feat: use jest -u if project has anti-tamper check

If the project CI runs with anti-tamper check, then it is safe to always
run jest with --updateSnapshot.

.github/workflows/release.yml

@@ -22,7 +22,7 @@ jobs:
       - run: yarn build
       - name: Anti-tamper check
         run: git diff --exit-code
-      - run: git push --follow-tags origin master
+      - run: git push --follow-tags origin $GITHUB_REF
       - name: Upload artifact
         uses: actions/upload-artifact@v2.1.1
         with:

package.json

@@ -13,7 +13,7 @@
   "scripts": {
     "projen": "node .projenrc.js && yarn install",
     "projen:upgrade": "yarn upgrade -L projen && yarn projen",
-    "test": "yarn eslint && jest --passWithNoTests",
+    "test": "yarn eslint && jest --passWithNoTests --updateSnapshot",
     "no-changes": "(git log --oneline -1 | grep -q \"chore(release):\") && echo \"No changes to release.\"",
     "bump": "yarn --silent no-changes || standard-version",
     "release": "yarn --silent no-changes || (yarn bump && git push --follow-tags origin master)",
@@ -23,7 +23,7 @@
     "build": "yarn compile && yarn test && yarn run package",
     "eslint": "eslint . --ext .ts",
     "test:watch": "jest --watch",
-    "test:update": "jest -u",
+    "test:update": "jest --updateSnapshot",
     "compat": "npx jsii-diff npm:$(node -p \"require('./package.json').name\") -k --ignore-file .compatignore || (echo \"\nUNEXPECTED BREAKING CHANGES: add keys such as 'removed:constructs.Node.of' to .compatignore to skip.\n\" && exit 1)",
     "docgen": "jsii-docgen",
     "bootstrap": "yarn install && yarn compile && yarn projen"

src/jest.ts

@@ -94,11 +94,19 @@ export class Jest extends Construct {
       };
     }
 
-    project.addTestCommands('jest --passWithNoTests');
+    const jestOpts = [ '--passWithNoTests' ];
+
+    // if the project has anti-tamper configured, it should be safe to always run tests
+    // with --updateSnapshot because if we forget to commit a snapshot change the CI build will fail.
+    if (project.antitamper) {
+      jestOpts.push('--updateSnapshot');
+    }
+
+    project.addTestCommands(`jest ${jestOpts.join(' ')}`);
 
     project.addScripts({
       'test:watch': 'jest --watch',
-      'test:update': 'jest -u',
+      'test:update': 'jest --updateSnapshot',
     });
 
     project.addFields({ jest: this.config });

src/node-project.ts

@@ -328,6 +328,11 @@ export class NodeProject extends Project {
   public readonly minNodeVersion?: string;
   public readonly maxNodeVersion?: string;
 
+  /**
+   * Indicates if workflows have anti-tamper checks.
+   */
+  public readonly antitamper: boolean;
+
   protected readonly npmDistTag: string;
 
   constructor(options: NodeProjectOptions) {
@@ -432,6 +437,10 @@ export class NodeProject extends Project {
     this._version = new Version(this);
     this.manifest.version = this.version;
 
+    // indicate if we have anti-tamper configured in our workflows. used by e.g. Jest
+    // to decide if we can always run with --updateSnapshot
+    this.antitamper = (options.buildWorkflow ?? true) && (options.antitamper ?? true);
+
     if (options.buildWorkflow ?? true) {
       this.buildWorkflow = new NodeBuildWorkflow(this, 'Build', {
         trigger: {
@@ -441,7 +450,7 @@ export class NodeProject extends Project {
         nodeVersion: options.workflowNodeVersion ?? this.minNodeVersion,
         bootstrapSteps: options.workflowBootstrapSteps,
         image: options.workflowContainerImage,
-        antitamper: options.antitamper,
+        antitamper: this.antitamper,
       });
     }
 
@@ -465,7 +474,7 @@ export class NodeProject extends Project {
         nodeVersion: options.workflowNodeVersion ?? this.minNodeVersion,
         bootstrapSteps: options.workflowBootstrapSteps,
         image: options.workflowContainerImage,
-        antitamper: options.antitamper,
+        antitamper: this.antitamper,
       });
 
       if (options.releaseToNpm) {