fix(cloudformation-diff): changeset-based diff hides static changes CloudFormation fails to detect

[mrgrain]

cdk diff reported "There were no differences" for changes CloudFormation changesets fail to detect, while cdk deploy still applied them. The reported case is a WAFv2 WebACL where an action switches from {"Allow":{}} to {"Block":{}}: exchanging one empty-object union member for another is invisible to CloudFormation's changeset engine. Verified against real CloudFormation — the changeset completes with an empty Changes list for exactly this update (reproduced with both CLOUDFRONT and REGIONAL scope, for DefaultAction and Rules[].Action). An internal ticket has been filed with the CloudFormation team for the underlying detection gap.

The template diff detects the change correctly, but the changeset merger then discards it: any template-detected property change that the changeset does not mention was overridden to "no change". That veto exists so the changeset can silence false positives on deploy-time values (e.g. an SSM-parameter-driven name that resolves to the same value, see #641) — but for a purely static difference the changeset has no better knowledge than the template, and its silence only means it failed to detect the change.

The merger now checks what kind of value changed before letting the changeset suppress it. If either side of the difference contains a deploy-time construct (Ref, an Fn::* intrinsic, or a {{resolve:...}} dynamic reference), the changeset verdict wins as before. A static difference is always kept. Unit tests that encoded the old blanket suppression were updated accordingly, and a regression test replays the WAF scenario against the empty changeset observed from the real service.

A new integration test deploys a WebACL from a dedicated waf-app fixture, flips the action, and asserts cdk diff --method=change-set surfaces the change (verified passing against a real account). Following recent guidance, the fixture is a standalone app rather than an addition to the shared default app; a note codifying that preference was added to AGENTS.md.

Fixes #1922

Checklist

• This change contains a major version upgrade for a dependency and I confirm all breaking changes are addressed
  • Release notes for the new version:

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 91.33%. Comparing base (03aebdc) to head (35910c3).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #1951   +/-   ##
=======================================
  Coverage   91.33%   91.33%           
=======================================
  Files          79       79           
  Lines       12164    12164           
  Branches     1721     1721           
=======================================
  Hits        11110    11110           
  Misses       1019     1019           
  Partials       35       35           

Flag	Coverage Δ
suite.unit	91.33% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.