integ-runner - unclear the correct way of getting past breaking change warning

[daveshepherd]

I have a CDK project that I'm testing with the integ-runner. I have introduced a change that involves destroying some IAM policies, but the integration tests fail with:

Failed: /home/runner/work/project/test/storage-stack/integ.storage-stack.ts
!!! This test contains destructive changes !!!
    Stack: IntegrationTestStorageStack - Resource: crawlerlambdainlinePolicyAddedToExecutionRole0ED894F46 - Impact: WILL_DESTROY
    Stack: IntegrationTestStorageStack - Resource: snspublisherlambdainlinePolicyAddedToExecutionRole0790DF1FF - Impact: WILL_DESTROY
!!! If these destructive changes are necessary, please indicate this on the PR !!!
Error: Some changes were destructive!

I'm not sure how this failure is intended to be resolved.

In the npm package documentation under Update Workflow is re-iterates that destructive change should be indicated on the PR.

This suggests that the test runner is aware of any PRs open for this change, but doesn't tell you what needs to be on the PR for it to know. I also can't find any suggested that the PR is checked in the code base.

I came across this issue 29636 that asks a similar question, but the answer says to call it out in the PR body, but the message doesn't appear to follow a clear pattern and I think it was just suggesting that you might want to flag a breaking change to anyone reviewing a PR with breaking changes in it.

It appears that the solution in that issue was to add allowDestroy to the test - but I don't want to always allow the destruction of IAM policies, only on this particular run - so this doesn't seem to be quite right either? I guess you could add it while the change goes through and then remove the flag afterwards.

I have also tried to bypass the update workflow so that there are no checks for destructive changes using the --disable-update-workflow flag - but this is still flagging up the changes as being destructive and failing my test.

Full output from the test failure:

integ-runner  --language typescript
Verifying integration test snapshots...
  CHANGED    storage-stack/integ.storage-stack 13.057s
      Resources
[-] AWS::IAM::Policy crawlerlambdainlinePolicyAddedToExecutionRole0ED894F46 destroy
[-] AWS::IAM::Policy snspublisherlambdainlinePolicyAddedToExecutionRole0790DF1FF destroy
[+] AWS::IAM::Policy crawlerroleDefaultPolicyD657C666
[~] AWS::Lambda::Function crawlerlambda65FC80E0
 └─ [~] DependsOn
     └─ @@ -1,4 +1,5 @@
        [ ] [
        [ ]   "crawlerrole985C99ED",
        [+]   "crawlerroleDefaultPolicyD657C666",
        [ ]   "crawlerrolecrawlerpolicy8AFFD705"
        [ ] ]
[~] AWS::IAM::Policy snspublisherroleDefaultPolicyE5B88FFE
 └─ [~] PolicyDocument
     └─ [~] .Statement:
         └─ @@ -1,6 +1,14 @@
            [ ] [
            [ ]   {
            [ ]     "Action": [
            [+]       "xray:PutTelemetryRecords",
            [+]       "xray:PutTraceSegments"
            [+]     ],
            [+]     "Effect": "Allow",
            [+]     "Resource": "*"
            [+]   },
            [+]   {
            [+]     "Action": [
            [ ]       "dynamodb:DescribeStream",
            [ ]       "dynamodb:GetRecords",
            [ ]       "dynamodb:GetShardIterator",
Snapshot Results: 
Tests:    1 failed, 1 total
Failed: /home/runner/work/project/test/storage-stack/integ.storage-stack.ts
!!! This test contains destructive changes !!!
    Stack: IntegrationTestStorageStack - Resource: crawlerlambdainlinePolicyAddedToExecutionRole0ED894F46 - Impact: WILL_DESTROY
    Stack: IntegrationTestStorageStack - Resource: snspublisherlambdainlinePolicyAddedToExecutionRole0790DF1FF - Impact: WILL_DESTROY
!!! If these destructive changes are necessary, please indicate this on the PR !!!
Error: Some changes were destructive!
    at main (/home/runner/work/project/node_modules/@aws-cdk/integ-runner/lib/index.js:10271:11)
👾 Task "build » test » integ" failed when executing "integ-runner  --language typescript" (cwd: /home/runner/work/project)
Error: Process completed with exit code 1.

[shawnoster]

+1 to the issue and the truly vague instructions. I'm looking for answers as well and while I can, I'm loathe to open an Enterprise Support ticket around a basic doc update but I may have to if there is no clearly defined path to do this, other than adding in a pragma header.