@jaypie/mcp 0.8.42 → 0.8.44

package/dist/suites/docs/index.js

@@ -9,7 +9,7 @@ import { gt } from 'semver';
 /**
  * Docs Suite - Documentation services (skill, version, release_notes)
  */
-const BUILD_VERSION_STRING = "@jaypie/mcp@0.8.42#4dd42146"
+const BUILD_VERSION_STRING = "@jaypie/mcp@0.8.44#b696c1bf"
     ;
 const __filename$1 = fileURLToPath(import.meta.url);
 const __dirname$1 = path.dirname(__filename$1);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jaypie/mcp",
-  "version": "0.8.42",
+  "version": "0.8.44",
   "description": "Jaypie MCP",
   "repository": {
     "type": "git",

package/release-notes/constructs/1.2.51.md

@@ -0,0 +1,22 @@
+---
+version: 1.2.51
+date: 2026-04-19
+summary: JaypieGitHubDeployRole grants ECR auth and push by default, scoped to <sponsor>-* repositories
+---
+
+## Changes
+
+- `JaypieGitHubDeployRole` grants `ecr:GetAuthorizationToken` on `*` and push actions (`ecr:BatchCheckLayerAvailability`, `ecr:BatchGetImage`, `ecr:CompleteLayerUpload`, `ecr:CreateRepository`, `ecr:DescribeRepositories`, `ecr:InitiateLayerUpload`, `ecr:PutImage`, `ecr:UploadLayerPart`) scoped to `arn:aws:ecr:*:<account>:repository/<sponsor>-*` by default.
+- Sponsor is resolved from `sponsor` prop, `PROJECT_SPONSOR`, or the organization parsed from `CDK_ENV_REPO` / `PROJECT_REPO` (same parse that produces the `repoRestriction`), keeping ECR scope aligned with the OIDC `sub` condition.
+- New `sponsor` and `ecr` props on `JaypieGitHubDeployRoleProps`. Set `ecr: false` to opt out.
+
+## Motivation
+
+Any project shipping a Docker artifact (ECS/Fargate, Lambda containers) needs ECR auth + push on the GitHub Actions deploy role. Previously every consumer had to extend the role downstream. Since `JaypieGitHubDeployRole` already constrains the OIDC `sub` to the organization's repos, granting ECR by default removes boilerplate without expanding the threat surface.
+
+## Migration
+
+- Consumers deploying from a sponsor-scoped monorepo (`<sponsor>-*`) see no change beyond new default permissions.
+- Consumers who previously extended the role for ECR can remove the inline statements.
+- To keep prior behavior with no ECR permissions, pass `ecr: false`.
+- If no sponsor can be resolved (no `sponsor` prop, `PROJECT_SPONSOR`, `CDK_ENV_REPO`, or `PROJECT_REPO`), construction throws `ConfigurationError`; set `ecr: false` to skip the check.

package/release-notes/mcp/0.8.43.md

@@ -0,0 +1,9 @@
+---
+version: 0.8.43
+date: 2026-04-19
+summary: Release notes for @jaypie/constructs 1.2.51 (ECR defaults on JaypieGitHubDeployRole)
+---
+
+## Changes
+
+- Adds release notes for `@jaypie/constructs` 1.2.51, which grants ECR auth + push permissions by default on `JaypieGitHubDeployRole`, scoped to `<sponsor>-*` repositories.

package/release-notes/mcp/0.8.44.md

@@ -0,0 +1,11 @@
+---
+version: 0.8.44
+date: 2026-04-19
+summary: Pin cicd skill GitHub Actions to Node 24-native majors
+---
+
+## Changes
+
+- Documents the Node 24-native action majors (`actions/checkout@v6`, `actions/setup-node@v6`, `actions/cache@v5`, `actions/upload-artifact@v7`, `actions/download-artifact@v8`, `aws-actions/configure-aws-credentials@v6`) at the top of `skills/cicd.md`.
+- Updates example workflows in `skills/cicd.md`, `skills/cicd-actions.md`, and `skills/cicd-deploy.md` so scaffolds land on Node 24-native actions on the first pass, avoiding the Node 20 deprecation warning and `FORCE_JAVASCRIPT_ACTIONS_TO_NODE24` opt-in.
+- Updates `workspaces/documentation/docs/guides/cicd.md` to match.

package/skills/cicd-actions.md

@@ -176,13 +176,13 @@ runs:
   using: 'composite'
   steps:
     - name: Setup Node.js
-      uses: actions/setup-node@v4
+      uses: actions/setup-node@v6
       with:
         node-version: ${{ inputs.node-version }}
         cache: 'npm'
 
     - name: Cache node_modules
-      uses: actions/cache@v4
+      uses: actions/cache@v5
       with:
         path: |
           node_modules
@@ -194,7 +194,7 @@ runs:
 
     - name: Cache build outputs
       if: inputs.cache-builds == 'true'
-      uses: actions/cache@v4
+      uses: actions/cache@v5
       with:
         path: |
           packages/*/dist
@@ -282,7 +282,7 @@ runs:
           ${{ inputs.extra-args }}
 
     - name: Upload CDK outputs
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v7
       with:
         name: cdk-outputs
         path: ${{ inputs.working-directory }}/cdk-outputs.json
@@ -302,7 +302,7 @@ jobs:
       id-token: write
       contents: read
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - uses: ./.github/actions/setup-environment
         with:

package/skills/cicd-deploy.md

@@ -30,7 +30,7 @@ jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - uses: ./.github/actions/setup-node-and-cache
       - uses: ./.github/actions/npm-install-build
         with:
@@ -40,7 +40,7 @@ jobs:
   typecheck:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - uses: ./.github/actions/setup-node-and-cache
       - uses: ./.github/actions/npm-install-build
         with:
@@ -53,7 +53,7 @@ jobs:
       matrix:
         node-version: [22, 24, 25]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - uses: ./.github/actions/setup-node-and-cache
         with:
           node-version: ${{ matrix.node-version }}
@@ -68,7 +68,7 @@ jobs:
       id-token: write
       contents: read
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - uses: ./.github/actions/setup-environment
         with:
@@ -112,7 +112,7 @@ jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - uses: ./.github/actions/setup-node-and-cache
       - uses: ./.github/actions/npm-install-build
         with:
@@ -122,7 +122,7 @@ jobs:
   typecheck:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - uses: ./.github/actions/setup-node-and-cache
       - uses: ./.github/actions/npm-install-build
         with:
@@ -135,7 +135,7 @@ jobs:
       matrix:
         node-version: [22, 24, 25]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - uses: ./.github/actions/setup-node-and-cache
         with:
           node-version: ${{ matrix.node-version }}
@@ -150,7 +150,7 @@ jobs:
       id-token: write
       contents: read
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - uses: ./.github/actions/setup-environment
         with:
@@ -200,7 +200,7 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
 

package/skills/cicd.md

@@ -15,6 +15,21 @@ Jaypie projects use GitHub Actions for continuous integration and deployment.
 | `cicd-deploy` | CDK deployment workflows (sandbox, production) |
 | `cicd-environments` | GitHub Environments configuration |
 
+## Action Versions
+
+GitHub Actions deprecated Node 20 runners on 2025-09-19. Pin third-party actions to majors that natively run on Node 24 to avoid deprecation warnings and the `FORCE_JAVASCRIPT_ACTIONS_TO_NODE24` opt-in.
+
+| Action | Tag |
+|---|---|
+| `actions/checkout` | `v6` |
+| `actions/setup-node` | `v6` |
+| `actions/cache` | `v5` |
+| `actions/upload-artifact` | `v7` |
+| `actions/download-artifact` | `v8` |
+| `aws-actions/configure-aws-credentials` | `v6` |
+
+Refresh this list against the [Node 20 deprecation changelog](https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/) when bumping action versions.
+
 ## Standard Workflows
 
 ### npm-check.yml
@@ -34,8 +49,8 @@ jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v6
+      - uses: actions/setup-node@v6
         with:
           node-version: 24
       - run: npm ci
@@ -44,8 +59,8 @@ jobs:
   typecheck:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v6
+      - uses: actions/setup-node@v6
         with:
           node-version: 24
       - run: npm ci
@@ -57,8 +72,8 @@ jobs:
       matrix:
         node-version: [22, 24, 25]
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v6
+      - uses: actions/setup-node@v6
         with:
           node-version: ${{ matrix.node-version }}
       - run: npm ci
@@ -87,8 +102,8 @@ jobs:
       contents: read
       id-token: write
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v6
+      - uses: actions/setup-node@v6
         with:
           node-version: 24
           registry-url: 'https://registry.npmjs.org'