Merge branch 'master' into benisrae/backport/pack-fix

package.json

@@ -65,18 +65,26 @@
       "@aws-cdk/cloud-assembly-schema/jsonschema/**",
       "@aws-cdk/cloud-assembly-schema/semver",
       "@aws-cdk/cloud-assembly-schema/semver/**",
+      "@aws-cdk/core/@balena/dockerignore",
+      "@aws-cdk/core/@balena/dockerignore/**",
       "@aws-cdk/core/fs-extra",
       "@aws-cdk/core/fs-extra/**",
+      "@aws-cdk/core/ignore",
+      "@aws-cdk/core/ignore/**",
       "@aws-cdk/core/minimatch",
       "@aws-cdk/core/minimatch/**",
       "@aws-cdk/cx-api/semver",
       "@aws-cdk/cx-api/semver/**",
       "@aws-cdk/yaml-cfn/yaml",
       "@aws-cdk/yaml-cfn/yaml/**",
+      "aws-cdk-lib/@balena/dockerignore",
+      "aws-cdk-lib/@balena/dockerignore/**",
       "aws-cdk-lib/case",
       "aws-cdk-lib/case/**",
       "aws-cdk-lib/fs-extra",
       "aws-cdk-lib/fs-extra/**",
+      "aws-cdk-lib/ignore",
+      "aws-cdk-lib/ignore/**",
       "aws-cdk-lib/jsonschema",
       "aws-cdk-lib/jsonschema/**",
       "aws-cdk-lib/minimatch",
@@ -87,10 +95,14 @@
       "aws-cdk-lib/semver/**",
       "aws-cdk-lib/yaml",
       "aws-cdk-lib/yaml/**",
+      "monocdk/@balena/dockerignore",
+      "monocdk/@balena/dockerignore/**",
       "monocdk/case",
       "monocdk/case/**",
       "monocdk/fs-extra",
       "monocdk/fs-extra/**",
+      "monocdk/ignore",
+      "monocdk/ignore/**",
       "monocdk/jsonschema",
       "monocdk/jsonschema/**",
       "monocdk/minimatch",

packages/@aws-cdk/assets/lib/fs/options.ts

@@ -1,3 +1,4 @@
+import { IgnoreMode } from '@aws-cdk/core';
 import { FollowMode } from './follow-mode';
 
 /**
@@ -18,6 +19,14 @@ export interface CopyOptions {
    * @default nothing is excluded
    */
   readonly exclude?: string[];
+
+  /**
+   * The ignore behavior to use for exclude patterns.
+   *
+   * @default - GLOB for file assets, DOCKER or GLOB for docker assets depending on whether the
+   * '@aws-cdk/aws-ecr-assets:dockerIgnoreSupport' flag is set.
+   */
+  readonly ignoreMode?: IgnoreMode;
 }
 
 /**

packages/@aws-cdk/assets/lib/staging.ts

@@ -22,6 +22,7 @@ export class Staging extends AssetStaging {
     super(scope, id, {
       sourcePath: props.sourcePath,
       exclude: props.exclude,
+      ignoreMode: props.ignoreMode,
       extraHash: props.extraHash,
       follow: toSymlinkFollow(props.follow),
     });

packages/@aws-cdk/aws-codebuild/test/integ.docker-asset.lit.expected.json

@@ -146,7 +146,7 @@
                 {
                   "Ref": "AWS::URLSuffix"
                 },
-                "/aws-cdk/assets:ee9ebbb592f461ed4638ea9ea64fab9fd384fd2f890c4fef981f9938d82419f4"
+                "/aws-cdk/assets:2564b8c8e3f9e82a6394872a4e555c4d0c06ab6f47b9aca360c22c9ed622487c"
               ]
             ]
           },
@@ -168,4 +168,4 @@
       }
     }
   }
-}
+}

packages/@aws-cdk/aws-ecr-assets/.gitignore

@@ -17,4 +17,7 @@ nyc.config.js
 !.eslintrc.js
 
 junit.xml
-!jest.config.js
+
+!jest.config.js
+
+!test/whitelisted-image/node_modules

packages/@aws-cdk/aws-ecr-assets/NOTICE

@@ -20,4 +20,4 @@ WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR
 IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 
-----------------
+----------------

packages/@aws-cdk/aws-ecr-assets/README.md

@@ -29,6 +29,21 @@ This will instruct the toolkit to build a Docker image from `my-image`, push it
 to an AWS ECR repository and wire the name of the repository as CloudFormation
 parameters to your stack.
 
+By default, all files in the given directory will be copied into the docker
+*build context*. If there is a large directory that you know you definitely
+don't need in the build context you can improve the performance by adding the
+names of files and directories to ignore to a file called `.dockerignore`, or
+pass them via the `exclude` property. If both are available, the patterns
+found in `exclude` are appended to the patterns found in `.dockerignore`.
+
+The `ignoreMode` property controls how the set of ignore patterns is
+interpreted. The recommended setting for Docker image assets is
+`IgnoreMode.DOCKER`. If the context flag
+`@aws-cdk/aws-ecr-assets:dockerIgnoreSupport` is set to `true` in your
+`cdk.json` (this is by default for new projects, but must be set manually for
+old projects) then `IgnoreMode.DOCKER` is the default and you don't need to
+configure it on the asset itself.
+
 Use `asset.imageUri` to reference the image (it includes both the ECR image URL
 and tag.
 

packages/@aws-cdk/aws-ecr-assets/lib/image-asset.ts

@@ -2,9 +2,9 @@ import * as fs from 'fs';
 import * as path from 'path';
 import * as assets from '@aws-cdk/assets';
 import * as ecr from '@aws-cdk/aws-ecr';
-import { Annotations, Construct as CoreConstruct, Stack, Token } from '@aws-cdk/core';
+import { Annotations, Construct as CoreConstruct, FeatureFlags, IgnoreMode, Stack, Token } from '@aws-cdk/core';
+import * as cxapi from '@aws-cdk/cx-api';
 import { Construct } from 'constructs';
-import * as minimatch from 'minimatch';
 
 /**
  * Options for DockerImageAsset
@@ -97,20 +97,28 @@ export class DockerImageAsset extends CoreConstruct implements assets.IAsset {
       throw new Error(`Cannot find file at ${file}`);
     }
 
+    const defaultIgnoreMode = FeatureFlags.of(this).isEnabled(cxapi.DOCKER_IGNORE_SUPPORT)
+      ? IgnoreMode.DOCKER : IgnoreMode.GLOB;
+    let ignoreMode = props.ignoreMode ?? defaultIgnoreMode;
+
     let exclude: string[] = props.exclude || [];
 
     const ignore = path.join(dir, '.dockerignore');
 
     if (fs.existsSync(ignore)) {
-      exclude = [...exclude, ...fs.readFileSync(ignore).toString().split('\n').filter(e => !!e)];
+      const dockerIgnorePatterns = fs.readFileSync(ignore).toString().split('\n').filter(e => !!e);
+
+      exclude = [
+        ...dockerIgnorePatterns,
+        ...exclude,
+
+        // Ensure .dockerignore is whitelisted no matter what.
+        '!.dockerignore',
+      ];
     }
 
-    // make sure the docker file and the dockerignore file end up in the staging area
-    // see https://github.com/aws/aws-cdk/issues/6004
-    exclude = exclude.filter(ignoreExpression => {
-      return !(minimatch(file, ignoreExpression, { matchBase: true }) ||
-             minimatch(ignore, ignoreExpression, { matchBase: true }));
-    });
+    // Ensure the Dockerfile is whitelisted no matter what.
+    exclude.push('!' + path.basename(file));
 
     if (props.repositoryName) {
       Annotations.of(this).addWarning('DockerImageAsset.repositoryName is deprecated. Override "core.Stack.addDockerImageAsset" to control asset locations');
@@ -132,6 +140,7 @@ export class DockerImageAsset extends CoreConstruct implements assets.IAsset {
     const staging = new assets.Staging(this, 'Staging', {
       ...props,
       exclude,
+      ignoreMode,
       sourcePath: dir,
       extraHash: Object.keys(extraHash).length === 0
         ? undefined