@@ -0,0 +1,35 @@
+name: Codecov
+
+on:
+  push:
+    branches: [ "main" ]
+  pull_request:
+    branches: [ "main" ]
+
+jobs:
+  collect:
+    name: collect
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Node
+        uses: actions/setup-node@v4
+
+      - name: Install dependencies
+        run: cd packages/aws-cdk && yarn install
+
+      - name: Build CLI
+        run: cd packages/aws-cdk && npx lerna run build --scope=aws-cdk
+
+      - name: Run tests
+        run: cd packages/aws-cdk && yarn test
+
+      - name: Upload results to Codecov
+        uses: codecov/codecov-action@v4
+        with:
+          directory: packages/aws-cdk/coverage
+          fail_ci_if_error: true
+          flags: suite.unit
+          token: ${{ secrets.CODECOV_TOKEN }}

.mergify.yml

@@ -15,6 +15,10 @@ queue_rules:
       - "#changes-requested-reviews-by=0"
       - status-success~=AWS CodeBuild us-east-1
       - status-success=validate-pr
+      - status-success=codecov/patch
+      - status-success=codecov/patch/packages/aws-cdk
+      - status-success=codecov/project
+      - status-success=codecov/project/packages/aws-cdk      
     commit_message_template: |-
       {{ title }} (#{{ number }})
       {{ body }}
@@ -33,6 +37,10 @@ queue_rules:
       - "#changes-requested-reviews-by=0"
       - status-success~=AWS CodeBuild us-east-1
       - status-success=validate-pr
+      - status-success=codecov/patch
+      - status-success=codecov/patch/packages/aws-cdk
+      - status-success=codecov/project
+      - status-success=codecov/project/packages/aws-cdk      
     commit_message_template: |-
       {{ title }} (#{{ number }})
       {{ body }}
@@ -64,6 +72,10 @@ pull_request_rules:
       - "#changes-requested-reviews-by=0"
       - status-success~=AWS CodeBuild us-east-1
       - status-success=validate-pr
+      - status-success=codecov/patch
+      - status-success=codecov/patch/packages/aws-cdk
+      - status-success=codecov/project
+      - status-success=codecov/project/packages/aws-cdk      
   - name: automatic merge (2+ approvers)
     actions:
       comment:
@@ -84,6 +96,10 @@ pull_request_rules:
       - "#changes-requested-reviews-by=0"
       - status-success~=AWS CodeBuild us-east-1
       - status-success=validate-pr
+      - status-success=codecov/patch
+      - status-success=codecov/patch/packages/aws-cdk
+      - status-success=codecov/project
+      - status-success=codecov/project/packages/aws-cdk      
   - name: automatic merge (no-squash)
     actions:
       comment:
@@ -104,6 +120,10 @@ pull_request_rules:
       - "#changes-requested-reviews-by=0"
       - status-success~=AWS CodeBuild us-east-1
       - status-success=validate-pr
+      - status-success=codecov/patch
+      - status-success=codecov/patch/packages/aws-cdk
+      - status-success=codecov/project
+      - status-success=codecov/project/packages/aws-cdk      
   - name: remove stale reviews
     actions:
       dismiss_reviews:
@@ -143,3 +163,7 @@ pull_request_rules:
       - "#changes-requested-reviews-by=0"
       - status-success~=AWS CodeBuild us-east-1
       - status-success=validate-pr
+      - status-success=codecov/patch
+      - status-success=codecov/patch/packages/aws-cdk
+      - status-success=codecov/project
+      - status-success=codecov/project/packages/aws-cdk      

CHANGELOG.v2.alpha.md

@@ -2,6 +2,22 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
+## [2.166.0-alpha.0](https://github.com/aws/aws-cdk/compare/v2.165.0-alpha.0...v2.166.0-alpha.0) (2024-11-06)
+
+
+### ⚠ BREAKING CHANGES TO EXPERIMENTAL FEATURES
+
+* **scheduler-targets-alpha:** Schedule Target will reuse role if target is re-used across schedules. This change triggered replacement of existing roles for Schedule as logical ID of the roles are changed.
+
+### Features
+
+* **glue-alpha:** add job run queuing to Glue job ([#31830](https://github.com/aws/aws-cdk/issues/31830)) ([5fca268](https://github.com/aws/aws-cdk/commit/5fca268e455c1ae7c424a4dec01c0c08bec3c16c)), closes [#31826](https://github.com/aws/aws-cdk/issues/31826)
+
+
+### Bug Fixes
+
+* **scheduler-targets-alpha:** create a role per target instead of singleton schedule target role ([#31895](https://github.com/aws/aws-cdk/issues/31895)) ([aee1b30](https://github.com/aws/aws-cdk/commit/aee1b30adabebe1712720d0d7d27ed4704ac9719)), closes [#31785](https://github.com/aws/aws-cdk/issues/31785)
+
 ## [2.165.0-alpha.0](https://github.com/aws/aws-cdk/compare/v2.164.1-alpha.0...v2.165.0-alpha.0) (2024-10-31)
 
 

CHANGELOG.v2.md

@@ -2,6 +2,27 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
+## [2.166.0](https://github.com/aws/aws-cdk/compare/v2.165.0...v2.166.0) (2024-11-06)
+
+
+### Features
+
+* **cli:** automatically roll back stacks if necessary ([#31920](https://github.com/aws/aws-cdk/issues/31920)) ([2f9fb1e](https://github.com/aws/aws-cdk/commit/2f9fb1e050331efbbe84bb0d5943ff7798cbf3fe)), closes [#30546](https://github.com/aws/aws-cdk/issues/30546)
+* **kinesis:** support resource policy for a data stream ([#31909](https://github.com/aws/aws-cdk/issues/31909)) ([18fbd6d](https://github.com/aws/aws-cdk/commit/18fbd6d5a1a3069b0fc1356d87e534a75239e668)), closes [#28814](https://github.com/aws/aws-cdk/issues/28814)
+* **rds:** configure `autoMinorVersionUpgrade` for a database cluster ([#31962](https://github.com/aws/aws-cdk/issues/31962)) ([0fb6106](https://github.com/aws/aws-cdk/commit/0fb610678495deb150fad1adebde259fc5fc0993))
+* **route53:** support HTTPS, SSHFP, SVCB, and TLSA DNS resource record ([#31955](https://github.com/aws/aws-cdk/issues/31955)) ([afc2b0d](https://github.com/aws/aws-cdk/commit/afc2b0d1d1d620e6350e96cc464428485fca198e)), closes [/docs.aws.amazon.com/ja_jp/AWSCloudFormation/latest/UserGuide/aws-resource-route53-recordset.html#cfn-route53](https://github.com/aws//docs.aws.amazon.com/ja_jp/AWSCloudFormation/latest/UserGuide/aws-resource-route53-recordset.html/issues/cfn-route53)
+* **synthetics:** add `artifactS3Encryption` property to the Canary Construct. ([#30197](https://github.com/aws/aws-cdk/issues/30197)) ([1f39cb9](https://github.com/aws/aws-cdk/commit/1f39cb9e0770b5c02302b9b36ac874ee6bf53329)), closes [#30190](https://github.com/aws/aws-cdk/issues/30190)
+* update L1 CloudFormation resource definitions ([#32007](https://github.com/aws/aws-cdk/issues/32007)) ([be6a964](https://github.com/aws/aws-cdk/commit/be6a964ec17f22a065aa64511f7d3d31341d0ba5))
+
+
+### Bug Fixes
+
+* deploy-time stack tags cause synthesis to fail ([#32041](https://github.com/aws/aws-cdk/issues/32041)) ([18c19fd](https://github.com/aws/aws-cdk/commit/18c19fd49f2b83fee3d1cdb7de8b53ea310729b4)), closes [#32040](https://github.com/aws/aws-cdk/issues/32040)
+* **aws_route53:** cannot use CfnParameter.valueAsNumber for L2 RecordSet weight ([#31823](https://github.com/aws/aws-cdk/issues/31823)) ([14561ac](https://github.com/aws/aws-cdk/commit/14561aca0ad9c0d5eef29729dbc97fc3ccd4d171)), closes [#31810](https://github.com/aws/aws-cdk/issues/31810)
+* **cli:** asset uploads fail if Object Lock is enabled on access bucket ([#31937](https://github.com/aws/aws-cdk/issues/31937)) ([ab1e91d](https://github.com/aws/aws-cdk/commit/ab1e91d11ec2d3abc1edad318b7ea67ff91c9a88))
+* **dynamoDB:** make TableV2 taggable ([#31867](https://github.com/aws/aws-cdk/issues/31867)) ([796c6d1](https://github.com/aws/aws-cdk/commit/796c6d170a91d9f5fa96f3915a6fb6a7f7bddff3)), closes [#30631](https://github.com/aws/aws-cdk/issues/30631)
+* **opensearch:** add I4G to list of OpenSearch nodes not requiring EBS volumes ([#31948](https://github.com/aws/aws-cdk/issues/31948)) ([73378f2](https://github.com/aws/aws-cdk/commit/73378f288e8c422228fbd145d9d41efcb3605857))
+
 ## [2.165.0](https://github.com/aws/aws-cdk/compare/v2.164.1...v2.165.0) (2024-10-31)
 
 

CONTRIBUTING.md

@@ -764,6 +764,40 @@ You can find the dependabot config file [here](./.github/dependabot.yml).
 **If you think your PR introduces a new unconventional dependency, make sure to call it
 out in the description so that we can discuss the best way to manage that dependency.**
 
+### Addressing Code Coverage Gaps
+
+We leverage [Codecov](https://about.codecov.io/) to track code coverage of the project.
+If your PR doesn't meet the coverage requirements, you'll see failing status checks, which will prevent the PR from merging.
+
+There are two requirements we define, each are enforced both on the overall 
+project as well as individual packages.
+
+1. Coverage percentage must not decrease.
+2. Patch percentage must be at least 95%.
+
+Following is an example of status checks for a PR that violates both requirements:
+
+![](./images/codecov-violations.png)
+
+To fix and diagnose coverage gaps in your PR, there are two options:
+
+1. Push your changes to the PR and wait for Codecov to comment on the PR.
+2. If you find option 1 too slow, you can open a local coverage report located in `<path-to-package>/coverage/index.html`
+
+> [!NOTE]
+> Coverage percentage in local reports differs slightly from the percentage you'll see on Codecov.
+> This is ok, and is related to how Codecov handles function signatures (probably).
+> Ultimately Codecov is the source of truth, but you can still use local reports to locate uncovered
+> lines and address them.
+
+Even though it should be rare, sometimes specific lines will be hard to cover by tests.
+To disable coverage of specific lines, you can use:
+
+```ts
+/* istanbul ignore next */
+console.log('This cannot be covered')
+```
+
 ### Step 5: Merge
 
 * Make sure your PR builds successfully (we have CodeBuild setup to automatically build all PRs).

codecov.yml

@@ -0,0 +1,32 @@
+# https://docs.codecov.com/docs/codecovyml-reference#coverage
+coverage:
+  status:
+    project:
+      default:
+        # require the overall project coverage to never decrease
+        target: auto
+    patch:
+      default:
+        # require the overall patch coverage to be at least 95%
+        target: 95
+
+
+# https://docs.codecov.com/docs/codecovyml-reference#comment
+comment:
+  layout: "header, diff, flags, components"
+
+# https://docs.codecov.com/docs/codecovyml-reference#component_management
+component_management:
+  default_rules:
+    statuses:
+      # every component will produce its own status check that requires overall coverage doesnt decrease
+      - type: project
+        target: auto
+      # every component will produce its own status check that requires patch coverage of at least 95%
+      - type: patch
+        target: 95
+  individual_components:
+    - component_id: packages_aws_cdk  # identifier that should not be changed
+      name: packages/aws-cdk # display name that can change freely
+      paths:
+        - packages/aws-cdk/**

packages/@aws-cdk-testing/cli-integ/resources/cli-regression-patches/v2.166.0/NOTES.md

@@ -0,0 +1 @@
+The output of this test is changed by the sdk upgrade. The type and content of the error have changed from sdkv2 to sdkv3. We now receive more specific information about the error type.

packages/@aws-cdk-testing/cli-integ/resources/cli-regression-patches/v2.166.0/skip-tests.txt

@@ -0,0 +1,2 @@
+# Skipping test due to the incompatibility in error output between sdkv2 and sdkv3
+hotswap deployment for ecs service detects failed deployment and errors

packages/@aws-cdk-testing/cli-integ/tests/cli-integ-tests/cli.integtest.ts

@@ -2160,11 +2160,12 @@ integTest(
     const functionName = response.Stacks?.[0].Outputs?.[0].OutputValue;
 
     // THEN
-
     // The deployment should not trigger a full deployment, thus the stack's status must remains
     // "CREATE_COMPLETE"
     expect(response.Stacks?.[0].StackStatus).toEqual('CREATE_COMPLETE');
-    expect(deployOutput).toContain(`Lambda Function '${functionName}' hotswapped!`);
+    // The entire string fails locally due to formatting. Making this test less specific
+    expect(deployOutput).toMatch(/hotswapped!/);
+    expect(deployOutput).toContain(functionName);
   }),
 );
 
@@ -2205,7 +2206,9 @@ integTest(
       // The deployment should not trigger a full deployment, thus the stack's status must remains
       // "CREATE_COMPLETE"
       expect(response.Stacks?.[0].StackStatus).toEqual('CREATE_COMPLETE');
-      expect(deployOutput).toContain(`Lambda Function '${functionName}' hotswapped!`);
+      // The entire string fails locally due to formatting. Making this test less specific
+      expect(deployOutput).toMatch(/hotswapped!/);
+      expect(deployOutput).toContain(functionName);
     } finally {
       // Ensure cleanup in reverse order due to use of import/export
       await fixture.cdkDestroy('lambda-hotswap');
@@ -2244,7 +2247,9 @@ integTest(
     // The deployment should not trigger a full deployment, thus the stack's status must remains
     // "CREATE_COMPLETE"
     expect(response.Stacks?.[0].StackStatus).toEqual('CREATE_COMPLETE');
-    expect(deployOutput).toContain(`ECS Service '${serviceName}' hotswapped!`);
+    // The entire string fails locally due to formatting. Making this test less specific
+    expect(deployOutput).toMatch(/hotswapped!/);
+    expect(deployOutput).toContain(serviceName);
   }),
 );
 
@@ -2257,7 +2262,7 @@ integTest(
     });
 
     // WHEN
-    await fixture.cdkDeploy('ecs-hotswap', {
+    const deployOutput = await fixture.cdkDeploy('ecs-hotswap', {
       options: ['--hotswap'],
       modEnv: {
         DYNAMIC_ECS_PROPERTY_VALUE: 'new value',
@@ -2283,14 +2288,15 @@ integTest(
       }),
     );
     expect(describeServicesResponse.services?.[0].deployments).toHaveLength(1); // only one deployment present
+    expect(deployOutput).toMatch(/hotswapped!/);
   }),
 );
 
 integTest(
   'hotswap deployment for ecs service detects failed deployment and errors',
   withExtendedTimeoutFixture(async (fixture) => {
     // GIVEN
-    await fixture.cdkDeploy('ecs-hotswap');
+    await fixture.cdkDeploy('ecs-hotswap', { verbose: true });
 
     // WHEN
     const deployOutput = await fixture.cdkDeploy('ecs-hotswap', {
@@ -2299,10 +2305,11 @@ integTest(
         USE_INVALID_ECS_HOTSWAP_IMAGE: 'true',
       },
       allowErrExit: true,
+      verbose: true,
     });
 
-    const expectedSubstring = 'Resource is not in the state deploymentCompleted';
-
+    // THEN
+    const expectedSubstring = 'Resource is not in the expected state due to waiter status: TIMEOUT';
     expect(deployOutput).toContain(expectedSubstring);
     expect(deployOutput).not.toContain('hotswapped!');
   }),