Skip to content

fix(cli): --require-approval any-change only asks for confirmation on broadening changes#1246

Merged
aws-cdk-automation merged 5 commits intomainfrom
epolon/require-approval-any-change
Mar 23, 2026
Merged

fix(cli): --require-approval any-change only asks for confirmation on broadening changes#1246
aws-cdk-automation merged 5 commits intomainfrom
epolon/require-approval-any-change

Conversation

@iliapolo
Copy link
Contributor

@iliapolo iliapolo commented Mar 23, 2026

Fixes #1236

Problem

The value of --require-approval is not being passed to the CliIoHost, which defaults it to RequireApproval.BROADENING.

Solution

The correct requireApproval value is already being passed to deploy, so we just need to propagate it into the CliIoHost via the setter. This isn't ideal because it prevents concurrent deployments with different requireApproval values, but the CLI can't do that anyway so its not an actual issue.

Checklist

  • This change contains a major version upgrade for a dependency and I confirm all breaking changes are addressed
    • Release notes for the new version:

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

private skipApprovalStep(msg: IoRequest<any, any>): boolean {
const approvalToolkitCodes = ['CDK_TOOLKIT_I5060'];
if (!(msg.code && approvalToolkitCodes.includes(msg.code))) {
false;
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is something the original issue creator mention and indeed seems like a bug. Looks like we are missing some tests here but I'd like to not delay this fix for it.

// the ioHost uses this internally to determine if a confirmation
// is actually needed, so it needs the same value we have here.
// ideally this would threaded into the request instead of it being an instance field.
this.ioHost.requireDeployApproval = requireApproval;
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

See

switch (this.requireDeployApproval) {
// Never require approval
case RequireApproval.NEVER:
return true;
// Always require approval
case RequireApproval.ANYCHANGE:
return false;
// Require approval if changes include broadening permissions
case RequireApproval.BROADENING:
return ['none', 'non-broadening'].includes(msg.data?.permissionChangeType);
}

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this is fine and im approving. but i feel like passing the requireApproval property to the iohost should happen when we define requireApproval on line 428 rather than here.

const requireApproval = options.requireApproval ?? RequireApproval.BROADENING;
this.ioHost.requireDeployApproval = requireApproval;

and then maybe that can be a helper function to make those actions atomic.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Makes sense.

@codecov-commenter
Copy link

codecov-commenter commented Mar 23, 2026

Codecov Report

❌ Patch coverage is 90.00000% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 88.09%. Comparing base (ad90be6) to head (66b49c9).
⚠️ Report is 17 commits behind head on main.

Files with missing lines Patch % Lines
packages/aws-cdk/lib/cli/cdk-toolkit.ts 88.88% 1 Missing ⚠️
Additional details and impacted files
@@            Coverage Diff             @@
##             main    #1246      +/-   ##
==========================================
+ Coverage   87.96%   88.09%   +0.12%     
==========================================
  Files          74       74              
  Lines       10363    10371       +8     
  Branches     1385     1388       +3     
==========================================
+ Hits         9116     9136      +20     
+ Misses       1221     1209      -12     
  Partials       26       26              
Flag Coverage Δ
suite.unit 88.09% <90.00%> (+0.12%) ⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@aws-cdk-automation aws-cdk-automation added this pull request to the merge queue Mar 23, 2026
Merged via the queue into main with commit bb3ff6f Mar 23, 2026
41 checks passed
@aws-cdk-automation aws-cdk-automation deleted the epolon/require-approval-any-change branch March 23, 2026 17:33
github-merge-queue bot pushed a commit that referenced this pull request Mar 24, 2026
Fast follow for #1246. Existing
tests are sufficient.

---
By submitting this pull request, I confirm that my contribution is made
under the terms of the Apache-2.0 license
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

(cli): --require-approval any-change silently skips approval for non-broadening changes

4 participants