@codedrifters/configulator 0.0.125 → 0.0.127

package/lib/index.d.mts

@@ -399,10 +399,17 @@ declare const VERSION: {
      * What version of the turborepo library should we use?
      */
     readonly TURBO_VERSION: "2.8.14";
+    /**
+     * What version of Vite to use (pnpm override). Pinned to 5.x so Vitest 4.x
+     * can load config (Vite 6+/7+ are ESM-only; see issue #142). Remove override
+     * when moving to ESM-only test setup.
+     */
+    readonly VITE_VERSION: "5.4.11";
     /**
      * What version of Vitest to use when testRunner is 'vitest'.
+     * Pinned to 3.x so it works with Vite 5 (Vitest 4 requires Vite 6). See issue #142.
      */
-    readonly VITEST_VERSION: "4.0.18";
+    readonly VITEST_VERSION: "3.2.4";
 };
 
 /**
@@ -421,8 +428,9 @@ declare const VERSION_NPM_PACKAGES: ReadonlyArray<{
     npmPackage: string;
 }>;
 /**
- * VERSION keys that are not backed by npm and must be skipped by
- * auto-update (e.g. runtime versions like Node.js).
+ * VERSION keys that are not backed by npm or must be skipped by
+ * auto-update (e.g. runtime versions like Node.js, or pinned deps like
+ * VITE_VERSION until ESM-only test setup).
  */
 declare const VERSION_KEYS_SKIP: ReadonlyArray<VersionKey>;
 
@@ -1176,6 +1184,71 @@ declare class TurboRepo extends Component$1 {
     preSynthesize(): void;
 }
 
+/** Merge methods supported by enable-pull-request-automerge. */
+declare const MERGE_METHODS: {
+    readonly SQUASH: "squash";
+    readonly MERGE: "merge";
+    readonly REBASE: "rebase";
+};
+/** Merge method for the approve-and-merge-upgrade workflow. */
+type MergeMethod = (typeof MERGE_METHODS)[keyof typeof MERGE_METHODS];
+/**
+ * Options for the approve-and-merge-upgrade workflow (ADR 0001 §2).
+ * When set, adds a workflow that approves and merges the dependency-upgrade PR
+ * when it has the auto-approve label and head branch matches. Trigger types
+ * exclude `opened` to prevent double approval when the PR is created with the label.
+ */
+interface ApproveMergeUpgradeOptions {
+    /**
+     * Workflow file name (display name in Actions tab).
+     * @default "approve-and-merge-upgrade"
+     */
+    readonly workflowName?: string;
+    /**
+     * Label that must be present on the PR to trigger approve-and-merge.
+     * @default "auto-approve"
+     */
+    readonly autoApproveLabel?: string;
+    /**
+     * Head branch name the PR must target (e.g. the branch created by the upgrade workflow).
+     * @default "github-actions/upgrade"
+     */
+    readonly headBranch?: string;
+    /**
+     * GitHub usernames allowed as PR authors (e.g. automation bot logins).
+     * The workflow runs only when the PR user is in this list.
+     */
+    readonly allowedUsernames: string[];
+    /**
+     * Repository secret name for the approval GitHub App ID.
+     * @default "APPROVAL_APP_ID"
+     */
+    readonly approvalAppIdSecret?: string;
+    /**
+     * Repository secret name for the approval GitHub App private key (PEM).
+     * @default "APPROVAL_APP_PRIVATE_KEY"
+     */
+    readonly approvalAppPrivateKeySecret?: string;
+    /**
+     * Merge method for enable-pull-request-automerge.
+     * @default "squash"
+     */
+    readonly mergeMethod?: MergeMethod;
+    /**
+     * Optional branch filters for pull_request_target (e.g. base branches).
+     * @see https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#pull_request_target
+     */
+    readonly branches?: string[];
+}
+/**
+ * Adds the approve-and-merge-upgrade workflow to the project.
+ * Uses a GitHub App token for approve + enable automerge (squash by default).
+ *
+ * @param project - A NodeProject with GitHub (e.g. MonorepoProject)
+ * @param options - Options for the workflow; allowedUsernames is required
+ */
+declare function addApproveMergeUpgradeWorkflow(project: NodeProject, options: ApproveMergeUpgradeOptions): void;
+
 /*******************************************************************************
  *
  * Monorepo Root Project
@@ -1243,6 +1316,15 @@ interface MonorepoProjectOptions extends Omit<TypeScriptProjectOptions$1, "defau
      * @default: daily schedule
      */
     readonly upgradeConfigulatorTaskOptions?: UpgradeDependenciesOptions;
+    /**
+     * When set, adds the approve-and-merge-upgrade workflow (ADR 0001 §2).
+     * Uses a second GitHub App to approve and merge the dependency-upgrade PR
+     * when it has the auto-approve label and head branch matches. Trigger types
+     * exclude `opened` to prevent double approval.
+     *
+     * @see ApproveMergeUpgradeOptions
+     */
+    readonly approveMergeUpgradeOptions?: ApproveMergeUpgradeOptions;
 }
 declare class MonorepoProject extends TypeScriptAppProject {
     /**
@@ -1504,4 +1586,17 @@ declare class AwsDeployWorkflow extends Component {
     preSynthesize(): void;
 }
 
-export { type AwsAccount, AwsDeployWorkflow, AwsDeploymentConfig, AwsDeploymentTarget, type AwsDeploymentTargetOptions, type AwsLocalDeploymentConfig, type AwsOrganization, type AwsRegion, type CiDeploymentConfig, type ClassTypeOptions, type DeployWorkflowOptions, type GitBranch, type IDependencyResolver, JsiiFaker, MIMIMUM_RELEASE_AGE, MonorepoProject, type MonorepoProjectOptions, PROD_DEPLOY_NAME, PnpmWorkspace, type PnpmWorkspaceOptions, ROOT_CI_TASK_NAME, ROOT_TURBO_TASK_NAME, type RemoteCacheOptions, ResetTask, type ResetTaskOptions, TestRunner, TurboRepo, type TurboRepoOptions, TurboRepoTask, type TurboRepoTaskOptions, TypeScriptConfig, TypeScriptProject, type TypeScriptProjectOptions, VERSION, VERSION_KEYS_SKIP, VERSION_NPM_PACKAGES, VSCodeConfig, type VersionKey, Vitest, type VitestConfigOptions, type VitestOptions, getLatestEligibleVersion };
+/** Name of the gate job appended to build workflows (ADR 0004). */
+declare const COMPLETE_JOB_ID = "complete";
+/**
+ * Appends the "complete" gate job to a build workflow (ADR 0004, issue #165).
+ * The job runs after all other jobs, uses {@code if: always()}, and succeeds
+ * only when the build job succeeded and every other job succeeded or was skipped.
+ * Call this for the default build workflow and for any build workflow created
+ * by Configulator (e.g. AwsDeployWorkflow).
+ *
+ * @param buildWorkflow The Projen BuildWorkflow to append the complete job to.
+ */
+declare function addBuildCompleteJob(buildWorkflow: BuildWorkflow): void;
+
+export { type ApproveMergeUpgradeOptions, type AwsAccount, AwsDeployWorkflow, AwsDeploymentConfig, AwsDeploymentTarget, type AwsDeploymentTargetOptions, type AwsLocalDeploymentConfig, type AwsOrganization, type AwsRegion, COMPLETE_JOB_ID, type CiDeploymentConfig, type ClassTypeOptions, type DeployWorkflowOptions, type GitBranch, type IDependencyResolver, JsiiFaker, MERGE_METHODS, MIMIMUM_RELEASE_AGE, type MergeMethod, MonorepoProject, type MonorepoProjectOptions, PROD_DEPLOY_NAME, PnpmWorkspace, type PnpmWorkspaceOptions, ROOT_CI_TASK_NAME, ROOT_TURBO_TASK_NAME, type RemoteCacheOptions, ResetTask, type ResetTaskOptions, TestRunner, TurboRepo, type TurboRepoOptions, TurboRepoTask, type TurboRepoTaskOptions, TypeScriptConfig, TypeScriptProject, type TypeScriptProjectOptions, VERSION, VERSION_KEYS_SKIP, VERSION_NPM_PACKAGES, VSCodeConfig, type VersionKey, Vitest, type VitestConfigOptions, type VitestOptions, addApproveMergeUpgradeWorkflow, addBuildCompleteJob, getLatestEligibleVersion };

package/lib/index.d.ts

@@ -448,10 +448,17 @@ declare const VERSION: {
      * What version of the turborepo library should we use?
      */
     readonly TURBO_VERSION: "2.8.14";
+    /**
+     * What version of Vite to use (pnpm override). Pinned to 5.x so Vitest 4.x
+     * can load config (Vite 6+/7+ are ESM-only; see issue #142). Remove override
+     * when moving to ESM-only test setup.
+     */
+    readonly VITE_VERSION: "5.4.11";
     /**
      * What version of Vitest to use when testRunner is 'vitest'.
+     * Pinned to 3.x so it works with Vite 5 (Vitest 4 requires Vite 6). See issue #142.
      */
-    readonly VITEST_VERSION: "4.0.18";
+    readonly VITEST_VERSION: "3.2.4";
 };
 
 /**
@@ -470,8 +477,9 @@ declare const VERSION_NPM_PACKAGES: ReadonlyArray<{
     npmPackage: string;
 }>;
 /**
- * VERSION keys that are not backed by npm and must be skipped by
- * auto-update (e.g. runtime versions like Node.js).
+ * VERSION keys that are not backed by npm or must be skipped by
+ * auto-update (e.g. runtime versions like Node.js, or pinned deps like
+ * VITE_VERSION until ESM-only test setup).
  */
 declare const VERSION_KEYS_SKIP: ReadonlyArray<VersionKey>;
 
@@ -1225,6 +1233,71 @@ declare class TurboRepo extends Component$1 {
     preSynthesize(): void;
 }
 
+/** Merge methods supported by enable-pull-request-automerge. */
+declare const MERGE_METHODS: {
+    readonly SQUASH: "squash";
+    readonly MERGE: "merge";
+    readonly REBASE: "rebase";
+};
+/** Merge method for the approve-and-merge-upgrade workflow. */
+type MergeMethod = (typeof MERGE_METHODS)[keyof typeof MERGE_METHODS];
+/**
+ * Options for the approve-and-merge-upgrade workflow (ADR 0001 §2).
+ * When set, adds a workflow that approves and merges the dependency-upgrade PR
+ * when it has the auto-approve label and head branch matches. Trigger types
+ * exclude `opened` to prevent double approval when the PR is created with the label.
+ */
+interface ApproveMergeUpgradeOptions {
+    /**
+     * Workflow file name (display name in Actions tab).
+     * @default "approve-and-merge-upgrade"
+     */
+    readonly workflowName?: string;
+    /**
+     * Label that must be present on the PR to trigger approve-and-merge.
+     * @default "auto-approve"
+     */
+    readonly autoApproveLabel?: string;
+    /**
+     * Head branch name the PR must target (e.g. the branch created by the upgrade workflow).
+     * @default "github-actions/upgrade"
+     */
+    readonly headBranch?: string;
+    /**
+     * GitHub usernames allowed as PR authors (e.g. automation bot logins).
+     * The workflow runs only when the PR user is in this list.
+     */
+    readonly allowedUsernames: string[];
+    /**
+     * Repository secret name for the approval GitHub App ID.
+     * @default "APPROVAL_APP_ID"
+     */
+    readonly approvalAppIdSecret?: string;
+    /**
+     * Repository secret name for the approval GitHub App private key (PEM).
+     * @default "APPROVAL_APP_PRIVATE_KEY"
+     */
+    readonly approvalAppPrivateKeySecret?: string;
+    /**
+     * Merge method for enable-pull-request-automerge.
+     * @default "squash"
+     */
+    readonly mergeMethod?: MergeMethod;
+    /**
+     * Optional branch filters for pull_request_target (e.g. base branches).
+     * @see https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#pull_request_target
+     */
+    readonly branches?: string[];
+}
+/**
+ * Adds the approve-and-merge-upgrade workflow to the project.
+ * Uses a GitHub App token for approve + enable automerge (squash by default).
+ *
+ * @param project - A NodeProject with GitHub (e.g. MonorepoProject)
+ * @param options - Options for the workflow; allowedUsernames is required
+ */
+declare function addApproveMergeUpgradeWorkflow(project: NodeProject, options: ApproveMergeUpgradeOptions): void;
+
 /*******************************************************************************
  *
  * Monorepo Root Project
@@ -1292,6 +1365,15 @@ interface MonorepoProjectOptions extends Omit<TypeScriptProjectOptions$1, "defau
      * @default: daily schedule
      */
     readonly upgradeConfigulatorTaskOptions?: UpgradeDependenciesOptions;
+    /**
+     * When set, adds the approve-and-merge-upgrade workflow (ADR 0001 §2).
+     * Uses a second GitHub App to approve and merge the dependency-upgrade PR
+     * when it has the auto-approve label and head branch matches. Trigger types
+     * exclude `opened` to prevent double approval.
+     *
+     * @see ApproveMergeUpgradeOptions
+     */
+    readonly approveMergeUpgradeOptions?: ApproveMergeUpgradeOptions;
 }
 declare class MonorepoProject extends TypeScriptAppProject {
     /**
@@ -1553,5 +1635,18 @@ declare class AwsDeployWorkflow extends Component {
     preSynthesize(): void;
 }
 
-export { AwsDeployWorkflow, AwsDeploymentConfig, AwsDeploymentTarget, JsiiFaker, MIMIMUM_RELEASE_AGE, MonorepoProject, PROD_DEPLOY_NAME, PnpmWorkspace, ROOT_CI_TASK_NAME, ROOT_TURBO_TASK_NAME, ResetTask, TestRunner, TurboRepo, TurboRepoTask, TypeScriptConfig, TypeScriptProject, VERSION, VERSION_KEYS_SKIP, VERSION_NPM_PACKAGES, VSCodeConfig, Vitest, getLatestEligibleVersion };
-export type { AwsAccount, AwsDeploymentTargetOptions, AwsLocalDeploymentConfig, AwsOrganization, AwsRegion, CiDeploymentConfig, ClassTypeOptions, DeployWorkflowOptions, GitBranch, IDependencyResolver, MonorepoProjectOptions, PnpmWorkspaceOptions, RemoteCacheOptions, ResetTaskOptions, TurboRepoOptions, TurboRepoTaskOptions, TypeScriptProjectOptions, VersionKey, VitestConfigOptions, VitestOptions };
+/** Name of the gate job appended to build workflows (ADR 0004). */
+declare const COMPLETE_JOB_ID = "complete";
+/**
+ * Appends the "complete" gate job to a build workflow (ADR 0004, issue #165).
+ * The job runs after all other jobs, uses {@code if: always()}, and succeeds
+ * only when the build job succeeded and every other job succeeded or was skipped.
+ * Call this for the default build workflow and for any build workflow created
+ * by Configulator (e.g. AwsDeployWorkflow).
+ *
+ * @param buildWorkflow The Projen BuildWorkflow to append the complete job to.
+ */
+declare function addBuildCompleteJob(buildWorkflow: BuildWorkflow): void;
+
+export { AwsDeployWorkflow, AwsDeploymentConfig, AwsDeploymentTarget, COMPLETE_JOB_ID, JsiiFaker, MERGE_METHODS, MIMIMUM_RELEASE_AGE, MonorepoProject, PROD_DEPLOY_NAME, PnpmWorkspace, ROOT_CI_TASK_NAME, ROOT_TURBO_TASK_NAME, ResetTask, TestRunner, TurboRepo, TurboRepoTask, TypeScriptConfig, TypeScriptProject, VERSION, VERSION_KEYS_SKIP, VERSION_NPM_PACKAGES, VSCodeConfig, Vitest, addApproveMergeUpgradeWorkflow, addBuildCompleteJob, getLatestEligibleVersion };
+export type { ApproveMergeUpgradeOptions, AwsAccount, AwsDeploymentTargetOptions, AwsLocalDeploymentConfig, AwsOrganization, AwsRegion, CiDeploymentConfig, ClassTypeOptions, DeployWorkflowOptions, GitBranch, IDependencyResolver, MergeMethod, MonorepoProjectOptions, PnpmWorkspaceOptions, RemoteCacheOptions, ResetTaskOptions, TurboRepoOptions, TurboRepoTaskOptions, TypeScriptProjectOptions, VersionKey, VitestConfigOptions, VitestOptions };

package/lib/index.js

@@ -178,7 +178,9 @@ __export(index_exports, {
   AwsDeployWorkflow: () => AwsDeployWorkflow,
   AwsDeploymentConfig: () => AwsDeploymentConfig,
   AwsDeploymentTarget: () => AwsDeploymentTarget,
+  COMPLETE_JOB_ID: () => COMPLETE_JOB_ID,
   JsiiFaker: () => JsiiFaker,
+  MERGE_METHODS: () => MERGE_METHODS,
   MIMIMUM_RELEASE_AGE: () => MIMIMUM_RELEASE_AGE,
   MonorepoProject: () => MonorepoProject,
   PROD_DEPLOY_NAME: () => PROD_DEPLOY_NAME,
@@ -196,6 +198,8 @@ __export(index_exports, {
   VERSION_NPM_PACKAGES: () => VERSION_NPM_PACKAGES,
   VSCodeConfig: () => VSCodeConfig,
   Vitest: () => Vitest,
+  addApproveMergeUpgradeWorkflow: () => addApproveMergeUpgradeWorkflow,
+  addBuildCompleteJob: () => addBuildCompleteJob,
   getLatestEligibleVersion: () => getLatestEligibleVersion
 });
 module.exports = __toCommonJS(index_exports);
@@ -779,7 +783,12 @@ var VERSION_NPM_PACKAGES = [
   { key: "TURBO_VERSION", npmPackage: "turbo" },
   { key: "VITEST_VERSION", npmPackage: "vitest" }
 ];
-var VERSION_KEYS_SKIP = ["NODE_WORKFLOWS"];
+var VERSION_KEYS_SKIP = [
+  "NODE_WORKFLOWS",
+  "VITE_VERSION",
+  "VITEST_VERSION"
+  // Pinned to 3.x for Vite 5 compatibility; skip until ESM-only (issue #142)
+];
 
 // src/versions.ts
 var VERSION = {
@@ -815,10 +824,17 @@ var VERSION = {
    * What version of the turborepo library should we use?
    */
   TURBO_VERSION: "2.8.14",
+  /**
+   * What version of Vite to use (pnpm override). Pinned to 5.x so Vitest 4.x
+   * can load config (Vite 6+/7+ are ESM-only; see issue #142). Remove override
+   * when moving to ESM-only test setup.
+   */
+  VITE_VERSION: "5.4.11",
   /**
    * What version of Vitest to use when testRunner is 'vitest'.
+   * Pinned to 3.x so it works with Vite 5 (Vitest 4 requires Vite 6). See issue #142.
    */
-  VITEST_VERSION: "4.0.18"
+  VITEST_VERSION: "3.2.4"
 };
 
 // src/jsii/jsii-faker.ts
@@ -1313,6 +1329,133 @@ var VSCodeConfig = class extends import_projen8.Component {
   }
 };
 
+// src/workflows/approve-merge-upgrade.ts
+var import_workflows_model2 = require("projen/lib/github/workflows-model");
+var MERGE_METHODS = {
+  SQUASH: "squash",
+  MERGE: "merge",
+  REBASE: "rebase"
+};
+var DEFAULT_WORKFLOW_NAME = "approve-and-merge-upgrade";
+var DEFAULT_AUTO_APPROVE_LABEL = "auto-approve";
+var DEFAULT_HEAD_BRANCH = "github-actions/upgrade";
+var DEFAULT_APPROVAL_APP_ID_SECRET = "APPROVAL_APP_ID";
+var DEFAULT_APPROVAL_APP_PRIVATE_KEY_SECRET = "APPROVAL_APP_PRIVATE_KEY";
+var DEFAULT_MERGE_METHOD = MERGE_METHODS.SQUASH;
+var PULL_REQUEST_TARGET_TYPES = [
+  "labeled",
+  "synchronize",
+  "reopened",
+  "ready_for_review"
+];
+function addApproveMergeUpgradeWorkflow(project, options) {
+  const workflowName = options.workflowName ?? DEFAULT_WORKFLOW_NAME;
+  const autoApproveLabel = options.autoApproveLabel ?? DEFAULT_AUTO_APPROVE_LABEL;
+  const headBranch = options.headBranch ?? DEFAULT_HEAD_BRANCH;
+  const allowedUsernames = options.allowedUsernames;
+  const appIdSecret = options.approvalAppIdSecret ?? DEFAULT_APPROVAL_APP_ID_SECRET;
+  const privateKeySecret = options.approvalAppPrivateKeySecret ?? DEFAULT_APPROVAL_APP_PRIVATE_KEY_SECRET;
+  const mergeMethod = options.mergeMethod ?? DEFAULT_MERGE_METHOD;
+  const workflow = project.github?.addWorkflow(workflowName);
+  if (!workflow) return;
+  workflow.on({
+    pullRequestTarget: {
+      types: [...PULL_REQUEST_TARGET_TYPES],
+      ...options.branches && options.branches.length > 0 ? { branches: options.branches } : {}
+    }
+  });
+  const jobCondition = [
+    `contains(github.event.pull_request.labels.*.name, '${autoApproveLabel}')`,
+    `github.event.pull_request.head.ref == '${headBranch}'`,
+    `(${allowedUsernames.map((u) => `github.event.pull_request.user.login == '${u}'`).join(" || ")})`
+  ].join(" && ");
+  workflow.addJobs({
+    "approve-and-merge": {
+      name: "Approve and merge upgrade PR",
+      runsOn: ["ubuntu-latest"],
+      permissions: {
+        pullRequests: import_workflows_model2.JobPermission.WRITE,
+        contents: import_workflows_model2.JobPermission.WRITE
+      },
+      if: jobCondition,
+      steps: [
+        {
+          name: "Generate token",
+          id: "generate_token",
+          uses: "actions/create-github-app-token@v2",
+          with: {
+            "app-id": `\${{ secrets.${appIdSecret} }}`,
+            "private-key": `\${{ secrets.${privateKeySecret} }}`
+          }
+        },
+        {
+          name: "Auto-approve",
+          uses: "hmarr/auto-approve-action@f0939ea97e9205ef24d872e76833fa908a770363",
+          with: {
+            "github-token": "${{ steps.generate_token.outputs.token }}"
+          }
+        },
+        {
+          name: "Enable auto-merge (squash)",
+          uses: "peter-evans/enable-pull-request-automerge@v3",
+          with: {
+            token: "${{ steps.generate_token.outputs.token }}",
+            "pull-request-number": "${{ github.event.pull_request.number }}",
+            "merge-method": mergeMethod
+          }
+        }
+      ]
+    }
+  });
+}
+
+// src/workflows/build-complete-job.ts
+var import_workflows_model3 = require("projen/lib/github/workflows-model");
+var BUILD_JOB_ID = "build";
+var COMPLETE_JOB_ID = "complete";
+function buildCompleteJobRunScript(jobIds) {
+  const lines = [];
+  for (const id of jobIds) {
+    const expr = "${{ needs." + id + ".result }}";
+    if (id === BUILD_JOB_ID) {
+      lines.push(
+        `if [ "${expr}" != "success" ]; then echo "Job ${id} must succeed"; exit 1; fi`
+      );
+    } else {
+      lines.push(
+        `if [ "${expr}" != "success" ] && [ "${expr}" != "skipped" ]; then echo "Job ${id} must succeed or be skipped"; exit 1; fi`
+      );
+    }
+  }
+  return lines.join("\n");
+}
+function addBuildCompleteJob(buildWorkflow) {
+  const w = buildWorkflow.workflow;
+  if (!w?.jobs || typeof w.addJob !== "function") {
+    return;
+  }
+  const jobIds = Object.keys(w.jobs).filter((id) => id !== COMPLETE_JOB_ID);
+  if (jobIds.length === 0) {
+    return;
+  }
+  const runScript = buildCompleteJobRunScript(jobIds);
+  w.addJob(COMPLETE_JOB_ID, {
+    name: "Complete",
+    needs: jobIds,
+    if: "always()",
+    runsOn: ["ubuntu-latest"],
+    permissions: {
+      contents: import_workflows_model3.JobPermission.NONE
+    },
+    steps: [
+      {
+        name: "Verify all jobs succeeded or were skipped",
+        run: runScript
+      }
+    ]
+  });
+}
+
 // src/projects/monorepo-project.ts
 var postInstallDependenciesMap = /* @__PURE__ */ new WeakMap();
 var MonorepoProject = class extends import_typescript.TypeScriptAppProject {
@@ -1547,6 +1690,12 @@ var MonorepoProject = class extends import_typescript.TypeScriptAppProject {
         )
       );
     }
+    if (options.approveMergeUpgradeOptions) {
+      addApproveMergeUpgradeWorkflow(this, options.approveMergeUpgradeOptions);
+    }
+    if (this.buildWorkflow) {
+      addBuildCompleteJob(this.buildWorkflow);
+    }
     this.tasks.tryFind("post-upgrade")?.exec("pnpm upgrade -r");
     this.tasks.tryFind("post-upgrade")?.spawn(this.defaultTask);
   }
@@ -1613,7 +1762,7 @@ var import_utils3 = __toESM(require_lib());
 var import_projen10 = require("projen");
 var import_build = require("projen/lib/build");
 var import_github = require("projen/lib/github");
-var import_workflows_model2 = require("projen/lib/github/workflows-model");
+var import_workflows_model4 = require("projen/lib/github/workflows-model");
 var PROD_DEPLOY_NAME = "prod-deploy";
 var AwsDeployWorkflow = class _AwsDeployWorkflow extends import_projen10.Component {
   constructor(project, options = {}) {
@@ -1842,14 +1991,15 @@ var AwsDeployWorkflow = class _AwsDeployWorkflow extends import_projen10.Compone
         ],
         runsOn: ["ubuntu-latest"],
         permissions: {
-          contents: import_workflows_model2.JobPermission.READ,
-          idToken: import_workflows_model2.JobPermission.WRITE
+          contents: import_workflows_model4.JobPermission.READ,
+          idToken: import_workflows_model4.JobPermission.WRITE
         },
         concurrency: deployJobName,
         if: jobCondition,
         steps: [...this.deploySteps(target)]
       });
     });
+    addBuildCompleteJob(this.buildWorkflow);
   }
   static of(project, buildWorkflow) {
     const isDefined = (c) => c instanceof _AwsDeployWorkflow && c.buildWorkflow === buildWorkflow;
@@ -1882,7 +2032,9 @@ var AwsDeployWorkflow = class _AwsDeployWorkflow extends import_projen10.Compone
   AwsDeployWorkflow,
   AwsDeploymentConfig,
   AwsDeploymentTarget,
+  COMPLETE_JOB_ID,
   JsiiFaker,
+  MERGE_METHODS,
   MIMIMUM_RELEASE_AGE,
   MonorepoProject,
   PROD_DEPLOY_NAME,
@@ -1900,6 +2052,8 @@ var AwsDeployWorkflow = class _AwsDeployWorkflow extends import_projen10.Compone
   VERSION_NPM_PACKAGES,
   VSCodeConfig,
   Vitest,
+  addApproveMergeUpgradeWorkflow,
+  addBuildCompleteJob,
   getLatestEligibleVersion
 });
 //# sourceMappingURL=index.js.map