CDK Diff Action

GitHub action to comment on PRs with the stack diff.

✨ Features

• 💬 Create a single comment per CDK stage
• ♻️ Updates the same comment on each commit, reducing clutter
• ‼️ Calls out any destructive changes to resources
• ❌ Fail workflow if there are destructive changes
• 🧵 Summary of stack changes with expandable details
• 🙈 Allow destructive changes for certain resource types

Example Configurations

The cdk-diff-action handles performing the diff and commenting on the PR. In order to do so it requires credentials to AWS and the synthesized CDK cloud assembly (cdk.out). Below is a minimal example

name: diffon:
pull_request:
branches:
- mainjobs:
Synth:
name: Synthesizepermissions:
contents: readpull-requests: writeid-token: writeruns-on: ubuntu-lateststeps:
- name: Checkoutuses: actions/checkout@v4
- name: Setup Nodeuses: actions/setup-node@v3with:
node-version: 20
- name: Install dependenciesrun: yarn install --frozen-lockfile
- name: Synthrun: npx cdk synth
- name: Authenticate Via OIDC Roleuses: aws-actions/configure-aws-credentials@v4with:
aws-region: us-east-2role-duration-seconds: 1800role-skip-session-tagging: truerole-to-assume: arn:aws:iam::1234567891012:role/cdk_github_actionsrole-session-name: github
- name: Diffuses: corymhall/cdk-diff-action@v2with:
githubToken: ${{ secrets.GITHUB_TOKEN }}

This action supports semver versioning.

For example, to get the latest v1.x.x version.

uses: corymhall/cdk-diff-action@v1

Or to get the latest v1.1.x version.

uses: corymhall/cdk-diff-action@v1.1

Allow Destroy Types

You can optionally allow certain resource types to be destroyed without failing the build.

jobs:
Synth:
steps:
- name: Diffuses: corymhall/cdk-diff-action@v2with:
allowedDestroyTypes: | AWS::ECS::TaskDefinition AWS::CloudWatch::DashboardgithubToken: ${{ secrets.GITHUB_TOKEN }}

Disable showing diff for stages

You can disable displaying the diff for certain stages or stacks by using stackSelectorPatterns. stackSelectorPatterns using glob patterns to filter which stacks to diff. To exclude stacks you can use an exclude pattern (e.g. !SomeStage/SampleStack). To exclude an entire stage you would provide !SomeStage/*.

jobs:
Synth:
steps:
- name: Diffuses: corymhall/cdk-diff-action@v2with:
StackSelectorPatterns: | !Stage1/* !Stage2/*githubToken: ${{ secrets.GITHUB_TOKEN }}

Don't fail for destructive changes in certain stages

If you still want to show the diff for certain stages, but do not want destructive changes to fail the build, you can use noFailOnDestructiveChanges.

jobs:
Synth:
steps:
- name: Diffuses: corymhall/cdk-diff-action@v2with:
noFailOnDestructiveChanges: | Stage1 Stage2githubToken: ${{ secrets.GITHUB_TOKEN }}

Don't fail workflow

If you want to show the diffs, but never want to fail the workflow (even if there are destructive changes) you can disable the workflow failure feature.

jobs:
Synth:
steps:
- name: Diffuses: corymhall/cdk-diff-action@v2with:
failOnDestructiveChanges: falsegithubToken: ${{ secrets.GITHUB_TOKEN }}