test: stub Stage 2 for fork testing (DO NOT MERGE)

Temporary commit to validate the workflow_run artifact handoff on
ozelalisen/aws-cdk fork. Will be reverted after testing.

Author: ozelalisen

.github/workflows/integration-test-deployment-auto-trigger.yml

@@ -9,19 +9,34 @@ name: Integration Test Auto Trigger
 on:
   pull_request_review:
     types: [submitted]
+  # Manual trigger for testing (e.g., when self-approval is not possible on forks)
+  workflow_dispatch:
+    inputs:
+      pr_number:
+        description: 'PR number to test'
+        required: true
+      head_sha:
+        description: 'Head commit SHA'
+        required: true
+      base_sha:
+        description: 'Base commit SHA'
+        required: true
+      reviewer:
+        description: 'Reviewer login'
+        required: true
 
 permissions:
   contents: read
 
 jobs:
   save-pr-info:
-    if: github.event.review.state == 'approved'
+    if: github.event_name == 'workflow_dispatch' || github.event.review.state == 'approved'
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
         uses: actions/checkout@v6
         with:
-          ref: ${{ github.event.pull_request.head.sha }}
+          ref: ${{ github.event.inputs.head_sha || github.event.pull_request.head.sha }}
           fetch-depth: 0
 
       - name: Setup Node.js
@@ -38,8 +53,8 @@ jobs:
       - name: Check for snapshot changes
         id: check_snapshots
         env:
-          TARGET_BRANCH_COMMIT: ${{ github.event.pull_request.base.sha }}
-          SOURCE_BRANCH_COMMIT: ${{ github.event.pull_request.head.sha }}
+          TARGET_BRANCH_COMMIT: ${{ github.event.inputs.base_sha || github.event.pull_request.base.sha }}
+          SOURCE_BRANCH_COMMIT: ${{ github.event.inputs.head_sha || github.event.pull_request.head.sha }}
         run: |
           if yarn --cwd tools/@aws-cdk/integration-test-deployment check-snapshots; then
             echo "has_snapshots=true" >> $GITHUB_OUTPUT
@@ -49,10 +64,10 @@ jobs:
 
       - name: Save PR info
         env:
-          PR_NUMBER: ${{ github.event.pull_request.number }}
-          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
-          BASE_SHA: ${{ github.event.pull_request.base.sha }}
-          REVIEWER: ${{ github.event.review.user.login }}
+          PR_NUMBER: ${{ github.event.inputs.pr_number || github.event.pull_request.number }}
+          HEAD_SHA: ${{ github.event.inputs.head_sha || github.event.pull_request.head.sha }}
+          BASE_SHA: ${{ github.event.inputs.base_sha || github.event.pull_request.base.sha }}
+          REVIEWER: ${{ github.event.inputs.reviewer || github.event.review.user.login }}
           HAS_SNAPSHOTS: ${{ steps.check_snapshots.outputs.has_snapshots }}
         run: |
           mkdir -p ./pr

.github/workflows/integration-test-deployment-auto.yml

@@ -1,11 +1,8 @@
 name: Integration Test deployment (Auto)
 
-# Privileged workflow that runs integration tests when triggered by the
-# "Integration Test Auto Trigger" workflow. Uses workflow_run to run in the
-# base repo context with access to secrets, vars, and OIDC.
-#
-# SHADOW MODE: Failures don't block PR merges.
-# Once validated, this will replace the label-based workflow (integration-test-deployment.yml).
+# ⚠️ FORK TEST VERSION — DO NOT MERGE
+# Stubbed for testing the workflow_run artifact handoff on a fork.
+# Real version: see commit 49066b8463
 
 on:
   workflow_run:
@@ -44,103 +41,43 @@ jobs:
           echo "base_sha=$(cat pr/base_sha)" >> "$GITHUB_OUTPUT"
           echo "reviewer=$(cat pr/reviewer)" >> "$GITHUB_OUTPUT"
           echo "has_snapshots=$(cat pr/has_snapshots)" >> "$GITHUB_OUTPUT"
+          echo "::notice::PR #$(cat pr/pr_number) | head=$(cat pr/head_sha) | base=$(cat pr/base_sha) | reviewer=$(cat pr/reviewer) | snapshots=$(cat pr/has_snapshots)"
 
+  # FORK TEST: Skip real team check, just validate the handoff worked
   validate-approver:
     needs: download-pr-info
     if: needs.download-pr-info.outputs.has_snapshots == 'true'
     runs-on: ubuntu-latest
     outputs:
       is_member: ${{ steps.check_team.outputs.is_member }}
     steps:
-      - name: Check if approver is CDK team member
+      - name: "FORK TEST: Stub team check"
         id: check_team
-        env:
-          GITHUB_TOKEN: ${{ secrets.PROJEN_GITHUB_TOKEN }}
-          APPROVER: ${{ needs.download-pr-info.outputs.reviewer }}
         run: |
-          if gh api "orgs/aws/teams/aws-cdk-team/memberships/${APPROVER}" --jq '.state' 2>/dev/null | grep -q "active"; then
-            echo "${APPROVER} is an active CDK team member"
-            echo "is_member=true" >> $GITHUB_OUTPUT
-          else
-            echo "${APPROVER} is not a CDK team member or membership is not active"
-            echo "is_member=false" >> $GITHUB_OUTPUT
-          fi
+          echo "::notice::FORK TEST — skipping real team check for reviewer: ${{ needs.download-pr-info.outputs.reviewer }}"
+          echo "is_member=true" >> $GITHUB_OUTPUT
 
+  # FORK TEST: Replace deployment with a summary of what would run
   integration_test_deployment_auto:
     needs: [download-pr-info, validate-approver]
     if: needs.validate-approver.outputs.is_member == 'true'
-    runs-on: codebuild-aws-cdk-github-actions-deployment-integ-runner-${{ github.run_id }}-${{ github.run_attempt }}
-    # Shadow mode: workflow reports success even if tests fail
+    runs-on: ubuntu-latest
     continue-on-error: true
     name: 'Deploy integration test snapshots (Auto)'
-
-    permissions:
-      id-token: write # Required for OIDC authentication with AWS Atmosphere
-      contents: read
-
-    env:
-      PR_BUILD: true
-
     steps:
-      - name: Checkout HEAD
-        uses: actions/checkout@v6
-        with:
-          ref: ${{ needs.download-pr-info.outputs.head_sha }}
-          fetch-depth: 0
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v6
-        with:
-          node-version: "lts/*"
-          cache: "yarn"
-          cache-dependency-path: |
-            yarn.lock
-
-      - name: Set up Docker
-        uses: docker/setup-buildx-action@v4
-
-      - name: Load Docker images
-        id: docker-cache
-        uses: actions/cache/restore@v5
-        with:
-          path: |
-            ~/.docker-images.tar
-          key: docker-cache-${{ runner.os }}
-
-      - name: Restore Docker images
-        if: ${{ steps.docker-cache.outputs.cache-hit }}
-        run: docker image load --input ~/.docker-images.tar
-
-      - name: Cache build artifacts
-        uses: actions/cache@v5
-        with:
-          path: |
-            ~/.s3buildcache
-          key: s3buildcache-${{ runner.os }}
-
-      - name: Configure system settings
+      - name: "FORK TEST: Deployment stub"
         run: |
-          (command -v sysctl || sudo apt-get update && sudo apt-get install -y procps) && \
-          sudo sysctl -w vm.max_map_count=2251954
-
-      - name: Install dependencies for Integration Tests
-        run: yarn install --frozen-lockfile
-
-      - name: Build deployment-integ
-        run: yarn --cwd tools/@aws-cdk/integration-test-deployment build
-
-      - name: Build Integration Test packages
-        run: npx lerna run build --scope="{@aws-cdk/*,@aws-cdk-testing/framework-integ}"
-
-      - name: Run integration tests
-        run: yarn run atmosphere-integ-test
-        env:
-          CDK_ATMOSPHERE_ENDPOINT: ${{ vars.CDK_ATMOSPHERE_ENDPOINT }}
-          CDK_ATMOSPHERE_POOL: ${{ vars.CDK_ATMOSPHERE_POOL }}
-          CDK_ATMOSPHERE_OIDC_ROLE: ${{ vars.CDK_ATMOSPHERE_OIDC_ROLE }}
-          CDK_ATMOSPHERE_BATCH_SIZE: ${{ vars.CDK_ATMOSPHERE_BATCH_SIZE }}
-          TARGET_BRANCH_COMMIT: ${{ needs.download-pr-info.outputs.base_sha }}
-          SOURCE_BRANCH_COMMIT: ${{ needs.download-pr-info.outputs.head_sha }}
-          GITHUB_TOKEN: ${{ secrets.PROJEN_GITHUB_TOKEN }}
-          GITHUB_REPOSITORY: ${{ github.repository }}
-          PR_NUMBER: ${{ needs.download-pr-info.outputs.pr_number }}
+          echo "========================================="
+          echo "  FORK TEST — Full chain validated! ✅"
+          echo "========================================="
+          echo ""
+          echo "PR Number:  ${{ needs.download-pr-info.outputs.pr_number }}"
+          echo "Head SHA:   ${{ needs.download-pr-info.outputs.head_sha }}"
+          echo "Base SHA:   ${{ needs.download-pr-info.outputs.base_sha }}"
+          echo "Reviewer:   ${{ needs.download-pr-info.outputs.reviewer }}"
+          echo "Snapshots:  ${{ needs.download-pr-info.outputs.has_snapshots }}"
+          echo ""
+          echo "In production, this job would:"
+          echo "  1. Run on codebuild runner"
+          echo "  2. Authenticate via OIDC to AWS Atmosphere"
+          echo "  3. Build and deploy integration tests"