Repository navigation
Conversation
|
Hi team, on this fix(E3005) PR: the [CI] Test PR workflow run on the current head is still parked waiting for a first-time-contributor approval (action_required). Could a maintainer approve the run so CI can proceed? Thanks. |
|
Hi @kddejong, friendly follow up: the CI runs on this PR are still parked at the first-time-contributor approval gate (action_required), so the checks cannot start until a maintainer approves the run. Could you approve it when you have a moment? Thanks! |
When a resource's Condition provably always evaluates to true, there is no scenario in which the resource does not exist, so E3005 no longer reports that the DependsOn target will not exist when the condition is False. Adds Conditions.is_always_true (SAT-backed, cached) and consults it in Template.is_resource_available before scenario analysis. A genuinely conditional target still reports the False scenario. Fixes aws-cloudformation#4820 Signed-off-by: Varshith Puli <pulivarshit@gmail.com>
88e0775 to
4f9d207
Compare
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #4843 +/- ##
=======================================
Coverage 94.68% 94.68%
=======================================
Files 439 439
Lines 16009 16016 +7
Branches 3109 3111 +2
=======================================
+ Hits 15158 15165 +7
Misses 468 468
Partials 383 383
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
What
E3005 (
DependsOn) reported that a target resource "will not exist when condition 'X' is False" even when condition X provably always evaluates to true. In that case the resource always exists, so there is no scenario in which theDependsOncan fail. This addsConditions.is_always_true, which asks the existing SAT solver whether the condition's negation is unsatisfiable (result cached per condition name), andTemplate.is_resource_availablenow returns no scenarios in that case before running the regular scenario analysis.Why
Resolves the report in #4820. A
DependsOnon a resource with a constant-true condition (a constantFn::Equals, or anFn::Orover constant conditions) always deploys: CloudFormation creates both resources. The finding is a false positive.How
src/cfnlint/conditions/conditions.py: newConditions.is_always_true(condition_name)(lru-cached; returns False for unknown condition names so unresolved names keep the old behavior).src/cfnlint/template/template.py:is_resource_availableconsults it first when the target resource has a string condition.Testing
!Equals [!Ref Env, prod]) still reports E3005 with the False scenario.test/unit/rules/resources/test_dependson.py(2 new cases: constantFn::Equals,Fn::Orof constants) andtest/unit/module/template/test_template.py::test_is_resource_available_always_true_condition(always-true returns[], conditional target still returns the False scenario, unknown condition name keeps prior behavior).test_dependson.py11 passed; conditions module 56 passed; resources rules plus conditions rules plus template module: 1396 passed, 1 pre-existing environment failure intest_build_graph(pygraphviz not installed; fails identically on pristine main).ruff checkandruff formatclean on all touched files.Fixes #4820