chore(release): release v0.24.0 by open-constructs-cdktn[bot] · Pull Request #303 · open-constructs/cdk-terrain

open-constructs-cdktn · 2026-07-04T09:28:22Z

🤖 Release PR — merge to cut a new release. Kept open and rebased as commits land on `main`.

0.24.0

0.24.0 (2026-08-06)

⚠ BREAKING CHANGES

lib: validate Terraform function versions by default (#362)
deps: Require Node 22 minimum (#345)
lib: preserve symlinks in TerraformAsset walkers (#321)
cli: replace node-fetch with undici (#306)

Features

lib: canonical asset hashes behind the canonicalAssetHashes feature flag (#323) (76dd4ff)
lib: validate Terraform function versions by default (#362) (4ac0736)
support newer provider plugin-protocol features via targetVersions (RFC-04) (#296) (90322f9)

Bug Fixes

cli: don't downgrade prebuilt providers on a transient registry failure (#298) (a960c5c)
cli: include dev dependencies in npm version lookup (#280) (955204a)
docs: fix stale constructs pin breaking with()/IMixin docs (#305) (605cf63)
gha: Allow pnpm to update the lockfile after package updates (#318) (a899b7c)
gha: Fix pnpm upgrade workflow (#335) (e1a69fc)
gha: flip merged release PR label to autorelease: tagged (#302) (8d64f6c)
gha: mint the Go-publish token from the CDKTN Maintainers app (#369) (71921ce)
gha: mint the Go-publish token from the open-constructs-cdktn App (#368) (179f10c)
gha: pass the Go-publish App token as x-access-token userinfo (#370) (4e3ff19)
lib: Disallow constructs 10.8 until support can be added (#363) (8bdae0d)
lib: preserve symlinks in TerraformAsset walkers (#321) (6360e20)
typo in moveFromId JSDoc (#355) (e1cf8ce)

Miscellaneous Chores

cli: replace Ink + React with smaller-tree CLI libraries (#264) (a6aff7e)
cli: replace node-fetch with undici (#306) (1317141)
deps: bump glob to 13.0.6 (#307) (47ee2bb)
deps: bump the github-actions-backward-compatible group with 2 updates (#295) (eab2a01)
deps: replace lerna with nx (#315) (94999fc)
deps: Require Node 22 minimum (#345) (2bf315d)
deps: update ci-info to 4.4.0 across all packages (#329) (557a163)
deps: update fs-extra to 11.3.6 across all packages (#328) (95753a9)
deps: update minimatch to 10.2.5 (#330) (d1c1c53)
deps: Update sscaff to v2.0.388 (#331) (38ea0ba)
deps: Update zod to v4.4.3 (#332) (c10ee35)
deps: Upgrade dependencies (#347) (45d3a66)
remove cdktf from tests (#277) (dc9a8e9)
ship Terraform 1.15.8 in the jsii-terraform image (#367) (deaa9b0)
Upgrade dependencies for lib (#348) (d616f17)

This PR was generated with Release Please. See documentation.

so0k

LGTM

#368) ## Problem The `release_golang` job authenticates with `TERRAFORM_CDK_GO_REPO_GITHUB_TOKEN` — a user PAT that has expired. GitHub 401s the push, headless git falls back to an interactive password prompt, and the job dies: ``` fatal: could not read Password for 'https://***@github.com': No such device or address Command failed: git push origin cdktn/v0.24.0-pre.95 ``` Both the original `publish_next` run and a fresh rerun ([31085026499](https://github.com/open-constructs/cdk-terrain/actions/runs/31085026499)) failed identically, so this is credential death, not token-TTL flakiness. **This currently blocks the 0.24.0 release cut** (#303) — the stable flow publishes Go with the same secret. ## Fix Mint an installation token from the **open-constructs-cdktn** GitHub App ([installation 138220829](https://github.com/apps/open-constructs-cdktn/installations/138220829)) whose credentials are already in this repo's secrets (`GH_APP_ID` / `GH_APP_PRIVATE_KEY`), scoped to `cdk-terrain-go`, and use it as `GITHUB_TOKEN` for `publib-golang`. Fresh every run, expires in an hour, no PAT to rot. Same pinned `create-github-app-token@v2` SHA as release-please.yml / pnpm-upgrade.yml. If the App installation turns out not to cover `cdk-terrain-go`, the mint step fails fast with a clear error — fallback is rotating the PAT. Closes #66 (this was exactly the failure mode that issue predicted). ## Verification Merging this triggers the `next` pre-release flow on main, which will exercise the new token path end-to-end (expect `v0.24.0-pre.96` to land in cdk-terrain-go). A green `publish_next / Release Go to Github Repo (next)` is the all-clear to merge #303. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

@hoegertn

) Follow-up to #368. The `GH_APP_ID`/`GH_APP_PRIVATE_KEY` secrets — unused by any workflow for the 7 months before #368 adopted them — evidently do not describe an app installed on `cdk-terrain-go`: the mint fails with a 404 on the installation lookup ([run 31097478176](https://github.com/open-constructs/cdk-terrain/actions/runs/31097478176)) even after the repo was added to open-constructs-cdktn's installation. Switch `release_golang` to the **CDKTN Maintainers** app (`CDKTN_MAINTAINERS_APP_ID`/`_PRIVATE_KEY` org secrets) — the app `release-please.yml` and `pnpm-upgrade.yml` authenticate with successfully in this repo every day. ⚠️ One org-admin precondition: the maintainers app's installation must include **`cdk-terrain-go`** (with Contents: write). @hoegertn — the installation screenshot you shared listing `cdk-terrain`, `cdk-terrain-docs`, `cdk-terrain-go` — if that was this app's installation and it's saved, we're already set. Verification: merge triggers the `next` flow; a green `publish_next / Release Go to Github Repo (next)` with `v0.24.0-pre.96` in cdk-terrain-go is the all-clear to cut 0.24.0 (#303). 🤖 Generated with [Claude Code](https://claude.com/claude-code)

## Summary - The `release_github` job's "Mark merged release PR as tagged" step calls `gh pr edit` without an explicit repo, so `gh` shells out to `git` to auto-detect it. - That job runs inside the `jsii-terraform` container, where the checkout is owned by a different UID than the container user, so `git` refuses with "detected dubious ownership" and the step fails (exit code 1), even though the GitHub release itself already succeeded. - Fix: pass `-R "${{ github.repository }}"` to `gh pr edit` so it never needs `git` to infer the repo — smallest possible fix, no container/git config changes needed. Note: an alternative fix would be adding a `git config --global --add safe.directory /__w/cdk-terrain/cdk-terrain` step after checkout (as `prepare-release` and `prepare-next` already do), but passing `-R` avoids touching git config in the container entirely. Diagnosed from the failed run: https://github.com/open-constructs/cdk-terrain/actions/runs/31133236561/job/92730605482 As an immediate unblock, I've also manually relabeled the affected PR (#303) from `autorelease: pending` to `autorelease: tagged` so release-please can open the next release PR. ## Test plan - [ ] Next release run exercises the `release_github` job's relabel step and confirms `gh pr edit -R ...` succeeds inside the container

open-constructs#368) ## Problem The `release_golang` job authenticates with `TERRAFORM_CDK_GO_REPO_GITHUB_TOKEN` — a user PAT that has expired. GitHub 401s the push, headless git falls back to an interactive password prompt, and the job dies: ``` fatal: could not read Password for 'https://***@github.com': No such device or address Command failed: git push origin cdktn/v0.24.0-pre.95 ``` Both the original `publish_next` run and a fresh rerun ([31085026499](https://github.com/open-constructs/cdk-terrain/actions/runs/31085026499)) failed identically, so this is credential death, not token-TTL flakiness. **This currently blocks the 0.24.0 release cut** (open-constructs#303) — the stable flow publishes Go with the same secret. ## Fix Mint an installation token from the **open-constructs-cdktn** GitHub App ([installation 138220829](https://github.com/apps/open-constructs-cdktn/installations/138220829)) whose credentials are already in this repo's secrets (`GH_APP_ID` / `GH_APP_PRIVATE_KEY`), scoped to `cdk-terrain-go`, and use it as `GITHUB_TOKEN` for `publib-golang`. Fresh every run, expires in an hour, no PAT to rot. Same pinned `create-github-app-token@v2` SHA as release-please.yml / pnpm-upgrade.yml. If the App installation turns out not to cover `cdk-terrain-go`, the mint step fails fast with a clear error — fallback is rotating the PAT. Closes open-constructs#66 (this was exactly the failure mode that issue predicted). ## Verification Merging this triggers the `next` pre-release flow on main, which will exercise the new token path end-to-end (expect `v0.24.0-pre.96` to land in cdk-terrain-go). A green `publish_next / Release Go to Github Repo (next)` is the all-clear to merge open-constructs#303. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

@hoegertn

…pen-constructs#369) Follow-up to open-constructs#368. The `GH_APP_ID`/`GH_APP_PRIVATE_KEY` secrets — unused by any workflow for the 7 months before open-constructs#368 adopted them — evidently do not describe an app installed on `cdk-terrain-go`: the mint fails with a 404 on the installation lookup ([run 31097478176](https://github.com/open-constructs/cdk-terrain/actions/runs/31097478176)) even after the repo was added to open-constructs-cdktn's installation. Switch `release_golang` to the **CDKTN Maintainers** app (`CDKTN_MAINTAINERS_APP_ID`/`_PRIVATE_KEY` org secrets) — the app `release-please.yml` and `pnpm-upgrade.yml` authenticate with successfully in this repo every day. ⚠️ One org-admin precondition: the maintainers app's installation must include **`cdk-terrain-go`** (with Contents: write). @hoegertn — the installation screenshot you shared listing `cdk-terrain`, `cdk-terrain-docs`, `cdk-terrain-go` — if that was this app's installation and it's saved, we're already set. Verification: merge triggers the `next` flow; a green `publish_next / Release Go to Github Repo (next)` with `v0.24.0-pre.96` in cdk-terrain-go is the all-clear to cut 0.24.0 (open-constructs#303). 🤖 Generated with [Claude Code](https://claude.com/claude-code)

🤖 Release PR — merge to cut a new release. Kept open and rebased as commits land on `main`. --- <details><summary>0.24.0</summary> ## [0.24.0](open-constructs/cdk-terrain@v0.23.4...v0.24.0) (2026-08-06) ### ⚠ BREAKING CHANGES * **lib:** validate Terraform function versions by default ([open-constructs#362](open-constructs#362)) * **deps:** Require Node 22 minimum ([open-constructs#345](open-constructs#345)) * **lib:** preserve symlinks in TerraformAsset walkers ([open-constructs#321](open-constructs#321)) * **cli:** replace node-fetch with undici ([open-constructs#306](open-constructs#306)) ### Features * **lib:** canonical asset hashes behind the canonicalAssetHashes feature flag ([open-constructs#323](open-constructs#323)) ([76dd4ff](open-constructs@76dd4ff)) * **lib:** validate Terraform function versions by default ([open-constructs#362](open-constructs#362)) ([4ac0736](open-constructs@4ac0736)) * support newer provider plugin-protocol features via targetVersions (RFC-04) ([open-constructs#296](open-constructs#296)) ([90322f9](open-constructs@90322f9)) ### Bug Fixes * **cli:** don't downgrade prebuilt providers on a transient registry failure ([open-constructs#298](open-constructs#298)) ([a960c5c](open-constructs@a960c5c)) * **cli:** include dev dependencies in npm version lookup ([open-constructs#280](open-constructs#280)) ([955204a](open-constructs@955204a)) * **docs:** fix stale constructs pin breaking with()/IMixin docs ([open-constructs#305](open-constructs#305)) ([605cf63](open-constructs@605cf63)) * **gha:** Allow pnpm to update the lockfile after package updates ([open-constructs#318](open-constructs#318)) ([a899b7c](open-constructs@a899b7c)) * **gha:** Fix pnpm upgrade workflow ([open-constructs#335](open-constructs#335)) ([e1a69fc](open-constructs@e1a69fc)) * **gha:** flip merged release PR label to autorelease: tagged ([open-constructs#302](open-constructs#302)) ([8d64f6c](open-constructs@8d64f6c)) * **gha:** mint the Go-publish token from the CDKTN Maintainers app ([open-constructs#369](open-constructs#369)) ([71921ce](open-constructs@71921ce)) * **gha:** mint the Go-publish token from the open-constructs-cdktn App ([open-constructs#368](open-constructs#368)) ([179f10c](open-constructs@179f10c)) * **gha:** pass the Go-publish App token as x-access-token userinfo ([open-constructs#370](open-constructs#370)) ([4e3ff19](open-constructs@4e3ff19)) * **lib:** Disallow constructs 10.8 until support can be added ([open-constructs#363](open-constructs#363)) ([8bdae0d](open-constructs@8bdae0d)) * **lib:** preserve symlinks in TerraformAsset walkers ([open-constructs#321](open-constructs#321)) ([6360e20](open-constructs@6360e20)) * typo in `moveFromId` JSDoc ([open-constructs#355](open-constructs#355)) ([e1cf8ce](open-constructs@e1cf8ce)) ### Miscellaneous Chores * **cli:** replace Ink + React with smaller-tree CLI libraries ([open-constructs#264](open-constructs#264)) ([a6aff7e](open-constructs@a6aff7e)) * **cli:** replace node-fetch with undici ([open-constructs#306](open-constructs#306)) ([1317141](open-constructs@1317141)) * **deps:** bump glob to 13.0.6 ([open-constructs#307](open-constructs#307)) ([47ee2bb](open-constructs@47ee2bb)) * **deps:** bump the github-actions-backward-compatible group with 2 updates ([open-constructs#295](open-constructs#295)) ([eab2a01](open-constructs@eab2a01)) * **deps:** replace lerna with nx ([open-constructs#315](open-constructs#315)) ([94999fc](open-constructs@94999fc)) * **deps:** Require Node 22 minimum ([open-constructs#345](open-constructs#345)) ([2bf315d](open-constructs@2bf315d)) * **deps:** update ci-info to 4.4.0 across all packages ([open-constructs#329](open-constructs#329)) ([557a163](open-constructs@557a163)) * **deps:** update fs-extra to 11.3.6 across all packages ([open-constructs#328](open-constructs#328)) ([95753a9](open-constructs@95753a9)) * **deps:** update minimatch to 10.2.5 ([open-constructs#330](open-constructs#330)) ([d1c1c53](open-constructs@d1c1c53)) * **deps:** Update sscaff to v2.0.388 ([open-constructs#331](open-constructs#331)) ([38ea0ba](open-constructs@38ea0ba)) * **deps:** Update zod to v4.4.3 ([open-constructs#332](open-constructs#332)) ([c10ee35](open-constructs@c10ee35)) * **deps:** Upgrade dependencies ([open-constructs#347](open-constructs#347)) ([45d3a66](open-constructs@45d3a66)) * remove cdktf from tests ([open-constructs#277](open-constructs#277)) ([dc9a8e9](open-constructs@dc9a8e9)) * ship Terraform 1.15.8 in the jsii-terraform image ([open-constructs#367](open-constructs#367)) ([deaa9b0](open-constructs@deaa9b0)) * Upgrade dependencies for lib ([open-constructs#348](open-constructs#348)) ([d616f17](open-constructs@d616f17)) </details> --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). Co-authored-by: open-constructs-cdktn[bot] <291052431+open-constructs-cdktn[bot]@users.noreply.github.com>

…constructs#372) ## Summary - The `release_github` job's "Mark merged release PR as tagged" step calls `gh pr edit` without an explicit repo, so `gh` shells out to `git` to auto-detect it. - That job runs inside the `jsii-terraform` container, where the checkout is owned by a different UID than the container user, so `git` refuses with "detected dubious ownership" and the step fails (exit code 1), even though the GitHub release itself already succeeded. - Fix: pass `-R "${{ github.repository }}"` to `gh pr edit` so it never needs `git` to infer the repo — smallest possible fix, no container/git config changes needed. Note: an alternative fix would be adding a `git config --global --add safe.directory /__w/cdk-terrain/cdk-terrain` step after checkout (as `prepare-release` and `prepare-next` already do), but passing `-R` avoids touching git config in the container entirely. Diagnosed from the failed run: https://github.com/open-constructs/cdk-terrain/actions/runs/31133236561/job/92730605482 As an immediate unblock, I've also manually relabeled the affected PR (open-constructs#303) from `autorelease: pending` to `autorelease: tagged` so release-please can open the next release PR. ## Test plan - [ ] Next release run exercises the `release_github` job's relabel step and confirms `gh pr edit -R ...` succeeds inside the container

open-constructs-cdktn Bot requested a review from a team as a code owner July 4, 2026 09:28

open-constructs-cdktn Bot added autorelease: pending ci/skip-examples Skip Examples Testing in PR ci/skip-integration Skips Integration Testing on PR ci/skip-provider-integration Skips Provider Integration Tests on PR ci/skip-unit Skips Unit Testing on PR labels Jul 4, 2026

open-constructs-cdktn Bot force-pushed the release-please--branches--main branch 6 times, most recently from 8d1c52e to 409cd13 Compare July 9, 2026 04:29

so0k mentioned this pull request Jul 9, 2026

docs(tutorials): bump Node.js prerequisite to 22.19+ open-constructs/cdk-terrain-docs#28

Open

open-constructs-cdktn Bot changed the title ~~chore(release): release v0.23.5~~ chore(release): release v0.24.0 Jul 10, 2026

open-constructs-cdktn Bot force-pushed the release-please--branches--main branch 8 times, most recently from aadded0 to 3c934a1 Compare July 17, 2026 01:38

open-constructs-cdktn Bot force-pushed the release-please--branches--main branch 2 times, most recently from 28f71a3 to d1986e8 Compare July 18, 2026 22:22

sakul-learning mentioned this pull request Jul 19, 2026

Remove validateFunctionVersions feature flag before v0.24 release (graduate to always-on) #342

Closed

5 tasks

open-constructs-cdktn Bot force-pushed the release-please--branches--main branch 5 times, most recently from ba05f16 to 8a5d969 Compare July 24, 2026 08:51

eduardomourar mentioned this pull request Jul 25, 2026

feat: add cdktn support to projen projen/projen#4836

Merged

open-constructs-cdktn Bot force-pushed the release-please--branches--main branch from 8a5d969 to 40239cf Compare July 27, 2026 13:14

so0k approved these changes Jul 29, 2026

View reviewed changes

open-constructs-cdktn Bot force-pushed the release-please--branches--main branch 3 times, most recently from d7281da to 462f693 Compare August 6, 2026 08:28

so0k mentioned this pull request Aug 6, 2026

fix(gha): mint the Go-publish token from the open-constructs-cdktn App #368

Merged

open-constructs-cdktn Bot force-pushed the release-please--branches--main branch from 462f693 to ddfd1ef Compare August 6, 2026 11:30

so0k mentioned this pull request Aug 6, 2026

fix(gha): mint the Go-publish token from the CDKTN Maintainers app #369

Merged

open-constructs-cdktn Bot force-pushed the release-please--branches--main branch from ddfd1ef to e7dcf6f Compare August 6, 2026 14:29

chore(release): release v0.24.0

eb40731

open-constructs-cdktn Bot force-pushed the release-please--branches--main branch from e7dcf6f to eb40731 Compare August 6, 2026 14:57

so0k merged commit b91823e into main Aug 7, 2026
15 checks passed

so0k deleted the release-please--branches--main branch August 7, 2026 00:03

so0k added autorelease: tagged This PR represents a release that has been tagged and published and removed autorelease: pending labels Aug 7, 2026

so0k mentioned this pull request Aug 7, 2026

fix(gha): pass -R to gh pr edit in release_github relabel step #372

Merged

1 task

Navigation Menu

Uh oh!

chore(release): release v0.24.0 - #303

chore(release): release v0.24.0#303
so0k merged 1 commit into
mainfrom
release-please--branches--main

open-constructs-cdktn Bot commented Jul 4, 2026 •

edited

Loading

Uh oh!

so0k left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

open-constructs-cdktn Bot commented Jul 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🤖 Release PR — merge to cut a new release. Kept open and rebased as commits land on main.

0.24.0 (2026-08-06)

⚠ BREAKING CHANGES

Features

Bug Fixes

Miscellaneous Chores

Uh oh!

so0k left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

open-constructs-cdktn Bot commented Jul 4, 2026 •

edited

Loading

🤖 Release PR — merge to cut a new release. Kept open and rebased as commits land on `main`.