@xpertss/projen-types 0.0.1 → 0.0.2

package/lib/common/projen-drift-check-workflow.d.ts

@@ -0,0 +1,36 @@
+import { Component, github } from 'projen';
+/**
+ * PR-triggered check that rejects direct edits to projen-managed files.
+ *
+ * Re-runs the project's synth command on the PR head and fails if the
+ * regenerated output no longer matches what's committed - i.e. someone
+ * hand-edited a generated file (package.json / pom.xml /
+ * .github/workflows/*.yml / ...) instead of going through `.projenrc.ts`.
+ *
+ * Runs on `pull_request` so it genuinely executes the PR's own code (the
+ * only way to detect drift) - and therefore, by necessity, a PR author can
+ * disable it within their own PR. That residual exposure is bounded by
+ * `WorkflowChangeNoticeWorkflow` (Check 2), which is tamper-proof and flags
+ * any touch to `.github/workflows/**`. See the F003 spec's Security section.
+ */
+export interface ProjenDriftCheckWorkflowOptions {
+    /**
+     * The command that regenerates the project from `.projenrc.ts`.
+     * @default "npx projen"
+     */
+    readonly projenCommand?: string;
+    /**
+     * GitHub secret holding a token with permission to comment on PRs, used
+     * for the best-effort drift report comment. The check still fails (and
+     * emits `::error::` annotations) without it, so fork PRs - which get no
+     * secrets - are only missing the extra comment.
+     * @default "PROJEN_GITHUB_TOKEN"
+     */
+    readonly gheTokenSecret?: string;
+    /** @default "projen-drift-check" */
+    readonly workflowName?: string;
+}
+export declare class ProjenDriftCheckWorkflow extends Component {
+    readonly workflow: github.GithubWorkflow;
+    constructor(scope: github.GitHubProject, options?: ProjenDriftCheckWorkflowOptions);
+}

package/lib/common/projen-drift-check-workflow.js

@@ -0,0 +1,73 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ProjenDriftCheckWorkflow = void 0;
+const JSII_RTTI_SYMBOL_1 = Symbol.for("jsii.rtti");
+const projen_1 = require("projen");
+class ProjenDriftCheckWorkflow extends projen_1.Component {
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@xpertss/projen-types.ProjenDriftCheckWorkflow", version: "0.0.2" };
+    workflow;
+    constructor(scope, options = {}) {
+        super(scope, 'ProjenDriftCheckWorkflow');
+        const gh = scope.github;
+        if (!gh) {
+            throw new Error('ProjenDriftCheckWorkflow requires GitHub integration to be enabled');
+        }
+        const projenCommand = options.projenCommand ?? 'npx projen';
+        const gheTokenSecret = options.gheTokenSecret ?? 'PROJEN_GITHUB_TOKEN';
+        this.workflow = new projen_1.github.GithubWorkflow(gh, options.workflowName ?? 'projen-drift-check');
+        this.workflow.on({ pullRequest: {} });
+        this.workflow.addJob('check', {
+            runsOn: ['ubuntu-latest'],
+            permissions: { contents: projen_1.github.workflows.JobPermission.READ },
+            env: { GH_TOKEN: `\${{ secrets.${gheTokenSecret} }}` },
+            steps: [
+                {
+                    name: 'Checkout',
+                    uses: 'actions/checkout@v4',
+                    with: {
+                        ref: '${{ github.event.pull_request.head.ref }}',
+                        repository: '${{ github.event.pull_request.head.repo.full_name }}',
+                    },
+                },
+                {
+                    name: 'Setup Node',
+                    uses: 'actions/setup-node@v4',
+                    with: { 'node-version': 'lts/*' },
+                },
+                {
+                    name: 'Install dependencies',
+                    run: 'npm ci',
+                },
+                {
+                    name: 'Check for projen drift',
+                    run: `set -euo pipefail
+${projenCommand}
+drifted="$(git diff --name-only)"
+if [ -n "$drifted" ]; then
+  while IFS= read -r f; do
+    echo "::error file=$f::projen-managed file was edited directly; make the change in .projenrc.ts and re-run npx projen"
+  done <<< "$drifted"
+  if [ -n "$GH_TOKEN" ] && [ -n "$GITHUB_EVENT_PATH" ]; then
+    pr_number="$(jq -r ".pull_request.number // empty" "$GITHUB_EVENT_PATH" 2>/dev/null || true)"
+    if [ -n "$pr_number" ]; then
+      {
+        echo "❌ projen drift detected"
+        echo ""
+        echo "These files are managed by projen and were edited directly. Direct edits are silently overwritten by the next npx projen run, so they cannot be merged as-is:"
+        echo ""
+        while IFS= read -r f; do echo "  - $f"; done <<< "$drifted"
+        echo ""
+        echo "To fix: revert the direct edits above, make the equivalent change in .projenrc.ts, then run npx projen and commit the regenerated output."
+      } | gh pr comment "$pr_number" --body-file - || echo "::warning::could not post PR comment (fork PR or missing token)"
+    fi
+  fi
+  exit 1
+fi
+`,
+                },
+            ],
+        });
+    }
+}
+exports.ProjenDriftCheckWorkflow = ProjenDriftCheckWorkflow;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicHJvamVuLWRyaWZ0LWNoZWNrLXdvcmtmbG93LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL2NvbW1vbi9wcm9qZW4tZHJpZnQtY2hlY2std29ya2Zsb3cudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7OztBQUFBLG1DQUEyQztBQW9DM0MsTUFBYSx3QkFBeUIsU0FBUSxrQkFBUzs7SUFDckMsUUFBUSxDQUF3QjtJQUVoRCxZQUNFLEtBQTJCLEVBQzNCLFVBQTJDLEVBQUU7UUFFN0MsS0FBSyxDQUFDLEtBQUssRUFBRSwwQkFBMEIsQ0FBQyxDQUFDO1FBRXpDLE1BQU0sRUFBRSxHQUFHLEtBQUssQ0FBQyxNQUFNLENBQUM7UUFDeEIsSUFBSSxDQUFDLEVBQUUsRUFBRSxDQUFDO1lBQ1IsTUFBTSxJQUFJLEtBQUssQ0FDYixvRUFBb0UsQ0FDckUsQ0FBQztRQUNKLENBQUM7UUFFRCxNQUFNLGFBQWEsR0FBRyxPQUFPLENBQUMsYUFBYSxJQUFJLFlBQVksQ0FBQztRQUM1RCxNQUFNLGNBQWMsR0FBRyxPQUFPLENBQUMsY0FBYyxJQUFJLHFCQUFxQixDQUFDO1FBRXZFLElBQUksQ0FBQyxRQUFRLEdBQUcsSUFBSSxlQUFNLENBQUMsY0FBYyxDQUN2QyxFQUFFLEVBQ0YsT0FBTyxDQUFDLFlBQVksSUFBSSxvQkFBb0IsQ0FDN0MsQ0FBQztRQUNGLElBQUksQ0FBQyxRQUFRLENBQUMsRUFBRSxDQUFDLEVBQUUsV0FBVyxFQUFFLEVBQUUsRUFBRSxDQUFDLENBQUM7UUFDdEMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxNQUFNLENBQUMsT0FBTyxFQUFFO1lBQzVCLE1BQU0sRUFBRSxDQUFDLGVBQWUsQ0FBQztZQUN6QixXQUFXLEVBQUUsRUFBRSxRQUFRLEVBQUUsZUFBTSxDQUFDLFNBQVMsQ0FBQyxhQUFhLENBQUMsSUFBSSxFQUFFO1lBQzlELEdBQUcsRUFBRSxFQUFFLFFBQVEsRUFBRSxnQkFBZ0IsY0FBYyxLQUFLLEVBQUU7WUFDdEQsS0FBSyxFQUFFO2dCQUNMO29CQUNFLElBQUksRUFBRSxVQUFVO29CQUNoQixJQUFJLEVBQUUscUJBQXFCO29CQUMzQixJQUFJLEVBQUU7d0JBQ0osR0FBRyxFQUFFLDJDQUEyQzt3QkFDaEQsVUFBVSxFQUFFLHNEQUFzRDtxQkFDbkU7aUJBQ0Y7Z0JBQ0Q7b0JBQ0UsSUFBSSxFQUFFLFlBQVk7b0JBQ2xCLElBQUksRUFBRSx1QkFBdUI7b0JBQzdCLElBQUksRUFBRSxFQUFFLGNBQWMsRUFBRSxPQUFPLEVBQUU7aUJBQ2xDO2dCQUNEO29CQUNFLElBQUksRUFBRSxzQkFBc0I7b0JBQzVCLEdBQUcsRUFBRSxRQUFRO2lCQUNkO2dCQUNEO29CQUNFLElBQUksRUFBRSx3QkFBd0I7b0JBQzlCLEdBQUcsRUFBRTtFQUNiLGFBQWE7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Q0FzQmQ7aUJBQ1E7YUFDRjtTQUNGLENBQUMsQ0FBQztJQUNMLENBQUM7O0FBM0VILDREQTRFQyIsInNvdXJjZXNDb250ZW50IjpbImltcG9ydCB7IENvbXBvbmVudCwgZ2l0aHViIH0gZnJvbSAncHJvamVuJztcblxuLyoqXG4gKiBQUi10cmlnZ2VyZWQgY2hlY2sgdGhhdCByZWplY3RzIGRpcmVjdCBlZGl0cyB0byBwcm9qZW4tbWFuYWdlZCBmaWxlcy5cbiAqXG4gKiBSZS1ydW5zIHRoZSBwcm9qZWN0J3Mgc3ludGggY29tbWFuZCBvbiB0aGUgUFIgaGVhZCBhbmQgZmFpbHMgaWYgdGhlXG4gKiByZWdlbmVyYXRlZCBvdXRwdXQgbm8gbG9uZ2VyIG1hdGNoZXMgd2hhdCdzIGNvbW1pdHRlZCAtIGkuZS4gc29tZW9uZVxuICogaGFuZC1lZGl0ZWQgYSBnZW5lcmF0ZWQgZmlsZSAocGFja2FnZS5qc29uIC8gcG9tLnhtbCAvXG4gKiAuZ2l0aHViL3dvcmtmbG93cy8qLnltbCAvIC4uLikgaW5zdGVhZCBvZiBnb2luZyB0aHJvdWdoIGAucHJvamVucmMudHNgLlxuICpcbiAqIFJ1bnMgb24gYHB1bGxfcmVxdWVzdGAgc28gaXQgZ2VudWluZWx5IGV4ZWN1dGVzIHRoZSBQUidzIG93biBjb2RlICh0aGVcbiAqIG9ubHkgd2F5IHRvIGRldGVjdCBkcmlmdCkgLSBhbmQgdGhlcmVmb3JlLCBieSBuZWNlc3NpdHksIGEgUFIgYXV0aG9yIGNhblxuICogZGlzYWJsZSBpdCB3aXRoaW4gdGhlaXIgb3duIFBSLiBUaGF0IHJlc2lkdWFsIGV4cG9zdXJlIGlzIGJvdW5kZWQgYnlcbiAqIGBXb3JrZmxvd0NoYW5nZU5vdGljZVdvcmtmbG93YCAoQ2hlY2sgMiksIHdoaWNoIGlzIHRhbXBlci1wcm9vZiBhbmQgZmxhZ3NcbiAqIGFueSB0b3VjaCB0byBgLmdpdGh1Yi93b3JrZmxvd3MvKipgLiBTZWUgdGhlIEYwMDMgc3BlYydzIFNlY3VyaXR5IHNlY3Rpb24uXG4gKi9cbmV4cG9ydCBpbnRlcmZhY2UgUHJvamVuRHJpZnRDaGVja1dvcmtmbG93T3B0aW9ucyB7XG4gIC8qKlxuICAgKiBUaGUgY29tbWFuZCB0aGF0IHJlZ2VuZXJhdGVzIHRoZSBwcm9qZWN0IGZyb20gYC5wcm9qZW5yYy50c2AuXG4gICAqIEBkZWZhdWx0IFwibnB4IHByb2plblwiXG4gICAqL1xuICByZWFkb25seSBwcm9qZW5Db21tYW5kPzogc3RyaW5nO1xuXG4gIC8qKlxuICAgKiBHaXRIdWIgc2VjcmV0IGhvbGRpbmcgYSB0b2tlbiB3aXRoIHBlcm1pc3Npb24gdG8gY29tbWVudCBvbiBQUnMsIHVzZWRcbiAgICogZm9yIHRoZSBiZXN0LWVmZm9ydCBkcmlmdCByZXBvcnQgY29tbWVudC4gVGhlIGNoZWNrIHN0aWxsIGZhaWxzIChhbmRcbiAgICogZW1pdHMgYDo6ZXJyb3I6OmAgYW5ub3RhdGlvbnMpIHdpdGhvdXQgaXQsIHNvIGZvcmsgUFJzIC0gd2hpY2ggZ2V0IG5vXG4gICAqIHNlY3JldHMgLSBhcmUgb25seSBtaXNzaW5nIHRoZSBleHRyYSBjb21tZW50LlxuICAgKiBAZGVmYXVsdCBcIlBST0pFTl9HSVRIVUJfVE9LRU5cIlxuICAgKi9cbiAgcmVhZG9ubHkgZ2hlVG9rZW5TZWNyZXQ/OiBzdHJpbmc7XG5cbiAgLyoqIEBkZWZhdWx0IFwicHJvamVuLWRyaWZ0LWNoZWNrXCIgKi9cbiAgcmVhZG9ubHkgd29ya2Zsb3dOYW1lPzogc3RyaW5nO1xufVxuXG5leHBvcnQgY2xhc3MgUHJvamVuRHJpZnRDaGVja1dvcmtmbG93IGV4dGVuZHMgQ29tcG9uZW50IHtcbiAgcHVibGljIHJlYWRvbmx5IHdvcmtmbG93OiBnaXRodWIuR2l0aHViV29ya2Zsb3c7XG5cbiAgY29uc3RydWN0b3IoXG4gICAgc2NvcGU6IGdpdGh1Yi5HaXRIdWJQcm9qZWN0LFxuICAgIG9wdGlvbnM6IFByb2plbkRyaWZ0Q2hlY2tXb3JrZmxvd09wdGlvbnMgPSB7fSxcbiAgKSB7XG4gICAgc3VwZXIoc2NvcGUsICdQcm9qZW5EcmlmdENoZWNrV29ya2Zsb3cnKTtcblxuICAgIGNvbnN0IGdoID0gc2NvcGUuZ2l0aHViO1xuICAgIGlmICghZ2gpIHtcbiAgICAgIHRocm93IG5ldyBFcnJvcihcbiAgICAgICAgJ1Byb2plbkRyaWZ0Q2hlY2tXb3JrZmxvdyByZXF1aXJlcyBHaXRIdWIgaW50ZWdyYXRpb24gdG8gYmUgZW5hYmxlZCcsXG4gICAgICApO1xuICAgIH1cblxuICAgIGNvbnN0IHByb2plbkNvbW1hbmQgPSBvcHRpb25zLnByb2plbkNvbW1hbmQgPz8gJ25weCBwcm9qZW4nO1xuICAgIGNvbnN0IGdoZVRva2VuU2VjcmV0ID0gb3B0aW9ucy5naGVUb2tlblNlY3JldCA/PyAnUFJPSkVOX0dJVEhVQl9UT0tFTic7XG5cbiAgICB0aGlzLndvcmtmbG93ID0gbmV3IGdpdGh1Yi5HaXRodWJXb3JrZmxvdyhcbiAgICAgIGdoLFxuICAgICAgb3B0aW9ucy53b3JrZmxvd05hbWUgPz8gJ3Byb2plbi1kcmlmdC1jaGVjaycsXG4gICAgKTtcbiAgICB0aGlzLndvcmtmbG93Lm9uKHsgcHVsbFJlcXVlc3Q6IHt9IH0pO1xuICAgIHRoaXMud29ya2Zsb3cuYWRkSm9iKCdjaGVjaycsIHtcbiAgICAgIHJ1bnNPbjogWyd1YnVudHUtbGF0ZXN0J10sXG4gICAgICBwZXJtaXNzaW9uczogeyBjb250ZW50czogZ2l0aHViLndvcmtmbG93cy5Kb2JQZXJtaXNzaW9uLlJFQUQgfSxcbiAgICAgIGVudjogeyBHSF9UT0tFTjogYFxcJHt7IHNlY3JldHMuJHtnaGVUb2tlblNlY3JldH0gfX1gIH0sXG4gICAgICBzdGVwczogW1xuICAgICAgICB7XG4gICAgICAgICAgbmFtZTogJ0NoZWNrb3V0JyxcbiAgICAgICAgICB1c2VzOiAnYWN0aW9ucy9jaGVja291dEB2NCcsXG4gICAgICAgICAgd2l0aDoge1xuICAgICAgICAgICAgcmVmOiAnJHt7IGdpdGh1Yi5ldmVudC5wdWxsX3JlcXVlc3QuaGVhZC5yZWYgfX0nLFxuICAgICAgICAgICAgcmVwb3NpdG9yeTogJyR7eyBnaXRodWIuZXZlbnQucHVsbF9yZXF1ZXN0LmhlYWQucmVwby5mdWxsX25hbWUgfX0nLFxuICAgICAgICAgIH0sXG4gICAgICAgIH0sXG4gICAgICAgIHtcbiAgICAgICAgICBuYW1lOiAnU2V0dXAgTm9kZScsXG4gICAgICAgICAgdXNlczogJ2FjdGlvbnMvc2V0dXAtbm9kZUB2NCcsXG4gICAgICAgICAgd2l0aDogeyAnbm9kZS12ZXJzaW9uJzogJ2x0cy8qJyB9LFxuICAgICAgICB9LFxuICAgICAgICB7XG4gICAgICAgICAgbmFtZTogJ0luc3RhbGwgZGVwZW5kZW5jaWVzJyxcbiAgICAgICAgICBydW46ICducG0gY2knLFxuICAgICAgICB9LFxuICAgICAgICB7XG4gICAgICAgICAgbmFtZTogJ0NoZWNrIGZvciBwcm9qZW4gZHJpZnQnLFxuICAgICAgICAgIHJ1bjogYHNldCAtZXVvIHBpcGVmYWlsXG4ke3Byb2plbkNvbW1hbmR9XG5kcmlmdGVkPVwiJChnaXQgZGlmZiAtLW5hbWUtb25seSlcIlxuaWYgWyAtbiBcIiRkcmlmdGVkXCIgXTsgdGhlblxuICB3aGlsZSBJRlM9IHJlYWQgLXIgZjsgZG9cbiAgICBlY2hvIFwiOjplcnJvciBmaWxlPSRmOjpwcm9qZW4tbWFuYWdlZCBmaWxlIHdhcyBlZGl0ZWQgZGlyZWN0bHk7IG1ha2UgdGhlIGNoYW5nZSBpbiAucHJvamVucmMudHMgYW5kIHJlLXJ1biBucHggcHJvamVuXCJcbiAgZG9uZSA8PDwgXCIkZHJpZnRlZFwiXG4gIGlmIFsgLW4gXCIkR0hfVE9LRU5cIiBdICYmIFsgLW4gXCIkR0lUSFVCX0VWRU5UX1BBVEhcIiBdOyB0aGVuXG4gICAgcHJfbnVtYmVyPVwiJChqcSAtciBcIi5wdWxsX3JlcXVlc3QubnVtYmVyIC8vIGVtcHR5XCIgXCIkR0lUSFVCX0VWRU5UX1BBVEhcIiAyPi9kZXYvbnVsbCB8fCB0cnVlKVwiXG4gICAgaWYgWyAtbiBcIiRwcl9udW1iZXJcIiBdOyB0aGVuXG4gICAgICB7XG4gICAgICAgIGVjaG8gXCLinYwgcHJvamVuIGRyaWZ0IGRldGVjdGVkXCJcbiAgICAgICAgZWNobyBcIlwiXG4gICAgICAgIGVjaG8gXCJUaGVzZSBmaWxlcyBhcmUgbWFuYWdlZCBieSBwcm9qZW4gYW5kIHdlcmUgZWRpdGVkIGRpcmVjdGx5LiBEaXJlY3QgZWRpdHMgYXJlIHNpbGVudGx5IG92ZXJ3cml0dGVuIGJ5IHRoZSBuZXh0IG5weCBwcm9qZW4gcnVuLCBzbyB0aGV5IGNhbm5vdCBiZSBtZXJnZWQgYXMtaXM6XCJcbiAgICAgICAgZWNobyBcIlwiXG4gICAgICAgIHdoaWxlIElGUz0gcmVhZCAtciBmOyBkbyBlY2hvIFwiICAtICRmXCI7IGRvbmUgPDw8IFwiJGRyaWZ0ZWRcIlxuICAgICAgICBlY2hvIFwiXCJcbiAgICAgICAgZWNobyBcIlRvIGZpeDogcmV2ZXJ0IHRoZSBkaXJlY3QgZWRpdHMgYWJvdmUsIG1ha2UgdGhlIGVxdWl2YWxlbnQgY2hhbmdlIGluIC5wcm9qZW5yYy50cywgdGhlbiBydW4gbnB4IHByb2plbiBhbmQgY29tbWl0IHRoZSByZWdlbmVyYXRlZCBvdXRwdXQuXCJcbiAgICAgIH0gfCBnaCBwciBjb21tZW50IFwiJHByX251bWJlclwiIC0tYm9keS1maWxlIC0gfHwgZWNobyBcIjo6d2FybmluZzo6Y291bGQgbm90IHBvc3QgUFIgY29tbWVudCAoZm9yayBQUiBvciBtaXNzaW5nIHRva2VuKVwiXG4gICAgZmlcbiAgZmlcbiAgZXhpdCAxXG5maVxuYCxcbiAgICAgICAgfSxcbiAgICAgIF0sXG4gICAgfSk7XG4gIH1cbn1cbiJdfQ==

package/lib/common/upgrade-workflow.js

@@ -19,7 +19,10 @@ class UpgradeWorkflow extends projen_1.Component {
                 schedule: [{ cron: options.schedule ?? constants_1.NIGHTLY_UPGRADE_SCHEDULE }],
                 workflowDispatch: {},
             },
-            permissions: { contents: projen_1.github.workflows.JobPermission.READ },
+            permissions: {
+                contents: projen_1.github.workflows.JobPermission.WRITE,
+                pullRequests: projen_1.github.workflows.JobPermission.WRITE,
+            },
             postBuildSteps: [
                 {
                     name: 'Create Pull Request',
@@ -29,6 +32,7 @@ class UpgradeWorkflow extends projen_1.Component {
                         'branch': 'auto/upgrade-dependencies',
                         'title': 'chore: upgrade dependencies',
                         'labels': 'auto-approve,auto-merge',
+                        'token': `\${{ secrets.${constants_1.DEFAULT_GHE_TOKEN_SECRET} }}`,
                     },
                 },
             ],
@@ -36,4 +40,4 @@ class UpgradeWorkflow extends projen_1.Component {
     }
 }
 exports.UpgradeWorkflow = UpgradeWorkflow;
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidXBncmFkZS13b3JrZmxvdy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9jb21tb24vdXBncmFkZS13b3JrZmxvdy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7QUFBQSxtQ0FBaUQ7QUFDakQsMkNBQXVEO0FBa0J2RCxNQUFhLGVBQWdCLFNBQVEsa0JBQVM7SUFDNUIsUUFBUSxDQUFzQjtJQUU5QyxZQUFZLEtBQTJCLEVBQUUsT0FBK0I7UUFDdEUsS0FBSyxDQUFDLEtBQUssRUFBRSxpQkFBaUIsQ0FBQyxDQUFDO1FBRWhDLE1BQU0sRUFBRSxHQUFHLEtBQUssQ0FBQyxNQUFNLENBQUM7UUFDeEIsSUFBSSxDQUFDLEVBQUUsRUFBRSxDQUFDO1lBQ1IsTUFBTSxJQUFJLEtBQUssQ0FDYiwyREFBMkQsQ0FDNUQsQ0FBQztRQUNKLENBQUM7UUFFRCxJQUFJLENBQUMsUUFBUSxHQUFHLElBQUksZUFBTSxDQUFDLFlBQVksQ0FBQyxFQUFFLEVBQUU7WUFDMUMsSUFBSSxFQUFFLE9BQU8sQ0FBQyxZQUFZLElBQUksU0FBUztZQUN2QyxLQUFLLEVBQUUsU0FBUztZQUNoQixJQUFJLEVBQUUsT0FBTyxDQUFDLElBQUk7WUFDbEIsUUFBUSxFQUFFO2dCQUNSLFFBQVEsRUFBRSxDQUFDLEVBQUUsSUFBSSxFQUFFLE9BQU8sQ0FBQyxRQUFRLElBQUksb0NBQXdCLEVBQUUsQ0FBQztnQkFDbEUsZ0JBQWdCLEVBQUUsRUFBRTthQUNyQjtZQUNELFdBQVcsRUFBRSxFQUFFLFFBQVEsRUFBRSxlQUFNLENBQUMsU0FBUyxDQUFDLGFBQWEsQ0FBQyxJQUFJLEVBQUU7WUFDOUQsY0FBYyxFQUFFO2dCQUNkO29CQUNFLElBQUksRUFBRSxxQkFBcUI7b0JBQzNCLElBQUksRUFBRSxvQ0FBb0M7b0JBQzFDLElBQUksRUFBRTt3QkFDSixnQkFBZ0IsRUFBRSw2QkFBNkI7d0JBQy9DLFFBQVEsRUFBRSwyQkFBMkI7d0JBQ3JDLE9BQU8sRUFBRSw2QkFBNkI7d0JBQ3RDLFFBQVEsRUFBRSx5QkFBeUI7cUJBQ3BDO2lCQUNGO2FBQ0Y7U0FDRixDQUFDLENBQUM7SUFDTCxDQUFDO0NBQ0Y7QUFwQ0QsMENBb0NDIiwic291cmNlc0NvbnRlbnQiOlsiaW1wb3J0IHsgQ29tcG9uZW50LCBUYXNrLCBnaXRodWIgfSBmcm9tICdwcm9qZW4nO1xuaW1wb3J0IHsgTklHSFRMWV9VUEdSQURFX1NDSEVEVUxFIH0gZnJvbSAnLi9jb25zdGFudHMnO1xuXG4vKipcbiAqIE5pZ2h0bHkgY3JvbiB3b3JrZmxvdyB0aGF0IG9wZW5zIGEgUFIgd2l0aCBkZXBlbmRlbmN5IHVwZ3JhZGVzLiBVc2VkIGJ5XG4gKiBub24tTm9kZSBwcm9qZWN0IHR5cGVzIChKYXZhKTsgVHlwZVNjcmlwdC9DREsgcHJvamVjdCB0eXBlcyBpbnN0ZWFkIGdldFxuICogdGhpcyBmb3IgZnJlZSBmcm9tIHByb2plbidzIGJ1aWx0LWluIGBkZXBzVXBncmFkZWAuXG4gKi9cbmV4cG9ydCBpbnRlcmZhY2UgVXBncmFkZVdvcmtmbG93T3B0aW9ucyB7XG4gIC8qKiBUaGUgdGFzayB0aGF0IHBlcmZvcm1zIHRoZSB1cGdyYWRlIChlLmcuIGBtdm4gdmVyc2lvbnM6dXNlLWxhdGVzdC1yZWxlYXNlc2ApLiAqL1xuICByZWFkb25seSB0YXNrOiBUYXNrO1xuXG4gIC8qKiBAZGVmYXVsdCBcInVwZ3JhZGVcIiAqL1xuICByZWFkb25seSB3b3JrZmxvd05hbWU/OiBzdHJpbmc7XG5cbiAgLyoqIEBkZWZhdWx0IE5JR0hUTFlfVVBHUkFERV9TQ0hFRFVMRSAoMDM6MDAgVVRDKSAqL1xuICByZWFkb25seSBzY2hlZHVsZT86IHN0cmluZztcbn1cblxuZXhwb3J0IGNsYXNzIFVwZ3JhZGVXb3JrZmxvdyBleHRlbmRzIENvbXBvbmVudCB7XG4gIHB1YmxpYyByZWFkb25seSB3b3JrZmxvdzogZ2l0aHViLlRhc2tXb3JrZmxvdztcblxuICBjb25zdHJ1Y3RvcihzY29wZTogZ2l0aHViLkdpdEh1YlByb2plY3QsIG9wdGlvbnM6IFVwZ3JhZGVXb3JrZmxvd09wdGlvbnMpIHtcbiAgICBzdXBlcihzY29wZSwgJ1VwZ3JhZGVXb3JrZmxvdycpO1xuXG4gICAgY29uc3QgZ2ggPSBzY29wZS5naXRodWI7XG4gICAgaWYgKCFnaCkge1xuICAgICAgdGhyb3cgbmV3IEVycm9yKFxuICAgICAgICAnVXBncmFkZVdvcmtmbG93IHJlcXVpcmVzIEdpdEh1YiBpbnRlZ3JhdGlvbiB0byBiZSBlbmFibGVkJyxcbiAgICAgICk7XG4gICAgfVxuXG4gICAgdGhpcy53b3JrZmxvdyA9IG5ldyBnaXRodWIuVGFza1dvcmtmbG93KGdoLCB7XG4gICAgICBuYW1lOiBvcHRpb25zLndvcmtmbG93TmFtZSA/PyAndXBncmFkZScsXG4gICAgICBqb2JJZDogJ3VwZ3JhZGUnLFxuICAgICAgdGFzazogb3B0aW9ucy50YXNrLFxuICAgICAgdHJpZ2dlcnM6IHtcbiAgICAgICAgc2NoZWR1bGU6IFt7IGNyb246IG9wdGlvbnMuc2NoZWR1bGUgPz8gTklHSFRMWV9VUEdSQURFX1NDSEVEVUxFIH1dLFxuICAgICAgICB3b3JrZmxvd0Rpc3BhdGNoOiB7fSxcbiAgICAgIH0sXG4gICAgICBwZXJtaXNzaW9uczogeyBjb250ZW50czogZ2l0aHViLndvcmtmbG93cy5Kb2JQZXJtaXNzaW9uLlJFQUQgfSxcbiAgICAgIHBvc3RCdWlsZFN0ZXBzOiBbXG4gICAgICAgIHtcbiAgICAgICAgICBuYW1lOiAnQ3JlYXRlIFB1bGwgUmVxdWVzdCcsXG4gICAgICAgICAgdXNlczogJ3BldGVyLWV2YW5zL2NyZWF0ZS1wdWxsLXJlcXVlc3RAdjcnLFxuICAgICAgICAgIHdpdGg6IHtcbiAgICAgICAgICAgICdjb21taXQtbWVzc2FnZSc6ICdjaG9yZTogdXBncmFkZSBkZXBlbmRlbmNpZXMnLFxuICAgICAgICAgICAgJ2JyYW5jaCc6ICdhdXRvL3VwZ3JhZGUtZGVwZW5kZW5jaWVzJyxcbiAgICAgICAgICAgICd0aXRsZSc6ICdjaG9yZTogdXBncmFkZSBkZXBlbmRlbmNpZXMnLFxuICAgICAgICAgICAgJ2xhYmVscyc6ICdhdXRvLWFwcHJvdmUsYXV0by1tZXJnZScsXG4gICAgICAgICAgfSxcbiAgICAgICAgfSxcbiAgICAgIF0sXG4gICAgfSk7XG4gIH1cbn1cbiJdfQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidXBncmFkZS13b3JrZmxvdy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9jb21tb24vdXBncmFkZS13b3JrZmxvdy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7QUFBQSxtQ0FBaUQ7QUFDakQsMkNBR3FCO0FBa0JyQixNQUFhLGVBQWdCLFNBQVEsa0JBQVM7SUFDNUIsUUFBUSxDQUFzQjtJQUU5QyxZQUFZLEtBQTJCLEVBQUUsT0FBK0I7UUFDdEUsS0FBSyxDQUFDLEtBQUssRUFBRSxpQkFBaUIsQ0FBQyxDQUFDO1FBRWhDLE1BQU0sRUFBRSxHQUFHLEtBQUssQ0FBQyxNQUFNLENBQUM7UUFDeEIsSUFBSSxDQUFDLEVBQUUsRUFBRSxDQUFDO1lBQ1IsTUFBTSxJQUFJLEtBQUssQ0FDYiwyREFBMkQsQ0FDNUQsQ0FBQztRQUNKLENBQUM7UUFFRCxJQUFJLENBQUMsUUFBUSxHQUFHLElBQUksZUFBTSxDQUFDLFlBQVksQ0FBQyxFQUFFLEVBQUU7WUFDMUMsSUFBSSxFQUFFLE9BQU8sQ0FBQyxZQUFZLElBQUksU0FBUztZQUN2QyxLQUFLLEVBQUUsU0FBUztZQUNoQixJQUFJLEVBQUUsT0FBTyxDQUFDLElBQUk7WUFDbEIsUUFBUSxFQUFFO2dCQUNSLFFBQVEsRUFBRSxDQUFDLEVBQUUsSUFBSSxFQUFFLE9BQU8sQ0FBQyxRQUFRLElBQUksb0NBQXdCLEVBQUUsQ0FBQztnQkFDbEUsZ0JBQWdCLEVBQUUsRUFBRTthQUNyQjtZQUNELFdBQVcsRUFBRTtnQkFDWCxRQUFRLEVBQUUsZUFBTSxDQUFDLFNBQVMsQ0FBQyxhQUFhLENBQUMsS0FBSztnQkFDOUMsWUFBWSxFQUFFLGVBQU0sQ0FBQyxTQUFTLENBQUMsYUFBYSxDQUFDLEtBQUs7YUFDbkQ7WUFDRCxjQUFjLEVBQUU7Z0JBQ2Q7b0JBQ0UsSUFBSSxFQUFFLHFCQUFxQjtvQkFDM0IsSUFBSSxFQUFFLG9DQUFvQztvQkFDMUMsSUFBSSxFQUFFO3dCQUNKLGdCQUFnQixFQUFFLDZCQUE2Qjt3QkFDL0MsUUFBUSxFQUFFLDJCQUEyQjt3QkFDckMsT0FBTyxFQUFFLDZCQUE2Qjt3QkFDdEMsUUFBUSxFQUFFLHlCQUF5Qjt3QkFDbkMsT0FBTyxFQUFFLGdCQUFnQixvQ0FBd0IsS0FBSztxQkFDdkQ7aUJBQ0Y7YUFDRjtTQUNGLENBQUMsQ0FBQztJQUNMLENBQUM7Q0FDRjtBQXhDRCwwQ0F3Q0MiLCJzb3VyY2VzQ29udGVudCI6WyJpbXBvcnQgeyBDb21wb25lbnQsIFRhc2ssIGdpdGh1YiB9IGZyb20gJ3Byb2plbic7XG5pbXBvcnQge1xuICBERUZBVUxUX0dIRV9UT0tFTl9TRUNSRVQsXG4gIE5JR0hUTFlfVVBHUkFERV9TQ0hFRFVMRSxcbn0gZnJvbSAnLi9jb25zdGFudHMnO1xuXG4vKipcbiAqIE5pZ2h0bHkgY3JvbiB3b3JrZmxvdyB0aGF0IG9wZW5zIGEgUFIgd2l0aCBkZXBlbmRlbmN5IHVwZ3JhZGVzLiBVc2VkIGJ5XG4gKiBub24tTm9kZSBwcm9qZWN0IHR5cGVzIChKYXZhKTsgVHlwZVNjcmlwdC9DREsgcHJvamVjdCB0eXBlcyBpbnN0ZWFkIGdldFxuICogdGhpcyBmb3IgZnJlZSBmcm9tIHByb2plbidzIGJ1aWx0LWluIGBkZXBzVXBncmFkZWAuXG4gKi9cbmV4cG9ydCBpbnRlcmZhY2UgVXBncmFkZVdvcmtmbG93T3B0aW9ucyB7XG4gIC8qKiBUaGUgdGFzayB0aGF0IHBlcmZvcm1zIHRoZSB1cGdyYWRlIChlLmcuIGBtdm4gdmVyc2lvbnM6dXNlLWxhdGVzdC1yZWxlYXNlc2ApLiAqL1xuICByZWFkb25seSB0YXNrOiBUYXNrO1xuXG4gIC8qKiBAZGVmYXVsdCBcInVwZ3JhZGVcIiAqL1xuICByZWFkb25seSB3b3JrZmxvd05hbWU/OiBzdHJpbmc7XG5cbiAgLyoqIEBkZWZhdWx0IE5JR0hUTFlfVVBHUkFERV9TQ0hFRFVMRSAoMDM6MDAgVVRDKSAqL1xuICByZWFkb25seSBzY2hlZHVsZT86IHN0cmluZztcbn1cblxuZXhwb3J0IGNsYXNzIFVwZ3JhZGVXb3JrZmxvdyBleHRlbmRzIENvbXBvbmVudCB7XG4gIHB1YmxpYyByZWFkb25seSB3b3JrZmxvdzogZ2l0aHViLlRhc2tXb3JrZmxvdztcblxuICBjb25zdHJ1Y3RvcihzY29wZTogZ2l0aHViLkdpdEh1YlByb2plY3QsIG9wdGlvbnM6IFVwZ3JhZGVXb3JrZmxvd09wdGlvbnMpIHtcbiAgICBzdXBlcihzY29wZSwgJ1VwZ3JhZGVXb3JrZmxvdycpO1xuXG4gICAgY29uc3QgZ2ggPSBzY29wZS5naXRodWI7XG4gICAgaWYgKCFnaCkge1xuICAgICAgdGhyb3cgbmV3IEVycm9yKFxuICAgICAgICAnVXBncmFkZVdvcmtmbG93IHJlcXVpcmVzIEdpdEh1YiBpbnRlZ3JhdGlvbiB0byBiZSBlbmFibGVkJyxcbiAgICAgICk7XG4gICAgfVxuXG4gICAgdGhpcy53b3JrZmxvdyA9IG5ldyBnaXRodWIuVGFza1dvcmtmbG93KGdoLCB7XG4gICAgICBuYW1lOiBvcHRpb25zLndvcmtmbG93TmFtZSA/PyAndXBncmFkZScsXG4gICAgICBqb2JJZDogJ3VwZ3JhZGUnLFxuICAgICAgdGFzazogb3B0aW9ucy50YXNrLFxuICAgICAgdHJpZ2dlcnM6IHtcbiAgICAgICAgc2NoZWR1bGU6IFt7IGNyb246IG9wdGlvbnMuc2NoZWR1bGUgPz8gTklHSFRMWV9VUEdSQURFX1NDSEVEVUxFIH1dLFxuICAgICAgICB3b3JrZmxvd0Rpc3BhdGNoOiB7fSxcbiAgICAgIH0sXG4gICAgICBwZXJtaXNzaW9uczoge1xuICAgICAgICBjb250ZW50czogZ2l0aHViLndvcmtmbG93cy5Kb2JQZXJtaXNzaW9uLldSSVRFLFxuICAgICAgICBwdWxsUmVxdWVzdHM6IGdpdGh1Yi53b3JrZmxvd3MuSm9iUGVybWlzc2lvbi5XUklURSxcbiAgICAgIH0sXG4gICAgICBwb3N0QnVpbGRTdGVwczogW1xuICAgICAgICB7XG4gICAgICAgICAgbmFtZTogJ0NyZWF0ZSBQdWxsIFJlcXVlc3QnLFxuICAgICAgICAgIHVzZXM6ICdwZXRlci1ldmFucy9jcmVhdGUtcHVsbC1yZXF1ZXN0QHY3JyxcbiAgICAgICAgICB3aXRoOiB7XG4gICAgICAgICAgICAnY29tbWl0LW1lc3NhZ2UnOiAnY2hvcmU6IHVwZ3JhZGUgZGVwZW5kZW5jaWVzJyxcbiAgICAgICAgICAgICdicmFuY2gnOiAnYXV0by91cGdyYWRlLWRlcGVuZGVuY2llcycsXG4gICAgICAgICAgICAndGl0bGUnOiAnY2hvcmU6IHVwZ3JhZGUgZGVwZW5kZW5jaWVzJyxcbiAgICAgICAgICAgICdsYWJlbHMnOiAnYXV0by1hcHByb3ZlLGF1dG8tbWVyZ2UnLFxuICAgICAgICAgICAgJ3Rva2VuJzogYFxcJHt7IHNlY3JldHMuJHtERUZBVUxUX0dIRV9UT0tFTl9TRUNSRVR9IH19YCxcbiAgICAgICAgICB9LFxuICAgICAgICB9LFxuICAgICAgXSxcbiAgICB9KTtcbiAgfVxufVxuIl19

package/lib/common/workflow-change-notice-workflow.d.ts

@@ -0,0 +1,33 @@
+import { Component, github } from 'projen';
+/**
+ * PR-triggered, tamper-proof notice that a PR touches GitHub Actions
+ * workflow or action files.
+ *
+ * Runs on `pull_request_target` (NOT `pull_request`) so it always executes
+ * the copy of this workflow committed on the base branch - a PR cannot edit
+ * this file to disable or weaken the notice. It checks out and executes
+ * nothing from the PR; it only lists the changed filenames via the GitHub
+ * API and posts a non-blocking NOTE. Because `pull_request_target` runs with
+ * the base repo's normal token even for fork-originated PRs, the comment
+ * posts reliably with no degraded fallback.
+ *
+ * This check NEVER fails the build - it is purely informational (reviewer
+ * attention). It is the tamper-proof backstop that bounds Check 1's
+ * (`ProjenDriftCheckWorkflow`) residual exposure. See the F003 spec's
+ * Security section.
+ */
+export interface WorkflowChangeNoticeWorkflowOptions {
+    /**
+     * Glob patterns (bash `[[ string == pattern ]]` semantics, where `*` also
+     * matches `/`) that trigger the notice when a changed PR file matches any
+     * of them.
+     * @default [".github/workflows/**", ".github/actions/**"]
+     */
+    readonly watchPaths?: string[];
+    /** @default "workflow-change-notice" */
+    readonly workflowName?: string;
+}
+export declare class WorkflowChangeNoticeWorkflow extends Component {
+    readonly workflow: github.GithubWorkflow;
+    constructor(scope: github.GitHubProject, options?: WorkflowChangeNoticeWorkflowOptions);
+}

package/lib/common/workflow-change-notice-workflow.js

@@ -0,0 +1,58 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WorkflowChangeNoticeWorkflow = void 0;
+const JSII_RTTI_SYMBOL_1 = Symbol.for("jsii.rtti");
+const projen_1 = require("projen");
+class WorkflowChangeNoticeWorkflow extends projen_1.Component {
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@xpertss/projen-types.WorkflowChangeNoticeWorkflow", version: "0.0.2" };
+    workflow;
+    constructor(scope, options = {}) {
+        super(scope, 'WorkflowChangeNoticeWorkflow');
+        const gh = scope.github;
+        if (!gh) {
+            throw new Error('WorkflowChangeNoticeWorkflow requires GitHub integration to be enabled');
+        }
+        const watchPaths = options.watchPaths ?? [
+            '.github/workflows/**',
+            '.github/actions/**',
+        ];
+        this.workflow = new projen_1.github.GithubWorkflow(gh, options.workflowName ?? 'workflow-change-notice');
+        this.workflow.on({ pullRequestTarget: {} });
+        this.workflow.addJob('check', {
+            runsOn: ['ubuntu-latest'],
+            permissions: { pullRequests: projen_1.github.workflows.JobPermission.WRITE },
+            env: {
+                GH_TOKEN: '${{ github.token }}',
+                WATCH_PATHS: watchPaths.join(' '),
+            },
+            steps: [
+                {
+                    name: 'Check for workflow/action changes',
+                    run: `set -uo pipefail
+changed="$(gh api --paginate "repos/\${GITHUB_REPOSITORY}/pulls/\${{ github.event.number }}/files" --jq '.[].filename')"
+if [ -z "$changed" ]; then exit 0; fi
+matches=""
+while IFS= read -r path; do
+  for p in $WATCH_PATHS; do
+    if [[ "$path" == $p ]]; then
+      matches="$matches$path
+"
+      break
+    fi
+  done
+done <<< "$changed"
+if [ -n "$matches" ]; then
+  {
+    echo "⚠️ NOTE for reviewers: this PR modifies GitHub Actions workflow or action files. Please review these changes carefully - they can alter or bypass standard build, test, and deployment checks:"
+    echo ""
+    printf "%s" "$matches" | sed "s/^/  - /"
+  } | gh pr comment "\${{ github.event.number }}" --body-file -
+fi
+`,
+                },
+            ],
+        });
+    }
+}
+exports.WorkflowChangeNoticeWorkflow = WorkflowChangeNoticeWorkflow;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoid29ya2Zsb3ctY2hhbmdlLW5vdGljZS13b3JrZmxvdy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9jb21tb24vd29ya2Zsb3ctY2hhbmdlLW5vdGljZS13b3JrZmxvdy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7O0FBQUEsbUNBQTJDO0FBZ0MzQyxNQUFhLDRCQUE2QixTQUFRLGtCQUFTOztJQUN6QyxRQUFRLENBQXdCO0lBRWhELFlBQ0UsS0FBMkIsRUFDM0IsVUFBK0MsRUFBRTtRQUVqRCxLQUFLLENBQUMsS0FBSyxFQUFFLDhCQUE4QixDQUFDLENBQUM7UUFFN0MsTUFBTSxFQUFFLEdBQUcsS0FBSyxDQUFDLE1BQU0sQ0FBQztRQUN4QixJQUFJLENBQUMsRUFBRSxFQUFFLENBQUM7WUFDUixNQUFNLElBQUksS0FBSyxDQUNiLHdFQUF3RSxDQUN6RSxDQUFDO1FBQ0osQ0FBQztRQUVELE1BQU0sVUFBVSxHQUFHLE9BQU8sQ0FBQyxVQUFVLElBQUk7WUFDdkMsc0JBQXNCO1lBQ3RCLG9CQUFvQjtTQUNyQixDQUFDO1FBRUYsSUFBSSxDQUFDLFFBQVEsR0FBRyxJQUFJLGVBQU0sQ0FBQyxjQUFjLENBQ3ZDLEVBQUUsRUFDRixPQUFPLENBQUMsWUFBWSxJQUFJLHdCQUF3QixDQUNqRCxDQUFDO1FBQ0YsSUFBSSxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUMsRUFBRSxpQkFBaUIsRUFBRSxFQUFFLEVBQUUsQ0FBQyxDQUFDO1FBQzVDLElBQUksQ0FBQyxRQUFRLENBQUMsTUFBTSxDQUFDLE9BQU8sRUFBRTtZQUM1QixNQUFNLEVBQUUsQ0FBQyxlQUFlLENBQUM7WUFDekIsV0FBVyxFQUFFLEVBQUUsWUFBWSxFQUFFLGVBQU0sQ0FBQyxTQUFTLENBQUMsYUFBYSxDQUFDLEtBQUssRUFBRTtZQUNuRSxHQUFHLEVBQUU7Z0JBQ0gsUUFBUSxFQUFFLHFCQUFxQjtnQkFDL0IsV0FBVyxFQUFFLFVBQVUsQ0FBQyxJQUFJLENBQUMsR0FBRyxDQUFDO2FBQ2xDO1lBQ0QsS0FBSyxFQUFFO2dCQUNMO29CQUNFLElBQUksRUFBRSxtQ0FBbUM7b0JBQ3pDLEdBQUcsRUFBRTs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Q0FvQmQ7aUJBQ1E7YUFDRjtTQUNGLENBQUMsQ0FBQztJQUNMLENBQUM7O0FBNURILG9FQTZEQyIsInNvdXJjZXNDb250ZW50IjpbImltcG9ydCB7IENvbXBvbmVudCwgZ2l0aHViIH0gZnJvbSAncHJvamVuJztcblxuLyoqXG4gKiBQUi10cmlnZ2VyZWQsIHRhbXBlci1wcm9vZiBub3RpY2UgdGhhdCBhIFBSIHRvdWNoZXMgR2l0SHViIEFjdGlvbnNcbiAqIHdvcmtmbG93IG9yIGFjdGlvbiBmaWxlcy5cbiAqXG4gKiBSdW5zIG9uIGBwdWxsX3JlcXVlc3RfdGFyZ2V0YCAoTk9UIGBwdWxsX3JlcXVlc3RgKSBzbyBpdCBhbHdheXMgZXhlY3V0ZXNcbiAqIHRoZSBjb3B5IG9mIHRoaXMgd29ya2Zsb3cgY29tbWl0dGVkIG9uIHRoZSBiYXNlIGJyYW5jaCAtIGEgUFIgY2Fubm90IGVkaXRcbiAqIHRoaXMgZmlsZSB0byBkaXNhYmxlIG9yIHdlYWtlbiB0aGUgbm90aWNlLiBJdCBjaGVja3Mgb3V0IGFuZCBleGVjdXRlc1xuICogbm90aGluZyBmcm9tIHRoZSBQUjsgaXQgb25seSBsaXN0cyB0aGUgY2hhbmdlZCBmaWxlbmFtZXMgdmlhIHRoZSBHaXRIdWJcbiAqIEFQSSBhbmQgcG9zdHMgYSBub24tYmxvY2tpbmcgTk9URS4gQmVjYXVzZSBgcHVsbF9yZXF1ZXN0X3RhcmdldGAgcnVucyB3aXRoXG4gKiB0aGUgYmFzZSByZXBvJ3Mgbm9ybWFsIHRva2VuIGV2ZW4gZm9yIGZvcmstb3JpZ2luYXRlZCBQUnMsIHRoZSBjb21tZW50XG4gKiBwb3N0cyByZWxpYWJseSB3aXRoIG5vIGRlZ3JhZGVkIGZhbGxiYWNrLlxuICpcbiAqIFRoaXMgY2hlY2sgTkVWRVIgZmFpbHMgdGhlIGJ1aWxkIC0gaXQgaXMgcHVyZWx5IGluZm9ybWF0aW9uYWwgKHJldmlld2VyXG4gKiBhdHRlbnRpb24pLiBJdCBpcyB0aGUgdGFtcGVyLXByb29mIGJhY2tzdG9wIHRoYXQgYm91bmRzIENoZWNrIDEnc1xuICogKGBQcm9qZW5EcmlmdENoZWNrV29ya2Zsb3dgKSByZXNpZHVhbCBleHBvc3VyZS4gU2VlIHRoZSBGMDAzIHNwZWMnc1xuICogU2VjdXJpdHkgc2VjdGlvbi5cbiAqL1xuZXhwb3J0IGludGVyZmFjZSBXb3JrZmxvd0NoYW5nZU5vdGljZVdvcmtmbG93T3B0aW9ucyB7XG4gIC8qKlxuICAgKiBHbG9iIHBhdHRlcm5zIChiYXNoIGBbWyBzdHJpbmcgPT0gcGF0dGVybiBdXWAgc2VtYW50aWNzLCB3aGVyZSBgKmAgYWxzb1xuICAgKiBtYXRjaGVzIGAvYCkgdGhhdCB0cmlnZ2VyIHRoZSBub3RpY2Ugd2hlbiBhIGNoYW5nZWQgUFIgZmlsZSBtYXRjaGVzIGFueVxuICAgKiBvZiB0aGVtLlxuICAgKiBAZGVmYXVsdCBbXCIuZ2l0aHViL3dvcmtmbG93cy8qKlwiLCBcIi5naXRodWIvYWN0aW9ucy8qKlwiXVxuICAgKi9cbiAgcmVhZG9ubHkgd2F0Y2hQYXRocz86IHN0cmluZ1tdO1xuXG4gIC8qKiBAZGVmYXVsdCBcIndvcmtmbG93LWNoYW5nZS1ub3RpY2VcIiAqL1xuICByZWFkb25seSB3b3JrZmxvd05hbWU/OiBzdHJpbmc7XG59XG5cbmV4cG9ydCBjbGFzcyBXb3JrZmxvd0NoYW5nZU5vdGljZVdvcmtmbG93IGV4dGVuZHMgQ29tcG9uZW50IHtcbiAgcHVibGljIHJlYWRvbmx5IHdvcmtmbG93OiBnaXRodWIuR2l0aHViV29ya2Zsb3c7XG5cbiAgY29uc3RydWN0b3IoXG4gICAgc2NvcGU6IGdpdGh1Yi5HaXRIdWJQcm9qZWN0LFxuICAgIG9wdGlvbnM6IFdvcmtmbG93Q2hhbmdlTm90aWNlV29ya2Zsb3dPcHRpb25zID0ge30sXG4gICkge1xuICAgIHN1cGVyKHNjb3BlLCAnV29ya2Zsb3dDaGFuZ2VOb3RpY2VXb3JrZmxvdycpO1xuXG4gICAgY29uc3QgZ2ggPSBzY29wZS5naXRodWI7XG4gICAgaWYgKCFnaCkge1xuICAgICAgdGhyb3cgbmV3IEVycm9yKFxuICAgICAgICAnV29ya2Zsb3dDaGFuZ2VOb3RpY2VXb3JrZmxvdyByZXF1aXJlcyBHaXRIdWIgaW50ZWdyYXRpb24gdG8gYmUgZW5hYmxlZCcsXG4gICAgICApO1xuICAgIH1cblxuICAgIGNvbnN0IHdhdGNoUGF0aHMgPSBvcHRpb25zLndhdGNoUGF0aHMgPz8gW1xuICAgICAgJy5naXRodWIvd29ya2Zsb3dzLyoqJyxcbiAgICAgICcuZ2l0aHViL2FjdGlvbnMvKionLFxuICAgIF07XG5cbiAgICB0aGlzLndvcmtmbG93ID0gbmV3IGdpdGh1Yi5HaXRodWJXb3JrZmxvdyhcbiAgICAgIGdoLFxuICAgICAgb3B0aW9ucy53b3JrZmxvd05hbWUgPz8gJ3dvcmtmbG93LWNoYW5nZS1ub3RpY2UnLFxuICAgICk7XG4gICAgdGhpcy53b3JrZmxvdy5vbih7IHB1bGxSZXF1ZXN0VGFyZ2V0OiB7fSB9KTtcbiAgICB0aGlzLndvcmtmbG93LmFkZEpvYignY2hlY2snLCB7XG4gICAgICBydW5zT246IFsndWJ1bnR1LWxhdGVzdCddLFxuICAgICAgcGVybWlzc2lvbnM6IHsgcHVsbFJlcXVlc3RzOiBnaXRodWIud29ya2Zsb3dzLkpvYlBlcm1pc3Npb24uV1JJVEUgfSxcbiAgICAgIGVudjoge1xuICAgICAgICBHSF9UT0tFTjogJyR7eyBnaXRodWIudG9rZW4gfX0nLFxuICAgICAgICBXQVRDSF9QQVRIUzogd2F0Y2hQYXRocy5qb2luKCcgJyksXG4gICAgICB9LFxuICAgICAgc3RlcHM6IFtcbiAgICAgICAge1xuICAgICAgICAgIG5hbWU6ICdDaGVjayBmb3Igd29ya2Zsb3cvYWN0aW9uIGNoYW5nZXMnLFxuICAgICAgICAgIHJ1bjogYHNldCAtdW8gcGlwZWZhaWxcbmNoYW5nZWQ9XCIkKGdoIGFwaSAtLXBhZ2luYXRlIFwicmVwb3MvXFwke0dJVEhVQl9SRVBPU0lUT1JZfS9wdWxscy9cXCR7eyBnaXRodWIuZXZlbnQubnVtYmVyIH19L2ZpbGVzXCIgLS1qcSAnLltdLmZpbGVuYW1lJylcIlxuaWYgWyAteiBcIiRjaGFuZ2VkXCIgXTsgdGhlbiBleGl0IDA7IGZpXG5tYXRjaGVzPVwiXCJcbndoaWxlIElGUz0gcmVhZCAtciBwYXRoOyBkb1xuICBmb3IgcCBpbiAkV0FUQ0hfUEFUSFM7IGRvXG4gICAgaWYgW1sgXCIkcGF0aFwiID09ICRwIF1dOyB0aGVuXG4gICAgICBtYXRjaGVzPVwiJG1hdGNoZXMkcGF0aFxuXCJcbiAgICAgIGJyZWFrXG4gICAgZmlcbiAgZG9uZVxuZG9uZSA8PDwgXCIkY2hhbmdlZFwiXG5pZiBbIC1uIFwiJG1hdGNoZXNcIiBdOyB0aGVuXG4gIHtcbiAgICBlY2hvIFwi4pqg77iPIE5PVEUgZm9yIHJldmlld2VyczogdGhpcyBQUiBtb2RpZmllcyBHaXRIdWIgQWN0aW9ucyB3b3JrZmxvdyBvciBhY3Rpb24gZmlsZXMuIFBsZWFzZSByZXZpZXcgdGhlc2UgY2hhbmdlcyBjYXJlZnVsbHkgLSB0aGV5IGNhbiBhbHRlciBvciBieXBhc3Mgc3RhbmRhcmQgYnVpbGQsIHRlc3QsIGFuZCBkZXBsb3ltZW50IGNoZWNrczpcIlxuICAgIGVjaG8gXCJcIlxuICAgIHByaW50ZiBcIiVzXCIgXCIkbWF0Y2hlc1wiIHwgc2VkIFwicy9eLyAgLSAvXCJcbiAgfSB8IGdoIHByIGNvbW1lbnQgXCJcXCR7eyBnaXRodWIuZXZlbnQubnVtYmVyIH19XCIgLS1ib2R5LWZpbGUgLVxuZmlcbmAsXG4gICAgICAgIH0sXG4gICAgICBdLFxuICAgIH0pO1xuICB9XG59XG4iXX0=

package/lib/index.d.ts

@@ -1,4 +1,8 @@
 export * from './common/environment-options';
+export * from './common/projen-drift-check-workflow';
+export * from './common/workflow-change-notice-workflow';
+export * from './common/internal-actions';
+export * from './common/actions-allowlist-guard';
 export * from './cdk/options';
 export * from './cdk/cdk-typescript-base';
 export * from './cdk/cdk-infra-project';
@@ -18,3 +22,7 @@ export * from './java/components/github-packages-publish';
 export * from './java/components/flyway-migration';
 export * from './java/components/cdk-deploy-hook';
 export * from './java/components/code-index-workflow';
+export * from './actions/github-action-project';
+export * from './actions/action-build-workflow';
+export * from './actions/action-dogfood-workflow';
+export * from './actions/action-sonar-workflow';

package/lib/index.js

@@ -15,6 +15,10 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 __exportStar(require("./common/environment-options"), exports);
+__exportStar(require("./common/projen-drift-check-workflow"), exports);
+__exportStar(require("./common/workflow-change-notice-workflow"), exports);
+__exportStar(require("./common/internal-actions"), exports);
+__exportStar(require("./common/actions-allowlist-guard"), exports);
 __exportStar(require("./cdk/options"), exports);
 __exportStar(require("./cdk/cdk-typescript-base"), exports);
 __exportStar(require("./cdk/cdk-infra-project"), exports);
@@ -34,4 +38,8 @@ __exportStar(require("./java/components/github-packages-publish"), exports);
 __exportStar(require("./java/components/flyway-migration"), exports);
 __exportStar(require("./java/components/cdk-deploy-hook"), exports);
 __exportStar(require("./java/components/code-index-workflow"), exports);
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi9zcmMvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7Ozs7Ozs7Ozs7OztBQUFBLCtEQUE2QztBQUU3QyxnREFBOEI7QUFDOUIsNERBQTBDO0FBQzFDLDBEQUF3QztBQUN4Qyx3REFBc0M7QUFDdEMsc0VBQW9EO0FBQ3BELDhFQUE0RDtBQUM1RCw2REFBMkM7QUFDM0MsMkRBQXlDO0FBRXpDLGlEQUErQjtBQUMvQix5REFBdUM7QUFDdkMsOERBQTRDO0FBQzVDLDhEQUE0QztBQUM1QywwREFBd0M7QUFDeEMsMEVBQXdEO0FBQ3hELG1FQUFpRDtBQUNqRCw0RUFBMEQ7QUFDMUQscUVBQW1EO0FBQ25ELG9FQUFrRDtBQUNsRCx3RUFBc0QiLCJzb3VyY2VzQ29udGVudCI6WyJleHBvcnQgKiBmcm9tICcuL2NvbW1vbi9lbnZpcm9ubWVudC1vcHRpb25zJztcblxuZXhwb3J0ICogZnJvbSAnLi9jZGsvb3B0aW9ucyc7XG5leHBvcnQgKiBmcm9tICcuL2Nkay9jZGstdHlwZXNjcmlwdC1iYXNlJztcbmV4cG9ydCAqIGZyb20gJy4vY2RrL2Nkay1pbmZyYS1wcm9qZWN0JztcbmV4cG9ydCAqIGZyb20gJy4vY2RrL2Nkay1hcHAtcHJvamVjdCc7XG5leHBvcnQgKiBmcm9tICcuL2Nkay9jb21wb25lbnRzL2Vjci1lY3MtY29uc3RydWN0cyc7XG5leHBvcnQgKiBmcm9tICcuL2Nkay9jb21wb25lbnRzL2VkZ2UtbmV0d29ya2luZy1jb25zdHJ1Y3RzJztcbmV4cG9ydCAqIGZyb20gJy4vY2RrL2FwcC1ydW50aW1lLXNjYWZmb2xkJztcbmV4cG9ydCAqIGZyb20gJy4vY2RrL2RhdGFiYXNlLWNvbXBvbmVudCc7XG5cbmV4cG9ydCAqIGZyb20gJy4vamF2YS9vcHRpb25zJztcbmV4cG9ydCAqIGZyb20gJy4vamF2YS9qYXZhLW1hdmVuLWJhc2UnO1xuZXhwb3J0ICogZnJvbSAnLi9qYXZhL2phdmEtbGlicmFyeS1wcm9qZWN0JztcbmV4cG9ydCAqIGZyb20gJy4vamF2YS9qYXZhLXNlcnZpY2UtcHJvamVjdCc7XG5leHBvcnQgKiBmcm9tICcuL2phdmEvamF2YS1hcHAtcHJvamVjdCc7XG5leHBvcnQgKiBmcm9tICcuL2phdmEvY29tcG9uZW50cy9tYXZlbi1jZW50cmFsLXB1Ymxpc2gnO1xuZXhwb3J0ICogZnJvbSAnLi9qYXZhL2NvbXBvbmVudHMvZG9ja2VyLXB1Ymxpc2gnO1xuZXhwb3J0ICogZnJvbSAnLi9qYXZhL2NvbXBvbmVudHMvZ2l0aHViLXBhY2thZ2VzLXB1Ymxpc2gnO1xuZXhwb3J0ICogZnJvbSAnLi9qYXZhL2NvbXBvbmVudHMvZmx5d2F5LW1pZ3JhdGlvbic7XG5leHBvcnQgKiBmcm9tICcuL2phdmEvY29tcG9uZW50cy9jZGstZGVwbG95LWhvb2snO1xuZXhwb3J0ICogZnJvbSAnLi9qYXZhL2NvbXBvbmVudHMvY29kZS1pbmRleC13b3JrZmxvdyc7XG5cbiJdfQ==
+__exportStar(require("./actions/github-action-project"), exports);
+__exportStar(require("./actions/action-build-workflow"), exports);
+__exportStar(require("./actions/action-dogfood-workflow"), exports);
+__exportStar(require("./actions/action-sonar-workflow"), exports);
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi9zcmMvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7Ozs7Ozs7Ozs7OztBQUFBLCtEQUE2QztBQUM3Qyx1RUFBcUQ7QUFDckQsMkVBQXlEO0FBQ3pELDREQUEwQztBQUMxQyxtRUFBaUQ7QUFFakQsZ0RBQThCO0FBQzlCLDREQUEwQztBQUMxQywwREFBd0M7QUFDeEMsd0RBQXNDO0FBQ3RDLHNFQUFvRDtBQUNwRCw4RUFBNEQ7QUFDNUQsNkRBQTJDO0FBQzNDLDJEQUF5QztBQUV6QyxpREFBK0I7QUFDL0IseURBQXVDO0FBQ3ZDLDhEQUE0QztBQUM1Qyw4REFBNEM7QUFDNUMsMERBQXdDO0FBQ3hDLDBFQUF3RDtBQUN4RCxtRUFBaUQ7QUFDakQsNEVBQTBEO0FBQzFELHFFQUFtRDtBQUNuRCxvRUFBa0Q7QUFDbEQsd0VBQXNEO0FBRXRELGtFQUFnRDtBQUNoRCxrRUFBZ0Q7QUFDaEQsb0VBQWtEO0FBQ2xELGtFQUFnRCIsInNvdXJjZXNDb250ZW50IjpbImV4cG9ydCAqIGZyb20gJy4vY29tbW9uL2Vudmlyb25tZW50LW9wdGlvbnMnO1xuZXhwb3J0ICogZnJvbSAnLi9jb21tb24vcHJvamVuLWRyaWZ0LWNoZWNrLXdvcmtmbG93JztcbmV4cG9ydCAqIGZyb20gJy4vY29tbW9uL3dvcmtmbG93LWNoYW5nZS1ub3RpY2Utd29ya2Zsb3cnO1xuZXhwb3J0ICogZnJvbSAnLi9jb21tb24vaW50ZXJuYWwtYWN0aW9ucyc7XG5leHBvcnQgKiBmcm9tICcuL2NvbW1vbi9hY3Rpb25zLWFsbG93bGlzdC1ndWFyZCc7XG5cbmV4cG9ydCAqIGZyb20gJy4vY2RrL29wdGlvbnMnO1xuZXhwb3J0ICogZnJvbSAnLi9jZGsvY2RrLXR5cGVzY3JpcHQtYmFzZSc7XG5leHBvcnQgKiBmcm9tICcuL2Nkay9jZGstaW5mcmEtcHJvamVjdCc7XG5leHBvcnQgKiBmcm9tICcuL2Nkay9jZGstYXBwLXByb2plY3QnO1xuZXhwb3J0ICogZnJvbSAnLi9jZGsvY29tcG9uZW50cy9lY3ItZWNzLWNvbnN0cnVjdHMnO1xuZXhwb3J0ICogZnJvbSAnLi9jZGsvY29tcG9uZW50cy9lZGdlLW5ldHdvcmtpbmctY29uc3RydWN0cyc7XG5leHBvcnQgKiBmcm9tICcuL2Nkay9hcHAtcnVudGltZS1zY2FmZm9sZCc7XG5leHBvcnQgKiBmcm9tICcuL2Nkay9kYXRhYmFzZS1jb21wb25lbnQnO1xuXG5leHBvcnQgKiBmcm9tICcuL2phdmEvb3B0aW9ucyc7XG5leHBvcnQgKiBmcm9tICcuL2phdmEvamF2YS1tYXZlbi1iYXNlJztcbmV4cG9ydCAqIGZyb20gJy4vamF2YS9qYXZhLWxpYnJhcnktcHJvamVjdCc7XG5leHBvcnQgKiBmcm9tICcuL2phdmEvamF2YS1zZXJ2aWNlLXByb2plY3QnO1xuZXhwb3J0ICogZnJvbSAnLi9qYXZhL2phdmEtYXBwLXByb2plY3QnO1xuZXhwb3J0ICogZnJvbSAnLi9qYXZhL2NvbXBvbmVudHMvbWF2ZW4tY2VudHJhbC1wdWJsaXNoJztcbmV4cG9ydCAqIGZyb20gJy4vamF2YS9jb21wb25lbnRzL2RvY2tlci1wdWJsaXNoJztcbmV4cG9ydCAqIGZyb20gJy4vamF2YS9jb21wb25lbnRzL2dpdGh1Yi1wYWNrYWdlcy1wdWJsaXNoJztcbmV4cG9ydCAqIGZyb20gJy4vamF2YS9jb21wb25lbnRzL2ZseXdheS1taWdyYXRpb24nO1xuZXhwb3J0ICogZnJvbSAnLi9qYXZhL2NvbXBvbmVudHMvY2RrLWRlcGxveS1ob29rJztcbmV4cG9ydCAqIGZyb20gJy4vamF2YS9jb21wb25lbnRzL2NvZGUtaW5kZXgtd29ya2Zsb3cnO1xuXG5leHBvcnQgKiBmcm9tICcuL2FjdGlvbnMvZ2l0aHViLWFjdGlvbi1wcm9qZWN0JztcbmV4cG9ydCAqIGZyb20gJy4vYWN0aW9ucy9hY3Rpb24tYnVpbGQtd29ya2Zsb3cnO1xuZXhwb3J0ICogZnJvbSAnLi9hY3Rpb25zL2FjdGlvbi1kb2dmb29kLXdvcmtmbG93JztcbmV4cG9ydCAqIGZyb20gJy4vYWN0aW9ucy9hY3Rpb24tc29uYXItd29ya2Zsb3cnO1xuXG4iXX0=

package/lib/java/components/cdk-deploy-hook.js

@@ -11,7 +11,7 @@ const manual_deploy_workflow_1 = require("../../common/manual-deploy-workflow");
  * deploys - see the CDK spec's open question about sharing this contract.
  */
 class CdkDeployHook extends projen_1.Component {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "@xpertss/projen-types.CdkDeployHook", version: "0.0.1" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@xpertss/projen-types.CdkDeployHook", version: "0.0.2" };
     constructor(project, environments, options = {}) {
         super(project, 'CdkDeployHook');
         if (!options.targetRepo) {

package/lib/java/components/code-index-workflow.js

@@ -5,7 +5,7 @@ const JSII_RTTI_SYMBOL_1 = Symbol.for("jsii.rtti");
 const projen_1 = require("projen");
 /** Generates a code index and publishes it to `.cai/` on checkin. */
 class CodeIndexWorkflow extends projen_1.Component {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "@xpertss/projen-types.CodeIndexWorkflow", version: "0.0.1" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@xpertss/projen-types.CodeIndexWorkflow", version: "0.0.2" };
     constructor(project) {
         super(project, 'CodeIndexWorkflow');
         const gh = project.github;

package/lib/java/components/docker-publish.js

@@ -5,7 +5,7 @@ const JSII_RTTI_SYMBOL_1 = Symbol.for("jsii.rtti");
 const projen_1 = require("projen");
 /** On-demand build+push of a Docker image, defaulting to Docker Hub. */
 class DockerPublish extends projen_1.Component {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "@xpertss/projen-types.DockerPublish", version: "0.0.1" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@xpertss/projen-types.DockerPublish", version: "0.0.2" };
     constructor(project, options = {}) {
         super(project, 'DockerPublish');
         const gh = project.github;

package/lib/java/components/flyway-migration.js

@@ -5,7 +5,7 @@ const JSII_RTTI_SYMBOL_1 = Symbol.for("jsii.rtti");
 const projen_1 = require("projen");
 /** Adds Flyway config/dependencies + a migrations directory for DB migrations. */
 class FlywayMigration extends projen_1.Component {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "@xpertss/projen-types.FlywayMigration", version: "0.0.1" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@xpertss/projen-types.FlywayMigration", version: "0.0.2" };
     constructor(project) {
         super(project, 'FlywayMigration');
         project.pom.addPlugin('org.flywaydb/flyway-maven-plugin@^10');

package/lib/java/components/github-packages-publish.js

@@ -5,7 +5,7 @@ const JSII_RTTI_SYMBOL_1 = Symbol.for("jsii.rtti");
 const projen_1 = require("projen");
 /** On-demand publish to GitHub Packages. */
 class GitHubPackagesPublish extends projen_1.Component {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "@xpertss/projen-types.GitHubPackagesPublish", version: "0.0.1" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@xpertss/projen-types.GitHubPackagesPublish", version: "0.0.2" };
     constructor(project, options = {}) {
         super(project, 'GitHubPackagesPublish');
         const gh = project.github;

package/lib/java/components/maven-central-publish.js

@@ -8,7 +8,7 @@ const projen_1 = require("projen");
  * or OIDC trusted publishing.
  */
 class MavenCentralPublish extends projen_1.Component {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "@xpertss/projen-types.MavenCentralPublish", version: "0.0.1" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@xpertss/projen-types.MavenCentralPublish", version: "0.0.2" };
     constructor(project, options = {}) {
         super(project, 'MavenCentralPublish');
         const gh = project.github;

package/lib/java/java-app-project.js

@@ -9,7 +9,7 @@ const java_maven_base_1 = require("./java-maven-base");
  * explicitly excludes Maven Central, Docker, and CDK deploy hooks.
  */
 class JavaAppProject extends java_maven_base_1.JavaMavenProject {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "@xpertss/projen-types.JavaAppProject", version: "0.0.1" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@xpertss/projen-types.JavaAppProject", version: "0.0.2" };
     constructor(options) {
         super(options);
         new github_packages_publish_1.GitHubPackagesPublish(this, {

package/lib/java/java-library-project.js

@@ -7,7 +7,7 @@ const maven_central_publish_1 = require("./components/maven-central-publish");
 const java_maven_base_1 = require("./java-maven-base");
 /** Reusable Java library, published to Maven Central. */
 class JavaLibraryProject extends java_maven_base_1.JavaMavenProject {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "@xpertss/projen-types.JavaLibraryProject", version: "0.0.1" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@xpertss/projen-types.JavaLibraryProject", version: "0.0.2" };
     constructor(options) {
         super(options);
         new maven_central_publish_1.MavenCentralPublish(this, { mavenCentralOidc: options.mavenCentralOidc });

package/lib/java/java-maven-base.js

@@ -3,9 +3,12 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.JavaMavenProject = void 0;
 const JSII_RTTI_SYMBOL_1 = Symbol.for("jsii.rtti");
 const projen_1 = require("projen");
+const actions_allowlist_guard_1 = require("../common/actions-allowlist-guard");
 const constants_1 = require("../common/constants");
-const drift_check_1 = require("../common/drift-check");
+const internal_actions_1 = require("../common/internal-actions");
+const projen_drift_check_workflow_1 = require("../common/projen-drift-check-workflow");
 const upgrade_workflow_1 = require("../common/upgrade-workflow");
+const workflow_change_notice_workflow_1 = require("../common/workflow-change-notice-workflow");
 /**
  * Shared Maven build skeleton for all three Java project types: standard
  * `pom.xml`/directory layout (via `java.JavaProject`), a PR-triggered
@@ -13,7 +16,7 @@ const upgrade_workflow_1 = require("../common/upgrade-workflow");
  * nightly dependency-upgrade workflow.
  */
 class JavaMavenProject extends projen_1.java.JavaProject {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "@xpertss/projen-types.JavaMavenProject", version: "0.0.1" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@xpertss/projen-types.JavaMavenProject", version: "0.0.2" };
     upgradeTask;
     buildVerifyWorkflow;
     constructor(options) {
@@ -30,7 +33,13 @@ class JavaMavenProject extends projen_1.java.JavaProject {
         if (!gh) {
             throw new Error('JavaMavenProject requires GitHub integration');
         }
-        const postBuildSteps = [...(0, drift_check_1.driftCheckSteps)()];
+        (0, internal_actions_1.applyInternalActionOverrides)(gh);
+        new projen_drift_check_workflow_1.ProjenDriftCheckWorkflow(this, {
+            gheTokenSecret: options.gheTokenSecret ?? constants_1.DEFAULT_GHE_TOKEN_SECRET,
+        });
+        new workflow_change_notice_workflow_1.WorkflowChangeNoticeWorkflow(this);
+        new actions_allowlist_guard_1.ActionsAllowlistGuard(this);
+        const postBuildSteps = [];
         if (options.sonarProjectKey) {
             postBuildSteps.push({
                 name: 'SonarQube scan',
@@ -53,4 +62,4 @@ class JavaMavenProject extends projen_1.java.JavaProject {
     }
 }
 exports.JavaMavenProject = JavaMavenProject;
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiamF2YS1tYXZlbi1iYXNlLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL2phdmEvamF2YS1tYXZlbi1iYXNlLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7Ozs7QUFBQSxtQ0FBNEM7QUFFNUMsbURBQStEO0FBQy9ELHVEQUF3RDtBQUN4RCxpRUFBNkQ7QUFJN0Q7Ozs7O0dBS0c7QUFDSCxNQUFhLGdCQUFpQixTQUFRLGFBQUksQ0FBQyxXQUFXOztJQUNwQyxXQUFXLENBQU87SUFDbEIsbUJBQW1CLENBQXNCO0lBRXpELFlBQVksT0FBZ0M7UUFDMUMsS0FBSyxDQUFDO1lBQ0osSUFBSSxFQUFFLE9BQU8sQ0FBQyxJQUFJO1lBQ2xCLE9BQU8sRUFBRSxPQUFPLENBQUMsT0FBTztZQUN4QixVQUFVLEVBQUUsT0FBTyxDQUFDLFVBQVU7WUFDOUIsT0FBTyxFQUFFLE9BQU8sQ0FBQyxPQUFPLElBQUksT0FBTztZQUNuQyxpQkFBaUIsRUFBRSxlQUFNLENBQUMsaUJBQWlCLENBQUMsdUJBQXVCLENBQUM7Z0JBQ2xFLE1BQU0sRUFBRSxPQUFPLENBQUMsY0FBYyxJQUFJLG9DQUF3QjthQUMzRCxDQUFDO1NBQ0gsQ0FBQyxDQUFDO1FBRUgsTUFBTSxFQUFFLEdBQUcsSUFBSSxDQUFDLE1BQU0sQ0FBQztRQUN2QixJQUFJLENBQUMsRUFBRSxFQUFFLENBQUM7WUFDUixNQUFNLElBQUksS0FBSyxDQUFDLDhDQUE4QyxDQUFDLENBQUM7UUFDbEUsQ0FBQztRQUVELE1BQU0sY0FBYyxHQUFHLENBQUMsR0FBRyxJQUFBLDZCQUFlLEdBQUUsQ0FBQyxDQUFDO1FBQzlDLElBQUksT0FBTyxDQUFDLGVBQWUsRUFBRSxDQUFDO1lBQzVCLGNBQWMsQ0FBQyxJQUFJLENBQUM7Z0JBQ2xCLElBQUksRUFBRSxnQkFBZ0I7Z0JBQ3RCLEdBQUcsRUFBRSx5Q0FBeUMsT0FBTyxDQUFDLGVBQWUsRUFBRTtnQkFDdkUsR0FBRyxFQUFFLEVBQUUsV0FBVyxFQUFFLDRCQUE0QixFQUFFO2FBQ25ELENBQUMsQ0FBQztRQUNMLENBQUM7UUFFRCxJQUFJLENBQUMsbUJBQW1CLEdBQUcsSUFBSSxlQUFNLENBQUMsWUFBWSxDQUFDLEVBQUUsRUFBRTtZQUNyRCxJQUFJLEVBQUUsT0FBTztZQUNiLEtBQUssRUFBRSxPQUFPO1lBQ2QsSUFBSSxFQUFFLElBQUksQ0FBQyxTQUFTO1lBQ3BCLFFBQVEsRUFBRSxFQUFFLFdBQVcsRUFBRSxFQUFFLEVBQUUsZ0JBQWdCLEVBQUUsRUFBRSxFQUFFO1lBQ25ELFdBQVcsRUFBRSxFQUFFLFFBQVEsRUFBRSxlQUFNLENBQUMsU0FBUyxDQUFDLGFBQWEsQ0FBQyxJQUFJLEVBQUU7WUFDOUQsY0FBYztTQUNmLENBQUMsQ0FBQztRQUVILElBQUksQ0FBQyxXQUFXLEdBQUcsSUFBSSxDQUFDLE9BQU8sQ0FBQyxTQUFTLEVBQUU7WUFDekMsSUFBSSxFQUFFLGdFQUFnRTtTQUN2RSxDQUFDLENBQUM7UUFDSCxJQUFJLGtDQUFlLENBQUMsSUFBSSxFQUFFLEVBQUUsSUFBSSxFQUFFLElBQUksQ0FBQyxXQUFXLEVBQUUsQ0FBQyxDQUFDO0lBQ3hELENBQUM7O0FBMUNILDRDQTJDQyIsInNvdXJjZXNDb250ZW50IjpbImltcG9ydCB7IFRhc2ssIGdpdGh1YiwgamF2YSB9IGZyb20gJ3Byb2plbic7XG5pbXBvcnQgeyBDb21tb25KYXZhT3B0aW9ucyB9IGZyb20gJy4vb3B0aW9ucyc7XG5pbXBvcnQgeyBERUZBVUxUX0dIRV9UT0tFTl9TRUNSRVQgfSBmcm9tICcuLi9jb21tb24vY29uc3RhbnRzJztcbmltcG9ydCB7IGRyaWZ0Q2hlY2tTdGVwcyB9IGZyb20gJy4uL2NvbW1vbi9kcmlmdC1jaGVjayc7XG5pbXBvcnQgeyBVcGdyYWRlV29ya2Zsb3cgfSBmcm9tICcuLi9jb21tb24vdXBncmFkZS13b3JrZmxvdyc7XG5cbmV4cG9ydCBpbnRlcmZhY2UgSmF2YU1hdmVuUHJvamVjdE9wdGlvbnMgZXh0ZW5kcyBDb21tb25KYXZhT3B0aW9ucyB7fVxuXG4vKipcbiAqIFNoYXJlZCBNYXZlbiBidWlsZCBza2VsZXRvbiBmb3IgYWxsIHRocmVlIEphdmEgcHJvamVjdCB0eXBlczogc3RhbmRhcmRcbiAqIGBwb20ueG1sYC9kaXJlY3RvcnkgbGF5b3V0ICh2aWEgYGphdmEuSmF2YVByb2plY3RgKSwgYSBQUi10cmlnZ2VyZWRcbiAqIGJ1aWxkK3Rlc3QoK1NvbmFyUXViZSkgd29ya2Zsb3cgdGhhdCBoYXJkLWZhaWxzIG9uIHByb2plbiBkcmlmdCwgYW5kIGFcbiAqIG5pZ2h0bHkgZGVwZW5kZW5jeS11cGdyYWRlIHdvcmtmbG93LlxuICovXG5leHBvcnQgY2xhc3MgSmF2YU1hdmVuUHJvamVjdCBleHRlbmRzIGphdmEuSmF2YVByb2plY3Qge1xuICBwdWJsaWMgcmVhZG9ubHkgdXBncmFkZVRhc2s6IFRhc2s7XG4gIHB1YmxpYyByZWFkb25seSBidWlsZFZlcmlmeVdvcmtmbG93OiBnaXRodWIuVGFza1dvcmtmbG93O1xuXG4gIGNvbnN0cnVjdG9yKG9wdGlvbnM6IEphdmFNYXZlblByb2plY3RPcHRpb25zKSB7XG4gICAgc3VwZXIoe1xuICAgICAgbmFtZTogb3B0aW9ucy5uYW1lLFxuICAgICAgZ3JvdXBJZDogb3B0aW9ucy5ncm91cElkLFxuICAgICAgYXJ0aWZhY3RJZDogb3B0aW9ucy5hcnRpZmFjdElkLFxuICAgICAgdmVyc2lvbjogb3B0aW9ucy52ZXJzaW9uID8/ICcwLjEuMCcsXG4gICAgICBwcm9qZW5DcmVkZW50aWFsczogZ2l0aHViLkdpdGh1YkNyZWRlbnRpYWxzLmZyb21QZXJzb25hbEFjY2Vzc1Rva2VuKHtcbiAgICAgICAgc2VjcmV0OiBvcHRpb25zLmdoZVRva2VuU2VjcmV0ID8/IERFRkFVTFRfR0hFX1RPS0VOX1NFQ1JFVCxcbiAgICAgIH0pLFxuICAgIH0pO1xuXG4gICAgY29uc3QgZ2ggPSB0aGlzLmdpdGh1YjtcbiAgICBpZiAoIWdoKSB7XG4gICAgICB0aHJvdyBuZXcgRXJyb3IoJ0phdmFNYXZlblByb2plY3QgcmVxdWlyZXMgR2l0SHViIGludGVncmF0aW9uJyk7XG4gICAgfVxuXG4gICAgY29uc3QgcG9zdEJ1aWxkU3RlcHMgPSBbLi4uZHJpZnRDaGVja1N0ZXBzKCldO1xuICAgIGlmIChvcHRpb25zLnNvbmFyUHJvamVjdEtleSkge1xuICAgICAgcG9zdEJ1aWxkU3RlcHMucHVzaCh7XG4gICAgICAgIG5hbWU6ICdTb25hclF1YmUgc2NhbicsXG4gICAgICAgIHJ1bjogYG12biAtQiBzb25hcjpzb25hciAtRHNvbmFyLnByb2plY3RLZXk9JHtvcHRpb25zLnNvbmFyUHJvamVjdEtleX1gLFxuICAgICAgICBlbnY6IHsgU09OQVJfVE9LRU46ICcke3sgc2VjcmV0cy5TT05BUl9UT0tFTiB9fScgfSxcbiAgICAgIH0pO1xuICAgIH1cblxuICAgIHRoaXMuYnVpbGRWZXJpZnlXb3JrZmxvdyA9IG5ldyBnaXRodWIuVGFza1dvcmtmbG93KGdoLCB7XG4gICAgICBuYW1lOiAnYnVpbGQnLFxuICAgICAgam9iSWQ6ICdidWlsZCcsXG4gICAgICB0YXNrOiB0aGlzLmJ1aWxkVGFzayxcbiAgICAgIHRyaWdnZXJzOiB7IHB1bGxSZXF1ZXN0OiB7fSwgd29ya2Zsb3dEaXNwYXRjaDoge30gfSxcbiAgICAgIHBlcm1pc3Npb25zOiB7IGNvbnRlbnRzOiBnaXRodWIud29ya2Zsb3dzLkpvYlBlcm1pc3Npb24uUkVBRCB9LFxuICAgICAgcG9zdEJ1aWxkU3RlcHMsXG4gICAgfSk7XG5cbiAgICB0aGlzLnVwZ3JhZGVUYXNrID0gdGhpcy5hZGRUYXNrKCd1cGdyYWRlJywge1xuICAgICAgZXhlYzogJ212biAtQiB2ZXJzaW9uczp1c2UtbGF0ZXN0LXJlbGVhc2VzIHZlcnNpb25zOnVwZGF0ZS1wcm9wZXJ0aWVzJyxcbiAgICB9KTtcbiAgICBuZXcgVXBncmFkZVdvcmtmbG93KHRoaXMsIHsgdGFzazogdGhpcy51cGdyYWRlVGFzayB9KTtcbiAgfVxufVxuIl19
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiamF2YS1tYXZlbi1iYXNlLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL2phdmEvamF2YS1tYXZlbi1iYXNlLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7Ozs7QUFBQSxtQ0FBNEM7QUFFNUMsK0VBQTBFO0FBQzFFLG1EQUErRDtBQUMvRCxpRUFBMEU7QUFDMUUsdUZBQWlGO0FBQ2pGLGlFQUE2RDtBQUM3RCwrRkFBeUY7QUFJekY7Ozs7O0dBS0c7QUFDSCxNQUFhLGdCQUFpQixTQUFRLGFBQUksQ0FBQyxXQUFXOztJQUNwQyxXQUFXLENBQU87SUFDbEIsbUJBQW1CLENBQXNCO0lBRXpELFlBQVksT0FBZ0M7UUFDMUMsS0FBSyxDQUFDO1lBQ0osSUFBSSxFQUFFLE9BQU8sQ0FBQyxJQUFJO1lBQ2xCLE9BQU8sRUFBRSxPQUFPLENBQUMsT0FBTztZQUN4QixVQUFVLEVBQUUsT0FBTyxDQUFDLFVBQVU7WUFDOUIsT0FBTyxFQUFFLE9BQU8sQ0FBQyxPQUFPLElBQUksT0FBTztZQUNuQyxpQkFBaUIsRUFBRSxlQUFNLENBQUMsaUJBQWlCLENBQUMsdUJBQXVCLENBQUM7Z0JBQ2xFLE1BQU0sRUFBRSxPQUFPLENBQUMsY0FBYyxJQUFJLG9DQUF3QjthQUMzRCxDQUFDO1NBQ0gsQ0FBQyxDQUFDO1FBRUgsTUFBTSxFQUFFLEdBQUcsSUFBSSxDQUFDLE1BQU0sQ0FBQztRQUN2QixJQUFJLENBQUMsRUFBRSxFQUFFLENBQUM7WUFDUixNQUFNLElBQUksS0FBSyxDQUFDLDhDQUE4QyxDQUFDLENBQUM7UUFDbEUsQ0FBQztRQUVELElBQUEsK0NBQTRCLEVBQUMsRUFBRSxDQUFDLENBQUM7UUFFakMsSUFBSSxzREFBd0IsQ0FBQyxJQUFJLEVBQUU7WUFDakMsY0FBYyxFQUFFLE9BQU8sQ0FBQyxjQUFjLElBQUksb0NBQXdCO1NBQ25FLENBQUMsQ0FBQztRQUNILElBQUksOERBQTRCLENBQUMsSUFBSSxDQUFDLENBQUM7UUFDdkMsSUFBSSwrQ0FBcUIsQ0FBQyxJQUFJLENBQUMsQ0FBQztRQUVoQyxNQUFNLGNBQWMsR0FBK0IsRUFBRSxDQUFDO1FBQ3RELElBQUksT0FBTyxDQUFDLGVBQWUsRUFBRSxDQUFDO1lBQzVCLGNBQWMsQ0FBQyxJQUFJLENBQUM7Z0JBQ2xCLElBQUksRUFBRSxnQkFBZ0I7Z0JBQ3RCLEdBQUcsRUFBRSx5Q0FBeUMsT0FBTyxDQUFDLGVBQWUsRUFBRTtnQkFDdkUsR0FBRyxFQUFFLEVBQUUsV0FBVyxFQUFFLDRCQUE0QixFQUFFO2FBQ25ELENBQUMsQ0FBQztRQUNMLENBQUM7UUFFRCxJQUFJLENBQUMsbUJBQW1CLEdBQUcsSUFBSSxlQUFNLENBQUMsWUFBWSxDQUFDLEVBQUUsRUFBRTtZQUNyRCxJQUFJLEVBQUUsT0FBTztZQUNiLEtBQUssRUFBRSxPQUFPO1lBQ2QsSUFBSSxFQUFFLElBQUksQ0FBQyxTQUFTO1lBQ3BCLFFBQVEsRUFBRSxFQUFFLFdBQVcsRUFBRSxFQUFFLEVBQUUsZ0JBQWdCLEVBQUUsRUFBRSxFQUFFO1lBQ25ELFdBQVcsRUFBRSxFQUFFLFFBQVEsRUFBRSxlQUFNLENBQUMsU0FBUyxDQUFDLGFBQWEsQ0FBQyxJQUFJLEVBQUU7WUFDOUQsY0FBYztTQUNmLENBQUMsQ0FBQztRQUVILElBQUksQ0FBQyxXQUFXLEdBQUcsSUFBSSxDQUFDLE9BQU8sQ0FBQyxTQUFTLEVBQUU7WUFDekMsSUFBSSxFQUFFLGdFQUFnRTtTQUN2RSxDQUFDLENBQUM7UUFDSCxJQUFJLGtDQUFlLENBQUMsSUFBSSxFQUFFLEVBQUUsSUFBSSxFQUFFLElBQUksQ0FBQyxXQUFXLEVBQUUsQ0FBQyxDQUFDO0lBQ3hELENBQUM7O0FBbERILDRDQW1EQyIsInNvdXJjZXNDb250ZW50IjpbImltcG9ydCB7IFRhc2ssIGdpdGh1YiwgamF2YSB9IGZyb20gJ3Byb2plbic7XG5pbXBvcnQgeyBDb21tb25KYXZhT3B0aW9ucyB9IGZyb20gJy4vb3B0aW9ucyc7XG5pbXBvcnQgeyBBY3Rpb25zQWxsb3dsaXN0R3VhcmQgfSBmcm9tICcuLi9jb21tb24vYWN0aW9ucy1hbGxvd2xpc3QtZ3VhcmQnO1xuaW1wb3J0IHsgREVGQVVMVF9HSEVfVE9LRU5fU0VDUkVUIH0gZnJvbSAnLi4vY29tbW9uL2NvbnN0YW50cyc7XG5pbXBvcnQgeyBhcHBseUludGVybmFsQWN0aW9uT3ZlcnJpZGVzIH0gZnJvbSAnLi4vY29tbW9uL2ludGVybmFsLWFjdGlvbnMnO1xuaW1wb3J0IHsgUHJvamVuRHJpZnRDaGVja1dvcmtmbG93IH0gZnJvbSAnLi4vY29tbW9uL3Byb2plbi1kcmlmdC1jaGVjay13b3JrZmxvdyc7XG5pbXBvcnQgeyBVcGdyYWRlV29ya2Zsb3cgfSBmcm9tICcuLi9jb21tb24vdXBncmFkZS13b3JrZmxvdyc7XG5pbXBvcnQgeyBXb3JrZmxvd0NoYW5nZU5vdGljZVdvcmtmbG93IH0gZnJvbSAnLi4vY29tbW9uL3dvcmtmbG93LWNoYW5nZS1ub3RpY2Utd29ya2Zsb3cnO1xuXG5leHBvcnQgaW50ZXJmYWNlIEphdmFNYXZlblByb2plY3RPcHRpb25zIGV4dGVuZHMgQ29tbW9uSmF2YU9wdGlvbnMge31cblxuLyoqXG4gKiBTaGFyZWQgTWF2ZW4gYnVpbGQgc2tlbGV0b24gZm9yIGFsbCB0aHJlZSBKYXZhIHByb2plY3QgdHlwZXM6IHN0YW5kYXJkXG4gKiBgcG9tLnhtbGAvZGlyZWN0b3J5IGxheW91dCAodmlhIGBqYXZhLkphdmFQcm9qZWN0YCksIGEgUFItdHJpZ2dlcmVkXG4gKiBidWlsZCt0ZXN0KCtTb25hclF1YmUpIHdvcmtmbG93IHRoYXQgaGFyZC1mYWlscyBvbiBwcm9qZW4gZHJpZnQsIGFuZCBhXG4gKiBuaWdodGx5IGRlcGVuZGVuY3ktdXBncmFkZSB3b3JrZmxvdy5cbiAqL1xuZXhwb3J0IGNsYXNzIEphdmFNYXZlblByb2plY3QgZXh0ZW5kcyBqYXZhLkphdmFQcm9qZWN0IHtcbiAgcHVibGljIHJlYWRvbmx5IHVwZ3JhZGVUYXNrOiBUYXNrO1xuICBwdWJsaWMgcmVhZG9ubHkgYnVpbGRWZXJpZnlXb3JrZmxvdzogZ2l0aHViLlRhc2tXb3JrZmxvdztcblxuICBjb25zdHJ1Y3RvcihvcHRpb25zOiBKYXZhTWF2ZW5Qcm9qZWN0T3B0aW9ucykge1xuICAgIHN1cGVyKHtcbiAgICAgIG5hbWU6IG9wdGlvbnMubmFtZSxcbiAgICAgIGdyb3VwSWQ6IG9wdGlvbnMuZ3JvdXBJZCxcbiAgICAgIGFydGlmYWN0SWQ6IG9wdGlvbnMuYXJ0aWZhY3RJZCxcbiAgICAgIHZlcnNpb246IG9wdGlvbnMudmVyc2lvbiA/PyAnMC4xLjAnLFxuICAgICAgcHJvamVuQ3JlZGVudGlhbHM6IGdpdGh1Yi5HaXRodWJDcmVkZW50aWFscy5mcm9tUGVyc29uYWxBY2Nlc3NUb2tlbih7XG4gICAgICAgIHNlY3JldDogb3B0aW9ucy5naGVUb2tlblNlY3JldCA/PyBERUZBVUxUX0dIRV9UT0tFTl9TRUNSRVQsXG4gICAgICB9KSxcbiAgICB9KTtcblxuICAgIGNvbnN0IGdoID0gdGhpcy5naXRodWI7XG4gICAgaWYgKCFnaCkge1xuICAgICAgdGhyb3cgbmV3IEVycm9yKCdKYXZhTWF2ZW5Qcm9qZWN0IHJlcXVpcmVzIEdpdEh1YiBpbnRlZ3JhdGlvbicpO1xuICAgIH1cblxuICAgIGFwcGx5SW50ZXJuYWxBY3Rpb25PdmVycmlkZXMoZ2gpO1xuXG4gICAgbmV3IFByb2plbkRyaWZ0Q2hlY2tXb3JrZmxvdyh0aGlzLCB7XG4gICAgICBnaGVUb2tlblNlY3JldDogb3B0aW9ucy5naGVUb2tlblNlY3JldCA/PyBERUZBVUxUX0dIRV9UT0tFTl9TRUNSRVQsXG4gICAgfSk7XG4gICAgbmV3IFdvcmtmbG93Q2hhbmdlTm90aWNlV29ya2Zsb3codGhpcyk7XG4gICAgbmV3IEFjdGlvbnNBbGxvd2xpc3RHdWFyZCh0aGlzKTtcblxuICAgIGNvbnN0IHBvc3RCdWlsZFN0ZXBzOiBnaXRodWIud29ya2Zsb3dzLkpvYlN0ZXBbXSA9IFtdO1xuICAgIGlmIChvcHRpb25zLnNvbmFyUHJvamVjdEtleSkge1xuICAgICAgcG9zdEJ1aWxkU3RlcHMucHVzaCh7XG4gICAgICAgIG5hbWU6ICdTb25hclF1YmUgc2NhbicsXG4gICAgICAgIHJ1bjogYG12biAtQiBzb25hcjpzb25hciAtRHNvbmFyLnByb2plY3RLZXk9JHtvcHRpb25zLnNvbmFyUHJvamVjdEtleX1gLFxuICAgICAgICBlbnY6IHsgU09OQVJfVE9LRU46ICcke3sgc2VjcmV0cy5TT05BUl9UT0tFTiB9fScgfSxcbiAgICAgIH0pO1xuICAgIH1cblxuICAgIHRoaXMuYnVpbGRWZXJpZnlXb3JrZmxvdyA9IG5ldyBnaXRodWIuVGFza1dvcmtmbG93KGdoLCB7XG4gICAgICBuYW1lOiAnYnVpbGQnLFxuICAgICAgam9iSWQ6ICdidWlsZCcsXG4gICAgICB0YXNrOiB0aGlzLmJ1aWxkVGFzayxcbiAgICAgIHRyaWdnZXJzOiB7IHB1bGxSZXF1ZXN0OiB7fSwgd29ya2Zsb3dEaXNwYXRjaDoge30gfSxcbiAgICAgIHBlcm1pc3Npb25zOiB7IGNvbnRlbnRzOiBnaXRodWIud29ya2Zsb3dzLkpvYlBlcm1pc3Npb24uUkVBRCB9LFxuICAgICAgcG9zdEJ1aWxkU3RlcHMsXG4gICAgfSk7XG5cbiAgICB0aGlzLnVwZ3JhZGVUYXNrID0gdGhpcy5hZGRUYXNrKCd1cGdyYWRlJywge1xuICAgICAgZXhlYzogJ212biAtQiB2ZXJzaW9uczp1c2UtbGF0ZXN0LXJlbGVhc2VzIHZlcnNpb25zOnVwZGF0ZS1wcm9wZXJ0aWVzJyxcbiAgICB9KTtcbiAgICBuZXcgVXBncmFkZVdvcmtmbG93KHRoaXMsIHsgdGFzazogdGhpcy51cGdyYWRlVGFzayB9KTtcbiAgfVxufVxuIl19

package/lib/java/java-service-project.js

@@ -11,7 +11,7 @@ const java_maven_base_1 = require("./java-maven-base");
  * Central); publish and deploy are both manual-dispatch, not on every merge.
  */
 class JavaServiceProject extends java_maven_base_1.JavaMavenProject {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "@xpertss/projen-types.JavaServiceProject", version: "0.0.1" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@xpertss/projen-types.JavaServiceProject", version: "0.0.2" };
     constructor(options) {
         super(options);
         this.pom.addDependency('org.springframework.boot/spring-boot-starter-web@^3');

package/package.json

@@ -82,7 +82,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "version": "0.0.1",
+  "version": "0.0.2",
   "jest": {
     "coverageProvider": "v8",
     "testMatch": [