@xpertss/projen-types 0.0.1 → 0.0.2

package/.jsii

@@ -106,7 +106,7 @@
   },
   "name": "@xpertss/projen-types",
   "readme": {
-    "markdown": "# @xpertss/projen-types\n\nProjen project types for CDK/TypeScript and Java/Maven projects.\n\nInstead of hand-maintaining `pom.xml`, `cdk.json`, and GitHub workflows, you declare a project type in a `.projenrc.ts` file and let [projen](https://github.com/projen/projen) generate (and keep up to date) the whole scaffold: build files, source skeletons, CI workflows, and deploy pipelines.\n\n## Project types at a glance\n\n| Type | What it is | Publishes to | Generated workflows |\n| --- | --- | --- | --- |\n| `CdkInfraProject` | Pure-infrastructure CDK stacks (CloudFront, Route53, SQS, API Gateway, Cognito, ECR/ECS for externally-built images) | - | `build` (PR checks), `deploy` (manual dispatch) |\n| `CdkAppProject` | Full TypeScript service behind API Gateway: infra + app source + database | - | `build`, `deploy`, `app-build` (PR checks) |\n| `JavaLibraryProject` | Reusable Java library | Maven Central | `build`, `upgrade` (nightly), `publish-maven-central`, `codeindex` |\n| `JavaServiceProject` | Spring Boot service | Docker Hub | `build`, `upgrade` (nightly), `publish-docker`, `deploy-cdk` |\n| `JavaAppProject` | GUI/TUI/CLI Java application | GitHub Packages | `build`, `upgrade` (nightly), `publish-ghpackages` |\n\nTwo foundation classes are also exported for advanced use: `CdkTypescriptProject` (shared CDK + TypeScript base for the CDK types) and `JavaMavenProject` (shared Maven base for the Java types).\n\nAll project types:\n\n- run a **drift check** in PR builds - a job that re-runs projen and fails if generated files were hand-edited. Edit `.projenrc.ts`, then run `npx projen`; never edit generated files directly.\n- use the GitHub secret `PROJEN_GITHUB_TOKEN` (a fine-grained PAT) for projen's automation. Override with `gheTokenSecret`.\n- make all publishing/deploying **manual** (workflow_dispatch) rather than on every merge.\n\n## Getting started\n\nCreate a new git repository and install the dependencies:\n\n```bash\nmkdir my-project && cd my-project\ngit init\nnpm install -D projen constructs @xpertss/projen-types\n```\n\nWrite a `.projenrc.ts` (see examples below), then generate the project:\n\n```bash\nnpx projen\n```\n\nCommit the result. From then on, every change to the scaffold goes through `.projenrc.ts` followed by `npx projen`.\n\nThe `name` option must match the `name` field in the project's `package.json` (for the CDK types) or the project name used by projen's `java.JavaProject` (for the Java types).\n\n## Examples\n\n### CdkInfraProject\n\nPure infrastructure stacks with optional ECR/ECS and edge-networking constructs.\n\n```typescript\n// .projenrc.ts\nimport { CdkInfraProject } from '@xpertss/projen-types';\n\nconst project = new CdkInfraProject({\n  name: 'media-edge-infra',\n  environments: [\n    'dev',\n    { name: 'stage', accountId: '111111111111', region: 'eu-central-1' },\n    { name: 'prod', accountId: '222222222222', region: 'eu-central-1', requiresApproval: true },\n  ],\n  edgeResources: ['cloudfront', 'route53', 'sqs'],\n  ecrEcs: { enabled: true, externalImageSource: true },\n  slackWebhookSecret: 'SLACK_DEPLOY_WEBHOOK',\n});\n\nproject.synth();\n```\n\nYou get:\n\n- `cdk.json`, `cdk synth` / `cdk diff` / `cdk deploy` tasks, and the standard `AwsCdkTypeScriptApp` layout (CDK 2.189.1 by default).\n- `.github/workflows/build.yml` - PR build that hard-fails on projen drift.\n- `.github/workflows/deploy.yml` - manual dispatch with one `deploy-<env>` job per environment (runs `cdk deploy --all` with `--context environment=<env>`); `requiresApproval` environments get a GitHub Environment approval gate; a Slack notification step is added when `slackWebhookSecret` is set.\n- `src/constructs/edge-networking.ts` - helper constructs only for the requested `edgeResources` (`cloudfront`, `route53`, `apigateway`, `cognito`, `sqs`).\n- `src/constructs/ecr-ecs.ts` when `ecrEcs.enabled` - ECR repo + Fargate service; `externalImageSource: true` (default) means the service pulls an image built outside this repo.\n\n### CdkAppProject\n\n`CdkInfraProject` plus application source, a database construct, and an app-level build workflow.\n\n```typescript\n// .projenrc.ts\nimport { CdkAppProject } from '@xpertss/projen-types';\n\nconst project = new CdkAppProject({\n  name: 'video-api',\n  environments: ['dev', 'prod'],\n  edgeResources: ['apigateway'],\n  database: { engine: 'postgres', migrationTool: 'flyway' },\n  appEntryPoint: 'src/app.ts',\n});\n\nproject.synth();\n```\n\nEverything from `CdkInfraProject`, plus:\n\n- `src/app.ts` - application entrypoint stub (`export function handler()`).\n- `src/handlers/example.ts` - API Gateway proxy handler stub, with `@types/aws-lambda` added as a dev dependency.\n- `src/constructs/database.ts` - a `Database` construct stub for the chosen engine (`postgres`/`mysql` -> RDS, `dynamodb` -> DynamoDB). `migrationTool` (no default, intentionally) is added as a dev dependency and referenced in the stub - wiring it up is left to you.\n- `.github/workflows/app-build.yml` - runs the project's test task on every PR, then checks for projen drift.\n\n### JavaLibraryProject\n\nA reusable Java library published to Maven Central.\n\n```typescript\n// .projenrc.ts\nimport { JavaLibraryProject } from '@xpertss/projen-types';\n\nconst project = new JavaLibraryProject({\n  name: 'common-utils',\n  groupId: 'org.xpertss',\n  artifactId: 'common-utils',\n  version: '1.0.0',\n  sonarProjectKey: 'org.xpertss:common-utils',\n  mavenCentralOidc: true,\n});\n\nproject.synth();\n```\n\nYou get:\n\n- `pom.xml` (via projen's `java.JavaProject`) with the given GAV coordinates.\n- `.github/workflows/build.yml` - PR build + projen drift check, plus a SonarQube scan step when `sonarProjectKey` is set (needs a `SONAR_TOKEN` secret).\n- `.github/workflows/upgrade.yml` - nightly (03:00 UTC) PR running `mvn versions:use-latest-releases versions:update-properties`.\n- `.github/workflows/publish-maven-central.yml` - manual dispatch running `mvn -B deploy -P release`. With `mavenCentralOidc: true` it uses Maven Central's OIDC trusted publishing (no GPG secrets needed); otherwise it expects the secrets `MAVEN_GPG_PRIVATE_KEY`, `MAVEN_GPG_PASSPHRASE`, `MAVEN_CENTRAL_USERNAME`, `MAVEN_CENTRAL_PASSWORD`.\n- `.github/workflows/codeindex.yml` - on push to `main`, generates a Java source index under `.cai/` (disable with `publishCodeIndex: false`).\n\n### JavaServiceProject\n\nA Spring Boot service that publishes a Docker image and can trigger deploys in a companion CDK repo.\n\n```typescript\n// .projenrc.ts\nimport { JavaServiceProject } from '@xpertss/projen-types';\n\nconst project = new JavaServiceProject({\n  name: 'stream-processor',\n  groupId: 'org.xpertss',\n  artifactId: 'stream-processor',\n  dockerRegistry: 'docker.io/xpertss',\n  cdkDeployHook: { targetRepo: 'xpertss/stream-infra' },\n  environments: ['dev', { name: 'prod', requiresApproval: true }],\n});\n\nproject.synth();\n```\n\nYou get (everything from `JavaMavenProject` - `pom.xml`, `build` + drift check, nightly `upgrade` - plus):\n\n- `spring-boot-starter-web` added to the pom.\n- `.github/workflows/publish-docker.yml` - manual dispatch: `mvn -B package && docker build -t <registry>/<name>:<sha>`, logged in with the `DOCKER_USERNAME` / `DOCKER_PASSWORD` secrets. `dockerRegistry` defaults to `docker.io`.\n- Flyway wiring when `useFlyway` (default `true`): `flyway-maven-plugin` ^10 + `flyway-core` ^10 in the pom, and `src/main/resources/db/migration/V1__init.sql`.\n- `.github/workflows/deploy-cdk.yml` (the `CdkDeployHook`, enabled by default) - manual dispatch with an environment selector; each job sends a `workflow_dispatch` to `deploy.yml` in the companion `targetRepo` (a `CdkInfraProject`/`CdkAppProject` repo). `targetRepo` is required when the hook is enabled; disable it with `cdkDeployHook: { enabled: false }`. `environments` defaults to `['prod']`.\n\n### JavaAppProject\n\nA GUI/TUI/CLI Java application published to GitHub Packages only - no Maven Central, no Docker, no CDK deploy hook.\n\n```typescript\n// .projenrc.ts\nimport { JavaAppProject } from '@xpertss/projen-types';\n\nconst project = new JavaAppProject({\n  name: 'studio-cli',\n  groupId: 'org.xpertss',\n  artifactId: 'studio-cli',\n  ghPackagesRegistry: 'https://maven.pkg.github.com/xpertss/studio-cli',\n});\n\nproject.synth();\n```\n\nYou get everything from `JavaMavenProject`, plus `.github/workflows/publish-ghpackages.yml` - manual dispatch running `mvn -B deploy -DaltDeploymentRepository=github::<registry>`, authenticated with `GITHUB_TOKEN`. `ghPackagesRegistry` defaults to `https://maven.pkg.github.com/<repo>` derived from the repository URL.\n\n## Common options\n\nCDK project types (`CdkInfraProjectOptions` / `CdkAppProjectOptions`):\n\n| Option | Default | Description |\n| --- | --- | --- |\n| `name` | - (required) | Project name; must match `package.json` |\n| `cdkVersion` | `2.189.1` | AWS CDK version |\n| `gheTokenSecret` | `PROJEN_GITHUB_TOKEN` | GitHub secret holding projen's PAT |\n| `slackWebhookSecret` | - | GitHub secret with a Slack webhook URL for deploy notifications |\n| `environments` | - (required) | Deploy targets for the `deploy` workflow; strings or `EnvironmentOptions` |\n| `ecrEcs` | - | `EcrEcsOptions` - `enabled`, `externalImageSource` (default `true`) |\n| `edgeResources` | - | Subset of `cloudfront`, `route53`, `apigateway`, `cognito`, `sqs` |\n| `database` | - (app only) | `DatabaseOptions` - `engine` (`postgres`/`mysql`/`dynamodb`, default `postgres`), `migrationTool` |\n| `appEntryPoint` | `src/app.ts` (app only) | Path of the generated application entrypoint |\n\nJava project types (`JavaLibraryProjectOptions` / `JavaServiceProjectOptions` / `JavaAppProjectOptions`):\n\n| Option | Default | Description |\n| --- | --- | --- |\n| `name` | - (required) | Project name |\n| `groupId` | - (required) | Maven group id |\n| `artifactId` | - (required) | Maven artifact id |\n| `version` | `0.1.0` | Maven version |\n| `sonarProjectKey` | - | SonarQube project key; the sonar step is skipped when unset |\n| `gheTokenSecret` | `PROJEN_GITHUB_TOKEN` | GitHub secret holding projen's PAT |\n\n`EnvironmentOptions` for deploy targets:\n\n```typescript\ninterface EnvironmentOptions {\n  readonly name: string;              // e.g. \"dev\", \"stage\", \"prod\"\n  readonly accountId?: string;        // AWS account id (CDK deploys)\n  readonly region?: string;           // AWS region (CDK deploys)\n  readonly requiresApproval?: boolean; // GitHub Environment approval gate (default false)\n}\n```\n\nPlain strings (`'dev'`) are shorthand for `{ name: 'dev' }`.\n\n## Required GitHub secrets\n\n| Secret | Used by | Notes |\n| --- | --- | --- |\n| `PROJEN_GITHUB_TOKEN` | all types | PAT for projen's self-mutation/automation; override via `gheTokenSecret` |\n| `SONAR_TOKEN` | Java types with `sonarProjectKey` | SonarQube scan step in `build.yml` |\n| `DOCKER_USERNAME` / `DOCKER_PASSWORD` | `JavaServiceProject` | Docker image push |\n| `MAVEN_GPG_PRIVATE_KEY`, `MAVEN_GPG_PASSPHRASE`, `MAVEN_CENTRAL_USERNAME`, `MAVEN_CENTRAL_PASSWORD` | `JavaLibraryProject` without `mavenCentralOidc` | Not needed with OIDC trusted publishing |\n| (your Slack webhook secret) | CDK types with `slackWebhookSecret` | Deploy notifications |\n\n## Going further\n\nThe project types are composed from smaller components you can also attach to your own projects:\n\n| Component | Applies to | Purpose |\n| --- | --- | --- |\n| `AppRuntimeScaffold` | `NodeProject` | App source skeleton (`app.ts` + handlers) |\n| `DatabaseComponent` | `NodeProject` | Database construct stub + migration tool wiring |\n| `EcrEcsConstructs` | `Project` | ECR + Fargate ECS construct helper |\n| `EdgeNetworkingConstructs` | `Project` | Per-resource edge networking construct helpers |\n| `MavenCentralPublish` | `JavaProject` | Manual-dispatch Maven Central publish workflow |\n| `DockerPublish` | `JavaProject` | Manual-dispatch Docker build+push workflow |\n| `GitHubPackagesPublish` | `JavaProject` | Manual-dispatch GitHub Packages publish workflow |\n| `FlywayMigration` | `JavaProject` | Flyway plugin/dependency + migrations directory |\n| `CdkDeployHook` | `JavaProject` | Manual-dispatch workflow that triggers `deploy.yml` in a companion CDK repo |\n| `CodeIndexWorkflow` | `JavaProject` | Code index generation on push to `main` |\n\nExample - adding a Docker publish to a plain projen `JavaProject`:\n\n```typescript\nimport { java } from 'projen';\nimport { DockerPublish } from '@xpertss/projen-types';\n\nconst project = new java.JavaProject({\n  name: 'my-service',\n  groupId: 'org.xpertss',\n  artifactId: 'my-service',\n});\n\nnew DockerPublish(project, { dockerRegistry: 'ghcr.io' });\n\nproject.synth();\n```\n\nThe full API reference, including every option and property, is in [API.md](./API.md).\n"
+    "markdown": "# @xpertss/projen-types\n\nProjen project types for CDK/TypeScript and Java/Maven projects.\n\nInstead of hand-maintaining `pom.xml`, `cdk.json`, and GitHub workflows, you declare a project type in a `.projenrc.ts` file and let [projen](https://github.com/projen/projen) generate (and keep up to date) the whole scaffold: build files, source skeletons, CI workflows, and deploy pipelines.\n\n## Project types at a glance\n\n| Type | What it is | Publishes to | Generated workflows |\n| --- | --- | --- | --- |\n| `CdkInfraProject` | Pure-infrastructure CDK stacks (CloudFront, Route53, SQS, API Gateway, Cognito, ECR/ECS for externally-built images) | - | `build` (PR checks), `deploy` (manual dispatch) |\n| `CdkAppProject` | Full TypeScript service behind API Gateway: infra + app source + database | - | `build`, `deploy`, `app-build` (PR checks) |\n| `JavaLibraryProject` | Reusable Java library | Maven Central | `build`, `upgrade` (nightly), `publish-maven-central`, `codeindex` |\n| `JavaServiceProject` | Spring Boot service | Docker Hub | `build`, `upgrade` (nightly), `publish-docker`, `deploy-cdk` |\n| `JavaAppProject` | GUI/TUI/CLI Java application | GitHub Packages | `build`, `upgrade` (nightly), `publish-ghpackages` |\n| `GitHubActionProject` | Reusable GitHub Action or Workflow | GitHub Releases | `build`, `test-dogfood`, `sonar`, `release` |\n\nTwo foundation classes are also exported for advanced use: `CdkTypescriptProject` (shared CDK + TypeScript base for the CDK types) and `JavaMavenProject` (shared Maven base for the Java types).\n\nAll project types:\n\n- run a **drift check** in PR builds - a job that re-runs projen and fails if generated files were hand-edited. Edit `.projenrc.ts`, then run `npx projen`; never edit generated files directly.\n- use the GitHub secret `PROJEN_GITHUB_TOKEN` (a fine-grained PAT) for projen's automation. Override with `gheTokenSecret`.\n- make all publishing/deploying **manual** (workflow_dispatch) rather than on every merge.\n\n## Getting started\n\nCreate a new git repository and install the dependencies:\n\n```bash\nmkdir my-project && cd my-project\ngit init\nnpm install -D projen constructs @xpertss/projen-types\n```\n\nWrite a `.projenrc.ts` (see examples below), then generate the project:\n\n```bash\nnpx projen\n```\n\nCommit the result. From then on, every change to the scaffold goes through `.projenrc.ts` followed by `npx projen`.\n\nThe `name` option must match the `name` field in the project's `package.json` (for the CDK types) or the project name used by projen's `java.JavaProject` (for the Java types).\n\n## Examples\n\n### CdkInfraProject\n\nPure infrastructure stacks with optional ECR/ECS and edge-networking constructs.\n\n```typescript\n// .projenrc.ts\nimport { CdkInfraProject } from '@xpertss/projen-types';\n\nconst project = new CdkInfraProject({\n  name: 'media-edge-infra',\n  environments: [\n    'dev',\n    { name: 'stage', accountId: '111111111111', region: 'eu-central-1' },\n    { name: 'prod', accountId: '222222222222', region: 'eu-central-1', requiresApproval: true },\n  ],\n  edgeResources: ['cloudfront', 'route53', 'sqs'],\n  ecrEcs: { enabled: true, externalImageSource: true },\n  slackWebhookSecret: 'SLACK_DEPLOY_WEBHOOK',\n});\n\nproject.synth();\n```\n\nYou get:\n\n- `cdk.json`, `cdk synth` / `cdk diff` / `cdk deploy` tasks, and the standard `AwsCdkTypeScriptApp` layout (CDK 2.189.1 by default).\n- `.github/workflows/build.yml` - PR build that hard-fails on projen drift.\n- `.github/workflows/deploy.yml` - manual dispatch with one `deploy-<env>` job per environment (runs `cdk deploy --all` with `--context environment=<env>`); `requiresApproval` environments get a GitHub Environment approval gate; a Slack notification step is added when `slackWebhookSecret` is set.\n- `src/constructs/edge-networking.ts` - helper constructs only for the requested `edgeResources` (`cloudfront`, `route53`, `apigateway`, `cognito`, `sqs`).\n- `src/constructs/ecr-ecs.ts` when `ecrEcs.enabled` - ECR repo + Fargate service; `externalImageSource: true` (default) means the service pulls an image built outside this repo.\n\n### CdkAppProject\n\n`CdkInfraProject` plus application source, a database construct, and an app-level build workflow.\n\n```typescript\n// .projenrc.ts\nimport { CdkAppProject } from '@xpertss/projen-types';\n\nconst project = new CdkAppProject({\n  name: 'video-api',\n  environments: ['dev', 'prod'],\n  edgeResources: ['apigateway'],\n  database: { engine: 'postgres', migrationTool: 'flyway' },\n  appEntryPoint: 'src/app.ts',\n});\n\nproject.synth();\n```\n\nEverything from `CdkInfraProject`, plus:\n\n- `src/app.ts` - application entrypoint stub (`export function handler()`).\n- `src/handlers/example.ts` - API Gateway proxy handler stub, with `@types/aws-lambda` added as a dev dependency.\n- `src/constructs/database.ts` - a `Database` construct stub for the chosen engine (`postgres`/`mysql` -> RDS, `dynamodb` -> DynamoDB). `migrationTool` (no default, intentionally) is added as a dev dependency and referenced in the stub - wiring it up is left to you.\n- `.github/workflows/app-build.yml` - runs the project's test task on every PR, then checks for projen drift.\n\n### JavaLibraryProject\n\nA reusable Java library published to Maven Central.\n\n```typescript\n// .projenrc.ts\nimport { JavaLibraryProject } from '@xpertss/projen-types';\n\nconst project = new JavaLibraryProject({\n  name: 'common-utils',\n  groupId: 'org.xpertss',\n  artifactId: 'common-utils',\n  version: '1.0.0',\n  sonarProjectKey: 'org.xpertss:common-utils',\n  mavenCentralOidc: true,\n});\n\nproject.synth();\n```\n\nYou get:\n\n- `pom.xml` (via projen's `java.JavaProject`) with the given GAV coordinates.\n- `.github/workflows/build.yml` - PR build + projen drift check, plus a SonarQube scan step when `sonarProjectKey` is set (needs a `SONAR_TOKEN` secret).\n- `.github/workflows/upgrade.yml` - nightly (03:00 UTC) PR running `mvn versions:use-latest-releases versions:update-properties`.\n- `.github/workflows/publish-maven-central.yml` - manual dispatch running `mvn -B deploy -P release`. With `mavenCentralOidc: true` it uses Maven Central's OIDC trusted publishing (no GPG secrets needed); otherwise it expects the secrets `MAVEN_GPG_PRIVATE_KEY`, `MAVEN_GPG_PASSPHRASE`, `MAVEN_CENTRAL_USERNAME`, `MAVEN_CENTRAL_PASSWORD`.\n- `.github/workflows/codeindex.yml` - on push to `main`, generates a Java source index under `.cai/` (disable with `publishCodeIndex: false`).\n\n### JavaServiceProject\n\nA Spring Boot service that publishes a Docker image and can trigger deploys in a companion CDK repo.\n\n```typescript\n// .projenrc.ts\nimport { JavaServiceProject } from '@xpertss/projen-types';\n\nconst project = new JavaServiceProject({\n  name: 'stream-processor',\n  groupId: 'org.xpertss',\n  artifactId: 'stream-processor',\n  dockerRegistry: 'docker.io/xpertss',\n  cdkDeployHook: { targetRepo: 'xpertss/stream-infra' },\n  environments: ['dev', { name: 'prod', requiresApproval: true }],\n});\n\nproject.synth();\n```\n\nYou get (everything from `JavaMavenProject` - `pom.xml`, `build` + drift check, nightly `upgrade` - plus):\n\n- `spring-boot-starter-web` added to the pom.\n- `.github/workflows/publish-docker.yml` - manual dispatch: `mvn -B package && docker build -t <registry>/<name>:<sha>`, logged in with the `DOCKER_USERNAME` / `DOCKER_PASSWORD` secrets. `dockerRegistry` defaults to `docker.io`.\n- Flyway wiring when `useFlyway` (default `true`): `flyway-maven-plugin` ^10 + `flyway-core` ^10 in the pom, and `src/main/resources/db/migration/V1__init.sql`.\n- `.github/workflows/deploy-cdk.yml` (the `CdkDeployHook`, enabled by default) - manual dispatch with an environment selector; each job sends a `workflow_dispatch` to `deploy.yml` in the companion `targetRepo` (a `CdkInfraProject`/`CdkAppProject` repo). `targetRepo` is required when the hook is enabled; disable it with `cdkDeployHook: { enabled: false }`. `environments` defaults to `['prod']`.\n\n### JavaAppProject\n\nA GUI/TUI/CLI Java application published to GitHub Packages only - no Maven Central, no Docker, no CDK deploy hook.\n\n```typescript\n// .projenrc.ts\nimport { JavaAppProject } from '@xpertss/projen-types';\n\nconst project = new JavaAppProject({\n  name: 'studio-cli',\n  groupId: 'org.xpertss',\n  artifactId: 'studio-cli',\n  ghPackagesRegistry: 'https://maven.pkg.github.com/xpertss/studio-cli',\n});\n\nproject.synth();\n```\n\nYou get everything from `JavaMavenProject`, plus `.github/workflows/publish-ghpackages.yml` - manual dispatch running `mvn -B deploy -DaltDeploymentRepository=github::<registry>`, authenticated with `GITHUB_TOKEN`. `ghPackagesRegistry` defaults to `https://maven.pkg.github.com/<repo>` derived from the repository URL.\n\n### GitHubActionProject\n\nA reusable GitHub Action or Workflow. This example scaffolds an action that stages a folder and, only if it changed, commits and pushes it.\n\n```typescript\n// .projenrc.ts\nimport { GitHubActionProject } from '@xpertss/projen-types';\n\nconst project = new GitHubActionProject({\n  name: 'auto-commit',\n  description: 'Stage a folder and, only if it changed, commit and push it',\n  sonarHostUrl: 'https://sonar.xpertss.org',   // required, no default - your self-hosted SonarQube\n  dogfood: {\n    // Two scenario steps: the \"changed\" path and the \"no-op\" path are both\n    // load-bearing behavior for this action (a double-commit or a\n    // push-when-empty bug is the failure mode a hand-rolled inline-shell\n    // alternative is most likely to introduce).\n    scenario: [\n      {\n        name: 'Changed path',\n        fixtureSteps: [\n          'echo \"$(date -u +%Y%m%dT%H%M%SZ)\" >> test/fixtures/dogfood-state.txt',\n        ],\n        inputs: {\n          commit_message: 'test: dogfood',\n          branches: 'test/dogfood',\n        },\n        assertions: [\n          // step id defaults to a slug of `name` - here \"changed-path-0\"\n          '[ \"${{ steps.changed-path-0.outputs.committed }}\" = \"true\" ]',\n        ],\n      },\n      {\n        // No fixture change this time - nothing new to commit.\n        name: 'No-op path',\n        id: 'no-op-check',            // pin an explicit id instead of relying on the default slug\n        inputs: {\n          commit_message: 'test: dogfood',\n          branches: 'test/dogfood',\n        },\n        assertions: [\n          '[ \"${{ steps.no-op-check.outputs.committed }}\" = \"false\" ]',\n        ],\n      },\n    ],\n    cleanup: [\n      'git push origin --delete test/dogfood || true',\n    ],\n  },\n});\n\nproject.synth();\n```\n\nYou get:\n\n- `action.yml` and `auto-commit.sh` are hand-written - this type only lints their content via `build.yml`'s shellcheck/yamllint/actionlint checks.\n- `.github/workflows/build.yml` - lint gate: `apt`-installed shellcheck/yamllint plus a pinned, SHA-256-verified `actionlint` release binary. Gates `main` alongside `sonar.yml`.\n- `.github/workflows/test-dogfood.yml` - runs the `dogfood.scenario` steps above against this repo's own `action.yml` (via `uses: .`), then the shared `cleanup`, on `workflow_dispatch`, every `pull_request`, and nightly.\n- `.github/workflows/sonar.yml` - self-hosted SonarQube via the Scanner CLI, scanning `action.yml`/`.github/workflows/**`/`**/*.sh` explicitly.\n- `.github/workflows/release.yml` - `feat:`/`fix:` commits on `main` bump the version, tag `vX.Y.Z`, and create a GitHub Release.\n- `.github/workflows/projen-drift-check.yml`, `workflow-change-notice.yml`, `actions-allowlist-guard.yml` - drift detection, a change notice, and an action allow-list guard, always included.\n- `package.json` (**private**, version source only), `tsconfig.json`, `.yamllint`, `LICENSE` (MIT by default), and a `README.md` template - all regenerated by `npx projen`.\n\nNeeds the same two secrets as everything else in this package: `PROJEN_GITHUB_TOKEN` (used for automated PR comments) and `SONAR_TOKEN` (the Sonar scan). Onboarding a brand-new action repo from scratch: `npm init -y && npm install -D projen constructs @xpertss/projen-types`, write the `.projenrc.ts` above, `npx projen && npm install`, then hand-write `action.yml`/`auto-commit.sh`/`test/fixtures/`.\n\n## Common options\n\nCDK project types (`CdkInfraProjectOptions` / `CdkAppProjectOptions`):\n\n| Option | Default | Description |\n| --- | --- | --- |\n| `name` | - (required) | Project name; must match `package.json` |\n| `cdkVersion` | `2.189.1` | AWS CDK version |\n| `gheTokenSecret` | `PROJEN_GITHUB_TOKEN` | GitHub secret holding projen's PAT |\n| `slackWebhookSecret` | - | GitHub secret with a Slack webhook URL for deploy notifications |\n| `environments` | - (required) | Deploy targets for the `deploy` workflow; strings or `EnvironmentOptions` |\n| `ecrEcs` | - | `EcrEcsOptions` - `enabled`, `externalImageSource` (default `true`) |\n| `edgeResources` | - | Subset of `cloudfront`, `route53`, `apigateway`, `cognito`, `sqs` |\n| `database` | - (app only) | `DatabaseOptions` - `engine` (`postgres`/`mysql`/`dynamodb`, default `postgres`), `migrationTool` |\n| `appEntryPoint` | `src/app.ts` (app only) | Path of the generated application entrypoint |\n\nJava project types (`JavaLibraryProjectOptions` / `JavaServiceProjectOptions` / `JavaAppProjectOptions`):\n\n| Option | Default | Description |\n| --- | --- | --- |\n| `name` | - (required) | Project name |\n| `groupId` | - (required) | Maven group id |\n| `artifactId` | - (required) | Maven artifact id |\n| `version` | `0.1.0` | Maven version |\n| `sonarProjectKey` | - | SonarQube project key; the sonar step is skipped when unset |\n| `gheTokenSecret` | `PROJEN_GITHUB_TOKEN` | GitHub secret holding projen's PAT |\n\n`EnvironmentOptions` for deploy targets:\n\n```typescript\ninterface EnvironmentOptions {\n  readonly name: string;              // e.g. \"dev\", \"stage\", \"prod\"\n  readonly accountId?: string;        // AWS account id (CDK deploys)\n  readonly region?: string;           // AWS region (CDK deploys)\n  readonly requiresApproval?: boolean; // GitHub Environment approval gate (default false)\n}\n```\n\nPlain strings (`'dev'`) are shorthand for `{ name: 'dev' }`.\n\n`GitHubActionProjectOptions`:\n\n| Option | Default | Description |\n| --- | --- | --- |\n| `name` | - (required) | Project name |\n| `description` | - | One-line description; used in the default README template and recorded in the private `package.json` |\n| `sonarHostUrl` | - (required) | URL of your self-hosted SonarQube instance; must be reachable from github.com-hosted runners |\n| `sonarTokenSecret` | `SONAR_TOKEN` | GitHub secret holding the Sonar token |\n| `sonarPullRequestGate` | `true` | Whether `sonar.yml` also runs on `pull_request` as a pass/fail gate |\n| `dogfood` | - (required) | `ActionDogfoodOptions` - the scenario that exercises the action end-to-end via `uses: .` |\n| `license` | `MIT` | SPDX identifier for the generated `LICENSE` |\n| `gheTokenSecret` | `PROJEN_GITHUB_TOKEN` | GitHub secret holding projen's PAT |\n\n`ActionDogfoodOptions`/`ActionDogfoodStep` - the dogfood scenario (`test-dogfood.yml`):\n\n```typescript\ninterface ActionDogfoodOptions {\n  readonly scenario: ActionDogfoodStep[]; // one or more, run in order - required\n  readonly cleanup: string[];             // shared, run once at the end with `if: always()` - required\n}\n\ninterface ActionDogfoodStep {\n  readonly name: string;                    // labels this step-group's generated workflow steps\n  readonly id?: string;                     // step id for the `uses: .` call; default: a slug of `name`\n  readonly fixtureSteps?: string[];         // shell, before the invocation (default: none)\n  readonly inputs?: Record<string, string>; // `with:` for this invocation (default: none)\n  readonly assertions: string[];            // shell, after the invocation - required, job fails unless all exit 0\n}\n```\n\nMost actions need exactly one `scenario` step. Actions with a re-run/no-op/idempotency behavior to verify (e.g. `auto-commit`'s no-op-on-no-change path, `create-pull-request`'s reuse-the-PR path) declare two - the second typically omits `fixtureSteps` so its invocation sees no new state, and its assertion checks the opposite outcome of the first. Reference an invocation's own outputs from a later assertion via `${{ steps.<id>.outputs.<name> }}`, using either the default slug or an explicit `id`.\n\n## Required GitHub secrets\n\n| Secret | Used by | Notes |\n| --- | --- | --- |\n| `PROJEN_GITHUB_TOKEN` | all types | PAT for projen's self-mutation/automation; override via `gheTokenSecret` |\n| `SONAR_TOKEN` | Java types with `sonarProjectKey`; `GitHubActionProject` | SonarQube scan step in `build.yml` / `sonar.yml`; override via `sonarTokenSecret` on `GitHubActionProject` |\n| `DOCKER_USERNAME` / `DOCKER_PASSWORD` | `JavaServiceProject` | Docker image push |\n| `MAVEN_GPG_PRIVATE_KEY`, `MAVEN_GPG_PASSPHRASE`, `MAVEN_CENTRAL_USERNAME`, `MAVEN_CENTRAL_PASSWORD` | `JavaLibraryProject` without `mavenCentralOidc` | Not needed with OIDC trusted publishing |\n| (your Slack webhook secret) | CDK types with `slackWebhookSecret` | Deploy notifications |\n\n## Going further\n\nThe project types are composed from smaller components you can also attach to your own projects:\n\n| Component | Applies to | Purpose |\n| --- | --- | --- |\n| `AppRuntimeScaffold` | `NodeProject` | App source skeleton (`app.ts` + handlers) |\n| `DatabaseComponent` | `NodeProject` | Database construct stub + migration tool wiring |\n| `EcrEcsConstructs` | `Project` | ECR + Fargate ECS construct helper |\n| `EdgeNetworkingConstructs` | `Project` | Per-resource edge networking construct helpers |\n| `MavenCentralPublish` | `JavaProject` | Manual-dispatch Maven Central publish workflow |\n| `DockerPublish` | `JavaProject` | Manual-dispatch Docker build+push workflow |\n| `GitHubPackagesPublish` | `JavaProject` | Manual-dispatch GitHub Packages publish workflow |\n| `FlywayMigration` | `JavaProject` | Flyway plugin/dependency + migrations directory |\n| `CdkDeployHook` | `JavaProject` | Manual-dispatch workflow that triggers `deploy.yml` in a companion CDK repo |\n| `CodeIndexWorkflow` | `JavaProject` | Code index generation on push to `main` |\n| `ActionBuildWorkflow` | `GitHubProject` | The `lint` task (shellcheck/yamllint/pinned actionlint) + `build.yml` |\n| `ActionDogfoodWorkflow` | `GitHubProject` | `test-dogfood.yml` from an `ActionDogfoodOptions` scenario |\n| `ActionSonarWorkflow` | `GitHubProject` | `sonar.yml` (self-hosted SonarQube via the Scanner CLI) |\n\nExample - adding a Docker publish to a plain projen `JavaProject`:\n\n```typescript\nimport { java } from 'projen';\nimport { DockerPublish } from '@xpertss/projen-types';\n\nconst project = new java.JavaProject({\n  name: 'my-service',\n  groupId: 'org.xpertss',\n  artifactId: 'my-service',\n});\n\nnew DockerPublish(project, { dockerRegistry: 'ghcr.io' });\n\nproject.synth();\n```\n\nThe full API reference, including every option and property, is in [API.md](./API.md).\n"
   },
   "repository": {
     "type": "git",
@@ -119,6 +119,538 @@
     }
   },
   "types": {
+    "@xpertss/projen-types.ActionBuildWorkflow": {
+      "assembly": "@xpertss/projen-types",
+      "base": "projen.Component",
+      "docs": {
+        "remarks": "Creates a dedicated `lint` task\n(named to avoid colliding with projen's own reserved `build` task, which\nspawns the unrelated default/pre-compile/compile/post-compile/test/package\nchain - including `default`, i.e. re-running `.projenrc.ts`, which is not\nwhat this gate is for) and wraps it in a `TaskWorkflow` (`build.yml`)\ntriggered on push-to-`main` and `pull_request`. The same task is reused by\nthe release build job, so the lint commands exist in exactly one place.",
+        "stability": "experimental",
+        "summary": "The AD-001 Layer-1 lint gate for a composite-action repo: shellcheck, yamllint, and a pinned `actionlint` release binary (verified by SHA-256, never a marketplace action - org policy)."
+      },
+      "fqn": "@xpertss/projen-types.ActionBuildWorkflow",
+      "initializer": {
+        "docs": {
+          "stability": "experimental"
+        },
+        "locationInModule": {
+          "filename": "src/actions/action-build-workflow.ts",
+          "line": 24
+        },
+        "parameters": [
+          {
+            "name": "scope",
+            "type": {
+              "fqn": "projen.github.GitHubProject"
+            }
+          }
+        ]
+      },
+      "kind": "class",
+      "locationInModule": {
+        "filename": "src/actions/action-build-workflow.ts",
+        "line": 20
+      },
+      "name": "ActionBuildWorkflow",
+      "properties": [
+        {
+          "docs": {
+            "stability": "experimental"
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/actions/action-build-workflow.ts",
+            "line": 21
+          },
+          "name": "task",
+          "type": {
+            "fqn": "projen.Task"
+          }
+        },
+        {
+          "docs": {
+            "stability": "experimental"
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/actions/action-build-workflow.ts",
+            "line": 22
+          },
+          "name": "workflow",
+          "type": {
+            "fqn": "projen.github.TaskWorkflow"
+          }
+        }
+      ],
+      "symbolId": "src/actions/action-build-workflow:ActionBuildWorkflow"
+    },
+    "@xpertss/projen-types.ActionDogfoodOptions": {
+      "assembly": "@xpertss/projen-types",
+      "datatype": true,
+      "docs": {
+        "stability": "experimental"
+      },
+      "fqn": "@xpertss/projen-types.ActionDogfoodOptions",
+      "kind": "interface",
+      "locationInModule": {
+        "filename": "src/actions/action-dogfood-workflow.ts",
+        "line": 55
+      },
+      "name": "ActionDogfoodOptions",
+      "properties": [
+        {
+          "abstract": true,
+          "docs": {
+            "stability": "experimental",
+            "summary": "Shell cleanup, run once at the end with `if: always()`, so repeated runs start clean."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/actions/action-dogfood-workflow.ts",
+            "line": 60
+          },
+          "name": "cleanup",
+          "type": {
+            "collection": {
+              "elementtype": {
+                "primitive": "string"
+              },
+              "kind": "array"
+            }
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "stability": "experimental",
+            "summary": "One or more scenario steps, run in order, in the dogfood job."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/actions/action-dogfood-workflow.ts",
+            "line": 57
+          },
+          "name": "scenario",
+          "type": {
+            "collection": {
+              "elementtype": {
+                "fqn": "@xpertss/projen-types.ActionDogfoodStep"
+              },
+              "kind": "array"
+            }
+          }
+        }
+      ],
+      "symbolId": "src/actions/action-dogfood-workflow:ActionDogfoodOptions"
+    },
+    "@xpertss/projen-types.ActionDogfoodStep": {
+      "assembly": "@xpertss/projen-types",
+      "datatype": true,
+      "docs": {
+        "stability": "experimental",
+        "summary": "One invocation of the action within the dogfood scenario: optional fixture setup, the `uses: .` call with this step's inputs, then this step's assertions. Most actions need exactly one; actions with a re-run/no-op behavior to verify (e.g. F006's reuse-the-PR path, F007's no-op-commit path) declare two."
+      },
+      "fqn": "@xpertss/projen-types.ActionDogfoodStep",
+      "kind": "interface",
+      "locationInModule": {
+        "filename": "src/actions/action-dogfood-workflow.ts",
+        "line": 16
+      },
+      "name": "ActionDogfoodStep",
+      "properties": [
+        {
+          "abstract": true,
+          "docs": {
+            "stability": "experimental",
+            "summary": "Shell assertions after this invocation - the job fails unless every one exits 0."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/actions/action-dogfood-workflow.ts",
+            "line": 41
+          },
+          "name": "assertions",
+          "type": {
+            "collection": {
+              "elementtype": {
+                "primitive": "string"
+              },
+              "kind": "array"
+            }
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "stability": "experimental",
+            "summary": "Label used to name this step-group's generated workflow steps."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/actions/action-dogfood-workflow.ts",
+            "line": 18
+          },
+          "name": "name",
+          "type": {
+            "primitive": "string"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "[]",
+            "stability": "experimental",
+            "summary": "Shell steps executed before this invocation, to produce or alter fixture state."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/actions/action-dogfood-workflow.ts",
+            "line": 32
+          },
+          "name": "fixtureSteps",
+          "optional": true,
+          "type": {
+            "collection": {
+              "elementtype": {
+                "primitive": "string"
+              },
+              "kind": "array"
+            }
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "- a slug derived from `name`, disambiguated by position",
+            "stability": "experimental",
+            "summary": "Step id for the `uses: .` invocation, so a later assertion can reference this step's outputs via `${{ steps.<id>.outputs.<name> }}`."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/actions/action-dogfood-workflow.ts",
+            "line": 25
+          },
+          "name": "id",
+          "optional": true,
+          "type": {
+            "primitive": "string"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "{}",
+            "stability": "experimental",
+            "summary": "`with:` inputs for this invocation's local `uses: .` call."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/actions/action-dogfood-workflow.ts",
+            "line": 38
+          },
+          "name": "inputs",
+          "optional": true,
+          "type": {
+            "collection": {
+              "elementtype": {
+                "primitive": "string"
+              },
+              "kind": "map"
+            }
+          }
+        }
+      ],
+      "symbolId": "src/actions/action-dogfood-workflow:ActionDogfoodStep"
+    },
+    "@xpertss/projen-types.ActionDogfoodWorkflow": {
+      "assembly": "@xpertss/projen-types",
+      "base": "projen.Component",
+      "docs": {
+        "stability": "experimental",
+        "summary": "Per AD-001's dogfood test: the composite action is run **against this repo**, end-to-end, via a local `uses: .` reference - no external harness. Builds `test-dogfood.yml` from an ordered `scenario` of invocation steps (see `ActionDogfoodStep`) followed by a shared cleanup step."
+      },
+      "fqn": "@xpertss/projen-types.ActionDogfoodWorkflow",
+      "initializer": {
+        "docs": {
+          "stability": "experimental"
+        },
+        "locationInModule": {
+          "filename": "src/actions/action-dogfood-workflow.ts",
+          "line": 72
+        },
+        "parameters": [
+          {
+            "name": "scope",
+            "type": {
+              "fqn": "projen.github.GitHubProject"
+            }
+          },
+          {
+            "name": "options",
+            "type": {
+              "fqn": "@xpertss/projen-types.ActionDogfoodOptions"
+            }
+          }
+        ]
+      },
+      "kind": "class",
+      "locationInModule": {
+        "filename": "src/actions/action-dogfood-workflow.ts",
+        "line": 69
+      },
+      "name": "ActionDogfoodWorkflow",
+      "properties": [
+        {
+          "docs": {
+            "stability": "experimental"
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/actions/action-dogfood-workflow.ts",
+            "line": 70
+          },
+          "name": "workflow",
+          "type": {
+            "fqn": "projen.github.GithubWorkflow"
+          }
+        }
+      ],
+      "symbolId": "src/actions/action-dogfood-workflow:ActionDogfoodWorkflow"
+    },
+    "@xpertss/projen-types.ActionSonarWorkflow": {
+      "assembly": "@xpertss/projen-types",
+      "base": "projen.Component",
+      "docs": {
+        "remarks": "`sonar.inclusions` is set explicitly since\ndefault inclusions may skip `action.yml` outside `.github/`.",
+        "stability": "experimental",
+        "summary": "AD-001 Layer 2: self-hosted SonarQube Community Edition via the Scanner CLI only (never `SonarSource/sonarqube-scan-action` - third-party, and it carried a security advisory)."
+      },
+      "fqn": "@xpertss/projen-types.ActionSonarWorkflow",
+      "initializer": {
+        "docs": {
+          "stability": "experimental"
+        },
+        "locationInModule": {
+          "filename": "src/actions/action-sonar-workflow.ts",
+          "line": 35
+        },
+        "parameters": [
+          {
+            "name": "scope",
+            "type": {
+              "fqn": "projen.github.GitHubProject"
+            }
+          },
+          {
+            "name": "options",
+            "type": {
+              "fqn": "@xpertss/projen-types.ActionSonarWorkflowOptions"
+            }
+          }
+        ]
+      },
+      "kind": "class",
+      "locationInModule": {
+        "filename": "src/actions/action-sonar-workflow.ts",
+        "line": 32
+      },
+      "name": "ActionSonarWorkflow",
+      "properties": [
+        {
+          "docs": {
+            "stability": "experimental"
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/actions/action-sonar-workflow.ts",
+            "line": 33
+          },
+          "name": "workflow",
+          "type": {
+            "fqn": "projen.github.GithubWorkflow"
+          }
+        }
+      ],
+      "symbolId": "src/actions/action-sonar-workflow:ActionSonarWorkflow"
+    },
+    "@xpertss/projen-types.ActionSonarWorkflowOptions": {
+      "assembly": "@xpertss/projen-types",
+      "datatype": true,
+      "docs": {
+        "stability": "experimental"
+      },
+      "fqn": "@xpertss/projen-types.ActionSonarWorkflowOptions",
+      "kind": "interface",
+      "locationInModule": {
+        "filename": "src/actions/action-sonar-workflow.ts",
+        "line": 9
+      },
+      "name": "ActionSonarWorkflowOptions",
+      "properties": [
+        {
+          "abstract": true,
+          "docs": {
+            "remarks": "Required, no default -\na guessed server is worse than a loud failure.",
+            "stability": "experimental",
+            "summary": "URL of the org's self-hosted SonarQube instance."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/actions/action-sonar-workflow.ts",
+            "line": 14
+          },
+          "name": "sonarHostUrl",
+          "type": {
+            "primitive": "string"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "true",
+            "stability": "experimental",
+            "summary": "Whether `sonar.yml` also runs on `pull_request` as a pass/fail gate."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/actions/action-sonar-workflow.ts",
+            "line": 23
+          },
+          "name": "sonarPullRequestGate",
+          "optional": true,
+          "type": {
+            "primitive": "boolean"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "\"SONAR_TOKEN\"",
+            "stability": "experimental"
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/actions/action-sonar-workflow.ts",
+            "line": 17
+          },
+          "name": "sonarTokenSecret",
+          "optional": true,
+          "type": {
+            "primitive": "string"
+          }
+        }
+      ],
+      "symbolId": "src/actions/action-sonar-workflow:ActionSonarWorkflowOptions"
+    },
+    "@xpertss/projen-types.ActionsAllowlistGuard": {
+      "assembly": "@xpertss/projen-types",
+      "base": "projen.Component",
+      "docs": {
+        "stability": "experimental"
+      },
+      "fqn": "@xpertss/projen-types.ActionsAllowlistGuard",
+      "initializer": {
+        "docs": {
+          "stability": "experimental"
+        },
+        "locationInModule": {
+          "filename": "src/common/actions-allowlist-guard.ts",
+          "line": 41
+        },
+        "parameters": [
+          {
+            "name": "scope",
+            "type": {
+              "fqn": "projen.github.GitHubProject"
+            }
+          },
+          {
+            "name": "options",
+            "optional": true,
+            "type": {
+              "fqn": "@xpertss/projen-types.ActionsAllowlistGuardOptions"
+            }
+          }
+        ]
+      },
+      "kind": "class",
+      "locationInModule": {
+        "filename": "src/common/actions-allowlist-guard.ts",
+        "line": 38
+      },
+      "name": "ActionsAllowlistGuard",
+      "properties": [
+        {
+          "docs": {
+            "stability": "experimental"
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/common/actions-allowlist-guard.ts",
+            "line": 39
+          },
+          "name": "workflow",
+          "type": {
+            "fqn": "projen.github.GithubWorkflow"
+          }
+        }
+      ],
+      "symbolId": "src/common/actions-allowlist-guard:ActionsAllowlistGuard"
+    },
+    "@xpertss/projen-types.ActionsAllowlistGuardOptions": {
+      "assembly": "@xpertss/projen-types",
+      "datatype": true,
+      "docs": {
+        "remarks": "Runs on `pull_request_target` so it always executes the copy of this\nworkflow committed on the base branch - a PR cannot edit this file to\ndisable or weaken the check. It checks out and executes nothing from the\nPR; it only reads the PR head's file content via the GitHub API. Because\n`pull_request_target` runs with the base repo's token even for\nfork-originated PRs, the failure comment posts reliably.\n\n It performs a flat, unconditional scan of the PR's head ref (no\n base-vs-head comparison): fetch the content of every GitHub workflow and\n composite-action file, extract every `uses:` value, and fail if any does\n not start with one of the three trusted namespaces from AD-001\n (`actions/`, `docker/`, `xpertss/`). The single\nexemption is a local same-repo reference (`uses: .` or\n`uses: ./.github/actions/<name>`) - the repo's own hand-committed action,\nto which the org policy's \"allow select actions\" setting does not apply.",
+        "stability": "experimental",
+        "summary": "Blocking, tamper-proof PR check that stops a disallowed GitHub Action reference from ever (re)appearing in a repo's workflow or composite-action files."
+      },
+      "fqn": "@xpertss/projen-types.ActionsAllowlistGuardOptions",
+      "kind": "interface",
+      "locationInModule": {
+        "filename": "src/common/actions-allowlist-guard.ts",
+        "line": 25
+      },
+      "name": "ActionsAllowlistGuardOptions",
+      "properties": [
+        {
+          "abstract": true,
+          "docs": {
+            "default": "\"PROJEN_GITHUB_TOKEN\"",
+            "remarks": "The check still fails without it, so fork PRs -\nwhich get no secrets - are only missing the extra comment.",
+            "stability": "experimental",
+            "summary": "GitHub secret holding a token with permission to comment on PRs, used for the failure comment."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/common/actions-allowlist-guard.ts",
+            "line": 32
+          },
+          "name": "gheTokenSecret",
+          "optional": true,
+          "type": {
+            "primitive": "string"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "\"actions-allowlist-guard\"",
+            "stability": "experimental"
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/common/actions-allowlist-guard.ts",
+            "line": 35
+          },
+          "name": "workflowName",
+          "optional": true,
+          "type": {
+            "primitive": "string"
+          }
+        }
+      ],
+      "symbolId": "src/common/actions-allowlist-guard:ActionsAllowlistGuardOptions"
+    },
     "@xpertss/projen-types.AppRuntimeScaffold": {
       "assembly": "@xpertss/projen-types",
       "base": "projen.Component",
@@ -173,7 +705,7 @@
         },
         "locationInModule": {
           "filename": "src/cdk/cdk-app-project.ts",
-          "line": 14
+          "line": 13
         },
         "parameters": [
           {
@@ -187,7 +719,7 @@
       "kind": "class",
       "locationInModule": {
         "filename": "src/cdk/cdk-app-project.ts",
-        "line": 13
+        "line": 12
       },
       "name": "CdkAppProject",
       "symbolId": "src/cdk/cdk-app-project:CdkAppProject"
@@ -205,7 +737,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "src/cdk/options.ts",
-        "line": 53
+        "line": 50
       },
       "name": "CdkAppProjectOptions",
       "properties": [
@@ -218,7 +750,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/cdk/options.ts",
-            "line": 57
+            "line": 54
           },
           "name": "appEntryPoint",
           "optional": true,
@@ -234,7 +766,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/cdk/options.ts",
-            "line": 54
+            "line": 51
           },
           "name": "database",
           "optional": true,
@@ -403,7 +935,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "src/cdk/options.ts",
-        "line": 36
+        "line": 33
       },
       "name": "CdkInfraProjectOptions",
       "properties": [
@@ -416,7 +948,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/cdk/options.ts",
-            "line": 38
+            "line": 35
           },
           "name": "environments",
           "type": {
@@ -445,7 +977,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/cdk/options.ts",
-            "line": 40
+            "line": 37
           },
           "name": "ecrEcs",
           "optional": true,
@@ -461,7 +993,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/cdk/options.ts",
-            "line": 42
+            "line": 39
           },
           "name": "edgeResources",
           "optional": true,
@@ -491,7 +1023,7 @@
         },
         "locationInModule": {
           "filename": "src/cdk/cdk-typescript-base.ts",
-          "line": 19
+          "line": 23
         },
         "parameters": [
           {
@@ -505,7 +1037,7 @@
       "kind": "class",
       "locationInModule": {
         "filename": "src/cdk/cdk-typescript-base.ts",
-        "line": 18
+        "line": 22
       },
       "name": "CdkTypescriptProject",
       "symbolId": "src/cdk/cdk-typescript-base:CdkTypescriptProject"
@@ -523,7 +1055,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "src/cdk/cdk-typescript-base.ts",
-        "line": 7
+        "line": 11
       },
       "name": "CdkTypescriptProjectOptions",
       "properties": [
@@ -535,7 +1067,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/cdk/cdk-typescript-base.ts",
-            "line": 8
+            "line": 12
           },
           "name": "environments",
           "optional": true,
@@ -655,23 +1187,6 @@
           "type": {
             "primitive": "string"
           }
-        },
-        {
-          "abstract": true,
-          "docs": {
-            "stability": "experimental",
-            "summary": "GitHub secret holding a Slack webhook URL for deploy notifications."
-          },
-          "immutable": true,
-          "locationInModule": {
-            "filename": "src/cdk/options.ts",
-            "line": 33
-          },
-          "name": "slackWebhookSecret",
-          "optional": true,
-          "type": {
-            "primitive": "string"
-          }
         }
       ],
       "symbolId": "src/cdk/options:CommonCdkOptions"
@@ -841,7 +1356,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "src/cdk/options.ts",
-        "line": 45
+        "line": 42
       },
       "name": "DatabaseOptions",
       "properties": [
@@ -854,7 +1369,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/cdk/options.ts",
-            "line": 47
+            "line": 44
           },
           "name": "engine",
           "optional": true,
@@ -871,7 +1386,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/cdk/options.ts",
-            "line": 50
+            "line": 47
           },
           "name": "migrationTool",
           "optional": true,
@@ -1112,14 +1627,262 @@
           "abstract": true,
           "docs": {
             "stability": "experimental",
-            "summary": "Environment name, e.g. \"dev\", \"stage\", \"prod\"."
+            "summary": "Environment name, e.g. \"dev\", \"stage\", \"prod\"."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/common/environment-options.ts",
+            "line": 6
+          },
+          "name": "name",
+          "type": {
+            "primitive": "string"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "stability": "experimental",
+            "summary": "AWS account id to deploy into, if relevant to the deploy steps used."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/common/environment-options.ts",
+            "line": 9
+          },
+          "name": "accountId",
+          "optional": true,
+          "type": {
+            "primitive": "string"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "stability": "experimental",
+            "summary": "AWS region to deploy into, if relevant to the deploy steps used."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/common/environment-options.ts",
+            "line": 12
+          },
+          "name": "region",
+          "optional": true,
+          "type": {
+            "primitive": "string"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "false",
+            "stability": "experimental",
+            "summary": "Whether this environment requires a GitHub Environment approval gate before the deploy job is allowed to run."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/common/environment-options.ts",
+            "line": 20
+          },
+          "name": "requiresApproval",
+          "optional": true,
+          "type": {
+            "primitive": "boolean"
+          }
+        }
+      ],
+      "symbolId": "src/common/environment-options:EnvironmentOptions"
+    },
+    "@xpertss/projen-types.FlywayMigration": {
+      "assembly": "@xpertss/projen-types",
+      "base": "projen.Component",
+      "docs": {
+        "stability": "experimental",
+        "summary": "Adds Flyway config/dependencies + a migrations directory for DB migrations."
+      },
+      "fqn": "@xpertss/projen-types.FlywayMigration",
+      "initializer": {
+        "docs": {
+          "stability": "experimental"
+        },
+        "locationInModule": {
+          "filename": "src/java/components/flyway-migration.ts",
+          "line": 6
+        },
+        "parameters": [
+          {
+            "name": "project",
+            "type": {
+              "fqn": "projen.java.JavaProject"
+            }
+          }
+        ]
+      },
+      "kind": "class",
+      "locationInModule": {
+        "filename": "src/java/components/flyway-migration.ts",
+        "line": 5
+      },
+      "name": "FlywayMigration",
+      "symbolId": "src/java/components/flyway-migration:FlywayMigration"
+    },
+    "@xpertss/projen-types.GitHubActionProject": {
+      "assembly": "@xpertss/projen-types",
+      "base": "projen.github.GitHubProject",
+      "docs": {
+        "stability": "experimental",
+        "summary": "Scaffolds the repo lifecycle (AD-001) around a hand-committed, composite (shell) GitHub Action: the `build`/`test-dogfood`/`sonar`/`release` workflows, versioning and release discipline, the F003 verify components, the F009 allowlist guard, and repo boilerplate (`tsconfig.json` for `.projenrc.ts`, a private version-source `package.json`, `.yamllint`, `LICENSE`, and a `README.md` template). The action's own content (`action.yml`, its shell scripts, `test/` fixtures) is authored by hand per the action's own F### spec - this type only lints it."
+      },
+      "fqn": "@xpertss/projen-types.GitHubActionProject",
+      "initializer": {
+        "docs": {
+          "stability": "experimental"
+        },
+        "locationInModule": {
+          "filename": "src/actions/github-action-project.ts",
+          "line": 126
+        },
+        "parameters": [
+          {
+            "name": "options",
+            "type": {
+              "fqn": "@xpertss/projen-types.GitHubActionProjectOptions"
+            }
+          }
+        ]
+      },
+      "kind": "class",
+      "locationInModule": {
+        "filename": "src/actions/github-action-project.ts",
+        "line": 120
+      },
+      "name": "GitHubActionProject",
+      "properties": [
+        {
+          "docs": {
+            "stability": "experimental"
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/actions/github-action-project.ts",
+            "line": 121
+          },
+          "name": "buildWorkflow",
+          "type": {
+            "fqn": "@xpertss/projen-types.ActionBuildWorkflow"
+          }
+        },
+        {
+          "docs": {
+            "stability": "experimental"
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/actions/github-action-project.ts",
+            "line": 122
+          },
+          "name": "dogfoodWorkflow",
+          "type": {
+            "fqn": "@xpertss/projen-types.ActionDogfoodWorkflow"
+          }
+        },
+        {
+          "docs": {
+            "stability": "experimental"
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/actions/github-action-project.ts",
+            "line": 124
+          },
+          "name": "release",
+          "type": {
+            "fqn": "projen.release.Release"
+          }
+        },
+        {
+          "docs": {
+            "stability": "experimental"
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/actions/github-action-project.ts",
+            "line": 123
+          },
+          "name": "sonarWorkflow",
+          "type": {
+            "fqn": "@xpertss/projen-types.ActionSonarWorkflow"
+          }
+        }
+      ],
+      "symbolId": "src/actions/github-action-project:GitHubActionProject"
+    },
+    "@xpertss/projen-types.GitHubActionProjectOptions": {
+      "assembly": "@xpertss/projen-types",
+      "datatype": true,
+      "docs": {
+        "stability": "experimental"
+      },
+      "fqn": "@xpertss/projen-types.GitHubActionProjectOptions",
+      "interfaces": [
+        "projen.github.GitHubProjectOptions"
+      ],
+      "kind": "interface",
+      "locationInModule": {
+        "filename": "src/actions/github-action-project.ts",
+        "line": 37
+      },
+      "name": "GitHubActionProjectOptions",
+      "properties": [
+        {
+          "abstract": true,
+          "docs": {
+            "remarks": "What fixture state, what to assert, and\nhow to clean up are specified by the action's own F### spec - the\nhighest-risk behavior of that action. Required: a default no-op\ndogfood would silently hollow out a load-bearing AD-001 workflow.",
+            "stability": "experimental",
+            "summary": "The dogfood scenario (AD-001)."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/actions/github-action-project.ts",
+            "line": 75
+          },
+          "name": "dogfood",
+          "type": {
+            "fqn": "@xpertss/projen-types.ActionDogfoodOptions"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "remarks": "MUST be reachable from\ngithub.com-hosted (public) runners (AD-001). Required, no default: a\nguessed server is worse than a loud failure.",
+            "stability": "experimental",
+            "summary": "URL of the org's self-hosted SonarQube instance."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/actions/github-action-project.ts",
+            "line": 58
+          },
+          "name": "sonarHostUrl",
+          "type": {
+            "primitive": "string"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "remarks": "Used in the default README\ntemplate and recorded in the private `package.json`.",
+            "stability": "experimental",
+            "summary": "One-line description of the action."
           },
           "immutable": true,
           "locationInModule": {
-            "filename": "src/common/environment-options.ts",
-            "line": 6
+            "filename": "src/actions/github-action-project.ts",
+            "line": 43
           },
-          "name": "name",
+          "name": "description",
+          "optional": true,
           "type": {
             "primitive": "string"
           }
@@ -1127,15 +1890,16 @@
         {
           "abstract": true,
           "docs": {
+            "default": "\"PROJEN_GITHUB_TOKEN\"",
             "stability": "experimental",
-            "summary": "AWS account id to deploy into, if relevant to the deploy steps used."
+            "summary": "Name of the GitHub Actions secret holding the PAT used for projen-automation PR comments (F003/F009) and, when the action has a `token` input, the dogfood's invocation of it."
           },
           "immutable": true,
           "locationInModule": {
-            "filename": "src/common/environment-options.ts",
-            "line": 9
+            "filename": "src/actions/github-action-project.ts",
+            "line": 51
           },
-          "name": "accountId",
+          "name": "gheTokenSecret",
           "optional": true,
           "type": {
             "primitive": "string"
@@ -1144,15 +1908,16 @@
         {
           "abstract": true,
           "docs": {
+            "default": "\"MIT\"",
             "stability": "experimental",
-            "summary": "AWS region to deploy into, if relevant to the deploy steps used."
+            "summary": "SPDX identifier for the generated `LICENSE`."
           },
           "immutable": true,
           "locationInModule": {
-            "filename": "src/common/environment-options.ts",
-            "line": 12
+            "filename": "src/actions/github-action-project.ts",
+            "line": 81
           },
-          "name": "region",
+          "name": "license",
           "optional": true,
           "type": {
             "primitive": "string"
@@ -1161,56 +1926,40 @@
         {
           "abstract": true,
           "docs": {
-            "default": "false",
+            "default": "true",
             "stability": "experimental",
-            "summary": "Whether this environment requires a GitHub Environment approval gate before the deploy job is allowed to run."
+            "summary": "Whether `sonar.yml` also runs on `pull_request` as a pass/fail gate."
           },
           "immutable": true,
           "locationInModule": {
-            "filename": "src/common/environment-options.ts",
-            "line": 20
+            "filename": "src/actions/github-action-project.ts",
+            "line": 67
           },
-          "name": "requiresApproval",
+          "name": "sonarPullRequestGate",
           "optional": true,
           "type": {
             "primitive": "boolean"
           }
-        }
-      ],
-      "symbolId": "src/common/environment-options:EnvironmentOptions"
-    },
-    "@xpertss/projen-types.FlywayMigration": {
-      "assembly": "@xpertss/projen-types",
-      "base": "projen.Component",
-      "docs": {
-        "stability": "experimental",
-        "summary": "Adds Flyway config/dependencies + a migrations directory for DB migrations."
-      },
-      "fqn": "@xpertss/projen-types.FlywayMigration",
-      "initializer": {
-        "docs": {
-          "stability": "experimental"
-        },
-        "locationInModule": {
-          "filename": "src/java/components/flyway-migration.ts",
-          "line": 6
         },
-        "parameters": [
-          {
-            "name": "project",
-            "type": {
-              "fqn": "projen.java.JavaProject"
-            }
+        {
+          "abstract": true,
+          "docs": {
+            "default": "\"SONAR_TOKEN\"",
+            "stability": "experimental"
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/actions/github-action-project.ts",
+            "line": 61
+          },
+          "name": "sonarTokenSecret",
+          "optional": true,
+          "type": {
+            "primitive": "string"
           }
-        ]
-      },
-      "kind": "class",
-      "locationInModule": {
-        "filename": "src/java/components/flyway-migration.ts",
-        "line": 5
-      },
-      "name": "FlywayMigration",
-      "symbolId": "src/java/components/flyway-migration:FlywayMigration"
+        }
+      ],
+      "symbolId": "src/actions/github-action-project:GitHubActionProjectOptions"
     },
     "@xpertss/projen-types.GitHubPackagesPublish": {
       "assembly": "@xpertss/projen-types",
@@ -1458,7 +2207,7 @@
         },
         "locationInModule": {
           "filename": "src/java/java-maven-base.ts",
-          "line": 19
+          "line": 22
         },
         "parameters": [
           {
@@ -1472,7 +2221,7 @@
       "kind": "class",
       "locationInModule": {
         "filename": "src/java/java-maven-base.ts",
-        "line": 15
+        "line": 18
       },
       "name": "JavaMavenProject",
       "properties": [
@@ -1483,7 +2232,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/java/java-maven-base.ts",
-            "line": 17
+            "line": 20
           },
           "name": "buildVerifyWorkflow",
           "type": {
@@ -1497,7 +2246,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/java/java-maven-base.ts",
-            "line": 16
+            "line": 19
           },
           "name": "upgradeTask",
           "type": {
@@ -1520,7 +2269,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "src/java/java-maven-base.ts",
-        "line": 7
+        "line": 10
       },
       "name": "JavaMavenProjectOptions",
       "symbolId": "src/java/java-maven-base:JavaMavenProjectOptions"
@@ -1735,8 +2484,250 @@
         }
       ],
       "symbolId": "src/java/components/maven-central-publish:MavenCentralPublishOptions"
+    },
+    "@xpertss/projen-types.ProjenDriftCheckWorkflow": {
+      "assembly": "@xpertss/projen-types",
+      "base": "projen.Component",
+      "docs": {
+        "stability": "experimental"
+      },
+      "fqn": "@xpertss/projen-types.ProjenDriftCheckWorkflow",
+      "initializer": {
+        "docs": {
+          "stability": "experimental"
+        },
+        "locationInModule": {
+          "filename": "src/common/projen-drift-check-workflow.ts",
+          "line": 40
+        },
+        "parameters": [
+          {
+            "name": "scope",
+            "type": {
+              "fqn": "projen.github.GitHubProject"
+            }
+          },
+          {
+            "name": "options",
+            "optional": true,
+            "type": {
+              "fqn": "@xpertss/projen-types.ProjenDriftCheckWorkflowOptions"
+            }
+          }
+        ]
+      },
+      "kind": "class",
+      "locationInModule": {
+        "filename": "src/common/projen-drift-check-workflow.ts",
+        "line": 37
+      },
+      "name": "ProjenDriftCheckWorkflow",
+      "properties": [
+        {
+          "docs": {
+            "stability": "experimental"
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/common/projen-drift-check-workflow.ts",
+            "line": 38
+          },
+          "name": "workflow",
+          "type": {
+            "fqn": "projen.github.GithubWorkflow"
+          }
+        }
+      ],
+      "symbolId": "src/common/projen-drift-check-workflow:ProjenDriftCheckWorkflow"
+    },
+    "@xpertss/projen-types.ProjenDriftCheckWorkflowOptions": {
+      "assembly": "@xpertss/projen-types",
+      "datatype": true,
+      "docs": {
+        "remarks": "Re-runs the project's synth command on the PR head and fails if the\nregenerated output no longer matches what's committed - i.e. someone\nhand-edited a generated file (package.json / pom.xml /\n.github/workflows/*.yml / ...) instead of going through `.projenrc.ts`.\n\nRuns on `pull_request` so it genuinely executes the PR's own code (the\nonly way to detect drift) - and therefore, by necessity, a PR author can\ndisable it within their own PR. That residual exposure is bounded by\n`WorkflowChangeNoticeWorkflow` (Check 2), which is tamper-proof and flags\nany touch to `.github/workflows/**`. See the F003 spec's Security section.",
+        "stability": "experimental",
+        "summary": "PR-triggered check that rejects direct edits to projen-managed files."
+      },
+      "fqn": "@xpertss/projen-types.ProjenDriftCheckWorkflowOptions",
+      "kind": "interface",
+      "locationInModule": {
+        "filename": "src/common/projen-drift-check-workflow.ts",
+        "line": 17
+      },
+      "name": "ProjenDriftCheckWorkflowOptions",
+      "properties": [
+        {
+          "abstract": true,
+          "docs": {
+            "default": "\"PROJEN_GITHUB_TOKEN\"",
+            "remarks": "The check still fails (and\nemits `::error::` annotations) without it, so fork PRs - which get no\nsecrets - are only missing the extra comment.",
+            "stability": "experimental",
+            "summary": "GitHub secret holding a token with permission to comment on PRs, used for the best-effort drift report comment."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/common/projen-drift-check-workflow.ts",
+            "line": 31
+          },
+          "name": "gheTokenSecret",
+          "optional": true,
+          "type": {
+            "primitive": "string"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "\"npx projen\"",
+            "stability": "experimental",
+            "summary": "The command that regenerates the project from `.projenrc.ts`."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/common/projen-drift-check-workflow.ts",
+            "line": 22
+          },
+          "name": "projenCommand",
+          "optional": true,
+          "type": {
+            "primitive": "string"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "\"projen-drift-check\"",
+            "stability": "experimental"
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/common/projen-drift-check-workflow.ts",
+            "line": 34
+          },
+          "name": "workflowName",
+          "optional": true,
+          "type": {
+            "primitive": "string"
+          }
+        }
+      ],
+      "symbolId": "src/common/projen-drift-check-workflow:ProjenDriftCheckWorkflowOptions"
+    },
+    "@xpertss/projen-types.WorkflowChangeNoticeWorkflow": {
+      "assembly": "@xpertss/projen-types",
+      "base": "projen.Component",
+      "docs": {
+        "stability": "experimental"
+      },
+      "fqn": "@xpertss/projen-types.WorkflowChangeNoticeWorkflow",
+      "initializer": {
+        "docs": {
+          "stability": "experimental"
+        },
+        "locationInModule": {
+          "filename": "src/common/workflow-change-notice-workflow.ts",
+          "line": 36
+        },
+        "parameters": [
+          {
+            "name": "scope",
+            "type": {
+              "fqn": "projen.github.GitHubProject"
+            }
+          },
+          {
+            "name": "options",
+            "optional": true,
+            "type": {
+              "fqn": "@xpertss/projen-types.WorkflowChangeNoticeWorkflowOptions"
+            }
+          }
+        ]
+      },
+      "kind": "class",
+      "locationInModule": {
+        "filename": "src/common/workflow-change-notice-workflow.ts",
+        "line": 33
+      },
+      "name": "WorkflowChangeNoticeWorkflow",
+      "properties": [
+        {
+          "docs": {
+            "stability": "experimental"
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/common/workflow-change-notice-workflow.ts",
+            "line": 34
+          },
+          "name": "workflow",
+          "type": {
+            "fqn": "projen.github.GithubWorkflow"
+          }
+        }
+      ],
+      "symbolId": "src/common/workflow-change-notice-workflow:WorkflowChangeNoticeWorkflow"
+    },
+    "@xpertss/projen-types.WorkflowChangeNoticeWorkflowOptions": {
+      "assembly": "@xpertss/projen-types",
+      "datatype": true,
+      "docs": {
+        "remarks": "Runs on `pull_request_target` (NOT `pull_request`) so it always executes\nthe copy of this workflow committed on the base branch - a PR cannot edit\nthis file to disable or weaken the notice. It checks out and executes\nnothing from the PR; it only lists the changed filenames via the GitHub\nAPI and posts a non-blocking NOTE. Because `pull_request_target` runs with\nthe base repo's normal token even for fork-originated PRs, the comment\nposts reliably with no degraded fallback.\n\nThis check NEVER fails the build - it is purely informational (reviewer\nattention). It is the tamper-proof backstop that bounds Check 1's\n(`ProjenDriftCheckWorkflow`) residual exposure. See the F003 spec's\nSecurity section.",
+        "stability": "experimental",
+        "summary": "PR-triggered, tamper-proof notice that a PR touches GitHub Actions workflow or action files."
+      },
+      "fqn": "@xpertss/projen-types.WorkflowChangeNoticeWorkflowOptions",
+      "kind": "interface",
+      "locationInModule": {
+        "filename": "src/common/workflow-change-notice-workflow.ts",
+        "line": 20
+      },
+      "name": "WorkflowChangeNoticeWorkflowOptions",
+      "properties": [
+        {
+          "abstract": true,
+          "docs": {
+            "default": "[\".github/workflows/**\", \".github/actions/**\"]",
+            "stability": "experimental",
+            "summary": "Glob patterns (bash `[[ string == pattern ]]` semantics, where `*` also matches `/`) that trigger the notice when a changed PR file matches any of them."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/common/workflow-change-notice-workflow.ts",
+            "line": 27
+          },
+          "name": "watchPaths",
+          "optional": true,
+          "type": {
+            "collection": {
+              "elementtype": {
+                "primitive": "string"
+              },
+              "kind": "array"
+            }
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "\"workflow-change-notice\"",
+            "stability": "experimental"
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/common/workflow-change-notice-workflow.ts",
+            "line": 30
+          },
+          "name": "workflowName",
+          "optional": true,
+          "type": {
+            "primitive": "string"
+          }
+        }
+      ],
+      "symbolId": "src/common/workflow-change-notice-workflow:WorkflowChangeNoticeWorkflowOptions"
     }
   },
-  "version": "0.0.1",
-  "fingerprint": "5HJBVxiVak9yT4UhZH/yhikRW6RBSsaJ6eYsfOuA27U="
+  "version": "0.0.2",
+  "fingerprint": "SOREw4FllfwWFwxt950SKH0rCoRLyBQ4OrDsDR7T0SI="
 }