From 514f7551c53dec0b30198b650e253cfa2dccbc0f Mon Sep 17 00:00:00 2001
From: Otavio Macedo <288203+otaviomacedo@users.noreply.github.com>
Date: Wed, 15 Nov 2023 15:13:07 +0000
Subject: [PATCH] chore: new prlint rule to protect the metadata.ts file
 against manual changes (#28007)

Only automated changes to the `packages/aws-cdk-lib/region-info/build-tools/metadata.ts` file are allowed.

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
---
 tools/@aws-cdk/prlint/lint.ts           | 16 ++++++++++--
 tools/@aws-cdk/prlint/test/lint.test.ts | 34 +++++++++++++++++++++++++
 2 files changed, 48 insertions(+), 2 deletions(-)

diff --git a/tools/@aws-cdk/prlint/lint.ts b/tools/@aws-cdk/prlint/lint.ts
index 06d7ec6ab5093..a3ded02249f4c 100644
--- a/tools/@aws-cdk/prlint/lint.ts
+++ b/tools/@aws-cdk/prlint/lint.ts
@@ -567,6 +567,11 @@ export class PullRequestLinter {
       testRuleSet: [{ test: noCliChanges }],
     });
 
+    validationCollector.validateRuleSet({
+      exemption: (pr) => pr.user?.login === 'aws-cdk-automation',
+      testRuleSet: [{ test: noMetadataChanges }],
+    })
+
     await this.deletePRLinterComment();
     try {
       await this.communicateResult(validationCollector);
@@ -732,13 +737,13 @@ function validateTitleScope(pr: GitHubPr): TestResult {
 
 /**
  * Check that the PR is not opened from main branch of author's fork
- * 
+ *
  * @param pr github pr
  * @returns test result
  */
 function validateBranch(pr: GitHubPr): TestResult {
   const result = new TestResult();
-  
+
   if (pr.head && pr.head.ref) {
     result.assessFailure(pr.head.ref === 'main', PR_FROM_MAIN_ERROR);
   }
@@ -766,6 +771,13 @@ function noCliChanges(pr: GitHubPr, files: GitHubFile[]): TestResult {
   );
 }
 
+function noMetadataChanges(_pr: GitHubPr, files: GitHubFile[]): TestResult {
+  const result = new TestResult();
+  const condition = files.some(file => file.filename === 'packages/aws-cdk-lib/region-info/build-tools/metadata.ts');
+  result.assessFailure(condition, 'Manual changes to the metadata.ts file are not allowed.');
+  return result;
+}
+
 require('make-runnable/custom')({
   printOutputFrame: false,
 });
diff --git a/tools/@aws-cdk/prlint/test/lint.test.ts b/tools/@aws-cdk/prlint/test/lint.test.ts
index 9952537a8ff35..330c32dee3a49 100644
--- a/tools/@aws-cdk/prlint/test/lint.test.ts
+++ b/tools/@aws-cdk/prlint/test/lint.test.ts
@@ -1010,6 +1010,40 @@ describe('integration tests required on features', () => {
       expect(mockAddLabel.mock.calls).toEqual([]);
     });
   });
+
+  describe('metadata file changed', () => {
+    const files: linter.GitHubFile[] = [{
+      filename: 'packages/aws-cdk-lib/region-info/build-tools/metadata.ts',
+    }];
+
+    test('with aws-cdk-automation author', async () => {
+      const pr = {
+        title: 'chore: Update regions',
+        number: 1234,
+        labels: [],
+        user: {
+          login: 'aws-cdk-automation'
+        },
+      };
+
+      const prLinter = configureMock(pr, files);
+      await expect(prLinter.validatePullRequestTarget(SHA)).resolves;
+    });
+
+    test('with another author', async () => {
+      const pr = {
+        title: 'chore: Update regions',
+        number: 1234,
+        labels: [],
+        user: {
+          login: 'johndoe',
+        },
+      };
+
+      const prLinter = configureMock(pr, files);
+      await expect(prLinter.validatePullRequestTarget(SHA)).rejects.toThrow();
+    });
+  });
 });
 
 function configureMock(pr: Subset<linter.GitHubPr>, prFiles?: linter.GitHubFile[]): linter.PullRequestLinter {