fix(assets): fix(assets): invalid fingerprint when 'exclude' captures root directory name (#7719)

When creating an asset from a directory with certain exclude options, the fingerprint does not change even if the files change.

If a fingerprint is calculated over a directory with exclude options `[ '**', '!file' ]`, the code never descends into the directory.

This commit skips the exclude check for the root directory, to correctly handle negated expressions in the exclude options.

fixes #7718

Author: christophgysin

packages/@aws-cdk/aws-s3-deployment/test/test.bucket-deployment.ts

@@ -228,7 +228,7 @@ export = {
         ],
       },
       'SourceBucketNames': [{
-        'Ref': 'AssetParameterse9b696b2a8a1f93ea8b8a9ce1e4dd4727f9243eba984e50411ca95c6b03d26b6S3Bucket1A1EC3E9',
+        'Ref': 'AssetParameters86f8bca4f28a0bcafef0a98fe4cea25c0071aca27401e35cfaecd06313373bcaS3BucketB41AE64D',
       }],
       'SourceObjectKeys': [{
         'Fn::Join': [
@@ -241,7 +241,7 @@ export = {
                   'Fn::Split': [
                     '||',
                     {
-                      'Ref': 'AssetParameterse9b696b2a8a1f93ea8b8a9ce1e4dd4727f9243eba984e50411ca95c6b03d26b6S3VersionKeyE46A4824',
+                      'Ref': 'AssetParameters86f8bca4f28a0bcafef0a98fe4cea25c0071aca27401e35cfaecd06313373bcaS3VersionKeyF3CBA38F',
                     },
                   ],
                 },
@@ -254,7 +254,7 @@ export = {
                   'Fn::Split': [
                     '||',
                     {
-                      'Ref': 'AssetParameterse9b696b2a8a1f93ea8b8a9ce1e4dd4727f9243eba984e50411ca95c6b03d26b6S3VersionKeyE46A4824',
+                      'Ref': 'AssetParameters86f8bca4f28a0bcafef0a98fe4cea25c0071aca27401e35cfaecd06313373bcaS3VersionKeyF3CBA38F',
                     },
                   ],
                 },

packages/@aws-cdk/core/lib/fs/fingerprint.ts

@@ -33,12 +33,13 @@ export function fingerprint(fileOrDirectory: string, options: FingerprintOptions
   if (exclude.length) {
     _hashField(hash, 'options.exclude', JSON.stringify(exclude));
   }
-  _processFileOrDirectory(fileOrDirectory);
+  const isDir = fs.statSync(fileOrDirectory).isDirectory();
+  _processFileOrDirectory(fileOrDirectory, isDir);
 
   return hash.digest('hex');
 
-  function _processFileOrDirectory(symbolicPath: string, realPath = symbolicPath) {
-    if (shouldExclude(exclude, symbolicPath)) {
+  function _processFileOrDirectory(symbolicPath: string, isRootDir: boolean = false, realPath = symbolicPath) {
+    if (!isRootDir && shouldExclude(exclude, symbolicPath)) {
       return;
     }
 
@@ -49,15 +50,15 @@ export function fingerprint(fileOrDirectory: string, options: FingerprintOptions
       const linkTarget = fs.readlinkSync(realPath);
       const resolvedLinkTarget = path.resolve(path.dirname(realPath), linkTarget);
       if (shouldFollow(follow, rootDirectory, resolvedLinkTarget)) {
-        _processFileOrDirectory(symbolicPath, resolvedLinkTarget);
+        _processFileOrDirectory(symbolicPath, false, resolvedLinkTarget);
       } else {
         _hashField(hash, `link:${relativePath}`, linkTarget);
       }
     } else if (stat.isFile()) {
       _hashField(hash, `file:${relativePath}`, _contentFingerprint(realPath, stat));
     } else if (stat.isDirectory()) {
       for (const item of fs.readdirSync(realPath).sort()) {
-        _processFileOrDirectory(path.join(symbolicPath, item), path.join(realPath, item));
+        _processFileOrDirectory(path.join(symbolicPath, item), false, path.join(realPath, item));
       }
     } else {
       throw new Error(`Unable to hash ${symbolicPath}: it is neither a file nor a directory`);

packages/@aws-cdk/core/test/fs/test.fs-fingerprint.ts

@@ -166,6 +166,20 @@ export = {
       const f1 = FileSystem.fingerprint(dir, options1);
       const f2 = FileSystem.fingerprint(dir, options2);
 
+      // THEN
+      test.notDeepEqual(f1, f2);
+      test.done();
+    },
+    'considers negated exclude patterns for fingerprint'(test: Test) {
+      // GIVEN
+      const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'fingerprint-tests'));
+      const options = {path: dir, exclude: ['**', '!file.txt'], sourcePath: dir};
+
+      // WHEN
+      const f1 = FileSystem.fingerprint(dir, options);
+      fs.writeFileSync(path.join(dir, 'file.txt'), 'data');
+      const f2 = FileSystem.fingerprint(dir, options);
+
       // THEN
       test.notDeepEqual(f1, f2);
       test.done();