fix(codepipeline): cross-env pipeline cannot be created in Stage (#17730)

Because a cross-environment pipeline cannot be created in `Stage`,
it cannot be deployed using CDK Pipelines.

The error is:

```
Error: You cannot add a dependency from 'AAA' (in Stage 'BBB') to 'CCC' (in the App): dependency cannot cross stage boundaries
```

Root cause is that the `Pipeline` construct creates a support stack
in the `App` scope, which is outside its containing `Stage`, and hence
the dependency crosses stage boundaries.

Fixes #17643.


----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

Author: rix0rrr

packages/@aws-cdk/aws-codepipeline/lib/pipeline.ts

@@ -4,8 +4,18 @@ import * as iam from '@aws-cdk/aws-iam';
 import * as kms from '@aws-cdk/aws-kms';
 import * as s3 from '@aws-cdk/aws-s3';
 import {
-  App, ArnFormat, BootstraplessSynthesizer, DefaultStackSynthesizer,
-  IStackSynthesizer, Lazy, Names, PhysicalName, RemovalPolicy, Resource, Stack, Token,
+  ArnFormat,
+  BootstraplessSynthesizer,
+  DefaultStackSynthesizer,
+  IStackSynthesizer,
+  Lazy,
+  Names,
+  PhysicalName,
+  RemovalPolicy,
+  Resource,
+  Stack,
+  Stage as CdkStage,
+  Token,
 } from '@aws-cdk/core';
 import { Construct } from 'constructs';
 import { ActionCategory, IAction, IPipeline, IStage, PipelineNotificationEvents, PipelineNotifyOnOptions } from './action';
@@ -620,7 +630,7 @@ export class Pipeline extends PipelineBase {
       throw new Error("You need to specify an explicit account when using CodePipeline's cross-region support");
     }
 
-    const app = this.requireApp();
+    const app = this.supportScope();
     const supportStackId = `cross-region-stack-${pipelineAccount}:${actionRegion}`;
     let supportStack = app.node.tryFindChild(supportStackId) as CrossRegionSupportStack;
     if (!supportStack) {
@@ -816,7 +826,7 @@ export class Pipeline extends PipelineBase {
     let targetAccountStack: Stack | undefined = this._crossAccountSupport[targetAccount];
     if (!targetAccountStack) {
       const stackId = `cross-account-support-stack-${targetAccount}`;
-      const app = this.requireApp();
+      const app = this.supportScope();
       targetAccountStack = app.node.tryFindChild(stackId) as Stack;
       if (!targetAccountStack) {
         const actionRegion = action.actionProperties.resource
@@ -1026,12 +1036,12 @@ export class Pipeline extends PipelineBase {
     return region;
   }
 
-  private requireApp(): App {
-    const app = this.node.root;
-    if (!app || !App.isApp(app)) {
-      throw new Error('Pipeline stack which uses cross-environment actions must be part of a CDK app');
+  private supportScope(): CdkStage {
+    const scope = CdkStage.of(this);
+    if (!scope) {
+      throw new Error('Pipeline stack which uses cross-environment actions must be part of a CDK App or Stage');
     }
-    return app;
+    return scope;
   }
 }
 

packages/@aws-cdk/aws-codepipeline/test/cross-env.test.ts

@@ -1,13 +1,20 @@
 import '@aws-cdk/assert-internal/jest';
 import * as iam from '@aws-cdk/aws-iam';
 import * as s3 from '@aws-cdk/aws-s3';
-import { Stack, App } from '@aws-cdk/core';
+import { Stack, App, Stage as CdkStage } from '@aws-cdk/core';
+import { Construct } from 'constructs';
 import * as codepipeline from '../lib';
 import { FakeBuildAction } from './fake-build-action';
 import { FakeSourceAction } from './fake-source-action';
 
-describe.each(['legacy', 'modern'])('with %s synthesis', (synthesisStyle: string) => {
+describe.each([
+  ['legacy', false],
+  ['legacy', true],
+  ['modern', false],
+  ['modern', true],
+])('with %s synthesis, in Stage=%p', (synthesisStyle: string, inStage: boolean) => {
   let app: App;
+  let stackScope: Construct;
   let stack: Stack;
   let sourceArtifact: codepipeline.Artifact;
   let initialStages: codepipeline.StageProps[];
@@ -18,7 +25,9 @@ describe.each(['legacy', 'modern'])('with %s synthesis', (synthesisStyle: string
         ...synthesisStyle === 'modern' ? { '@aws-cdk/core:newStyleStackSynthesis': true } : undefined,
       },
     });
-    stack = new Stack(app, 'PipelineStack', { env: { account: '2222', region: 'us-east-1' } });
+    stackScope = inStage ? new CdkStage(app, 'MyStage') : app;
+
+    stack = new Stack(stackScope, 'PipelineStack', { env: { account: '2222', region: 'us-east-1' } });
     sourceArtifact = new codepipeline.Artifact();
     initialStages = [
       {
@@ -114,7 +123,8 @@ describe.each(['legacy', 'modern'])('with %s synthesis', (synthesisStyle: string
         }));
 
         // THEN
-        const asm = app.synth();
+        let asm = app.synth();
+        asm = inStage ? asm.getNestedAssembly('assembly-MyStage') : asm;
         const supportStack = asm.getStackByName(`${stack.stackName}-support-eu-west-1`);
 
         // THEN
@@ -123,7 +133,7 @@ describe.each(['legacy', 'modern'])('with %s synthesis', (synthesisStyle: string
       });
 
       test('when twiddling another stack', () => {
-        const stack2 = new Stack(app, 'Stack2', { env: { account: '2222', region: 'eu-west-1' } });
+        const stack2 = new Stack(stackScope, 'Stack2', { env: { account: '2222', region: 'eu-west-1' } });
 
         // WHEN
         stage.addAction(new FakeBuildAction({