test(deps): derive vended agentcore-cdk pin from the template by jariy17 · Pull Request #2117 · aws/agentcore-cli

jariy17 · 2026-08-26T21:17:14Z

TL;DR

The @aws/agentcore-cdk pin was hand-typed in 3 places. This makes the tests read it from the one file that ships it, so a version bump stops being a find-and-replace chore.

Review time: ~5 min. Risk: low — tests only, no runtime src/ change. Motivating commit:ddb32a2 (#2087).

The problem

0.1.0-alpha.49 was duplicated in:

src/assets/cdk/package.json — the real pin (sync.ts treats it as source of truth)
plan.test.ts + sync.test.ts — hand-typed copies

Every prerelease bump had to edit all of them in lockstep. Miss one → red build, or a stale assertion that passes when it shouldn't.

What changed (3 files)

New__tests__/fixtures.ts — exposes CDK_PIN read from the vended template, plus newerPrerelease() for skew tests. Reads via fs (not import) because src/assets is excluded from the TS program — same pattern the snapshot test and sync.ts already use.
plan.test.ts — uses CDK_PIN / derived CDK_PIN_NEWER instead of the literals.
sync.test.ts — uses CDK_PIN for its 5 pin literals.

Older-version fixtures (alpha.19) stay literal on purpose — they mean "much older", never bumped.

Why no new guardrail literal

The asset snapshot already stores the pin as a literal, so any unintended template change still trips a red snapshot test until someone regenerates it. No point duplicating that.

Verified

vitest run --project unit src/lib/dependency-management → 40 passed
npm run typecheck · eslint · prettier --check → clean

Package Tarball

aws-agentcore-0.28.0.tgz

How to install

gh release download pr-2117-tarball --repo aws/agentcore-cli --pattern "*.tgz" --dir /tmp/pr-tarball
npm install -g /tmp/pr-tarball/aws-agentcore-0.28.0.tgz

agentcore-devx-automation

AgentCore Harness Review

Verdict: Looks good

This is a focused test refactor that removes duplicated hardcoded @aws/agentcore-cdk version strings by sourcing CDK_PIN from the vended src/assets/cdk/package.json (the actual source of truth) and deriving a strictly-newer prerelease for skew tests via newerPrerelease. The substitutions in plan.test.ts and sync.test.ts are 1:1 replacements of the previous literals (0.1.0-alpha.49 and 0.1.0-alpha.51), so behavior is preserved while future template bumps no longer require editing multiple test files.

A few observations, none blocking:

readFileSync in fixtures.ts runs at module load. Since vitest discovers only *.test.ts, fixtures.ts won't be picked up as a suite, and path.resolve(__dirname, '../../../assets/cdk/package.json') correctly points at src/assets/cdk/package.json from src/lib/dependency-management/__tests__/. The comment about src/assets being excluded from the TS program matches tsconfig.json.
newerPrerelease will throw if the CDK pin ever moves off a -alpha.N prerelease. That's an intentional fail-fast, but worth remembering as the vended package approaches a stable release — the fixture will need updating at that point.
The "upgrades an older exact-pinned prerelease" test still hardcodes 0.1.0-alpha.19 as the "older" version. That's fine as long as the pin never drops below alpha.20, which is a safe assumption.

No changes required. LGTM.

The @aws/agentcore-cdk pin lived as a hand-typed literal in plan.test.ts and sync.test.ts as well as in src/assets/cdk/package.json, so every prerelease bump (e.g. #2087, alpha.48 -> alpha.49) had to edit the same string in all of them. Read the pin from the vended template instead via a shared fixture, and derive the skew-test's 'newer' example from it, so bumping the template no longer touches these tests. The asset snapshot remains the literal guardrail that trips on any unintended pin change.

agentcore-devx-automation · 2026-08-26T21:24:46Z

Claude Security Review: no high-confidence findings. (run)

github-actions · 2026-08-26T21:30:58Z

Coverage Report

Status	Category	Percentage	Covered / Total
🔵	Lines	40.99%	15453 / 37694
🔵	Statements	40.24%	16473 / 40935
🔵	Functions	35.15%	2644 / 7522
🔵	Branches	34.18%	10311 / 30161

Generated in workflow #4421 for commit 85a851e by the Vitest Coverage Report Action

jariy17 · 2026-08-26T21:17:14Z

TL;DR

The @aws/agentcore-cdk pin was hand-typed in 3 places. This makes the tests read it from the one file that ships it, so a version bump stops being a find-and-replace chore.

Review time: ~5 min. Risk: low — tests only, no runtime src/ change. Motivating commit:ddb32a2 (#2087).

The problem

0.1.0-alpha.49 was duplicated in:

src/assets/cdk/package.json — the real pin (sync.ts treats it as source of truth)
plan.test.ts + sync.test.ts — hand-typed copies

Every prerelease bump had to edit all of them in lockstep. Miss one → red build, or a stale assertion that passes when it shouldn't.

What changed (3 files)

New__tests__/fixtures.ts — exposes CDK_PIN read from the vended template, plus newerPrerelease() for skew tests. Reads via fs (not import) because src/assets is excluded from the TS program — same pattern the snapshot test and sync.ts already use.
plan.test.ts — uses CDK_PIN / derived CDK_PIN_NEWER instead of the literals.
sync.test.ts — uses CDK_PIN for its 5 pin literals.

Older-version fixtures (alpha.19) stay literal on purpose — they mean "much older", never bumped.

Why no new guardrail literal

The asset snapshot already stores the pin as a literal, so any unintended template change still trips a red snapshot test until someone regenerates it. No point duplicating that.

Verified

vitest run --project unit src/lib/dependency-management → 40 passed
npm run typecheck · eslint · prettier --check → clean

Package Tarball

aws-agentcore-0.28.0.tgz

How to install

gh release download pr-2117-tarball --repo aws/agentcore-cli --pattern "*.tgz" --dir /tmp/pr-tarball
npm install -g /tmp/pr-tarball/aws-agentcore-0.28.0.tgz

agentcore-devx-automation

AgentCore Harness Review

Verdict: Looks good

This is a focused test refactor that removes duplicated hardcoded @aws/agentcore-cdk version strings by sourcing CDK_PIN from the vended src/assets/cdk/package.json (the actual source of truth) and deriving a strictly-newer prerelease for skew tests via newerPrerelease. The substitutions in plan.test.ts and sync.test.ts are 1:1 replacements of the previous literals (0.1.0-alpha.49 and 0.1.0-alpha.51), so behavior is preserved while future template bumps no longer require editing multiple test files.

A few observations, none blocking:

readFileSync in fixtures.ts runs at module load. Since vitest discovers only *.test.ts, fixtures.ts won't be picked up as a suite, and path.resolve(__dirname, '../../../assets/cdk/package.json') correctly points at src/assets/cdk/package.json from src/lib/dependency-management/__tests__/. The comment about src/assets being excluded from the TS program matches tsconfig.json.
newerPrerelease will throw if the CDK pin ever moves off a -alpha.N prerelease. That's an intentional fail-fast, but worth remembering as the vended package approaches a stable release — the fixture will need updating at that point.
The "upgrades an older exact-pinned prerelease" test still hardcodes 0.1.0-alpha.19 as the "older" version. That's fine as long as the pin never drops below alpha.20, which is a safe assumption.

No changes required. LGTM.

The @aws/agentcore-cdk pin lived as a hand-typed literal in plan.test.ts and sync.test.ts as well as in src/assets/cdk/package.json, so every prerelease bump (e.g. #2087, alpha.48 -> alpha.49) had to edit the same string in all of them. Read the pin from the vended template instead via a shared fixture, and derive the skew-test's 'newer' example from it, so bumping the template no longer touches these tests. The asset snapshot remains the literal guardrail that trips on any unintended pin change.

agentcore-devx-automation · 2026-08-26T21:24:46Z

Claude Security Review: no high-confidence findings. (run)

github-actions · 2026-08-26T21:30:58Z

Coverage Report

Status	Category	Percentage	Covered / Total
🔵	Lines	40.99%	15453 / 37694
🔵	Statements	40.24%	16473 / 40935
🔵	Functions	35.15%	2644 / 7522
🔵	Branches	34.18%	10311 / 30161

Generated in workflow #4421 for commit 85a851e by the Vitest Coverage Report Action

jariy17 · 2026-08-26T21:17:14Z

TL;DR

The @aws/agentcore-cdk pin was hand-typed in 3 places. This makes the tests read it from the one file that ships it, so a version bump stops being a find-and-replace chore.

Review time: ~5 min. Risk: low — tests only, no runtime src/ change. Motivating commit:ddb32a2 (#2087).

The problem

0.1.0-alpha.49 was duplicated in:

src/assets/cdk/package.json — the real pin (sync.ts treats it as source of truth)
plan.test.ts + sync.test.ts — hand-typed copies

Every prerelease bump had to edit all of them in lockstep. Miss one → red build, or a stale assertion that passes when it shouldn't.

What changed (3 files)

New__tests__/fixtures.ts — exposes CDK_PIN read from the vended template, plus newerPrerelease() for skew tests. Reads via fs (not import) because src/assets is excluded from the TS program — same pattern the snapshot test and sync.ts already use.
plan.test.ts — uses CDK_PIN / derived CDK_PIN_NEWER instead of the literals.
sync.test.ts — uses CDK_PIN for its 5 pin literals.

Older-version fixtures (alpha.19) stay literal on purpose — they mean "much older", never bumped.

Why no new guardrail literal

The asset snapshot already stores the pin as a literal, so any unintended template change still trips a red snapshot test until someone regenerates it. No point duplicating that.

Verified

vitest run --project unit src/lib/dependency-management → 40 passed
npm run typecheck · eslint · prettier --check → clean

Package Tarball

aws-agentcore-0.28.0.tgz

How to install

gh release download pr-2117-tarball --repo aws/agentcore-cli --pattern "*.tgz" --dir /tmp/pr-tarball
npm install -g /tmp/pr-tarball/aws-agentcore-0.28.0.tgz

agentcore-devx-automation

AgentCore Harness Review

Verdict: Looks good

This is a focused test refactor that removes duplicated hardcoded @aws/agentcore-cdk version strings by sourcing CDK_PIN from the vended src/assets/cdk/package.json (the actual source of truth) and deriving a strictly-newer prerelease for skew tests via newerPrerelease. The substitutions in plan.test.ts and sync.test.ts are 1:1 replacements of the previous literals (0.1.0-alpha.49 and 0.1.0-alpha.51), so behavior is preserved while future template bumps no longer require editing multiple test files.

A few observations, none blocking:

readFileSync in fixtures.ts runs at module load. Since vitest discovers only *.test.ts, fixtures.ts won't be picked up as a suite, and path.resolve(__dirname, '../../../assets/cdk/package.json') correctly points at src/assets/cdk/package.json from src/lib/dependency-management/__tests__/. The comment about src/assets being excluded from the TS program matches tsconfig.json.
newerPrerelease will throw if the CDK pin ever moves off a -alpha.N prerelease. That's an intentional fail-fast, but worth remembering as the vended package approaches a stable release — the fixture will need updating at that point.
The "upgrades an older exact-pinned prerelease" test still hardcodes 0.1.0-alpha.19 as the "older" version. That's fine as long as the pin never drops below alpha.20, which is a safe assumption.

No changes required. LGTM.

The @aws/agentcore-cdk pin lived as a hand-typed literal in plan.test.ts and sync.test.ts as well as in src/assets/cdk/package.json, so every prerelease bump (e.g. #2087, alpha.48 -> alpha.49) had to edit the same string in all of them. Read the pin from the vended template instead via a shared fixture, and derive the skew-test's 'newer' example from it, so bumping the template no longer touches these tests. The asset snapshot remains the literal guardrail that trips on any unintended pin change.

agentcore-devx-automation · 2026-08-26T21:24:46Z

Claude Security Review: no high-confidence findings. (run)

github-actions · 2026-08-26T21:30:58Z

Coverage Report

Status	Category	Percentage	Covered / Total
🔵	Lines	40.99%	15453 / 37694
🔵	Statements	40.24%	16473 / 40935
🔵	Functions	35.15%	2644 / 7522
🔵	Branches	34.18%	10311 / 30161

Generated in workflow #4421 for commit 85a851e by the Vitest Coverage Report Action

jariy17 · 2026-08-26T21:17:14Z

TL;DR

The @aws/agentcore-cdk pin was hand-typed in 3 places. This makes the tests read it from the one file that ships it, so a version bump stops being a find-and-replace chore.

Review time: ~5 min. Risk: low — tests only, no runtime src/ change. Motivating commit:ddb32a2 (#2087).

The problem

0.1.0-alpha.49 was duplicated in:

src/assets/cdk/package.json — the real pin (sync.ts treats it as source of truth)
plan.test.ts + sync.test.ts — hand-typed copies

Every prerelease bump had to edit all of them in lockstep. Miss one → red build, or a stale assertion that passes when it shouldn't.

What changed (3 files)

New__tests__/fixtures.ts — exposes CDK_PIN read from the vended template, plus newerPrerelease() for skew tests. Reads via fs (not import) because src/assets is excluded from the TS program — same pattern the snapshot test and sync.ts already use.
plan.test.ts — uses CDK_PIN / derived CDK_PIN_NEWER instead of the literals.
sync.test.ts — uses CDK_PIN for its 5 pin literals.

Older-version fixtures (alpha.19) stay literal on purpose — they mean "much older", never bumped.

Why no new guardrail literal

The asset snapshot already stores the pin as a literal, so any unintended template change still trips a red snapshot test until someone regenerates it. No point duplicating that.

Verified

vitest run --project unit src/lib/dependency-management → 40 passed
npm run typecheck · eslint · prettier --check → clean

Package Tarball

aws-agentcore-0.28.0.tgz

How to install

gh release download pr-2117-tarball --repo aws/agentcore-cli --pattern "*.tgz" --dir /tmp/pr-tarball
npm install -g /tmp/pr-tarball/aws-agentcore-0.28.0.tgz

agentcore-devx-automation

AgentCore Harness Review

Verdict: Looks good

This is a focused test refactor that removes duplicated hardcoded @aws/agentcore-cdk version strings by sourcing CDK_PIN from the vended src/assets/cdk/package.json (the actual source of truth) and deriving a strictly-newer prerelease for skew tests via newerPrerelease. The substitutions in plan.test.ts and sync.test.ts are 1:1 replacements of the previous literals (0.1.0-alpha.49 and 0.1.0-alpha.51), so behavior is preserved while future template bumps no longer require editing multiple test files.

A few observations, none blocking:

readFileSync in fixtures.ts runs at module load. Since vitest discovers only *.test.ts, fixtures.ts won't be picked up as a suite, and path.resolve(__dirname, '../../../assets/cdk/package.json') correctly points at src/assets/cdk/package.json from src/lib/dependency-management/__tests__/. The comment about src/assets being excluded from the TS program matches tsconfig.json.
newerPrerelease will throw if the CDK pin ever moves off a -alpha.N prerelease. That's an intentional fail-fast, but worth remembering as the vended package approaches a stable release — the fixture will need updating at that point.
The "upgrades an older exact-pinned prerelease" test still hardcodes 0.1.0-alpha.19 as the "older" version. That's fine as long as the pin never drops below alpha.20, which is a safe assumption.

No changes required. LGTM.

The @aws/agentcore-cdk pin lived as a hand-typed literal in plan.test.ts and sync.test.ts as well as in src/assets/cdk/package.json, so every prerelease bump (e.g. #2087, alpha.48 -> alpha.49) had to edit the same string in all of them. Read the pin from the vended template instead via a shared fixture, and derive the skew-test's 'newer' example from it, so bumping the template no longer touches these tests. The asset snapshot remains the literal guardrail that trips on any unintended pin change.

agentcore-devx-automation · 2026-08-26T21:24:46Z

Claude Security Review: no high-confidence findings. (run)

github-actions · 2026-08-26T21:30:58Z

Coverage Report

Status	Category	Percentage	Covered / Total
🔵	Lines	40.99%	15453 / 37694
🔵	Statements	40.24%	16473 / 40935
🔵	Functions	35.15%	2644 / 7522
🔵	Branches	34.18%	10311 / 30161

Generated in workflow #4421 for commit 85a851e by the Vitest Coverage Report Action

jariy17 · 2026-08-26T21:17:14Z

TL;DR

The @aws/agentcore-cdk pin was hand-typed in 3 places. This makes the tests read it from the one file that ships it, so a version bump stops being a find-and-replace chore.

Review time: ~5 min. Risk: low — tests only, no runtime src/ change. Motivating commit:ddb32a2 (#2087).

The problem

0.1.0-alpha.49 was duplicated in:

src/assets/cdk/package.json — the real pin (sync.ts treats it as source of truth)
plan.test.ts + sync.test.ts — hand-typed copies

Every prerelease bump had to edit all of them in lockstep. Miss one → red build, or a stale assertion that passes when it shouldn't.

What changed (3 files)

New__tests__/fixtures.ts — exposes CDK_PIN read from the vended template, plus newerPrerelease() for skew tests. Reads via fs (not import) because src/assets is excluded from the TS program — same pattern the snapshot test and sync.ts already use.
plan.test.ts — uses CDK_PIN / derived CDK_PIN_NEWER instead of the literals.
sync.test.ts — uses CDK_PIN for its 5 pin literals.

Older-version fixtures (alpha.19) stay literal on purpose — they mean "much older", never bumped.

Why no new guardrail literal

The asset snapshot already stores the pin as a literal, so any unintended template change still trips a red snapshot test until someone regenerates it. No point duplicating that.

Verified

vitest run --project unit src/lib/dependency-management → 40 passed
npm run typecheck · eslint · prettier --check → clean

Package Tarball

aws-agentcore-0.28.0.tgz

How to install

gh release download pr-2117-tarball --repo aws/agentcore-cli --pattern "*.tgz" --dir /tmp/pr-tarball
npm install -g /tmp/pr-tarball/aws-agentcore-0.28.0.tgz

agentcore-devx-automation

AgentCore Harness Review

Verdict: Looks good

This is a focused test refactor that removes duplicated hardcoded @aws/agentcore-cdk version strings by sourcing CDK_PIN from the vended src/assets/cdk/package.json (the actual source of truth) and deriving a strictly-newer prerelease for skew tests via newerPrerelease. The substitutions in plan.test.ts and sync.test.ts are 1:1 replacements of the previous literals (0.1.0-alpha.49 and 0.1.0-alpha.51), so behavior is preserved while future template bumps no longer require editing multiple test files.

A few observations, none blocking:

readFileSync in fixtures.ts runs at module load. Since vitest discovers only *.test.ts, fixtures.ts won't be picked up as a suite, and path.resolve(__dirname, '../../../assets/cdk/package.json') correctly points at src/assets/cdk/package.json from src/lib/dependency-management/__tests__/. The comment about src/assets being excluded from the TS program matches tsconfig.json.
newerPrerelease will throw if the CDK pin ever moves off a -alpha.N prerelease. That's an intentional fail-fast, but worth remembering as the vended package approaches a stable release — the fixture will need updating at that point.
The "upgrades an older exact-pinned prerelease" test still hardcodes 0.1.0-alpha.19 as the "older" version. That's fine as long as the pin never drops below alpha.20, which is a safe assumption.

No changes required. LGTM.

The @aws/agentcore-cdk pin lived as a hand-typed literal in plan.test.ts and sync.test.ts as well as in src/assets/cdk/package.json, so every prerelease bump (e.g. #2087, alpha.48 -> alpha.49) had to edit the same string in all of them. Read the pin from the vended template instead via a shared fixture, and derive the skew-test's 'newer' example from it, so bumping the template no longer touches these tests. The asset snapshot remains the literal guardrail that trips on any unintended pin change.

agentcore-devx-automation · 2026-08-26T21:24:46Z

Claude Security Review: no high-confidence findings. (run)

github-actions · 2026-08-26T21:30:58Z

Coverage Report

Status	Category	Percentage	Covered / Total
🔵	Lines	40.99%	15453 / 37694
🔵	Statements	40.24%	16473 / 40935
🔵	Functions	35.15%	2644 / 7522
🔵	Branches	34.18%	10311 / 30161

Generated in workflow #4421 for commit 85a851e by the Vitest Coverage Report Action

jariy17 · 2026-08-26T21:17:14Z

TL;DR

The @aws/agentcore-cdk pin was hand-typed in 3 places. This makes the tests read it from the one file that ships it, so a version bump stops being a find-and-replace chore.

Review time: ~5 min. Risk: low — tests only, no runtime src/ change. Motivating commit:ddb32a2 (#2087).

The problem

0.1.0-alpha.49 was duplicated in:

src/assets/cdk/package.json — the real pin (sync.ts treats it as source of truth)
plan.test.ts + sync.test.ts — hand-typed copies

Every prerelease bump had to edit all of them in lockstep. Miss one → red build, or a stale assertion that passes when it shouldn't.

What changed (3 files)

New__tests__/fixtures.ts — exposes CDK_PIN read from the vended template, plus newerPrerelease() for skew tests. Reads via fs (not import) because src/assets is excluded from the TS program — same pattern the snapshot test and sync.ts already use.
plan.test.ts — uses CDK_PIN / derived CDK_PIN_NEWER instead of the literals.
sync.test.ts — uses CDK_PIN for its 5 pin literals.

Older-version fixtures (alpha.19) stay literal on purpose — they mean "much older", never bumped.

Why no new guardrail literal

The asset snapshot already stores the pin as a literal, so any unintended template change still trips a red snapshot test until someone regenerates it. No point duplicating that.

Verified

vitest run --project unit src/lib/dependency-management → 40 passed
npm run typecheck · eslint · prettier --check → clean

Package Tarball

aws-agentcore-0.28.0.tgz

How to install

gh release download pr-2117-tarball --repo aws/agentcore-cli --pattern "*.tgz" --dir /tmp/pr-tarball
npm install -g /tmp/pr-tarball/aws-agentcore-0.28.0.tgz

agentcore-devx-automation

AgentCore Harness Review

Verdict: Looks good

This is a focused test refactor that removes duplicated hardcoded @aws/agentcore-cdk version strings by sourcing CDK_PIN from the vended src/assets/cdk/package.json (the actual source of truth) and deriving a strictly-newer prerelease for skew tests via newerPrerelease. The substitutions in plan.test.ts and sync.test.ts are 1:1 replacements of the previous literals (0.1.0-alpha.49 and 0.1.0-alpha.51), so behavior is preserved while future template bumps no longer require editing multiple test files.

A few observations, none blocking:

readFileSync in fixtures.ts runs at module load. Since vitest discovers only *.test.ts, fixtures.ts won't be picked up as a suite, and path.resolve(__dirname, '../../../assets/cdk/package.json') correctly points at src/assets/cdk/package.json from src/lib/dependency-management/__tests__/. The comment about src/assets being excluded from the TS program matches tsconfig.json.
newerPrerelease will throw if the CDK pin ever moves off a -alpha.N prerelease. That's an intentional fail-fast, but worth remembering as the vended package approaches a stable release — the fixture will need updating at that point.
The "upgrades an older exact-pinned prerelease" test still hardcodes 0.1.0-alpha.19 as the "older" version. That's fine as long as the pin never drops below alpha.20, which is a safe assumption.

No changes required. LGTM.

The @aws/agentcore-cdk pin lived as a hand-typed literal in plan.test.ts and sync.test.ts as well as in src/assets/cdk/package.json, so every prerelease bump (e.g. #2087, alpha.48 -> alpha.49) had to edit the same string in all of them. Read the pin from the vended template instead via a shared fixture, and derive the skew-test's 'newer' example from it, so bumping the template no longer touches these tests. The asset snapshot remains the literal guardrail that trips on any unintended pin change.

agentcore-devx-automation · 2026-08-26T21:24:46Z

Claude Security Review: no high-confidence findings. (run)

github-actions · 2026-08-26T21:30:58Z

Coverage Report

Status	Category	Percentage	Covered / Total
🔵	Lines	40.99%	15453 / 37694
🔵	Statements	40.24%	16473 / 40935
🔵	Functions	35.15%	2644 / 7522
🔵	Branches	34.18%	10311 / 30161

Generated in workflow #4421 for commit 85a851e by the Vitest Coverage Report Action

jariy17 · 2026-08-26T21:17:14Z

TL;DR

The @aws/agentcore-cdk pin was hand-typed in 3 places. This makes the tests read it from the one file that ships it, so a version bump stops being a find-and-replace chore.

Review time: ~5 min. Risk: low — tests only, no runtime src/ change. Motivating commit:ddb32a2 (#2087).

The problem

0.1.0-alpha.49 was duplicated in:

src/assets/cdk/package.json — the real pin (sync.ts treats it as source of truth)
plan.test.ts + sync.test.ts — hand-typed copies

Every prerelease bump had to edit all of them in lockstep. Miss one → red build, or a stale assertion that passes when it shouldn't.

What changed (3 files)

New__tests__/fixtures.ts — exposes CDK_PIN read from the vended template, plus newerPrerelease() for skew tests. Reads via fs (not import) because src/assets is excluded from the TS program — same pattern the snapshot test and sync.ts already use.
plan.test.ts — uses CDK_PIN / derived CDK_PIN_NEWER instead of the literals.
sync.test.ts — uses CDK_PIN for its 5 pin literals.

Older-version fixtures (alpha.19) stay literal on purpose — they mean "much older", never bumped.

Why no new guardrail literal

The asset snapshot already stores the pin as a literal, so any unintended template change still trips a red snapshot test until someone regenerates it. No point duplicating that.

Verified

vitest run --project unit src/lib/dependency-management → 40 passed
npm run typecheck · eslint · prettier --check → clean

Package Tarball

aws-agentcore-0.28.0.tgz

How to install

gh release download pr-2117-tarball --repo aws/agentcore-cli --pattern "*.tgz" --dir /tmp/pr-tarball
npm install -g /tmp/pr-tarball/aws-agentcore-0.28.0.tgz

agentcore-devx-automation

AgentCore Harness Review

Verdict: Looks good

This is a focused test refactor that removes duplicated hardcoded @aws/agentcore-cdk version strings by sourcing CDK_PIN from the vended src/assets/cdk/package.json (the actual source of truth) and deriving a strictly-newer prerelease for skew tests via newerPrerelease. The substitutions in plan.test.ts and sync.test.ts are 1:1 replacements of the previous literals (0.1.0-alpha.49 and 0.1.0-alpha.51), so behavior is preserved while future template bumps no longer require editing multiple test files.

A few observations, none blocking:

readFileSync in fixtures.ts runs at module load. Since vitest discovers only *.test.ts, fixtures.ts won't be picked up as a suite, and path.resolve(__dirname, '../../../assets/cdk/package.json') correctly points at src/assets/cdk/package.json from src/lib/dependency-management/__tests__/. The comment about src/assets being excluded from the TS program matches tsconfig.json.
newerPrerelease will throw if the CDK pin ever moves off a -alpha.N prerelease. That's an intentional fail-fast, but worth remembering as the vended package approaches a stable release — the fixture will need updating at that point.
The "upgrades an older exact-pinned prerelease" test still hardcodes 0.1.0-alpha.19 as the "older" version. That's fine as long as the pin never drops below alpha.20, which is a safe assumption.

No changes required. LGTM.

The @aws/agentcore-cdk pin lived as a hand-typed literal in plan.test.ts and sync.test.ts as well as in src/assets/cdk/package.json, so every prerelease bump (e.g. #2087, alpha.48 -> alpha.49) had to edit the same string in all of them. Read the pin from the vended template instead via a shared fixture, and derive the skew-test's 'newer' example from it, so bumping the template no longer touches these tests. The asset snapshot remains the literal guardrail that trips on any unintended pin change.

agentcore-devx-automation · 2026-08-26T21:24:46Z

Claude Security Review: no high-confidence findings. (run)

github-actions · 2026-08-26T21:30:58Z

Coverage Report

Status	Category	Percentage	Covered / Total
🔵	Lines	40.99%	15453 / 37694
🔵	Statements	40.24%	16473 / 40935
🔵	Functions	35.15%	2644 / 7522
🔵	Branches	34.18%	10311 / 30161

Generated in workflow #4421 for commit 85a851e by the Vitest Coverage Report Action

jariy17 · 2026-08-26T21:17:14Z

TL;DR

The @aws/agentcore-cdk pin was hand-typed in 3 places. This makes the tests read it from the one file that ships it, so a version bump stops being a find-and-replace chore.

Review time: ~5 min. Risk: low — tests only, no runtime src/ change. Motivating commit:ddb32a2 (#2087).

The problem

0.1.0-alpha.49 was duplicated in:

src/assets/cdk/package.json — the real pin (sync.ts treats it as source of truth)
plan.test.ts + sync.test.ts — hand-typed copies

Every prerelease bump had to edit all of them in lockstep. Miss one → red build, or a stale assertion that passes when it shouldn't.

What changed (3 files)

New__tests__/fixtures.ts — exposes CDK_PIN read from the vended template, plus newerPrerelease() for skew tests. Reads via fs (not import) because src/assets is excluded from the TS program — same pattern the snapshot test and sync.ts already use.
plan.test.ts — uses CDK_PIN / derived CDK_PIN_NEWER instead of the literals.
sync.test.ts — uses CDK_PIN for its 5 pin literals.

Older-version fixtures (alpha.19) stay literal on purpose — they mean "much older", never bumped.

Why no new guardrail literal

The asset snapshot already stores the pin as a literal, so any unintended template change still trips a red snapshot test until someone regenerates it. No point duplicating that.

Verified

vitest run --project unit src/lib/dependency-management → 40 passed
npm run typecheck · eslint · prettier --check → clean

Package Tarball

aws-agentcore-0.28.0.tgz

How to install

gh release download pr-2117-tarball --repo aws/agentcore-cli --pattern "*.tgz" --dir /tmp/pr-tarball
npm install -g /tmp/pr-tarball/aws-agentcore-0.28.0.tgz

agentcore-devx-automation

AgentCore Harness Review

Verdict: Looks good

This is a focused test refactor that removes duplicated hardcoded @aws/agentcore-cdk version strings by sourcing CDK_PIN from the vended src/assets/cdk/package.json (the actual source of truth) and deriving a strictly-newer prerelease for skew tests via newerPrerelease. The substitutions in plan.test.ts and sync.test.ts are 1:1 replacements of the previous literals (0.1.0-alpha.49 and 0.1.0-alpha.51), so behavior is preserved while future template bumps no longer require editing multiple test files.

A few observations, none blocking:

readFileSync in fixtures.ts runs at module load. Since vitest discovers only *.test.ts, fixtures.ts won't be picked up as a suite, and path.resolve(__dirname, '../../../assets/cdk/package.json') correctly points at src/assets/cdk/package.json from src/lib/dependency-management/__tests__/. The comment about src/assets being excluded from the TS program matches tsconfig.json.
newerPrerelease will throw if the CDK pin ever moves off a -alpha.N prerelease. That's an intentional fail-fast, but worth remembering as the vended package approaches a stable release — the fixture will need updating at that point.
The "upgrades an older exact-pinned prerelease" test still hardcodes 0.1.0-alpha.19 as the "older" version. That's fine as long as the pin never drops below alpha.20, which is a safe assumption.

No changes required. LGTM.

The @aws/agentcore-cdk pin lived as a hand-typed literal in plan.test.ts and sync.test.ts as well as in src/assets/cdk/package.json, so every prerelease bump (e.g. #2087, alpha.48 -> alpha.49) had to edit the same string in all of them. Read the pin from the vended template instead via a shared fixture, and derive the skew-test's 'newer' example from it, so bumping the template no longer touches these tests. The asset snapshot remains the literal guardrail that trips on any unintended pin change.

agentcore-devx-automation · 2026-08-26T21:24:46Z

Claude Security Review: no high-confidence findings. (run)

github-actions · 2026-08-26T21:30:58Z

Coverage Report

Status	Category	Percentage	Covered / Total
🔵	Lines	40.99%	15453 / 37694
🔵	Statements	40.24%	16473 / 40935
🔵	Functions	35.15%	2644 / 7522
🔵	Branches	34.18%	10311 / 30161

Generated in workflow #4421 for commit 85a851e by the Vitest Coverage Report Action

jariy17 mentioned this pull request Aug 26, 2026
feat(release): auto-bump the vended CDK pin during release prep #2118
Merged

github-actionsBot added the size/s PR size: S label Aug 26, 2026

jariy17 had a problem deploying to e2e-testing August 26, 2026 21:17 — with GitHub Actions Error

agentcore-devx-automationBot added agentcore-harness-reviewing AgentCore Harness review in progress claude-security-reviewing Claude Code /security-review in progress labels Aug 26, 2026

agentcore-devx-automationBot removed the claude-security-reviewing Claude Code /security-review in progress label Aug 26, 2026

agentcore-devx-automationBot reviewed Aug 26, 2026
View reviewed changes

agentcore-devx-automationBot removed the agentcore-harness-reviewing AgentCore Harness review in progress label Aug 26, 2026

jariy17 force-pushed the tj/dedupe-vended-cdk-pin branch from 2172854 to 85a851eCompare August 26, 2026 21:22

github-actionsBot added size/s PR size: S and removed size/s PR size: S labels Aug 26, 2026

jariy17 marked this pull request as ready for review August 26, 2026 21:23

jariy17 requested a review from a teamAugust 26, 2026 21:23

jariy17 temporarily deployed to e2e-testing August 26, 2026 21:23 — with GitHub Actions Inactive

agentcore-devx-automationBot added the claude-security-reviewing Claude Code /security-review in progress label Aug 26, 2026

agentcore-devx-automationBot removed the claude-security-reviewing Claude Code /security-review in progress label Aug 26, 2026

github-actionsBot added size/s PR size: S and removed size/s PR size: S labels Aug 26, 2026

aidandaly24 approved these changes Aug 27, 2026
View reviewed changes

aidandaly24 merged commit d367f79 into mainAug 27, 2026
42 checks passed

aidandaly24 deleted the tj/dedupe-vended-cdk-pin branch August 27, 2026 14:51