npm - @jjrawlins/cdk-diff-pr-github-action - Versions diffs - 0.0.1-beta → 0.0.3-beta - Mend

@jjrawlins/cdk-diff-pr-github-action 0.0.1-beta → 0.0.3-beta

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (277) hide show

package/.yalc/@jjrawlins/cdk-diff-pr-github-action/.yalc/@jjrawlins/cdk-diff-pr-github-action/.yalc/@jjrawlins/cdk-diff-pr-github-action/.yalc/@jjrawlins/cdk-diff-pr-github-action/lib/CdkDiffStackWorkflow.js ADDED Viewed

@@ -0,0 +1,143 @@
+"use strict";
+var _a;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CdkDiffStackWorkflow = void 0;
+const JSII_RTTI_SYMBOL_1 = Symbol.for("jsii.rtti");
+const github_1 = require("projen/lib/github");
+const workflows_model_1 = require("projen/lib/github/workflows-model");
+const cdk_changeset_script_1 = require("./bin/cdk-changeset-script");
+const githubActionsAwsCredentialsVersion = 'v4';
+const githubActionsCheckoutVersion = 'v4';
+const githubActionsSetupNodeVersion = 'v4';
+class CdkDiffStackWorkflow {
+    constructor(props) {
+        const cdkYarnCommand = props.cdkYarnCommand ?? 'cdk';
+        const nodeVersion = props.nodeVersion ?? '24.x';
+        const scriptOutputPath = props.scriptOutputPath ?? '.github/workflows/scripts/describe-cfn-changeset.ts';
+        // Validate OIDC configuration
+        this.validateOidcConfiguration(props);
+        // Only create the changeset script once to avoid collisions
+        if (!CdkDiffStackWorkflow.scriptCreated) {
+            new cdk_changeset_script_1.CdkChangesetScript({
+                project: props.project,
+                outputPath: scriptOutputPath,
+            });
+            CdkDiffStackWorkflow.scriptCreated = true;
+        }
+        // Create a separate workflow for each stack
+        for (const stack of props.stacks) {
+            const workflowName = `diff-${stack.stackName}`;
+            const gh = props.project.github ?? new github_1.GitHub(props.project);
+            const diffDeployWorkflow = new github_1.GithubWorkflow(gh, workflowName, { fileName: `${workflowName}.yml` });
+            this.createWorkflowForStack(diffDeployWorkflow, stack, cdkYarnCommand, nodeVersion, scriptOutputPath, props.oidcRoleArn, props.oidcRegion);
+        }
+    }
+    validateOidcConfiguration(props) {
+        const hasDefaultOidcRole = !!props.oidcRoleArn;
+        const hasDefaultOidcRegion = !!props.oidcRegion;
+        // Check if all stacks have their own OIDC configuration
+        const allStacksHaveOidcRole = props.stacks.every(stack => !!stack.oidcRoleArn);
+        const allStacksHaveOidcRegion = props.stacks.every(stack => !!stack.oidcRegion);
+        // Either defaults must be provided OR all stacks must have their own OIDC config
+        if (!hasDefaultOidcRole && !allStacksHaveOidcRole) {
+            throw new Error('Either provide default oidcRoleArn or specify oidcRoleArn for each stack');
+        }
+        if (!hasDefaultOidcRegion && !allStacksHaveOidcRegion) {
+            throw new Error('Either provide default oidcRegion or specify oidcRegion for each stack');
+        }
+    }
+    createWorkflowForStack(workflow, stack, cdkYarnCommand, nodeVersion, scriptOutputPath, defaultOidcRoleArn, defaultOidcRegion) {
+        workflow.on({
+            pullRequest: {
+                types: ['opened', 'synchronize', 'reopened'],
+            },
+        });
+        workflow.addJobs({
+            diff: {
+                runsOn: ['ubuntu-latest'],
+                permissions: {
+                    idToken: workflows_model_1.JobPermission.WRITE,
+                    contents: workflows_model_1.JobPermission.READ,
+                    issues: workflows_model_1.JobPermission.WRITE,
+                    pullRequests: workflows_model_1.JobPermission.WRITE,
+                    packages: workflows_model_1.JobPermission.READ,
+                },
+                env: {
+                    GITHUB_TOKEN: '${{ secrets.GITHUB_TOKEN }}',
+                },
+                steps: [
+                    {
+                        uses: `actions/checkout@${githubActionsCheckoutVersion}`,
+                    },
+                    {
+                        uses: `actions/setup-node@${githubActionsSetupNodeVersion}`,
+                        with: {
+                            'node-version': nodeVersion,
+                            'registry-url': 'https://npm.pkg.github.com',
+                            'scope': '@${{ github.repository_owner }}',
+                            'token': '${{ secrets.GITHUB_TOKEN }}',
+                        },
+                    },
+                    {
+                        run: 'yarn install --frozen-lockfile',
+                        env: {
+                            NODE_AUTH_TOKEN: '${{ secrets.GITHUB_TOKEN }}',
+                        },
+                    },
+                    {
+                        uses: `aws-actions/configure-aws-credentials@${githubActionsAwsCredentialsVersion}`,
+                        with: {
+                            'role-to-assume': stack.oidcRoleArn ?? defaultOidcRoleArn,
+                            'aws-region': stack.oidcRegion ?? defaultOidcRegion,
+                        },
+                    },
+                    {
+                        name: `Create Changeset for ${stack.stackName}`,
+                        run: `yarn ${cdkYarnCommand} deploy ${stack.stackName} --no-execute --change-set-name ${stack.stackName} --require-approval never`,
+                    },
+                    {
+                        id: 'creds',
+                        uses: `aws-actions/configure-aws-credentials@${githubActionsAwsCredentialsVersion}`,
+                        with: {
+                            'role-to-assume': stack.oidcRoleArn ?? defaultOidcRoleArn,
+                            'aws-region': stack.oidcRegion ?? defaultOidcRegion,
+                        },
+                    },
+                    {
+                        name: 'Assume CloudFormation Changeset Role',
+                        id: 'changeset-role',
+                        uses: `aws-actions/configure-aws-credentials@${githubActionsAwsCredentialsVersion}`,
+                        with: {
+                            'role-to-assume': stack.changesetRoleToAssumeArn,
+                            'role-chaining': true,
+                            'role-skip-session-tagging': true,
+                            'aws-region': stack.changesetRoleToAssumeRegion,
+                            'aws-access-key-id': '${{ steps.creds.outputs.aws-access-key-id }}',
+                            'aws-secret-access-key': '${{ steps.creds.outputs.aws-secret-access-key }}',
+                            'aws-session-token': '${{ steps.creds.outputs.aws-session-token }}',
+                        },
+                    },
+                    {
+                        name: `Describe change set for ${stack.stackName}`,
+                        run: `npx ts-node ${scriptOutputPath}`,
+                        env: {
+                            STACK_NAME: stack.stackName,
+                            CHANGE_SET_NAME: stack.stackName,
+                            GITHUB_COMMENT_URL: '${{ github.event.pull_request.comments_url }}',
+                            GITHUB_TOKEN: '${{ secrets.GITHUB_TOKEN }}',
+                        },
+                    },
+                    {
+                        name: `Delete changeset for ${stack.stackName}`,
+                        run: `aws cloudformation delete-change-set --change-set-name ${stack.stackName} --stack-name ${stack.stackName} --region ${stack.changesetRoleToAssumeRegion}`,
+                    },
+                ],
+            },
+        });
+    }
+}
+exports.CdkDiffStackWorkflow = CdkDiffStackWorkflow;
+_a = JSII_RTTI_SYMBOL_1;
+CdkDiffStackWorkflow[_a] = { fqn: "@jjrawlins/cdk-diff-pr-github-action.CdkDiffStackWorkflow", version: "0.0.0" };
+CdkDiffStackWorkflow.scriptCreated = false;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiQ2RrRGlmZlN0YWNrV29ya2Zsb3cuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi9zcmMvQ2RrRGlmZlN0YWNrV29ya2Zsb3cudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7QUFBQSw4Q0FBMkQ7QUFDM0QsdUVBQWtFO0FBQ2xFLHFFQUFnRTtBQUVoRSxNQUFNLGtDQUFrQyxHQUFHLElBQUksQ0FBQztBQUNoRCxNQUFNLDRCQUE0QixHQUFHLElBQUksQ0FBQztBQUMxQyxNQUFNLDZCQUE2QixHQUFHLElBQUksQ0FBQztBQW1CM0MsTUFBYSxvQkFBb0I7SUFHL0IsWUFBWSxLQUFnQztRQUMxQyxNQUFNLGNBQWMsR0FBRyxLQUFLLENBQUMsY0FBYyxJQUFJLEtBQUssQ0FBQztRQUNyRCxNQUFNLFdBQVcsR0FBRyxLQUFLLENBQUMsV0FBVyxJQUFJLE1BQU0sQ0FBQztRQUNoRCxNQUFNLGdCQUFnQixHQUFHLEtBQUssQ0FBQyxnQkFBZ0IsSUFBSSxxREFBcUQsQ0FBQztRQUV6Ryw4QkFBOEI7UUFDOUIsSUFBSSxDQUFDLHlCQUF5QixDQUFDLEtBQUssQ0FBQyxDQUFDO1FBRXRDLDREQUE0RDtRQUM1RCxJQUFJLENBQUMsb0JBQW9CLENBQUMsYUFBYSxFQUFFLENBQUM7WUFDeEMsSUFBSSx5Q0FBa0IsQ0FBQztnQkFDckIsT0FBTyxFQUFFLEtBQUssQ0FBQyxPQUFPO2dCQUN0QixVQUFVLEVBQUUsZ0JBQWdCO2FBQzdCLENBQUMsQ0FBQztZQUNILG9CQUFvQixDQUFDLGFBQWEsR0FBRyxJQUFJLENBQUM7UUFDNUMsQ0FBQztRQUVELDRDQUE0QztRQUM1QyxLQUFLLE1BQU0sS0FBSyxJQUFJLEtBQUssQ0FBQyxNQUFNLEVBQUUsQ0FBQztZQUNqQyxNQUFNLFlBQVksR0FBRyxRQUFRLEtBQUssQ0FBQyxTQUFTLEVBQUUsQ0FBQztZQUMvQyxNQUFNLEVBQUUsR0FBSSxLQUFhLENBQUMsT0FBTyxDQUFDLE1BQU0sSUFBSSxJQUFJLGVBQU0sQ0FBRSxLQUFhLENBQUMsT0FBTyxDQUFDLENBQUM7WUFDL0UsTUFBTSxrQkFBa0IsR0FBRyxJQUFJLHVCQUFjLENBQUMsRUFBRSxFQUFFLFlBQVksRUFBRSxFQUFFLFFBQVEsRUFBRSxHQUFHLFlBQVksTUFBTSxFQUFFLENBQUMsQ0FBQztZQUVyRyxJQUFJLENBQUMsc0JBQXNCLENBQUMsa0JBQWtCLEVBQUUsS0FBSyxFQUFFLGNBQWMsRUFBRSxXQUFXLEVBQUUsZ0JBQWdCLEVBQUUsS0FBSyxDQUFDLFdBQVcsRUFBRSxLQUFLLENBQUMsVUFBVSxDQUFDLENBQUM7UUFDN0ksQ0FBQztJQUNILENBQUM7SUFFTyx5QkFBeUIsQ0FBQyxLQUFnQztRQUNoRSxNQUFNLGtCQUFrQixHQUFHLENBQUMsQ0FBQyxLQUFLLENBQUMsV0FBVyxDQUFDO1FBQy9DLE1BQU0sb0JBQW9CLEdBQUcsQ0FBQyxDQUFDLEtBQUssQ0FBQyxVQUFVLENBQUM7UUFFaEQsd0RBQXdEO1FBQ3hELE1BQU0scUJBQXFCLEdBQUcsS0FBSyxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUMsS0FBSyxDQUFDLFdBQVcsQ0FBQyxDQUFDO1FBQy9FLE1BQU0sdUJBQXVCLEdBQUcsS0FBSyxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUMsS0FBSyxDQUFDLFVBQVUsQ0FBQyxDQUFDO1FBRWhGLGlGQUFpRjtRQUNqRixJQUFJLENBQUMsa0JBQWtCLElBQUksQ0FBQyxxQkFBcUIsRUFBRSxDQUFDO1lBQ2xELE1BQU0sSUFBSSxLQUFLLENBQUMsMEVBQTBFLENBQUMsQ0FBQztRQUM5RixDQUFDO1FBRUQsSUFBSSxDQUFDLG9CQUFvQixJQUFJLENBQUMsdUJBQXVCLEVBQUUsQ0FBQztZQUN0RCxNQUFNLElBQUksS0FBSyxDQUFDLHdFQUF3RSxDQUFDLENBQUM7UUFDNUYsQ0FBQztJQUNILENBQUM7SUFFTyxzQkFBc0IsQ0FDNUIsUUFBd0IsRUFDeEIsS0FBbUIsRUFDbkIsY0FBc0IsRUFDdEIsV0FBbUIsRUFDbkIsZ0JBQXdCLEVBQ3hCLGtCQUEwQixFQUMxQixpQkFBeUI7UUFFekIsUUFBUSxDQUFDLEVBQUUsQ0FBQztZQUNWLFdBQVcsRUFBRTtnQkFDWCxLQUFLLEVBQUUsQ0FBQyxRQUFRLEVBQUUsYUFBYSxFQUFFLFVBQVUsQ0FBQzthQUM3QztTQUNGLENBQUMsQ0FBQztRQUNILFFBQVEsQ0FBQyxPQUFPLENBQUM7WUFDZixJQUFJLEVBQUU7Z0JBQ0osTUFBTSxFQUFFLENBQUMsZUFBZSxDQUFDO2dCQUN6QixXQUFXLEVBQUU7b0JBQ1gsT0FBTyxFQUFFLCtCQUFhLENBQUMsS0FBSztvQkFDNUIsUUFBUSxFQUFFLCtCQUFhLENBQUMsSUFBSTtvQkFDNUIsTUFBTSxFQUFFLCtCQUFhLENBQUMsS0FBSztvQkFDM0IsWUFBWSxFQUFFLCtCQUFhLENBQUMsS0FBSztvQkFDakMsUUFBUSxFQUFFLCtCQUFhLENBQUMsSUFBSTtpQkFDN0I7Z0JBQ0QsR0FBRyxFQUFFO29CQUNILFlBQVksRUFBRSw2QkFBNkI7aUJBQzVDO2dCQUNELEtBQUssRUFBRTtvQkFDTDt3QkFDRSxJQUFJLEVBQUUsb0JBQW9CLDRCQUE0QixFQUFFO3FCQUN6RDtvQkFDRDt3QkFDRSxJQUFJLEVBQUUsc0JBQXNCLDZCQUE2QixFQUFFO3dCQUMzRCxJQUFJLEVBQUU7NEJBQ0osY0FBYyxFQUFFLFdBQVc7NEJBQzNCLGNBQWMsRUFBRSw0QkFBNEI7NEJBQzVDLE9BQU8sRUFBRSxpQ0FBaUM7NEJBQzFDLE9BQU8sRUFBRSw2QkFBNkI7eUJBQ3ZDO3FCQUNGO29CQUNEO3dCQUNFLEdBQUcsRUFBRSxnQ0FBZ0M7d0JBQ3JDLEdBQUcsRUFBRTs0QkFDSCxlQUFlLEVBQUUsNkJBQTZCO3lCQUMvQztxQkFDRjtvQkFDRDt3QkFDRSxJQUFJLEVBQUUseUNBQXlDLGtDQUFrQyxFQUFFO3dCQUNuRixJQUFJLEVBQUU7NEJBQ0osZ0JBQWdCLEVBQUUsS0FBSyxDQUFDLFdBQVcsSUFBSSxrQkFBa0I7NEJBQ3pELFlBQVksRUFBRSxLQUFLLENBQUMsVUFBVSxJQUFJLGlCQUFpQjt5QkFDcEQ7cUJBQ0Y7b0JBQ0Q7d0JBQ0UsSUFBSSxFQUFFLHdCQUF3QixLQUFLLENBQUMsU0FBUyxFQUFFO3dCQUMvQyxHQUFHLEVBQUUsUUFBUSxjQUFjLFdBQVcsS0FBSyxDQUFDLFNBQVMsbUNBQW1DLEtBQUssQ0FBQyxTQUFTLDJCQUEyQjtxQkFDbkk7b0JBQ0Q7d0JBQ0UsRUFBRSxFQUFFLE9BQU87d0JBQ1gsSUFBSSxFQUFFLHlDQUF5QyxrQ0FBa0MsRUFBRTt3QkFDbkYsSUFBSSxFQUFFOzRCQUNKLGdCQUFnQixFQUFFLEtBQUssQ0FBQyxXQUFXLElBQUksa0JBQWtCOzRCQUN6RCxZQUFZLEVBQUUsS0FBSyxDQUFDLFVBQVUsSUFBSSxpQkFBaUI7eUJBQ3BEO3FCQUNGO29CQUNEO3dCQUNFLElBQUksRUFBRSxzQ0FBc0M7d0JBQzVDLEVBQUUsRUFBRSxnQkFBZ0I7d0JBQ3BCLElBQUksRUFBRSx5Q0FBeUMsa0NBQWtDLEVBQUU7d0JBQ25GLElBQUksRUFBRTs0QkFDSixnQkFBZ0IsRUFBRSxLQUFLLENBQUMsd0JBQXdCOzRCQUNoRCxlQUFlLEVBQUUsSUFBSTs0QkFDckIsMkJBQTJCLEVBQUUsSUFBSTs0QkFDakMsWUFBWSxFQUFFLEtBQUssQ0FBQywyQkFBMkI7NEJBQy9DLG1CQUFtQixFQUFFLDhDQUE4Qzs0QkFDbkUsdUJBQXVCLEVBQUUsa0RBQWtEOzRCQUMzRSxtQkFBbUIsRUFBRSw4Q0FBOEM7eUJBQ3BFO3FCQUNGO29CQUNEO3dCQUNFLElBQUksRUFBRSwyQkFBMkIsS0FBSyxDQUFDLFNBQVMsRUFBRTt3QkFDbEQsR0FBRyxFQUFFLGVBQWUsZ0JBQWdCLEVBQUU7d0JBQ3RDLEdBQUcsRUFBRTs0QkFDSCxVQUFVLEVBQUUsS0FBSyxDQUFDLFNBQVM7NEJBQzNCLGVBQWUsRUFBRSxLQUFLLENBQUMsU0FBUzs0QkFDaEMsa0JBQWtCLEVBQUUsK0NBQStDOzRCQUNuRSxZQUFZLEVBQUUsNkJBQTZCO3lCQUM1QztxQkFDRjtvQkFDRDt3QkFDRSxJQUFJLEVBQUUsd0JBQXdCLEtBQUssQ0FBQyxTQUFTLEVBQUU7d0JBQy9DLEdBQUcsRUFBRSwwREFBMEQsS0FBSyxDQUFDLFNBQVMsaUJBQWlCLEtBQUssQ0FBQyxTQUFTLGFBQWEsS0FBSyxDQUFDLDJCQUEyQixFQUFFO3FCQUMvSjtpQkFDRjthQUNGO1NBQ0YsQ0FBQyxDQUFDO0lBQ0wsQ0FBQzs7QUFoSkgsb0RBaUpDOzs7QUFoSmdCLGtDQUFhLEdBQUcsS0FBSyxDQUFDIiwic291cmNlc0NvbnRlbnQiOlsiaW1wb3J0IHsgR2l0SHViLCBHaXRodWJXb3JrZmxvdyB9IGZyb20gJ3Byb2plbi9saWIvZ2l0aHViJztcbmltcG9ydCB7IEpvYlBlcm1pc3Npb24gfSBmcm9tICdwcm9qZW4vbGliL2dpdGh1Yi93b3JrZmxvd3MtbW9kZWwnO1xuaW1wb3J0IHsgQ2RrQ2hhbmdlc2V0U2NyaXB0IH0gZnJvbSAnLi9iaW4vY2RrLWNoYW5nZXNldC1zY3JpcHQnO1xuXG5jb25zdCBnaXRodWJBY3Rpb25zQXdzQ3JlZGVudGlhbHNWZXJzaW9uID0gJ3Y0JztcbmNvbnN0IGdpdGh1YkFjdGlvbnNDaGVja291dFZlcnNpb24gPSAndjQnO1xuY29uc3QgZ2l0aHViQWN0aW9uc1NldHVwTm9kZVZlcnNpb24gPSAndjQnO1xuXG5leHBvcnQgaW50ZXJmYWNlIENka0RpZmZTdGFjayB7XG4gIHJlYWRvbmx5IHN0YWNrTmFtZTogc3RyaW5nO1xuICByZWFkb25seSBjaGFuZ2VzZXRSb2xlVG9Bc3N1bWVBcm46IHN0cmluZztcbiAgcmVhZG9ubHkgY2hhbmdlc2V0Um9sZVRvQXNzdW1lUmVnaW9uOiBzdHJpbmc7XG4gIHJlYWRvbmx5IG9pZGNSb2xlQXJuPzogc3RyaW5nOyAvLyBPcHRpb25hbCBvdmVycmlkZSBmb3IgT0lEQyByb2xlXG4gIHJlYWRvbmx5IG9pZGNSZWdpb24/OiBzdHJpbmc7IC8vIE9wdGlvbmFsIG92ZXJyaWRlIGZvciBPSURDIHJlZ2lvblxufVxuXG5leHBvcnQgaW50ZXJmYWNlIENka0RpZmZTdGFja1dvcmtmbG93UHJvcHMge1xuICByZWFkb25seSBwcm9qZWN0OiBhbnk7IC8vIGF2b2lkIGV4cG9ydGluZyBwcm9qZW4gdHlwZXMgaW4gcHVibGljIEFQSVxuICByZWFkb25seSBzdGFja3M6IENka0RpZmZTdGFja1tdO1xuICByZWFkb25seSBvaWRjUm9sZUFybjogc3RyaW5nOyAvLyBSZXF1aXJlZCBPSURDIHJvbGUgQVJOIGZvciBhbGwgc3RhY2tzIChvciBlYWNoIHN0YWNrIG11c3QgaGF2ZSBpdHMgb3duKVxuICByZWFkb25seSBvaWRjUmVnaW9uOiBzdHJpbmc7IC8vIFJlcXVpcmVkIE9JREMgcmVnaW9uIGZvciBhbGwgc3RhY2tzIChvciBlYWNoIHN0YWNrIG11c3QgaGF2ZSBpdHMgb3duKVxuICByZWFkb25seSBub2RlVmVyc2lvbj86IHN0cmluZztcbiAgcmVhZG9ubHkgY2RrWWFybkNvbW1hbmQ/OiBzdHJpbmc7XG4gIHJlYWRvbmx5IHNjcmlwdE91dHB1dFBhdGg/OiBzdHJpbmc7XG59XG5leHBvcnQgY2xhc3MgQ2RrRGlmZlN0YWNrV29ya2Zsb3cge1xuICBwcml2YXRlIHN0YXRpYyBzY3JpcHRDcmVhdGVkID0gZmFsc2U7XG5cbiAgY29uc3RydWN0b3IocHJvcHM6IENka0RpZmZTdGFja1dvcmtmbG93UHJvcHMpIHtcbiAgICBjb25zdCBjZGtZYXJuQ29tbWFuZCA9IHByb3BzLmNka1lhcm5Db21tYW5kID8/ICdjZGsnO1xuICAgIGNvbnN0IG5vZGVWZXJzaW9uID0gcHJvcHMubm9kZVZlcnNpb24gPz8gJzI0LngnO1xuICAgIGNvbnN0IHNjcmlwdE91dHB1dFBhdGggPSBwcm9wcy5zY3JpcHRPdXRwdXRQYXRoID8/ICcuZ2l0aHViL3dvcmtmbG93cy9zY3JpcHRzL2Rlc2NyaWJlLWNmbi1jaGFuZ2VzZXQudHMnO1xuXG4gICAgLy8gVmFsaWRhdGUgT0lEQyBjb25maWd1cmF0aW9uXG4gICAgdGhpcy52YWxpZGF0ZU9pZGNDb25maWd1cmF0aW9uKHByb3BzKTtcblxuICAgIC8vIE9ubHkgY3JlYXRlIHRoZSBjaGFuZ2VzZXQgc2NyaXB0IG9uY2UgdG8gYXZvaWQgY29sbGlzaW9uc1xuICAgIGlmICghQ2RrRGlmZlN0YWNrV29ya2Zsb3cuc2NyaXB0Q3JlYXRlZCkge1xuICAgICAgbmV3IENka0NoYW5nZXNldFNjcmlwdCh7XG4gICAgICAgIHByb2plY3Q6IHByb3BzLnByb2plY3QsXG4gICAgICAgIG91dHB1dFBhdGg6IHNjcmlwdE91dHB1dFBhdGgsXG4gICAgICB9KTtcbiAgICAgIENka0RpZmZTdGFja1dvcmtmbG93LnNjcmlwdENyZWF0ZWQgPSB0cnVlO1xuICAgIH1cblxuICAgIC8vIENyZWF0ZSBhIHNlcGFyYXRlIHdvcmtmbG93IGZvciBlYWNoIHN0YWNrXG4gICAgZm9yIChjb25zdCBzdGFjayBvZiBwcm9wcy5zdGFja3MpIHtcbiAgICAgIGNvbnN0IHdvcmtmbG93TmFtZSA9IGBkaWZmLSR7c3RhY2suc3RhY2tOYW1lfWA7XG4gICAgICBjb25zdCBnaCA9IChwcm9wcyBhcyBhbnkpLnByb2plY3QuZ2l0aHViID8/IG5ldyBHaXRIdWIoKHByb3BzIGFzIGFueSkucHJvamVjdCk7XG4gICAgICBjb25zdCBkaWZmRGVwbG95V29ya2Zsb3cgPSBuZXcgR2l0aHViV29ya2Zsb3coZ2gsIHdvcmtmbG93TmFtZSwgeyBmaWxlTmFtZTogYCR7d29ya2Zsb3dOYW1lfS55bWxgIH0pO1xuXG4gICAgICB0aGlzLmNyZWF0ZVdvcmtmbG93Rm9yU3RhY2soZGlmZkRlcGxveVdvcmtmbG93LCBzdGFjaywgY2RrWWFybkNvbW1hbmQsIG5vZGVWZXJzaW9uLCBzY3JpcHRPdXRwdXRQYXRoLCBwcm9wcy5vaWRjUm9sZUFybiwgcHJvcHMub2lkY1JlZ2lvbik7XG4gICAgfVxuICB9XG5cbiAgcHJpdmF0ZSB2YWxpZGF0ZU9pZGNDb25maWd1cmF0aW9uKHByb3BzOiBDZGtEaWZmU3RhY2tXb3JrZmxvd1Byb3BzKTogdm9pZCB7XG4gICAgY29uc3QgaGFzRGVmYXVsdE9pZGNSb2xlID0gISFwcm9wcy5vaWRjUm9sZUFybjtcbiAgICBjb25zdCBoYXNEZWZhdWx0T2lkY1JlZ2lvbiA9ICEhcHJvcHMub2lkY1JlZ2lvbjtcblxuICAgIC8vIENoZWNrIGlmIGFsbCBzdGFja3MgaGF2ZSB0aGVpciBvd24gT0lEQyBjb25maWd1cmF0aW9uXG4gICAgY29uc3QgYWxsU3RhY2tzSGF2ZU9pZGNSb2xlID0gcHJvcHMuc3RhY2tzLmV2ZXJ5KHN0YWNrID0+ICEhc3RhY2sub2lkY1JvbGVBcm4pO1xuICAgIGNvbnN0IGFsbFN0YWNrc0hhdmVPaWRjUmVnaW9uID0gcHJvcHMuc3RhY2tzLmV2ZXJ5KHN0YWNrID0+ICEhc3RhY2sub2lkY1JlZ2lvbik7XG5cbiAgICAvLyBFaXRoZXIgZGVmYXVsdHMgbXVzdCBiZSBwcm92aWRlZCBPUiBhbGwgc3RhY2tzIG11c3QgaGF2ZSB0aGVpciBvd24gT0lEQyBjb25maWdcbiAgICBpZiAoIWhhc0RlZmF1bHRPaWRjUm9sZSAmJiAhYWxsU3RhY2tzSGF2ZU9pZGNSb2xlKSB7XG4gICAgICB0aHJvdyBuZXcgRXJyb3IoJ0VpdGhlciBwcm92aWRlIGRlZmF1bHQgb2lkY1JvbGVBcm4gb3Igc3BlY2lmeSBvaWRjUm9sZUFybiBmb3IgZWFjaCBzdGFjaycpO1xuICAgIH1cblxuICAgIGlmICghaGFzRGVmYXVsdE9pZGNSZWdpb24gJiYgIWFsbFN0YWNrc0hhdmVPaWRjUmVnaW9uKSB7XG4gICAgICB0aHJvdyBuZXcgRXJyb3IoJ0VpdGhlciBwcm92aWRlIGRlZmF1bHQgb2lkY1JlZ2lvbiBvciBzcGVjaWZ5IG9pZGNSZWdpb24gZm9yIGVhY2ggc3RhY2snKTtcbiAgICB9XG4gIH1cblxuICBwcml2YXRlIGNyZWF0ZVdvcmtmbG93Rm9yU3RhY2soXG4gICAgd29ya2Zsb3c6IEdpdGh1YldvcmtmbG93LFxuICAgIHN0YWNrOiBDZGtEaWZmU3RhY2ssXG4gICAgY2RrWWFybkNvbW1hbmQ6IHN0cmluZyxcbiAgICBub2RlVmVyc2lvbjogc3RyaW5nLFxuICAgIHNjcmlwdE91dHB1dFBhdGg6IHN0cmluZyxcbiAgICBkZWZhdWx0T2lkY1JvbGVBcm46IHN0cmluZyxcbiAgICBkZWZhdWx0T2lkY1JlZ2lvbjogc3RyaW5nLFxuICApIHtcbiAgICB3b3JrZmxvdy5vbih7XG4gICAgICBwdWxsUmVxdWVzdDoge1xuICAgICAgICB0eXBlczogWydvcGVuZWQnLCAnc3luY2hyb25pemUnLCAncmVvcGVuZWQnXSxcbiAgICAgIH0sXG4gICAgfSk7XG4gICAgd29ya2Zsb3cuYWRkSm9icyh7XG4gICAgICBkaWZmOiB7XG4gICAgICAgIHJ1bnNPbjogWyd1YnVudHUtbGF0ZXN0J10sXG4gICAgICAgIHBlcm1pc3Npb25zOiB7XG4gICAgICAgICAgaWRUb2tlbjogSm9iUGVybWlzc2lvbi5XUklURSxcbiAgICAgICAgICBjb250ZW50czogSm9iUGVybWlzc2lvbi5SRUFELFxuICAgICAgICAgIGlzc3VlczogSm9iUGVybWlzc2lvbi5XUklURSxcbiAgICAgICAgICBwdWxsUmVxdWVzdHM6IEpvYlBlcm1pc3Npb24uV1JJVEUsXG4gICAgICAgICAgcGFja2FnZXM6IEpvYlBlcm1pc3Npb24uUkVBRCxcbiAgICAgICAgfSxcbiAgICAgICAgZW52OiB7XG4gICAgICAgICAgR0lUSFVCX1RPS0VOOiAnJHt7IHNlY3JldHMuR0lUSFVCX1RPS0VOIH19JyxcbiAgICAgICAgfSxcbiAgICAgICAgc3RlcHM6IFtcbiAgICAgICAgICB7XG4gICAgICAgICAgICB1c2VzOiBgYWN0aW9ucy9jaGVja291dEAke2dpdGh1YkFjdGlvbnNDaGVja291dFZlcnNpb259YCxcbiAgICAgICAgICB9LFxuICAgICAgICAgIHtcbiAgICAgICAgICAgIHVzZXM6IGBhY3Rpb25zL3NldHVwLW5vZGVAJHtnaXRodWJBY3Rpb25zU2V0dXBOb2RlVmVyc2lvbn1gLFxuICAgICAgICAgICAgd2l0aDoge1xuICAgICAgICAgICAgICAnbm9kZS12ZXJzaW9uJzogbm9kZVZlcnNpb24sXG4gICAgICAgICAgICAgICdyZWdpc3RyeS11cmwnOiAnaHR0cHM6Ly9ucG0ucGtnLmdpdGh1Yi5jb20nLFxuICAgICAgICAgICAgICAnc2NvcGUnOiAnQCR7eyBnaXRodWIucmVwb3NpdG9yeV9vd25lciB9fScsXG4gICAgICAgICAgICAgICd0b2tlbic6ICcke3sgc2VjcmV0cy5HSVRIVUJfVE9LRU4gfX0nLFxuICAgICAgICAgICAgfSxcbiAgICAgICAgICB9LFxuICAgICAgICAgIHtcbiAgICAgICAgICAgIHJ1bjogJ3lhcm4gaW5zdGFsbCAtLWZyb3plbi1sb2NrZmlsZScsXG4gICAgICAgICAgICBlbnY6IHtcbiAgICAgICAgICAgICAgTk9ERV9BVVRIX1RPS0VOOiAnJHt7IHNlY3JldHMuR0lUSFVCX1RPS0VOIH19JyxcbiAgICAgICAgICAgIH0sXG4gICAgICAgICAgfSxcbiAgICAgICAgICB7XG4gICAgICAgICAgICB1c2VzOiBgYXdzLWFjdGlvbnMvY29uZmlndXJlLWF3cy1jcmVkZW50aWFsc0Ake2dpdGh1YkFjdGlvbnNBd3NDcmVkZW50aWFsc1ZlcnNpb259YCxcbiAgICAgICAgICAgIHdpdGg6IHtcbiAgICAgICAgICAgICAgJ3JvbGUtdG8tYXNzdW1lJzogc3RhY2sub2lkY1JvbGVBcm4gPz8gZGVmYXVsdE9pZGNSb2xlQXJuLFxuICAgICAgICAgICAgICAnYXdzLXJlZ2lvbic6IHN0YWNrLm9pZGNSZWdpb24gPz8gZGVmYXVsdE9pZGNSZWdpb24sXG4gICAgICAgICAgICB9LFxuICAgICAgICAgIH0sXG4gICAgICAgICAge1xuICAgICAgICAgICAgbmFtZTogYENyZWF0ZSBDaGFuZ2VzZXQgZm9yICR7c3RhY2suc3RhY2tOYW1lfWAsXG4gICAgICAgICAgICBydW46IGB5YXJuICR7Y2RrWWFybkNvbW1hbmR9IGRlcGxveSAke3N0YWNrLnN0YWNrTmFtZX0gLS1uby1leGVjdXRlIC0tY2hhbmdlLXNldC1uYW1lICR7c3RhY2suc3RhY2tOYW1lfSAtLXJlcXVpcmUtYXBwcm92YWwgbmV2ZXJgLFxuICAgICAgICAgIH0sXG4gICAgICAgICAge1xuICAgICAgICAgICAgaWQ6ICdjcmVkcycsXG4gICAgICAgICAgICB1c2VzOiBgYXdzLWFjdGlvbnMvY29uZmlndXJlLWF3cy1jcmVkZW50aWFsc0Ake2dpdGh1YkFjdGlvbnNBd3NDcmVkZW50aWFsc1ZlcnNpb259YCxcbiAgICAgICAgICAgIHdpdGg6IHtcbiAgICAgICAgICAgICAgJ3JvbGUtdG8tYXNzdW1lJzogc3RhY2sub2lkY1JvbGVBcm4gPz8gZGVmYXVsdE9pZGNSb2xlQXJuLFxuICAgICAgICAgICAgICAnYXdzLXJlZ2lvbic6IHN0YWNrLm9pZGNSZWdpb24gPz8gZGVmYXVsdE9pZGNSZWdpb24sXG4gICAgICAgICAgICB9LFxuICAgICAgICAgIH0sXG4gICAgICAgICAge1xuICAgICAgICAgICAgbmFtZTogJ0Fzc3VtZSBDbG91ZEZvcm1hdGlvbiBDaGFuZ2VzZXQgUm9sZScsXG4gICAgICAgICAgICBpZDogJ2NoYW5nZXNldC1yb2xlJyxcbiAgICAgICAgICAgIHVzZXM6IGBhd3MtYWN0aW9ucy9jb25maWd1cmUtYXdzLWNyZWRlbnRpYWxzQCR7Z2l0aHViQWN0aW9uc0F3c0NyZWRlbnRpYWxzVmVyc2lvbn1gLFxuICAgICAgICAgICAgd2l0aDoge1xuICAgICAgICAgICAgICAncm9sZS10by1hc3N1bWUnOiBzdGFjay5jaGFuZ2VzZXRSb2xlVG9Bc3N1bWVBcm4sXG4gICAgICAgICAgICAgICdyb2xlLWNoYWluaW5nJzogdHJ1ZSxcbiAgICAgICAgICAgICAgJ3JvbGUtc2tpcC1zZXNzaW9uLXRhZ2dpbmcnOiB0cnVlLFxuICAgICAgICAgICAgICAnYXdzLXJlZ2lvbic6IHN0YWNrLmNoYW5nZXNldFJvbGVUb0Fzc3VtZVJlZ2lvbixcbiAgICAgICAgICAgICAgJ2F3cy1hY2Nlc3Mta2V5LWlkJzogJyR7eyBzdGVwcy5jcmVkcy5vdXRwdXRzLmF3cy1hY2Nlc3Mta2V5LWlkIH19JyxcbiAgICAgICAgICAgICAgJ2F3cy1zZWNyZXQtYWNjZXNzLWtleSc6ICcke3sgc3RlcHMuY3JlZHMub3V0cHV0cy5hd3Mtc2VjcmV0LWFjY2Vzcy1rZXkgfX0nLFxuICAgICAgICAgICAgICAnYXdzLXNlc3Npb24tdG9rZW4nOiAnJHt7IHN0ZXBzLmNyZWRzLm91dHB1dHMuYXdzLXNlc3Npb24tdG9rZW4gfX0nLFxuICAgICAgICAgICAgfSxcbiAgICAgICAgICB9LFxuICAgICAgICAgIHtcbiAgICAgICAgICAgIG5hbWU6IGBEZXNjcmliZSBjaGFuZ2Ugc2V0IGZvciAke3N0YWNrLnN0YWNrTmFtZX1gLFxuICAgICAgICAgICAgcnVuOiBgbnB4IHRzLW5vZGUgJHtzY3JpcHRPdXRwdXRQYXRofWAsXG4gICAgICAgICAgICBlbnY6IHtcbiAgICAgICAgICAgICAgU1RBQ0tfTkFNRTogc3RhY2suc3RhY2tOYW1lLFxuICAgICAgICAgICAgICBDSEFOR0VfU0VUX05BTUU6IHN0YWNrLnN0YWNrTmFtZSxcbiAgICAgICAgICAgICAgR0lUSFVCX0NPTU1FTlRfVVJMOiAnJHt7IGdpdGh1Yi5ldmVudC5wdWxsX3JlcXVlc3QuY29tbWVudHNfdXJsIH19JyxcbiAgICAgICAgICAgICAgR0lUSFVCX1RPS0VOOiAnJHt7IHNlY3JldHMuR0lUSFVCX1RPS0VOIH19JyxcbiAgICAgICAgICAgIH0sXG4gICAgICAgICAgfSxcbiAgICAgICAgICB7XG4gICAgICAgICAgICBuYW1lOiBgRGVsZXRlIGNoYW5nZXNldCBmb3IgJHtzdGFjay5zdGFja05hbWV9YCxcbiAgICAgICAgICAgIHJ1bjogYGF3cyBjbG91ZGZvcm1hdGlvbiBkZWxldGUtY2hhbmdlLXNldCAtLWNoYW5nZS1zZXQtbmFtZSAke3N0YWNrLnN0YWNrTmFtZX0gLS1zdGFjay1uYW1lICR7c3RhY2suc3RhY2tOYW1lfSAtLXJlZ2lvbiAke3N0YWNrLmNoYW5nZXNldFJvbGVUb0Fzc3VtZVJlZ2lvbn1gLFxuICAgICAgICAgIH0sXG4gICAgICAgIF0sXG4gICAgICB9LFxuICAgIH0pO1xuICB9XG59XG4iXX0=

@@ -0,0 +1,18 @@
+export interface DriftStage {
+    readonly stackName: string;
+    readonly region: string;
+    readonly driftRoleArn: string;
+    readonly failOnDrift?: boolean;
+    readonly stageName?: string;
+}
+export interface CdkDriftDetectionWorkflowProps {
+    readonly project: any;
+    readonly name?: string;
+    readonly schedule?: string;
+    readonly createIssues?: boolean;
+    readonly stages: DriftStage[];
+    readonly nodeVersion?: string;
+}
+export declare class CdkDriftDetectionWorkflow {
+    constructor(props: CdkDriftDetectionWorkflowProps);
+}

@@ -0,0 +1,217 @@
+"use strict";
+var _a;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CdkDriftDetectionWorkflow = void 0;
+const JSII_RTTI_SYMBOL_1 = Symbol.for("jsii.rtti");
+const github_1 = require("projen/lib/github");
+const workflows_model_1 = require("projen/lib/github/workflows-model");
+const githubActionsAwsCredentialsVersion = 'v5';
+const githubActionsCheckoutVersion = 'v5';
+const githubActionsSetupNodeVersion = 'v5';
+const githubActionsUploadArtifactVersion = 'v4';
+const githubActionsDownloadArtifactVersion = 'v5';
+const githubActionsGithubScriptVersion = 'v8';
+class CdkDriftDetectionWorkflow {
+    constructor(props) {
+        const name = props.name ?? 'CDK Drift Detection';
+        const fileName = toKebabCase(name) + '.yml';
+        const nodeVersion = props.nodeVersion ?? '24.x';
+        const createIssues = props.createIssues ?? true;
+        const project = props.project;
+        const gh = project.github ?? new github_1.GitHub(project);
+        const workflow = new github_1.GithubWorkflow(gh, name, { fileName });
+        // triggers: schedule + manual dispatch with stage choice
+        const stageChoices = props.stages.map((s) => s.stageName ?? stageFromStack(s.stackName));
+        workflow.on({
+            schedule: props.schedule ? [{ cron: props.schedule }] : undefined,
+            workflowDispatch: {
+                inputs: {
+                    stage: {
+                        description: 'Stage to check for drift (leave empty for all)',
+                        required: false,
+                        type: 'choice',
+                        options: stageChoices,
+                    },
+                },
+            },
+        });
+        // One job per stage
+        const jobs = {};
+        for (const stage of props.stages) {
+            const short = stage.stageName ?? stageFromStack(stage.stackName);
+            const jobId = `drift-${short}`;
+            const resultsFile = `drift-results-${short}.json`;
+            const ifCond = "${{ github.event_name == 'schedule' || github.event.inputs.stage == '' || github.event.inputs.stage == '" + short + "' }}";
+            jobs[jobId] = {
+                name: `Drift Detection - ${short}`,
+                runsOn: ['ubuntu-latest'],
+                permissions: {
+                    contents: workflows_model_1.JobPermission.READ,
+                    idToken: workflows_model_1.JobPermission.WRITE,
+                    issues: workflows_model_1.JobPermission.WRITE,
+                },
+                env: {
+                    AWS_DEFAULT_REGION: stage.region,
+                    AWS_REGION: stage.region,
+                    DRIFT_DETECTION_OUTPUT: resultsFile,
+                    STAGE_NAME: short,
+                    STACK_NAME: stage.stackName,
+                },
+                if: ifCond,
+                steps: [
+                    { name: 'Checkout', uses: `actions/checkout@${githubActionsCheckoutVersion}` },
+                    {
+                        name: 'Setup Node.js',
+                        uses: `actions/setup-node@${githubActionsSetupNodeVersion}`,
+                        with: { 'node-version': nodeVersion },
+                    },
+                    { name: 'Install dependencies', run: 'yarn install --frozen-lockfile || npm ci' },
+                    {
+                        name: 'AWS Credentials',
+                        uses: `aws-actions/configure-aws-credentials@${githubActionsAwsCredentialsVersion}`,
+                        with: {
+                            'role-to-assume': stage.driftRoleArn,
+                            'role-session-name': 'GitHubAction',
+                            'aws-region': stage.region,
+                        },
+                    },
+                    {
+                        name: 'Detect drift',
+                        id: 'drift',
+                        continueOnError: true, // allow artifact upload and issue creation even when drift is detected
+                        run: [
+                            'set -e',
+                            // Use the bundled script from this package
+                            'node ./node_modules/@jjrawlins/cdk-diff-pr-github-action/lib/bin/detect-drift.js',
+                            'if [ -f "$DRIFT_DETECTION_OUTPUT" ]; then echo "Results file created: $DRIFT_DETECTION_OUTPUT"; fi',
+                        ].join('\n'),
+                        env: {
+                            STACK_NAME: stage.stackName,
+                            AWS_REGION: stage.region,
+                            DRIFT_DETECTION_OUTPUT: resultsFile,
+                        },
+                    },
+                    {
+                        name: 'Upload results',
+                        uses: `actions/upload-artifact@${githubActionsUploadArtifactVersion}`,
+                        with: { name: `drift-results-${short}`, path: resultsFile, ifNoFilesFound: 'ignore' },
+                    },
+                    ...(createIssues
+                        ? [
+                            {
+                                name: 'Create Issue on Drift',
+                                if: "always() && steps.drift.outcome == 'failure' && github.event_name == 'schedule'",
+                                uses: `actions/github-script@${githubActionsGithubScriptVersion}`,
+                                with: { script: issueScript(short, stage.region, resultsFile) },
+                            },
+                        ]
+                        : []),
+                ],
+            };
+        }
+        // summary aggregator job
+        jobs['drift-summary'] = {
+            name: 'Drift Detection Summary',
+            needs: Object.keys(jobs).filter((j) => j.startsWith('drift-') && j !== 'drift-summary'),
+            runsOn: ['ubuntu-latest'],
+            permissions: { contents: workflows_model_1.JobPermission.READ },
+            steps: [
+                {
+                    name: 'Download all artifacts',
+                    uses: `actions/download-artifact@${githubActionsDownloadArtifactVersion}`,
+                    with: { path: 'drift-results' },
+                },
+                { name: 'Generate summary', shell: 'bash', run: summaryScript() },
+            ],
+        };
+        workflow.addJobs(jobs);
+    }
+}
+exports.CdkDriftDetectionWorkflow = CdkDriftDetectionWorkflow;
+_a = JSII_RTTI_SYMBOL_1;
+CdkDriftDetectionWorkflow[_a] = { fqn: "@jjrawlins/cdk-diff-pr-github-action.CdkDriftDetectionWorkflow", version: "0.0.0" };
+function stageFromStack(stackName) {
+    const parts = stackName.split('-');
+    return parts[parts.length - 1] || stackName;
+}
+function issueScript(stage, region, resultsFile) {
+    // Construct a plain JS script string (no template string nesting mishaps)
+    const lines = [
+        "const fs = require('fs');",
+        `const resultsFile = '${resultsFile}';`,
+        "if (!fs.existsSync(resultsFile)) { console.log('No results file found'); return; }",
+        "const results = JSON.parse(fs.readFileSync(resultsFile, 'utf8'));",
+        "const driftedStacks = results.filter(r => r.driftStatus === 'DRIFTED');",
+        "if (driftedStacks.length === 0) { console.log('No drift detected'); return; }",
+        `const title = 'Drift Detected in ${stage}';`,
+        `let body = '## Drift Detection Report\\n\\n' + '**Stage:** ${stage}\\n' + '**Region:** ${region}\\n' + '**Time:** ' + new Date().toISOString() + '\\n\\n';`,
+        "body += '### Summary\\n';",
+        "body += '- Total stacks checked: ' + results.length + '\\n';",
+        "body += '- Drifted stacks: ' + driftedStacks.length + '\\n\\n';",
+        "body += '### Drifted Stacks\\n';",
+        'for (const s of driftedStacks) {',
+        '  const resources = s.driftedResources || [];',
+        "  body += '#### ' + s.stackName + '\\n';",
+        "  body += '- Drifted resources: ' + resources.length + '\\n';",
+        "  for (const r of resources) { body += '  - ' + r.logicalResourceId + ' (' + r.resourceType + ')\\n'; }",
+        "  body += '\\n';",
+        '}',
+        "body += '### Action Required\\n' + 'Please review the drifted resources and either:\\n1. Update the infrastructure code to match the actual state\\n2. Restore the resources to match the expected state\\n\\n';",
+        'body += `[View workflow run](${context.serverUrl}/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId})`;',
+        // List or update an issue with labels
+        `const issues = await github.rest.issues.listForRepo({ owner: context.repo.owner, repo: context.repo.repo, state: 'open', labels: ['drift-detection', '${stage}'] });`,
+        'if (issues.data.length === 0) {',
+        `  await github.rest.issues.create({ owner: context.repo.owner, repo: context.repo.repo, title, body, labels: ['drift-detection', '${stage}'] });`,
+        '} else {',
+        '  const issue = issues.data[0];',
+        '  await github.rest.issues.createComment({ owner: context.repo.owner, repo: context.repo.repo, issue_number: issue.number, body });',
+        '}',
+    ];
+    return lines.join('\n');
+}
+function summaryScript() {
+    return [
+        '#!/bin/bash',
+        'set -e',
+        'echo "## Drift Detection Summary" >> $GITHUB_STEP_SUMMARY',
+        'echo "" >> $GITHUB_STEP_SUMMARY',
+        '',
+        'total_stacks=0',
+        'total_drifted=0',
+        'total_errors=0',
+        '',
+        'shopt -s nullglob',
+        'for file in drift-results-*.json drift-results/*/drift-results-*.json; do',
+        '  if [[ -f "$file" ]]; then',
+        '    stage=$(basename "$file" | sed -E \"s/^drift-results-([^.]+)\\.json$/\\1/\")',
+        '    echo "### Stage: $stage" >> $GITHUB_STEP_SUMMARY',
+        '    jq -r \'' +
+            '. as $results |\n' +
+            '"- Total stacks: " + ($results | length | tostring) + "\\n" +\n' +
+            '"- Drifted: " + ([.[] | select(.driftStatus == "DRIFTED")] | length | tostring) + "\\n" +\n' +
+            '"- Errors: " + ([.[] | select(.error)] | length | tostring) + "\\n" +\n' +
+            '([.[] | select(.driftStatus == "DRIFTED")] | if length > 0 then "\\n**Drifted stacks:**\\n" + (map("  - " + .stackName + " (" + ((.driftedResources // []) | length | tostring) + " resources)") | join("\\n")) else "" end)\n' +
+            '\'' +
+            ' "$file" >> $GITHUB_STEP_SUMMARY',
+        '    echo "" >> $GITHUB_STEP_SUMMARY',
+        '    total_stacks=$((total_stacks + $(jq \"length\" \"$file\")))',
+        '    total_drifted=$((total_drifted + $(jq \"[.[] | select(.driftStatus == \\\"DRIFTED\\\")] | length\" \"$file\")))',
+        '    total_errors=$((total_errors + $(jq \"[.[] | select(.error)] | length\" \"$file\")))',
+        '  fi',
+        'done',
+        '',
+        'echo "### Overall Summary" >> $GITHUB_STEP_SUMMARY',
+        'echo "- Total stacks checked: $total_stacks" >> $GITHUB_STEP_SUMMARY',
+        'echo "- Total drifted stacks: $total_drifted" >> $GITHUB_STEP_SUMMARY',
+        'echo "- Total errors: $total_errors" >> $GITHUB_STEP_SUMMARY',
+        '',
+        'if [[ $total_drifted -gt 0 ]]; then',
+        '  echo "" >> $GITHUB_STEP_SUMMARY',
+        '  echo "⚠️ **Action required:** Drift detected in $total_drifted stacks" >> $GITHUB_STEP_SUMMARY',
+        'fi',
+    ].join('\n');
+}
+function toKebabCase(s) {
+    return s.replace(/[^a-zA-Z0-9]+/g, '-').replace(/^-+|-+$/g, '').toLowerCase();
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiQ2RrRHJpZnREZXRlY3Rpb25Xb3JrZmxvdy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3NyYy9DZGtEcmlmdERldGVjdGlvbldvcmtmbG93LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7Ozs7O0FBQUEsOENBQTJEO0FBQzNELHVFQUFrRTtBQUVsRSxNQUFNLGtDQUFrQyxHQUFHLElBQUksQ0FBQztBQUNoRCxNQUFNLDRCQUE0QixHQUFHLElBQUksQ0FBQztBQUMxQyxNQUFNLDZCQUE2QixHQUFHLElBQUksQ0FBQztBQUMzQyxNQUFNLGtDQUFrQyxHQUFHLElBQUksQ0FBQztBQUNoRCxNQUFNLG9DQUFvQyxHQUFHLElBQUksQ0FBQztBQUNsRCxNQUFNLGdDQUFnQyxHQUFHLElBQUksQ0FBQztBQW1COUMsTUFBYSx5QkFBeUI7SUFDcEMsWUFBWSxLQUFxQztRQUMvQyxNQUFNLElBQUksR0FBRyxLQUFLLENBQUMsSUFBSSxJQUFJLHFCQUFxQixDQUFDO1FBQ2pELE1BQU0sUUFBUSxHQUFHLFdBQVcsQ0FBQyxJQUFJLENBQUMsR0FBRyxNQUFNLENBQUM7UUFDNUMsTUFBTSxXQUFXLEdBQUcsS0FBSyxDQUFDLFdBQVcsSUFBSSxNQUFNLENBQUM7UUFDaEQsTUFBTSxZQUFZLEdBQUcsS0FBSyxDQUFDLFlBQVksSUFBSSxJQUFJLENBQUM7UUFDaEQsTUFBTSxPQUFPLEdBQUcsS0FBSyxDQUFDLE9BQU8sQ0FBQztRQUU5QixNQUFNLEVBQUUsR0FBSSxPQUFlLENBQUMsTUFBTSxJQUFJLElBQUksZUFBTSxDQUFDLE9BQU8sQ0FBQyxDQUFDO1FBQzFELE1BQU0sUUFBUSxHQUFHLElBQUksdUJBQWMsQ0FBQyxFQUFFLEVBQUUsSUFBSSxFQUFFLEVBQUUsUUFBUSxFQUFFLENBQUMsQ0FBQztRQUU1RCx5REFBeUQ7UUFDekQsTUFBTSxZQUFZLEdBQUcsS0FBSyxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLEVBQUUsRUFBRSxDQUFDLENBQUMsQ0FBQyxTQUFTLElBQUksY0FBYyxDQUFDLENBQUMsQ0FBQyxTQUFTLENBQUMsQ0FBQyxDQUFDO1FBQ3pGLFFBQVEsQ0FBQyxFQUFFLENBQUM7WUFDVixRQUFRLEVBQUUsS0FBSyxDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQUMsQ0FBQyxFQUFFLElBQUksRUFBRSxLQUFLLENBQUMsUUFBUSxFQUFFLENBQUMsQ0FBQyxDQUFDLENBQUMsU0FBUztZQUNqRSxnQkFBZ0IsRUFBRTtnQkFDaEIsTUFBTSxFQUFFO29CQUNOLEtBQUssRUFBRTt3QkFDTCxXQUFXLEVBQUUsZ0RBQWdEO3dCQUM3RCxRQUFRLEVBQUUsS0FBSzt3QkFDZixJQUFJLEVBQUUsUUFBUTt3QkFDZCxPQUFPLEVBQUUsWUFBWTtxQkFDdEI7aUJBQ0Y7YUFDRjtTQUNGLENBQUMsQ0FBQztRQUVILG9CQUFvQjtRQUNwQixNQUFNLElBQUksR0FBd0IsRUFBRSxDQUFDO1FBQ3JDLEtBQUssTUFBTSxLQUFLLElBQUksS0FBSyxDQUFDLE1BQU0sRUFBRSxDQUFDO1lBQ2pDLE1BQU0sS0FBSyxHQUFHLEtBQUssQ0FBQyxTQUFTLElBQUksY0FBYyxDQUFDLEtBQUssQ0FBQyxTQUFTLENBQUMsQ0FBQztZQUNqRSxNQUFNLEtBQUssR0FBRyxTQUFTLEtBQUssRUFBRSxDQUFDO1lBQy9CLE1BQU0sV0FBVyxHQUFHLGlCQUFpQixLQUFLLE9BQU8sQ0FBQztZQUNsRCxNQUFNLE1BQU0sR0FBRywwR0FBMEcsR0FBRyxLQUFLLEdBQUcsTUFBTSxDQUFDO1lBRTNJLElBQUksQ0FBQyxLQUFLLENBQUMsR0FBRztnQkFDWixJQUFJLEVBQUUscUJBQXFCLEtBQUssRUFBRTtnQkFDbEMsTUFBTSxFQUFFLENBQUMsZUFBZSxDQUFDO2dCQUN6QixXQUFXLEVBQUU7b0JBQ1gsUUFBUSxFQUFFLCtCQUFhLENBQUMsSUFBSTtvQkFDNUIsT0FBTyxFQUFFLCtCQUFhLENBQUMsS0FBSztvQkFDNUIsTUFBTSxFQUFFLCtCQUFhLENBQUMsS0FBSztpQkFDNUI7Z0JBQ0QsR0FBRyxFQUFFO29CQUNILGtCQUFrQixFQUFFLEtBQUssQ0FBQyxNQUFNO29CQUNoQyxVQUFVLEVBQUUsS0FBSyxDQUFDLE1BQU07b0JBQ3hCLHNCQUFzQixFQUFFLFdBQVc7b0JBQ25DLFVBQVUsRUFBRSxLQUFLO29CQUNqQixVQUFVLEVBQUUsS0FBSyxDQUFDLFNBQVM7aUJBQzVCO2dCQUNELEVBQUUsRUFBRSxNQUFNO2dCQUNWLEtBQUssRUFBRTtvQkFDTCxFQUFFLElBQUksRUFBRSxVQUFVLEVBQUUsSUFBSSxFQUFFLG9CQUFvQiw0QkFBNEIsRUFBRSxFQUFFO29CQUM5RTt3QkFDRSxJQUFJLEVBQUUsZUFBZTt3QkFDckIsSUFBSSxFQUFFLHNCQUFzQiw2QkFBNkIsRUFBRTt3QkFDM0QsSUFBSSxFQUFFLEVBQUUsY0FBYyxFQUFFLFdBQVcsRUFBRTtxQkFDdEM7b0JBQ0QsRUFBRSxJQUFJLEVBQUUsc0JBQXNCLEVBQUUsR0FBRyxFQUFFLDBDQUEwQyxFQUFFO29CQUNqRjt3QkFDRSxJQUFJLEVBQUUsaUJBQWlCO3dCQUN2QixJQUFJLEVBQUUseUNBQXlDLGtDQUFrQyxFQUFFO3dCQUNuRixJQUFJLEVBQUU7NEJBQ0osZ0JBQWdCLEVBQUUsS0FBSyxDQUFDLFlBQVk7NEJBQ3BDLG1CQUFtQixFQUFFLGNBQWM7NEJBQ25DLFlBQVksRUFBRSxLQUFLLENBQUMsTUFBTTt5QkFDM0I7cUJBQ0Y7b0JBQ0Q7d0JBQ0UsSUFBSSxFQUFFLGNBQWM7d0JBQ3BCLEVBQUUsRUFBRSxPQUFPO3dCQUNYLGVBQWUsRUFBRSxJQUFJLEVBQUUsdUVBQXVFO3dCQUM5RixHQUFHLEVBQUU7NEJBQ0gsUUFBUTs0QkFDUiwyQ0FBMkM7NEJBQzNDLGtGQUFrRjs0QkFDbEYsb0dBQW9HO3lCQUNyRyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUM7d0JBQ1osR0FBRyxFQUFFOzRCQUNILFVBQVUsRUFBRSxLQUFLLENBQUMsU0FBUzs0QkFDM0IsVUFBVSxFQUFFLEtBQUssQ0FBQyxNQUFNOzRCQUN4QixzQkFBc0IsRUFBRSxXQUFXO3lCQUNwQztxQkFDRjtvQkFDRDt3QkFDRSxJQUFJLEVBQUUsZ0JBQWdCO3dCQUN0QixJQUFJLEVBQUUsMkJBQTJCLGtDQUFrQyxFQUFFO3dCQUNyRSxJQUFJLEVBQUUsRUFBRSxJQUFJLEVBQUUsaUJBQWlCLEtBQUssRUFBRSxFQUFFLElBQUksRUFBRSxXQUFXLEVBQUUsY0FBYyxFQUFFLFFBQVEsRUFBRTtxQkFDdEY7b0JBQ0QsR0FBRyxDQUNELFlBQVk7d0JBQ1YsQ0FBQyxDQUFDOzRCQUNBO2dDQUNFLElBQUksRUFBRSx1QkFBdUI7Z0NBQzdCLEVBQUUsRUFBRSxpRkFBaUY7Z0NBQ3JGLElBQUksRUFBRSx5QkFBeUIsZ0NBQWdDLEVBQUU7Z0NBQ2pFLElBQUksRUFBRSxFQUFFLE1BQU0sRUFBRSxXQUFXLENBQUMsS0FBSyxFQUFFLEtBQUssQ0FBQyxNQUFNLEVBQUUsV0FBVyxDQUFDLEVBQUU7NkJBQ2hFO3lCQUNGO3dCQUNELENBQUMsQ0FBQyxFQUFFLENBQ1A7aUJBQ0Y7YUFDRixDQUFDO1FBQ0osQ0FBQztRQUVELHlCQUF5QjtRQUN6QixJQUFJLENBQUMsZUFBZSxDQUFDLEdBQUc7WUFDdEIsSUFBSSxFQUFFLHlCQUF5QjtZQUMvQixLQUFLLEVBQUUsTUFBTSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDLEVBQUUsRUFBRSxDQUFDLENBQUMsQ0FBQyxVQUFVLENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQyxLQUFLLGVBQWUsQ0FBQztZQUN2RixNQUFNLEVBQUUsQ0FBQyxlQUFlLENBQUM7WUFDekIsV0FBVyxFQUFFLEVBQUUsUUFBUSxFQUFFLCtCQUFhLENBQUMsSUFBSSxFQUFFO1lBQzdDLEtBQUssRUFBRTtnQkFDTDtvQkFDRSxJQUFJLEVBQUUsd0JBQXdCO29CQUM5QixJQUFJLEVBQUUsNkJBQTZCLG9DQUFvQyxFQUFFO29CQUN6RSxJQUFJLEVBQUUsRUFBRSxJQUFJLEVBQUUsZUFBZSxFQUFFO2lCQUNoQztnQkFDRCxFQUFFLElBQUksRUFBRSxrQkFBa0IsRUFBRSxLQUFLLEVBQUUsTUFBTSxFQUFFLEdBQUcsRUFBRSxhQUFhLEVBQUUsRUFBRTthQUNsRTtTQUNGLENBQUM7UUFFRixRQUFRLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxDQUFDO0lBQ3pCLENBQUM7O0FBMUhILDhEQTJIQzs7O0FBRUQsU0FBUyxjQUFjLENBQUMsU0FBaUI7SUFDdkMsTUFBTSxLQUFLLEdBQUcsU0FBUyxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsQ0FBQztJQUNuQyxPQUFPLEtBQUssQ0FBQyxLQUFLLENBQUMsTUFBTSxHQUFHLENBQUMsQ0FBQyxJQUFJLFNBQVMsQ0FBQztBQUM5QyxDQUFDO0FBRUQsU0FBUyxXQUFXLENBQUMsS0FBYSxFQUFFLE1BQWMsRUFBRSxXQUFtQjtJQUNyRSwwRUFBMEU7SUFDMUUsTUFBTSxLQUFLLEdBQUc7UUFDWiwyQkFBMkI7UUFDM0Isd0JBQXdCLFdBQVcsSUFBSTtRQUN2QyxvRkFBb0Y7UUFDcEYsbUVBQW1FO1FBQ25FLHlFQUF5RTtRQUN6RSwrRUFBK0U7UUFDL0Usb0NBQW9DLEtBQUssSUFBSTtRQUM3Qyw4REFBOEQsS0FBSyx1QkFBdUIsTUFBTSw0REFBNEQ7UUFDNUosMkJBQTJCO1FBQzNCLDhEQUE4RDtRQUM5RCxpRUFBaUU7UUFDakUsa0NBQWtDO1FBQ2xDLGtDQUFrQztRQUNsQywrQ0FBK0M7UUFDL0MsMENBQTBDO1FBQzFDLCtEQUErRDtRQUMvRCx5R0FBeUc7UUFDekcsa0JBQWtCO1FBQ2xCLEdBQUc7UUFDSCxrTkFBa047UUFDbE4sK0hBQStIO1FBQy9ILHNDQUFzQztRQUN0Qyx5SkFBeUosS0FBSyxRQUFRO1FBQ3RLLGlDQUFpQztRQUNqQyxxSUFBcUksS0FBSyxRQUFRO1FBQ2xKLFVBQVU7UUFDVixpQ0FBaUM7UUFDakMscUlBQXFJO1FBQ3JJLEdBQUc7S0FDSixDQUFDO0lBQ0YsT0FBTyxLQUFLLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxDQUFDO0FBQzFCLENBQUM7QUFFRCxTQUFTLGFBQWE7SUFDcEIsT0FBTztRQUNMLGFBQWE7UUFDYixRQUFRO1FBQ1IsMkRBQTJEO1FBQzNELGlDQUFpQztRQUNqQyxFQUFFO1FBQ0YsZ0JBQWdCO1FBQ2hCLGlCQUFpQjtRQUNqQixnQkFBZ0I7UUFDaEIsRUFBRTtRQUNGLG1CQUFtQjtRQUNuQiwyRUFBMkU7UUFDM0UsNkJBQTZCO1FBQzdCLGtGQUFrRjtRQUNsRixzREFBc0Q7UUFDdEQsY0FBYztZQUNaLG1CQUFtQjtZQUNuQixpRUFBaUU7WUFDakUsNkZBQTZGO1lBQzdGLHlFQUF5RTtZQUN6RSxnT0FBZ087WUFDbE8sSUFBSTtZQUNKLGtDQUFrQztRQUNsQyxxQ0FBcUM7UUFDckMsaUVBQWlFO1FBQ2pFLHFIQUFxSDtRQUNySCwwRkFBMEY7UUFDMUYsTUFBTTtRQUNOLE1BQU07UUFDTixFQUFFO1FBQ0Ysb0RBQW9EO1FBQ3BELHNFQUFzRTtRQUN0RSx1RUFBdUU7UUFDdkUsOERBQThEO1FBQzlELEVBQUU7UUFDRixxQ0FBcUM7UUFDckMsbUNBQW1DO1FBQ25DLGtHQUFrRztRQUNsRyxJQUFJO0tBQ0wsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLENBQUM7QUFDZixDQUFDO0FBRUQsU0FBUyxXQUFXLENBQUMsQ0FBUztJQUM1QixPQUFPLENBQUMsQ0FBQyxPQUFPLENBQUMsZ0JBQWdCLEVBQUUsR0FBRyxDQUFDLENBQUMsT0FBTyxDQUFDLFVBQVUsRUFBRSxFQUFFLENBQUMsQ0FBQyxXQUFXLEVBQUUsQ0FBQztBQUNoRixDQUFDIiwic291cmNlc0NvbnRlbnQiOlsiaW1wb3J0IHsgR2l0SHViLCBHaXRodWJXb3JrZmxvdyB9IGZyb20gJ3Byb2plbi9saWIvZ2l0aHViJztcbmltcG9ydCB7IEpvYlBlcm1pc3Npb24gfSBmcm9tICdwcm9qZW4vbGliL2dpdGh1Yi93b3JrZmxvd3MtbW9kZWwnO1xuXG5jb25zdCBnaXRodWJBY3Rpb25zQXdzQ3JlZGVudGlhbHNWZXJzaW9uID0gJ3Y1JztcbmNvbnN0IGdpdGh1YkFjdGlvbnNDaGVja291dFZlcnNpb24gPSAndjUnO1xuY29uc3QgZ2l0aHViQWN0aW9uc1NldHVwTm9kZVZlcnNpb24gPSAndjUnO1xuY29uc3QgZ2l0aHViQWN0aW9uc1VwbG9hZEFydGlmYWN0VmVyc2lvbiA9ICd2NCc7XG5jb25zdCBnaXRodWJBY3Rpb25zRG93bmxvYWRBcnRpZmFjdFZlcnNpb24gPSAndjUnO1xuY29uc3QgZ2l0aHViQWN0aW9uc0dpdGh1YlNjcmlwdFZlcnNpb24gPSAndjgnO1xuXG5leHBvcnQgaW50ZXJmYWNlIERyaWZ0U3RhZ2Uge1xuICByZWFkb25seSBzdGFja05hbWU6IHN0cmluZztcbiAgcmVhZG9ubHkgcmVnaW9uOiBzdHJpbmc7XG4gIHJlYWRvbmx5IGRyaWZ0Um9sZUFybjogc3RyaW5nO1xuICByZWFkb25seSBmYWlsT25EcmlmdD86IGJvb2xlYW47IC8vIGlmIHRydWUsIGZhaWwgam9iIHdoZW4gZHJpZnQgZGV0ZWN0ZWQgKGRlZmF1bHQgdHJ1ZSlcbiAgcmVhZG9ubHkgc3RhZ2VOYW1lPzogc3RyaW5nOyAvLyBmcmllbmRseSBuYW1lIGZvciBqb2IgYW5kIGRpc3BhdGNoIG9wdGlvbiwgZGVmYXVsdCBkZXJpdmVkIGZyb20gc3RhY2tOYW1lIHN1ZmZpeFxufVxuXG5leHBvcnQgaW50ZXJmYWNlIENka0RyaWZ0RGV0ZWN0aW9uV29ya2Zsb3dQcm9wcyB7XG4gIHJlYWRvbmx5IHByb2plY3Q6IGFueTsgLy8gYXZvaWQgZXhwb3J0aW5nIHByb2plbiB0eXBlcyBpbiBwdWJsaWMgQVBJXG4gIHJlYWRvbmx5IG5hbWU/OiBzdHJpbmc7IC8vIHdvcmtmbG93IG5hbWUgKGFsc28gdXNlZCB0byBkZXJpdmUgZmlsZSBuYW1lKVxuICByZWFkb25seSBzY2hlZHVsZT86IHN0cmluZzsgLy8gY3JvbiBleHByZXNzaW9uLCBlLmcuICcwIDAgKiAqIConXG4gIHJlYWRvbmx5IGNyZWF0ZUlzc3Vlcz86IGJvb2xlYW47IC8vIGNyZWF0ZS91cGRhdGUgaXNzdWUgd2hlbiBkcmlmdCBkZXRlY3RlZCBvbiBzY2hlZHVsZSAoZGVmYXVsdCB0cnVlKVxuICByZWFkb25seSBzdGFnZXM6IERyaWZ0U3RhZ2VbXTtcbiAgcmVhZG9ubHkgbm9kZVZlcnNpb24/OiBzdHJpbmc7IC8vIGUuZy4sICcyNC54J1xufVxuXG5leHBvcnQgY2xhc3MgQ2RrRHJpZnREZXRlY3Rpb25Xb3JrZmxvdyB7XG4gIGNvbnN0cnVjdG9yKHByb3BzOiBDZGtEcmlmdERldGVjdGlvbldvcmtmbG93UHJvcHMpIHtcbiAgICBjb25zdCBuYW1lID0gcHJvcHMubmFtZSA/PyAnQ0RLIERyaWZ0IERldGVjdGlvbic7XG4gICAgY29uc3QgZmlsZU5hbWUgPSB0b0tlYmFiQ2FzZShuYW1lKSArICcueW1sJztcbiAgICBjb25zdCBub2RlVmVyc2lvbiA9IHByb3BzLm5vZGVWZXJzaW9uID8/ICcyNC54JztcbiAgICBjb25zdCBjcmVhdGVJc3N1ZXMgPSBwcm9wcy5jcmVhdGVJc3N1ZXMgPz8gdHJ1ZTtcbiAgICBjb25zdCBwcm9qZWN0ID0gcHJvcHMucHJvamVjdDtcblxuICAgIGNvbnN0IGdoID0gKHByb2plY3QgYXMgYW55KS5naXRodWIgPz8gbmV3IEdpdEh1Yihwcm9qZWN0KTtcbiAgICBjb25zdCB3b3JrZmxvdyA9IG5ldyBHaXRodWJXb3JrZmxvdyhnaCwgbmFtZSwgeyBmaWxlTmFtZSB9KTtcblxuICAgIC8vIHRyaWdnZXJzOiBzY2hlZHVsZSArIG1hbnVhbCBkaXNwYXRjaCB3aXRoIHN0YWdlIGNob2ljZVxuICAgIGNvbnN0IHN0YWdlQ2hvaWNlcyA9IHByb3BzLnN0YWdlcy5tYXAoKHMpID0+IHMuc3RhZ2VOYW1lID8/IHN0YWdlRnJvbVN0YWNrKHMuc3RhY2tOYW1lKSk7XG4gICAgd29ya2Zsb3cub24oe1xuICAgICAgc2NoZWR1bGU6IHByb3BzLnNjaGVkdWxlID8gW3sgY3JvbjogcHJvcHMuc2NoZWR1bGUgfV0gOiB1bmRlZmluZWQsXG4gICAgICB3b3JrZmxvd0Rpc3BhdGNoOiB7XG4gICAgICAgIGlucHV0czoge1xuICAgICAgICAgIHN0YWdlOiB7XG4gICAgICAgICAgICBkZXNjcmlwdGlvbjogJ1N0YWdlIHRvIGNoZWNrIGZvciBkcmlmdCAobGVhdmUgZW1wdHkgZm9yIGFsbCknLFxuICAgICAgICAgICAgcmVxdWlyZWQ6IGZhbHNlLFxuICAgICAgICAgICAgdHlwZTogJ2Nob2ljZScsXG4gICAgICAgICAgICBvcHRpb25zOiBzdGFnZUNob2ljZXMsXG4gICAgICAgICAgfSxcbiAgICAgICAgfSxcbiAgICAgIH0sXG4gICAgfSk7XG5cbiAgICAvLyBPbmUgam9iIHBlciBzdGFnZVxuICAgIGNvbnN0IGpvYnM6IFJlY29yZDxzdHJpbmcsIGFueT4gPSB7fTtcbiAgICBmb3IgKGNvbnN0IHN0YWdlIG9mIHByb3BzLnN0YWdlcykge1xuICAgICAgY29uc3Qgc2hvcnQgPSBzdGFnZS5zdGFnZU5hbWUgPz8gc3RhZ2VGcm9tU3RhY2soc3RhZ2Uuc3RhY2tOYW1lKTtcbiAgICAgIGNvbnN0IGpvYklkID0gYGRyaWZ0LSR7c2hvcnR9YDtcbiAgICAgIGNvbnN0IHJlc3VsdHNGaWxlID0gYGRyaWZ0LXJlc3VsdHMtJHtzaG9ydH0uanNvbmA7XG4gICAgICBjb25zdCBpZkNvbmQgPSBcIiR7eyBnaXRodWIuZXZlbnRfbmFtZSA9PSAnc2NoZWR1bGUnIHx8IGdpdGh1Yi5ldmVudC5pbnB1dHMuc3RhZ2UgPT0gJycgfHwgZ2l0aHViLmV2ZW50LmlucHV0cy5zdGFnZSA9PSAnXCIgKyBzaG9ydCArIFwiJyB9fVwiO1xuXG4gICAgICBqb2JzW2pvYklkXSA9IHtcbiAgICAgICAgbmFtZTogYERyaWZ0IERldGVjdGlvbiAtICR7c2hvcnR9YCxcbiAgICAgICAgcnVuc09uOiBbJ3VidW50dS1sYXRlc3QnXSxcbiAgICAgICAgcGVybWlzc2lvbnM6IHtcbiAgICAgICAgICBjb250ZW50czogSm9iUGVybWlzc2lvbi5SRUFELFxuICAgICAgICAgIGlkVG9rZW46IEpvYlBlcm1pc3Npb24uV1JJVEUsXG4gICAgICAgICAgaXNzdWVzOiBKb2JQZXJtaXNzaW9uLldSSVRFLFxuICAgICAgICB9LFxuICAgICAgICBlbnY6IHtcbiAgICAgICAgICBBV1NfREVGQVVMVF9SRUdJT046IHN0YWdlLnJlZ2lvbixcbiAgICAgICAgICBBV1NfUkVHSU9OOiBzdGFnZS5yZWdpb24sXG4gICAgICAgICAgRFJJRlRfREVURUNUSU9OX09VVFBVVDogcmVzdWx0c0ZpbGUsXG4gICAgICAgICAgU1RBR0VfTkFNRTogc2hvcnQsXG4gICAgICAgICAgU1RBQ0tfTkFNRTogc3RhZ2Uuc3RhY2tOYW1lLFxuICAgICAgICB9LFxuICAgICAgICBpZjogaWZDb25kLFxuICAgICAgICBzdGVwczogW1xuICAgICAgICAgIHsgbmFtZTogJ0NoZWNrb3V0JywgdXNlczogYGFjdGlvbnMvY2hlY2tvdXRAJHtnaXRodWJBY3Rpb25zQ2hlY2tvdXRWZXJzaW9ufWAgfSxcbiAgICAgICAgICB7XG4gICAgICAgICAgICBuYW1lOiAnU2V0dXAgTm9kZS5qcycsXG4gICAgICAgICAgICB1c2VzOiBgYWN0aW9ucy9zZXR1cC1ub2RlQCR7Z2l0aHViQWN0aW9uc1NldHVwTm9kZVZlcnNpb259YCxcbiAgICAgICAgICAgIHdpdGg6IHsgJ25vZGUtdmVyc2lvbic6IG5vZGVWZXJzaW9uIH0sXG4gICAgICAgICAgfSxcbiAgICAgICAgICB7IG5hbWU6ICdJbnN0YWxsIGRlcGVuZGVuY2llcycsIHJ1bjogJ3lhcm4gaW5zdGFsbCAtLWZyb3plbi1sb2NrZmlsZSB8fCBucG0gY2knIH0sXG4gICAgICAgICAge1xuICAgICAgICAgICAgbmFtZTogJ0FXUyBDcmVkZW50aWFscycsXG4gICAgICAgICAgICB1c2VzOiBgYXdzLWFjdGlvbnMvY29uZmlndXJlLWF3cy1jcmVkZW50aWFsc0Ake2dpdGh1YkFjdGlvbnNBd3NDcmVkZW50aWFsc1ZlcnNpb259YCxcbiAgICAgICAgICAgIHdpdGg6IHtcbiAgICAgICAgICAgICAgJ3JvbGUtdG8tYXNzdW1lJzogc3RhZ2UuZHJpZnRSb2xlQXJuLFxuICAgICAgICAgICAgICAncm9sZS1zZXNzaW9uLW5hbWUnOiAnR2l0SHViQWN0aW9uJyxcbiAgICAgICAgICAgICAgJ2F3cy1yZWdpb24nOiBzdGFnZS5yZWdpb24sXG4gICAgICAgICAgICB9LFxuICAgICAgICAgIH0sXG4gICAgICAgICAge1xuICAgICAgICAgICAgbmFtZTogJ0RldGVjdCBkcmlmdCcsXG4gICAgICAgICAgICBpZDogJ2RyaWZ0JyxcbiAgICAgICAgICAgIGNvbnRpbnVlT25FcnJvcjogdHJ1ZSwgLy8gYWxsb3cgYXJ0aWZhY3QgdXBsb2FkIGFuZCBpc3N1ZSBjcmVhdGlvbiBldmVuIHdoZW4gZHJpZnQgaXMgZGV0ZWN0ZWRcbiAgICAgICAgICAgIHJ1bjogW1xuICAgICAgICAgICAgICAnc2V0IC1lJyxcbiAgICAgICAgICAgICAgLy8gVXNlIHRoZSBidW5kbGVkIHNjcmlwdCBmcm9tIHRoaXMgcGFja2FnZVxuICAgICAgICAgICAgICAnbm9kZSAuL25vZGVfbW9kdWxlcy9AampyYXdsaW5zL2Nkay1kaWZmLXByLWdpdGh1Yi1hY3Rpb24vbGliL2Jpbi9kZXRlY3QtZHJpZnQuanMnLFxuICAgICAgICAgICAgICAnaWYgWyAtZiBcIiREUklGVF9ERVRFQ1RJT05fT1VUUFVUXCIgXTsgdGhlbiBlY2hvIFwiUmVzdWx0cyBmaWxlIGNyZWF0ZWQ6ICREUklGVF9ERVRFQ1RJT05fT1VUUFVUXCI7IGZpJyxcbiAgICAgICAgICAgIF0uam9pbignXFxuJyksXG4gICAgICAgICAgICBlbnY6IHtcbiAgICAgICAgICAgICAgU1RBQ0tfTkFNRTogc3RhZ2Uuc3RhY2tOYW1lLFxuICAgICAgICAgICAgICBBV1NfUkVHSU9OOiBzdGFnZS5yZWdpb24sXG4gICAgICAgICAgICAgIERSSUZUX0RFVEVDVElPTl9PVVRQVVQ6IHJlc3VsdHNGaWxlLFxuICAgICAgICAgICAgfSxcbiAgICAgICAgICB9LFxuICAgICAgICAgIHtcbiAgICAgICAgICAgIG5hbWU6ICdVcGxvYWQgcmVzdWx0cycsXG4gICAgICAgICAgICB1c2VzOiBgYWN0aW9ucy91cGxvYWQtYXJ0aWZhY3RAJHtnaXRodWJBY3Rpb25zVXBsb2FkQXJ0aWZhY3RWZXJzaW9ufWAsXG4gICAgICAgICAgICB3aXRoOiB7IG5hbWU6IGBkcmlmdC1yZXN1bHRzLSR7c2hvcnR9YCwgcGF0aDogcmVzdWx0c0ZpbGUsIGlmTm9GaWxlc0ZvdW5kOiAnaWdub3JlJyB9LFxuICAgICAgICAgIH0sXG4gICAgICAgICAgLi4uKFxuICAgICAgICAgICAgY3JlYXRlSXNzdWVzXG4gICAgICAgICAgICAgID8gW1xuICAgICAgICAgICAgICAgIHtcbiAgICAgICAgICAgICAgICAgIG5hbWU6ICdDcmVhdGUgSXNzdWUgb24gRHJpZnQnLFxuICAgICAgICAgICAgICAgICAgaWY6IFwiYWx3YXlzKCkgJiYgc3RlcHMuZHJpZnQub3V0Y29tZSA9PSAnZmFpbHVyZScgJiYgZ2l0aHViLmV2ZW50X25hbWUgPT0gJ3NjaGVkdWxlJ1wiLFxuICAgICAgICAgICAgICAgICAgdXNlczogYGFjdGlvbnMvZ2l0aHViLXNjcmlwdEAke2dpdGh1YkFjdGlvbnNHaXRodWJTY3JpcHRWZXJzaW9ufWAsXG4gICAgICAgICAgICAgICAgICB3aXRoOiB7IHNjcmlwdDogaXNzdWVTY3JpcHQoc2hvcnQsIHN0YWdlLnJlZ2lvbiwgcmVzdWx0c0ZpbGUpIH0sXG4gICAgICAgICAgICAgICAgfSxcbiAgICAgICAgICAgICAgXVxuICAgICAgICAgICAgICA6IFtdXG4gICAgICAgICAgKSxcbiAgICAgICAgXSxcbiAgICAgIH07XG4gICAgfVxuXG4gICAgLy8gc3VtbWFyeSBhZ2dyZWdhdG9yIGpvYlxuICAgIGpvYnNbJ2RyaWZ0LXN1bW1hcnknXSA9IHtcbiAgICAgIG5hbWU6ICdEcmlmdCBEZXRlY3Rpb24gU3VtbWFyeScsXG4gICAgICBuZWVkczogT2JqZWN0LmtleXMoam9icykuZmlsdGVyKChqKSA9PiBqLnN0YXJ0c1dpdGgoJ2RyaWZ0LScpICYmIGogIT09ICdkcmlmdC1zdW1tYXJ5JyksXG4gICAgICBydW5zT246IFsndWJ1bnR1LWxhdGVzdCddLFxuICAgICAgcGVybWlzc2lvbnM6IHsgY29udGVudHM6IEpvYlBlcm1pc3Npb24uUkVBRCB9LFxuICAgICAgc3RlcHM6IFtcbiAgICAgICAge1xuICAgICAgICAgIG5hbWU6ICdEb3dubG9hZCBhbGwgYXJ0aWZhY3RzJyxcbiAgICAgICAgICB1c2VzOiBgYWN0aW9ucy9kb3dubG9hZC1hcnRpZmFjdEAke2dpdGh1YkFjdGlvbnNEb3dubG9hZEFydGlmYWN0VmVyc2lvbn1gLFxuICAgICAgICAgIHdpdGg6IHsgcGF0aDogJ2RyaWZ0LXJlc3VsdHMnIH0sXG4gICAgICAgIH0sXG4gICAgICAgIHsgbmFtZTogJ0dlbmVyYXRlIHN1bW1hcnknLCBzaGVsbDogJ2Jhc2gnLCBydW46IHN1bW1hcnlTY3JpcHQoKSB9LFxuICAgICAgXSxcbiAgICB9O1xuXG4gICAgd29ya2Zsb3cuYWRkSm9icyhqb2JzKTtcbiAgfVxufVxuXG5mdW5jdGlvbiBzdGFnZUZyb21TdGFjayhzdGFja05hbWU6IHN0cmluZyk6IHN0cmluZyB7XG4gIGNvbnN0IHBhcnRzID0gc3RhY2tOYW1lLnNwbGl0KCctJyk7XG4gIHJldHVybiBwYXJ0c1twYXJ0cy5sZW5ndGggLSAxXSB8fCBzdGFja05hbWU7XG59XG5cbmZ1bmN0aW9uIGlzc3VlU2NyaXB0KHN0YWdlOiBzdHJpbmcsIHJlZ2lvbjogc3RyaW5nLCByZXN1bHRzRmlsZTogc3RyaW5nKTogc3RyaW5nIHtcbiAgLy8gQ29uc3RydWN0IGEgcGxhaW4gSlMgc2NyaXB0IHN0cmluZyAobm8gdGVtcGxhdGUgc3RyaW5nIG5lc3RpbmcgbWlzaGFwcylcbiAgY29uc3QgbGluZXMgPSBbXG4gICAgXCJjb25zdCBmcyA9IHJlcXVpcmUoJ2ZzJyk7XCIsXG4gICAgYGNvbnN0IHJlc3VsdHNGaWxlID0gJyR7cmVzdWx0c0ZpbGV9JztgLFxuICAgIFwiaWYgKCFmcy5leGlzdHNTeW5jKHJlc3VsdHNGaWxlKSkgeyBjb25zb2xlLmxvZygnTm8gcmVzdWx0cyBmaWxlIGZvdW5kJyk7IHJldHVybjsgfVwiLFxuICAgIFwiY29uc3QgcmVzdWx0cyA9IEpTT04ucGFyc2UoZnMucmVhZEZpbGVTeW5jKHJlc3VsdHNGaWxlLCAndXRmOCcpKTtcIixcbiAgICBcImNvbnN0IGRyaWZ0ZWRTdGFja3MgPSByZXN1bHRzLmZpbHRlcihyID0+IHIuZHJpZnRTdGF0dXMgPT09ICdEUklGVEVEJyk7XCIsXG4gICAgXCJpZiAoZHJpZnRlZFN0YWNrcy5sZW5ndGggPT09IDApIHsgY29uc29sZS5sb2coJ05vIGRyaWZ0IGRldGVjdGVkJyk7IHJldHVybjsgfVwiLFxuICAgIGBjb25zdCB0aXRsZSA9ICdEcmlmdCBEZXRlY3RlZCBpbiAke3N0YWdlfSc7YCxcbiAgICBgbGV0IGJvZHkgPSAnIyMgRHJpZnQgRGV0ZWN0aW9uIFJlcG9ydFxcXFxuXFxcXG4nICsgJyoqU3RhZ2U6KiogJHtzdGFnZX1cXFxcbicgKyAnKipSZWdpb246KiogJHtyZWdpb259XFxcXG4nICsgJyoqVGltZToqKiAnICsgbmV3IERhdGUoKS50b0lTT1N0cmluZygpICsgJ1xcXFxuXFxcXG4nO2AsXG4gICAgXCJib2R5ICs9ICcjIyMgU3VtbWFyeVxcXFxuJztcIixcbiAgICBcImJvZHkgKz0gJy0gVG90YWwgc3RhY2tzIGNoZWNrZWQ6ICcgKyByZXN1bHRzLmxlbmd0aCArICdcXFxcbic7XCIsXG4gICAgXCJib2R5ICs9ICctIERyaWZ0ZWQgc3RhY2tzOiAnICsgZHJpZnRlZFN0YWNrcy5sZW5ndGggKyAnXFxcXG5cXFxcbic7XCIsXG4gICAgXCJib2R5ICs9ICcjIyMgRHJpZnRlZCBTdGFja3NcXFxcbic7XCIsXG4gICAgJ2ZvciAoY29uc3QgcyBvZiBkcmlmdGVkU3RhY2tzKSB7JyxcbiAgICAnICBjb25zdCByZXNvdXJjZXMgPSBzLmRyaWZ0ZWRSZXNvdXJjZXMgfHwgW107JyxcbiAgICBcIiAgYm9keSArPSAnIyMjIyAnICsgcy5zdGFja05hbWUgKyAnXFxcXG4nO1wiLFxuICAgIFwiICBib2R5ICs9ICctIERyaWZ0ZWQgcmVzb3VyY2VzOiAnICsgcmVzb3VyY2VzLmxlbmd0aCArICdcXFxcbic7XCIsXG4gICAgXCIgIGZvciAoY29uc3QgciBvZiByZXNvdXJjZXMpIHsgYm9keSArPSAnICAtICcgKyByLmxvZ2ljYWxSZXNvdXJjZUlkICsgJyAoJyArIHIucmVzb3VyY2VUeXBlICsgJylcXFxcbic7IH1cIixcbiAgICBcIiAgYm9keSArPSAnXFxcXG4nO1wiLFxuICAgICd9JyxcbiAgICBcImJvZHkgKz0gJyMjIyBBY3Rpb24gUmVxdWlyZWRcXFxcbicgKyAnUGxlYXNlIHJldmlldyB0aGUgZHJpZnRlZCByZXNvdXJjZXMgYW5kIGVpdGhlcjpcXFxcbjEuIFVwZGF0ZSB0aGUgaW5mcmFzdHJ1Y3R1cmUgY29kZSB0byBtYXRjaCB0aGUgYWN0dWFsIHN0YXRlXFxcXG4yLiBSZXN0b3JlIHRoZSByZXNvdXJjZXMgdG8gbWF0Y2ggdGhlIGV4cGVjdGVkIHN0YXRlXFxcXG5cXFxcbic7XCIsXG4gICAgJ2JvZHkgKz0gYFtWaWV3IHdvcmtmbG93IHJ1bl0oJHtjb250ZXh0LnNlcnZlclVybH0vJHtjb250ZXh0LnJlcG8ub3duZXJ9LyR7Y29udGV4dC5yZXBvLnJlcG99L2FjdGlvbnMvcnVucy8ke2NvbnRleHQucnVuSWR9KWA7JyxcbiAgICAvLyBMaXN0IG9yIHVwZGF0ZSBhbiBpc3N1ZSB3aXRoIGxhYmVsc1xuICAgIGBjb25zdCBpc3N1ZXMgPSBhd2FpdCBnaXRodWIucmVzdC5pc3N1ZXMubGlzdEZvclJlcG8oeyBvd25lcjogY29udGV4dC5yZXBvLm93bmVyLCByZXBvOiBjb250ZXh0LnJlcG8ucmVwbywgc3RhdGU6ICdvcGVuJywgbGFiZWxzOiBbJ2RyaWZ0LWRldGVjdGlvbicsICcke3N0YWdlfSddIH0pO2AsXG4gICAgJ2lmIChpc3N1ZXMuZGF0YS5sZW5ndGggPT09IDApIHsnLFxuICAgIGAgIGF3YWl0IGdpdGh1Yi5yZXN0Lmlzc3Vlcy5jcmVhdGUoeyBvd25lcjogY29udGV4dC5yZXBvLm93bmVyLCByZXBvOiBjb250ZXh0LnJlcG8ucmVwbywgdGl0bGUsIGJvZHksIGxhYmVsczogWydkcmlmdC1kZXRlY3Rpb24nLCAnJHtzdGFnZX0nXSB9KTtgLFxuICAgICd9IGVsc2UgeycsXG4gICAgJyAgY29uc3QgaXNzdWUgPSBpc3N1ZXMuZGF0YVswXTsnLFxuICAgICcgIGF3YWl0IGdpdGh1Yi5yZXN0Lmlzc3Vlcy5jcmVhdGVDb21tZW50KHsgb3duZXI6IGNvbnRleHQucmVwby5vd25lciwgcmVwbzogY29udGV4dC5yZXBvLnJlcG8sIGlzc3VlX251bWJlcjogaXNzdWUubnVtYmVyLCBib2R5IH0pOycsXG4gICAgJ30nLFxuICBdO1xuICByZXR1cm4gbGluZXMuam9pbignXFxuJyk7XG59XG5cbmZ1bmN0aW9uIHN1bW1hcnlTY3JpcHQoKTogc3RyaW5nIHtcbiAgcmV0dXJuIFtcbiAgICAnIyEvYmluL2Jhc2gnLFxuICAgICdzZXQgLWUnLFxuICAgICdlY2hvIFwiIyMgRHJpZnQgRGV0ZWN0aW9uIFN1bW1hcnlcIiA+PiAkR0lUSFVCX1NURVBfU1VNTUFSWScsXG4gICAgJ2VjaG8gXCJcIiA+PiAkR0lUSFVCX1NURVBfU1VNTUFSWScsXG4gICAgJycsXG4gICAgJ3RvdGFsX3N0YWNrcz0wJyxcbiAgICAndG90YWxfZHJpZnRlZD0wJyxcbiAgICAndG90YWxfZXJyb3JzPTAnLFxuICAgICcnLFxuICAgICdzaG9wdCAtcyBudWxsZ2xvYicsXG4gICAgJ2ZvciBmaWxlIGluIGRyaWZ0LXJlc3VsdHMtKi5qc29uIGRyaWZ0LXJlc3VsdHMvKi9kcmlmdC1yZXN1bHRzLSouanNvbjsgZG8nLFxuICAgICcgIGlmIFtbIC1mIFwiJGZpbGVcIiBdXTsgdGhlbicsXG4gICAgJyAgICBzdGFnZT0kKGJhc2VuYW1lIFwiJGZpbGVcIiB8IHNlZCAtRSBcXFwicy9eZHJpZnQtcmVzdWx0cy0oW14uXSspXFxcXC5qc29uJC9cXFxcMS9cXFwiKScsXG4gICAgJyAgICBlY2hvIFwiIyMjIFN0YWdlOiAkc3RhZ2VcIiA+PiAkR0lUSFVCX1NURVBfU1VNTUFSWScsXG4gICAgJyAgICBqcSAtciBcXCcnICtcbiAgICAgICcuIGFzICRyZXN1bHRzIHxcXG4nICtcbiAgICAgICdcIi0gVG90YWwgc3RhY2tzOiBcIiArICgkcmVzdWx0cyB8IGxlbmd0aCB8IHRvc3RyaW5nKSArIFwiXFxcXG5cIiArXFxuJyArXG4gICAgICAnXCItIERyaWZ0ZWQ6IFwiICsgKFsuW10gfCBzZWxlY3QoLmRyaWZ0U3RhdHVzID09IFwiRFJJRlRFRFwiKV0gfCBsZW5ndGggfCB0b3N0cmluZykgKyBcIlxcXFxuXCIgK1xcbicgK1xuICAgICAgJ1wiLSBFcnJvcnM6IFwiICsgKFsuW10gfCBzZWxlY3QoLmVycm9yKV0gfCBsZW5ndGggfCB0b3N0cmluZykgKyBcIlxcXFxuXCIgK1xcbicgK1xuICAgICAgJyhbLltdIHwgc2VsZWN0KC5kcmlmdFN0YXR1cyA9PSBcIkRSSUZURURcIildIHwgaWYgbGVuZ3RoID4gMCB0aGVuIFwiXFxcXG4qKkRyaWZ0ZWQgc3RhY2tzOioqXFxcXG5cIiArIChtYXAoXCIgIC0gXCIgKyAuc3RhY2tOYW1lICsgXCIgKFwiICsgKCguZHJpZnRlZFJlc291cmNlcyAvLyBbXSkgfCBsZW5ndGggfCB0b3N0cmluZykgKyBcIiByZXNvdXJjZXMpXCIpIHwgam9pbihcIlxcXFxuXCIpKSBlbHNlIFwiXCIgZW5kKVxcbicgK1xuICAgICdcXCcnICtcbiAgICAnIFwiJGZpbGVcIiA+PiAkR0lUSFVCX1NURVBfU1VNTUFSWScsXG4gICAgJyAgICBlY2hvIFwiXCIgPj4gJEdJVEhVQl9TVEVQX1NVTU1BUlknLFxuICAgICcgICAgdG90YWxfc3RhY2tzPSQoKHRvdGFsX3N0YWNrcyArICQoanEgXFxcImxlbmd0aFxcXCIgXFxcIiRmaWxlXFxcIikpKScsXG4gICAgJyAgICB0b3RhbF9kcmlmdGVkPSQoKHRvdGFsX2RyaWZ0ZWQgKyAkKGpxIFxcXCJbLltdIHwgc2VsZWN0KC5kcmlmdFN0YXR1cyA9PSBcXFxcXFxcIkRSSUZURURcXFxcXFxcIildIHwgbGVuZ3RoXFxcIiBcXFwiJGZpbGVcXFwiKSkpJyxcbiAgICAnICAgIHRvdGFsX2Vycm9ycz0kKCh0b3RhbF9lcnJvcnMgKyAkKGpxIFxcXCJbLltdIHwgc2VsZWN0KC5lcnJvcildIHwgbGVuZ3RoXFxcIiBcXFwiJGZpbGVcXFwiKSkpJyxcbiAgICAnICBmaScsXG4gICAgJ2RvbmUnLFxuICAgICcnLFxuICAgICdlY2hvIFwiIyMjIE92ZXJhbGwgU3VtbWFyeVwiID4+ICRHSVRIVUJfU1RFUF9TVU1NQVJZJyxcbiAgICAnZWNobyBcIi0gVG90YWwgc3RhY2tzIGNoZWNrZWQ6ICR0b3RhbF9zdGFja3NcIiA+PiAkR0lUSFVCX1NURVBfU1VNTUFSWScsXG4gICAgJ2VjaG8gXCItIFRvdGFsIGRyaWZ0ZWQgc3RhY2tzOiAkdG90YWxfZHJpZnRlZFwiID4+ICRHSVRIVUJfU1RFUF9TVU1NQVJZJyxcbiAgICAnZWNobyBcIi0gVG90YWwgZXJyb3JzOiAkdG90YWxfZXJyb3JzXCIgPj4gJEdJVEhVQl9TVEVQX1NVTU1BUlknLFxuICAgICcnLFxuICAgICdpZiBbWyAkdG90YWxfZHJpZnRlZCAtZ3QgMCBdXTsgdGhlbicsXG4gICAgJyAgZWNobyBcIlwiID4+ICRHSVRIVUJfU1RFUF9TVU1NQVJZJyxcbiAgICAnICBlY2hvIFwi4pqg77iPICoqQWN0aW9uIHJlcXVpcmVkOioqIERyaWZ0IGRldGVjdGVkIGluICR0b3RhbF9kcmlmdGVkIHN0YWNrc1wiID4+ICRHSVRIVUJfU1RFUF9TVU1NQVJZJyxcbiAgICAnZmknLFxuICBdLmpvaW4oJ1xcbicpO1xufVxuXG5mdW5jdGlvbiB0b0tlYmFiQ2FzZShzOiBzdHJpbmcpOiBzdHJpbmcge1xuICByZXR1cm4gcy5yZXBsYWNlKC9bXmEtekEtWjAtOV0rL2csICctJykucmVwbGFjZSgvXi0rfC0rJC9nLCAnJykudG9Mb3dlckNhc2UoKTtcbn1cbiJdfQ==

@@ -0,0 +1,10 @@
+export interface CdkDriftIamTemplateProps {
+    readonly project: any;
+    readonly roleName: string;
+    readonly outputPath?: string;
+    readonly oidcRoleArn: string;
+    readonly oidcRegion: string;
+}
+export declare class CdkDriftIamTemplate {
+    constructor(props: CdkDriftIamTemplateProps);
+}

@@ -0,0 +1,76 @@
+"use strict";
+var _a;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CdkDriftIamTemplate = void 0;
+const JSII_RTTI_SYMBOL_1 = Symbol.for("jsii.rtti");
+const projen_1 = require("projen");
+class CdkDriftIamTemplate {
+    constructor(props) {
+        const outputPath = props.outputPath ?? 'cdk-drift-workflow-iam-template.yaml';
+        props.project.addTask('deploy-cdkdrift-iam-template', {
+            description: 'Deploy the CDK Drift Detection IAM template via CloudFormation (accepts extra AWS CLI args, e.g., --parameter-overrides Key=Value...)',
+            receiveArgs: true,
+            exec: `aws cloudformation deploy --template-file ${outputPath} --stack-name cdk-drift-workflow-iam-role --capabilities CAPABILITY_NAMED_IAM`,
+        });
+        new projen_1.TextFile(props.project, outputPath, {
+            lines: [
+                "AWSTemplateFormatVersion: '2010-09-09'",
+                "Description: 'IAM role for CDK Drift Detection Workflow'",
+                '',
+                'Parameters:',
+                '  GitHubOIDCRoleArn:',
+                '    Type: String',
+                "    Description: 'ARN of the existing GitHub OIDC role that can assume this drift role'",
+                `    Default: '${props.oidcRoleArn}'`,
+                '',
+                'Resources:',
+                '  # CloudFormation Drift Detection Role - minimal permissions for drift detection operations',
+                '  CdkDriftRole:',
+                '    Type: AWS::IAM::Role',
+                '    Properties:',
+                "      RoleName: '" + props.roleName + "'",
+                '      AssumeRolePolicyDocument:',
+                "        Version: '2012-10-17'",
+                '        Statement:',
+                '          - Effect: Allow',
+                '            Principal:',
+                '              AWS: !Ref GitHubOIDCRoleArn',
+                '            Action: sts:AssumeRole',
+                '            Condition:',
+                '              StringEquals:',
+                "                aws:RequestedRegion: '" + props.oidcRegion + "'",
+                '      Policies:',
+                '        - PolicyName: CloudFormationDriftAccess',
+                '          PolicyDocument:',
+                "            Version: '2012-10-17'",
+                '            Statement:',
+                '              # CloudFormation drift detection operations',
+                '              - Effect: Allow',
+                '                Action:',
+                '                  - cloudformation:DetectStackDrift',
+                '                  - cloudformation:DescribeStackDriftDetectionStatus',
+                '                  - cloudformation:DescribeStackResourceDrifts',
+                '                  - cloudformation:DescribeStacks',
+                '                  - cloudformation:ListStackResources',
+                "                Resource: '*'",
+                '',
+                'Outputs:',
+                '  CdkDriftRoleArn:',
+                "    Description: 'ARN of the CDK drift detection role'",
+                '    Value: !GetAtt CdkDriftRole.Arn',
+                '    Export:',
+                "      Name: !Sub '${AWS::StackName}-CdkDriftRoleArn'",
+                '',
+                '  CdkDriftRoleName:',
+                "    Description: 'Name of the CDK drift detection role'",
+                '    Value: !Ref CdkDriftRole',
+                '    Export:',
+                "      Name: !Sub '${AWS::StackName}-CdkDriftRoleName'",
+            ],
+        });
+    }
+}
+exports.CdkDriftIamTemplate = CdkDriftIamTemplate;
+_a = JSII_RTTI_SYMBOL_1;
+CdkDriftIamTemplate[_a] = { fqn: "@jjrawlins/cdk-diff-pr-github-action.CdkDriftIamTemplate", version: "0.0.0" };
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiQ2RrRHJpZnRJYW1UZW1wbGF0ZS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3NyYy9DZGtEcmlmdElhbVRlbXBsYXRlLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7Ozs7O0FBQUEsbUNBQWtDO0FBVWxDLE1BQWEsbUJBQW1CO0lBQzlCLFlBQVksS0FBK0I7UUFDekMsTUFBTSxVQUFVLEdBQUcsS0FBSyxDQUFDLFVBQVUsSUFBSSxzQ0FBc0MsQ0FBQztRQUU5RSxLQUFLLENBQUMsT0FBTyxDQUFDLE9BQU8sQ0FBQyw4QkFBOEIsRUFBRTtZQUNwRCxXQUFXLEVBQ1QsdUlBQXVJO1lBQ3pJLFdBQVcsRUFBRSxJQUFJO1lBQ2pCLElBQUksRUFDRiw2Q0FBNkMsVUFBVSwrRUFBK0U7U0FDekksQ0FBQyxDQUFDO1FBRUgsSUFBSSxpQkFBUSxDQUFDLEtBQUssQ0FBQyxPQUFPLEVBQUUsVUFBVSxFQUFFO1lBQ3RDLEtBQUssRUFBRTtnQkFDTCx3Q0FBd0M7Z0JBQ3hDLDBEQUEwRDtnQkFDMUQsRUFBRTtnQkFDRixhQUFhO2dCQUNiLHNCQUFzQjtnQkFDdEIsa0JBQWtCO2dCQUNsQix5RkFBeUY7Z0JBQ3pGLGlCQUFpQixLQUFLLENBQUMsV0FBVyxHQUFHO2dCQUNyQyxFQUFFO2dCQUNGLFlBQVk7Z0JBQ1osOEZBQThGO2dCQUM5RixpQkFBaUI7Z0JBQ2pCLDBCQUEwQjtnQkFDMUIsaUJBQWlCO2dCQUNqQixtQkFBbUIsR0FBRyxLQUFLLENBQUMsUUFBUSxHQUFHLEdBQUc7Z0JBQzFDLGlDQUFpQztnQkFDakMsK0JBQStCO2dCQUMvQixvQkFBb0I7Z0JBQ3BCLDJCQUEyQjtnQkFDM0Isd0JBQXdCO2dCQUN4QiwyQ0FBMkM7Z0JBQzNDLG9DQUFvQztnQkFDcEMsd0JBQXdCO2dCQUN4Qiw2QkFBNkI7Z0JBQzdCLHdDQUF3QyxHQUFHLEtBQUssQ0FBQyxVQUFVLEdBQUcsR0FBRztnQkFDakUsaUJBQWlCO2dCQUNqQixpREFBaUQ7Z0JBQ2pELDJCQUEyQjtnQkFDM0IsbUNBQW1DO2dCQUNuQyx3QkFBd0I7Z0JBQ3hCLDJEQUEyRDtnQkFDM0QsK0JBQStCO2dCQUMvQix5QkFBeUI7Z0JBQ3pCLHFEQUFxRDtnQkFDckQsc0VBQXNFO2dCQUN0RSxnRUFBZ0U7Z0JBQ2hFLG1EQUFtRDtnQkFDbkQsdURBQXVEO2dCQUN2RCwrQkFBK0I7Z0JBQy9CLEVBQUU7Z0JBQ0YsVUFBVTtnQkFDVixvQkFBb0I7Z0JBQ3BCLHdEQUF3RDtnQkFDeEQscUNBQXFDO2dCQUNyQyxhQUFhO2dCQUNiLHNEQUFzRDtnQkFDdEQsRUFBRTtnQkFDRixxQkFBcUI7Z0JBQ3JCLHlEQUF5RDtnQkFDekQsOEJBQThCO2dCQUM5QixhQUFhO2dCQUNiLHVEQUF1RDthQUN4RDtTQUNGLENBQUMsQ0FBQztJQUNMLENBQUM7O0FBcEVILGtEQXFFQyIsInNvdXJjZXNDb250ZW50IjpbImltcG9ydCB7IFRleHRGaWxlIH0gZnJvbSAncHJvamVuJztcblxuZXhwb3J0IGludGVyZmFjZSBDZGtEcmlmdElhbVRlbXBsYXRlUHJvcHMge1xuICByZWFkb25seSBwcm9qZWN0OiBhbnk7XG4gIHJlYWRvbmx5IHJvbGVOYW1lOiBzdHJpbmc7XG4gIHJlYWRvbmx5IG91dHB1dFBhdGg/OiBzdHJpbmc7XG4gIHJlYWRvbmx5IG9pZGNSb2xlQXJuOiBzdHJpbmc7XG4gIHJlYWRvbmx5IG9pZGNSZWdpb246IHN0cmluZztcbn1cblxuZXhwb3J0IGNsYXNzIENka0RyaWZ0SWFtVGVtcGxhdGUge1xuICBjb25zdHJ1Y3Rvcihwcm9wczogQ2RrRHJpZnRJYW1UZW1wbGF0ZVByb3BzKSB7XG4gICAgY29uc3Qgb3V0cHV0UGF0aCA9IHByb3BzLm91dHB1dFBhdGggPz8gJ2Nkay1kcmlmdC13b3JrZmxvdy1pYW0tdGVtcGxhdGUueWFtbCc7XG5cbiAgICBwcm9wcy5wcm9qZWN0LmFkZFRhc2soJ2RlcGxveS1jZGtkcmlmdC1pYW0tdGVtcGxhdGUnLCB7XG4gICAgICBkZXNjcmlwdGlvbjpcbiAgICAgICAgJ0RlcGxveSB0aGUgQ0RLIERyaWZ0IERldGVjdGlvbiBJQU0gdGVtcGxhdGUgdmlhIENsb3VkRm9ybWF0aW9uIChhY2NlcHRzIGV4dHJhIEFXUyBDTEkgYXJncywgZS5nLiwgLS1wYXJhbWV0ZXItb3ZlcnJpZGVzIEtleT1WYWx1ZS4uLiknLFxuICAgICAgcmVjZWl2ZUFyZ3M6IHRydWUsXG4gICAgICBleGVjOlxuICAgICAgICBgYXdzIGNsb3VkZm9ybWF0aW9uIGRlcGxveSAtLXRlbXBsYXRlLWZpbGUgJHtvdXRwdXRQYXRofSAtLXN0YWNrLW5hbWUgY2RrLWRyaWZ0LXdvcmtmbG93LWlhbS1yb2xlIC0tY2FwYWJpbGl0aWVzIENBUEFCSUxJVFlfTkFNRURfSUFNYCxcbiAgICB9KTtcblxuICAgIG5ldyBUZXh0RmlsZShwcm9wcy5wcm9qZWN0LCBvdXRwdXRQYXRoLCB7XG4gICAgICBsaW5lczogW1xuICAgICAgICBcIkFXU1RlbXBsYXRlRm9ybWF0VmVyc2lvbjogJzIwMTAtMDktMDknXCIsXG4gICAgICAgIFwiRGVzY3JpcHRpb246ICdJQU0gcm9sZSBmb3IgQ0RLIERyaWZ0IERldGVjdGlvbiBXb3JrZmxvdydcIixcbiAgICAgICAgJycsXG4gICAgICAgICdQYXJhbWV0ZXJzOicsXG4gICAgICAgICcgIEdpdEh1Yk9JRENSb2xlQXJuOicsXG4gICAgICAgICcgICAgVHlwZTogU3RyaW5nJyxcbiAgICAgICAgXCIgICAgRGVzY3JpcHRpb246ICdBUk4gb2YgdGhlIGV4aXN0aW5nIEdpdEh1YiBPSURDIHJvbGUgdGhhdCBjYW4gYXNzdW1lIHRoaXMgZHJpZnQgcm9sZSdcIixcbiAgICAgICAgYCAgICBEZWZhdWx0OiAnJHtwcm9wcy5vaWRjUm9sZUFybn0nYCxcbiAgICAgICAgJycsXG4gICAgICAgICdSZXNvdXJjZXM6JyxcbiAgICAgICAgJyAgIyBDbG91ZEZvcm1hdGlvbiBEcmlmdCBEZXRlY3Rpb24gUm9sZSAtIG1pbmltYWwgcGVybWlzc2lvbnMgZm9yIGRyaWZ0IGRldGVjdGlvbiBvcGVyYXRpb25zJyxcbiAgICAgICAgJyAgQ2RrRHJpZnRSb2xlOicsXG4gICAgICAgICcgICAgVHlwZTogQVdTOjpJQU06OlJvbGUnLFxuICAgICAgICAnICAgIFByb3BlcnRpZXM6JyxcbiAgICAgICAgXCIgICAgICBSb2xlTmFtZTogJ1wiICsgcHJvcHMucm9sZU5hbWUgKyBcIidcIixcbiAgICAgICAgJyAgICAgIEFzc3VtZVJvbGVQb2xpY3lEb2N1bWVudDonLFxuICAgICAgICBcIiAgICAgICAgVmVyc2lvbjogJzIwMTItMTAtMTcnXCIsXG4gICAgICAgICcgICAgICAgIFN0YXRlbWVudDonLFxuICAgICAgICAnICAgICAgICAgIC0gRWZmZWN0OiBBbGxvdycsXG4gICAgICAgICcgICAgICAgICAgICBQcmluY2lwYWw6JyxcbiAgICAgICAgJyAgICAgICAgICAgICAgQVdTOiAhUmVmIEdpdEh1Yk9JRENSb2xlQXJuJyxcbiAgICAgICAgJyAgICAgICAgICAgIEFjdGlvbjogc3RzOkFzc3VtZVJvbGUnLFxuICAgICAgICAnICAgICAgICAgICAgQ29uZGl0aW9uOicsXG4gICAgICAgICcgICAgICAgICAgICAgIFN0cmluZ0VxdWFsczonLFxuICAgICAgICBcIiAgICAgICAgICAgICAgICBhd3M6UmVxdWVzdGVkUmVnaW9uOiAnXCIgKyBwcm9wcy5vaWRjUmVnaW9uICsgXCInXCIsXG4gICAgICAgICcgICAgICBQb2xpY2llczonLFxuICAgICAgICAnICAgICAgICAtIFBvbGljeU5hbWU6IENsb3VkRm9ybWF0aW9uRHJpZnRBY2Nlc3MnLFxuICAgICAgICAnICAgICAgICAgIFBvbGljeURvY3VtZW50OicsXG4gICAgICAgIFwiICAgICAgICAgICAgVmVyc2lvbjogJzIwMTItMTAtMTcnXCIsXG4gICAgICAgICcgICAgICAgICAgICBTdGF0ZW1lbnQ6JyxcbiAgICAgICAgJyAgICAgICAgICAgICAgIyBDbG91ZEZvcm1hdGlvbiBkcmlmdCBkZXRlY3Rpb24gb3BlcmF0aW9ucycsXG4gICAgICAgICcgICAgICAgICAgICAgIC0gRWZmZWN0OiBBbGxvdycsXG4gICAgICAgICcgICAgICAgICAgICAgICAgQWN0aW9uOicsXG4gICAgICAgICcgICAgICAgICAgICAgICAgICAtIGNsb3VkZm9ybWF0aW9uOkRldGVjdFN0YWNrRHJpZnQnLFxuICAgICAgICAnICAgICAgICAgICAgICAgICAgLSBjbG91ZGZvcm1hdGlvbjpEZXNjcmliZVN0YWNrRHJpZnREZXRlY3Rpb25TdGF0dXMnLFxuICAgICAgICAnICAgICAgICAgICAgICAgICAgLSBjbG91ZGZvcm1hdGlvbjpEZXNjcmliZVN0YWNrUmVzb3VyY2VEcmlmdHMnLFxuICAgICAgICAnICAgICAgICAgICAgICAgICAgLSBjbG91ZGZvcm1hdGlvbjpEZXNjcmliZVN0YWNrcycsXG4gICAgICAgICcgICAgICAgICAgICAgICAgICAtIGNsb3VkZm9ybWF0aW9uOkxpc3RTdGFja1Jlc291cmNlcycsXG4gICAgICAgIFwiICAgICAgICAgICAgICAgIFJlc291cmNlOiAnKidcIixcbiAgICAgICAgJycsXG4gICAgICAgICdPdXRwdXRzOicsXG4gICAgICAgICcgIENka0RyaWZ0Um9sZUFybjonLFxuICAgICAgICBcIiAgICBEZXNjcmlwdGlvbjogJ0FSTiBvZiB0aGUgQ0RLIGRyaWZ0IGRldGVjdGlvbiByb2xlJ1wiLFxuICAgICAgICAnICAgIFZhbHVlOiAhR2V0QXR0IENka0RyaWZ0Um9sZS5Bcm4nLFxuICAgICAgICAnICAgIEV4cG9ydDonLFxuICAgICAgICBcIiAgICAgIE5hbWU6ICFTdWIgJyR7QVdTOjpTdGFja05hbWV9LUNka0RyaWZ0Um9sZUFybidcIixcbiAgICAgICAgJycsXG4gICAgICAgICcgIENka0RyaWZ0Um9sZU5hbWU6JyxcbiAgICAgICAgXCIgICAgRGVzY3JpcHRpb246ICdOYW1lIG9mIHRoZSBDREsgZHJpZnQgZGV0ZWN0aW9uIHJvbGUnXCIsXG4gICAgICAgICcgICAgVmFsdWU6ICFSZWYgQ2RrRHJpZnRSb2xlJyxcbiAgICAgICAgJyAgICBFeHBvcnQ6JyxcbiAgICAgICAgXCIgICAgICBOYW1lOiAhU3ViICcke0FXUzo6U3RhY2tOYW1lfS1DZGtEcmlmdFJvbGVOYW1lJ1wiLFxuICAgICAgXSxcbiAgICB9KTtcbiAgfVxufVxuIl19

@@ -0,0 +1,9 @@
+import { AwsCdkTypeScriptApp } from 'projen/lib/awscdk';
+interface CdkChangesetScriptProps {
+    project: AwsCdkTypeScriptApp;
+    outputPath?: string;
+}
+export declare class CdkChangesetScript {
+    constructor(props: CdkChangesetScriptProps);
+}
+export {};