While reviewing the fix to bug 15023 we found that metadata reporting ("versionReporting": true) causes cdk deploy to upload metadata even when cdk diff reports no differences and no files have changed. This occurs when the commands are run on different operating systems.

Reproduction Steps

Craft any stable stack that is javascript only (no native code) and ensure all modules versions are explicit. This repo abides by that. Note, versionReporting has been set to false in that repo's cdk.json. It would need to be set to true to see the issue.

# On a macOS
> git clone git@github.com:codeedog/aws-test-hello-world.git
> cd aws-test-hello-world
> node --version && npm --version
> npm ci      # this will also build the subdirectory
> cdk deploy

# On Ubuntu
> git clone git@github.com:codeedog/aws-test-hello-world.git
> cd aws-test-hello-world
> node --version && npm --version
> npm ci      # this will also build the subdirectory
> cdk diff    # Should show no diffs
> cdk deploy  # Will deploy 2 "changes"; metadata only

What did you expect to happen?

I expected there to be no deploy on the second machine due to the lack of any code changes.

What actually happened?

Metadata was collected making it look like there were changes to the Stack that needed to be built.

Environment

• CDK CLI Version : 1.110.0
• Framework Version: 1.110.0
• Node.js Version: v14.17.0 (note: also, npm Version: 7.17.0)
• OS : macOS Catalina 10.15.7 (19H524) & Ubuntu (20.04.2 LTS, on GitHub)
• Language (Version): Typescript (3.9.9 from package-lock.json)

Other

Notes from my comment in the now fixed Bug 15023:

I don't mind turning off metadata to stop this. On the other hand, I'm more than happy to share build results with the AWS CDK team. It seems to me that if there are no differences in a Stack (according to cdk diff), metadata should not be pushed. At least, this should be a configuration option ("versionReporting": "no-deploy-on-no-diffs" | true | false). Pick a better name for it... Anyway, I'd prefer the first be the default, but at least make this available to folks.

When I see the system rebuild despite my knowing no files have changed, I worry something has failed or some merge has or hasn't happened. I suspect others may feel this way, too.

To me this feels like a bug (trigger a deploy when no code changed and all modules are stable). You don't send metadata from the same OS when cdk deploy is called with no differences. Why should you do so when the command is run on a different operating system and still there are no differences?

This is 🐛 Bug Report