fix(build): refuse a --build-dir that would delete the project

[bnusunny]

Which issue(s) does this change fix?

Fixes #9327

Why is this change necessary?

sam build deletes --build-dir before it builds. The only guard (#1403) refuses the working directory itself. So sam build --build-dir .. deletes the whole project and everything beside it, and sam build -t proj/template.yaml --build-dir proj deletes the template and its source. --build-dir .aws-sam builds, but deletes SAM CLI's own build cache, dependencies and pipeline config on every run.

How does it address the issue?

--build-dir	Before	After
., .., any parent of the working directory	. refused, parents deleted	all refused, nothing deleted
a dir that is or contains the template's directory or --base-dir, e.g. -t proj/template.yaml -b proj	project deleted, then "Template file not found"	refused, nothing deleted
.aws-sam, .aws-sam/cache, .aws-sam/deps, or a dir containing --cache-dir	state deleted silently	same build, plus a warning that this will not be supported in a future release
.aws-sam/build (default), .aws-sam/auto-dependency-layer, any other dir	builds	unchanged

_setup_build_dir in samcli/commands/build/build_context.py compares paths with a new is_same_or_ancestor helper in samcli/lib/utils/path_utils.py. The helper uses os.path.commonpath and normcase, so it ignores case on Windows. The .aws-sam case warns rather than fails, because some users pass it today. There is no warning when clean is false, since nothing is removed then. DEFAULT_SAM_DIR is a new constant in samcli/commands/_utils/constants.py.

What side effects does this change have?

• A --build-dir that is or contains the working directory, the template's directory or the base dir now fails instead of deleting it.
• --build-dir .aws-sam and similar now print a warning; the build itself is unchanged.
• The .aws-sam entry overlaps with the deps-dir entry, which already sits inside .aws-sam. It is kept so the rule still holds if the deps dir ever moves.

Mandatory Checklist

PRs will only be reviewed after checklist is complete

• Review the generative AI contribution guidelines
• Add input/output type hints to new functions/methods
• Write design document if needed (Do I need to write a design document?)
• Write/update unit tests
• Write/update integration tests
• Write/update functional tests if needed
• make pr passes
• make update-reproducible-reqs if dependencies were changed
• Write documentation

Notes on the unchecked items:

• Tests:

  • Unit: the tests in tests/unit/commands/buildcmd/test_build_context.py and tests/unit/lib/utils/test_path_utils.py cover every row of the table on a real temporary filesystem. The helper also has Windows-path cases. Reverting either guard turns them red.

  • Integration: TestBuildCommand_BuildDirGuard in tests/integration/buildcmd/test_build_cmd.py runs a real sam build for four cases:

    • .. and ../.. are refused, and the project and a file next to it survive;
    • -t proj/template.yaml --build-dir proj is refused, and the template and source survive;
    • .aws-sam and .aws-sam/cache warn and still build;
    • the default build dir builds without a warning.

    Against released 1.166.2, the five guarded cases fail and the default case passes.

• make pr: ruff, black, mypy and the build/sync/_utils unit tests pass locally; the full suite is left to CI.
• No dependency changes. The --build-dir help text already says the directory is removed first.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

[licjun]

The change LGTM, I just think of a strange case, sam build -t proj/template.yaml --build-dir proj, i think this build will fail since the template.yaml will be deteled, is this something we should worry about?

[bnusunny]

Good catch, and it's worse than a failed build: run from proj's parent, sam build -t proj/template.yaml --build-dir proj deletes proj (template and source), then fails with "Template file not found". The guard only looked at the working directory and its parents.

Fixed in 56a66da: the build dir now must not be or contain the working directory, the template's directory, or --base-dir. That case is refused with nothing deleted, and TestBuildCommand_BuildDirGuard.test_build_dir_containing_template_dir_is_refused covers it (it fails on 1.166.2).

[aws-sam-tooling-bot]

Code Review Results

Reviewed: b73a020..56a66da
Files: 6
Comments: 1