@jjrawlins/cdk-diff-pr-github-action 0.0.72 → 1.0.0

package/.jsii

@@ -3549,7 +3549,7 @@
   },
   "name": "@jjrawlins/cdk-diff-pr-github-action",
   "readme": {
-    "markdown": "# cdk-diff-pr-github-action\n\nA small Projen-based helper library that wires GitHub workflows for:\n- Creating CloudFormation Change Sets for your CDK stacks on pull requests and commenting a formatted diff back on the PR.\n- Detecting CloudFormation drift on a schedule or manual trigger and producing a consolidated summary (optionally creating an issue).\n\nIt also provides ready‑to‑deploy IAM templates with the minimal permissions required for each workflow.\n\nThis package exposes four constructs:\n\n- `CdkDiffStackWorkflow` — Generates one GitHub Actions workflow per stack to create a change set and render the diff back to the PR and Step Summary.\n- `CdkDiffIamTemplate` — Emits a CloudFormation template file with minimal permissions for the Change Set workflow.\n- `CdkDriftDetectionWorkflow` — Generates a GitHub Actions workflow to detect CloudFormation drift per stack, upload machine‑readable results, and aggregate a summary.\n- `CdkDriftIamTemplate` — Emits a CloudFormation template file with minimal permissions for the Drift Detection workflow.\n\n## Quick start\n\n1) Add the constructs to your Projen project (in `.projenrc.ts`).\n2) Synthesize with `npx projen`.\n3) Commit the generated files.\n4) Open a pull request or run the drift detection workflow.\n\n## Usage: CdkDiffStackWorkflow\n\n`CdkDiffStackWorkflow` renders a workflow per stack named `diff-<StackName>.yml` under `.github/workflows/`. It also generates a helper script at `.github/workflows/scripts/describe-cfn-changeset.ts` that formats the change set output and takes care of posting the PR comment and Step Summary.\n\nExample `.projenrc.ts`:\n\n```ts\nimport { awscdk } from 'projen';\nimport { CdkDiffStackWorkflow } from '@jjrawlins/cdk-diff-pr-github-action';\n\nconst project = new awscdk.AwsCdkConstructLibrary({\n  // ... your usual settings ...\n  workflowName: 'my-lib',\n  defaultReleaseBranch: 'main',\n  cdkVersion: '2.85.0',\n  github: true,\n});\n\nnew CdkDiffStackWorkflow({\n  project,\n  stacks: [\n    {\n      stackName: 'MyAppStack',\n      changesetRoleToAssumeArn: 'arn:aws:iam::123456789012:role/cdk-diff-role',\n      changesetRoleToAssumeRegion: 'us-east-1',\n      // Optional per‑stack OIDC override (if not using the defaults below)\n      // oidcRoleArn: 'arn:aws:iam::123456789012:role/github-oidc-role',\n      // oidcRegion: 'us-east-1',\n    },\n  ],\n  // Default OIDC role/region used by all stacks unless overridden per‑stack\n  oidcRoleArn: 'arn:aws:iam::123456789012:role/github-oidc-role',\n  oidcRegion: 'us-east-1',\n  // Optional: Node version used in the workflow (default: '24.x')\n  // nodeVersion: '24.x',\n  // Optional: Yarn command to run CDK (default: 'cdk')\n  // cdkYarnCommand: 'cdk',\n  // Optional: Where to place the helper script (default: '.github/workflows/scripts/describe-cfn-changeset.ts')\n  // scriptOutputPath: '.github/workflows/scripts/describe-cfn-changeset.ts',\n});\n\nproject.synth();\n```\n\n### CdkDiffStackWorkflow props\n- `project` (required) — Your Projen project instance.\n- `stacks` (required) — Array of stack entries.\n- `oidcRoleArn` (required unless provided per‑stack) — Default OIDC role ARN.\n- `oidcRegion` (required unless provided per‑stack) — Default OIDC region.\n- `nodeVersion` (optional, default `'24.x'`) — Node.js version for the workflow runner.\n- `cdkYarnCommand` (optional, default `'cdk'`) — Yarn script/command to invoke CDK.\n- `scriptOutputPath` (optional, default `'.github/workflows/scripts/describe-cfn-changeset.ts'`) — Where to write the helper script.\n\nIf neither top‑level OIDC defaults nor all per‑stack values are supplied, the construct throws a helpful error.\n\n### Stack item fields\n- `stackName` (required) — The CDK stack name to create the change set for.\n- `changesetRoleToAssumeArn` (required) — The ARN of the role used to create the change set (role chaining after OIDC).\n- `changesetRoleToAssumeRegion` (required) — The region for that role.\n- `oidcRoleArn` (optional) — Per‑stack override for the OIDC role.\n- `oidcRegion` (optional) — Per‑stack override for the OIDC region.\n\n### What gets generated\n- `.github/workflows/diff-<StackName>.yml` — One workflow per stack, triggered on PR open/sync/reopen.\n- `.github/workflows/scripts/describe-cfn-changeset.ts` — A helper script that:\n  - Polls `DescribeChangeSet` until terminal\n  - Filters out ignorable logical IDs or resource types using environment variables `IGNORE_LOGICAL_IDS` and `IGNORE_RESOURCE_TYPES`\n  - Renders an HTML table with actions, logical IDs, types, replacements, and changed properties\n  - Prints the HTML, appends to the GitHub Step Summary, and (if `GITHUB_TOKEN` and `GITHUB_COMMENT_URL` are present) posts a PR comment\n\n### Environment variables used by the change set script\n- `STACK_NAME` (required) — Stack name to describe.\n- `CHANGE_SET_NAME` (default: same as `STACK_NAME`).\n- `AWS_REGION` — Region for CloudFormation API calls. The workflow sets this via the credentials action(s).\n- `GITHUB_TOKEN` (optional) — If set with `GITHUB_COMMENT_URL`, posts a PR comment.\n- `GITHUB_COMMENT_URL` (optional) — PR comments URL.\n- `GITHUB_STEP_SUMMARY` (optional) — When present, appends the HTML to the step summary file.\n- `IGNORE_LOGICAL_IDS` (optional) — Comma‑separated logical IDs to ignore (default includes `CDKMetadata`).\n- `IGNORE_RESOURCE_TYPES` (optional) — Comma‑separated resource types to ignore (e.g., `AWS::CDK::Metadata`).\n\n## Usage: CdkDiffIamTemplate\n\nEmit an example IAM template you can deploy in your account for the Change Set workflow:\n\n```ts\nimport { awscdk } from 'projen';\nimport { CdkDiffIamTemplate } from '@jjrawlins/cdk-diff-pr-github-action';\n\nconst project = new awscdk.AwsCdkConstructLibrary({\n  // ...\n});\n\nnew CdkDiffIamTemplate({\n  project,\n  roleName: 'cdk-diff-role',\n  oidcRoleArn: 'arn:aws:iam::123456789012:role/github-oidc-role',\n  oidcRegion: 'us-east-1',\n  // Optional: custom output path (default: 'cdk-diff-workflow-iam-template.yaml')\n  // outputPath: 'infra/cdk-diff-iam.yaml',\n});\n\nproject.synth();\n```\n\nThis writes `cdk-diff-workflow-iam-template.yaml` at the project root (or your chosen `outputPath`). The template defines:\n- Parameter `GitHubOIDCRoleArn` with a default from `oidcRoleArn` — the ARN of your existing GitHub OIDC role allowed to assume the change set role.\n- IAM role `CdkChangesetRole` with minimal permissions for:\n  - CloudFormation Change Set operations\n  - Access to common CDK bootstrap S3 buckets and SSM parameters\n  - `iam:PassRole` to `cloudformation.amazonaws.com`\n- Outputs exporting the role name and ARN.\n\nA Projen task is also added:\n\n```bash\nnpx projen deploy-cdkdiff-iam-template -- --parameter-overrides GitHubOIDCRoleArn=... # plus any extra AWS CLI args\n```\n\nUse the created role ARN as `changesetRoleToAssumeArn` in `CdkDiffStackWorkflow`.\n\n---\n\n## Usage: CdkDriftDetectionWorkflow\n\n`CdkDriftDetectionWorkflow` creates a single workflow file (default `drift-detection.yml`) that can run on a schedule and via manual dispatch. It generates a helper script at `.github/workflows/scripts/detect-drift.ts` (by default) that uses AWS SDK v3 to run drift detection, write optional machine‑readable JSON, and print an HTML report for the Step Summary.\n\nExample `.projenrc.ts`:\n\n```ts\nimport { awscdk } from 'projen';\nimport { CdkDriftDetectionWorkflow } from '@jjrawlins/cdk-diff-pr-github-action';\n\nconst project = new awscdk.AwsCdkConstructLibrary({ github: true, /* ... */ });\n\nnew CdkDriftDetectionWorkflow({\n  project,\n  workflowName: 'Drift Detection',            // optional; file name derived as 'drift-detection.yml'\n  schedule: '0 1 * * *',                      // optional cron\n  createIssues: true,                         // default true; create/update issue when drift detected on schedule\n  oidcRoleArn: 'arn:aws:iam::123456789012:role/github-oidc-role',\n  oidcRegion: 'us-east-1',\n  // Optional: Node version (default '24.x')\n  // nodeVersion: '24.x',\n  // Optional: Where to place the helper script (default '.github/workflows/scripts/detect-drift.ts')\n  // scriptOutputPath: '.github/workflows/scripts/detect-drift.ts',\n  stacks: [\n    {\n      stackName: 'MyAppStack-Prod',\n      driftDetectionRoleToAssumeArn: 'arn:aws:iam::123456789012:role/cdk-drift-role',\n      driftDetectionRoleToAssumeRegion: 'us-east-1',\n      // failOnDrift: true, // optional (default true)\n    },\n  ],\n});\n\nproject.synth();\n```\n\n### CdkDriftDetectionWorkflow props\n- `project` (required) — Your Projen project instance.\n- `stacks` (required) — Array of stacks to check.\n- `oidcRoleArn` (required) — Default OIDC role ARN used before chaining into per‑stack drift roles.\n- `oidcRegion` (required) — Default OIDC region.\n- `workflowName` (optional, default `'drift-detection'`) — Human‑friendly workflow name; the file name is derived in kebab‑case.\n- `schedule` (optional) — Cron expression for automatic runs.\n- `createIssues` (optional, default `true`) — When true, scheduled runs will create/update a GitHub issue if drift is detected.\n- `nodeVersion` (optional, default `'24.x'`) — Node.js version for the runner.\n- `scriptOutputPath` (optional, default `'.github/workflows/scripts/detect-drift.ts'`) — Where to write the helper script.\n\n### Per‑stack fields\n- `stackName` (required) — The full CloudFormation stack name.\n- `driftDetectionRoleToAssumeArn` (required) — Role to assume (after OIDC) for making drift API calls.\n- `driftDetectionRoleToAssumeRegion` (required) — Region for that role and API calls.\n- `failOnDrift` (optional, default `true`) — Intended to fail the detection step on drift. The provided script exits with non‑zero when drift is found; the job continues to allow artifact upload and issue creation.\n\n### What gets generated\n- `.github/workflows/<kebab(workflowName)>.yml` — A workflow with one job per stack plus a final summary job.\n- `.github/workflows/scripts/detect-drift.ts` — Helper script that:\n  - Starts drift detection and polls until completion\n  - Lists non‑`IN_SYNC` resources and builds an HTML report\n  - Writes optional JSON to `DRIFT_DETECTION_OUTPUT` when set\n  - Prints to stdout and appends to the GitHub Step Summary when available\n\n### Artifacts and summary\n- Each stack job uploads `drift-results-<stack>.json` (if produced).\n- A final `Drift Detection Summary` job downloads all artifacts and prints a consolidated summary.\n\n### Manual dispatch\n- The workflow exposes an input named `stack` with choices including each configured stack and an `all` option.\n- Choose a specific stack to run drift detection for that stack only, or select `all` (or leave the input empty) to run all stacks.\n\nNote: The default workflow does not post PR comments for drift. It can create/update an Issue on scheduled runs when `createIssues` is `true`.\n\n### Post-notification steps (e.g., Slack)\n\nYou can add your own GitHub Action steps to run after the drift detection step for each stack using `postGitHubSteps`.\nProvide your own Slack payload/markdown (this library no longer generates a payload step for you).\n\nOption A: slackapi/slack-github-action (Incoming Webhook, official syntax)\n\n```ts\nnew CdkDriftDetectionWorkflow({\n  project,\n  oidcRoleArn: 'arn:aws:iam::123456789012:role/github-oidc-role',\n  oidcRegion: 'us-east-1',\n  stacks: [/* ... */],\n  postGitHubSteps: ({ stack }) => {\n    // Build a descriptive name per stack\n    const name = `Notify Slack (${stack} post-drift)`;\n    const step = {\n      name,\n      uses: 'slackapi/slack-github-action@v2.1.1',\n      // by default, post steps run only when drift is detected; you can override `if`\n      if: \"always() && steps.drift.outcome == 'failure'\",\n      // Use official inputs: webhook + webhook-type, and a YAML payload with blocks\n      with: {\n        webhook: '${{ secrets.CDK_NOTIFICATIONS_SLACK_WEBHOOK }}',\n        'webhook-type': 'incoming-webhook',\n        payload: [\n          'text: \"** ${{ env.STACK_NAME }} ** has drifted!\"',\n          'blocks:',\n          '  - type: \"section\"',\n          '    text:',\n          '      type: \"mrkdwn\"',\n          '      text: \"*Stack:* ${{ env.STACK_NAME }} (region ${{ env.AWS_REGION }}) has drifted:exclamation:\"',\n          '  - type: \"section\"',\n          '    fields:',\n          '      - type: \"mrkdwn\"',\n          '        text: \"*Stack ARN*\\\\n${{ steps.drift.outputs.stack-arn }}\"',\n          '      - type: \"mrkdwn\"',\n          '        text: \"*Issue*\\\\n<${{ github.server_url }}/${{ github.repository }}/issues/${{ steps.issue.outputs.result }}|#${{ steps.issue.outputs.result }}>\"',\n        ].join('\\n'),\n      },\n    };\n    return [step];\n  },\n});\n```\n\nNote: The Issue link requires `createIssues: true` (default) so that the `Create Issue on Drift` step runs before this Slack step and exposes `steps.issue.outputs.result`. This library orders the steps accordingly.\n\nDetails:\n- `postGitHubSteps` can be:\n  - an array of step objects, or\n  - a factory function `({ stack }) => step | step[]`.\n- Each step you provide is inserted after the results are uploaded.\n- Default condition: if you do not set `if` on your step, it will default to `always() && steps.drift.outcome == 'failure'`.\n- Available context/env you can use:\n  - `${{ env.STACK_NAME }}`, `${{ env.DRIFT_DETECTION_OUTPUT }}`\n  - `${{ steps.drift.outcome }}` — success/failure of the detect step\n  - `${{ steps.drift.outputs.stack-arn }}` — Stack ARN resolved at runtime\n  - `${{ steps.issue.outputs.result }}` — Issue number if the workflow created/found one (empty when not applicable)\n```\n\n## Usage: CdkDriftIamTemplate\n\nEmit an example IAM template you can deploy in your account for the Drift Detection workflow:\n\n```ts\nimport { awscdk } from 'projen';\nimport { CdkDriftIamTemplate } from '@jjrawlins/cdk-diff-pr-github-action';\n\nconst project = new awscdk.AwsCdkConstructLibrary({\n  // ...\n});\n\nnew CdkDriftIamTemplate({\n  project,\n  roleName: 'cdk-drift-role',\n  oidcRoleArn: 'arn:aws:iam::123456789012:role/github-oidc-role',\n  oidcRegion: 'us-east-1',\n  // Optional: custom output path (default: 'cdk-drift-workflow-iam-template.yaml')\n  // outputPath: 'infra/cdk-drift-iam.yaml',\n});\n\nproject.synth();\n```\n\nThis writes `cdk-drift-workflow-iam-template.yaml` at the project root (or your chosen `outputPath`). The template defines:\n- Parameter `GitHubOIDCRoleArn` with a default from `oidcRoleArn` — the ARN of your existing GitHub OIDC role allowed to assume this drift role.\n- IAM role `CdkDriftRole` with minimal permissions for CloudFormation drift detection operations.\n- Outputs exporting the role name and ARN.\n\nA Projen task is also added:\n\n```bash\nnpx projen deploy-cdkdrift-iam-template -- --parameter-overrides GitHubOIDCRoleArn=... # plus any extra AWS CLI args\n```\n\n## Testing\n\nThis repository includes Jest tests that snapshot the synthesized outputs from Projen and assert that:\n- Diff workflows are created per stack and contain all expected steps.\n- Drift detection workflow produces one job per stack and a summary job.\n- Only one helper script file is generated per workflow type.\n- Per‑stack OIDC overrides (where supported) are respected.\n- Helpful validation errors are thrown for missing OIDC settings.\n- The IAM template files contain the expected resources and outputs.\n\nRun tests with:\n\n```bash\nyarn test\n```\n\n## Notes\n- This package assumes your repository is configured with GitHub Actions and that you have a GitHub OIDC role configured in AWS.\n- The generated scripts use the AWS SDK v3 for CloudFormation and, where applicable, the GitHub REST API.\n"
+    "markdown": "# cdk-diff-pr-github-action\n\nA library that provides GitHub workflows and IAM templates for:\n- Creating CloudFormation Change Sets for your CDK stacks on pull requests and commenting a formatted diff back on the PR.\n- Detecting CloudFormation drift on a schedule or manual trigger and producing a consolidated summary (optionally creating an issue).\n- Deploying IAM roles across AWS Organizations using StackSets.\n\nIt also provides ready‑to‑deploy IAM templates with the minimal permissions required for each workflow.\n\n**Works with or without Projen** — The StackSet generator can be used standalone in any Node.js project.\n\nThis package exposes five constructs:\n\n- `CdkDiffStackWorkflow` — Generates one GitHub Actions workflow per stack to create a change set and render the diff back to the PR and Step Summary.\n- `CdkDiffIamTemplate` — Emits a CloudFormation template file with minimal permissions for the Change Set workflow.\n- `CdkDriftDetectionWorkflow` — Generates a GitHub Actions workflow to detect CloudFormation drift per stack, upload machine‑readable results, and aggregate a summary.\n- `CdkDriftIamTemplate` — Emits a CloudFormation template file with minimal permissions for the Drift Detection workflow.\n- `CdkDiffIamTemplateStackSet` — Creates a CloudFormation StackSet template for org-wide deployment of GitHub OIDC and IAM roles (Projen integration).\n- `CdkDiffIamTemplateStackSetGenerator` — Pure generator class for StackSet templates (no Projen dependency).\n\n## Quick start\n\n1) Add the constructs to your Projen project (in `.projenrc.ts`).\n2) Synthesize with `npx projen`.\n3) Commit the generated files.\n4) Open a pull request or run the drift detection workflow.\n\n## Usage: CdkDiffStackWorkflow\n\n`CdkDiffStackWorkflow` renders a workflow per stack named `diff-<StackName>.yml` under `.github/workflows/`. It also generates a helper script at `.github/workflows/scripts/describe-cfn-changeset.ts` that formats the change set output and takes care of posting the PR comment and Step Summary.\n\nExample `.projenrc.ts`:\n\n```ts\nimport { awscdk } from 'projen';\nimport { CdkDiffStackWorkflow } from '@jjrawlins/cdk-diff-pr-github-action';\n\nconst project = new awscdk.AwsCdkConstructLibrary({\n  // ... your usual settings ...\n  workflowName: 'my-lib',\n  defaultReleaseBranch: 'main',\n  cdkVersion: '2.85.0',\n  github: true,\n});\n\nnew CdkDiffStackWorkflow({\n  project,\n  stacks: [\n    {\n      stackName: 'MyAppStack',\n      changesetRoleToAssumeArn: 'arn:aws:iam::123456789012:role/cdk-diff-role',\n      changesetRoleToAssumeRegion: 'us-east-1',\n      // Optional per‑stack OIDC override (if not using the defaults below)\n      // oidcRoleArn: 'arn:aws:iam::123456789012:role/github-oidc-role',\n      // oidcRegion: 'us-east-1',\n    },\n  ],\n  // Default OIDC role/region used by all stacks unless overridden per‑stack\n  oidcRoleArn: 'arn:aws:iam::123456789012:role/github-oidc-role',\n  oidcRegion: 'us-east-1',\n  // Optional: Node version used in the workflow (default: '24.x')\n  // nodeVersion: '24.x',\n  // Optional: Yarn command to run CDK (default: 'cdk')\n  // cdkYarnCommand: 'cdk',\n  // Optional: Where to place the helper script (default: '.github/workflows/scripts/describe-cfn-changeset.ts')\n  // scriptOutputPath: '.github/workflows/scripts/describe-cfn-changeset.ts',\n});\n\nproject.synth();\n```\n\n### CdkDiffStackWorkflow props\n- `project` (required) — Your Projen project instance.\n- `stacks` (required) — Array of stack entries.\n- `oidcRoleArn` (required unless provided per‑stack) — Default OIDC role ARN.\n- `oidcRegion` (required unless provided per‑stack) — Default OIDC region.\n- `nodeVersion` (optional, default `'24.x'`) — Node.js version for the workflow runner.\n- `cdkYarnCommand` (optional, default `'cdk'`) — Yarn script/command to invoke CDK.\n- `scriptOutputPath` (optional, default `'.github/workflows/scripts/describe-cfn-changeset.ts'`) — Where to write the helper script.\n\nIf neither top‑level OIDC defaults nor all per‑stack values are supplied, the construct throws a helpful error.\n\n### Stack item fields\n- `stackName` (required) — The CDK stack name to create the change set for.\n- `changesetRoleToAssumeArn` (required) — The ARN of the role used to create the change set (role chaining after OIDC).\n- `changesetRoleToAssumeRegion` (required) — The region for that role.\n- `oidcRoleArn` (optional) — Per‑stack override for the OIDC role.\n- `oidcRegion` (optional) — Per‑stack override for the OIDC region.\n\n### What gets generated\n- `.github/workflows/diff-<StackName>.yml` — One workflow per stack, triggered on PR open/sync/reopen.\n- `.github/workflows/scripts/describe-cfn-changeset.ts` — A helper script that:\n  - Polls `DescribeChangeSet` until terminal\n  - Filters out ignorable logical IDs or resource types using environment variables `IGNORE_LOGICAL_IDS` and `IGNORE_RESOURCE_TYPES`\n  - Renders an HTML table with actions, logical IDs, types, replacements, and changed properties\n  - Prints the HTML, appends to the GitHub Step Summary, and (if `GITHUB_TOKEN` and `GITHUB_COMMENT_URL` are present) posts a PR comment\n\n### Environment variables used by the change set script\n- `STACK_NAME` (required) — Stack name to describe.\n- `CHANGE_SET_NAME` (default: same as `STACK_NAME`).\n- `AWS_REGION` — Region for CloudFormation API calls. The workflow sets this via the credentials action(s).\n- `GITHUB_TOKEN` (optional) — If set with `GITHUB_COMMENT_URL`, posts a PR comment.\n- `GITHUB_COMMENT_URL` (optional) — PR comments URL.\n- `GITHUB_STEP_SUMMARY` (optional) — When present, appends the HTML to the step summary file.\n- `IGNORE_LOGICAL_IDS` (optional) — Comma‑separated logical IDs to ignore (default includes `CDKMetadata`).\n- `IGNORE_RESOURCE_TYPES` (optional) — Comma‑separated resource types to ignore (e.g., `AWS::CDK::Metadata`).\n\n## Usage: CdkDiffIamTemplate\n\nEmit an example IAM template you can deploy in your account for the Change Set workflow.\n\n### With Projen\n\n```ts\nimport { awscdk } from 'projen';\nimport { CdkDiffIamTemplate } from '@jjrawlins/cdk-diff-pr-github-action';\n\nconst project = new awscdk.AwsCdkConstructLibrary({\n  // ...\n});\n\nnew CdkDiffIamTemplate({\n  project,\n  roleName: 'cdk-diff-role',\n  oidcRoleArn: 'arn:aws:iam::123456789012:role/github-oidc-role',\n  oidcRegion: 'us-east-1',\n  // Optional: custom output path (default: 'cdk-diff-workflow-iam-template.yaml')\n  // outputPath: 'infra/cdk-diff-iam.yaml',\n});\n\nproject.synth();\n```\n\nA Projen task is also added:\n\n```bash\nnpx projen deploy-cdkdiff-iam-template -- --parameter-overrides GitHubOIDCRoleArn=... # plus any extra AWS CLI args\n```\n\n### Without Projen (Standalone Generator)\n\n```ts\nimport { CdkDiffIamTemplateGenerator } from '@jjrawlins/cdk-diff-pr-github-action';\nimport * as fs from 'fs';\n\nconst template = CdkDiffIamTemplateGenerator.generateTemplate({\n  roleName: 'cdk-diff-role',\n  oidcRoleArn: 'arn:aws:iam::123456789012:role/github-oidc-role',\n  oidcRegion: 'us-east-1',\n});\n\nfs.writeFileSync('cdk-diff-iam-template.yaml', template);\n\n// Get the deploy command\nconst deployCmd = CdkDiffIamTemplateGenerator.generateDeployCommand('cdk-diff-iam-template.yaml');\nconsole.log('Deploy with:', deployCmd);\n```\n\n### What the template defines\n\n- Parameter `GitHubOIDCRoleArn` with a default from `oidcRoleArn` — the ARN of your existing GitHub OIDC role allowed to assume the change set role.\n- IAM role `CdkChangesetRole` with minimal permissions for:\n  - CloudFormation Change Set operations\n  - Access to common CDK bootstrap S3 buckets and SSM parameters\n  - `iam:PassRole` to `cloudformation.amazonaws.com`\n- Outputs exporting the role name and ARN.\n\nUse the created role ARN as `changesetRoleToAssumeArn` in `CdkDiffStackWorkflow`.\n\n---\n\n## Usage: CdkDriftDetectionWorkflow\n\n`CdkDriftDetectionWorkflow` creates a single workflow file (default `drift-detection.yml`) that can run on a schedule and via manual dispatch. It generates a helper script at `.github/workflows/scripts/detect-drift.ts` (by default) that uses AWS SDK v3 to run drift detection, write optional machine‑readable JSON, and print an HTML report for the Step Summary.\n\nExample `.projenrc.ts`:\n\n```ts\nimport { awscdk } from 'projen';\nimport { CdkDriftDetectionWorkflow } from '@jjrawlins/cdk-diff-pr-github-action';\n\nconst project = new awscdk.AwsCdkConstructLibrary({ github: true, /* ... */ });\n\nnew CdkDriftDetectionWorkflow({\n  project,\n  workflowName: 'Drift Detection',            // optional; file name derived as 'drift-detection.yml'\n  schedule: '0 1 * * *',                      // optional cron\n  createIssues: true,                         // default true; create/update issue when drift detected on schedule\n  oidcRoleArn: 'arn:aws:iam::123456789012:role/github-oidc-role',\n  oidcRegion: 'us-east-1',\n  // Optional: Node version (default '24.x')\n  // nodeVersion: '24.x',\n  // Optional: Where to place the helper script (default '.github/workflows/scripts/detect-drift.ts')\n  // scriptOutputPath: '.github/workflows/scripts/detect-drift.ts',\n  stacks: [\n    {\n      stackName: 'MyAppStack-Prod',\n      driftDetectionRoleToAssumeArn: 'arn:aws:iam::123456789012:role/cdk-drift-role',\n      driftDetectionRoleToAssumeRegion: 'us-east-1',\n      // failOnDrift: true, // optional (default true)\n    },\n  ],\n});\n\nproject.synth();\n```\n\n### CdkDriftDetectionWorkflow props\n- `project` (required) — Your Projen project instance.\n- `stacks` (required) — Array of stacks to check.\n- `oidcRoleArn` (required) — Default OIDC role ARN used before chaining into per‑stack drift roles.\n- `oidcRegion` (required) — Default OIDC region.\n- `workflowName` (optional, default `'drift-detection'`) — Human‑friendly workflow name; the file name is derived in kebab‑case.\n- `schedule` (optional) — Cron expression for automatic runs.\n- `createIssues` (optional, default `true`) — When true, scheduled runs will create/update a GitHub issue if drift is detected.\n- `nodeVersion` (optional, default `'24.x'`) — Node.js version for the runner.\n- `scriptOutputPath` (optional, default `'.github/workflows/scripts/detect-drift.ts'`) — Where to write the helper script.\n\n### Per‑stack fields\n- `stackName` (required) — The full CloudFormation stack name.\n- `driftDetectionRoleToAssumeArn` (required) — Role to assume (after OIDC) for making drift API calls.\n- `driftDetectionRoleToAssumeRegion` (required) — Region for that role and API calls.\n- `failOnDrift` (optional, default `true`) — Intended to fail the detection step on drift. The provided script exits with non‑zero when drift is found; the job continues to allow artifact upload and issue creation.\n\n### What gets generated\n- `.github/workflows/<kebab(workflowName)>.yml` — A workflow with one job per stack plus a final summary job.\n- `.github/workflows/scripts/detect-drift.ts` — Helper script that:\n  - Starts drift detection and polls until completion\n  - Lists non‑`IN_SYNC` resources and builds an HTML report\n  - Writes optional JSON to `DRIFT_DETECTION_OUTPUT` when set\n  - Prints to stdout and appends to the GitHub Step Summary when available\n\n### Artifacts and summary\n- Each stack job uploads `drift-results-<stack>.json` (if produced).\n- A final `Drift Detection Summary` job downloads all artifacts and prints a consolidated summary.\n\n### Manual dispatch\n- The workflow exposes an input named `stack` with choices including each configured stack and an `all` option.\n- Choose a specific stack to run drift detection for that stack only, or select `all` (or leave the input empty) to run all stacks.\n\nNote: The default workflow does not post PR comments for drift. It can create/update an Issue on scheduled runs when `createIssues` is `true`.\n\n### Post-notification steps (e.g., Slack)\n\nYou can add your own GitHub Action steps to run after the drift detection step for each stack using `postGitHubSteps`.\nProvide your own Slack payload/markdown (this library no longer generates a payload step for you).\n\nOption A: slackapi/slack-github-action (Incoming Webhook, official syntax)\n\n```ts\nnew CdkDriftDetectionWorkflow({\n  project,\n  oidcRoleArn: 'arn:aws:iam::123456789012:role/github-oidc-role',\n  oidcRegion: 'us-east-1',\n  stacks: [/* ... */],\n  postGitHubSteps: ({ stack }) => {\n    // Build a descriptive name per stack\n    const name = `Notify Slack (${stack} post-drift)`;\n    const step = {\n      name,\n      uses: 'slackapi/slack-github-action@v2.1.1',\n      // by default, post steps run only when drift is detected; you can override `if`\n      if: \"always() && steps.drift.outcome == 'failure'\",\n      // Use official inputs: webhook + webhook-type, and a YAML payload with blocks\n      with: {\n        webhook: '${{ secrets.CDK_NOTIFICATIONS_SLACK_WEBHOOK }}',\n        'webhook-type': 'incoming-webhook',\n        payload: [\n          'text: \"** ${{ env.STACK_NAME }} ** has drifted!\"',\n          'blocks:',\n          '  - type: \"section\"',\n          '    text:',\n          '      type: \"mrkdwn\"',\n          '      text: \"*Stack:* ${{ env.STACK_NAME }} (region ${{ env.AWS_REGION }}) has drifted:exclamation:\"',\n          '  - type: \"section\"',\n          '    fields:',\n          '      - type: \"mrkdwn\"',\n          '        text: \"*Stack ARN*\\\\n${{ steps.drift.outputs.stack-arn }}\"',\n          '      - type: \"mrkdwn\"',\n          '        text: \"*Issue*\\\\n<${{ github.server_url }}/${{ github.repository }}/issues/${{ steps.issue.outputs.result }}|#${{ steps.issue.outputs.result }}>\"',\n        ].join('\\n'),\n      },\n    };\n    return [step];\n  },\n});\n```\n\nNote: The Issue link requires `createIssues: true` (default) so that the `Create Issue on Drift` step runs before this Slack step and exposes `steps.issue.outputs.result`. This library orders the steps accordingly.\n\nDetails:\n- `postGitHubSteps` can be:\n  - an array of step objects, or\n  - a factory function `({ stack }) => step | step[]`.\n- Each step you provide is inserted after the results are uploaded.\n- Default condition: if you do not set `if` on your step, it will default to `always() && steps.drift.outcome == 'failure'`.\n- Available context/env you can use:\n  - `${{ env.STACK_NAME }}`, `${{ env.DRIFT_DETECTION_OUTPUT }}`\n  - `${{ steps.drift.outcome }}` — success/failure of the detect step\n  - `${{ steps.drift.outputs.stack-arn }}` — Stack ARN resolved at runtime\n  - `${{ steps.issue.outputs.result }}` — Issue number if the workflow created/found one (empty when not applicable)\n```\n\n## Usage: CdkDriftIamTemplate\n\nEmit an example IAM template you can deploy in your account for the Drift Detection workflow.\n\n### With Projen\n\n```ts\nimport { awscdk } from 'projen';\nimport { CdkDriftIamTemplate } from '@jjrawlins/cdk-diff-pr-github-action';\n\nconst project = new awscdk.AwsCdkConstructLibrary({\n  // ...\n});\n\nnew CdkDriftIamTemplate({\n  project,\n  roleName: 'cdk-drift-role',\n  oidcRoleArn: 'arn:aws:iam::123456789012:role/github-oidc-role',\n  oidcRegion: 'us-east-1',\n  // Optional: custom output path (default: 'cdk-drift-workflow-iam-template.yaml')\n  // outputPath: 'infra/cdk-drift-iam.yaml',\n});\n\nproject.synth();\n```\n\nA Projen task is also added:\n\n```bash\nnpx projen deploy-cdkdrift-iam-template -- --parameter-overrides GitHubOIDCRoleArn=... # plus any extra AWS CLI args\n```\n\n### Without Projen (Standalone Generator)\n\n```ts\nimport { CdkDriftIamTemplateGenerator } from '@jjrawlins/cdk-diff-pr-github-action';\nimport * as fs from 'fs';\n\nconst template = CdkDriftIamTemplateGenerator.generateTemplate({\n  roleName: 'cdk-drift-role',\n  oidcRoleArn: 'arn:aws:iam::123456789012:role/github-oidc-role',\n  oidcRegion: 'us-east-1',\n});\n\nfs.writeFileSync('cdk-drift-iam-template.yaml', template);\n\n// Get the deploy command\nconst deployCmd = CdkDriftIamTemplateGenerator.generateDeployCommand('cdk-drift-iam-template.yaml');\nconsole.log('Deploy with:', deployCmd);\n```\n\n### What the template defines\n\n- Parameter `GitHubOIDCRoleArn` with a default from `oidcRoleArn` — the ARN of your existing GitHub OIDC role allowed to assume this drift role.\n- IAM role `CdkDriftRole` with minimal permissions for CloudFormation drift detection operations.\n- Outputs exporting the role name and ARN.\n\n---\n\n## Usage: CdkDiffIamTemplateStackSet (Org-Wide Deployment)\n\n`CdkDiffIamTemplateStackSet` creates a CloudFormation StackSet template for deploying GitHub OIDC provider, OIDC role, and CDK diff/drift IAM roles across an entire AWS Organization. This is the recommended approach for organizations that want to enable CDK diff/drift workflows across multiple accounts.\n\n### Architecture\n\nEach account in your organization gets:\n- **GitHub OIDC Provider** — Authenticates GitHub Actions workflows\n- **GitHubOIDCRole** — Trusts the OIDC provider with repo/branch restrictions\n- **CdkChangesetRole** — For PR change set previews (trusts GitHubOIDCRole)\n- **CdkDriftRole** — For drift detection (trusts GitHubOIDCRole)\n\nThis is a self-contained deployment with **no role chaining required**.\n\n### With Projen\n\n```ts\nimport { awscdk } from 'projen';\nimport { CdkDiffIamTemplateStackSet } from '@jjrawlins/cdk-diff-pr-github-action';\n\nconst project = new awscdk.AwsCdkConstructLibrary({ /* ... */ });\n\nnew CdkDiffIamTemplateStackSet({\n  project,\n  githubOidc: {\n    owner: 'my-org',                          // GitHub org or username\n    repositories: ['infra-repo', 'app-repo'], // Repos allowed to assume roles\n    branches: ['main', 'release/*'],          // Branch patterns (default: ['*'])\n  },\n  targetOrganizationalUnitIds: ['ou-xxxx-xxxxxxxx'], // Target OUs\n  regions: ['us-east-1', 'eu-west-1'],               // Target regions\n  // Optional settings:\n  // oidcRoleName: 'GitHubOIDCRole',       // default\n  // changesetRoleName: 'CdkChangesetRole', // default\n  // driftRoleName: 'CdkDriftRole',         // default\n  // roleSelection: StackSetRoleSelection.BOTH, // BOTH, CHANGESET_ONLY, or DRIFT_ONLY\n  // delegatedAdmin: true,                  // Use --call-as DELEGATED_ADMIN (default: true)\n});\n\nproject.synth();\n```\n\nThis creates:\n- `cdk-diff-workflow-stackset-template.yaml` — CloudFormation template\n- Projen tasks for StackSet management\n\n**Projen tasks:**\n```bash\nnpx projen stackset-create          # Create the StackSet\nnpx projen stackset-update          # Update the StackSet template\nnpx projen stackset-deploy-instances # Deploy to target OUs/regions\nnpx projen stackset-delete-instances # Remove stack instances\nnpx projen stackset-delete          # Delete the StackSet\nnpx projen stackset-describe        # Show StackSet status\nnpx projen stackset-list-instances  # List all instances\n```\n\n### Without Projen (Standalone Generator)\n\nFor non-Projen projects, use `CdkDiffIamTemplateStackSetGenerator` directly:\n\n```ts\nimport {\n  CdkDiffIamTemplateStackSetGenerator\n} from '@jjrawlins/cdk-diff-pr-github-action';\nimport * as fs from 'fs';\n\n// Generate the CloudFormation template\nconst template = CdkDiffIamTemplateStackSetGenerator.generateTemplate({\n  githubOidc: {\n    owner: 'my-org',\n    repositories: ['infra-repo'],\n    branches: ['main'],\n  },\n});\n\n// Write to file\nfs.writeFileSync('stackset-template.yaml', template);\n\n// Get AWS CLI commands for StackSet operations\nconst commands = CdkDiffIamTemplateStackSetGenerator.generateCommands({\n  stackSetName: 'cdk-diff-workflow-iam-stackset',\n  templatePath: 'stackset-template.yaml',\n  targetOrganizationalUnitIds: ['ou-xxxx-xxxxxxxx'],\n  regions: ['us-east-1'],\n});\n\nconsole.log('Create StackSet:', commands['stackset-create']);\nconsole.log('Deploy instances:', commands['stackset-deploy-instances']);\n```\n\n### GitHub Actions Workflow (Simplified)\n\nWith per-account OIDC, your workflow is simplified — no role chaining needed:\n\n```yaml\njobs:\n  diff:\n    runs-on: ubuntu-latest\n    permissions:\n      id-token: write\n      contents: read\n    steps:\n      - uses: actions/checkout@v4\n\n      - uses: aws-actions/configure-aws-credentials@v4\n        with:\n          role-to-assume: arn:aws:iam::${{ env.ACCOUNT_ID }}:role/GitHubOIDCRole\n          aws-region: us-east-1\n\n      - name: Assume Changeset Role\n        run: |\n          CREDS=$(aws sts assume-role \\\n            --role-arn arn:aws:iam::${{ env.ACCOUNT_ID }}:role/CdkChangesetRole \\\n            --role-session-name changeset-session)\n          # Export credentials...\n```\n\n### GitHubOidcConfig options\n\n| Property | Description |\n|----------|-------------|\n| `owner` | GitHub organization or username (required) |\n| `repositories` | Array of repo names, or `['*']` for all repos (required) |\n| `branches` | Array of branch patterns (default: `['*']`) |\n| `additionalClaims` | Extra OIDC claims like `['pull_request', 'environment:production']` |\n\n---\n\n## Testing\n\nThis repository includes Jest tests that snapshot the synthesized outputs from Projen and assert that:\n- Diff workflows are created per stack and contain all expected steps.\n- Drift detection workflow produces one job per stack and a summary job.\n- Only one helper script file is generated per workflow type.\n- Per‑stack OIDC overrides (where supported) are respected.\n- Helpful validation errors are thrown for missing OIDC settings.\n- The IAM template files contain the expected resources and outputs.\n\nRun tests with:\n\n```bash\nyarn test\n```\n\n## Notes\n- This package assumes your repository is configured with GitHub Actions and that you have a GitHub OIDC role configured in AWS.\n- The generated scripts use the AWS SDK v3 for CloudFormation and, where applicable, the GitHub REST API.\n"
   },
   "repository": {
     "type": "git",
@@ -3565,7 +3565,9 @@
     "@jjrawlins/cdk-diff-pr-github-action.CdkDiffIamTemplate": {
       "assembly": "@jjrawlins/cdk-diff-pr-github-action",
       "docs": {
-        "stability": "experimental"
+        "remarks": "For non-Projen projects, use `CdkDiffIamTemplateGenerator` directly.",
+        "stability": "experimental",
+        "summary": "Projen construct that emits a CloudFormation template with minimal IAM permissions for the CDK Diff Stack Workflow."
       },
       "fqn": "@jjrawlins/cdk-diff-pr-github-action.CdkDiffIamTemplate",
       "initializer": {
@@ -3574,7 +3576,7 @@
         },
         "locationInModule": {
           "filename": "src/CdkDiffIamTemplate.ts",
-          "line": 12
+          "line": 132
         },
         "parameters": [
           {
@@ -3588,51 +3590,668 @@
       "kind": "class",
       "locationInModule": {
         "filename": "src/CdkDiffIamTemplate.ts",
-        "line": 11
+        "line": 131
       },
       "name": "CdkDiffIamTemplate",
       "symbolId": "src/CdkDiffIamTemplate:CdkDiffIamTemplate"
     },
+    "@jjrawlins/cdk-diff-pr-github-action.CdkDiffIamTemplateGenerator": {
+      "assembly": "@jjrawlins/cdk-diff-pr-github-action",
+      "docs": {
+        "remarks": "No Projen dependency - can be used in any project.",
+        "stability": "experimental",
+        "summary": "Pure generator class for CDK Diff IAM templates."
+      },
+      "fqn": "@jjrawlins/cdk-diff-pr-github-action.CdkDiffIamTemplateGenerator",
+      "initializer": {
+        "docs": {
+          "stability": "experimental"
+        }
+      },
+      "kind": "class",
+      "locationInModule": {
+        "filename": "src/CdkDiffIamTemplate.ts",
+        "line": 19
+      },
+      "methods": [
+        {
+          "docs": {
+            "stability": "experimental",
+            "summary": "Generate the AWS CLI deploy command for the IAM template."
+          },
+          "locationInModule": {
+            "filename": "src/CdkDiffIamTemplate.ts",
+            "line": 110
+          },
+          "name": "generateDeployCommand",
+          "parameters": [
+            {
+              "name": "templatePath",
+              "optional": true,
+              "type": {
+                "primitive": "string"
+              }
+            }
+          ],
+          "returns": {
+            "type": {
+              "primitive": "string"
+            }
+          },
+          "static": true
+        },
+        {
+          "docs": {
+            "stability": "experimental",
+            "summary": "Generate the CloudFormation IAM template as a YAML string."
+          },
+          "locationInModule": {
+            "filename": "src/CdkDiffIamTemplate.ts",
+            "line": 23
+          },
+          "name": "generateTemplate",
+          "parameters": [
+            {
+              "name": "props",
+              "type": {
+                "fqn": "@jjrawlins/cdk-diff-pr-github-action.CdkDiffIamTemplateGeneratorProps"
+              }
+            }
+          ],
+          "returns": {
+            "type": {
+              "primitive": "string"
+            }
+          },
+          "static": true
+        }
+      ],
+      "name": "CdkDiffIamTemplateGenerator",
+      "symbolId": "src/CdkDiffIamTemplate:CdkDiffIamTemplateGenerator"
+    },
+    "@jjrawlins/cdk-diff-pr-github-action.CdkDiffIamTemplateGeneratorProps": {
+      "assembly": "@jjrawlins/cdk-diff-pr-github-action",
+      "datatype": true,
+      "docs": {
+        "stability": "experimental",
+        "summary": "Props for generating CDK Diff IAM templates (no Projen dependency)."
+      },
+      "fqn": "@jjrawlins/cdk-diff-pr-github-action.CdkDiffIamTemplateGeneratorProps",
+      "kind": "interface",
+      "locationInModule": {
+        "filename": "src/CdkDiffIamTemplate.ts",
+        "line": 6
+      },
+      "name": "CdkDiffIamTemplateGeneratorProps",
+      "properties": [
+        {
+          "abstract": true,
+          "docs": {
+            "stability": "experimental",
+            "summary": "Region for the OIDC trust condition."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/CdkDiffIamTemplate.ts",
+            "line": 12
+          },
+          "name": "oidcRegion",
+          "type": {
+            "primitive": "string"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "stability": "experimental",
+            "summary": "ARN of the existing GitHub OIDC role that can assume this changeset role."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/CdkDiffIamTemplate.ts",
+            "line": 10
+          },
+          "name": "oidcRoleArn",
+          "type": {
+            "primitive": "string"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "stability": "experimental",
+            "summary": "Name for the IAM role."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/CdkDiffIamTemplate.ts",
+            "line": 8
+          },
+          "name": "roleName",
+          "type": {
+            "primitive": "string"
+          }
+        }
+      ],
+      "symbolId": "src/CdkDiffIamTemplate:CdkDiffIamTemplateGeneratorProps"
+    },
     "@jjrawlins/cdk-diff-pr-github-action.CdkDiffIamTemplateProps": {
       "assembly": "@jjrawlins/cdk-diff-pr-github-action",
       "datatype": true,
       "docs": {
-        "stability": "experimental"
+        "stability": "experimental",
+        "summary": "Props for the Projen-integrated CDK Diff IAM template construct."
       },
       "fqn": "@jjrawlins/cdk-diff-pr-github-action.CdkDiffIamTemplateProps",
+      "interfaces": [
+        "@jjrawlins/cdk-diff-pr-github-action.CdkDiffIamTemplateGeneratorProps"
+      ],
       "kind": "interface",
       "locationInModule": {
         "filename": "src/CdkDiffIamTemplate.ts",
-        "line": 3
+        "line": 118
       },
       "name": "CdkDiffIamTemplateProps",
       "properties": [
         {
           "abstract": true,
           "docs": {
-            "stability": "experimental"
+            "stability": "experimental",
+            "summary": "Projen project instance."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/CdkDiffIamTemplate.ts",
+            "line": 120
+          },
+          "name": "project",
+          "type": {
+            "primitive": "any"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "stability": "experimental",
+            "summary": "Output path for the template file (default: 'cdk-diff-workflow-iam-template.yaml')."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/CdkDiffIamTemplate.ts",
+            "line": 122
+          },
+          "name": "outputPath",
+          "optional": true,
+          "type": {
+            "primitive": "string"
+          }
+        }
+      ],
+      "symbolId": "src/CdkDiffIamTemplate:CdkDiffIamTemplateProps"
+    },
+    "@jjrawlins/cdk-diff-pr-github-action.CdkDiffIamTemplateStackSet": {
+      "assembly": "@jjrawlins/cdk-diff-pr-github-action",
+      "docs": {
+        "remarks": "This provides a self-contained per-account deployment with no role chaining required.\n\nFor non-Projen projects, use `CdkDiffIamTemplateStackSetGenerator` directly.",
+        "stability": "experimental",
+        "summary": "Projen construct that creates a CloudFormation StackSet template for org-wide deployment of GitHub OIDC provider, OIDC role, and CDK Diff/Drift IAM roles."
+      },
+      "fqn": "@jjrawlins/cdk-diff-pr-github-action.CdkDiffIamTemplateStackSet",
+      "initializer": {
+        "docs": {
+          "stability": "experimental"
+        },
+        "locationInModule": {
+          "filename": "src/CdkDiffIamTemplateStackSet.ts",
+          "line": 526
+        },
+        "parameters": [
+          {
+            "name": "props",
+            "type": {
+              "fqn": "@jjrawlins/cdk-diff-pr-github-action.CdkDiffIamTemplateStackSetProps"
+            }
+          }
+        ]
+      },
+      "kind": "class",
+      "locationInModule": {
+        "filename": "src/CdkDiffIamTemplateStackSet.ts",
+        "line": 525
+      },
+      "name": "CdkDiffIamTemplateStackSet",
+      "symbolId": "src/CdkDiffIamTemplateStackSet:CdkDiffIamTemplateStackSet"
+    },
+    "@jjrawlins/cdk-diff-pr-github-action.CdkDiffIamTemplateStackSetCommandsProps": {
+      "assembly": "@jjrawlins/cdk-diff-pr-github-action",
+      "datatype": true,
+      "docs": {
+        "stability": "experimental",
+        "summary": "Props for generating StackSet CLI commands (no Projen dependency)."
+      },
+      "fqn": "@jjrawlins/cdk-diff-pr-github-action.CdkDiffIamTemplateStackSetCommandsProps",
+      "kind": "interface",
+      "locationInModule": {
+        "filename": "src/CdkDiffIamTemplateStackSet.ts",
+        "line": 87
+      },
+      "name": "CdkDiffIamTemplateStackSetCommandsProps",
+      "properties": [
+        {
+          "abstract": true,
+          "docs": {
+            "stability": "experimental",
+            "summary": "Auto-deployment configuration."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/CdkDiffIamTemplateStackSet.ts",
+            "line": 101
+          },
+          "name": "autoDeployment",
+          "optional": true,
+          "type": {
+            "fqn": "@jjrawlins/cdk-diff-pr-github-action.StackSetAutoDeployment"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "remarks": "If true, adds --call-as DELEGATED_ADMIN to commands.\nDefault: true",
+            "stability": "experimental",
+            "summary": "Whether to use delegated admin mode for StackSet operations."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/CdkDiffIamTemplateStackSet.ts",
+            "line": 108
+          },
+          "name": "delegatedAdmin",
+          "optional": true,
+          "type": {
+            "primitive": "boolean"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "stability": "experimental",
+            "summary": "Target regions for deployment (e.g., ['us-east-1', 'eu-west-1'])."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/CdkDiffIamTemplateStackSet.ts",
+            "line": 98
+          },
+          "name": "regions",
+          "optional": true,
+          "type": {
+            "collection": {
+              "elementtype": {
+                "primitive": "string"
+              },
+              "kind": "array"
+            }
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "stability": "experimental",
+            "summary": "Name of the StackSet (default: 'cdk-diff-workflow-iam-stackset')."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/CdkDiffIamTemplateStackSet.ts",
+            "line": 89
+          },
+          "name": "stackSetName",
+          "optional": true,
+          "type": {
+            "primitive": "string"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "stability": "experimental",
+            "summary": "Target OUs for deployment (e.g., ['ou-xxxx-xxxxxxxx', 'r-xxxx'])."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/CdkDiffIamTemplateStackSet.ts",
+            "line": 95
+          },
+          "name": "targetOrganizationalUnitIds",
+          "optional": true,
+          "type": {
+            "collection": {
+              "elementtype": {
+                "primitive": "string"
+              },
+              "kind": "array"
+            }
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "stability": "experimental",
+            "summary": "Path to the template file (default: 'cdk-diff-workflow-stackset-template.yaml')."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/CdkDiffIamTemplateStackSet.ts",
+            "line": 92
+          },
+          "name": "templatePath",
+          "optional": true,
+          "type": {
+            "primitive": "string"
+          }
+        }
+      ],
+      "symbolId": "src/CdkDiffIamTemplateStackSet:CdkDiffIamTemplateStackSetCommandsProps"
+    },
+    "@jjrawlins/cdk-diff-pr-github-action.CdkDiffIamTemplateStackSetGenerator": {
+      "assembly": "@jjrawlins/cdk-diff-pr-github-action",
+      "docs": {
+        "remarks": "No Projen dependency - can be used in any project.",
+        "stability": "experimental",
+        "summary": "Pure generator class for StackSet templates and commands."
+      },
+      "fqn": "@jjrawlins/cdk-diff-pr-github-action.CdkDiffIamTemplateStackSetGenerator",
+      "initializer": {
+        "docs": {
+          "stability": "experimental"
+        }
+      },
+      "kind": "class",
+      "locationInModule": {
+        "filename": "src/CdkDiffIamTemplateStackSet.ts",
+        "line": 115
+      },
+      "methods": [
+        {
+          "docs": {
+            "remarks": "Returns a map of command names to shell commands.",
+            "stability": "experimental",
+            "summary": "Generate AWS CLI commands for StackSet operations."
+          },
+          "locationInModule": {
+            "filename": "src/CdkDiffIamTemplateStackSet.ts",
+            "line": 143
+          },
+          "name": "generateCommands",
+          "parameters": [
+            {
+              "name": "props",
+              "optional": true,
+              "type": {
+                "fqn": "@jjrawlins/cdk-diff-pr-github-action.CdkDiffIamTemplateStackSetCommandsProps"
+              }
+            }
+          ],
+          "returns": {
+            "type": {
+              "collection": {
+                "elementtype": {
+                  "primitive": "string"
+                },
+                "kind": "map"
+              }
+            }
+          },
+          "static": true
+        },
+        {
+          "docs": {
+            "stability": "experimental",
+            "summary": "Generate the CloudFormation StackSet template as a YAML string."
+          },
+          "locationInModule": {
+            "filename": "src/CdkDiffIamTemplateStackSet.ts",
+            "line": 119
+          },
+          "name": "generateTemplate",
+          "parameters": [
+            {
+              "name": "props",
+              "type": {
+                "fqn": "@jjrawlins/cdk-diff-pr-github-action.CdkDiffIamTemplateStackSetGeneratorProps"
+              }
+            }
+          ],
+          "returns": {
+            "type": {
+              "primitive": "string"
+            }
+          },
+          "static": true
+        }
+      ],
+      "name": "CdkDiffIamTemplateStackSetGenerator",
+      "symbolId": "src/CdkDiffIamTemplateStackSet:CdkDiffIamTemplateStackSetGenerator"
+    },
+    "@jjrawlins/cdk-diff-pr-github-action.CdkDiffIamTemplateStackSetGeneratorProps": {
+      "assembly": "@jjrawlins/cdk-diff-pr-github-action",
+      "datatype": true,
+      "docs": {
+        "stability": "experimental",
+        "summary": "Props for generating StackSet templates (no Projen dependency)."
+      },
+      "fqn": "@jjrawlins/cdk-diff-pr-github-action.CdkDiffIamTemplateStackSetGeneratorProps",
+      "kind": "interface",
+      "locationInModule": {
+        "filename": "src/CdkDiffIamTemplateStackSet.ts",
+        "line": 56
+      },
+      "name": "CdkDiffIamTemplateStackSetGeneratorProps",
+      "properties": [
+        {
+          "abstract": true,
+          "docs": {
+            "stability": "experimental",
+            "summary": "GitHub OIDC configuration for repo/branch restrictions."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/CdkDiffIamTemplateStackSet.ts",
+            "line": 58
+          },
+          "name": "githubOidc",
+          "type": {
+            "fqn": "@jjrawlins/cdk-diff-pr-github-action.GitHubOidcConfig"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "stability": "experimental",
+            "summary": "Name of the CdkChangesetRole (default: 'CdkChangesetRole')."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/CdkDiffIamTemplateStackSet.ts",
+            "line": 64
+          },
+          "name": "changesetRoleName",
+          "optional": true,
+          "type": {
+            "primitive": "string"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "stability": "experimental",
+            "summary": "Description for the StackSet."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/CdkDiffIamTemplateStackSet.ts",
+            "line": 73
+          },
+          "name": "description",
+          "optional": true,
+          "type": {
+            "primitive": "string"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "stability": "experimental",
+            "summary": "Name of the CdkDriftRole (default: 'CdkDriftRole')."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/CdkDiffIamTemplateStackSet.ts",
+            "line": 67
+          },
+          "name": "driftRoleName",
+          "optional": true,
+          "type": {
+            "primitive": "string"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "stability": "experimental",
+            "summary": "Name of the GitHub OIDC role (default: 'GitHubOIDCRole')."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/CdkDiffIamTemplateStackSet.ts",
+            "line": 61
+          },
+          "name": "oidcRoleName",
+          "optional": true,
+          "type": {
+            "primitive": "string"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "stability": "experimental",
+            "summary": "Which roles to include (default: BOTH)."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/CdkDiffIamTemplateStackSet.ts",
+            "line": 70
+          },
+          "name": "roleSelection",
+          "optional": true,
+          "type": {
+            "fqn": "@jjrawlins/cdk-diff-pr-github-action.StackSetRoleSelection"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "remarks": "Set to true if accounts already have a GitHub OIDC provider.\nThe template will reference the existing provider by ARN.\nDefault: false",
+            "stability": "experimental",
+            "summary": "Skip creating the OIDC provider (use existing one)."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/CdkDiffIamTemplateStackSet.ts",
+            "line": 81
+          },
+          "name": "skipOidcProviderCreation",
+          "optional": true,
+          "type": {
+            "primitive": "boolean"
+          }
+        }
+      ],
+      "symbolId": "src/CdkDiffIamTemplateStackSet:CdkDiffIamTemplateStackSetGeneratorProps"
+    },
+    "@jjrawlins/cdk-diff-pr-github-action.CdkDiffIamTemplateStackSetProps": {
+      "assembly": "@jjrawlins/cdk-diff-pr-github-action",
+      "datatype": true,
+      "docs": {
+        "stability": "experimental",
+        "summary": "Props for the Projen-integrated StackSet construct."
+      },
+      "fqn": "@jjrawlins/cdk-diff-pr-github-action.CdkDiffIamTemplateStackSetProps",
+      "interfaces": [
+        "@jjrawlins/cdk-diff-pr-github-action.CdkDiffIamTemplateStackSetGeneratorProps"
+      ],
+      "kind": "interface",
+      "locationInModule": {
+        "filename": "src/CdkDiffIamTemplateStackSet.ts",
+        "line": 489
+      },
+      "name": "CdkDiffIamTemplateStackSetProps",
+      "properties": [
+        {
+          "abstract": true,
+          "docs": {
+            "stability": "experimental",
+            "summary": "Projen project instance."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/CdkDiffIamTemplateStackSet.ts",
+            "line": 491
+          },
+          "name": "project",
+          "type": {
+            "primitive": "any"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "stability": "experimental",
+            "summary": "Auto-deployment configuration."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/CdkDiffIamTemplateStackSet.ts",
+            "line": 506
+          },
+          "name": "autoDeployment",
+          "optional": true,
+          "type": {
+            "fqn": "@jjrawlins/cdk-diff-pr-github-action.StackSetAutoDeployment"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "remarks": "If true, adds --call-as DELEGATED_ADMIN to commands.\nIf false, assumes running from the management account.\nDefault: true",
+            "stability": "experimental",
+            "summary": "Whether to use delegated admin mode for StackSet operations."
           },
           "immutable": true,
           "locationInModule": {
-            "filename": "src/CdkDiffIamTemplate.ts",
-            "line": 8
+            "filename": "src/CdkDiffIamTemplateStackSet.ts",
+            "line": 514
           },
-          "name": "oidcRegion",
+          "name": "delegatedAdmin",
+          "optional": true,
           "type": {
-            "primitive": "string"
+            "primitive": "boolean"
           }
         },
         {
           "abstract": true,
           "docs": {
-            "stability": "experimental"
+            "stability": "experimental",
+            "summary": "Output path for the template file (default: 'cdk-diff-workflow-stackset-template.yaml')."
           },
           "immutable": true,
           "locationInModule": {
-            "filename": "src/CdkDiffIamTemplate.ts",
-            "line": 7
+            "filename": "src/CdkDiffIamTemplateStackSet.ts",
+            "line": 497
           },
-          "name": "oidcRoleArn",
+          "name": "outputPath",
+          "optional": true,
           "type": {
             "primitive": "string"
           }
@@ -3640,29 +4259,38 @@
         {
           "abstract": true,
           "docs": {
-            "stability": "experimental"
+            "stability": "experimental",
+            "summary": "Target regions for deployment (e.g., ['us-east-1', 'eu-west-1'])."
           },
           "immutable": true,
           "locationInModule": {
-            "filename": "src/CdkDiffIamTemplate.ts",
-            "line": 4
+            "filename": "src/CdkDiffIamTemplateStackSet.ts",
+            "line": 503
           },
-          "name": "project",
+          "name": "regions",
+          "optional": true,
           "type": {
-            "primitive": "any"
+            "collection": {
+              "elementtype": {
+                "primitive": "string"
+              },
+              "kind": "array"
+            }
           }
         },
         {
           "abstract": true,
           "docs": {
-            "stability": "experimental"
+            "stability": "experimental",
+            "summary": "Name of the StackSet (default: 'cdk-diff-workflow-iam-stackset')."
           },
           "immutable": true,
           "locationInModule": {
-            "filename": "src/CdkDiffIamTemplate.ts",
-            "line": 5
+            "filename": "src/CdkDiffIamTemplateStackSet.ts",
+            "line": 494
           },
-          "name": "roleName",
+          "name": "stackSetName",
+          "optional": true,
           "type": {
             "primitive": "string"
           }
@@ -3670,21 +4298,27 @@
         {
           "abstract": true,
           "docs": {
-            "stability": "experimental"
+            "stability": "experimental",
+            "summary": "Target OUs for deployment (e.g., ['ou-xxxx-xxxxxxxx', 'r-xxxx'])."
           },
           "immutable": true,
           "locationInModule": {
-            "filename": "src/CdkDiffIamTemplate.ts",
-            "line": 6
+            "filename": "src/CdkDiffIamTemplateStackSet.ts",
+            "line": 500
           },
-          "name": "outputPath",
+          "name": "targetOrganizationalUnitIds",
           "optional": true,
           "type": {
-            "primitive": "string"
+            "collection": {
+              "elementtype": {
+                "primitive": "string"
+              },
+              "kind": "array"
+            }
           }
         }
       ],
-      "symbolId": "src/CdkDiffIamTemplate:CdkDiffIamTemplateProps"
+      "symbolId": "src/CdkDiffIamTemplateStackSet:CdkDiffIamTemplateStackSetProps"
     },
     "@jjrawlins/cdk-diff-pr-github-action.CdkDiffStack": {
       "assembly": "@jjrawlins/cdk-diff-pr-github-action",
@@ -4155,7 +4789,9 @@
     "@jjrawlins/cdk-diff-pr-github-action.CdkDriftIamTemplate": {
       "assembly": "@jjrawlins/cdk-diff-pr-github-action",
       "docs": {
-        "stability": "experimental"
+        "remarks": "For non-Projen projects, use `CdkDriftIamTemplateGenerator` directly.",
+        "stability": "experimental",
+        "summary": "Projen construct that emits a CloudFormation template with minimal IAM permissions for the CDK Drift Detection Workflow."
       },
       "fqn": "@jjrawlins/cdk-diff-pr-github-action.CdkDriftIamTemplate",
       "initializer": {
@@ -4164,7 +4800,7 @@
         },
         "locationInModule": {
           "filename": "src/CdkDriftIamTemplate.ts",
-          "line": 12
+          "line": 108
         },
         "parameters": [
           {
@@ -4178,34 +4814,110 @@
       "kind": "class",
       "locationInModule": {
         "filename": "src/CdkDriftIamTemplate.ts",
-        "line": 11
+        "line": 107
       },
       "name": "CdkDriftIamTemplate",
       "symbolId": "src/CdkDriftIamTemplate:CdkDriftIamTemplate"
     },
-    "@jjrawlins/cdk-diff-pr-github-action.CdkDriftIamTemplateProps": {
+    "@jjrawlins/cdk-diff-pr-github-action.CdkDriftIamTemplateGenerator": {
+      "assembly": "@jjrawlins/cdk-diff-pr-github-action",
+      "docs": {
+        "remarks": "No Projen dependency - can be used in any project.",
+        "stability": "experimental",
+        "summary": "Pure generator class for CDK Drift IAM templates."
+      },
+      "fqn": "@jjrawlins/cdk-diff-pr-github-action.CdkDriftIamTemplateGenerator",
+      "initializer": {
+        "docs": {
+          "stability": "experimental"
+        }
+      },
+      "kind": "class",
+      "locationInModule": {
+        "filename": "src/CdkDriftIamTemplate.ts",
+        "line": 19
+      },
+      "methods": [
+        {
+          "docs": {
+            "stability": "experimental",
+            "summary": "Generate the AWS CLI deploy command for the IAM template."
+          },
+          "locationInModule": {
+            "filename": "src/CdkDriftIamTemplate.ts",
+            "line": 86
+          },
+          "name": "generateDeployCommand",
+          "parameters": [
+            {
+              "name": "templatePath",
+              "optional": true,
+              "type": {
+                "primitive": "string"
+              }
+            }
+          ],
+          "returns": {
+            "type": {
+              "primitive": "string"
+            }
+          },
+          "static": true
+        },
+        {
+          "docs": {
+            "stability": "experimental",
+            "summary": "Generate the CloudFormation IAM template as a YAML string."
+          },
+          "locationInModule": {
+            "filename": "src/CdkDriftIamTemplate.ts",
+            "line": 23
+          },
+          "name": "generateTemplate",
+          "parameters": [
+            {
+              "name": "props",
+              "type": {
+                "fqn": "@jjrawlins/cdk-diff-pr-github-action.CdkDriftIamTemplateGeneratorProps"
+              }
+            }
+          ],
+          "returns": {
+            "type": {
+              "primitive": "string"
+            }
+          },
+          "static": true
+        }
+      ],
+      "name": "CdkDriftIamTemplateGenerator",
+      "symbolId": "src/CdkDriftIamTemplate:CdkDriftIamTemplateGenerator"
+    },
+    "@jjrawlins/cdk-diff-pr-github-action.CdkDriftIamTemplateGeneratorProps": {
       "assembly": "@jjrawlins/cdk-diff-pr-github-action",
       "datatype": true,
       "docs": {
-        "stability": "experimental"
+        "stability": "experimental",
+        "summary": "Props for generating CDK Drift IAM templates (no Projen dependency)."
       },
-      "fqn": "@jjrawlins/cdk-diff-pr-github-action.CdkDriftIamTemplateProps",
+      "fqn": "@jjrawlins/cdk-diff-pr-github-action.CdkDriftIamTemplateGeneratorProps",
       "kind": "interface",
       "locationInModule": {
         "filename": "src/CdkDriftIamTemplate.ts",
-        "line": 3
+        "line": 6
       },
-      "name": "CdkDriftIamTemplateProps",
+      "name": "CdkDriftIamTemplateGeneratorProps",
       "properties": [
         {
           "abstract": true,
           "docs": {
-            "stability": "experimental"
+            "stability": "experimental",
+            "summary": "Region for the OIDC trust condition."
           },
           "immutable": true,
           "locationInModule": {
             "filename": "src/CdkDriftIamTemplate.ts",
-            "line": 8
+            "line": 12
           },
           "name": "oidcRegion",
           "type": {
@@ -4215,12 +4927,13 @@
         {
           "abstract": true,
           "docs": {
-            "stability": "experimental"
+            "stability": "experimental",
+            "summary": "ARN of the existing GitHub OIDC role that can assume this drift role."
           },
           "immutable": true,
           "locationInModule": {
             "filename": "src/CdkDriftIamTemplate.ts",
-            "line": 7
+            "line": 10
           },
           "name": "oidcRoleArn",
           "type": {
@@ -4230,42 +4943,66 @@
         {
           "abstract": true,
           "docs": {
-            "stability": "experimental"
+            "stability": "experimental",
+            "summary": "Name for the IAM role."
           },
           "immutable": true,
           "locationInModule": {
             "filename": "src/CdkDriftIamTemplate.ts",
-            "line": 4
+            "line": 8
           },
-          "name": "project",
+          "name": "roleName",
           "type": {
-            "primitive": "any"
+            "primitive": "string"
           }
-        },
+        }
+      ],
+      "symbolId": "src/CdkDriftIamTemplate:CdkDriftIamTemplateGeneratorProps"
+    },
+    "@jjrawlins/cdk-diff-pr-github-action.CdkDriftIamTemplateProps": {
+      "assembly": "@jjrawlins/cdk-diff-pr-github-action",
+      "datatype": true,
+      "docs": {
+        "stability": "experimental",
+        "summary": "Props for the Projen-integrated CDK Drift IAM template construct."
+      },
+      "fqn": "@jjrawlins/cdk-diff-pr-github-action.CdkDriftIamTemplateProps",
+      "interfaces": [
+        "@jjrawlins/cdk-diff-pr-github-action.CdkDriftIamTemplateGeneratorProps"
+      ],
+      "kind": "interface",
+      "locationInModule": {
+        "filename": "src/CdkDriftIamTemplate.ts",
+        "line": 94
+      },
+      "name": "CdkDriftIamTemplateProps",
+      "properties": [
         {
           "abstract": true,
           "docs": {
-            "stability": "experimental"
+            "stability": "experimental",
+            "summary": "Projen project instance."
           },
           "immutable": true,
           "locationInModule": {
             "filename": "src/CdkDriftIamTemplate.ts",
-            "line": 5
+            "line": 96
           },
-          "name": "roleName",
+          "name": "project",
           "type": {
-            "primitive": "string"
+            "primitive": "any"
           }
         },
         {
           "abstract": true,
           "docs": {
-            "stability": "experimental"
+            "stability": "experimental",
+            "summary": "Output path for the template file (default: 'cdk-drift-workflow-iam-template.yaml')."
           },
           "immutable": true,
           "locationInModule": {
             "filename": "src/CdkDriftIamTemplate.ts",
-            "line": 6
+            "line": 98
           },
           "name": "outputPath",
           "optional": true,
@@ -4276,6 +5013,105 @@
       ],
       "symbolId": "src/CdkDriftIamTemplate:CdkDriftIamTemplateProps"
     },
+    "@jjrawlins/cdk-diff-pr-github-action.GitHubOidcConfig": {
+      "assembly": "@jjrawlins/cdk-diff-pr-github-action",
+      "datatype": true,
+      "docs": {
+        "stability": "experimental",
+        "summary": "GitHub repository restrictions for OIDC authentication."
+      },
+      "fqn": "@jjrawlins/cdk-diff-pr-github-action.GitHubOidcConfig",
+      "kind": "interface",
+      "locationInModule": {
+        "filename": "src/CdkDiffIamTemplateStackSet.ts",
+        "line": 28
+      },
+      "name": "GitHubOidcConfig",
+      "properties": [
+        {
+          "abstract": true,
+          "docs": {
+            "stability": "experimental",
+            "summary": "GitHub organization or username (e.g., 'my-org' or 'my-username')."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/CdkDiffIamTemplateStackSet.ts",
+            "line": 32
+          },
+          "name": "owner",
+          "type": {
+            "primitive": "string"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "stability": "experimental",
+            "summary": "Repository names allowed to assume the role (e.g., ['repo1', 'repo2']) Use ['*'] to allow all repos in the organization."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/CdkDiffIamTemplateStackSet.ts",
+            "line": 38
+          },
+          "name": "repositories",
+          "type": {
+            "collection": {
+              "elementtype": {
+                "primitive": "string"
+              },
+              "kind": "array"
+            }
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "stability": "experimental",
+            "summary": "Additional subject claims for fine-grained access e.g., ['pull_request', 'environment:production']."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/CdkDiffIamTemplateStackSet.ts",
+            "line": 50
+          },
+          "name": "additionalClaims",
+          "optional": true,
+          "type": {
+            "collection": {
+              "elementtype": {
+                "primitive": "string"
+              },
+              "kind": "array"
+            }
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "stability": "experimental",
+            "summary": "Branch patterns allowed (e.g., ['main', 'release/*']) Default: ['*'] (all branches)."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/CdkDiffIamTemplateStackSet.ts",
+            "line": 44
+          },
+          "name": "branches",
+          "optional": true,
+          "type": {
+            "collection": {
+              "elementtype": {
+                "primitive": "string"
+              },
+              "kind": "array"
+            }
+          }
+        }
+      ],
+      "symbolId": "src/CdkDiffIamTemplateStackSet:GitHubOidcConfig"
+    },
     "@jjrawlins/cdk-diff-pr-github-action.Stack": {
       "assembly": "@jjrawlins/cdk-diff-pr-github-action",
       "datatype": true,
@@ -4353,8 +5189,98 @@
         }
       ],
       "symbolId": "src/CdkDriftDetectionWorkflow:Stack"
+    },
+    "@jjrawlins/cdk-diff-pr-github-action.StackSetAutoDeployment": {
+      "assembly": "@jjrawlins/cdk-diff-pr-github-action",
+      "datatype": true,
+      "docs": {
+        "stability": "experimental",
+        "summary": "Configuration for StackSet auto-deployment."
+      },
+      "fqn": "@jjrawlins/cdk-diff-pr-github-action.StackSetAutoDeployment",
+      "kind": "interface",
+      "locationInModule": {
+        "filename": "src/CdkDiffIamTemplateStackSet.ts",
+        "line": 18
+      },
+      "name": "StackSetAutoDeployment",
+      "properties": [
+        {
+          "abstract": true,
+          "docs": {
+            "stability": "experimental",
+            "summary": "Enable auto-deployment to new accounts in target OUs (default: true)."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/CdkDiffIamTemplateStackSet.ts",
+            "line": 20
+          },
+          "name": "enabled",
+          "optional": true,
+          "type": {
+            "primitive": "boolean"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "stability": "experimental",
+            "summary": "Retain stacks when account leaves OU (default: false)."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/CdkDiffIamTemplateStackSet.ts",
+            "line": 22
+          },
+          "name": "retainStacksOnAccountRemoval",
+          "optional": true,
+          "type": {
+            "primitive": "boolean"
+          }
+        }
+      ],
+      "symbolId": "src/CdkDiffIamTemplateStackSet:StackSetAutoDeployment"
+    },
+    "@jjrawlins/cdk-diff-pr-github-action.StackSetRoleSelection": {
+      "assembly": "@jjrawlins/cdk-diff-pr-github-action",
+      "docs": {
+        "stability": "experimental",
+        "summary": "Which roles to include in the StackSet."
+      },
+      "fqn": "@jjrawlins/cdk-diff-pr-github-action.StackSetRoleSelection",
+      "kind": "enum",
+      "locationInModule": {
+        "filename": "src/CdkDiffIamTemplateStackSet.ts",
+        "line": 6
+      },
+      "members": [
+        {
+          "docs": {
+            "stability": "experimental",
+            "summary": "Include only the changeset role (CdkChangesetRole)."
+          },
+          "name": "CHANGESET_ONLY"
+        },
+        {
+          "docs": {
+            "stability": "experimental",
+            "summary": "Include only the drift role (CdkDriftRole)."
+          },
+          "name": "DRIFT_ONLY"
+        },
+        {
+          "docs": {
+            "stability": "experimental",
+            "summary": "Include both roles (default)."
+          },
+          "name": "BOTH"
+        }
+      ],
+      "name": "StackSetRoleSelection",
+      "symbolId": "src/CdkDiffIamTemplateStackSet:StackSetRoleSelection"
     }
   },
-  "version": "0.0.72",
-  "fingerprint": "WOeSrMNsE4tsIMyTo8iOq0QgIUj37Ow0yH7my4hROc0="
+  "version": "1.0.0",
+  "fingerprint": "9pMOy4tAMCoGCv5oj3QE0hewzoeH7Z47zUhXLwzBpok="
 }