Skip to content

Conversation

@rix0rrr
Copy link
Contributor

@rix0rrr rix0rrr commented Dec 4, 2025

In order to support some other performance-related changes, I was planning to split the sets of source files inside aws-cdk-lib into 2 classes:

  • "Library" source files: all .ts files except those in test subdirectories.
  • "Test" source files: files in test subdirectories, consuming the library as a separately compiled subproject.

It turns out this does not work for 2 reasons:

  • stripInternal: true (TypeScript feature): there are some APIs that we strip out of the .d.ts files. If we put a discrete compilation step between the library and the tests, that means that tests can't use @internal APIs either, which we test in a number of cases.
  • --strip-deprecated (jsii feature): there are some legacy @deprecated APIs that we strip out of the .d.ts files as well, and the same applies: we have tests for a number of these that start failing once we separately compile the two source sets.

Instead, we're just absorbing the test suite into a single tsconfig.json for this project again.

The upshot of doing all this is: test files are now being type-checked by tsc and it turns out they had a ton of type errors in them!

In most cases we saw "unused variable" errors, but there were honest to goodness typing mistakes in there, that just happened to execute properly when runing through ts-jest (with type checking ignored).

I'm submitting this as a PR by itself to get those changes out of the way.


By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

In preparation for something else I want to do (compiling the test files
to `.js` again), I'm splitting the source filess inside `aws-cdk-lib`
into 2 classes:

- "Library" source files: all `.ts` files except those in `test`
  subdirectories.
- "Test" source files: files in `test` subdirectories.

In order to make this official, I'm making two `tsconfig.json` files
with project references between them:

- `tsconfig.lib.json`: addresses library source files.
- `tsconfig.tests.json`: addresses test source files, and has a project
  reference to `tsconfig.lib.json`.

Doing this introduces an additional problem: we now have two different
tsconfig files in the same directory, and how does your IDE know which
config to use based on which file you are currently looking at?  Turns
out the VSCode plugin will only look for `tsconfig.json` and nothing
else.

We're therefore also adding the following:

- `tsconfig.json`: addresses *all* source files in the subdirectory.
- `tsconfig.options.json`: all the other files `extend` this. Contains
  the TS compiler options in a single place so that we don't have to
  copy/paste them around.

The upshot of doing all this is: **test files are now being type-checked
by `tsc` and it turns out they had a ton of type errors in them!**

In most cases we saw "unused variable" errors, but there were honest to
goodness typing mistakes in there, that just happened to execute
properly when runing through `ts-jest` (with type checking ignored).

I'm submitting this as a PR by itself to get those changes out of the
way.
@rix0rrr rix0rrr requested a review from a team as a code owner December 4, 2025 11:17
@aws-cdk-automation aws-cdk-automation requested a review from a team December 4, 2025 11:18
@github-actions github-actions bot added the p2 label Dec 4, 2025
@mergify mergify bot added the contribution/core This is a PR that came from AWS. label Dec 4, 2025
@aws-cdk-automation aws-cdk-automation added the pr/needs-maintainer-review This PR needs a review from a Core Team Member label Dec 5, 2025
@github-actions
Copy link
Contributor

github-actions bot commented Dec 9, 2025

TestsPassed ☑️SkippedFailed ❌️
Security Guardian Results1066 ran1015 passed51 failed
TestResult
Security Guardian Results
packages/@aws-cdk-testing/framework-integ/test/aws-dynamodb/test/integ.global-replicas-provisioned.js.snapshot/aws-cdk-dynamodb-global-replicas-provisioned.template.json
iam-no-wildcard-actions.guard❌ failure
packages/@aws-cdk-testing/framework-integ/test/aws-dynamodb/test/integ.global-replicas-provisioned.js.snapshot/awscdkdynamodbglobalreplicasprovisionedawscdkawsdynamodbReplicaProviderEA32CB30.nested.template.json
iam-no-wildcard-actions-inline.guard❌ failure
packages/@aws-cdk-testing/framework-integ/test/aws-dynamodb/test/integ.global.js.snapshot/cdk-dynamodb-global-20191121.template.json
iam-no-wildcard-actions.guard❌ failure
packages/@aws-cdk-testing/framework-integ/test/aws-dynamodb/test/integ.global.js.snapshot/cdkdynamodbglobal20191121awscdkawsdynamodbReplicaProviderB281C954.nested.template.json
iam-no-wildcard-actions-inline.guard❌ failure
packages/@aws-cdk-testing/framework-integ/test/aws-ec2/test/integ.launch-template.js.snapshot/aws-cdk-ec2-lt-metadata-1.template.json
ec2-no-open-security-groups.guard❌ failure
packages/@aws-cdk-testing/framework-integ/test/aws-ec2/test/integ.vpc-flow-logs-kinesis.js.snapshot/FlowLogsTestStack.template.json
iam-no-wildcard-actions-inline.guard❌ failure
kinesis-firehose-encryption-enabled.guard❌ failure
s3-encryption-enabled.guard❌ failure
packages/@aws-cdk-testing/framework-integ/test/aws-elasticloadbalancingv2/test/integ.alb.oidc.js.snapshot/IntegAlbOidc.template.json
ec2-no-open-security-groups.guard❌ failure
iam-no-wildcard-actions-inline.guard❌ failure
packages/@aws-cdk-testing/framework-integ/test/aws-iam/test/integ.condition-with-ref.js.snapshot/test-condition-with-ref.template.json
iam-no-wildcard-actions-inline.guard❌ failure
packages/@aws-cdk-testing/framework-integ/test/aws-lambda-event-sources/test/integ.kinesiswithdlq.js.snapshot/lambda-event-source-kinesis-with-dlq.template.json
iam-no-wildcard-actions-inline.guard❌ failure
kinesis-encryption-enabled.guard❌ failure
sqs-encryption-enabled.guard❌ failure
sqs-no-world-accessible-inline.guard❌ failure
packages/@aws-cdk-testing/framework-integ/test/aws-lambda-event-sources/test/integ.s3-onfailuire-destination.js.snapshot/kinesis-with-s3ofd.template.json
iam-no-wildcard-actions-inline.guard❌ failure
kinesis-encryption-enabled.guard❌ failure
s3-encryption-enabled.guard❌ failure
packages/@aws-cdk-testing/framework-integ/test/aws-lambda-nodejs/test/integ.nodejs.build.images.js.snapshot/cdk-integ-lambda-nodejs-latest.template.json
iam-no-wildcard-actions-inline.guard❌ failure
packages/@aws-cdk-testing/framework-integ/test/aws-rds/test/integ.cluster-snapshot.js.snapshot/cdk-integ-cluster-snapshot.template.json
ec2-no-open-security-groups.guard❌ failure
iam-no-wildcard-actions-inline.guard❌ failure
packages/@aws-cdk-testing/framework-integ/test/aws-route53/test/integ.cross-account-zone-delegation.js.snapshot/child-opt-in-stack-with-assume-role-region.template.json
iam-no-wildcard-actions-inline.guard❌ failure
packages/@aws-cdk-testing/framework-integ/test/aws-route53/test/integ.cross-account-zone-delegation.js.snapshot/child-opt-in-stack.template.json
iam-no-wildcard-actions-inline.guard❌ failure
packages/@aws-cdk-testing/framework-integ/test/aws-route53/test/integ.cross-account-zone-delegation.js.snapshot/child-stack.template.json
iam-no-wildcard-actions-inline.guard❌ failure
packages/@aws-cdk-testing/framework-integ/test/aws-route53/test/integ.cross-account-zone-delegation.js.snapshot/parent-stack.template.json
codepipeline-cross-account-role-trust-scope.guard❌ failure
guardhooks-no-root-principals-except-kms-secrets.guard❌ failure
iam-no-wildcard-actions-inline.guard❌ failure
iam-role-no-broad-principals.guard❌ failure
packages/@aws-cdk-testing/framework-integ/test/aws-route53/test/integ.rename-cross-account-zone-delegation.js.snapshot/child-stack.template.json
iam-no-wildcard-actions-inline.guard❌ failure
packages/@aws-cdk-testing/framework-integ/test/aws-s3/test/integ.bucket-auto-delete-objects.js.snapshot/cdk-s3-bucket-auto-delete-objects.template.json
iam-no-wildcard-actions-inline.guard❌ failure
s3-encryption-enabled.guard❌ failure
packages/@aws-cdk-testing/framework-integ/test/aws-sns-subscriptions/test/integ.sns-lambda.js.snapshot/aws-cdk-sns-lambda.template.json
iam-no-wildcard-actions-inline.guard❌ failure
sns-encryption-enabled.guard❌ failure
sns-no-world-accessible-inline.guard❌ failure
sqs-encryption-enabled.guard❌ failure
sqs-no-world-accessible-inline.guard❌ failure
packages/@aws-cdk-testing/framework-integ/test/custom-resources/test/provider-framework/integ.provider-with-waiter-state-machine-custom-role.js.snapshot/integ-provider-with-waiter-state-machine-custom-role.template.json
iam-no-wildcard-actions-inline.guard❌ failure
packages/@aws-cdk-testing/framework-integ/test/custom-resources/test/provider-framework/integ.provider-with-waiter-state-machine.js.snapshot/integ-provider-with-waiter-state-machine.template.json
ec2-no-open-security-groups.guard❌ failure
iam-no-wildcard-actions-inline.guard❌ failure
packages/@aws-cdk-testing/framework-integ/test/custom-resources/test/provider-framework/integ.provider.js.snapshot/integ-provider-framework.template.json
iam-no-wildcard-actions-inline.guard❌ failure
s3-encryption-enabled.guard❌ failure
packages/@aws-cdk-testing/framework-integ/test/lambda-layer-awscli/test/integ.awscli-layer.js.snapshot/lambda-layer-awscli-integ-stack.template.json
iam-no-wildcard-actions-inline.guard❌ failure
packages/@aws-cdk-testing/framework-integ/test/lambda-layer-kubectl/test/integ.kubectl-layer.js.snapshot/lambda-layer-kubectl-integ-stack.template.json
iam-no-wildcard-actions-inline.guard❌ failure
packages/@aws-cdk-testing/framework-integ/test/pipelines/test/integ.pipeline-with-variables.js.snapshot/VariablePipelineStack.template.json
iam-no-wildcard-actions-inline.guard❌ failure
s3-encryption-enabled.guard❌ failure
packages/@aws-cdk-testing/framework-integ/test/triggers/test/integ.triggers.js.snapshot/MyStack.template.json
iam-no-wildcard-actions-inline.guard❌ failure
sns-encryption-enabled.guard❌ failure
sns-no-world-accessible-inline.guard❌ failure
sqs-encryption-enabled.guard❌ failure
sqs-no-world-accessible-inline.guard❌ failure
packages/@aws-cdk-testing/framework-integ/test/triggers/test/integ.triggers.js.snapshot/TriggerTestDefaultTestDeployAssert61636546.template.json
iam-no-wildcard-actions-inline.guard❌ failure

@github-actions
Copy link
Contributor

github-actions bot commented Dec 9, 2025

TestsPassed ☑️SkippedFailed ❌️
Security Guardian Results with resolved templates1066 ran1013 passed53 failed
TestResult
Security Guardian Results with resolved templates
packages/@aws-cdk-testing/framework-integ/test/aws-dynamodb/test/integ.global-replicas-provisioned.js.snapshot/aws-cdk-dynamodb-global-replicas-provisioned.template.json
iam-no-wildcard-actions.guard❌ failure
packages/@aws-cdk-testing/framework-integ/test/aws-dynamodb/test/integ.global-replicas-provisioned.js.snapshot/awscdkdynamodbglobalreplicasprovisionedawscdkawsdynamodbReplicaProviderEA32CB30.nested.template.json
iam-no-wildcard-actions-inline.guard❌ failure
packages/@aws-cdk-testing/framework-integ/test/aws-dynamodb/test/integ.global.js.snapshot/cdk-dynamodb-global-20191121.template.json
iam-no-wildcard-actions.guard❌ failure
packages/@aws-cdk-testing/framework-integ/test/aws-dynamodb/test/integ.global.js.snapshot/cdkdynamodbglobal20191121awscdkawsdynamodbReplicaProviderB281C954.nested.template.json
iam-no-wildcard-actions-inline.guard❌ failure
packages/@aws-cdk-testing/framework-integ/test/aws-ec2/test/integ.launch-template.js.snapshot/aws-cdk-ec2-lt-metadata-1.template.json
ec2-no-open-security-groups.guard❌ failure
packages/@aws-cdk-testing/framework-integ/test/aws-ec2/test/integ.vpc-flow-logs-kinesis.js.snapshot/FlowLogsTestStack.template.json
iam-no-wildcard-actions-inline.guard❌ failure
kinesis-firehose-encryption-enabled.guard❌ failure
s3-encryption-enabled.guard❌ failure
packages/@aws-cdk-testing/framework-integ/test/aws-elasticloadbalancingv2/test/integ.alb.oidc.js.snapshot/IntegAlbOidc.template.json
ec2-no-open-security-groups.guard❌ failure
iam-no-wildcard-actions-inline.guard❌ failure
packages/@aws-cdk-testing/framework-integ/test/aws-iam/test/integ.condition-with-ref.js.snapshot/test-condition-with-ref.template.json
guardhooks-no-root-principals-except-kms-secrets.guard❌ failure
iam-no-wildcard-actions-inline.guard❌ failure
iam-role-no-broad-principals.guard❌ failure
packages/@aws-cdk-testing/framework-integ/test/aws-lambda-event-sources/test/integ.kinesiswithdlq.js.snapshot/lambda-event-source-kinesis-with-dlq.template.json
iam-no-wildcard-actions-inline.guard❌ failure
kinesis-encryption-enabled.guard❌ failure
sqs-encryption-enabled.guard❌ failure
sqs-no-world-accessible-inline.guard❌ failure
packages/@aws-cdk-testing/framework-integ/test/aws-lambda-event-sources/test/integ.s3-onfailuire-destination.js.snapshot/kinesis-with-s3ofd.template.json
iam-no-wildcard-actions-inline.guard❌ failure
kinesis-encryption-enabled.guard❌ failure
s3-encryption-enabled.guard❌ failure
packages/@aws-cdk-testing/framework-integ/test/aws-lambda-nodejs/test/integ.nodejs.build.images.js.snapshot/cdk-integ-lambda-nodejs-latest.template.json
iam-no-wildcard-actions-inline.guard❌ failure
packages/@aws-cdk-testing/framework-integ/test/aws-rds/test/integ.cluster-snapshot.js.snapshot/cdk-integ-cluster-snapshot.template.json
ec2-no-open-security-groups.guard❌ failure
iam-no-wildcard-actions-inline.guard❌ failure
packages/@aws-cdk-testing/framework-integ/test/aws-route53/test/integ.cross-account-zone-delegation.js.snapshot/child-opt-in-stack-with-assume-role-region.template.json
iam-no-wildcard-actions-inline.guard❌ failure
packages/@aws-cdk-testing/framework-integ/test/aws-route53/test/integ.cross-account-zone-delegation.js.snapshot/child-opt-in-stack.template.json
iam-no-wildcard-actions-inline.guard❌ failure
packages/@aws-cdk-testing/framework-integ/test/aws-route53/test/integ.cross-account-zone-delegation.js.snapshot/child-stack.template.json
iam-no-wildcard-actions-inline.guard❌ failure
packages/@aws-cdk-testing/framework-integ/test/aws-route53/test/integ.cross-account-zone-delegation.js.snapshot/parent-stack.template.json
codepipeline-cross-account-role-trust-scope.guard❌ failure
guardhooks-no-root-principals-except-kms-secrets.guard❌ failure
iam-no-wildcard-actions-inline.guard❌ failure
iam-role-no-broad-principals.guard❌ failure
packages/@aws-cdk-testing/framework-integ/test/aws-route53/test/integ.rename-cross-account-zone-delegation.js.snapshot/child-stack.template.json
iam-no-wildcard-actions-inline.guard❌ failure
packages/@aws-cdk-testing/framework-integ/test/aws-s3/test/integ.bucket-auto-delete-objects.js.snapshot/cdk-s3-bucket-auto-delete-objects.template.json
iam-no-wildcard-actions-inline.guard❌ failure
s3-encryption-enabled.guard❌ failure
packages/@aws-cdk-testing/framework-integ/test/aws-sns-subscriptions/test/integ.sns-lambda.js.snapshot/aws-cdk-sns-lambda.template.json
iam-no-wildcard-actions-inline.guard❌ failure
sns-encryption-enabled.guard❌ failure
sns-no-world-accessible-inline.guard❌ failure
sqs-encryption-enabled.guard❌ failure
sqs-no-world-accessible-inline.guard❌ failure
packages/@aws-cdk-testing/framework-integ/test/custom-resources/test/provider-framework/integ.provider-with-waiter-state-machine-custom-role.js.snapshot/integ-provider-with-waiter-state-machine-custom-role.template.json
iam-no-wildcard-actions-inline.guard❌ failure
packages/@aws-cdk-testing/framework-integ/test/custom-resources/test/provider-framework/integ.provider-with-waiter-state-machine.js.snapshot/integ-provider-with-waiter-state-machine.template.json
ec2-no-open-security-groups.guard❌ failure
iam-no-wildcard-actions-inline.guard❌ failure
packages/@aws-cdk-testing/framework-integ/test/custom-resources/test/provider-framework/integ.provider.js.snapshot/integ-provider-framework.template.json
iam-no-wildcard-actions-inline.guard❌ failure
s3-encryption-enabled.guard❌ failure
packages/@aws-cdk-testing/framework-integ/test/lambda-layer-awscli/test/integ.awscli-layer.js.snapshot/lambda-layer-awscli-integ-stack.template.json
iam-no-wildcard-actions-inline.guard❌ failure
packages/@aws-cdk-testing/framework-integ/test/lambda-layer-kubectl/test/integ.kubectl-layer.js.snapshot/lambda-layer-kubectl-integ-stack.template.json
iam-no-wildcard-actions-inline.guard❌ failure
packages/@aws-cdk-testing/framework-integ/test/pipelines/test/integ.pipeline-with-variables.js.snapshot/VariablePipelineStack.template.json
iam-no-wildcard-actions-inline.guard❌ failure
s3-encryption-enabled.guard❌ failure
packages/@aws-cdk-testing/framework-integ/test/triggers/test/integ.triggers.js.snapshot/MyStack.template.json
iam-no-wildcard-actions-inline.guard❌ failure
sns-encryption-enabled.guard❌ failure
sns-no-world-accessible-inline.guard❌ failure
sqs-encryption-enabled.guard❌ failure
sqs-no-world-accessible-inline.guard❌ failure
packages/@aws-cdk-testing/framework-integ/test/triggers/test/integ.triggers.js.snapshot/TriggerTestDefaultTestDeployAssert61636546.template.json
iam-no-wildcard-actions-inline.guard❌ failure

Comment on lines 557 to 563
"aws-devopsagent": {
"scopes": [
{
"namespace": "AWS::DevOpsAgent"
}
]
},
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Unexpected

Copy link
Contributor

@mrgrain mrgrain left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

see comments

@rix0rrr rix0rrr added the pr/needs-integration-tests-deployment Requires the PR to deploy the integration test snapshots. label Dec 10, 2025
@rix0rrr rix0rrr had a problem deploying to deployment-integ-test December 10, 2025 13:43 — with GitHub Actions Error
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

contribution/core This is a PR that came from AWS. p2 pr/needs-integration-tests-deployment Requires the PR to deploy the integration test snapshots. pr/needs-maintainer-review This PR needs a review from a Core Team Member

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants