npm - @jjrawlins/cdk-diff-pr-github-action - Versions diffs - 0.0.2-beta → 0.0.3-beta - Mend

@jjrawlins/cdk-diff-pr-github-action 0.0.2-beta → 0.0.3-beta

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (243) hide show

package/.yalc/@jjrawlins/cdk-diff-pr-github-action/.yalc/@jjrawlins/cdk-diff-pr-github-action/.yalc/@jjrawlins/cdk-diff-pr-github-action/.yalc/@jjrawlins/cdk-diff-pr-github-action/.yalc/@jjrawlins/cdk-diff-pr-github-action/.yalc/@jjrawlins/cdk-diff-pr-github-action/.yalc/@jjrawlins/cdk-diff-pr-github-action/.yalc/@jjrawlins/cdk-diff-pr-github-action/README.md ADDED Viewed

@@ -0,0 +1,146 @@
+# cdk-diff-pr-github-action
+A small Projen-based helper library that wires a GitHub workflow to create a CloudFormation Change Set for a CDK stack on every pull request, then comments the formatted diff back on the PR. It also provides a ready‑to‑deploy IAM template you can use to grant the minimal permissions required for the workflow to create and inspect change sets.
+This package exposes two constructs:
+- `CdkDiffStackWorkflow` — Generates one GitHub Actions workflow per stack that:
+  - Assumes your GitHub OIDC role
+  - Optionally chains into a separate CDK deploy role
+  - Runs `cdk deploy --no-execute` to create a change set
+  - Runs a generated script to render the change set as an HTML table and posts it to the PR and to the GitHub Step Summary
+  - Cleans up the change set
+- `CdkDiffIamTemplate` — Emits a CloudFormation template file (`cdk-diff-workflow-iam-template.yaml`) containing an example IAM role policy with the minimal permissions to create, describe, and delete CloudFormation change sets and read common CDK bootstrap resources. You can launch this in your account and then reference the created role.
+## Quick start
+1) Add the constructs to your Projen project (in `.projenrc.ts`).
+2) Synthesize with `npx projen`.
+3) Commit the generated files.
+4) Open a pull request — the workflow will create a change set and comment the diff.
+## Usage: CdkDiffStackWorkflow
+`CdkDiffStackWorkflow` renders a workflow per stack named `diff-<StackName>.yml` under `.github/workflows/`. It also generates a helper script at `.github/workflows/scripts/describe-cfn-changeset.ts` that formats the change set output and takes care of posting the PR comment and Step Summary.
+Example `.projenrc.ts`:
+```ts
+import { awscdk } from 'projen';
+import { CdkDiffStackWorkflow } from '@jjrawlins/cdk-diff-pr-github-action';
+const project = new awscdk.AwsCdkConstructLibrary({
+  // ... your usual settings ...
+  workflowName: 'my-lib',
+  defaultReleaseBranch: 'main',
+  cdkVersion: '2.85.0',
+  github: true,
+});
+new CdkDiffStackWorkflow({
+  project,
+  // Stacks to diff on PRs
+  stacks: [
+    {
+      stackName: 'MyAppStack',
+      changesetRoleToAssumeArn: 'arn:aws:iam::123456789012:role/cdk-diff-role',
+      changesetRoleToAssumeRegion: 'us-east-1',
+      // Optional per‑stack OIDC override (if not using the defaults below)
+      // oidcRoleArn: 'arn:aws:iam::123456789012:role/github-oidc-role',
+      // oidcRegion: 'us-east-1',
+    },
+  ],
+  // Default OIDC role/region used by all stacks unless overridden per‑stack
+  oidcRoleArn: 'arn:aws:iam::123456789012:role/github-oidc-role',
+  oidcRegion: 'us-east-1',
+  // Optional: Node version used in the workflow (default: '24.x')
+  // nodeVersion: '20.x',
+  // Optional: Yarn command to run CDK (default: 'cdk')
+  // cdkYarnCommand: 'cdk',
+  // Optional: Where to place the helper script
+  // scriptOutputPath: '.github/workflows/scripts/describe-cfn-changeset.ts',
+});
+project.synth();
+```
+### Required properties
+- `project` (AwsCdkTypeScriptApp) — Your Projen project instance.
+- `stacks` (array) — One entry per CDK stack you want a diff for.
+- OIDC configuration: either
+  - Provide `oidcRoleArn` and `oidcRegion` at the top level, or
+  - Provide `oidcRoleArn` and `oidcRegion` on every stack item.
+If neither the defaults nor all per‑stack values are supplied, the construct throws with a helpful error.
+### Stack item fields
+- `stackName` — The CDK stack workflowName to create the change set for.
+- `changesetRoleToAssumeArn` — The ARN of the role used to create the change set (role chaining after OIDC).
+- `changesetRoleToAssumeRegion` — The region for that role.
+- `oidcRoleArn` (optional) — Per‑stack override for the OIDC role.
+- `oidcRegion` (optional) — Per‑stack override for the OIDC region.
+### What gets generated
+- `.github/workflows/diff-<StackName>.yml` — One workflow per stack, triggered on PR open/sync/reopen.
+- `.github/workflows/scripts/describe-cfn-changeset.ts` — A helper script that:
+  - Polls `DescribeChangeSet` until terminal
+  - Filters out ignorable logical IDs or resource types using environment variables `IGNORE_LOGICAL_IDS` and `IGNORE_RESOURCE_TYPES`
+  - Renders an HTML table with actions, logical IDs, types, replacements, and changed properties
+  - Prints the HTML, appends to the GitHub Step Summary, and (if `GITHUB_TOKEN` and `GITHUB_COMMENT_URL` are present) posts a PR comment
+### Environment variables used by the script
+- `STACK_NAME` (required) — Stack workflowName to describe.
+- `CHANGE_SET_NAME` (default: same as `STACK_NAME`).
+- `AWS_REGION` — Region for CloudFormation API calls. The workflow sets this via the credentials action.
+- `GITHUB_TOKEN` (optional) — If set with `GITHUB_COMMENT_URL`, posts a PR comment.
+- `GITHUB_COMMENT_URL` (optional) — PR comments URL.
+- `GITHUB_STEP_SUMMARY` (optional) — When present, appends the HTML to the step summary file.
+- `IGNORE_LOGICAL_IDS` (optional) — Comma‑separated logical IDs to ignore (default includes `CDKMetadata`).
+- `IGNORE_RESOURCE_TYPES` (optional) — Comma‑separated resource types to ignore (e.g., `AWS::CDK::Metadata`).
+## Usage: CdkDiffIamTemplate
+Add `CdkDiffIamTemplate` to your Projen project to emit an example IAM template you can deploy in your account:
+```ts
+import { awscdk } from 'projen';
+import { CdkDiffIamTemplate } from '@jjrawlins/cdk-diff-pr-github-action';
+const project = new awscdk.AwsCdkConstructLibrary({
+  // ...
+});
+new CdkDiffIamTemplate({ project });
+project.synth();
+```
+This will write `cdk-diff-workflow-iam-template.yaml` at the project root. The template defines:
+- A parameter `GitHubOIDCRoleArn` — pass the ARN of your existing GitHub OIDC role that will assume the change set role.
+- An IAM role `CdkChangesetRole` with minimal permissions for:
+  - CloudFormation Change Set operations
+  - Access to common CDK bootstrap S3 buckets and SSM parameters
+  - `iam:PassRole` to `cloudformation.amazonaws.com`
+- Outputs exporting the role workflowName and ARN.
+You can deploy the file via CloudFormation/StackSets and then use the created role ARN as the `changesetRoleToAssumeArn` in your workflow configuration.
+## Testing
+This repository includes Jest tests that snapshot the synthesized outputs from Projen and assert that:
+- Workflows are created per stack and contain all expected steps.
+- Only one script file is generated.
+- Per‑stack OIDC overrides are respected.
+- Helpful validation errors are thrown for missing OIDC settings.
+- The IAM template file contains the expected resources and outputs.
+Run tests with:
+```bash
+yarn test
+```
+## Notes
+- This package assumes your repository is configured with GitHub Actions and that you have a GitHub OIDC role configured in AWS.
+- The generated script uses the AWS SDK v3 for CloudFormation and posts comments using the GitHub REST API.

@@ -0,0 +1,10 @@
+export interface CdkDiffIamTemplateProps {
+    readonly project: any;
+    readonly roleName: string;
+    readonly outputPath?: string;
+    readonly oidcRoleArn: string;
+    readonly oidcRegion: string;
+}
+export declare class CdkDiffIamTemplate {
+    constructor(props: CdkDiffIamTemplateProps);
+}

@@ -0,0 +1,101 @@
+"use strict";
+var _a;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CdkDiffIamTemplate = void 0;
+const JSII_RTTI_SYMBOL_1 = Symbol.for("jsii.rtti");
+const projen_1 = require("projen");
+class CdkDiffIamTemplate {
+    constructor(props) {
+        const outputPath = props.outputPath ?? 'cdk-diff-workflow-iam-template.yaml';
+        props.project.addTask('deploy-cdkdiff-iam-template', {
+            description: 'Deploy the CDK Diff IAM template via CloudFormation (accepts extra AWS CLI args, e.g., --parameter-overrides Key=Value...)',
+            receiveArgs: true,
+            exec: `aws cloudformation deploy --template-file ${outputPath} --stack-name cdk-diff-workflow-iam-role --capabilities CAPABILITY_NAMED_IAM`,
+        });
+        new projen_1.TextFile(props.project, outputPath, {
+            lines: [
+                "AWSTemplateFormatVersion: '2010-09-09'",
+                "Description: 'IAM role for CDK Diff Stack Workflow construct'",
+                '',
+                'Parameters:',
+                '  GitHubOIDCRoleArn:',
+                '    Type: String',
+                "    Description: 'ARN of the existing GitHub OIDC role that can assume this changeset role'",
+                `    Default: '${props.oidcRoleArn}'`,
+                '',
+                'Resources:',
+                '  # CloudFormation ChangeSet Role - minimal permissions for changeset operations',
+                '  CdkChangesetRole:',
+                '    Type: AWS::IAM::Role',
+                '    Properties:',
+                "      RoleName: '" + props.roleName + "'",
+                '      AssumeRolePolicyDocument:',
+                "        Version: '2012-10-17'",
+                '        Statement:',
+                '          - Effect: Allow',
+                '            Principal:',
+                '              AWS: !Ref GitHubOIDCRoleArn',
+                '            Action: sts:AssumeRole',
+                '            Condition:',
+                '              StringEquals:',
+                "                aws:RequestedRegion: '" + props.oidcRegion + "'",
+                '      Policies:',
+                '        - PolicyName: CloudFormationChangeSetAccess',
+                '          PolicyDocument:',
+                "            Version: '2012-10-17'",
+                '            Statement:',
+                '              # CloudFormation changeset operations',
+                '              - Effect: Allow',
+                '                Action:',
+                '                  - cloudformation:CreateChangeSet',
+                '                  - cloudformation:DescribeChangeSet',
+                '                  - cloudformation:DeleteChangeSet',
+                '                  - cloudformation:ListChangeSets',
+                '                  - cloudformation:DescribeStacks',
+                "                Resource: '*'",
+                '              # CDK bootstrap bucket access (for changeset creation)',
+                '              - Effect: Allow',
+                '                Action:',
+                '                  - s3:GetObject',
+                '                  - s3:PutObject',
+                '                  - s3:DeleteObject',
+                '                  - s3:ListBucket',
+                '                Resource:',
+                "                  - !Sub 'arn:aws:s3:::cdk-${AWS::AccountId}-${AWS::Region}-*'",
+                "                  - !Sub 'arn:aws:s3:::cdk-${AWS::AccountId}-${AWS::Region}-*/*'",
+                '              # CDK bootstrap parameter access',
+                '              - Effect: Allow',
+                '                Action:',
+                '                  - ssm:GetParameter',
+                '                  - ssm:GetParameters',
+                '                  - ssm:GetParametersByPath',
+                "                Resource: !Sub 'arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/cdk-bootstrap/*'",
+                '              # IAM PassRole for CDK operations',
+                '              - Effect: Allow',
+                '                Action:',
+                '                  - iam:PassRole',
+                "                Resource: '*'",
+                '                Condition:',
+                '                  StringEquals:',
+                "                    'iam:PassedToService': 'cloudformation.amazonaws.com'",
+                '',
+                'Outputs:',
+                '  CdkChangesetRoleArn:',
+                "    Description: 'ARN of the CDK changeset role'",
+                '    Value: !GetAtt CdkChangesetRole.Arn',
+                '    Export:',
+                "      Name: !Sub '${AWS::StackName}-CdkChangesetRoleArn'",
+                '',
+                '  CdkChangesetRoleName:',
+                "    Description: 'Name of the CDK changeset role'",
+                '    Value: !Ref CdkChangesetRole',
+                '    Export:',
+                "      Name: !Sub '${AWS::StackName}-CdkChangesetRoleName'",
+            ],
+        });
+    }
+}
+exports.CdkDiffIamTemplate = CdkDiffIamTemplate;
+_a = JSII_RTTI_SYMBOL_1;
+CdkDiffIamTemplate[_a] = { fqn: "@jjrawlins/cdk-diff-pr-github-action.CdkDiffIamTemplate", version: "0.0.0" };
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiQ2RrRGlmZklhbVRlbXBsYXRlLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vc3JjL0Nka0RpZmZJYW1UZW1wbGF0ZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7OztBQUFBLG1DQUFrQztBQVVsQyxNQUFhLGtCQUFrQjtJQUM3QixZQUFZLEtBQThCO1FBQ3hDLE1BQU0sVUFBVSxHQUFHLEtBQUssQ0FBQyxVQUFVLElBQUkscUNBQXFDLENBQUM7UUFDN0UsS0FBSyxDQUFDLE9BQU8sQ0FBQyxPQUFPLENBQUMsNkJBQTZCLEVBQUU7WUFDbkQsV0FBVyxFQUFFLDRIQUE0SDtZQUN6SSxXQUFXLEVBQUUsSUFBSTtZQUNqQixJQUFJLEVBQUUsNkNBQTZDLFVBQVUsOEVBQThFO1NBQzVJLENBQUMsQ0FBQztRQUVILElBQUksaUJBQVEsQ0FBQyxLQUFLLENBQUMsT0FBTyxFQUFFLFVBQVUsRUFBRTtZQUN0QyxLQUFLLEVBQUU7Z0JBQ0wsd0NBQXdDO2dCQUN4QywrREFBK0Q7Z0JBQy9ELEVBQUU7Z0JBQ0YsYUFBYTtnQkFDYixzQkFBc0I7Z0JBQ3RCLGtCQUFrQjtnQkFDbEIsNkZBQTZGO2dCQUM3RixpQkFBaUIsS0FBSyxDQUFDLFdBQVcsR0FBRztnQkFDckMsRUFBRTtnQkFDRixZQUFZO2dCQUNaLGtGQUFrRjtnQkFDbEYscUJBQXFCO2dCQUNyQiwwQkFBMEI7Z0JBQzFCLGlCQUFpQjtnQkFDakIsbUJBQW1CLEdBQUcsS0FBSyxDQUFDLFFBQVEsR0FBRyxHQUFHO2dCQUMxQyxpQ0FBaUM7Z0JBQ2pDLCtCQUErQjtnQkFDL0Isb0JBQW9CO2dCQUNwQiwyQkFBMkI7Z0JBQzNCLHdCQUF3QjtnQkFDeEIsMkNBQTJDO2dCQUMzQyxvQ0FBb0M7Z0JBQ3BDLHdCQUF3QjtnQkFDeEIsNkJBQTZCO2dCQUM3Qix3Q0FBd0MsR0FBRyxLQUFLLENBQUMsVUFBVSxHQUFHLEdBQUc7Z0JBQ2pFLGlCQUFpQjtnQkFDakIscURBQXFEO2dCQUNyRCwyQkFBMkI7Z0JBQzNCLG1DQUFtQztnQkFDbkMsd0JBQXdCO2dCQUN4QixxREFBcUQ7Z0JBQ3JELCtCQUErQjtnQkFDL0IseUJBQXlCO2dCQUN6QixvREFBb0Q7Z0JBQ3BELHNEQUFzRDtnQkFDdEQsb0RBQW9EO2dCQUNwRCxtREFBbUQ7Z0JBQ25ELG1EQUFtRDtnQkFDbkQsK0JBQStCO2dCQUMvQixzRUFBc0U7Z0JBQ3RFLCtCQUErQjtnQkFDL0IseUJBQXlCO2dCQUN6QixrQ0FBa0M7Z0JBQ2xDLGtDQUFrQztnQkFDbEMscUNBQXFDO2dCQUNyQyxtQ0FBbUM7Z0JBQ25DLDJCQUEyQjtnQkFDM0IsZ0ZBQWdGO2dCQUNoRixrRkFBa0Y7Z0JBQ2xGLGdEQUFnRDtnQkFDaEQsK0JBQStCO2dCQUMvQix5QkFBeUI7Z0JBQ3pCLHNDQUFzQztnQkFDdEMsdUNBQXVDO2dCQUN2Qyw2Q0FBNkM7Z0JBQzdDLHlHQUF5RztnQkFDekcsaURBQWlEO2dCQUNqRCwrQkFBK0I7Z0JBQy9CLHlCQUF5QjtnQkFDekIsa0NBQWtDO2dCQUNsQywrQkFBK0I7Z0JBQy9CLDRCQUE0QjtnQkFDNUIsaUNBQWlDO2dCQUNqQywyRUFBMkU7Z0JBQzNFLEVBQUU7Z0JBQ0YsVUFBVTtnQkFDVix3QkFBd0I7Z0JBQ3hCLGtEQUFrRDtnQkFDbEQseUNBQXlDO2dCQUN6QyxhQUFhO2dCQUNiLDBEQUEwRDtnQkFDMUQsRUFBRTtnQkFDRix5QkFBeUI7Z0JBQ3pCLG1EQUFtRDtnQkFDbkQsa0NBQWtDO2dCQUNsQyxhQUFhO2dCQUNiLDJEQUEyRDthQUM1RDtTQUNGLENBQUMsQ0FBQztJQUNMLENBQUM7O0FBMUZILGdEQTJGQyIsInNvdXJjZXNDb250ZW50IjpbImltcG9ydCB7IFRleHRGaWxlIH0gZnJvbSAncHJvamVuJztcblxuZXhwb3J0IGludGVyZmFjZSBDZGtEaWZmSWFtVGVtcGxhdGVQcm9wcyB7XG4gIHJlYWRvbmx5IHByb2plY3Q6IGFueTtcbiAgcmVhZG9ubHkgcm9sZU5hbWU6IHN0cmluZztcbiAgcmVhZG9ubHkgb3V0cHV0UGF0aD86IHN0cmluZztcbiAgcmVhZG9ubHkgb2lkY1JvbGVBcm46IHN0cmluZztcbiAgcmVhZG9ubHkgb2lkY1JlZ2lvbjogc3RyaW5nO1xufVxuXG5leHBvcnQgY2xhc3MgQ2RrRGlmZklhbVRlbXBsYXRlIHtcbiAgY29uc3RydWN0b3IocHJvcHM6IENka0RpZmZJYW1UZW1wbGF0ZVByb3BzKSB7XG4gICAgY29uc3Qgb3V0cHV0UGF0aCA9IHByb3BzLm91dHB1dFBhdGggPz8gJ2Nkay1kaWZmLXdvcmtmbG93LWlhbS10ZW1wbGF0ZS55YW1sJztcbiAgICBwcm9wcy5wcm9qZWN0LmFkZFRhc2soJ2RlcGxveS1jZGtkaWZmLWlhbS10ZW1wbGF0ZScsIHtcbiAgICAgIGRlc2NyaXB0aW9uOiAnRGVwbG95IHRoZSBDREsgRGlmZiBJQU0gdGVtcGxhdGUgdmlhIENsb3VkRm9ybWF0aW9uIChhY2NlcHRzIGV4dHJhIEFXUyBDTEkgYXJncywgZS5nLiwgLS1wYXJhbWV0ZXItb3ZlcnJpZGVzIEtleT1WYWx1ZS4uLiknLFxuICAgICAgcmVjZWl2ZUFyZ3M6IHRydWUsXG4gICAgICBleGVjOiBgYXdzIGNsb3VkZm9ybWF0aW9uIGRlcGxveSAtLXRlbXBsYXRlLWZpbGUgJHtvdXRwdXRQYXRofSAtLXN0YWNrLW5hbWUgY2RrLWRpZmYtd29ya2Zsb3ctaWFtLXJvbGUgLS1jYXBhYmlsaXRpZXMgQ0FQQUJJTElUWV9OQU1FRF9JQU1gLFxuICAgIH0pO1xuXG4gICAgbmV3IFRleHRGaWxlKHByb3BzLnByb2plY3QsIG91dHB1dFBhdGgsIHtcbiAgICAgIGxpbmVzOiBbXG4gICAgICAgIFwiQVdTVGVtcGxhdGVGb3JtYXRWZXJzaW9uOiAnMjAxMC0wOS0wOSdcIixcbiAgICAgICAgXCJEZXNjcmlwdGlvbjogJ0lBTSByb2xlIGZvciBDREsgRGlmZiBTdGFjayBXb3JrZmxvdyBjb25zdHJ1Y3QnXCIsXG4gICAgICAgICcnLFxuICAgICAgICAnUGFyYW1ldGVyczonLFxuICAgICAgICAnICBHaXRIdWJPSURDUm9sZUFybjonLFxuICAgICAgICAnICAgIFR5cGU6IFN0cmluZycsXG4gICAgICAgIFwiICAgIERlc2NyaXB0aW9uOiAnQVJOIG9mIHRoZSBleGlzdGluZyBHaXRIdWIgT0lEQyByb2xlIHRoYXQgY2FuIGFzc3VtZSB0aGlzIGNoYW5nZXNldCByb2xlJ1wiLFxuICAgICAgICBgICAgIERlZmF1bHQ6ICcke3Byb3BzLm9pZGNSb2xlQXJufSdgLFxuICAgICAgICAnJyxcbiAgICAgICAgJ1Jlc291cmNlczonLFxuICAgICAgICAnICAjIENsb3VkRm9ybWF0aW9uIENoYW5nZVNldCBSb2xlIC0gbWluaW1hbCBwZXJtaXNzaW9ucyBmb3IgY2hhbmdlc2V0IG9wZXJhdGlvbnMnLFxuICAgICAgICAnICBDZGtDaGFuZ2VzZXRSb2xlOicsXG4gICAgICAgICcgICAgVHlwZTogQVdTOjpJQU06OlJvbGUnLFxuICAgICAgICAnICAgIFByb3BlcnRpZXM6JyxcbiAgICAgICAgXCIgICAgICBSb2xlTmFtZTogJ1wiICsgcHJvcHMucm9sZU5hbWUgKyBcIidcIixcbiAgICAgICAgJyAgICAgIEFzc3VtZVJvbGVQb2xpY3lEb2N1bWVudDonLFxuICAgICAgICBcIiAgICAgICAgVmVyc2lvbjogJzIwMTItMTAtMTcnXCIsXG4gICAgICAgICcgICAgICAgIFN0YXRlbWVudDonLFxuICAgICAgICAnICAgICAgICAgIC0gRWZmZWN0OiBBbGxvdycsXG4gICAgICAgICcgICAgICAgICAgICBQcmluY2lwYWw6JyxcbiAgICAgICAgJyAgICAgICAgICAgICAgQVdTOiAhUmVmIEdpdEh1Yk9JRENSb2xlQXJuJyxcbiAgICAgICAgJyAgICAgICAgICAgIEFjdGlvbjogc3RzOkFzc3VtZVJvbGUnLFxuICAgICAgICAnICAgICAgICAgICAgQ29uZGl0aW9uOicsXG4gICAgICAgICcgICAgICAgICAgICAgIFN0cmluZ0VxdWFsczonLFxuICAgICAgICBcIiAgICAgICAgICAgICAgICBhd3M6UmVxdWVzdGVkUmVnaW9uOiAnXCIgKyBwcm9wcy5vaWRjUmVnaW9uICsgXCInXCIsXG4gICAgICAgICcgICAgICBQb2xpY2llczonLFxuICAgICAgICAnICAgICAgICAtIFBvbGljeU5hbWU6IENsb3VkRm9ybWF0aW9uQ2hhbmdlU2V0QWNjZXNzJyxcbiAgICAgICAgJyAgICAgICAgICBQb2xpY3lEb2N1bWVudDonLFxuICAgICAgICBcIiAgICAgICAgICAgIFZlcnNpb246ICcyMDEyLTEwLTE3J1wiLFxuICAgICAgICAnICAgICAgICAgICAgU3RhdGVtZW50OicsXG4gICAgICAgICcgICAgICAgICAgICAgICMgQ2xvdWRGb3JtYXRpb24gY2hhbmdlc2V0IG9wZXJhdGlvbnMnLFxuICAgICAgICAnICAgICAgICAgICAgICAtIEVmZmVjdDogQWxsb3cnLFxuICAgICAgICAnICAgICAgICAgICAgICAgIEFjdGlvbjonLFxuICAgICAgICAnICAgICAgICAgICAgICAgICAgLSBjbG91ZGZvcm1hdGlvbjpDcmVhdGVDaGFuZ2VTZXQnLFxuICAgICAgICAnICAgICAgICAgICAgICAgICAgLSBjbG91ZGZvcm1hdGlvbjpEZXNjcmliZUNoYW5nZVNldCcsXG4gICAgICAgICcgICAgICAgICAgICAgICAgICAtIGNsb3VkZm9ybWF0aW9uOkRlbGV0ZUNoYW5nZVNldCcsXG4gICAgICAgICcgICAgICAgICAgICAgICAgICAtIGNsb3VkZm9ybWF0aW9uOkxpc3RDaGFuZ2VTZXRzJyxcbiAgICAgICAgJyAgICAgICAgICAgICAgICAgIC0gY2xvdWRmb3JtYXRpb246RGVzY3JpYmVTdGFja3MnLFxuICAgICAgICBcIiAgICAgICAgICAgICAgICBSZXNvdXJjZTogJyonXCIsXG4gICAgICAgICcgICAgICAgICAgICAgICMgQ0RLIGJvb3RzdHJhcCBidWNrZXQgYWNjZXNzIChmb3IgY2hhbmdlc2V0IGNyZWF0aW9uKScsXG4gICAgICAgICcgICAgICAgICAgICAgIC0gRWZmZWN0OiBBbGxvdycsXG4gICAgICAgICcgICAgICAgICAgICAgICAgQWN0aW9uOicsXG4gICAgICAgICcgICAgICAgICAgICAgICAgICAtIHMzOkdldE9iamVjdCcsXG4gICAgICAgICcgICAgICAgICAgICAgICAgICAtIHMzOlB1dE9iamVjdCcsXG4gICAgICAgICcgICAgICAgICAgICAgICAgICAtIHMzOkRlbGV0ZU9iamVjdCcsXG4gICAgICAgICcgICAgICAgICAgICAgICAgICAtIHMzOkxpc3RCdWNrZXQnLFxuICAgICAgICAnICAgICAgICAgICAgICAgIFJlc291cmNlOicsXG4gICAgICAgIFwiICAgICAgICAgICAgICAgICAgLSAhU3ViICdhcm46YXdzOnMzOjo6Y2RrLSR7QVdTOjpBY2NvdW50SWR9LSR7QVdTOjpSZWdpb259LSonXCIsXG4gICAgICAgIFwiICAgICAgICAgICAgICAgICAgLSAhU3ViICdhcm46YXdzOnMzOjo6Y2RrLSR7QVdTOjpBY2NvdW50SWR9LSR7QVdTOjpSZWdpb259LSovKidcIixcbiAgICAgICAgJyAgICAgICAgICAgICAgIyBDREsgYm9vdHN0cmFwIHBhcmFtZXRlciBhY2Nlc3MnLFxuICAgICAgICAnICAgICAgICAgICAgICAtIEVmZmVjdDogQWxsb3cnLFxuICAgICAgICAnICAgICAgICAgICAgICAgIEFjdGlvbjonLFxuICAgICAgICAnICAgICAgICAgICAgICAgICAgLSBzc206R2V0UGFyYW1ldGVyJyxcbiAgICAgICAgJyAgICAgICAgICAgICAgICAgIC0gc3NtOkdldFBhcmFtZXRlcnMnLFxuICAgICAgICAnICAgICAgICAgICAgICAgICAgLSBzc206R2V0UGFyYW1ldGVyc0J5UGF0aCcsXG4gICAgICAgIFwiICAgICAgICAgICAgICAgIFJlc291cmNlOiAhU3ViICdhcm46YXdzOnNzbToke0FXUzo6UmVnaW9ufToke0FXUzo6QWNjb3VudElkfTpwYXJhbWV0ZXIvY2RrLWJvb3RzdHJhcC8qJ1wiLFxuICAgICAgICAnICAgICAgICAgICAgICAjIElBTSBQYXNzUm9sZSBmb3IgQ0RLIG9wZXJhdGlvbnMnLFxuICAgICAgICAnICAgICAgICAgICAgICAtIEVmZmVjdDogQWxsb3cnLFxuICAgICAgICAnICAgICAgICAgICAgICAgIEFjdGlvbjonLFxuICAgICAgICAnICAgICAgICAgICAgICAgICAgLSBpYW06UGFzc1JvbGUnLFxuICAgICAgICBcIiAgICAgICAgICAgICAgICBSZXNvdXJjZTogJyonXCIsXG4gICAgICAgICcgICAgICAgICAgICAgICAgQ29uZGl0aW9uOicsXG4gICAgICAgICcgICAgICAgICAgICAgICAgICBTdHJpbmdFcXVhbHM6JyxcbiAgICAgICAgXCIgICAgICAgICAgICAgICAgICAgICdpYW06UGFzc2VkVG9TZXJ2aWNlJzogJ2Nsb3VkZm9ybWF0aW9uLmFtYXpvbmF3cy5jb20nXCIsXG4gICAgICAgICcnLFxuICAgICAgICAnT3V0cHV0czonLFxuICAgICAgICAnICBDZGtDaGFuZ2VzZXRSb2xlQXJuOicsXG4gICAgICAgIFwiICAgIERlc2NyaXB0aW9uOiAnQVJOIG9mIHRoZSBDREsgY2hhbmdlc2V0IHJvbGUnXCIsXG4gICAgICAgICcgICAgVmFsdWU6ICFHZXRBdHQgQ2RrQ2hhbmdlc2V0Um9sZS5Bcm4nLFxuICAgICAgICAnICAgIEV4cG9ydDonLFxuICAgICAgICBcIiAgICAgIE5hbWU6ICFTdWIgJyR7QVdTOjpTdGFja05hbWV9LUNka0NoYW5nZXNldFJvbGVBcm4nXCIsXG4gICAgICAgICcnLFxuICAgICAgICAnICBDZGtDaGFuZ2VzZXRSb2xlTmFtZTonLFxuICAgICAgICBcIiAgICBEZXNjcmlwdGlvbjogJ05hbWUgb2YgdGhlIENESyBjaGFuZ2VzZXQgcm9sZSdcIixcbiAgICAgICAgJyAgICBWYWx1ZTogIVJlZiBDZGtDaGFuZ2VzZXRSb2xlJyxcbiAgICAgICAgJyAgICBFeHBvcnQ6JyxcbiAgICAgICAgXCIgICAgICBOYW1lOiAhU3ViICcke0FXUzo6U3RhY2tOYW1lfS1DZGtDaGFuZ2VzZXRSb2xlTmFtZSdcIixcbiAgICAgIF0sXG4gICAgfSk7XG4gIH1cbn1cbiJdfQ==

@@ -0,0 +1,22 @@
+export interface CdkDiffStack {
+    readonly stackName: string;
+    readonly cdkDiffRoleToAssumeArn: string;
+    readonly cdkDiffRoleToAssumeRegion: string;
+    readonly oidcRoleArn?: string;
+    readonly oidcRegion?: string;
+}
+export interface CdkDiffStackWorkflowProps {
+    readonly project: any;
+    readonly stacks: CdkDiffStack[];
+    readonly oidcRoleArn: string;
+    readonly oidcRegion: string;
+    readonly nodeVersion?: string;
+    readonly cdkYarnCommand?: string;
+    readonly scriptOutputPath?: string;
+}
+export declare class CdkDiffStackWorkflow {
+    private static scriptCreated;
+    constructor(props: CdkDiffStackWorkflowProps);
+    private validateOidcConfiguration;
+    private createWorkflowForStack;
+}

@@ -0,0 +1,144 @@
+"use strict";
+var _a;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CdkDiffStackWorkflow = void 0;
+const JSII_RTTI_SYMBOL_1 = Symbol.for("jsii.rtti");
+const github_1 = require("projen/lib/github");
+const workflows_model_1 = require("projen/lib/github/workflows-model");
+const cdk_changeset_script_1 = require("./bin/cdk-changeset-script");
+const githubActionsAwsCredentialsVersion = 'v4';
+const githubActionsCheckoutVersion = 'v4';
+const githubActionsSetupNodeVersion = 'v4';
+class CdkDiffStackWorkflow {
+    constructor(props) {
+        const cdkYarnCommand = props.cdkYarnCommand ?? 'cdk';
+        const nodeVersion = props.nodeVersion ?? '24.x';
+        const scriptOutputPath = props.scriptOutputPath ?? '.github/workflows/scripts/describe-cfn-changeset.ts';
+        // Validate OIDC configuration
+        this.validateOidcConfiguration(props);
+        // Only create the changeset script once to avoid collisions
+        if (!CdkDiffStackWorkflow.scriptCreated) {
+            new cdk_changeset_script_1.CdkChangesetScript({
+                project: props.project,
+                outputPath: scriptOutputPath,
+            });
+            CdkDiffStackWorkflow.scriptCreated = true;
+        }
+        // Create a separate workflow for each stack
+        for (const stack of props.stacks) {
+            const workflowName = `diff-${stack.stackName}`;
+            const gh = props.project.github ?? new github_1.GitHub(props.project);
+            const diffDeployWorkflow = new github_1.GithubWorkflow(gh, workflowName, { fileName: `${workflowName}.yml` });
+            this.createWorkflowForStack(diffDeployWorkflow, stack, cdkYarnCommand, nodeVersion, scriptOutputPath, props.oidcRoleArn, props.oidcRegion);
+        }
+    }
+    validateOidcConfiguration(props) {
+        const hasDefaultOidcRole = !!props.oidcRoleArn;
+        const hasDefaultOidcRegion = !!props.oidcRegion;
+        // Check if all stacks have their own OIDC configuration
+        const allStacksHaveOidcRole = props.stacks.every(stack => !!stack.oidcRoleArn);
+        const allStacksHaveOidcRegion = props.stacks.every(stack => !!stack.oidcRegion);
+        // Either defaults must be provided OR all stacks must have their own OIDC config
+        if (!hasDefaultOidcRole && !allStacksHaveOidcRole) {
+            throw new Error('Either provide default oidcRoleArn or specify oidcRoleArn for each stack');
+        }
+        if (!hasDefaultOidcRegion && !allStacksHaveOidcRegion) {
+            throw new Error('Either provide default oidcRegion or specify oidcRegion for each stack');
+        }
+    }
+    createWorkflowForStack(workflow, stack, cdkYarnCommand, nodeVersion, scriptOutputPath, defaultOidcRoleArn, defaultOidcRegion) {
+        // Configure workflow triggers
+        workflow.on({
+            pullRequest: {
+                types: ['opened', 'synchronize', 'reopened'],
+            },
+        });
+        // Add the diff job
+        workflow.addJobs({
+            diff: {
+                runsOn: ['ubuntu-latest'],
+                permissions: {
+                    idToken: workflows_model_1.JobPermission.WRITE,
+                    contents: workflows_model_1.JobPermission.READ,
+                    issues: workflows_model_1.JobPermission.WRITE,
+                    pullRequests: workflows_model_1.JobPermission.WRITE,
+                    packages: workflows_model_1.JobPermission.READ,
+                },
+                env: {
+                    GITHUB_TOKEN: '${{ secrets.GITHUB_TOKEN }}',
+                },
+                steps: [
+                    // Checkout code
+                    {
+                        uses: `actions/checkout@${githubActionsCheckoutVersion}`,
+                    },
+                    // Setup Node.js
+                    {
+                        uses: `actions/setup-node@${githubActionsSetupNodeVersion}`,
+                        with: {
+                            'node-version': nodeVersion,
+                            'registry-url': 'https://npm.pkg.github.com',
+                            'scope': '@${{ github.repository_owner }}',
+                            'token': '${{ secrets.GITHUB_TOKEN }}',
+                        },
+                    },
+                    // Install dependencies
+                    {
+                        run: 'yarn install --frozen-lockfile',
+                        env: {
+                            NODE_AUTH_TOKEN: '${{ secrets.GITHUB_TOKEN }}',
+                        },
+                    },
+                    {
+                        id: 'creds',
+                        uses: `aws-actions/configure-aws-credentials@${githubActionsAwsCredentialsVersion}`,
+                        with: {
+                            'role-to-assume': stack.oidcRoleArn ?? defaultOidcRoleArn,
+                            'aws-region': stack.oidcRegion ?? defaultOidcRegion,
+                        },
+                    },
+                    {
+                        name: 'Assume CDK Deploy Role',
+                        id: 'deploy-role',
+                        uses: 'aws-actions/configure-aws-credentials@v4',
+                        with: {
+                            'role-to-assume': stack.cdkDiffRoleToAssumeArn,
+                            'role-chaining': true,
+                            'role-skip-session-tagging': true,
+                            'aws-region': stack.cdkDiffRoleToAssumeRegion,
+                            'aws-access-key-id': '${{ steps.creds.outputs.aws-access-key-id }}',
+                            'aws-secret-access-key': '${{ steps.creds.outputs.aws-secret-access-key }}',
+                            'aws-session-token': '${{ steps.creds.outputs.aws-session-token }}',
+                        },
+                    },
+                    // Add changeset creation step
+                    {
+                        name: `Create Changeset for ${stack.stackName}`,
+                        run: `yarn ${cdkYarnCommand} deploy ${stack.stackName} --no-execute --change-set-name ${stack.stackName} --require-approval never`,
+                    },
+                    // Add changeset description step
+                    {
+                        name: `Describe change set for ${stack.stackName}`,
+                        run: `npx ts-node ${scriptOutputPath}`,
+                        env: {
+                            STACK_NAME: stack.stackName,
+                            CHANGE_SET_NAME: stack.stackName,
+                            GITHUB_COMMENT_URL: '${{ github.event.pull_request.comments_url }}',
+                            GITHUB_TOKEN: '${{ secrets.GITHUB_TOKEN }}',
+                        },
+                    },
+                    // Add changeset cleanup step
+                    {
+                        name: `Delete changeset for ${stack.stackName}`,
+                        run: `aws cloudformation delete-change-set --change-set-name ${stack.stackName} --stack-name ${stack.stackName} --region ${stack.cdkDiffRoleToAssumeRegion}`,
+                    },
+                ],
+            },
+        });
+    }
+}
+exports.CdkDiffStackWorkflow = CdkDiffStackWorkflow;
+_a = JSII_RTTI_SYMBOL_1;
+CdkDiffStackWorkflow[_a] = { fqn: "@jjrawlins/cdk-diff-pr-github-action.CdkDiffStackWorkflow", version: "0.0.0" };
+CdkDiffStackWorkflow.scriptCreated = false;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiQ2RrRGlmZlN0YWNrV29ya2Zsb3cuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi9zcmMvQ2RrRGlmZlN0YWNrV29ya2Zsb3cudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7QUFBQSw4Q0FBMkQ7QUFDM0QsdUVBQWtFO0FBQ2xFLHFFQUFnRTtBQUVoRSxNQUFNLGtDQUFrQyxHQUFHLElBQUksQ0FBQztBQUNoRCxNQUFNLDRCQUE0QixHQUFHLElBQUksQ0FBQztBQUMxQyxNQUFNLDZCQUE2QixHQUFHLElBQUksQ0FBQztBQW1CM0MsTUFBYSxvQkFBb0I7SUFHL0IsWUFBWSxLQUFnQztRQUMxQyxNQUFNLGNBQWMsR0FBRyxLQUFLLENBQUMsY0FBYyxJQUFJLEtBQUssQ0FBQztRQUNyRCxNQUFNLFdBQVcsR0FBRyxLQUFLLENBQUMsV0FBVyxJQUFJLE1BQU0sQ0FBQztRQUNoRCxNQUFNLGdCQUFnQixHQUFHLEtBQUssQ0FBQyxnQkFBZ0IsSUFBSSxxREFBcUQsQ0FBQztRQUV6Ryw4QkFBOEI7UUFDOUIsSUFBSSxDQUFDLHlCQUF5QixDQUFDLEtBQUssQ0FBQyxDQUFDO1FBRXRDLDREQUE0RDtRQUM1RCxJQUFJLENBQUMsb0JBQW9CLENBQUMsYUFBYSxFQUFFLENBQUM7WUFDeEMsSUFBSSx5Q0FBa0IsQ0FBQztnQkFDckIsT0FBTyxFQUFFLEtBQUssQ0FBQyxPQUFPO2dCQUN0QixVQUFVLEVBQUUsZ0JBQWdCO2FBQzdCLENBQUMsQ0FBQztZQUNILG9CQUFvQixDQUFDLGFBQWEsR0FBRyxJQUFJLENBQUM7UUFDNUMsQ0FBQztRQUVELDRDQUE0QztRQUM1QyxLQUFLLE1BQU0sS0FBSyxJQUFJLEtBQUssQ0FBQyxNQUFNLEVBQUUsQ0FBQztZQUNqQyxNQUFNLFlBQVksR0FBRyxRQUFRLEtBQUssQ0FBQyxTQUFTLEVBQUUsQ0FBQztZQUMvQyxNQUFNLEVBQUUsR0FBSSxLQUFhLENBQUMsT0FBTyxDQUFDLE1BQU0sSUFBSSxJQUFJLGVBQU0sQ0FBRSxLQUFhLENBQUMsT0FBTyxDQUFDLENBQUM7WUFDL0UsTUFBTSxrQkFBa0IsR0FBRyxJQUFJLHVCQUFjLENBQUMsRUFBRSxFQUFFLFlBQVksRUFBRSxFQUFFLFFBQVEsRUFBRSxHQUFHLFlBQVksTUFBTSxFQUFFLENBQUMsQ0FBQztZQUVyRyxJQUFJLENBQUMsc0JBQXNCLENBQUMsa0JBQWtCLEVBQUUsS0FBSyxFQUFFLGNBQWMsRUFBRSxXQUFXLEVBQUUsZ0JBQWdCLEVBQUUsS0FBSyxDQUFDLFdBQVcsRUFBRSxLQUFLLENBQUMsVUFBVSxDQUFDLENBQUM7UUFDN0ksQ0FBQztJQUNILENBQUM7SUFFTyx5QkFBeUIsQ0FBQyxLQUFnQztRQUNoRSxNQUFNLGtCQUFrQixHQUFHLENBQUMsQ0FBQyxLQUFLLENBQUMsV0FBVyxDQUFDO1FBQy9DLE1BQU0sb0JBQW9CLEdBQUcsQ0FBQyxDQUFDLEtBQUssQ0FBQyxVQUFVLENBQUM7UUFFaEQsd0RBQXdEO1FBQ3hELE1BQU0scUJBQXFCLEdBQUcsS0FBSyxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUMsS0FBSyxDQUFDLFdBQVcsQ0FBQyxDQUFDO1FBQy9FLE1BQU0sdUJBQXVCLEdBQUcsS0FBSyxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUMsS0FBSyxDQUFDLFVBQVUsQ0FBQyxDQUFDO1FBRWhGLGlGQUFpRjtRQUNqRixJQUFJLENBQUMsa0JBQWtCLElBQUksQ0FBQyxxQkFBcUIsRUFBRSxDQUFDO1lBQ2xELE1BQU0sSUFBSSxLQUFLLENBQUMsMEVBQTBFLENBQUMsQ0FBQztRQUM5RixDQUFDO1FBRUQsSUFBSSxDQUFDLG9CQUFvQixJQUFJLENBQUMsdUJBQXVCLEVBQUUsQ0FBQztZQUN0RCxNQUFNLElBQUksS0FBSyxDQUFDLHdFQUF3RSxDQUFDLENBQUM7UUFDNUYsQ0FBQztJQUNILENBQUM7SUFFTyxzQkFBc0IsQ0FDNUIsUUFBd0IsRUFDeEIsS0FBbUIsRUFDbkIsY0FBc0IsRUFDdEIsV0FBbUIsRUFDbkIsZ0JBQXdCLEVBQ3hCLGtCQUEwQixFQUMxQixpQkFBeUI7UUFFekIsOEJBQThCO1FBQzlCLFFBQVEsQ0FBQyxFQUFFLENBQUM7WUFDVixXQUFXLEVBQUU7Z0JBQ1gsS0FBSyxFQUFFLENBQUMsUUFBUSxFQUFFLGFBQWEsRUFBRSxVQUFVLENBQUM7YUFDN0M7U0FDRixDQUFDLENBQUM7UUFFSCxtQkFBbUI7UUFDbkIsUUFBUSxDQUFDLE9BQU8sQ0FBQztZQUNmLElBQUksRUFBRTtnQkFDSixNQUFNLEVBQUUsQ0FBQyxlQUFlLENBQUM7Z0JBQ3pCLFdBQVcsRUFBRTtvQkFDWCxPQUFPLEVBQUUsK0JBQWEsQ0FBQyxLQUFLO29CQUM1QixRQUFRLEVBQUUsK0JBQWEsQ0FBQyxJQUFJO29CQUM1QixNQUFNLEVBQUUsK0JBQWEsQ0FBQyxLQUFLO29CQUMzQixZQUFZLEVBQUUsK0JBQWEsQ0FBQyxLQUFLO29CQUNqQyxRQUFRLEVBQUUsK0JBQWEsQ0FBQyxJQUFJO2lCQUM3QjtnQkFDRCxHQUFHLEVBQUU7b0JBQ0gsWUFBWSxFQUFFLDZCQUE2QjtpQkFDNUM7Z0JBQ0QsS0FBSyxFQUFFO29CQUNMLGdCQUFnQjtvQkFDaEI7d0JBQ0UsSUFBSSxFQUFFLG9CQUFvQiw0QkFBNEIsRUFBRTtxQkFDekQ7b0JBQ0QsZ0JBQWdCO29CQUNoQjt3QkFDRSxJQUFJLEVBQUUsc0JBQXNCLDZCQUE2QixFQUFFO3dCQUMzRCxJQUFJLEVBQUU7NEJBQ0osY0FBYyxFQUFFLFdBQVc7NEJBQzNCLGNBQWMsRUFBRSw0QkFBNEI7NEJBQzVDLE9BQU8sRUFBRSxpQ0FBaUM7NEJBQzFDLE9BQU8sRUFBRSw2QkFBNkI7eUJBQ3ZDO3FCQUNGO29CQUNELHVCQUF1QjtvQkFDdkI7d0JBQ0UsR0FBRyxFQUFFLGdDQUFnQzt3QkFDckMsR0FBRyxFQUFFOzRCQUNILGVBQWUsRUFBRSw2QkFBNkI7eUJBQy9DO3FCQUNGO29CQUNEO3dCQUNFLEVBQUUsRUFBRSxPQUFPO3dCQUNYLElBQUksRUFBRSx5Q0FBeUMsa0NBQWtDLEVBQUU7d0JBQ25GLElBQUksRUFBRTs0QkFDSixnQkFBZ0IsRUFBRSxLQUFLLENBQUMsV0FBVyxJQUFJLGtCQUFrQjs0QkFDekQsWUFBWSxFQUFFLEtBQUssQ0FBQyxVQUFVLElBQUksaUJBQWlCO3lCQUNwRDtxQkFDRjtvQkFDRDt3QkFDRSxJQUFJLEVBQUUsd0JBQXdCO3dCQUM5QixFQUFFLEVBQUUsYUFBYTt3QkFDakIsSUFBSSxFQUFFLDBDQUEwQzt3QkFDaEQsSUFBSSxFQUFFOzRCQUNKLGdCQUFnQixFQUFFLEtBQUssQ0FBQyxzQkFBc0I7NEJBQzlDLGVBQWUsRUFBRSxJQUFJOzRCQUNyQiwyQkFBMkIsRUFBRSxJQUFJOzRCQUNqQyxZQUFZLEVBQUUsS0FBSyxDQUFDLHlCQUF5Qjs0QkFDN0MsbUJBQW1CLEVBQUUsOENBQThDOzRCQUNuRSx1QkFBdUIsRUFBRSxrREFBa0Q7NEJBQzNFLG1CQUFtQixFQUFFLDhDQUE4Qzt5QkFDcEU7cUJBQ0Y7b0JBQ0QsOEJBQThCO29CQUM5Qjt3QkFDRSxJQUFJLEVBQUUsd0JBQXdCLEtBQUssQ0FBQyxTQUFTLEVBQUU7d0JBQy9DLEdBQUcsRUFBRSxRQUFRLGNBQWMsV0FBVyxLQUFLLENBQUMsU0FBUyxtQ0FBbUMsS0FBSyxDQUFDLFNBQVMsMkJBQTJCO3FCQUNuSTtvQkFDRCxpQ0FBaUM7b0JBQ2pDO3dCQUNFLElBQUksRUFBRSwyQkFBMkIsS0FBSyxDQUFDLFNBQVMsRUFBRTt3QkFDbEQsR0FBRyxFQUFFLGVBQWUsZ0JBQWdCLEVBQUU7d0JBQ3RDLEdBQUcsRUFBRTs0QkFDSCxVQUFVLEVBQUUsS0FBSyxDQUFDLFNBQVM7NEJBQzNCLGVBQWUsRUFBRSxLQUFLLENBQUMsU0FBUzs0QkFDaEMsa0JBQWtCLEVBQUUsK0NBQStDOzRCQUNuRSxZQUFZLEVBQUUsNkJBQTZCO3lCQUM1QztxQkFDRjtvQkFDRCw2QkFBNkI7b0JBQzdCO3dCQUNFLElBQUksRUFBRSx3QkFBd0IsS0FBSyxDQUFDLFNBQVMsRUFBRTt3QkFDL0MsR0FBRyxFQUFFLDBEQUEwRCxLQUFLLENBQUMsU0FBUyxpQkFBaUIsS0FBSyxDQUFDLFNBQVMsYUFBYSxLQUFLLENBQUMseUJBQXlCLEVBQUU7cUJBQzdKO2lCQUNGO2FBQ0Y7U0FDRixDQUFDLENBQUM7SUFDTCxDQUFDOztBQWxKSCxvREFtSkM7OztBQWxKZ0Isa0NBQWEsR0FBRyxLQUFLLENBQUMiLCJzb3VyY2VzQ29udGVudCI6WyJpbXBvcnQgeyBHaXRIdWIsIEdpdGh1YldvcmtmbG93IH0gZnJvbSAncHJvamVuL2xpYi9naXRodWInO1xuaW1wb3J0IHsgSm9iUGVybWlzc2lvbiB9IGZyb20gJ3Byb2plbi9saWIvZ2l0aHViL3dvcmtmbG93cy1tb2RlbCc7XG5pbXBvcnQgeyBDZGtDaGFuZ2VzZXRTY3JpcHQgfSBmcm9tICcuL2Jpbi9jZGstY2hhbmdlc2V0LXNjcmlwdCc7XG5cbmNvbnN0IGdpdGh1YkFjdGlvbnNBd3NDcmVkZW50aWFsc1ZlcnNpb24gPSAndjQnO1xuY29uc3QgZ2l0aHViQWN0aW9uc0NoZWNrb3V0VmVyc2lvbiA9ICd2NCc7XG5jb25zdCBnaXRodWJBY3Rpb25zU2V0dXBOb2RlVmVyc2lvbiA9ICd2NCc7XG5cbmV4cG9ydCBpbnRlcmZhY2UgQ2RrRGlmZlN0YWNrIHtcbiAgcmVhZG9ubHkgc3RhY2tOYW1lOiBzdHJpbmc7XG4gIHJlYWRvbmx5IGNka0RpZmZSb2xlVG9Bc3N1bWVBcm46IHN0cmluZztcbiAgcmVhZG9ubHkgY2RrRGlmZlJvbGVUb0Fzc3VtZVJlZ2lvbjogc3RyaW5nO1xuICByZWFkb25seSBvaWRjUm9sZUFybj86IHN0cmluZzsgLy8gT3B0aW9uYWwgb3ZlcnJpZGUgZm9yIE9JREMgcm9sZVxuICByZWFkb25seSBvaWRjUmVnaW9uPzogc3RyaW5nOyAvLyBPcHRpb25hbCBvdmVycmlkZSBmb3IgT0lEQyByZWdpb25cbn1cblxuZXhwb3J0IGludGVyZmFjZSBDZGtEaWZmU3RhY2tXb3JrZmxvd1Byb3BzIHtcbiAgcmVhZG9ubHkgcHJvamVjdDogYW55OyAvLyBhdm9pZCBleHBvcnRpbmcgcHJvamVuIHR5cGVzIGluIHB1YmxpYyBBUElcbiAgcmVhZG9ubHkgc3RhY2tzOiBDZGtEaWZmU3RhY2tbXTtcbiAgcmVhZG9ubHkgb2lkY1JvbGVBcm46IHN0cmluZzsgLy8gUmVxdWlyZWQgT0lEQyByb2xlIEFSTiBmb3IgYWxsIHN0YWNrcyAob3IgZWFjaCBzdGFjayBtdXN0IGhhdmUgaXRzIG93bilcbiAgcmVhZG9ubHkgb2lkY1JlZ2lvbjogc3RyaW5nOyAvLyBSZXF1aXJlZCBPSURDIHJlZ2lvbiBmb3IgYWxsIHN0YWNrcyAob3IgZWFjaCBzdGFjayBtdXN0IGhhdmUgaXRzIG93bilcbiAgcmVhZG9ubHkgbm9kZVZlcnNpb24/OiBzdHJpbmc7XG4gIHJlYWRvbmx5IGNka1lhcm5Db21tYW5kPzogc3RyaW5nO1xuICByZWFkb25seSBzY3JpcHRPdXRwdXRQYXRoPzogc3RyaW5nO1xufVxuZXhwb3J0IGNsYXNzIENka0RpZmZTdGFja1dvcmtmbG93IHtcbiAgcHJpdmF0ZSBzdGF0aWMgc2NyaXB0Q3JlYXRlZCA9IGZhbHNlO1xuXG4gIGNvbnN0cnVjdG9yKHByb3BzOiBDZGtEaWZmU3RhY2tXb3JrZmxvd1Byb3BzKSB7XG4gICAgY29uc3QgY2RrWWFybkNvbW1hbmQgPSBwcm9wcy5jZGtZYXJuQ29tbWFuZCA/PyAnY2RrJztcbiAgICBjb25zdCBub2RlVmVyc2lvbiA9IHByb3BzLm5vZGVWZXJzaW9uID8/ICcyNC54JztcbiAgICBjb25zdCBzY3JpcHRPdXRwdXRQYXRoID0gcHJvcHMuc2NyaXB0T3V0cHV0UGF0aCA/PyAnLmdpdGh1Yi93b3JrZmxvd3Mvc2NyaXB0cy9kZXNjcmliZS1jZm4tY2hhbmdlc2V0LnRzJztcblxuICAgIC8vIFZhbGlkYXRlIE9JREMgY29uZmlndXJhdGlvblxuICAgIHRoaXMudmFsaWRhdGVPaWRjQ29uZmlndXJhdGlvbihwcm9wcyk7XG5cbiAgICAvLyBPbmx5IGNyZWF0ZSB0aGUgY2hhbmdlc2V0IHNjcmlwdCBvbmNlIHRvIGF2b2lkIGNvbGxpc2lvbnNcbiAgICBpZiAoIUNka0RpZmZTdGFja1dvcmtmbG93LnNjcmlwdENyZWF0ZWQpIHtcbiAgICAgIG5ldyBDZGtDaGFuZ2VzZXRTY3JpcHQoe1xuICAgICAgICBwcm9qZWN0OiBwcm9wcy5wcm9qZWN0LFxuICAgICAgICBvdXRwdXRQYXRoOiBzY3JpcHRPdXRwdXRQYXRoLFxuICAgICAgfSk7XG4gICAgICBDZGtEaWZmU3RhY2tXb3JrZmxvdy5zY3JpcHRDcmVhdGVkID0gdHJ1ZTtcbiAgICB9XG5cbiAgICAvLyBDcmVhdGUgYSBzZXBhcmF0ZSB3b3JrZmxvdyBmb3IgZWFjaCBzdGFja1xuICAgIGZvciAoY29uc3Qgc3RhY2sgb2YgcHJvcHMuc3RhY2tzKSB7XG4gICAgICBjb25zdCB3b3JrZmxvd05hbWUgPSBgZGlmZi0ke3N0YWNrLnN0YWNrTmFtZX1gO1xuICAgICAgY29uc3QgZ2ggPSAocHJvcHMgYXMgYW55KS5wcm9qZWN0LmdpdGh1YiA/PyBuZXcgR2l0SHViKChwcm9wcyBhcyBhbnkpLnByb2plY3QpO1xuICAgICAgY29uc3QgZGlmZkRlcGxveVdvcmtmbG93ID0gbmV3IEdpdGh1YldvcmtmbG93KGdoLCB3b3JrZmxvd05hbWUsIHsgZmlsZU5hbWU6IGAke3dvcmtmbG93TmFtZX0ueW1sYCB9KTtcblxuICAgICAgdGhpcy5jcmVhdGVXb3JrZmxvd0ZvclN0YWNrKGRpZmZEZXBsb3lXb3JrZmxvdywgc3RhY2ssIGNka1lhcm5Db21tYW5kLCBub2RlVmVyc2lvbiwgc2NyaXB0T3V0cHV0UGF0aCwgcHJvcHMub2lkY1JvbGVBcm4sIHByb3BzLm9pZGNSZWdpb24pO1xuICAgIH1cbiAgfVxuXG4gIHByaXZhdGUgdmFsaWRhdGVPaWRjQ29uZmlndXJhdGlvbihwcm9wczogQ2RrRGlmZlN0YWNrV29ya2Zsb3dQcm9wcyk6IHZvaWQge1xuICAgIGNvbnN0IGhhc0RlZmF1bHRPaWRjUm9sZSA9ICEhcHJvcHMub2lkY1JvbGVBcm47XG4gICAgY29uc3QgaGFzRGVmYXVsdE9pZGNSZWdpb24gPSAhIXByb3BzLm9pZGNSZWdpb247XG5cbiAgICAvLyBDaGVjayBpZiBhbGwgc3RhY2tzIGhhdmUgdGhlaXIgb3duIE9JREMgY29uZmlndXJhdGlvblxuICAgIGNvbnN0IGFsbFN0YWNrc0hhdmVPaWRjUm9sZSA9IHByb3BzLnN0YWNrcy5ldmVyeShzdGFjayA9PiAhIXN0YWNrLm9pZGNSb2xlQXJuKTtcbiAgICBjb25zdCBhbGxTdGFja3NIYXZlT2lkY1JlZ2lvbiA9IHByb3BzLnN0YWNrcy5ldmVyeShzdGFjayA9PiAhIXN0YWNrLm9pZGNSZWdpb24pO1xuXG4gICAgLy8gRWl0aGVyIGRlZmF1bHRzIG11c3QgYmUgcHJvdmlkZWQgT1IgYWxsIHN0YWNrcyBtdXN0IGhhdmUgdGhlaXIgb3duIE9JREMgY29uZmlnXG4gICAgaWYgKCFoYXNEZWZhdWx0T2lkY1JvbGUgJiYgIWFsbFN0YWNrc0hhdmVPaWRjUm9sZSkge1xuICAgICAgdGhyb3cgbmV3IEVycm9yKCdFaXRoZXIgcHJvdmlkZSBkZWZhdWx0IG9pZGNSb2xlQXJuIG9yIHNwZWNpZnkgb2lkY1JvbGVBcm4gZm9yIGVhY2ggc3RhY2snKTtcbiAgICB9XG5cbiAgICBpZiAoIWhhc0RlZmF1bHRPaWRjUmVnaW9uICYmICFhbGxTdGFja3NIYXZlT2lkY1JlZ2lvbikge1xuICAgICAgdGhyb3cgbmV3IEVycm9yKCdFaXRoZXIgcHJvdmlkZSBkZWZhdWx0IG9pZGNSZWdpb24gb3Igc3BlY2lmeSBvaWRjUmVnaW9uIGZvciBlYWNoIHN0YWNrJyk7XG4gICAgfVxuICB9XG5cbiAgcHJpdmF0ZSBjcmVhdGVXb3JrZmxvd0ZvclN0YWNrKFxuICAgIHdvcmtmbG93OiBHaXRodWJXb3JrZmxvdyxcbiAgICBzdGFjazogQ2RrRGlmZlN0YWNrLFxuICAgIGNka1lhcm5Db21tYW5kOiBzdHJpbmcsXG4gICAgbm9kZVZlcnNpb246IHN0cmluZyxcbiAgICBzY3JpcHRPdXRwdXRQYXRoOiBzdHJpbmcsXG4gICAgZGVmYXVsdE9pZGNSb2xlQXJuOiBzdHJpbmcsXG4gICAgZGVmYXVsdE9pZGNSZWdpb246IHN0cmluZyxcbiAgKSB7XG4gICAgLy8gQ29uZmlndXJlIHdvcmtmbG93IHRyaWdnZXJzXG4gICAgd29ya2Zsb3cub24oe1xuICAgICAgcHVsbFJlcXVlc3Q6IHtcbiAgICAgICAgdHlwZXM6IFsnb3BlbmVkJywgJ3N5bmNocm9uaXplJywgJ3Jlb3BlbmVkJ10sXG4gICAgICB9LFxuICAgIH0pO1xuXG4gICAgLy8gQWRkIHRoZSBkaWZmIGpvYlxuICAgIHdvcmtmbG93LmFkZEpvYnMoe1xuICAgICAgZGlmZjoge1xuICAgICAgICBydW5zT246IFsndWJ1bnR1LWxhdGVzdCddLFxuICAgICAgICBwZXJtaXNzaW9uczoge1xuICAgICAgICAgIGlkVG9rZW46IEpvYlBlcm1pc3Npb24uV1JJVEUsXG4gICAgICAgICAgY29udGVudHM6IEpvYlBlcm1pc3Npb24uUkVBRCxcbiAgICAgICAgICBpc3N1ZXM6IEpvYlBlcm1pc3Npb24uV1JJVEUsXG4gICAgICAgICAgcHVsbFJlcXVlc3RzOiBKb2JQZXJtaXNzaW9uLldSSVRFLFxuICAgICAgICAgIHBhY2thZ2VzOiBKb2JQZXJtaXNzaW9uLlJFQUQsXG4gICAgICAgIH0sXG4gICAgICAgIGVudjoge1xuICAgICAgICAgIEdJVEhVQl9UT0tFTjogJyR7eyBzZWNyZXRzLkdJVEhVQl9UT0tFTiB9fScsXG4gICAgICAgIH0sXG4gICAgICAgIHN0ZXBzOiBbXG4gICAgICAgICAgLy8gQ2hlY2tvdXQgY29kZVxuICAgICAgICAgIHtcbiAgICAgICAgICAgIHVzZXM6IGBhY3Rpb25zL2NoZWNrb3V0QCR7Z2l0aHViQWN0aW9uc0NoZWNrb3V0VmVyc2lvbn1gLFxuICAgICAgICAgIH0sXG4gICAgICAgICAgLy8gU2V0dXAgTm9kZS5qc1xuICAgICAgICAgIHtcbiAgICAgICAgICAgIHVzZXM6IGBhY3Rpb25zL3NldHVwLW5vZGVAJHtnaXRodWJBY3Rpb25zU2V0dXBOb2RlVmVyc2lvbn1gLFxuICAgICAgICAgICAgd2l0aDoge1xuICAgICAgICAgICAgICAnbm9kZS12ZXJzaW9uJzogbm9kZVZlcnNpb24sXG4gICAgICAgICAgICAgICdyZWdpc3RyeS11cmwnOiAnaHR0cHM6Ly9ucG0ucGtnLmdpdGh1Yi5jb20nLFxuICAgICAgICAgICAgICAnc2NvcGUnOiAnQCR7eyBnaXRodWIucmVwb3NpdG9yeV9vd25lciB9fScsXG4gICAgICAgICAgICAgICd0b2tlbic6ICcke3sgc2VjcmV0cy5HSVRIVUJfVE9LRU4gfX0nLFxuICAgICAgICAgICAgfSxcbiAgICAgICAgICB9LFxuICAgICAgICAgIC8vIEluc3RhbGwgZGVwZW5kZW5jaWVzXG4gICAgICAgICAge1xuICAgICAgICAgICAgcnVuOiAneWFybiBpbnN0YWxsIC0tZnJvemVuLWxvY2tmaWxlJyxcbiAgICAgICAgICAgIGVudjoge1xuICAgICAgICAgICAgICBOT0RFX0FVVEhfVE9LRU46ICcke3sgc2VjcmV0cy5HSVRIVUJfVE9LRU4gfX0nLFxuICAgICAgICAgICAgfSxcbiAgICAgICAgICB9LFxuICAgICAgICAgIHtcbiAgICAgICAgICAgIGlkOiAnY3JlZHMnLFxuICAgICAgICAgICAgdXNlczogYGF3cy1hY3Rpb25zL2NvbmZpZ3VyZS1hd3MtY3JlZGVudGlhbHNAJHtnaXRodWJBY3Rpb25zQXdzQ3JlZGVudGlhbHNWZXJzaW9ufWAsXG4gICAgICAgICAgICB3aXRoOiB7XG4gICAgICAgICAgICAgICdyb2xlLXRvLWFzc3VtZSc6IHN0YWNrLm9pZGNSb2xlQXJuID8/IGRlZmF1bHRPaWRjUm9sZUFybixcbiAgICAgICAgICAgICAgJ2F3cy1yZWdpb24nOiBzdGFjay5vaWRjUmVnaW9uID8/IGRlZmF1bHRPaWRjUmVnaW9uLFxuICAgICAgICAgICAgfSxcbiAgICAgICAgICB9LFxuICAgICAgICAgIHtcbiAgICAgICAgICAgIG5hbWU6ICdBc3N1bWUgQ0RLIERlcGxveSBSb2xlJyxcbiAgICAgICAgICAgIGlkOiAnZGVwbG95LXJvbGUnLFxuICAgICAgICAgICAgdXNlczogJ2F3cy1hY3Rpb25zL2NvbmZpZ3VyZS1hd3MtY3JlZGVudGlhbHNAdjQnLFxuICAgICAgICAgICAgd2l0aDoge1xuICAgICAgICAgICAgICAncm9sZS10by1hc3N1bWUnOiBzdGFjay5jZGtEaWZmUm9sZVRvQXNzdW1lQXJuLFxuICAgICAgICAgICAgICAncm9sZS1jaGFpbmluZyc6IHRydWUsXG4gICAgICAgICAgICAgICdyb2xlLXNraXAtc2Vzc2lvbi10YWdnaW5nJzogdHJ1ZSxcbiAgICAgICAgICAgICAgJ2F3cy1yZWdpb24nOiBzdGFjay5jZGtEaWZmUm9sZVRvQXNzdW1lUmVnaW9uLFxuICAgICAgICAgICAgICAnYXdzLWFjY2Vzcy1rZXktaWQnOiAnJHt7IHN0ZXBzLmNyZWRzLm91dHB1dHMuYXdzLWFjY2Vzcy1rZXktaWQgfX0nLFxuICAgICAgICAgICAgICAnYXdzLXNlY3JldC1hY2Nlc3Mta2V5JzogJyR7eyBzdGVwcy5jcmVkcy5vdXRwdXRzLmF3cy1zZWNyZXQtYWNjZXNzLWtleSB9fScsXG4gICAgICAgICAgICAgICdhd3Mtc2Vzc2lvbi10b2tlbic6ICcke3sgc3RlcHMuY3JlZHMub3V0cHV0cy5hd3Mtc2Vzc2lvbi10b2tlbiB9fScsXG4gICAgICAgICAgICB9LFxuICAgICAgICAgIH0sXG4gICAgICAgICAgLy8gQWRkIGNoYW5nZXNldCBjcmVhdGlvbiBzdGVwXG4gICAgICAgICAge1xuICAgICAgICAgICAgbmFtZTogYENyZWF0ZSBDaGFuZ2VzZXQgZm9yICR7c3RhY2suc3RhY2tOYW1lfWAsXG4gICAgICAgICAgICBydW46IGB5YXJuICR7Y2RrWWFybkNvbW1hbmR9IGRlcGxveSAke3N0YWNrLnN0YWNrTmFtZX0gLS1uby1leGVjdXRlIC0tY2hhbmdlLXNldC1uYW1lICR7c3RhY2suc3RhY2tOYW1lfSAtLXJlcXVpcmUtYXBwcm92YWwgbmV2ZXJgLFxuICAgICAgICAgIH0sXG4gICAgICAgICAgLy8gQWRkIGNoYW5nZXNldCBkZXNjcmlwdGlvbiBzdGVwXG4gICAgICAgICAge1xuICAgICAgICAgICAgbmFtZTogYERlc2NyaWJlIGNoYW5nZSBzZXQgZm9yICR7c3RhY2suc3RhY2tOYW1lfWAsXG4gICAgICAgICAgICBydW46IGBucHggdHMtbm9kZSAke3NjcmlwdE91dHB1dFBhdGh9YCxcbiAgICAgICAgICAgIGVudjoge1xuICAgICAgICAgICAgICBTVEFDS19OQU1FOiBzdGFjay5zdGFja05hbWUsXG4gICAgICAgICAgICAgIENIQU5HRV9TRVRfTkFNRTogc3RhY2suc3RhY2tOYW1lLFxuICAgICAgICAgICAgICBHSVRIVUJfQ09NTUVOVF9VUkw6ICcke3sgZ2l0aHViLmV2ZW50LnB1bGxfcmVxdWVzdC5jb21tZW50c191cmwgfX0nLFxuICAgICAgICAgICAgICBHSVRIVUJfVE9LRU46ICcke3sgc2VjcmV0cy5HSVRIVUJfVE9LRU4gfX0nLFxuICAgICAgICAgICAgfSxcbiAgICAgICAgICB9LFxuICAgICAgICAgIC8vIEFkZCBjaGFuZ2VzZXQgY2xlYW51cCBzdGVwXG4gICAgICAgICAge1xuICAgICAgICAgICAgbmFtZTogYERlbGV0ZSBjaGFuZ2VzZXQgZm9yICR7c3RhY2suc3RhY2tOYW1lfWAsXG4gICAgICAgICAgICBydW46IGBhd3MgY2xvdWRmb3JtYXRpb24gZGVsZXRlLWNoYW5nZS1zZXQgLS1jaGFuZ2Utc2V0LW5hbWUgJHtzdGFjay5zdGFja05hbWV9IC0tc3RhY2stbmFtZSAke3N0YWNrLnN0YWNrTmFtZX0gLS1yZWdpb24gJHtzdGFjay5jZGtEaWZmUm9sZVRvQXNzdW1lUmVnaW9ufWAsXG4gICAgICAgICAgfSxcbiAgICAgICAgXSxcbiAgICAgIH0sXG4gICAgfSk7XG4gIH1cbn1cbiJdfQ==

@@ -0,0 +1,10 @@
+export interface CdkDriftIamTemplateProps {
+    readonly project: any;
+    readonly roleName: string;
+    readonly outputPath?: string;
+    readonly oidcRoleArn: string;
+    readonly oidcRegion: string;
+}
+export declare class CdkDriftIamTemplate {
+    constructor(props: CdkDriftIamTemplateProps);
+}

@@ -0,0 +1,76 @@
+"use strict";
+var _a;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CdkDriftIamTemplate = void 0;
+const JSII_RTTI_SYMBOL_1 = Symbol.for("jsii.rtti");
+const projen_1 = require("projen");
+class CdkDriftIamTemplate {
+    constructor(props) {
+        const outputPath = props.outputPath ?? 'cdk-drift-workflow-iam-template.yaml';
+        props.project.addTask('deploy-cdkdrift-iam-template', {
+            description: 'Deploy the CDK Drift Detection IAM template via CloudFormation (accepts extra AWS CLI args, e.g., --parameter-overrides Key=Value...)',
+            receiveArgs: true,
+            exec: `aws cloudformation deploy --template-file ${outputPath} --stack-name cdk-drift-workflow-iam-role --capabilities CAPABILITY_NAMED_IAM`,
+        });
+        new projen_1.TextFile(props.project, outputPath, {
+            lines: [
+                "AWSTemplateFormatVersion: '2010-09-09'",
+                "Description: 'IAM role for CDK Drift Detection Workflow'",
+                '',
+                'Parameters:',
+                '  GitHubOIDCRoleArn:',
+                '    Type: String',
+                "    Description: 'ARN of the existing GitHub OIDC role that can assume this drift role'",
+                `    Default: '${props.oidcRoleArn}'`,
+                '',
+                'Resources:',
+                '  # CloudFormation Drift Detection Role - minimal permissions for drift detection operations',
+                '  CdkDriftRole:',
+                '    Type: AWS::IAM::Role',
+                '    Properties:',
+                "      RoleName: '" + props.roleName + "'",
+                '      AssumeRolePolicyDocument:',
+                "        Version: '2012-10-17'",
+                '        Statement:',
+                '          - Effect: Allow',
+                '            Principal:',
+                '              AWS: !Ref GitHubOIDCRoleArn',
+                '            Action: sts:AssumeRole',
+                '            Condition:',
+                '              StringEquals:',
+                "                aws:RequestedRegion: '" + props.oidcRegion + "'",
+                '      Policies:',
+                '        - PolicyName: CloudFormationDriftAccess',
+                '          PolicyDocument:',
+                "            Version: '2012-10-17'",
+                '            Statement:',
+                '              # CloudFormation drift detection operations',
+                '              - Effect: Allow',
+                '                Action:',
+                '                  - cloudformation:DetectStackDrift',
+                '                  - cloudformation:DescribeStackDriftDetectionStatus',
+                '                  - cloudformation:DescribeStackResourceDrifts',
+                '                  - cloudformation:DescribeStacks',
+                '                  - cloudformation:ListStackResources',
+                "                Resource: '*'",
+                '',
+                'Outputs:',
+                '  CdkDriftRoleArn:',
+                "    Description: 'ARN of the CDK drift detection role'",
+                '    Value: !GetAtt CdkDriftRole.Arn',
+                '    Export:',
+                "      Name: !Sub '${AWS::StackName}-CdkDriftRoleArn'",
+                '',
+                '  CdkDriftRoleName:',
+                "    Description: 'Name of the CDK drift detection role'",
+                '    Value: !Ref CdkDriftRole',
+                '    Export:',
+                "      Name: !Sub '${AWS::StackName}-CdkDriftRoleName'",
+            ],
+        });
+    }
+}
+exports.CdkDriftIamTemplate = CdkDriftIamTemplate;
+_a = JSII_RTTI_SYMBOL_1;
+CdkDriftIamTemplate[_a] = { fqn: "@jjrawlins/cdk-diff-pr-github-action.CdkDriftIamTemplate", version: "0.0.0" };
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiQ2RrRHJpZnRJYW1UZW1wbGF0ZS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3NyYy9DZGtEcmlmdElhbVRlbXBsYXRlLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7Ozs7O0FBQUEsbUNBQWtDO0FBVWxDLE1BQWEsbUJBQW1CO0lBQzlCLFlBQVksS0FBK0I7UUFDekMsTUFBTSxVQUFVLEdBQUcsS0FBSyxDQUFDLFVBQVUsSUFBSSxzQ0FBc0MsQ0FBQztRQUU5RSxLQUFLLENBQUMsT0FBTyxDQUFDLE9BQU8sQ0FBQyw4QkFBOEIsRUFBRTtZQUNwRCxXQUFXLEVBQ1QsdUlBQXVJO1lBQ3pJLFdBQVcsRUFBRSxJQUFJO1lBQ2pCLElBQUksRUFDRiw2Q0FBNkMsVUFBVSwrRUFBK0U7U0FDekksQ0FBQyxDQUFDO1FBRUgsSUFBSSxpQkFBUSxDQUFDLEtBQUssQ0FBQyxPQUFPLEVBQUUsVUFBVSxFQUFFO1lBQ3RDLEtBQUssRUFBRTtnQkFDTCx3Q0FBd0M7Z0JBQ3hDLDBEQUEwRDtnQkFDMUQsRUFBRTtnQkFDRixhQUFhO2dCQUNiLHNCQUFzQjtnQkFDdEIsa0JBQWtCO2dCQUNsQix5RkFBeUY7Z0JBQ3pGLGlCQUFpQixLQUFLLENBQUMsV0FBVyxHQUFHO2dCQUNyQyxFQUFFO2dCQUNGLFlBQVk7Z0JBQ1osOEZBQThGO2dCQUM5RixpQkFBaUI7Z0JBQ2pCLDBCQUEwQjtnQkFDMUIsaUJBQWlCO2dCQUNqQixtQkFBbUIsR0FBRyxLQUFLLENBQUMsUUFBUSxHQUFHLEdBQUc7Z0JBQzFDLGlDQUFpQztnQkFDakMsK0JBQStCO2dCQUMvQixvQkFBb0I7Z0JBQ3BCLDJCQUEyQjtnQkFDM0Isd0JBQXdCO2dCQUN4QiwyQ0FBMkM7Z0JBQzNDLG9DQUFvQztnQkFDcEMsd0JBQXdCO2dCQUN4Qiw2QkFBNkI7Z0JBQzdCLHdDQUF3QyxHQUFHLEtBQUssQ0FBQyxVQUFVLEdBQUcsR0FBRztnQkFDakUsaUJBQWlCO2dCQUNqQixpREFBaUQ7Z0JBQ2pELDJCQUEyQjtnQkFDM0IsbUNBQW1DO2dCQUNuQyx3QkFBd0I7Z0JBQ3hCLDJEQUEyRDtnQkFDM0QsK0JBQStCO2dCQUMvQix5QkFBeUI7Z0JBQ3pCLHFEQUFxRDtnQkFDckQsc0VBQXNFO2dCQUN0RSxnRUFBZ0U7Z0JBQ2hFLG1EQUFtRDtnQkFDbkQsdURBQXVEO2dCQUN2RCwrQkFBK0I7Z0JBQy9CLEVBQUU7Z0JBQ0YsVUFBVTtnQkFDVixvQkFBb0I7Z0JBQ3BCLHdEQUF3RDtnQkFDeEQscUNBQXFDO2dCQUNyQyxhQUFhO2dCQUNiLHNEQUFzRDtnQkFDdEQsRUFBRTtnQkFDRixxQkFBcUI7Z0JBQ3JCLHlEQUF5RDtnQkFDekQsOEJBQThCO2dCQUM5QixhQUFhO2dCQUNiLHVEQUF1RDthQUN4RDtTQUNGLENBQUMsQ0FBQztJQUNMLENBQUM7O0FBcEVILGtEQXFFQyIsInNvdXJjZXNDb250ZW50IjpbImltcG9ydCB7IFRleHRGaWxlIH0gZnJvbSAncHJvamVuJztcblxuZXhwb3J0IGludGVyZmFjZSBDZGtEcmlmdElhbVRlbXBsYXRlUHJvcHMge1xuICByZWFkb25seSBwcm9qZWN0OiBhbnk7XG4gIHJlYWRvbmx5IHJvbGVOYW1lOiBzdHJpbmc7XG4gIHJlYWRvbmx5IG91dHB1dFBhdGg/OiBzdHJpbmc7XG4gIHJlYWRvbmx5IG9pZGNSb2xlQXJuOiBzdHJpbmc7XG4gIHJlYWRvbmx5IG9pZGNSZWdpb246IHN0cmluZztcbn1cblxuZXhwb3J0IGNsYXNzIENka0RyaWZ0SWFtVGVtcGxhdGUge1xuICBjb25zdHJ1Y3Rvcihwcm9wczogQ2RrRHJpZnRJYW1UZW1wbGF0ZVByb3BzKSB7XG4gICAgY29uc3Qgb3V0cHV0UGF0aCA9IHByb3BzLm91dHB1dFBhdGggPz8gJ2Nkay1kcmlmdC13b3JrZmxvdy1pYW0tdGVtcGxhdGUueWFtbCc7XG5cbiAgICBwcm9wcy5wcm9qZWN0LmFkZFRhc2soJ2RlcGxveS1jZGtkcmlmdC1pYW0tdGVtcGxhdGUnLCB7XG4gICAgICBkZXNjcmlwdGlvbjpcbiAgICAgICAgJ0RlcGxveSB0aGUgQ0RLIERyaWZ0IERldGVjdGlvbiBJQU0gdGVtcGxhdGUgdmlhIENsb3VkRm9ybWF0aW9uIChhY2NlcHRzIGV4dHJhIEFXUyBDTEkgYXJncywgZS5nLiwgLS1wYXJhbWV0ZXItb3ZlcnJpZGVzIEtleT1WYWx1ZS4uLiknLFxuICAgICAgcmVjZWl2ZUFyZ3M6IHRydWUsXG4gICAgICBleGVjOlxuICAgICAgICBgYXdzIGNsb3VkZm9ybWF0aW9uIGRlcGxveSAtLXRlbXBsYXRlLWZpbGUgJHtvdXRwdXRQYXRofSAtLXN0YWNrLW5hbWUgY2RrLWRyaWZ0LXdvcmtmbG93LWlhbS1yb2xlIC0tY2FwYWJpbGl0aWVzIENBUEFCSUxJVFlfTkFNRURfSUFNYCxcbiAgICB9KTtcblxuICAgIG5ldyBUZXh0RmlsZShwcm9wcy5wcm9qZWN0LCBvdXRwdXRQYXRoLCB7XG4gICAgICBsaW5lczogW1xuICAgICAgICBcIkFXU1RlbXBsYXRlRm9ybWF0VmVyc2lvbjogJzIwMTAtMDktMDknXCIsXG4gICAgICAgIFwiRGVzY3JpcHRpb246ICdJQU0gcm9sZSBmb3IgQ0RLIERyaWZ0IERldGVjdGlvbiBXb3JrZmxvdydcIixcbiAgICAgICAgJycsXG4gICAgICAgICdQYXJhbWV0ZXJzOicsXG4gICAgICAgICcgIEdpdEh1Yk9JRENSb2xlQXJuOicsXG4gICAgICAgICcgICAgVHlwZTogU3RyaW5nJyxcbiAgICAgICAgXCIgICAgRGVzY3JpcHRpb246ICdBUk4gb2YgdGhlIGV4aXN0aW5nIEdpdEh1YiBPSURDIHJvbGUgdGhhdCBjYW4gYXNzdW1lIHRoaXMgZHJpZnQgcm9sZSdcIixcbiAgICAgICAgYCAgICBEZWZhdWx0OiAnJHtwcm9wcy5vaWRjUm9sZUFybn0nYCxcbiAgICAgICAgJycsXG4gICAgICAgICdSZXNvdXJjZXM6JyxcbiAgICAgICAgJyAgIyBDbG91ZEZvcm1hdGlvbiBEcmlmdCBEZXRlY3Rpb24gUm9sZSAtIG1pbmltYWwgcGVybWlzc2lvbnMgZm9yIGRyaWZ0IGRldGVjdGlvbiBvcGVyYXRpb25zJyxcbiAgICAgICAgJyAgQ2RrRHJpZnRSb2xlOicsXG4gICAgICAgICcgICAgVHlwZTogQVdTOjpJQU06OlJvbGUnLFxuICAgICAgICAnICAgIFByb3BlcnRpZXM6JyxcbiAgICAgICAgXCIgICAgICBSb2xlTmFtZTogJ1wiICsgcHJvcHMucm9sZU5hbWUgKyBcIidcIixcbiAgICAgICAgJyAgICAgIEFzc3VtZVJvbGVQb2xpY3lEb2N1bWVudDonLFxuICAgICAgICBcIiAgICAgICAgVmVyc2lvbjogJzIwMTItMTAtMTcnXCIsXG4gICAgICAgICcgICAgICAgIFN0YXRlbWVudDonLFxuICAgICAgICAnICAgICAgICAgIC0gRWZmZWN0OiBBbGxvdycsXG4gICAgICAgICcgICAgICAgICAgICBQcmluY2lwYWw6JyxcbiAgICAgICAgJyAgICAgICAgICAgICAgQVdTOiAhUmVmIEdpdEh1Yk9JRENSb2xlQXJuJyxcbiAgICAgICAgJyAgICAgICAgICAgIEFjdGlvbjogc3RzOkFzc3VtZVJvbGUnLFxuICAgICAgICAnICAgICAgICAgICAgQ29uZGl0aW9uOicsXG4gICAgICAgICcgICAgICAgICAgICAgIFN0cmluZ0VxdWFsczonLFxuICAgICAgICBcIiAgICAgICAgICAgICAgICBhd3M6UmVxdWVzdGVkUmVnaW9uOiAnXCIgKyBwcm9wcy5vaWRjUmVnaW9uICsgXCInXCIsXG4gICAgICAgICcgICAgICBQb2xpY2llczonLFxuICAgICAgICAnICAgICAgICAtIFBvbGljeU5hbWU6IENsb3VkRm9ybWF0aW9uRHJpZnRBY2Nlc3MnLFxuICAgICAgICAnICAgICAgICAgIFBvbGljeURvY3VtZW50OicsXG4gICAgICAgIFwiICAgICAgICAgICAgVmVyc2lvbjogJzIwMTItMTAtMTcnXCIsXG4gICAgICAgICcgICAgICAgICAgICBTdGF0ZW1lbnQ6JyxcbiAgICAgICAgJyAgICAgICAgICAgICAgIyBDbG91ZEZvcm1hdGlvbiBkcmlmdCBkZXRlY3Rpb24gb3BlcmF0aW9ucycsXG4gICAgICAgICcgICAgICAgICAgICAgIC0gRWZmZWN0OiBBbGxvdycsXG4gICAgICAgICcgICAgICAgICAgICAgICAgQWN0aW9uOicsXG4gICAgICAgICcgICAgICAgICAgICAgICAgICAtIGNsb3VkZm9ybWF0aW9uOkRldGVjdFN0YWNrRHJpZnQnLFxuICAgICAgICAnICAgICAgICAgICAgICAgICAgLSBjbG91ZGZvcm1hdGlvbjpEZXNjcmliZVN0YWNrRHJpZnREZXRlY3Rpb25TdGF0dXMnLFxuICAgICAgICAnICAgICAgICAgICAgICAgICAgLSBjbG91ZGZvcm1hdGlvbjpEZXNjcmliZVN0YWNrUmVzb3VyY2VEcmlmdHMnLFxuICAgICAgICAnICAgICAgICAgICAgICAgICAgLSBjbG91ZGZvcm1hdGlvbjpEZXNjcmliZVN0YWNrcycsXG4gICAgICAgICcgICAgICAgICAgICAgICAgICAtIGNsb3VkZm9ybWF0aW9uOkxpc3RTdGFja1Jlc291cmNlcycsXG4gICAgICAgIFwiICAgICAgICAgICAgICAgIFJlc291cmNlOiAnKidcIixcbiAgICAgICAgJycsXG4gICAgICAgICdPdXRwdXRzOicsXG4gICAgICAgICcgIENka0RyaWZ0Um9sZUFybjonLFxuICAgICAgICBcIiAgICBEZXNjcmlwdGlvbjogJ0FSTiBvZiB0aGUgQ0RLIGRyaWZ0IGRldGVjdGlvbiByb2xlJ1wiLFxuICAgICAgICAnICAgIFZhbHVlOiAhR2V0QXR0IENka0RyaWZ0Um9sZS5Bcm4nLFxuICAgICAgICAnICAgIEV4cG9ydDonLFxuICAgICAgICBcIiAgICAgIE5hbWU6ICFTdWIgJyR7QVdTOjpTdGFja05hbWV9LUNka0RyaWZ0Um9sZUFybidcIixcbiAgICAgICAgJycsXG4gICAgICAgICcgIENka0RyaWZ0Um9sZU5hbWU6JyxcbiAgICAgICAgXCIgICAgRGVzY3JpcHRpb246ICdOYW1lIG9mIHRoZSBDREsgZHJpZnQgZGV0ZWN0aW9uIHJvbGUnXCIsXG4gICAgICAgICcgICAgVmFsdWU6ICFSZWYgQ2RrRHJpZnRSb2xlJyxcbiAgICAgICAgJyAgICBFeHBvcnQ6JyxcbiAgICAgICAgXCIgICAgICBOYW1lOiAhU3ViICcke0FXUzo6U3RhY2tOYW1lfS1DZGtEcmlmdFJvbGVOYW1lJ1wiLFxuICAgICAgXSxcbiAgICB9KTtcbiAgfVxufVxuIl19

@@ -0,0 +1,9 @@
+import { AwsCdkTypeScriptApp } from 'projen/lib/awscdk';
+interface CdkChangesetScriptProps {
+    project: AwsCdkTypeScriptApp;
+    outputPath?: string;
+}
+export declare class CdkChangesetScript {
+    constructor(props: CdkChangesetScriptProps);
+}
+export {};