Helpers

Helper utilities for naming, branch handling, Projen task generation, and CI/CD workflow creation.


env-helper.ts

Source: src/bin/env-helper.ts

Utilities for environment-specific task generation, resource naming, and branch handling. Used in both Projen configuration and at runtime in CDK stacks.

Types and Constants

Environment

type Environment = 'sandbox' | 'development' | 'test' | 'staging' | 'production'

Supported environment names.

SUPPORTED_CDK_ACTIONS

const SUPPORTED_CDK_ACTIONS = ['synth', 'diff', 'deploy', 'deploy:hotswap', 'destroy', 'ls'] as const

CDK actions with task generation support.

EnvironmentConfig

interface EnvironmentConfig {
  accountId: string;
  enableBranchDeploy: boolean;
}

Environment configuration shape.


Functions

getTaskName

Location: src/bin/env-helper.ts:35-53

getTaskName(
  environment: string,
  action: typeof SUPPORTED_CDK_ACTIONS[number],
  options?: { isBranch?: boolean; taskType?: 'all' | 'stack' }
): string

Generates consistent task names following the convention: <env>[:<branch>]:<action>[:<type>].

Parameters:

NameTypeDescription
environmentstringEnvironment name (test, production, etc.).
actionCdkActionCDK action (synth, deploy, destroy, diff, ls, deploy:hotswap).
options.isBranchboolean (optional)Whether this is a branch deployment task.
options.taskType'all' | 'stack' (optional)Either 'all' (for all stacks) or 'stack' (for specific stacks).

Returns: string - Task name in the format <env>[:<branch>]:<action>[:<type>].

Examples:

getTaskName('test', 'synth')
// → 'test:synth'

getTaskName('test', 'deploy', { taskType: 'all' })
// → 'test:deploy:all'

getTaskName('test', 'deploy', { isBranch: true, taskType: 'all' })
// → 'test:branch:deploy:all'

getTaskName('test', 'destroy', { isBranch: true, taskType: 'stack' })
// → 'test:branch:destroy:stack'

Usage: Task names are used by GitHub Actions workflows. See How workflows are generated.


addCdkActionTask

Location: src/bin/env-helper.ts:69-116

addCdkActionTask(
  cdkProject: AwsCdkTypeScriptApp,
  targetAccount: {
    CDK_DEFAULT_ACCOUNT: string;
    CDK_DEFAULT_REGION: string;
    ENVIRONMENT: string;
    GITHUB_DEPLOY_ROLE: string;
    GIT_BRANCH_REF?: string;
  }
): void

Generates npm run tasks for all supported CDK actions with environment-specific variables.

Parameters:

NameTypeDescription
cdkProjectAwsCdkTypeScriptAppProjen CDK project instance.
targetAccountTargetAccountEnvironment configuration object.

TargetAccount Properties:

NameTypeRequiredDescription
CDK_DEFAULT_ACCOUNTstringYesAWS account ID.
CDK_DEFAULT_REGIONstringYesAWS region.
ENVIRONMENTstringYesEnvironment name.
GITHUB_DEPLOY_ROLEstringYesIAM role name for OIDC.
GIT_BRANCH_REFstringNoBranch reference for branch deployments.

Task Generation Behavior:

ActionTask VariantsDescription
synth, lsSingle taskOperates on all stacks
deploy, destroy, diff:all and :stack:all runs on all stacks with --all flag, :stack accepts stack names via receiveArgs: true
deploy:hotswap:all and :stackOnly generated for branch deployments (when GIT_BRANCH_REF is present)

Example Tasks Generated:

# Regular environment tasks
npm run test:synth              # Synth all test stacks
npm run test:deploy:all         # Deploy all test stacks
npm run test:deploy:stack MyStack  # Deploy specific test stack
npm run test:diff:all           # Diff all test stacks
npm run test:destroy:all        # Destroy all test stacks

# Branch deployment tasks (when GIT_BRANCH_REF is set)
npm run test:branch:synth
npm run test:branch:deploy:all
npm run test:branch:deploy:hotswap:all
npm run test:branch:destroy:all

Usage in .projenrc.ts:165:

import { addCdkActionTask } from './src/bin/env-helper';

addCdkActionTask(project, {
  CDK_DEFAULT_ACCOUNT: '987654321012',
  CDK_DEFAULT_REGION: 'us-east-1',
  ENVIRONMENT: 'test',
  GITHUB_DEPLOY_ROLE: 'GitHubActionsServiceRole',
});

// For branch deployments (line 174)
addCdkActionTask(project, {
  CDK_DEFAULT_ACCOUNT: '987654321012',
  CDK_DEFAULT_REGION: 'us-east-1',
  ENVIRONMENT: 'test',
  GITHUB_DEPLOY_ROLE: 'GitHubActionsServiceRole',
  GIT_BRANCH_REF: '$(echo ${GIT_BRANCH_REF:-$(git rev-parse --abbrev-ref HEAD)})',
});

Related: Task generation


extractCleanedBranchName

Location: src/bin/env-helper.ts:124-147

extractCleanedBranchName(branchRef: string): string | undefined

Extracts and sanitizes branch names for use in resource naming.

Parameters:

NameTypeDescription
branchRefstringGit branch reference.

Returns: string | undefined - Sanitized branch name or undefined for excluded branches.

Sanitization Rules:

RuleDescription
Excluded branchesReturns undefined for main, develop, development
Version tagsReturns undefined for tags matching v\d+\.\d+\.\d+
LowercaseConverts to lowercase
Extract segmentExtracts last segment after / (e.g., feature/foo-barfoo-bar)
Character filterRemoves all characters except a-z, 0-9, and -
Trim hyphensTrims trailing hyphens
TruncateTruncates to 25 characters

Examples:

extractCleanedBranchName('feature/user-auth')
// → 'user-auth'

extractCleanedBranchName('bugfix/fix-api-123')
// → 'fix-api-123'

extractCleanedBranchName('main')
// → undefined

extractCleanedBranchName('v1.2.3')
// → undefined

Usage: Used by createEnvResourceName to generate branch-suffixed stack names. See Branch deployment workflow.


createEnvResourceName

Location: src/bin/env-helper.ts:157-181

createEnvResourceName(baseName: string): string

Creates environment or branch-aware resource names with automatic suffixing.

Parameters:

NameTypeDescription
baseNamestringBase name for the resource.

Returns: string - Environment or branch-suffixed resource name (max 64 characters).

Behavior:

ConditionFormatExample
GIT_BRANCH_REF is set<baseName>-<cleanedBranchName>MyStack-user-auth
Otherwise<baseName>-<environment>MyStack-test

Error Handling:

  • Throws error if GIT_BRANCH_REF is "main" to prevent accidental branch deploys to production.
  • Truncates to 64 characters max, removing trailing non-alphanumeric chars.

Examples:

// Regular environment deployment
process.env.ENVIRONMENT = 'test';
createEnvResourceName('MyStack')
// → 'MyStack-test'

// Branch deployment
process.env.GIT_BRANCH_REF = 'feature/user-auth';
createEnvResourceName('MyStack')
// → 'MyStack-user-auth'

// Error case
process.env.GIT_BRANCH_REF = 'main';
createEnvResourceName('MyStack')
// → Throws error

Usage in CDK Stacks:

import { createEnvResourceName } from '../bin/env-helper';

// Stack naming
new Stack(app, createEnvResourceName('StarterStack'), { env });

// Resource naming
new Bucket(this, 'Bucket', {
  bucketName: createEnvResourceName('my-app-bucket'),
});

Related: Branch deployment workflow


cicd-helper.ts

Source: src/bin/cicd-helper.ts

Functions for generating GitHub Actions workflows for CDK deployments. See Configuration: CI/CD Workflows.

Functions

createCdkDeploymentWorkflows

Location: src/bin/cicd-helper.ts:113-132

createCdkDeploymentWorkflows(
  gh: GitHub,
  account: string,
  region: string,
  env: string,
  githubDeployRole: string,
  nodeVersion: string,
  deployForBranch: boolean,
  orderedEnvironments: string[]
): void

Main entry point that orchestrates workflow generation for an environment.

Parameters:

NameTypeDescription
ghGitHubGitHub instance from Projen.
accountstringAWS account ID for deployments.
regionstringAWS region for deployments.
envstringEnvironment name (test, staging, production, etc.).
githubDeployRolestringName of the IAM role for OIDC authentication.
nodeVersionstringNode.js version for workflows.
deployForBranchbooleanWhether to create branch deployment workflows.
orderedEnvironmentsstring[]Array of environments in deployment order for workflow chaining.

Returns: void

Workflows Created:

WorkflowFilenameCondition
Regular deploymentcdk-deploy-<env>.ymlAlways
Branch deploymentcdk-deploy-<env>-branch.ymlIf deployForBranch=true
Branch destroycdk-destroy-<env>-branch.ymlIf deployForBranch=true

Usage in .projenrc.ts:184-193:

import { createCdkDeploymentWorkflows } from './src/bin/cicd-helper';

createCdkDeploymentWorkflows(
  project.github,
  config.accountId,
  awsRegion,
  config.name,
  githubRole,
  nodeVersion,
  config.enableBranchDeploy,
  orderedEnvironments,
);

Related: Environment deployment workflow


createCdkDeploymentWorkflow

Location: src/bin/cicd-helper.ts:146-217

createCdkDeploymentWorkflow(
  gh: GitHub,
  account: string,
  region: string,
  env: string,
  githubDeployRole: string,
  nodeVersion: string,
  isBranchWorkflow: boolean,
  orderedEnvironments: string[]
): void

Internal function that creates individual deployment workflows. Handles both regular and branch-based deployments.

Parameters:

NameTypeDescription
ghGitHubGitHub instance from Projen.
accountstringAWS account ID.
regionstringAWS region.
envstringEnvironment name.
githubDeployRolestringIAM role name for OIDC.
nodeVersionstringNode.js version.
isBranchWorkflowbooleanWhether this is a branch deployment workflow.
orderedEnvironmentsstring[]Ordered list of environments.

Returns: void

Trigger Behavior:

EnvironmentTrigger
First env in listPush to main
Subsequent envsworkflow_run when previous env completes successfully
Branch workflowPush to feature branches (excludes main, hotfix/*, github-actions/*, dependabot/**)

Workflow Configuration:

SettingValuePurpose
Concurrencycancel-in-progress: falsePrevents parallel deployments to same environment
Permissionscontents: read, id-token: writeFor OIDC authentication
EnvironmentLinks to GitHub environmentFor protection rules

Steps:

  1. Checkout repository
  2. Setup Node.js
  3. Configure AWS credentials via OIDC
  4. Install dependencies
  5. Run <env>:synth
  6. Run <env>:deploy:all

Related: Environment deployment workflow and Branch deployment workflow


createCdkDestroyWorkflow

Location: src/bin/cicd-helper.ts:235-303

createCdkDestroyWorkflow(
  gh: GitHub,
  account: string,
  region: string,
  env: string,
  githubDeployRole: string,
  nodeVersion: string
): void

Creates cleanup workflows for branch deployments.

Parameters:

NameTypeDescription
ghGitHubGitHub instance from Projen.
accountstringAWS account ID.
regionstringAWS region.
envstringEnvironment name.
githubDeployRolestringIAM role name for OIDC.
nodeVersionstringNode.js version.

Returns: void

Trigger Scenarios:

TriggerMethodBranch Extraction
Manual dispatchworkflow_dispatchUses current branch ref
Branch deletiondelete eventExtracts from GitHub event payload using jq
PR closurepull_request closedUses PR head ref from GitHub context

Safety Features:

  • Job-level if condition prevents accidental destruction of main branch stacks
  • Branch name validation ensures only feature branches are destroyed
  • Manual override via workflow_dispatch for cleanup operations

Related: Branch destroy workflow


createCdkDiffPrWorkflow

Location: src/bin/cicd-helper.ts:29-94

createCdkDiffPrWorkflow(
  gh: GitHub,
  account: string,
  region: string,
  githubDeployRole: string,
  nodeVersion: string,
  orderedEnvironments: string[]
): void

Creates a workflow that generates CDK diff output and posts it as a PR comment for early visibility into infrastructure changes.

Parameters:

NameTypeDescription
ghGitHubGitHub instance from Projen.
accountstringAWS account ID (usually production).
regionstringAWS region.
githubDeployRolestringIAM role name for OIDC.
nodeVersionstringNode.js version.
orderedEnvironmentsstring[]Ordered list of environments.

Returns: void

Configuration:

SettingValuePurpose
Triggerpull_request_target on PRs to mainSecure access to secrets
ComparisonPR branch vs highest environmentUsually production
CheckoutPR branch SHAgithub.event.pull_request.head.sha
Diff outputcdk-diff-output.txtCaptured with || true to prevent workflow failures
Comment actiontowardsthecloud/aws-cdk-diff-pr-commenter@v1Posts diff as PR comment
Permissionscontents: read, id-token: write, pull-requests: writeFor checkout, OIDC, and commenting

Usage in .projenrc.ts:197-204:

import { createCdkDiffPrWorkflow } from './src/bin/cicd-helper';

createCdkDiffPrWorkflow(
  project.github,
  environmentConfigs[environmentConfigs.length - 1].accountId, // Production account
  awsRegion,
  githubRole,
  nodeVersion,
  orderedEnvironments,
);

Related: CDK diff PR comment workflow


getCommonWorkflowSteps

Location: src/bin/cicd-helper.ts:362-378

getCommonWorkflowSteps(
  nodeVersion: string,
  region: string,
  githubDeployRole: string,
  account: string,
  ref?: string
): WorkflowStep[]

Generates standard workflow steps shared across all deployment workflows.

Parameters:

NameTypeDescription
nodeVersionstringNode.js version.
regionstringAWS region.
githubDeployRolestringIAM role name.
accountstringAWS account ID.
refstring (optional)Git ref to checkout.

Returns: WorkflowStep[] - Array of workflow steps.

Steps Generated:

StepActionPurpose
1. Checkout repositoryactions/checkout@v5Clone repo with optional ref
2. Setup Node.jsactions/setup-node@v6Install Node.js with version and npm caching
3. Configure AWS credentialsaws-actions/configure-aws-credentials@v4OIDC authentication
4. Install dependenciesnpm ciReproducible installs

Related: Common workflow steps


git-helper.ts

Source: src/bin/git-helper.ts

Functions

getGitRepositoryDetails

getGitRepositoryDetails(): { gitOwner: string; gitRepoName: string }

Parses the Git remote URL from git config --get remote.origin.url to extract owner and repo.

Returns: Object with gitOwner and gitRepoName.

Usage:

Used by the FoundationStack to scope the GitHub OIDC sub claim to repo:<owner>/<repo>:environment:<env>.

import { getGitRepositoryDetails } from '../bin/git-helper';
const { gitOwner, gitRepoName } = getGitRepositoryDetails();