chore: new prlint rule to protect the metadata.ts file against manual…

… changes (#28007)

Only automated changes to the `packages/aws-cdk-lib/region-info/build-tools/metadata.ts` file are allowed.

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

tools/@aws-cdk/prlint/lint.ts

@@ -567,6 +567,11 @@ export class PullRequestLinter {
       testRuleSet: [{ test: noCliChanges }],
     });
 
+    validationCollector.validateRuleSet({
+      exemption: (pr) => pr.user?.login === 'aws-cdk-automation',
+      testRuleSet: [{ test: noMetadataChanges }],
+    })
+
     await this.deletePRLinterComment();
     try {
       await this.communicateResult(validationCollector);
@@ -732,13 +737,13 @@ function validateTitleScope(pr: GitHubPr): TestResult {
 
 /**
  * Check that the PR is not opened from main branch of author's fork
- * 
+ *
  * @param pr github pr
  * @returns test result
  */
 function validateBranch(pr: GitHubPr): TestResult {
   const result = new TestResult();
-  
+
   if (pr.head && pr.head.ref) {
     result.assessFailure(pr.head.ref === 'main', PR_FROM_MAIN_ERROR);
   }
@@ -766,6 +771,13 @@ function noCliChanges(pr: GitHubPr, files: GitHubFile[]): TestResult {
   );
 }
 
+function noMetadataChanges(_pr: GitHubPr, files: GitHubFile[]): TestResult {
+  const result = new TestResult();
+  const condition = files.some(file => file.filename === 'packages/aws-cdk-lib/region-info/build-tools/metadata.ts');
+  result.assessFailure(condition, 'Manual changes to the metadata.ts file are not allowed.');
+  return result;
+}
+
 require('make-runnable/custom')({
   printOutputFrame: false,
 });

tools/@aws-cdk/prlint/test/lint.test.ts

@@ -1010,6 +1010,40 @@ describe('integration tests required on features', () => {
       expect(mockAddLabel.mock.calls).toEqual([]);
     });
   });
+
+  describe('metadata file changed', () => {
+    const files: linter.GitHubFile[] = [{
+      filename: 'packages/aws-cdk-lib/region-info/build-tools/metadata.ts',
+    }];
+
+    test('with aws-cdk-automation author', async () => {
+      const pr = {
+        title: 'chore: Update regions',
+        number: 1234,
+        labels: [],
+        user: {
+          login: 'aws-cdk-automation'
+        },
+      };
+
+      const prLinter = configureMock(pr, files);
+      await expect(prLinter.validatePullRequestTarget(SHA)).resolves;
+    });
+
+    test('with another author', async () => {
+      const pr = {
+        title: 'chore: Update regions',
+        number: 1234,
+        labels: [],
+        user: {
+          login: 'johndoe',
+        },
+      };
+
+      const prLinter = configureMock(pr, files);
+      await expect(prLinter.validatePullRequestTarget(SHA)).rejects.toThrow();
+    });
+  });
 });
 
 function configureMock(pr: Subset<linter.GitHubPr>, prFiles?: linter.GitHubFile[]): linter.PullRequestLinter {