From 316b0bd09febbc61c833234e8c29817f54a72429 Mon Sep 17 00:00:00 2001
From: Tejas Ariyanayagam <tjariy@amazon.com>
Date: Wed, 26 Aug 2026 21:16:05 +0000
Subject: [PATCH] feat(release): auto-bump the vended CDK pin during release
 prep

Adds scripts/sync-vended-cdk.ts, which resolves @aws/agentcore-cdk from an npm
dist-tag (or an explicit --to) and rewrites the pin in the vended CDK template,
and wires a 'Sync vended CDK version' step into the active release workflow
(release-main-and-preview.yml) before its existing snapshot-update step. The
bump now rides into the reviewed release PR instead of a separate hand-edited
PR per prerelease (see #2087). Tag is configurable via the new cdk_dist_tag
input (default: latest); the step is a no-op when the template is already
current.

Depends on the pin de-duplication in the parent commit: because the
dependency-management tests derive the pin from the template, this bump needs
no test edits.
---
 .../workflows/release-main-and-preview.yml    | 12 +++++
 scripts/sync-vended-cdk.ts                    | 49 +++++++++++++++++++
 2 files changed, 61 insertions(+)
 create mode 100644 scripts/sync-vended-cdk.ts

diff --git a/.github/workflows/release-main-and-preview.yml b/.github/workflows/release-main-and-preview.yml
index dab14cbd4..688965258 100644
--- a/.github/workflows/release-main-and-preview.yml
+++ b/.github/workflows/release-main-and-preview.yml
@@ -40,6 +40,11 @@ on:
         required: false
         type: boolean
         default: false
+      cdk_dist_tag:
+        description: '@aws/agentcore-cdk npm dist-tag to pin the vended CDK template to (default: latest)'
+        required: false
+        type: string
+        default: 'latest'
 
 permissions:
   contents: write
@@ -135,6 +140,13 @@ jobs:
           echo "version=$NEW_VERSION" >> $GITHUB_OUTPUT
           echo "📦 Preview version: $NEW_VERSION"
 
+      - name: Sync vended CDK version
+        env:
+          CDK_DIST_TAG: ${{ github.event.inputs.cdk_dist_tag }}
+        run: |
+          npx tsx scripts/sync-vended-cdk.ts --tag "${CDK_DIST_TAG:-latest}"
+          npx prettier --write src/assets/cdk/package.json
+
       - name: Regenerate JSON schema
         run: |
           npm run build
diff --git a/scripts/sync-vended-cdk.ts b/scripts/sync-vended-cdk.ts
new file mode 100644
index 000000000..1baaf7a97
--- /dev/null
+++ b/scripts/sync-vended-cdk.ts
@@ -0,0 +1,49 @@
+#!/usr/bin/env npx tsx
+
+import { execFileSync } from 'node:child_process';
+import { readFileSync, writeFileSync } from 'node:fs';
+import * as path from 'node:path';
+
+const CDK_PACKAGE = '@aws/agentcore-cdk';
+const TEMPLATE_PATH = path.resolve(__dirname, '../src/assets/cdk/package.json');
+
+function getFlagValue(flag: string): string | undefined {
+  const index = process.argv.indexOf(flag);
+  return index !== -1 ? process.argv[index + 1] : undefined;
+}
+
+function resolveTargetVersion(): string {
+  const explicit = getFlagValue('--to');
+  if (explicit) {
+    return explicit;
+  }
+  const tag = getFlagValue('--tag') ?? 'latest';
+  const version = execFileSync('npm', ['view', `${CDK_PACKAGE}@${tag}`, 'version'], { encoding: 'utf-8' }).trim();
+  if (!version) {
+    throw new Error(`could not resolve ${CDK_PACKAGE}@${tag} from npm`);
+  }
+  return version;
+}
+
+function main(): void {
+  const dryRun = process.argv.includes('--dry-run');
+  const target = resolveTargetVersion();
+
+  const pkg = JSON.parse(readFileSync(TEMPLATE_PATH, 'utf-8')) as { dependencies: Record<string, string> };
+  const current = pkg.dependencies[CDK_PACKAGE];
+
+  if (current === target) {
+    console.log(`${CDK_PACKAGE} already pinned to ${target} — no change`);
+    return;
+  }
+  if (dryRun) {
+    console.log(`[dry-run] ${CDK_PACKAGE}: ${current} -> ${target}`);
+    return;
+  }
+
+  pkg.dependencies[CDK_PACKAGE] = target;
+  writeFileSync(TEMPLATE_PATH, JSON.stringify(pkg, null, 2) + '\n');
+  console.log(`${CDK_PACKAGE}: ${current} -> ${target}`);
+}
+
+main();