Command to generate the app package without deploying (e.g. `bref package` like `serverless package`)

[oppiansteve]

Command to generate the app package without deploying (e.g. `bref package` like `serverless package`)

[mnapoli]

Hi, I'm currently exploring a new foundation for Bref (#99), so I'd rather keep the external API surface ("what can be done with bref") limited for now.

To better understand your need: why do you want to package separately from deployment?

[oppiansteve]

So that we can test on dev/stage exactly what is to be deployed to prod later (after tests are passed and signed-off).

Rebuilding, even using the NPM lock file doesn't guarantee that it will pull in the exact same code as you tested.

[oppiansteve]

plus have an explicit record of what was deployed for debugging/security audits

[mnapoli]

Rebuilding, even using the NPM lock file doesn't guarantee that it will pull in the exact same code as you tested.

Ohh, is that behavior specific to NPM? With Composer (and the lock file) you have a guarantee to have the same dependencies.

In any case that makes sense. I'll keep this in the TODO list, and with AWS SAM (again #99) this should be simple to do as SAM supports this out of the box.

[oppiansteve]

Yep, I should have specified the requirement rather than the potential solution - that's a bug-bear of mine, and I still did it!

I could be wrong, but, for NPM, tags can be moved, or the commits changed and there's no checking at install time that (source) hashes actually match what was needed. (Again, this might have improved since I last investigated).

Composer is much more resilient to change in this regard.

[oppiansteve]

AWS SAM looks very useful and a good choice it seems. Been meaning to investigate it more.

[mnapoli]

I confirm that this will be possible using AWS SAM (there is a separate command sam package).