@xpertss/projen-types 0.0.0 → 0.0.2

package/lib/common/projen-drift-check-workflow.d.ts

@@ -0,0 +1,36 @@
+import { Component, github } from 'projen';
+/**
+ * PR-triggered check that rejects direct edits to projen-managed files.
+ *
+ * Re-runs the project's synth command on the PR head and fails if the
+ * regenerated output no longer matches what's committed - i.e. someone
+ * hand-edited a generated file (package.json / pom.xml /
+ * .github/workflows/*.yml / ...) instead of going through `.projenrc.ts`.
+ *
+ * Runs on `pull_request` so it genuinely executes the PR's own code (the
+ * only way to detect drift) - and therefore, by necessity, a PR author can
+ * disable it within their own PR. That residual exposure is bounded by
+ * `WorkflowChangeNoticeWorkflow` (Check 2), which is tamper-proof and flags
+ * any touch to `.github/workflows/**`. See the F003 spec's Security section.
+ */
+export interface ProjenDriftCheckWorkflowOptions {
+    /**
+     * The command that regenerates the project from `.projenrc.ts`.
+     * @default "npx projen"
+     */
+    readonly projenCommand?: string;
+    /**
+     * GitHub secret holding a token with permission to comment on PRs, used
+     * for the best-effort drift report comment. The check still fails (and
+     * emits `::error::` annotations) without it, so fork PRs - which get no
+     * secrets - are only missing the extra comment.
+     * @default "PROJEN_GITHUB_TOKEN"
+     */
+    readonly gheTokenSecret?: string;
+    /** @default "projen-drift-check" */
+    readonly workflowName?: string;
+}
+export declare class ProjenDriftCheckWorkflow extends Component {
+    readonly workflow: github.GithubWorkflow;
+    constructor(scope: github.GitHubProject, options?: ProjenDriftCheckWorkflowOptions);
+}

package/lib/common/projen-drift-check-workflow.js

@@ -0,0 +1,73 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ProjenDriftCheckWorkflow = void 0;
+const JSII_RTTI_SYMBOL_1 = Symbol.for("jsii.rtti");
+const projen_1 = require("projen");
+class ProjenDriftCheckWorkflow extends projen_1.Component {
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@xpertss/projen-types.ProjenDriftCheckWorkflow", version: "0.0.2" };
+    workflow;
+    constructor(scope, options = {}) {
+        super(scope, 'ProjenDriftCheckWorkflow');
+        const gh = scope.github;
+        if (!gh) {
+            throw new Error('ProjenDriftCheckWorkflow requires GitHub integration to be enabled');
+        }
+        const projenCommand = options.projenCommand ?? 'npx projen';
+        const gheTokenSecret = options.gheTokenSecret ?? 'PROJEN_GITHUB_TOKEN';
+        this.workflow = new projen_1.github.GithubWorkflow(gh, options.workflowName ?? 'projen-drift-check');
+        this.workflow.on({ pullRequest: {} });
+        this.workflow.addJob('check', {
+            runsOn: ['ubuntu-latest'],
+            permissions: { contents: projen_1.github.workflows.JobPermission.READ },
+            env: { GH_TOKEN: `\${{ secrets.${gheTokenSecret} }}` },
+            steps: [
+                {
+                    name: 'Checkout',
+                    uses: 'actions/checkout@v4',
+                    with: {
+                        ref: '${{ github.event.pull_request.head.ref }}',
+                        repository: '${{ github.event.pull_request.head.repo.full_name }}',
+                    },
+                },
+                {
+                    name: 'Setup Node',
+                    uses: 'actions/setup-node@v4',
+                    with: { 'node-version': 'lts/*' },
+                },
+                {
+                    name: 'Install dependencies',
+                    run: 'npm ci',
+                },
+                {
+                    name: 'Check for projen drift',
+                    run: `set -euo pipefail
+${projenCommand}
+drifted="$(git diff --name-only)"
+if [ -n "$drifted" ]; then
+  while IFS= read -r f; do
+    echo "::error file=$f::projen-managed file was edited directly; make the change in .projenrc.ts and re-run npx projen"
+  done <<< "$drifted"
+  if [ -n "$GH_TOKEN" ] && [ -n "$GITHUB_EVENT_PATH" ]; then
+    pr_number="$(jq -r ".pull_request.number // empty" "$GITHUB_EVENT_PATH" 2>/dev/null || true)"
+    if [ -n "$pr_number" ]; then
+      {
+        echo "❌ projen drift detected"
+        echo ""
+        echo "These files are managed by projen and were edited directly. Direct edits are silently overwritten by the next npx projen run, so they cannot be merged as-is:"
+        echo ""
+        while IFS= read -r f; do echo "  - $f"; done <<< "$drifted"
+        echo ""
+        echo "To fix: revert the direct edits above, make the equivalent change in .projenrc.ts, then run npx projen and commit the regenerated output."
+      } | gh pr comment "$pr_number" --body-file - || echo "::warning::could not post PR comment (fork PR or missing token)"
+    fi
+  fi
+  exit 1
+fi
+`,
+                },
+            ],
+        });
+    }
+}
+exports.ProjenDriftCheckWorkflow = ProjenDriftCheckWorkflow;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicHJvamVuLWRyaWZ0LWNoZWNrLXdvcmtmbG93LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL2NvbW1vbi9wcm9qZW4tZHJpZnQtY2hlY2std29ya2Zsb3cudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7OztBQUFBLG1DQUEyQztBQW9DM0MsTUFBYSx3QkFBeUIsU0FBUSxrQkFBUzs7SUFDckMsUUFBUSxDQUF3QjtJQUVoRCxZQUNFLEtBQTJCLEVBQzNCLFVBQTJDLEVBQUU7UUFFN0MsS0FBSyxDQUFDLEtBQUssRUFBRSwwQkFBMEIsQ0FBQyxDQUFDO1FBRXpDLE1BQU0sRUFBRSxHQUFHLEtBQUssQ0FBQyxNQUFNLENBQUM7UUFDeEIsSUFBSSxDQUFDLEVBQUUsRUFBRSxDQUFDO1lBQ1IsTUFBTSxJQUFJLEtBQUssQ0FDYixvRUFBb0UsQ0FDckUsQ0FBQztRQUNKLENBQUM7UUFFRCxNQUFNLGFBQWEsR0FBRyxPQUFPLENBQUMsYUFBYSxJQUFJLFlBQVksQ0FBQztRQUM1RCxNQUFNLGNBQWMsR0FBRyxPQUFPLENBQUMsY0FBYyxJQUFJLHFCQUFxQixDQUFDO1FBRXZFLElBQUksQ0FBQyxRQUFRLEdBQUcsSUFBSSxlQUFNLENBQUMsY0FBYyxDQUN2QyxFQUFFLEVBQ0YsT0FBTyxDQUFDLFlBQVksSUFBSSxvQkFBb0IsQ0FDN0MsQ0FBQztRQUNGLElBQUksQ0FBQyxRQUFRLENBQUMsRUFBRSxDQUFDLEVBQUUsV0FBVyxFQUFFLEVBQUUsRUFBRSxDQUFDLENBQUM7UUFDdEMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxNQUFNLENBQUMsT0FBTyxFQUFFO1lBQzVCLE1BQU0sRUFBRSxDQUFDLGVBQWUsQ0FBQztZQUN6QixXQUFXLEVBQUUsRUFBRSxRQUFRLEVBQUUsZUFBTSxDQUFDLFNBQVMsQ0FBQyxhQUFhLENBQUMsSUFBSSxFQUFFO1lBQzlELEdBQUcsRUFBRSxFQUFFLFFBQVEsRUFBRSxnQkFBZ0IsY0FBYyxLQUFLLEVBQUU7WUFDdEQsS0FBSyxFQUFFO2dCQUNMO29CQUNFLElBQUksRUFBRSxVQUFVO29CQUNoQixJQUFJLEVBQUUscUJBQXFCO29CQUMzQixJQUFJLEVBQUU7d0JBQ0osR0FBRyxFQUFFLDJDQUEyQzt3QkFDaEQsVUFBVSxFQUFFLHNEQUFzRDtxQkFDbkU7aUJBQ0Y7Z0JBQ0Q7b0JBQ0UsSUFBSSxFQUFFLFlBQVk7b0JBQ2xCLElBQUksRUFBRSx1QkFBdUI7b0JBQzdCLElBQUksRUFBRSxFQUFFLGNBQWMsRUFBRSxPQUFPLEVBQUU7aUJBQ2xDO2dCQUNEO29CQUNFLElBQUksRUFBRSxzQkFBc0I7b0JBQzVCLEdBQUcsRUFBRSxRQUFRO2lCQUNkO2dCQUNEO29CQUNFLElBQUksRUFBRSx3QkFBd0I7b0JBQzlCLEdBQUcsRUFBRTtFQUNiLGFBQWE7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Q0FzQmQ7aUJBQ1E7YUFDRjtTQUNGLENBQUMsQ0FBQztJQUNMLENBQUM7O0FBM0VILDREQTRFQyIsInNvdXJjZXNDb250ZW50IjpbImltcG9ydCB7IENvbXBvbmVudCwgZ2l0aHViIH0gZnJvbSAncHJvamVuJztcblxuLyoqXG4gKiBQUi10cmlnZ2VyZWQgY2hlY2sgdGhhdCByZWplY3RzIGRpcmVjdCBlZGl0cyB0byBwcm9qZW4tbWFuYWdlZCBmaWxlcy5cbiAqXG4gKiBSZS1ydW5zIHRoZSBwcm9qZWN0J3Mgc3ludGggY29tbWFuZCBvbiB0aGUgUFIgaGVhZCBhbmQgZmFpbHMgaWYgdGhlXG4gKiByZWdlbmVyYXRlZCBvdXRwdXQgbm8gbG9uZ2VyIG1hdGNoZXMgd2hhdCdzIGNvbW1pdHRlZCAtIGkuZS4gc29tZW9uZVxuICogaGFuZC1lZGl0ZWQgYSBnZW5lcmF0ZWQgZmlsZSAocGFja2FnZS5qc29uIC8gcG9tLnhtbCAvXG4gKiAuZ2l0aHViL3dvcmtmbG93cy8qLnltbCAvIC4uLikgaW5zdGVhZCBvZiBnb2luZyB0aHJvdWdoIGAucHJvamVucmMudHNgLlxuICpcbiAqIFJ1bnMgb24gYHB1bGxfcmVxdWVzdGAgc28gaXQgZ2VudWluZWx5IGV4ZWN1dGVzIHRoZSBQUidzIG93biBjb2RlICh0aGVcbiAqIG9ubHkgd2F5IHRvIGRldGVjdCBkcmlmdCkgLSBhbmQgdGhlcmVmb3JlLCBieSBuZWNlc3NpdHksIGEgUFIgYXV0aG9yIGNhblxuICogZGlzYWJsZSBpdCB3aXRoaW4gdGhlaXIgb3duIFBSLiBUaGF0IHJlc2lkdWFsIGV4cG9zdXJlIGlzIGJvdW5kZWQgYnlcbiAqIGBXb3JrZmxvd0NoYW5nZU5vdGljZVdvcmtmbG93YCAoQ2hlY2sgMiksIHdoaWNoIGlzIHRhbXBlci1wcm9vZiBhbmQgZmxhZ3NcbiAqIGFueSB0b3VjaCB0byBgLmdpdGh1Yi93b3JrZmxvd3MvKipgLiBTZWUgdGhlIEYwMDMgc3BlYydzIFNlY3VyaXR5IHNlY3Rpb24uXG4gKi9cbmV4cG9ydCBpbnRlcmZhY2UgUHJvamVuRHJpZnRDaGVja1dvcmtmbG93T3B0aW9ucyB7XG4gIC8qKlxuICAgKiBUaGUgY29tbWFuZCB0aGF0IHJlZ2VuZXJhdGVzIHRoZSBwcm9qZWN0IGZyb20gYC5wcm9qZW5yYy50c2AuXG4gICAqIEBkZWZhdWx0IFwibnB4IHByb2plblwiXG4gICAqL1xuICByZWFkb25seSBwcm9qZW5Db21tYW5kPzogc3RyaW5nO1xuXG4gIC8qKlxuICAgKiBHaXRIdWIgc2VjcmV0IGhvbGRpbmcgYSB0b2tlbiB3aXRoIHBlcm1pc3Npb24gdG8gY29tbWVudCBvbiBQUnMsIHVzZWRcbiAgICogZm9yIHRoZSBiZXN0LWVmZm9ydCBkcmlmdCByZXBvcnQgY29tbWVudC4gVGhlIGNoZWNrIHN0aWxsIGZhaWxzIChhbmRcbiAgICogZW1pdHMgYDo6ZXJyb3I6OmAgYW5ub3RhdGlvbnMpIHdpdGhvdXQgaXQsIHNvIGZvcmsgUFJzIC0gd2hpY2ggZ2V0IG5vXG4gICAqIHNlY3JldHMgLSBhcmUgb25seSBtaXNzaW5nIHRoZSBleHRyYSBjb21tZW50LlxuICAgKiBAZGVmYXVsdCBcIlBST0pFTl9HSVRIVUJfVE9LRU5cIlxuICAgKi9cbiAgcmVhZG9ubHkgZ2hlVG9rZW5TZWNyZXQ/OiBzdHJpbmc7XG5cbiAgLyoqIEBkZWZhdWx0IFwicHJvamVuLWRyaWZ0LWNoZWNrXCIgKi9cbiAgcmVhZG9ubHkgd29ya2Zsb3dOYW1lPzogc3RyaW5nO1xufVxuXG5leHBvcnQgY2xhc3MgUHJvamVuRHJpZnRDaGVja1dvcmtmbG93IGV4dGVuZHMgQ29tcG9uZW50IHtcbiAgcHVibGljIHJlYWRvbmx5IHdvcmtmbG93OiBnaXRodWIuR2l0aHViV29ya2Zsb3c7XG5cbiAgY29uc3RydWN0b3IoXG4gICAgc2NvcGU6IGdpdGh1Yi5HaXRIdWJQcm9qZWN0LFxuICAgIG9wdGlvbnM6IFByb2plbkRyaWZ0Q2hlY2tXb3JrZmxvd09wdGlvbnMgPSB7fSxcbiAgKSB7XG4gICAgc3VwZXIoc2NvcGUsICdQcm9qZW5EcmlmdENoZWNrV29ya2Zsb3cnKTtcblxuICAgIGNvbnN0IGdoID0gc2NvcGUuZ2l0aHViO1xuICAgIGlmICghZ2gpIHtcbiAgICAgIHRocm93IG5ldyBFcnJvcihcbiAgICAgICAgJ1Byb2plbkRyaWZ0Q2hlY2tXb3JrZmxvdyByZXF1aXJlcyBHaXRIdWIgaW50ZWdyYXRpb24gdG8gYmUgZW5hYmxlZCcsXG4gICAgICApO1xuICAgIH1cblxuICAgIGNvbnN0IHByb2plbkNvbW1hbmQgPSBvcHRpb25zLnByb2plbkNvbW1hbmQgPz8gJ25weCBwcm9qZW4nO1xuICAgIGNvbnN0IGdoZVRva2VuU2VjcmV0ID0gb3B0aW9ucy5naGVUb2tlblNlY3JldCA/PyAnUFJPSkVOX0dJVEhVQl9UT0tFTic7XG5cbiAgICB0aGlzLndvcmtmbG93ID0gbmV3IGdpdGh1Yi5HaXRodWJXb3JrZmxvdyhcbiAgICAgIGdoLFxuICAgICAgb3B0aW9ucy53b3JrZmxvd05hbWUgPz8gJ3Byb2plbi1kcmlmdC1jaGVjaycsXG4gICAgKTtcbiAgICB0aGlzLndvcmtmbG93Lm9uKHsgcHVsbFJlcXVlc3Q6IHt9IH0pO1xuICAgIHRoaXMud29ya2Zsb3cuYWRkSm9iKCdjaGVjaycsIHtcbiAgICAgIHJ1bnNPbjogWyd1YnVudHUtbGF0ZXN0J10sXG4gICAgICBwZXJtaXNzaW9uczogeyBjb250ZW50czogZ2l0aHViLndvcmtmbG93cy5Kb2JQZXJtaXNzaW9uLlJFQUQgfSxcbiAgICAgIGVudjogeyBHSF9UT0tFTjogYFxcJHt7IHNlY3JldHMuJHtnaGVUb2tlblNlY3JldH0gfX1gIH0sXG4gICAgICBzdGVwczogW1xuICAgICAgICB7XG4gICAgICAgICAgbmFtZTogJ0NoZWNrb3V0JyxcbiAgICAgICAgICB1c2VzOiAnYWN0aW9ucy9jaGVja291dEB2NCcsXG4gICAgICAgICAgd2l0aDoge1xuICAgICAgICAgICAgcmVmOiAnJHt7IGdpdGh1Yi5ldmVudC5wdWxsX3JlcXVlc3QuaGVhZC5yZWYgfX0nLFxuICAgICAgICAgICAgcmVwb3NpdG9yeTogJyR7eyBnaXRodWIuZXZlbnQucHVsbF9yZXF1ZXN0LmhlYWQucmVwby5mdWxsX25hbWUgfX0nLFxuICAgICAgICAgIH0sXG4gICAgICAgIH0sXG4gICAgICAgIHtcbiAgICAgICAgICBuYW1lOiAnU2V0dXAgTm9kZScsXG4gICAgICAgICAgdXNlczogJ2FjdGlvbnMvc2V0dXAtbm9kZUB2NCcsXG4gICAgICAgICAgd2l0aDogeyAnbm9kZS12ZXJzaW9uJzogJ2x0cy8qJyB9LFxuICAgICAgICB9LFxuICAgICAgICB7XG4gICAgICAgICAgbmFtZTogJ0luc3RhbGwgZGVwZW5kZW5jaWVzJyxcbiAgICAgICAgICBydW46ICducG0gY2knLFxuICAgICAgICB9LFxuICAgICAgICB7XG4gICAgICAgICAgbmFtZTogJ0NoZWNrIGZvciBwcm9qZW4gZHJpZnQnLFxuICAgICAgICAgIHJ1bjogYHNldCAtZXVvIHBpcGVmYWlsXG4ke3Byb2plbkNvbW1hbmR9XG5kcmlmdGVkPVwiJChnaXQgZGlmZiAtLW5hbWUtb25seSlcIlxuaWYgWyAtbiBcIiRkcmlmdGVkXCIgXTsgdGhlblxuICB3aGlsZSBJRlM9IHJlYWQgLXIgZjsgZG9cbiAgICBlY2hvIFwiOjplcnJvciBmaWxlPSRmOjpwcm9qZW4tbWFuYWdlZCBmaWxlIHdhcyBlZGl0ZWQgZGlyZWN0bHk7IG1ha2UgdGhlIGNoYW5nZSBpbiAucHJvamVucmMudHMgYW5kIHJlLXJ1biBucHggcHJvamVuXCJcbiAgZG9uZSA8PDwgXCIkZHJpZnRlZFwiXG4gIGlmIFsgLW4gXCIkR0hfVE9LRU5cIiBdICYmIFsgLW4gXCIkR0lUSFVCX0VWRU5UX1BBVEhcIiBdOyB0aGVuXG4gICAgcHJfbnVtYmVyPVwiJChqcSAtciBcIi5wdWxsX3JlcXVlc3QubnVtYmVyIC8vIGVtcHR5XCIgXCIkR0lUSFVCX0VWRU5UX1BBVEhcIiAyPi9kZXYvbnVsbCB8fCB0cnVlKVwiXG4gICAgaWYgWyAtbiBcIiRwcl9udW1iZXJcIiBdOyB0aGVuXG4gICAgICB7XG4gICAgICAgIGVjaG8gXCLinYwgcHJvamVuIGRyaWZ0IGRldGVjdGVkXCJcbiAgICAgICAgZWNobyBcIlwiXG4gICAgICAgIGVjaG8gXCJUaGVzZSBmaWxlcyBhcmUgbWFuYWdlZCBieSBwcm9qZW4gYW5kIHdlcmUgZWRpdGVkIGRpcmVjdGx5LiBEaXJlY3QgZWRpdHMgYXJlIHNpbGVudGx5IG92ZXJ3cml0dGVuIGJ5IHRoZSBuZXh0IG5weCBwcm9qZW4gcnVuLCBzbyB0aGV5IGNhbm5vdCBiZSBtZXJnZWQgYXMtaXM6XCJcbiAgICAgICAgZWNobyBcIlwiXG4gICAgICAgIHdoaWxlIElGUz0gcmVhZCAtciBmOyBkbyBlY2hvIFwiICAtICRmXCI7IGRvbmUgPDw8IFwiJGRyaWZ0ZWRcIlxuICAgICAgICBlY2hvIFwiXCJcbiAgICAgICAgZWNobyBcIlRvIGZpeDogcmV2ZXJ0IHRoZSBkaXJlY3QgZWRpdHMgYWJvdmUsIG1ha2UgdGhlIGVxdWl2YWxlbnQgY2hhbmdlIGluIC5wcm9qZW5yYy50cywgdGhlbiBydW4gbnB4IHByb2plbiBhbmQgY29tbWl0IHRoZSByZWdlbmVyYXRlZCBvdXRwdXQuXCJcbiAgICAgIH0gfCBnaCBwciBjb21tZW50IFwiJHByX251bWJlclwiIC0tYm9keS1maWxlIC0gfHwgZWNobyBcIjo6d2FybmluZzo6Y291bGQgbm90IHBvc3QgUFIgY29tbWVudCAoZm9yayBQUiBvciBtaXNzaW5nIHRva2VuKVwiXG4gICAgZmlcbiAgZmlcbiAgZXhpdCAxXG5maVxuYCxcbiAgICAgICAgfSxcbiAgICAgIF0sXG4gICAgfSk7XG4gIH1cbn1cbiJdfQ==

package/lib/common/upgrade-workflow.js

@@ -19,7 +19,10 @@ class UpgradeWorkflow extends projen_1.Component {
                 schedule: [{ cron: options.schedule ?? constants_1.NIGHTLY_UPGRADE_SCHEDULE }],
                 workflowDispatch: {},
             },
-            permissions: { contents: projen_1.github.workflows.JobPermission.READ },
+            permissions: {
+                contents: projen_1.github.workflows.JobPermission.WRITE,
+                pullRequests: projen_1.github.workflows.JobPermission.WRITE,
+            },
             postBuildSteps: [
                 {
                     name: 'Create Pull Request',
@@ -29,6 +32,7 @@ class UpgradeWorkflow extends projen_1.Component {
                         'branch': 'auto/upgrade-dependencies',
                         'title': 'chore: upgrade dependencies',
                         'labels': 'auto-approve,auto-merge',
+                        'token': `\${{ secrets.${constants_1.DEFAULT_GHE_TOKEN_SECRET} }}`,
                     },
                 },
             ],
@@ -36,4 +40,4 @@ class UpgradeWorkflow extends projen_1.Component {
     }
 }
 exports.UpgradeWorkflow = UpgradeWorkflow;
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidXBncmFkZS13b3JrZmxvdy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9jb21tb24vdXBncmFkZS13b3JrZmxvdy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7QUFBQSxtQ0FBaUQ7QUFDakQsMkNBQXVEO0FBa0J2RCxNQUFhLGVBQWdCLFNBQVEsa0JBQVM7SUFDNUIsUUFBUSxDQUFzQjtJQUU5QyxZQUFZLEtBQTJCLEVBQUUsT0FBK0I7UUFDdEUsS0FBSyxDQUFDLEtBQUssRUFBRSxpQkFBaUIsQ0FBQyxDQUFDO1FBRWhDLE1BQU0sRUFBRSxHQUFHLEtBQUssQ0FBQyxNQUFNLENBQUM7UUFDeEIsSUFBSSxDQUFDLEVBQUUsRUFBRSxDQUFDO1lBQ1IsTUFBTSxJQUFJLEtBQUssQ0FDYiwyREFBMkQsQ0FDNUQsQ0FBQztRQUNKLENBQUM7UUFFRCxJQUFJLENBQUMsUUFBUSxHQUFHLElBQUksZUFBTSxDQUFDLFlBQVksQ0FBQyxFQUFFLEVBQUU7WUFDMUMsSUFBSSxFQUFFLE9BQU8sQ0FBQyxZQUFZLElBQUksU0FBUztZQUN2QyxLQUFLLEVBQUUsU0FBUztZQUNoQixJQUFJLEVBQUUsT0FBTyxDQUFDLElBQUk7WUFDbEIsUUFBUSxFQUFFO2dCQUNSLFFBQVEsRUFBRSxDQUFDLEVBQUUsSUFBSSxFQUFFLE9BQU8sQ0FBQyxRQUFRLElBQUksb0NBQXdCLEVBQUUsQ0FBQztnQkFDbEUsZ0JBQWdCLEVBQUUsRUFBRTthQUNyQjtZQUNELFdBQVcsRUFBRSxFQUFFLFFBQVEsRUFBRSxlQUFNLENBQUMsU0FBUyxDQUFDLGFBQWEsQ0FBQyxJQUFJLEVBQUU7WUFDOUQsY0FBYyxFQUFFO2dCQUNkO29CQUNFLElBQUksRUFBRSxxQkFBcUI7b0JBQzNCLElBQUksRUFBRSxvQ0FBb0M7b0JBQzFDLElBQUksRUFBRTt3QkFDSixnQkFBZ0IsRUFBRSw2QkFBNkI7d0JBQy9DLFFBQVEsRUFBRSwyQkFBMkI7d0JBQ3JDLE9BQU8sRUFBRSw2QkFBNkI7d0JBQ3RDLFFBQVEsRUFBRSx5QkFBeUI7cUJBQ3BDO2lCQUNGO2FBQ0Y7U0FDRixDQUFDLENBQUM7SUFDTCxDQUFDO0NBQ0Y7QUFwQ0QsMENBb0NDIiwic291cmNlc0NvbnRlbnQiOlsiaW1wb3J0IHsgQ29tcG9uZW50LCBUYXNrLCBnaXRodWIgfSBmcm9tICdwcm9qZW4nO1xuaW1wb3J0IHsgTklHSFRMWV9VUEdSQURFX1NDSEVEVUxFIH0gZnJvbSAnLi9jb25zdGFudHMnO1xuXG4vKipcbiAqIE5pZ2h0bHkgY3JvbiB3b3JrZmxvdyB0aGF0IG9wZW5zIGEgUFIgd2l0aCBkZXBlbmRlbmN5IHVwZ3JhZGVzLiBVc2VkIGJ5XG4gKiBub24tTm9kZSBwcm9qZWN0IHR5cGVzIChKYXZhKTsgVHlwZVNjcmlwdC9DREsgcHJvamVjdCB0eXBlcyBpbnN0ZWFkIGdldFxuICogdGhpcyBmb3IgZnJlZSBmcm9tIHByb2plbidzIGJ1aWx0LWluIGBkZXBzVXBncmFkZWAuXG4gKi9cbmV4cG9ydCBpbnRlcmZhY2UgVXBncmFkZVdvcmtmbG93T3B0aW9ucyB7XG4gIC8qKiBUaGUgdGFzayB0aGF0IHBlcmZvcm1zIHRoZSB1cGdyYWRlIChlLmcuIGBtdm4gdmVyc2lvbnM6dXNlLWxhdGVzdC1yZWxlYXNlc2ApLiAqL1xuICByZWFkb25seSB0YXNrOiBUYXNrO1xuXG4gIC8qKiBAZGVmYXVsdCBcInVwZ3JhZGVcIiAqL1xuICByZWFkb25seSB3b3JrZmxvd05hbWU/OiBzdHJpbmc7XG5cbiAgLyoqIEBkZWZhdWx0IE5JR0hUTFlfVVBHUkFERV9TQ0hFRFVMRSAoMDM6MDAgVVRDKSAqL1xuICByZWFkb25seSBzY2hlZHVsZT86IHN0cmluZztcbn1cblxuZXhwb3J0IGNsYXNzIFVwZ3JhZGVXb3JrZmxvdyBleHRlbmRzIENvbXBvbmVudCB7XG4gIHB1YmxpYyByZWFkb25seSB3b3JrZmxvdzogZ2l0aHViLlRhc2tXb3JrZmxvdztcblxuICBjb25zdHJ1Y3RvcihzY29wZTogZ2l0aHViLkdpdEh1YlByb2plY3QsIG9wdGlvbnM6IFVwZ3JhZGVXb3JrZmxvd09wdGlvbnMpIHtcbiAgICBzdXBlcihzY29wZSwgJ1VwZ3JhZGVXb3JrZmxvdycpO1xuXG4gICAgY29uc3QgZ2ggPSBzY29wZS5naXRodWI7XG4gICAgaWYgKCFnaCkge1xuICAgICAgdGhyb3cgbmV3IEVycm9yKFxuICAgICAgICAnVXBncmFkZVdvcmtmbG93IHJlcXVpcmVzIEdpdEh1YiBpbnRlZ3JhdGlvbiB0byBiZSBlbmFibGVkJyxcbiAgICAgICk7XG4gICAgfVxuXG4gICAgdGhpcy53b3JrZmxvdyA9IG5ldyBnaXRodWIuVGFza1dvcmtmbG93KGdoLCB7XG4gICAgICBuYW1lOiBvcHRpb25zLndvcmtmbG93TmFtZSA/PyAndXBncmFkZScsXG4gICAgICBqb2JJZDogJ3VwZ3JhZGUnLFxuICAgICAgdGFzazogb3B0aW9ucy50YXNrLFxuICAgICAgdHJpZ2dlcnM6IHtcbiAgICAgICAgc2NoZWR1bGU6IFt7IGNyb246IG9wdGlvbnMuc2NoZWR1bGUgPz8gTklHSFRMWV9VUEdSQURFX1NDSEVEVUxFIH1dLFxuICAgICAgICB3b3JrZmxvd0Rpc3BhdGNoOiB7fSxcbiAgICAgIH0sXG4gICAgICBwZXJtaXNzaW9uczogeyBjb250ZW50czogZ2l0aHViLndvcmtmbG93cy5Kb2JQZXJtaXNzaW9uLlJFQUQgfSxcbiAgICAgIHBvc3RCdWlsZFN0ZXBzOiBbXG4gICAgICAgIHtcbiAgICAgICAgICBuYW1lOiAnQ3JlYXRlIFB1bGwgUmVxdWVzdCcsXG4gICAgICAgICAgdXNlczogJ3BldGVyLWV2YW5zL2NyZWF0ZS1wdWxsLXJlcXVlc3RAdjcnLFxuICAgICAgICAgIHdpdGg6IHtcbiAgICAgICAgICAgICdjb21taXQtbWVzc2FnZSc6ICdjaG9yZTogdXBncmFkZSBkZXBlbmRlbmNpZXMnLFxuICAgICAgICAgICAgJ2JyYW5jaCc6ICdhdXRvL3VwZ3JhZGUtZGVwZW5kZW5jaWVzJyxcbiAgICAgICAgICAgICd0aXRsZSc6ICdjaG9yZTogdXBncmFkZSBkZXBlbmRlbmNpZXMnLFxuICAgICAgICAgICAgJ2xhYmVscyc6ICdhdXRvLWFwcHJvdmUsYXV0by1tZXJnZScsXG4gICAgICAgICAgfSxcbiAgICAgICAgfSxcbiAgICAgIF0sXG4gICAgfSk7XG4gIH1cbn1cbiJdfQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidXBncmFkZS13b3JrZmxvdy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9jb21tb24vdXBncmFkZS13b3JrZmxvdy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7QUFBQSxtQ0FBaUQ7QUFDakQsMkNBR3FCO0FBa0JyQixNQUFhLGVBQWdCLFNBQVEsa0JBQVM7SUFDNUIsUUFBUSxDQUFzQjtJQUU5QyxZQUFZLEtBQTJCLEVBQUUsT0FBK0I7UUFDdEUsS0FBSyxDQUFDLEtBQUssRUFBRSxpQkFBaUIsQ0FBQyxDQUFDO1FBRWhDLE1BQU0sRUFBRSxHQUFHLEtBQUssQ0FBQyxNQUFNLENBQUM7UUFDeEIsSUFBSSxDQUFDLEVBQUUsRUFBRSxDQUFDO1lBQ1IsTUFBTSxJQUFJLEtBQUssQ0FDYiwyREFBMkQsQ0FDNUQsQ0FBQztRQUNKLENBQUM7UUFFRCxJQUFJLENBQUMsUUFBUSxHQUFHLElBQUksZUFBTSxDQUFDLFlBQVksQ0FBQyxFQUFFLEVBQUU7WUFDMUMsSUFBSSxFQUFFLE9BQU8sQ0FBQyxZQUFZLElBQUksU0FBUztZQUN2QyxLQUFLLEVBQUUsU0FBUztZQUNoQixJQUFJLEVBQUUsT0FBTyxDQUFDLElBQUk7WUFDbEIsUUFBUSxFQUFFO2dCQUNSLFFBQVEsRUFBRSxDQUFDLEVBQUUsSUFBSSxFQUFFLE9BQU8sQ0FBQyxRQUFRLElBQUksb0NBQXdCLEVBQUUsQ0FBQztnQkFDbEUsZ0JBQWdCLEVBQUUsRUFBRTthQUNyQjtZQUNELFdBQVcsRUFBRTtnQkFDWCxRQUFRLEVBQUUsZUFBTSxDQUFDLFNBQVMsQ0FBQyxhQUFhLENBQUMsS0FBSztnQkFDOUMsWUFBWSxFQUFFLGVBQU0sQ0FBQyxTQUFTLENBQUMsYUFBYSxDQUFDLEtBQUs7YUFDbkQ7WUFDRCxjQUFjLEVBQUU7Z0JBQ2Q7b0JBQ0UsSUFBSSxFQUFFLHFCQUFxQjtvQkFDM0IsSUFBSSxFQUFFLG9DQUFvQztvQkFDMUMsSUFBSSxFQUFFO3dCQUNKLGdCQUFnQixFQUFFLDZCQUE2Qjt3QkFDL0MsUUFBUSxFQUFFLDJCQUEyQjt3QkFDckMsT0FBTyxFQUFFLDZCQUE2Qjt3QkFDdEMsUUFBUSxFQUFFLHlCQUF5Qjt3QkFDbkMsT0FBTyxFQUFFLGdCQUFnQixvQ0FBd0IsS0FBSztxQkFDdkQ7aUJBQ0Y7YUFDRjtTQUNGLENBQUMsQ0FBQztJQUNMLENBQUM7Q0FDRjtBQXhDRCwwQ0F3Q0MiLCJzb3VyY2VzQ29udGVudCI6WyJpbXBvcnQgeyBDb21wb25lbnQsIFRhc2ssIGdpdGh1YiB9IGZyb20gJ3Byb2plbic7XG5pbXBvcnQge1xuICBERUZBVUxUX0dIRV9UT0tFTl9TRUNSRVQsXG4gIE5JR0hUTFlfVVBHUkFERV9TQ0hFRFVMRSxcbn0gZnJvbSAnLi9jb25zdGFudHMnO1xuXG4vKipcbiAqIE5pZ2h0bHkgY3JvbiB3b3JrZmxvdyB0aGF0IG9wZW5zIGEgUFIgd2l0aCBkZXBlbmRlbmN5IHVwZ3JhZGVzLiBVc2VkIGJ5XG4gKiBub24tTm9kZSBwcm9qZWN0IHR5cGVzIChKYXZhKTsgVHlwZVNjcmlwdC9DREsgcHJvamVjdCB0eXBlcyBpbnN0ZWFkIGdldFxuICogdGhpcyBmb3IgZnJlZSBmcm9tIHByb2plbidzIGJ1aWx0LWluIGBkZXBzVXBncmFkZWAuXG4gKi9cbmV4cG9ydCBpbnRlcmZhY2UgVXBncmFkZVdvcmtmbG93T3B0aW9ucyB7XG4gIC8qKiBUaGUgdGFzayB0aGF0IHBlcmZvcm1zIHRoZSB1cGdyYWRlIChlLmcuIGBtdm4gdmVyc2lvbnM6dXNlLWxhdGVzdC1yZWxlYXNlc2ApLiAqL1xuICByZWFkb25seSB0YXNrOiBUYXNrO1xuXG4gIC8qKiBAZGVmYXVsdCBcInVwZ3JhZGVcIiAqL1xuICByZWFkb25seSB3b3JrZmxvd05hbWU/OiBzdHJpbmc7XG5cbiAgLyoqIEBkZWZhdWx0IE5JR0hUTFlfVVBHUkFERV9TQ0hFRFVMRSAoMDM6MDAgVVRDKSAqL1xuICByZWFkb25seSBzY2hlZHVsZT86IHN0cmluZztcbn1cblxuZXhwb3J0IGNsYXNzIFVwZ3JhZGVXb3JrZmxvdyBleHRlbmRzIENvbXBvbmVudCB7XG4gIHB1YmxpYyByZWFkb25seSB3b3JrZmxvdzogZ2l0aHViLlRhc2tXb3JrZmxvdztcblxuICBjb25zdHJ1Y3RvcihzY29wZTogZ2l0aHViLkdpdEh1YlByb2plY3QsIG9wdGlvbnM6IFVwZ3JhZGVXb3JrZmxvd09wdGlvbnMpIHtcbiAgICBzdXBlcihzY29wZSwgJ1VwZ3JhZGVXb3JrZmxvdycpO1xuXG4gICAgY29uc3QgZ2ggPSBzY29wZS5naXRodWI7XG4gICAgaWYgKCFnaCkge1xuICAgICAgdGhyb3cgbmV3IEVycm9yKFxuICAgICAgICAnVXBncmFkZVdvcmtmbG93IHJlcXVpcmVzIEdpdEh1YiBpbnRlZ3JhdGlvbiB0byBiZSBlbmFibGVkJyxcbiAgICAgICk7XG4gICAgfVxuXG4gICAgdGhpcy53b3JrZmxvdyA9IG5ldyBnaXRodWIuVGFza1dvcmtmbG93KGdoLCB7XG4gICAgICBuYW1lOiBvcHRpb25zLndvcmtmbG93TmFtZSA/PyAndXBncmFkZScsXG4gICAgICBqb2JJZDogJ3VwZ3JhZGUnLFxuICAgICAgdGFzazogb3B0aW9ucy50YXNrLFxuICAgICAgdHJpZ2dlcnM6IHtcbiAgICAgICAgc2NoZWR1bGU6IFt7IGNyb246IG9wdGlvbnMuc2NoZWR1bGUgPz8gTklHSFRMWV9VUEdSQURFX1NDSEVEVUxFIH1dLFxuICAgICAgICB3b3JrZmxvd0Rpc3BhdGNoOiB7fSxcbiAgICAgIH0sXG4gICAgICBwZXJtaXNzaW9uczoge1xuICAgICAgICBjb250ZW50czogZ2l0aHViLndvcmtmbG93cy5Kb2JQZXJtaXNzaW9uLldSSVRFLFxuICAgICAgICBwdWxsUmVxdWVzdHM6IGdpdGh1Yi53b3JrZmxvd3MuSm9iUGVybWlzc2lvbi5XUklURSxcbiAgICAgIH0sXG4gICAgICBwb3N0QnVpbGRTdGVwczogW1xuICAgICAgICB7XG4gICAgICAgICAgbmFtZTogJ0NyZWF0ZSBQdWxsIFJlcXVlc3QnLFxuICAgICAgICAgIHVzZXM6ICdwZXRlci1ldmFucy9jcmVhdGUtcHVsbC1yZXF1ZXN0QHY3JyxcbiAgICAgICAgICB3aXRoOiB7XG4gICAgICAgICAgICAnY29tbWl0LW1lc3NhZ2UnOiAnY2hvcmU6IHVwZ3JhZGUgZGVwZW5kZW5jaWVzJyxcbiAgICAgICAgICAgICdicmFuY2gnOiAnYXV0by91cGdyYWRlLWRlcGVuZGVuY2llcycsXG4gICAgICAgICAgICAndGl0bGUnOiAnY2hvcmU6IHVwZ3JhZGUgZGVwZW5kZW5jaWVzJyxcbiAgICAgICAgICAgICdsYWJlbHMnOiAnYXV0by1hcHByb3ZlLGF1dG8tbWVyZ2UnLFxuICAgICAgICAgICAgJ3Rva2VuJzogYFxcJHt7IHNlY3JldHMuJHtERUZBVUxUX0dIRV9UT0tFTl9TRUNSRVR9IH19YCxcbiAgICAgICAgICB9LFxuICAgICAgICB9LFxuICAgICAgXSxcbiAgICB9KTtcbiAgfVxufVxuIl19

package/lib/common/workflow-change-notice-workflow.d.ts

@@ -0,0 +1,33 @@
+import { Component, github } from 'projen';
+/**
+ * PR-triggered, tamper-proof notice that a PR touches GitHub Actions
+ * workflow or action files.
+ *
+ * Runs on `pull_request_target` (NOT `pull_request`) so it always executes
+ * the copy of this workflow committed on the base branch - a PR cannot edit
+ * this file to disable or weaken the notice. It checks out and executes
+ * nothing from the PR; it only lists the changed filenames via the GitHub
+ * API and posts a non-blocking NOTE. Because `pull_request_target` runs with
+ * the base repo's normal token even for fork-originated PRs, the comment
+ * posts reliably with no degraded fallback.
+ *
+ * This check NEVER fails the build - it is purely informational (reviewer
+ * attention). It is the tamper-proof backstop that bounds Check 1's
+ * (`ProjenDriftCheckWorkflow`) residual exposure. See the F003 spec's
+ * Security section.
+ */
+export interface WorkflowChangeNoticeWorkflowOptions {
+    /**
+     * Glob patterns (bash `[[ string == pattern ]]` semantics, where `*` also
+     * matches `/`) that trigger the notice when a changed PR file matches any
+     * of them.
+     * @default [".github/workflows/**", ".github/actions/**"]
+     */
+    readonly watchPaths?: string[];
+    /** @default "workflow-change-notice" */
+    readonly workflowName?: string;
+}
+export declare class WorkflowChangeNoticeWorkflow extends Component {
+    readonly workflow: github.GithubWorkflow;
+    constructor(scope: github.GitHubProject, options?: WorkflowChangeNoticeWorkflowOptions);
+}

package/lib/common/workflow-change-notice-workflow.js

@@ -0,0 +1,58 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WorkflowChangeNoticeWorkflow = void 0;
+const JSII_RTTI_SYMBOL_1 = Symbol.for("jsii.rtti");
+const projen_1 = require("projen");
+class WorkflowChangeNoticeWorkflow extends projen_1.Component {
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@xpertss/projen-types.WorkflowChangeNoticeWorkflow", version: "0.0.2" };
+    workflow;
+    constructor(scope, options = {}) {
+        super(scope, 'WorkflowChangeNoticeWorkflow');
+        const gh = scope.github;
+        if (!gh) {
+            throw new Error('WorkflowChangeNoticeWorkflow requires GitHub integration to be enabled');
+        }
+        const watchPaths = options.watchPaths ?? [
+            '.github/workflows/**',
+            '.github/actions/**',
+        ];
+        this.workflow = new projen_1.github.GithubWorkflow(gh, options.workflowName ?? 'workflow-change-notice');
+        this.workflow.on({ pullRequestTarget: {} });
+        this.workflow.addJob('check', {
+            runsOn: ['ubuntu-latest'],
+            permissions: { pullRequests: projen_1.github.workflows.JobPermission.WRITE },
+            env: {
+                GH_TOKEN: '${{ github.token }}',
+                WATCH_PATHS: watchPaths.join(' '),
+            },
+            steps: [
+                {
+                    name: 'Check for workflow/action changes',
+                    run: `set -uo pipefail
+changed="$(gh api --paginate "repos/\${GITHUB_REPOSITORY}/pulls/\${{ github.event.number }}/files" --jq '.[].filename')"
+if [ -z "$changed" ]; then exit 0; fi
+matches=""
+while IFS= read -r path; do
+  for p in $WATCH_PATHS; do
+    if [[ "$path" == $p ]]; then
+      matches="$matches$path
+"
+      break
+    fi
+  done
+done <<< "$changed"
+if [ -n "$matches" ]; then
+  {
+    echo "⚠️ NOTE for reviewers: this PR modifies GitHub Actions workflow or action files. Please review these changes carefully - they can alter or bypass standard build, test, and deployment checks:"
+    echo ""
+    printf "%s" "$matches" | sed "s/^/  - /"
+  } | gh pr comment "\${{ github.event.number }}" --body-file -
+fi
+`,
+                },
+            ],
+        });
+    }
+}
+exports.WorkflowChangeNoticeWorkflow = WorkflowChangeNoticeWorkflow;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoid29ya2Zsb3ctY2hhbmdlLW5vdGljZS13b3JrZmxvdy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9jb21tb24vd29ya2Zsb3ctY2hhbmdlLW5vdGljZS13b3JrZmxvdy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7O0FBQUEsbUNBQTJDO0FBZ0MzQyxNQUFhLDRCQUE2QixTQUFRLGtCQUFTOztJQUN6QyxRQUFRLENBQXdCO0lBRWhELFlBQ0UsS0FBMkIsRUFDM0IsVUFBK0MsRUFBRTtRQUVqRCxLQUFLLENBQUMsS0FBSyxFQUFFLDhCQUE4QixDQUFDLENBQUM7UUFFN0MsTUFBTSxFQUFFLEdBQUcsS0FBSyxDQUFDLE1BQU0sQ0FBQztRQUN4QixJQUFJLENBQUMsRUFBRSxFQUFFLENBQUM7WUFDUixNQUFNLElBQUksS0FBSyxDQUNiLHdFQUF3RSxDQUN6RSxDQUFDO1FBQ0osQ0FBQztRQUVELE1BQU0sVUFBVSxHQUFHLE9BQU8sQ0FBQyxVQUFVLElBQUk7WUFDdkMsc0JBQXNCO1lBQ3RCLG9CQUFvQjtTQUNyQixDQUFDO1FBRUYsSUFBSSxDQUFDLFFBQVEsR0FBRyxJQUFJLGVBQU0sQ0FBQyxjQUFjLENBQ3ZDLEVBQUUsRUFDRixPQUFPLENBQUMsWUFBWSxJQUFJLHdCQUF3QixDQUNqRCxDQUFDO1FBQ0YsSUFBSSxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUMsRUFBRSxpQkFBaUIsRUFBRSxFQUFFLEVBQUUsQ0FBQyxDQUFDO1FBQzVDLElBQUksQ0FBQyxRQUFRLENBQUMsTUFBTSxDQUFDLE9BQU8sRUFBRTtZQUM1QixNQUFNLEVBQUUsQ0FBQyxlQUFlLENBQUM7WUFDekIsV0FBVyxFQUFFLEVBQUUsWUFBWSxFQUFFLGVBQU0sQ0FBQyxTQUFTLENBQUMsYUFBYSxDQUFDLEtBQUssRUFBRTtZQUNuRSxHQUFHLEVBQUU7Z0JBQ0gsUUFBUSxFQUFFLHFCQUFxQjtnQkFDL0IsV0FBVyxFQUFFLFVBQVUsQ0FBQyxJQUFJLENBQUMsR0FBRyxDQUFDO2FBQ2xDO1lBQ0QsS0FBSyxFQUFFO2dCQUNMO29CQUNFLElBQUksRUFBRSxtQ0FBbUM7b0JBQ3pDLEdBQUcsRUFBRTs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Q0FvQmQ7aUJBQ1E7YUFDRjtTQUNGLENBQUMsQ0FBQztJQUNMLENBQUM7O0FBNURILG9FQTZEQyIsInNvdXJjZXNDb250ZW50IjpbImltcG9ydCB7IENvbXBvbmVudCwgZ2l0aHViIH0gZnJvbSAncHJvamVuJztcblxuLyoqXG4gKiBQUi10cmlnZ2VyZWQsIHRhbXBlci1wcm9vZiBub3RpY2UgdGhhdCBhIFBSIHRvdWNoZXMgR2l0SHViIEFjdGlvbnNcbiAqIHdvcmtmbG93IG9yIGFjdGlvbiBmaWxlcy5cbiAqXG4gKiBSdW5zIG9uIGBwdWxsX3JlcXVlc3RfdGFyZ2V0YCAoTk9UIGBwdWxsX3JlcXVlc3RgKSBzbyBpdCBhbHdheXMgZXhlY3V0ZXNcbiAqIHRoZSBjb3B5IG9mIHRoaXMgd29ya2Zsb3cgY29tbWl0dGVkIG9uIHRoZSBiYXNlIGJyYW5jaCAtIGEgUFIgY2Fubm90IGVkaXRcbiAqIHRoaXMgZmlsZSB0byBkaXNhYmxlIG9yIHdlYWtlbiB0aGUgbm90aWNlLiBJdCBjaGVja3Mgb3V0IGFuZCBleGVjdXRlc1xuICogbm90aGluZyBmcm9tIHRoZSBQUjsgaXQgb25seSBsaXN0cyB0aGUgY2hhbmdlZCBmaWxlbmFtZXMgdmlhIHRoZSBHaXRIdWJcbiAqIEFQSSBhbmQgcG9zdHMgYSBub24tYmxvY2tpbmcgTk9URS4gQmVjYXVzZSBgcHVsbF9yZXF1ZXN0X3RhcmdldGAgcnVucyB3aXRoXG4gKiB0aGUgYmFzZSByZXBvJ3Mgbm9ybWFsIHRva2VuIGV2ZW4gZm9yIGZvcmstb3JpZ2luYXRlZCBQUnMsIHRoZSBjb21tZW50XG4gKiBwb3N0cyByZWxpYWJseSB3aXRoIG5vIGRlZ3JhZGVkIGZhbGxiYWNrLlxuICpcbiAqIFRoaXMgY2hlY2sgTkVWRVIgZmFpbHMgdGhlIGJ1aWxkIC0gaXQgaXMgcHVyZWx5IGluZm9ybWF0aW9uYWwgKHJldmlld2VyXG4gKiBhdHRlbnRpb24pLiBJdCBpcyB0aGUgdGFtcGVyLXByb29mIGJhY2tzdG9wIHRoYXQgYm91bmRzIENoZWNrIDEnc1xuICogKGBQcm9qZW5EcmlmdENoZWNrV29ya2Zsb3dgKSByZXNpZHVhbCBleHBvc3VyZS4gU2VlIHRoZSBGMDAzIHNwZWMnc1xuICogU2VjdXJpdHkgc2VjdGlvbi5cbiAqL1xuZXhwb3J0IGludGVyZmFjZSBXb3JrZmxvd0NoYW5nZU5vdGljZVdvcmtmbG93T3B0aW9ucyB7XG4gIC8qKlxuICAgKiBHbG9iIHBhdHRlcm5zIChiYXNoIGBbWyBzdHJpbmcgPT0gcGF0dGVybiBdXWAgc2VtYW50aWNzLCB3aGVyZSBgKmAgYWxzb1xuICAgKiBtYXRjaGVzIGAvYCkgdGhhdCB0cmlnZ2VyIHRoZSBub3RpY2Ugd2hlbiBhIGNoYW5nZWQgUFIgZmlsZSBtYXRjaGVzIGFueVxuICAgKiBvZiB0aGVtLlxuICAgKiBAZGVmYXVsdCBbXCIuZ2l0aHViL3dvcmtmbG93cy8qKlwiLCBcIi5naXRodWIvYWN0aW9ucy8qKlwiXVxuICAgKi9cbiAgcmVhZG9ubHkgd2F0Y2hQYXRocz86IHN0cmluZ1tdO1xuXG4gIC8qKiBAZGVmYXVsdCBcIndvcmtmbG93LWNoYW5nZS1ub3RpY2VcIiAqL1xuICByZWFkb25seSB3b3JrZmxvd05hbWU/OiBzdHJpbmc7XG59XG5cbmV4cG9ydCBjbGFzcyBXb3JrZmxvd0NoYW5nZU5vdGljZVdvcmtmbG93IGV4dGVuZHMgQ29tcG9uZW50IHtcbiAgcHVibGljIHJlYWRvbmx5IHdvcmtmbG93OiBnaXRodWIuR2l0aHViV29ya2Zsb3c7XG5cbiAgY29uc3RydWN0b3IoXG4gICAgc2NvcGU6IGdpdGh1Yi5HaXRIdWJQcm9qZWN0LFxuICAgIG9wdGlvbnM6IFdvcmtmbG93Q2hhbmdlTm90aWNlV29ya2Zsb3dPcHRpb25zID0ge30sXG4gICkge1xuICAgIHN1cGVyKHNjb3BlLCAnV29ya2Zsb3dDaGFuZ2VOb3RpY2VXb3JrZmxvdycpO1xuXG4gICAgY29uc3QgZ2ggPSBzY29wZS5naXRodWI7XG4gICAgaWYgKCFnaCkge1xuICAgICAgdGhyb3cgbmV3IEVycm9yKFxuICAgICAgICAnV29ya2Zsb3dDaGFuZ2VOb3RpY2VXb3JrZmxvdyByZXF1aXJlcyBHaXRIdWIgaW50ZWdyYXRpb24gdG8gYmUgZW5hYmxlZCcsXG4gICAgICApO1xuICAgIH1cblxuICAgIGNvbnN0IHdhdGNoUGF0aHMgPSBvcHRpb25zLndhdGNoUGF0aHMgPz8gW1xuICAgICAgJy5naXRodWIvd29ya2Zsb3dzLyoqJyxcbiAgICAgICcuZ2l0aHViL2FjdGlvbnMvKionLFxuICAgIF07XG5cbiAgICB0aGlzLndvcmtmbG93ID0gbmV3IGdpdGh1Yi5HaXRodWJXb3JrZmxvdyhcbiAgICAgIGdoLFxuICAgICAgb3B0aW9ucy53b3JrZmxvd05hbWUgPz8gJ3dvcmtmbG93LWNoYW5nZS1ub3RpY2UnLFxuICAgICk7XG4gICAgdGhpcy53b3JrZmxvdy5vbih7IHB1bGxSZXF1ZXN0VGFyZ2V0OiB7fSB9KTtcbiAgICB0aGlzLndvcmtmbG93LmFkZEpvYignY2hlY2snLCB7XG4gICAgICBydW5zT246IFsndWJ1bnR1LWxhdGVzdCddLFxuICAgICAgcGVybWlzc2lvbnM6IHsgcHVsbFJlcXVlc3RzOiBnaXRodWIud29ya2Zsb3dzLkpvYlBlcm1pc3Npb24uV1JJVEUgfSxcbiAgICAgIGVudjoge1xuICAgICAgICBHSF9UT0tFTjogJyR7eyBnaXRodWIudG9rZW4gfX0nLFxuICAgICAgICBXQVRDSF9QQVRIUzogd2F0Y2hQYXRocy5qb2luKCcgJyksXG4gICAgICB9LFxuICAgICAgc3RlcHM6IFtcbiAgICAgICAge1xuICAgICAgICAgIG5hbWU6ICdDaGVjayBmb3Igd29ya2Zsb3cvYWN0aW9uIGNoYW5nZXMnLFxuICAgICAgICAgIHJ1bjogYHNldCAtdW8gcGlwZWZhaWxcbmNoYW5nZWQ9XCIkKGdoIGFwaSAtLXBhZ2luYXRlIFwicmVwb3MvXFwke0dJVEhVQl9SRVBPU0lUT1JZfS9wdWxscy9cXCR7eyBnaXRodWIuZXZlbnQubnVtYmVyIH19L2ZpbGVzXCIgLS1qcSAnLltdLmZpbGVuYW1lJylcIlxuaWYgWyAteiBcIiRjaGFuZ2VkXCIgXTsgdGhlbiBleGl0IDA7IGZpXG5tYXRjaGVzPVwiXCJcbndoaWxlIElGUz0gcmVhZCAtciBwYXRoOyBkb1xuICBmb3IgcCBpbiAkV0FUQ0hfUEFUSFM7IGRvXG4gICAgaWYgW1sgXCIkcGF0aFwiID09ICRwIF1dOyB0aGVuXG4gICAgICBtYXRjaGVzPVwiJG1hdGNoZXMkcGF0aFxuXCJcbiAgICAgIGJyZWFrXG4gICAgZmlcbiAgZG9uZVxuZG9uZSA8PDwgXCIkY2hhbmdlZFwiXG5pZiBbIC1uIFwiJG1hdGNoZXNcIiBdOyB0aGVuXG4gIHtcbiAgICBlY2hvIFwi4pqg77iPIE5PVEUgZm9yIHJldmlld2VyczogdGhpcyBQUiBtb2RpZmllcyBHaXRIdWIgQWN0aW9ucyB3b3JrZmxvdyBvciBhY3Rpb24gZmlsZXMuIFBsZWFzZSByZXZpZXcgdGhlc2UgY2hhbmdlcyBjYXJlZnVsbHkgLSB0aGV5IGNhbiBhbHRlciBvciBieXBhc3Mgc3RhbmRhcmQgYnVpbGQsIHRlc3QsIGFuZCBkZXBsb3ltZW50IGNoZWNrczpcIlxuICAgIGVjaG8gXCJcIlxuICAgIHByaW50ZiBcIiVzXCIgXCIkbWF0Y2hlc1wiIHwgc2VkIFwicy9eLyAgLSAvXCJcbiAgfSB8IGdoIHByIGNvbW1lbnQgXCJcXCR7eyBnaXRodWIuZXZlbnQubnVtYmVyIH19XCIgLS1ib2R5LWZpbGUgLVxuZmlcbmAsXG4gICAgICAgIH0sXG4gICAgICBdLFxuICAgIH0pO1xuICB9XG59XG4iXX0=

package/lib/index.d.ts

@@ -1,4 +1,8 @@
 export * from './common/environment-options';
+export * from './common/projen-drift-check-workflow';
+export * from './common/workflow-change-notice-workflow';
+export * from './common/internal-actions';
+export * from './common/actions-allowlist-guard';
 export * from './cdk/options';
 export * from './cdk/cdk-typescript-base';
 export * from './cdk/cdk-infra-project';
@@ -18,3 +22,7 @@ export * from './java/components/github-packages-publish';
 export * from './java/components/flyway-migration';
 export * from './java/components/cdk-deploy-hook';
 export * from './java/components/code-index-workflow';
+export * from './actions/github-action-project';
+export * from './actions/action-build-workflow';
+export * from './actions/action-dogfood-workflow';
+export * from './actions/action-sonar-workflow';

package/lib/index.js

@@ -15,6 +15,10 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 __exportStar(require("./common/environment-options"), exports);
+__exportStar(require("./common/projen-drift-check-workflow"), exports);
+__exportStar(require("./common/workflow-change-notice-workflow"), exports);
+__exportStar(require("./common/internal-actions"), exports);
+__exportStar(require("./common/actions-allowlist-guard"), exports);
 __exportStar(require("./cdk/options"), exports);
 __exportStar(require("./cdk/cdk-typescript-base"), exports);
 __exportStar(require("./cdk/cdk-infra-project"), exports);
@@ -34,4 +38,8 @@ __exportStar(require("./java/components/github-packages-publish"), exports);
 __exportStar(require("./java/components/flyway-migration"), exports);
 __exportStar(require("./java/components/cdk-deploy-hook"), exports);
 __exportStar(require("./java/components/code-index-workflow"), exports);
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi9zcmMvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7Ozs7Ozs7Ozs7OztBQUFBLCtEQUE2QztBQUU3QyxnREFBOEI7QUFDOUIsNERBQTBDO0FBQzFDLDBEQUF3QztBQUN4Qyx3REFBc0M7QUFDdEMsc0VBQW9EO0FBQ3BELDhFQUE0RDtBQUM1RCw2REFBMkM7QUFDM0MsMkRBQXlDO0FBRXpDLGlEQUErQjtBQUMvQix5REFBdUM7QUFDdkMsOERBQTRDO0FBQzVDLDhEQUE0QztBQUM1QywwREFBd0M7QUFDeEMsMEVBQXdEO0FBQ3hELG1FQUFpRDtBQUNqRCw0RUFBMEQ7QUFDMUQscUVBQW1EO0FBQ25ELG9FQUFrRDtBQUNsRCx3RUFBc0QiLCJzb3VyY2VzQ29udGVudCI6WyJleHBvcnQgKiBmcm9tICcuL2NvbW1vbi9lbnZpcm9ubWVudC1vcHRpb25zJztcblxuZXhwb3J0ICogZnJvbSAnLi9jZGsvb3B0aW9ucyc7XG5leHBvcnQgKiBmcm9tICcuL2Nkay9jZGstdHlwZXNjcmlwdC1iYXNlJztcbmV4cG9ydCAqIGZyb20gJy4vY2RrL2Nkay1pbmZyYS1wcm9qZWN0JztcbmV4cG9ydCAqIGZyb20gJy4vY2RrL2Nkay1hcHAtcHJvamVjdCc7XG5leHBvcnQgKiBmcm9tICcuL2Nkay9jb21wb25lbnRzL2Vjci1lY3MtY29uc3RydWN0cyc7XG5leHBvcnQgKiBmcm9tICcuL2Nkay9jb21wb25lbnRzL2VkZ2UtbmV0d29ya2luZy1jb25zdHJ1Y3RzJztcbmV4cG9ydCAqIGZyb20gJy4vY2RrL2FwcC1ydW50aW1lLXNjYWZmb2xkJztcbmV4cG9ydCAqIGZyb20gJy4vY2RrL2RhdGFiYXNlLWNvbXBvbmVudCc7XG5cbmV4cG9ydCAqIGZyb20gJy4vamF2YS9vcHRpb25zJztcbmV4cG9ydCAqIGZyb20gJy4vamF2YS9qYXZhLW1hdmVuLWJhc2UnO1xuZXhwb3J0ICogZnJvbSAnLi9qYXZhL2phdmEtbGlicmFyeS1wcm9qZWN0JztcbmV4cG9ydCAqIGZyb20gJy4vamF2YS9qYXZhLXNlcnZpY2UtcHJvamVjdCc7XG5leHBvcnQgKiBmcm9tICcuL2phdmEvamF2YS1hcHAtcHJvamVjdCc7XG5leHBvcnQgKiBmcm9tICcuL2phdmEvY29tcG9uZW50cy9tYXZlbi1jZW50cmFsLXB1Ymxpc2gnO1xuZXhwb3J0ICogZnJvbSAnLi9qYXZhL2NvbXBvbmVudHMvZG9ja2VyLXB1Ymxpc2gnO1xuZXhwb3J0ICogZnJvbSAnLi9qYXZhL2NvbXBvbmVudHMvZ2l0aHViLXBhY2thZ2VzLXB1Ymxpc2gnO1xuZXhwb3J0ICogZnJvbSAnLi9qYXZhL2NvbXBvbmVudHMvZmx5d2F5LW1pZ3JhdGlvbic7XG5leHBvcnQgKiBmcm9tICcuL2phdmEvY29tcG9uZW50cy9jZGstZGVwbG95LWhvb2snO1xuZXhwb3J0ICogZnJvbSAnLi9qYXZhL2NvbXBvbmVudHMvY29kZS1pbmRleC13b3JrZmxvdyc7XG5cbiJdfQ==
+__exportStar(require("./actions/github-action-project"), exports);
+__exportStar(require("./actions/action-build-workflow"), exports);
+__exportStar(require("./actions/action-dogfood-workflow"), exports);
+__exportStar(require("./actions/action-sonar-workflow"), exports);
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi9zcmMvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7Ozs7Ozs7Ozs7OztBQUFBLCtEQUE2QztBQUM3Qyx1RUFBcUQ7QUFDckQsMkVBQXlEO0FBQ3pELDREQUEwQztBQUMxQyxtRUFBaUQ7QUFFakQsZ0RBQThCO0FBQzlCLDREQUEwQztBQUMxQywwREFBd0M7QUFDeEMsd0RBQXNDO0FBQ3RDLHNFQUFvRDtBQUNwRCw4RUFBNEQ7QUFDNUQsNkRBQTJDO0FBQzNDLDJEQUF5QztBQUV6QyxpREFBK0I7QUFDL0IseURBQXVDO0FBQ3ZDLDhEQUE0QztBQUM1Qyw4REFBNEM7QUFDNUMsMERBQXdDO0FBQ3hDLDBFQUF3RDtBQUN4RCxtRUFBaUQ7QUFDakQsNEVBQTBEO0FBQzFELHFFQUFtRDtBQUNuRCxvRUFBa0Q7QUFDbEQsd0VBQXNEO0FBRXRELGtFQUFnRDtBQUNoRCxrRUFBZ0Q7QUFDaEQsb0VBQWtEO0FBQ2xELGtFQUFnRCIsInNvdXJjZXNDb250ZW50IjpbImV4cG9ydCAqIGZyb20gJy4vY29tbW9uL2Vudmlyb25tZW50LW9wdGlvbnMnO1xuZXhwb3J0ICogZnJvbSAnLi9jb21tb24vcHJvamVuLWRyaWZ0LWNoZWNrLXdvcmtmbG93JztcbmV4cG9ydCAqIGZyb20gJy4vY29tbW9uL3dvcmtmbG93LWNoYW5nZS1ub3RpY2Utd29ya2Zsb3cnO1xuZXhwb3J0ICogZnJvbSAnLi9jb21tb24vaW50ZXJuYWwtYWN0aW9ucyc7XG5leHBvcnQgKiBmcm9tICcuL2NvbW1vbi9hY3Rpb25zLWFsbG93bGlzdC1ndWFyZCc7XG5cbmV4cG9ydCAqIGZyb20gJy4vY2RrL29wdGlvbnMnO1xuZXhwb3J0ICogZnJvbSAnLi9jZGsvY2RrLXR5cGVzY3JpcHQtYmFzZSc7XG5leHBvcnQgKiBmcm9tICcuL2Nkay9jZGstaW5mcmEtcHJvamVjdCc7XG5leHBvcnQgKiBmcm9tICcuL2Nkay9jZGstYXBwLXByb2plY3QnO1xuZXhwb3J0ICogZnJvbSAnLi9jZGsvY29tcG9uZW50cy9lY3ItZWNzLWNvbnN0cnVjdHMnO1xuZXhwb3J0ICogZnJvbSAnLi9jZGsvY29tcG9uZW50cy9lZGdlLW5ldHdvcmtpbmctY29uc3RydWN0cyc7XG5leHBvcnQgKiBmcm9tICcuL2Nkay9hcHAtcnVudGltZS1zY2FmZm9sZCc7XG5leHBvcnQgKiBmcm9tICcuL2Nkay9kYXRhYmFzZS1jb21wb25lbnQnO1xuXG5leHBvcnQgKiBmcm9tICcuL2phdmEvb3B0aW9ucyc7XG5leHBvcnQgKiBmcm9tICcuL2phdmEvamF2YS1tYXZlbi1iYXNlJztcbmV4cG9ydCAqIGZyb20gJy4vamF2YS9qYXZhLWxpYnJhcnktcHJvamVjdCc7XG5leHBvcnQgKiBmcm9tICcuL2phdmEvamF2YS1zZXJ2aWNlLXByb2plY3QnO1xuZXhwb3J0ICogZnJvbSAnLi9qYXZhL2phdmEtYXBwLXByb2plY3QnO1xuZXhwb3J0ICogZnJvbSAnLi9qYXZhL2NvbXBvbmVudHMvbWF2ZW4tY2VudHJhbC1wdWJsaXNoJztcbmV4cG9ydCAqIGZyb20gJy4vamF2YS9jb21wb25lbnRzL2RvY2tlci1wdWJsaXNoJztcbmV4cG9ydCAqIGZyb20gJy4vamF2YS9jb21wb25lbnRzL2dpdGh1Yi1wYWNrYWdlcy1wdWJsaXNoJztcbmV4cG9ydCAqIGZyb20gJy4vamF2YS9jb21wb25lbnRzL2ZseXdheS1taWdyYXRpb24nO1xuZXhwb3J0ICogZnJvbSAnLi9qYXZhL2NvbXBvbmVudHMvY2RrLWRlcGxveS1ob29rJztcbmV4cG9ydCAqIGZyb20gJy4vamF2YS9jb21wb25lbnRzL2NvZGUtaW5kZXgtd29ya2Zsb3cnO1xuXG5leHBvcnQgKiBmcm9tICcuL2FjdGlvbnMvZ2l0aHViLWFjdGlvbi1wcm9qZWN0JztcbmV4cG9ydCAqIGZyb20gJy4vYWN0aW9ucy9hY3Rpb24tYnVpbGQtd29ya2Zsb3cnO1xuZXhwb3J0ICogZnJvbSAnLi9hY3Rpb25zL2FjdGlvbi1kb2dmb29kLXdvcmtmbG93JztcbmV4cG9ydCAqIGZyb20gJy4vYWN0aW9ucy9hY3Rpb24tc29uYXItd29ya2Zsb3cnO1xuXG4iXX0=

package/lib/java/components/cdk-deploy-hook.js

@@ -11,7 +11,7 @@ const manual_deploy_workflow_1 = require("../../common/manual-deploy-workflow");
  * deploys - see the CDK spec's open question about sharing this contract.
  */
 class CdkDeployHook extends projen_1.Component {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "@xpertss/projen-types.CdkDeployHook", version: "0.0.0" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@xpertss/projen-types.CdkDeployHook", version: "0.0.2" };
     constructor(project, environments, options = {}) {
         super(project, 'CdkDeployHook');
         if (!options.targetRepo) {

package/lib/java/components/code-index-workflow.js

@@ -5,7 +5,7 @@ const JSII_RTTI_SYMBOL_1 = Symbol.for("jsii.rtti");
 const projen_1 = require("projen");
 /** Generates a code index and publishes it to `.cai/` on checkin. */
 class CodeIndexWorkflow extends projen_1.Component {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "@xpertss/projen-types.CodeIndexWorkflow", version: "0.0.0" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@xpertss/projen-types.CodeIndexWorkflow", version: "0.0.2" };
     constructor(project) {
         super(project, 'CodeIndexWorkflow');
         const gh = project.github;

package/lib/java/components/docker-publish.js

@@ -5,7 +5,7 @@ const JSII_RTTI_SYMBOL_1 = Symbol.for("jsii.rtti");
 const projen_1 = require("projen");
 /** On-demand build+push of a Docker image, defaulting to Docker Hub. */
 class DockerPublish extends projen_1.Component {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "@xpertss/projen-types.DockerPublish", version: "0.0.0" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@xpertss/projen-types.DockerPublish", version: "0.0.2" };
     constructor(project, options = {}) {
         super(project, 'DockerPublish');
         const gh = project.github;

package/lib/java/components/flyway-migration.js

@@ -5,7 +5,7 @@ const JSII_RTTI_SYMBOL_1 = Symbol.for("jsii.rtti");
 const projen_1 = require("projen");
 /** Adds Flyway config/dependencies + a migrations directory for DB migrations. */
 class FlywayMigration extends projen_1.Component {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "@xpertss/projen-types.FlywayMigration", version: "0.0.0" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@xpertss/projen-types.FlywayMigration", version: "0.0.2" };
     constructor(project) {
         super(project, 'FlywayMigration');
         project.pom.addPlugin('org.flywaydb/flyway-maven-plugin@^10');

package/lib/java/components/github-packages-publish.js

@@ -5,7 +5,7 @@ const JSII_RTTI_SYMBOL_1 = Symbol.for("jsii.rtti");
 const projen_1 = require("projen");
 /** On-demand publish to GitHub Packages. */
 class GitHubPackagesPublish extends projen_1.Component {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "@xpertss/projen-types.GitHubPackagesPublish", version: "0.0.0" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@xpertss/projen-types.GitHubPackagesPublish", version: "0.0.2" };
     constructor(project, options = {}) {
         super(project, 'GitHubPackagesPublish');
         const gh = project.github;

package/lib/java/components/maven-central-publish.js

@@ -8,7 +8,7 @@ const projen_1 = require("projen");
  * or OIDC trusted publishing.
  */
 class MavenCentralPublish extends projen_1.Component {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "@xpertss/projen-types.MavenCentralPublish", version: "0.0.0" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@xpertss/projen-types.MavenCentralPublish", version: "0.0.2" };
     constructor(project, options = {}) {
         super(project, 'MavenCentralPublish');
         const gh = project.github;

package/lib/java/java-app-project.js

@@ -9,7 +9,7 @@ const java_maven_base_1 = require("./java-maven-base");
  * explicitly excludes Maven Central, Docker, and CDK deploy hooks.
  */
 class JavaAppProject extends java_maven_base_1.JavaMavenProject {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "@xpertss/projen-types.JavaAppProject", version: "0.0.0" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@xpertss/projen-types.JavaAppProject", version: "0.0.2" };
     constructor(options) {
         super(options);
         new github_packages_publish_1.GitHubPackagesPublish(this, {

package/lib/java/java-library-project.js

@@ -7,7 +7,7 @@ const maven_central_publish_1 = require("./components/maven-central-publish");
 const java_maven_base_1 = require("./java-maven-base");
 /** Reusable Java library, published to Maven Central. */
 class JavaLibraryProject extends java_maven_base_1.JavaMavenProject {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "@xpertss/projen-types.JavaLibraryProject", version: "0.0.0" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@xpertss/projen-types.JavaLibraryProject", version: "0.0.2" };
     constructor(options) {
         super(options);
         new maven_central_publish_1.MavenCentralPublish(this, { mavenCentralOidc: options.mavenCentralOidc });

package/lib/java/java-maven-base.js

@@ -3,9 +3,12 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.JavaMavenProject = void 0;
 const JSII_RTTI_SYMBOL_1 = Symbol.for("jsii.rtti");
 const projen_1 = require("projen");
+const actions_allowlist_guard_1 = require("../common/actions-allowlist-guard");
 const constants_1 = require("../common/constants");
-const drift_check_1 = require("../common/drift-check");
+const internal_actions_1 = require("../common/internal-actions");
+const projen_drift_check_workflow_1 = require("../common/projen-drift-check-workflow");
 const upgrade_workflow_1 = require("../common/upgrade-workflow");
+const workflow_change_notice_workflow_1 = require("../common/workflow-change-notice-workflow");
 /**
  * Shared Maven build skeleton for all three Java project types: standard
  * `pom.xml`/directory layout (via `java.JavaProject`), a PR-triggered
@@ -13,7 +16,7 @@ const upgrade_workflow_1 = require("../common/upgrade-workflow");
  * nightly dependency-upgrade workflow.
  */
 class JavaMavenProject extends projen_1.java.JavaProject {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "@xpertss/projen-types.JavaMavenProject", version: "0.0.0" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@xpertss/projen-types.JavaMavenProject", version: "0.0.2" };
     upgradeTask;
     buildVerifyWorkflow;
     constructor(options) {
@@ -30,7 +33,13 @@ class JavaMavenProject extends projen_1.java.JavaProject {
         if (!gh) {
             throw new Error('JavaMavenProject requires GitHub integration');
         }
-        const postBuildSteps = [...(0, drift_check_1.driftCheckSteps)()];
+        (0, internal_actions_1.applyInternalActionOverrides)(gh);
+        new projen_drift_check_workflow_1.ProjenDriftCheckWorkflow(this, {
+            gheTokenSecret: options.gheTokenSecret ?? constants_1.DEFAULT_GHE_TOKEN_SECRET,
+        });
+        new workflow_change_notice_workflow_1.WorkflowChangeNoticeWorkflow(this);
+        new actions_allowlist_guard_1.ActionsAllowlistGuard(this);
+        const postBuildSteps = [];
         if (options.sonarProjectKey) {
             postBuildSteps.push({
                 name: 'SonarQube scan',
@@ -53,4 +62,4 @@ class JavaMavenProject extends projen_1.java.JavaProject {
     }
 }
 exports.JavaMavenProject = JavaMavenProject;
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiamF2YS1tYXZlbi1iYXNlLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL2phdmEvamF2YS1tYXZlbi1iYXNlLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7Ozs7QUFBQSxtQ0FBNEM7QUFFNUMsbURBQStEO0FBQy9ELHVEQUF3RDtBQUN4RCxpRUFBNkQ7QUFJN0Q7Ozs7O0dBS0c7QUFDSCxNQUFhLGdCQUFpQixTQUFRLGFBQUksQ0FBQyxXQUFXOztJQUNwQyxXQUFXLENBQU87SUFDbEIsbUJBQW1CLENBQXNCO0lBRXpELFlBQVksT0FBZ0M7UUFDMUMsS0FBSyxDQUFDO1lBQ0osSUFBSSxFQUFFLE9BQU8sQ0FBQyxJQUFJO1lBQ2xCLE9BQU8sRUFBRSxPQUFPLENBQUMsT0FBTztZQUN4QixVQUFVLEVBQUUsT0FBTyxDQUFDLFVBQVU7WUFDOUIsT0FBTyxFQUFFLE9BQU8sQ0FBQyxPQUFPLElBQUksT0FBTztZQUNuQyxpQkFBaUIsRUFBRSxlQUFNLENBQUMsaUJBQWlCLENBQUMsdUJBQXVCLENBQUM7Z0JBQ2xFLE1BQU0sRUFBRSxPQUFPLENBQUMsY0FBYyxJQUFJLG9DQUF3QjthQUMzRCxDQUFDO1NBQ0gsQ0FBQyxDQUFDO1FBRUgsTUFBTSxFQUFFLEdBQUcsSUFBSSxDQUFDLE1BQU0sQ0FBQztRQUN2QixJQUFJLENBQUMsRUFBRSxFQUFFLENBQUM7WUFDUixNQUFNLElBQUksS0FBSyxDQUFDLDhDQUE4QyxDQUFDLENBQUM7UUFDbEUsQ0FBQztRQUVELE1BQU0sY0FBYyxHQUFHLENBQUMsR0FBRyxJQUFBLDZCQUFlLEdBQUUsQ0FBQyxDQUFDO1FBQzlDLElBQUksT0FBTyxDQUFDLGVBQWUsRUFBRSxDQUFDO1lBQzVCLGNBQWMsQ0FBQyxJQUFJLENBQUM7Z0JBQ2xCLElBQUksRUFBRSxnQkFBZ0I7Z0JBQ3RCLEdBQUcsRUFBRSx5Q0FBeUMsT0FBTyxDQUFDLGVBQWUsRUFBRTtnQkFDdkUsR0FBRyxFQUFFLEVBQUUsV0FBVyxFQUFFLDRCQUE0QixFQUFFO2FBQ25ELENBQUMsQ0FBQztRQUNMLENBQUM7UUFFRCxJQUFJLENBQUMsbUJBQW1CLEdBQUcsSUFBSSxlQUFNLENBQUMsWUFBWSxDQUFDLEVBQUUsRUFBRTtZQUNyRCxJQUFJLEVBQUUsT0FBTztZQUNiLEtBQUssRUFBRSxPQUFPO1lBQ2QsSUFBSSxFQUFFLElBQUksQ0FBQyxTQUFTO1lBQ3BCLFFBQVEsRUFBRSxFQUFFLFdBQVcsRUFBRSxFQUFFLEVBQUUsZ0JBQWdCLEVBQUUsRUFBRSxFQUFFO1lBQ25ELFdBQVcsRUFBRSxFQUFFLFFBQVEsRUFBRSxlQUFNLENBQUMsU0FBUyxDQUFDLGFBQWEsQ0FBQyxJQUFJLEVBQUU7WUFDOUQsY0FBYztTQUNmLENBQUMsQ0FBQztRQUVILElBQUksQ0FBQyxXQUFXLEdBQUcsSUFBSSxDQUFDLE9BQU8sQ0FBQyxTQUFTLEVBQUU7WUFDekMsSUFBSSxFQUFFLGdFQUFnRTtTQUN2RSxDQUFDLENBQUM7UUFDSCxJQUFJLGtDQUFlLENBQUMsSUFBSSxFQUFFLEVBQUUsSUFBSSxFQUFFLElBQUksQ0FBQyxXQUFXLEVBQUUsQ0FBQyxDQUFDO0lBQ3hELENBQUM7O0FBMUNILDRDQTJDQyIsInNvdXJjZXNDb250ZW50IjpbImltcG9ydCB7IFRhc2ssIGdpdGh1YiwgamF2YSB9IGZyb20gJ3Byb2plbic7XG5pbXBvcnQgeyBDb21tb25KYXZhT3B0aW9ucyB9IGZyb20gJy4vb3B0aW9ucyc7XG5pbXBvcnQgeyBERUZBVUxUX0dIRV9UT0tFTl9TRUNSRVQgfSBmcm9tICcuLi9jb21tb24vY29uc3RhbnRzJztcbmltcG9ydCB7IGRyaWZ0Q2hlY2tTdGVwcyB9IGZyb20gJy4uL2NvbW1vbi9kcmlmdC1jaGVjayc7XG5pbXBvcnQgeyBVcGdyYWRlV29ya2Zsb3cgfSBmcm9tICcuLi9jb21tb24vdXBncmFkZS13b3JrZmxvdyc7XG5cbmV4cG9ydCBpbnRlcmZhY2UgSmF2YU1hdmVuUHJvamVjdE9wdGlvbnMgZXh0ZW5kcyBDb21tb25KYXZhT3B0aW9ucyB7fVxuXG4vKipcbiAqIFNoYXJlZCBNYXZlbiBidWlsZCBza2VsZXRvbiBmb3IgYWxsIHRocmVlIEphdmEgcHJvamVjdCB0eXBlczogc3RhbmRhcmRcbiAqIGBwb20ueG1sYC9kaXJlY3RvcnkgbGF5b3V0ICh2aWEgYGphdmEuSmF2YVByb2plY3RgKSwgYSBQUi10cmlnZ2VyZWRcbiAqIGJ1aWxkK3Rlc3QoK1NvbmFyUXViZSkgd29ya2Zsb3cgdGhhdCBoYXJkLWZhaWxzIG9uIHByb2plbiBkcmlmdCwgYW5kIGFcbiAqIG5pZ2h0bHkgZGVwZW5kZW5jeS11cGdyYWRlIHdvcmtmbG93LlxuICovXG5leHBvcnQgY2xhc3MgSmF2YU1hdmVuUHJvamVjdCBleHRlbmRzIGphdmEuSmF2YVByb2plY3Qge1xuICBwdWJsaWMgcmVhZG9ubHkgdXBncmFkZVRhc2s6IFRhc2s7XG4gIHB1YmxpYyByZWFkb25seSBidWlsZFZlcmlmeVdvcmtmbG93OiBnaXRodWIuVGFza1dvcmtmbG93O1xuXG4gIGNvbnN0cnVjdG9yKG9wdGlvbnM6IEphdmFNYXZlblByb2plY3RPcHRpb25zKSB7XG4gICAgc3VwZXIoe1xuICAgICAgbmFtZTogb3B0aW9ucy5uYW1lLFxuICAgICAgZ3JvdXBJZDogb3B0aW9ucy5ncm91cElkLFxuICAgICAgYXJ0aWZhY3RJZDogb3B0aW9ucy5hcnRpZmFjdElkLFxuICAgICAgdmVyc2lvbjogb3B0aW9ucy52ZXJzaW9uID8/ICcwLjEuMCcsXG4gICAgICBwcm9qZW5DcmVkZW50aWFsczogZ2l0aHViLkdpdGh1YkNyZWRlbnRpYWxzLmZyb21QZXJzb25hbEFjY2Vzc1Rva2VuKHtcbiAgICAgICAgc2VjcmV0OiBvcHRpb25zLmdoZVRva2VuU2VjcmV0ID8/IERFRkFVTFRfR0hFX1RPS0VOX1NFQ1JFVCxcbiAgICAgIH0pLFxuICAgIH0pO1xuXG4gICAgY29uc3QgZ2ggPSB0aGlzLmdpdGh1YjtcbiAgICBpZiAoIWdoKSB7XG4gICAgICB0aHJvdyBuZXcgRXJyb3IoJ0phdmFNYXZlblByb2plY3QgcmVxdWlyZXMgR2l0SHViIGludGVncmF0aW9uJyk7XG4gICAgfVxuXG4gICAgY29uc3QgcG9zdEJ1aWxkU3RlcHMgPSBbLi4uZHJpZnRDaGVja1N0ZXBzKCldO1xuICAgIGlmIChvcHRpb25zLnNvbmFyUHJvamVjdEtleSkge1xuICAgICAgcG9zdEJ1aWxkU3RlcHMucHVzaCh7XG4gICAgICAgIG5hbWU6ICdTb25hclF1YmUgc2NhbicsXG4gICAgICAgIHJ1bjogYG12biAtQiBzb25hcjpzb25hciAtRHNvbmFyLnByb2plY3RLZXk9JHtvcHRpb25zLnNvbmFyUHJvamVjdEtleX1gLFxuICAgICAgICBlbnY6IHsgU09OQVJfVE9LRU46ICcke3sgc2VjcmV0cy5TT05BUl9UT0tFTiB9fScgfSxcbiAgICAgIH0pO1xuICAgIH1cblxuICAgIHRoaXMuYnVpbGRWZXJpZnlXb3JrZmxvdyA9IG5ldyBnaXRodWIuVGFza1dvcmtmbG93KGdoLCB7XG4gICAgICBuYW1lOiAnYnVpbGQnLFxuICAgICAgam9iSWQ6ICdidWlsZCcsXG4gICAgICB0YXNrOiB0aGlzLmJ1aWxkVGFzayxcbiAgICAgIHRyaWdnZXJzOiB7IHB1bGxSZXF1ZXN0OiB7fSwgd29ya2Zsb3dEaXNwYXRjaDoge30gfSxcbiAgICAgIHBlcm1pc3Npb25zOiB7IGNvbnRlbnRzOiBnaXRodWIud29ya2Zsb3dzLkpvYlBlcm1pc3Npb24uUkVBRCB9LFxuICAgICAgcG9zdEJ1aWxkU3RlcHMsXG4gICAgfSk7XG5cbiAgICB0aGlzLnVwZ3JhZGVUYXNrID0gdGhpcy5hZGRUYXNrKCd1cGdyYWRlJywge1xuICAgICAgZXhlYzogJ212biAtQiB2ZXJzaW9uczp1c2UtbGF0ZXN0LXJlbGVhc2VzIHZlcnNpb25zOnVwZGF0ZS1wcm9wZXJ0aWVzJyxcbiAgICB9KTtcbiAgICBuZXcgVXBncmFkZVdvcmtmbG93KHRoaXMsIHsgdGFzazogdGhpcy51cGdyYWRlVGFzayB9KTtcbiAgfVxufVxuIl19
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiamF2YS1tYXZlbi1iYXNlLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL2phdmEvamF2YS1tYXZlbi1iYXNlLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7Ozs7QUFBQSxtQ0FBNEM7QUFFNUMsK0VBQTBFO0FBQzFFLG1EQUErRDtBQUMvRCxpRUFBMEU7QUFDMUUsdUZBQWlGO0FBQ2pGLGlFQUE2RDtBQUM3RCwrRkFBeUY7QUFJekY7Ozs7O0dBS0c7QUFDSCxNQUFhLGdCQUFpQixTQUFRLGFBQUksQ0FBQyxXQUFXOztJQUNwQyxXQUFXLENBQU87SUFDbEIsbUJBQW1CLENBQXNCO0lBRXpELFlBQVksT0FBZ0M7UUFDMUMsS0FBSyxDQUFDO1lBQ0osSUFBSSxFQUFFLE9BQU8sQ0FBQyxJQUFJO1lBQ2xCLE9BQU8sRUFBRSxPQUFPLENBQUMsT0FBTztZQUN4QixVQUFVLEVBQUUsT0FBTyxDQUFDLFVBQVU7WUFDOUIsT0FBTyxFQUFFLE9BQU8sQ0FBQyxPQUFPLElBQUksT0FBTztZQUNuQyxpQkFBaUIsRUFBRSxlQUFNLENBQUMsaUJBQWlCLENBQUMsdUJBQXVCLENBQUM7Z0JBQ2xFLE1BQU0sRUFBRSxPQUFPLENBQUMsY0FBYyxJQUFJLG9DQUF3QjthQUMzRCxDQUFDO1NBQ0gsQ0FBQyxDQUFDO1FBRUgsTUFBTSxFQUFFLEdBQUcsSUFBSSxDQUFDLE1BQU0sQ0FBQztRQUN2QixJQUFJLENBQUMsRUFBRSxFQUFFLENBQUM7WUFDUixNQUFNLElBQUksS0FBSyxDQUFDLDhDQUE4QyxDQUFDLENBQUM7UUFDbEUsQ0FBQztRQUVELElBQUEsK0NBQTRCLEVBQUMsRUFBRSxDQUFDLENBQUM7UUFFakMsSUFBSSxzREFBd0IsQ0FBQyxJQUFJLEVBQUU7WUFDakMsY0FBYyxFQUFFLE9BQU8sQ0FBQyxjQUFjLElBQUksb0NBQXdCO1NBQ25FLENBQUMsQ0FBQztRQUNILElBQUksOERBQTRCLENBQUMsSUFBSSxDQUFDLENBQUM7UUFDdkMsSUFBSSwrQ0FBcUIsQ0FBQyxJQUFJLENBQUMsQ0FBQztRQUVoQyxNQUFNLGNBQWMsR0FBK0IsRUFBRSxDQUFDO1FBQ3RELElBQUksT0FBTyxDQUFDLGVBQWUsRUFBRSxDQUFDO1lBQzVCLGNBQWMsQ0FBQyxJQUFJLENBQUM7Z0JBQ2xCLElBQUksRUFBRSxnQkFBZ0I7Z0JBQ3RCLEdBQUcsRUFBRSx5Q0FBeUMsT0FBTyxDQUFDLGVBQWUsRUFBRTtnQkFDdkUsR0FBRyxFQUFFLEVBQUUsV0FBVyxFQUFFLDRCQUE0QixFQUFFO2FBQ25ELENBQUMsQ0FBQztRQUNMLENBQUM7UUFFRCxJQUFJLENBQUMsbUJBQW1CLEdBQUcsSUFBSSxlQUFNLENBQUMsWUFBWSxDQUFDLEVBQUUsRUFBRTtZQUNyRCxJQUFJLEVBQUUsT0FBTztZQUNiLEtBQUssRUFBRSxPQUFPO1lBQ2QsSUFBSSxFQUFFLElBQUksQ0FBQyxTQUFTO1lBQ3BCLFFBQVEsRUFBRSxFQUFFLFdBQVcsRUFBRSxFQUFFLEVBQUUsZ0JBQWdCLEVBQUUsRUFBRSxFQUFFO1lBQ25ELFdBQVcsRUFBRSxFQUFFLFFBQVEsRUFBRSxlQUFNLENBQUMsU0FBUyxDQUFDLGFBQWEsQ0FBQyxJQUFJLEVBQUU7WUFDOUQsY0FBYztTQUNmLENBQUMsQ0FBQztRQUVILElBQUksQ0FBQyxXQUFXLEdBQUcsSUFBSSxDQUFDLE9BQU8sQ0FBQyxTQUFTLEVBQUU7WUFDekMsSUFBSSxFQUFFLGdFQUFnRTtTQUN2RSxDQUFDLENBQUM7UUFDSCxJQUFJLGtDQUFlLENBQUMsSUFBSSxFQUFFLEVBQUUsSUFBSSxFQUFFLElBQUksQ0FBQyxXQUFXLEVBQUUsQ0FBQyxDQUFDO0lBQ3hELENBQUM7O0FBbERILDRDQW1EQyIsInNvdXJjZXNDb250ZW50IjpbImltcG9ydCB7IFRhc2ssIGdpdGh1YiwgamF2YSB9IGZyb20gJ3Byb2plbic7XG5pbXBvcnQgeyBDb21tb25KYXZhT3B0aW9ucyB9IGZyb20gJy4vb3B0aW9ucyc7XG5pbXBvcnQgeyBBY3Rpb25zQWxsb3dsaXN0R3VhcmQgfSBmcm9tICcuLi9jb21tb24vYWN0aW9ucy1hbGxvd2xpc3QtZ3VhcmQnO1xuaW1wb3J0IHsgREVGQVVMVF9HSEVfVE9LRU5fU0VDUkVUIH0gZnJvbSAnLi4vY29tbW9uL2NvbnN0YW50cyc7XG5pbXBvcnQgeyBhcHBseUludGVybmFsQWN0aW9uT3ZlcnJpZGVzIH0gZnJvbSAnLi4vY29tbW9uL2ludGVybmFsLWFjdGlvbnMnO1xuaW1wb3J0IHsgUHJvamVuRHJpZnRDaGVja1dvcmtmbG93IH0gZnJvbSAnLi4vY29tbW9uL3Byb2plbi1kcmlmdC1jaGVjay13b3JrZmxvdyc7XG5pbXBvcnQgeyBVcGdyYWRlV29ya2Zsb3cgfSBmcm9tICcuLi9jb21tb24vdXBncmFkZS13b3JrZmxvdyc7XG5pbXBvcnQgeyBXb3JrZmxvd0NoYW5nZU5vdGljZVdvcmtmbG93IH0gZnJvbSAnLi4vY29tbW9uL3dvcmtmbG93LWNoYW5nZS1ub3RpY2Utd29ya2Zsb3cnO1xuXG5leHBvcnQgaW50ZXJmYWNlIEphdmFNYXZlblByb2plY3RPcHRpb25zIGV4dGVuZHMgQ29tbW9uSmF2YU9wdGlvbnMge31cblxuLyoqXG4gKiBTaGFyZWQgTWF2ZW4gYnVpbGQgc2tlbGV0b24gZm9yIGFsbCB0aHJlZSBKYXZhIHByb2plY3QgdHlwZXM6IHN0YW5kYXJkXG4gKiBgcG9tLnhtbGAvZGlyZWN0b3J5IGxheW91dCAodmlhIGBqYXZhLkphdmFQcm9qZWN0YCksIGEgUFItdHJpZ2dlcmVkXG4gKiBidWlsZCt0ZXN0KCtTb25hclF1YmUpIHdvcmtmbG93IHRoYXQgaGFyZC1mYWlscyBvbiBwcm9qZW4gZHJpZnQsIGFuZCBhXG4gKiBuaWdodGx5IGRlcGVuZGVuY3ktdXBncmFkZSB3b3JrZmxvdy5cbiAqL1xuZXhwb3J0IGNsYXNzIEphdmFNYXZlblByb2plY3QgZXh0ZW5kcyBqYXZhLkphdmFQcm9qZWN0IHtcbiAgcHVibGljIHJlYWRvbmx5IHVwZ3JhZGVUYXNrOiBUYXNrO1xuICBwdWJsaWMgcmVhZG9ubHkgYnVpbGRWZXJpZnlXb3JrZmxvdzogZ2l0aHViLlRhc2tXb3JrZmxvdztcblxuICBjb25zdHJ1Y3RvcihvcHRpb25zOiBKYXZhTWF2ZW5Qcm9qZWN0T3B0aW9ucykge1xuICAgIHN1cGVyKHtcbiAgICAgIG5hbWU6IG9wdGlvbnMubmFtZSxcbiAgICAgIGdyb3VwSWQ6IG9wdGlvbnMuZ3JvdXBJZCxcbiAgICAgIGFydGlmYWN0SWQ6IG9wdGlvbnMuYXJ0aWZhY3RJZCxcbiAgICAgIHZlcnNpb246IG9wdGlvbnMudmVyc2lvbiA/PyAnMC4xLjAnLFxuICAgICAgcHJvamVuQ3JlZGVudGlhbHM6IGdpdGh1Yi5HaXRodWJDcmVkZW50aWFscy5mcm9tUGVyc29uYWxBY2Nlc3NUb2tlbih7XG4gICAgICAgIHNlY3JldDogb3B0aW9ucy5naGVUb2tlblNlY3JldCA/PyBERUZBVUxUX0dIRV9UT0tFTl9TRUNSRVQsXG4gICAgICB9KSxcbiAgICB9KTtcblxuICAgIGNvbnN0IGdoID0gdGhpcy5naXRodWI7XG4gICAgaWYgKCFnaCkge1xuICAgICAgdGhyb3cgbmV3IEVycm9yKCdKYXZhTWF2ZW5Qcm9qZWN0IHJlcXVpcmVzIEdpdEh1YiBpbnRlZ3JhdGlvbicpO1xuICAgIH1cblxuICAgIGFwcGx5SW50ZXJuYWxBY3Rpb25PdmVycmlkZXMoZ2gpO1xuXG4gICAgbmV3IFByb2plbkRyaWZ0Q2hlY2tXb3JrZmxvdyh0aGlzLCB7XG4gICAgICBnaGVUb2tlblNlY3JldDogb3B0aW9ucy5naGVUb2tlblNlY3JldCA/PyBERUZBVUxUX0dIRV9UT0tFTl9TRUNSRVQsXG4gICAgfSk7XG4gICAgbmV3IFdvcmtmbG93Q2hhbmdlTm90aWNlV29ya2Zsb3codGhpcyk7XG4gICAgbmV3IEFjdGlvbnNBbGxvd2xpc3RHdWFyZCh0aGlzKTtcblxuICAgIGNvbnN0IHBvc3RCdWlsZFN0ZXBzOiBnaXRodWIud29ya2Zsb3dzLkpvYlN0ZXBbXSA9IFtdO1xuICAgIGlmIChvcHRpb25zLnNvbmFyUHJvamVjdEtleSkge1xuICAgICAgcG9zdEJ1aWxkU3RlcHMucHVzaCh7XG4gICAgICAgIG5hbWU6ICdTb25hclF1YmUgc2NhbicsXG4gICAgICAgIHJ1bjogYG12biAtQiBzb25hcjpzb25hciAtRHNvbmFyLnByb2plY3RLZXk9JHtvcHRpb25zLnNvbmFyUHJvamVjdEtleX1gLFxuICAgICAgICBlbnY6IHsgU09OQVJfVE9LRU46ICcke3sgc2VjcmV0cy5TT05BUl9UT0tFTiB9fScgfSxcbiAgICAgIH0pO1xuICAgIH1cblxuICAgIHRoaXMuYnVpbGRWZXJpZnlXb3JrZmxvdyA9IG5ldyBnaXRodWIuVGFza1dvcmtmbG93KGdoLCB7XG4gICAgICBuYW1lOiAnYnVpbGQnLFxuICAgICAgam9iSWQ6ICdidWlsZCcsXG4gICAgICB0YXNrOiB0aGlzLmJ1aWxkVGFzayxcbiAgICAgIHRyaWdnZXJzOiB7IHB1bGxSZXF1ZXN0OiB7fSwgd29ya2Zsb3dEaXNwYXRjaDoge30gfSxcbiAgICAgIHBlcm1pc3Npb25zOiB7IGNvbnRlbnRzOiBnaXRodWIud29ya2Zsb3dzLkpvYlBlcm1pc3Npb24uUkVBRCB9LFxuICAgICAgcG9zdEJ1aWxkU3RlcHMsXG4gICAgfSk7XG5cbiAgICB0aGlzLnVwZ3JhZGVUYXNrID0gdGhpcy5hZGRUYXNrKCd1cGdyYWRlJywge1xuICAgICAgZXhlYzogJ212biAtQiB2ZXJzaW9uczp1c2UtbGF0ZXN0LXJlbGVhc2VzIHZlcnNpb25zOnVwZGF0ZS1wcm9wZXJ0aWVzJyxcbiAgICB9KTtcbiAgICBuZXcgVXBncmFkZVdvcmtmbG93KHRoaXMsIHsgdGFzazogdGhpcy51cGdyYWRlVGFzayB9KTtcbiAgfVxufVxuIl19

package/lib/java/java-service-project.js

@@ -11,7 +11,7 @@ const java_maven_base_1 = require("./java-maven-base");
  * Central); publish and deploy are both manual-dispatch, not on every merge.
  */
 class JavaServiceProject extends java_maven_base_1.JavaMavenProject {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "@xpertss/projen-types.JavaServiceProject", version: "0.0.0" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@xpertss/projen-types.JavaServiceProject", version: "0.0.2" };
     constructor(options) {
         super(options);
         this.pom.addDependency('org.springframework.boot/spring-boot-starter-web@^3');

package/package.json

@@ -82,7 +82,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "version": "0.0.0",
+  "version": "0.0.2",
   "jest": {
     "coverageProvider": "v8",
     "testMatch": [

package/release-publishing.md

@@ -0,0 +1,125 @@
+# Release & Commit Methodology — `xpertss/projen` (`@xpertss/projen-types`)
+
+## Scope
+
+This document defines how to trigger a release of `@xpertss/projen-types` and the commit discipline required for a release to happen. It applies to the `release` workflow (`.github/workflows/release.yml`, generated by projen from `.projenrc.ts`).
+
+**A release happens when a run of the `release` workflow finds at least one releasable commit since the last release tag** — a commit whose subject is typed `feat:` or `fix:` (see §2). Runs are started by any push to `main` (or manually, §1). A run whose window contains no `feat:`/`fix:` commits is a **green no-op** that publishes nothing — `docs:`, `ci:`, `chore:`, and other commits never release on their own.
+
+Key words "MUST", "MUST NOT", "SHOULD" are to be interpreted as described in RFC 2119.
+
+## 1. Triggering a release
+
+- **Any push to `main`** starts the `release` workflow — direct push or merged PR. The run publishes only if the window since the last release tag contains a releasable commit (below); otherwise it is a no-op.
+- The workflow can also be started manually: GitHub → **Actions** → `release` → **Run workflow** (optional `dry_run = true` runs everything except the actual `npm publish`) — useful for re-running after a failed build or to confirm a no-op window.
+- At start of the run, the toolchain lists the **releasable commits** between the last release tag (`vX.Y.Z`) and `HEAD`: all non-merge commits whose subject matches `feat:` or `fix:` (with an optional scope and an optional `!`, e.g. `feat(parser)!: ...`).
+  - **≥ 1 releasable commit** → the run bumps the version, builds, and publishes to npm and GitHub Releases.
+  - **0 releasable commits** (e.g. only `docs:`, `ci:`, `chore:`, or unprefixed commits in the window) → the run is a **no-op**: green, no tag, no npm publish, no GitHub release. This is expected behavior, not an error.
+
+## 2. Commit message rules
+
+### 2.1 Format
+
+Commit messages MUST use the [Conventional Commits](https://www.conventionalcommits.org/) format. Only the **first line (subject)** is parsed for the type, in the form:
+
+```
+type(scope)!: description
+```
+
+- `type` — lower-case; `feat` or `fix` makes the commit releasable (see §1).
+- `scope` — optional, free-form (e.g. `fix(parser): ...`).
+- `!` — optional breaking-change marker, see §2.3.
+- `description` — imperative mood preferred ("add", not "added"/"adds").
+
+### 2.2 Releasable types and the version bump
+
+Only `feat:` and `fix:` commits are releasable. When a release run does release, the bump level for the window is:
+
+| Window since last tag | Bump level | Example `0.1.0` → |
+|---|---|---|
+| Breaking change present (§2.3) | **major** | `1.0.0` |
+| Else any `feat:` commit | **minor** | `0.2.0` |
+| Else (only `fix:` commits) | **patch** | `0.1.1` |
+
+Within one window, the highest level wins.
+
+**All commits since the last tag are included in the release**, not only the releasable ones — `docs:`, `ci:`, `chore:`, and other commits appear in the generated release notes (under an "Other" heading) and are part of the released content. They simply do not, on their own, cause a release to happen.
+
+### 2.3 Breaking changes
+
+A change that is incompatible with existing consumers MUST be marked explicitly, one of:
+
+- `!` directly before the colon: `feat!: drop legacy option`
+- or a `BREAKING CHANGE:` paragraph in the commit **body** (the body, not the subject).
+
+Because the releasable-commits check (§1) only inspects commit **subjects**, a breaking change MUST be carried by a `feat:`/`fix:` commit. A `BREAKING CHANGE:` note on any other commit type (e.g. `refactor:`) will never be released.
+
+### 2.4 Examples
+
+| Message | Effect |
+|---|---|
+| `feat: add Java project scaffold` | releasable; minor bump |
+| `fix: correct dependency range in .projenrc.ts` | releasable; patch bump |
+| `feat!: remove deprecated option X` | releasable; major bump |
+| `fix!: change default of option Y` | releasable; major bump |
+| `docs: update publishing guide` | **not releasable** — no release unless the window also has a `feat:`/`fix:` |
+| `ci: pin node version` | **not releasable** — no release unless the window also has a `feat:`/`fix:` |
+| `Updated the README` (no prefix) | **not releasable** |
+| `chore(release): 0.0.1` (auto-generated) | never counted — filtered out of the window |
+
+## 3. What a release run does
+
+Per run, in order:
+
+1. The `release` job runs `npx projen release` = `rm -fr dist` → **bump** (resolve latest tag → list releasable commits → if none, stop as no-op; if any, set the new version in `package.json`, write the changelog to `dist/changelog.md`) → **build** (jsii) → **unbump** → `git diff` must be clean. A build failure aborts the run before anything is published.
+2. Gates: `tag_exists` (is the computed release tag already on origin?) and `latest_commit == github.sha` (did someone push a newer commit mid-run?).
+3. If gated through, `Publish to npm` and `Publish to GitHub Releases` run in parallel:
+   - **npm:** `publib-npm` with `NPM_TRUSTED_PUBLISHER=true` (OIDC, no token; see `spec/npm-publishing-setup.md`). A version that is already on the registry is reported as `SKIPPING: already published` — green, not an error.
+   - **GitHub:** `gh release create vX.Y.Z --target <sha>` with the generated changelog as body; this also creates/pushes the `vX.Y.Z` tag.
+4. The `chore(release): vX.Y.Z` commit (author `github-actions[bot]`) lands on `main`.
+
+## 4. Rules
+
+### MUST
+
+- Type commits `feat:` or `fix:` when the change should be part of a release.
+- Mark breaking changes with `!` or a `BREAKING CHANGE:` **body** paragraph, on a `feat:`/`fix:` commit (§2.3).
+- Treat a push to `main` whose window contains `feat:`/`fix:` commits as an imminent release — review accordingly.
+- Verify after each release: `npm view @xpertss/projen-types version` and the GitHub **Releases** page.
+
+### MUST NOT
+
+- Push a `feat:`/`fix:` commit to `main` unless you are ready to publish — the run it triggers will release.
+- Edit `package.json` `version` by hand, or add a `version` field to `.projenrc.ts` — the release toolchain owns version numbers.
+- Move, rename, or rewrite release tags (`vX.Y.Z`) on `main` — the tag is the version baseline.
+- Force-push `main` — it desyncs the tag baseline from history.
+- Edit `.github/workflows/release.yml` directly — edit `.projenrc.ts` and run `npx projen`. In particular, renaming the workflow file or changing the `release_npm` job would orphan the npm **trusted publisher** configuration (see `spec/npm-publishing-setup.md`, step 3).
+
+### SHOULD
+
+- Use **squash merge** for PRs and make the *squash title* the conventional message — it replaces all underlying commit subjects and therefore decides whether the merged change is releasable.
+- Use the imperative mood in the subject; one logical change per commit; subject ≤ 72 chars.
+- Keep a releasable (`feat:`/`fix:`) commit in the window whenever you intend a release to include a given set of changes; otherwise bundle the changes into a `feat:`/`fix:` PR.
+
+## 5. Edge cases and known behaviors
+
+| Situation | Outcome |
+|---|---|
+| Push to `main` with `feat:`/`fix:` commits in the window | release run — minor / patch / major per §2.2 |
+| Push or manual run whose window has only non-releasable commits (`docs:`, `ci:`, …) | no-op run — green, nothing published |
+| Window contains `feat:` (no breaking) | minor bump (highest level wins) |
+| Breaking change marked per §2.3 on a `feat:`/`fix:` commit | major bump |
+| Run with no commits since the last release tag (e.g. re-run of the same HEAD) | no-op run |
+| Run for an already-published tag | `tag_exists` gate skips publishing |
+| Version already on npm (e.g. published manually beforehand) | `publib-npm` prints `SKIPPING: already published`, run is green |
+| Two runs in rapid succession | concurrency group serializes; the second run's `latest_commit` gate handles drift |
+| Build fails | run aborts, no tag, no publish — fix and trigger again |
+| `chore(release):` is the latest commit | excluded from the window — no double release |
+
+## References
+
+- Workflow: `.github/workflows/release.yml` (projen-generated; source of truth is `.projenrc.ts`)
+- Releasable-commits gate: `bump:releasable-commits` task (`.projen/tasks.json`) — `git log --no-merges --oneline $LATEST_TAG..HEAD -E --grep '^(feat|fix){1}(\(...\))?(!)?:...'`
+- Bump engine: `commit-and-tag-version@12` (task `bump`, `.projen/tasks.json`), projen builtins `release/resolve-latest-tag`, `release/suggest-version-bump`, `release/apply-version-bump`
+- Publishing credentials (OIDC trusted publisher, bootstrap, 2FA): `spec/npm-publishing-setup.md`
+- Conventional Commits: https://www.conventionalcommits.org/

package/lib/common/drift-check.d.ts

@@ -1,8 +0,0 @@
-import { github } from 'projen';
-/**
- * Steps that re-run projen and fail the job if the generated output no
- * longer matches what's committed - i.e. someone hand-edited a projen
- * managed file (package.json/pom.xml/.github/workflows/*.yml/...) without
- * going through .projenrc.
- */
-export declare function driftCheckSteps(projenCommand?: string): github.workflows.JobStep[];