@xpertss/projen-types 0.0.1 → 0.0.3

package/README.md

@@ -2,7 +2,7 @@
 
 Projen project types for CDK/TypeScript and Java/Maven projects.
 
-Instead of hand-maintaining `pom.xml`, `cdk.json`, and GitHub workflows, you declare a project type in a `.projenrc.ts` file and let [projen](https://github.com/projen/projen) generate (and keep up to date) the whole scaffold: build files, source skeletons, CI workflows, and deploy pipelines.
+Instead of hand-maintaining `pom.xml`, `cdk.json`, and GitHub workflows, you declare a project type in a plain-JavaScript `.projenrc.js` file and let [projen](https://github.com/projen/projen) generate (and keep up to date) the whole scaffold: build files, source skeletons, CI workflows, and deploy pipelines.
 
 ## Project types at a glance
 
@@ -13,12 +13,13 @@ Instead of hand-maintaining `pom.xml`, `cdk.json`, and GitHub workflows, you dec
 | `JavaLibraryProject` | Reusable Java library | Maven Central | `build`, `upgrade` (nightly), `publish-maven-central`, `codeindex` |
 | `JavaServiceProject` | Spring Boot service | Docker Hub | `build`, `upgrade` (nightly), `publish-docker`, `deploy-cdk` |
 | `JavaAppProject` | GUI/TUI/CLI Java application | GitHub Packages | `build`, `upgrade` (nightly), `publish-ghpackages` |
+| `GitHubActionProject` | Reusable GitHub Action or Workflow | GitHub Releases | `build`, `test-dogfood`, `sonar`, `release` |
 
 Two foundation classes are also exported for advanced use: `CdkTypescriptProject` (shared CDK + TypeScript base for the CDK types) and `JavaMavenProject` (shared Maven base for the Java types).
 
 All project types:
 
-- run a **drift check** in PR builds - a job that re-runs projen and fails if generated files were hand-edited. Edit `.projenrc.ts`, then run `npx projen`; never edit generated files directly.
+- run a **drift check** in PR builds - a job that re-runs projen and fails if generated files were hand-edited. Edit `.projenrc.js`, then run `npx projen`; never edit generated files directly.
 - use the GitHub secret `PROJEN_GITHUB_TOKEN` (a fine-grained PAT) for projen's automation. Override with `gheTokenSecret`.
 - make all publishing/deploying **manual** (workflow_dispatch) rather than on every merge.
 
@@ -32,13 +33,13 @@ git init
 npm install -D projen constructs @xpertss/projen-types
 ```
 
-Write a `.projenrc.ts` (see examples below), then generate the project:
+Write a `.projenrc.js` (see examples below), then bootstrap the project by running it directly - `npx projen` alone can't do this on a brand-new repo, since it only re-runs a `default` task that doesn't exist yet:
 
 ```bash
-npx projen
+node .projenrc.js
 ```
 
-Commit the result. From then on, every change to the scaffold goes through `.projenrc.ts` followed by `npx projen`.
+Commit the result. From then on, every change to the scaffold goes through `.projenrc.js` followed by plain `npx projen`.
 
 The `name` option must match the `name` field in the project's `package.json` (for the CDK types) or the project name used by projen's `java.JavaProject` (for the Java types).
 
@@ -48,9 +49,9 @@ The `name` option must match the `name` field in the project's `package.json` (f
 
 Pure infrastructure stacks with optional ECR/ECS and edge-networking constructs.
 
-```typescript
-// .projenrc.ts
-import { CdkInfraProject } from '@xpertss/projen-types';
+```javascript
+// .projenrc.js
+const { CdkInfraProject } = require('@xpertss/projen-types');
 
 const project = new CdkInfraProject({
   name: 'media-edge-infra',
@@ -79,9 +80,9 @@ You get:
 
 `CdkInfraProject` plus application source, a database construct, and an app-level build workflow.
 
-```typescript
-// .projenrc.ts
-import { CdkAppProject } from '@xpertss/projen-types';
+```javascript
+// .projenrc.js
+const { CdkAppProject } = require('@xpertss/projen-types');
 
 const project = new CdkAppProject({
   name: 'video-api',
@@ -105,9 +106,9 @@ Everything from `CdkInfraProject`, plus:
 
 A reusable Java library published to Maven Central.
 
-```typescript
-// .projenrc.ts
-import { JavaLibraryProject } from '@xpertss/projen-types';
+```javascript
+// .projenrc.js
+const { JavaLibraryProject } = require('@xpertss/projen-types');
 
 const project = new JavaLibraryProject({
   name: 'common-utils',
@@ -133,9 +134,9 @@ You get:
 
 A Spring Boot service that publishes a Docker image and can trigger deploys in a companion CDK repo.
 
-```typescript
-// .projenrc.ts
-import { JavaServiceProject } from '@xpertss/projen-types';
+```javascript
+// .projenrc.js
+const { JavaServiceProject } = require('@xpertss/projen-types');
 
 const project = new JavaServiceProject({
   name: 'stream-processor',
@@ -160,9 +161,9 @@ You get (everything from `JavaMavenProject` - `pom.xml`, `build` + drift check,
 
 A GUI/TUI/CLI Java application published to GitHub Packages only - no Maven Central, no Docker, no CDK deploy hook.
 
-```typescript
-// .projenrc.ts
-import { JavaAppProject } from '@xpertss/projen-types';
+```javascript
+// .projenrc.js
+const { JavaAppProject } = require('@xpertss/projen-types');
 
 const project = new JavaAppProject({
   name: 'studio-cli',
@@ -176,6 +177,72 @@ project.synth();
 
 You get everything from `JavaMavenProject`, plus `.github/workflows/publish-ghpackages.yml` - manual dispatch running `mvn -B deploy -DaltDeploymentRepository=github::<registry>`, authenticated with `GITHUB_TOKEN`. `ghPackagesRegistry` defaults to `https://maven.pkg.github.com/<repo>` derived from the repository URL.
 
+### GitHubActionProject
+
+A reusable GitHub Action or Workflow. This example scaffolds an action that stages a folder and, only if it changed, commits and pushes it.
+
+```javascript
+// .projenrc.js
+const { GitHubActionProject } = require('@xpertss/projen-types');
+
+const project = new GitHubActionProject({
+  name: 'auto-commit',
+  description: 'Stage a folder and, only if it changed, commit and push it',
+  sonarHostUrl: 'https://sonar.xpertss.org',   // required, no default - your self-hosted SonarQube
+  dogfood: {
+    // Two scenario steps: the "changed" path and the "no-op" path are both
+    // load-bearing behavior for this action (a double-commit or a
+    // push-when-empty bug is the failure mode a hand-rolled inline-shell
+    // alternative is most likely to introduce).
+    scenario: [
+      {
+        name: 'Changed path',
+        fixtureSteps: [
+          'echo "$(date -u +%Y%m%dT%H%M%SZ)" >> test/fixtures/dogfood-state.txt',
+        ],
+        inputs: {
+          commit_message: 'test: dogfood',
+          branches: 'test/dogfood',
+        },
+        assertions: [
+          // step id defaults to a slug of `name` - here "changed-path-0"
+          '[ "${{ steps.changed-path-0.outputs.committed }}" = "true" ]',
+        ],
+      },
+      {
+        // No fixture change this time - nothing new to commit.
+        name: 'No-op path',
+        id: 'no-op-check',            // pin an explicit id instead of relying on the default slug
+        inputs: {
+          commit_message: 'test: dogfood',
+          branches: 'test/dogfood',
+        },
+        assertions: [
+          '[ "${{ steps.no-op-check.outputs.committed }}" = "false" ]',
+        ],
+      },
+    ],
+    cleanup: [
+      'git push origin --delete test/dogfood || true',
+    ],
+  },
+});
+
+project.synth();
+```
+
+You get:
+
+- `action.yml` and `auto-commit.sh` are hand-written - this type only lints their content via `build.yml`'s shellcheck/yamllint/actionlint checks.
+- `.github/workflows/build.yml` - lint gate: `apt`-installed shellcheck/yamllint plus a pinned, SHA-256-verified `actionlint` release binary. Gates `main` alongside `sonar.yml`.
+- `.github/workflows/test-dogfood.yml` - runs the `dogfood.scenario` steps above against this repo's own `action.yml` (via `uses: .`), then the shared `cleanup`, on `workflow_dispatch`, every `pull_request`, and nightly.
+- `.github/workflows/sonar.yml` - self-hosted SonarQube via the Scanner CLI, scanning `action.yml`/`.github/workflows/**`/`**/*.sh` explicitly.
+- `.github/workflows/release.yml` - `feat:`/`fix:` commits on `main` bump the version, tag `vX.Y.Z`, and create a GitHub Release.
+- `.github/workflows/projen-drift-check.yml`, `workflow-change-notice.yml`, `actions-allowlist-guard.yml` - drift detection, a change notice, and an action allow-list guard, always included.
+- `package.json` (**private**, version source only), `.yamllint`, `LICENSE` (MIT by default), and a `README.md` template - all regenerated by `npx projen`.
+
+Needs the same two secrets as everything else in this package: `PROJEN_GITHUB_TOKEN` (used for automated PR comments) and `SONAR_TOKEN` (the Sonar scan). Onboard a brand-new action repo following [Getting started](#getting-started), write the `.projenrc.js` above, then hand-write `action.yml`/`auto-commit.sh`/`test/fixtures/`.
+
 ## Common options
 
 CDK project types (`CdkInfraProjectOptions` / `CdkAppProjectOptions`):
@@ -205,7 +272,7 @@ Java project types (`JavaLibraryProjectOptions` / `JavaServiceProjectOptions` /
 
 `EnvironmentOptions` for deploy targets:
 
-```typescript
+```text
 interface EnvironmentOptions {
   readonly name: string;              // e.g. "dev", "stage", "prod"
   readonly accountId?: string;        // AWS account id (CDK deploys)
@@ -216,12 +283,44 @@ interface EnvironmentOptions {
 
 Plain strings (`'dev'`) are shorthand for `{ name: 'dev' }`.
 
+`GitHubActionProjectOptions`:
+
+| Option | Default | Description |
+| --- | --- | --- |
+| `name` | - (required) | Project name |
+| `description` | - | One-line description; used in the default README template and recorded in the private `package.json` |
+| `sonarHostUrl` | - (required) | URL of your self-hosted SonarQube instance; must be reachable from github.com-hosted runners |
+| `sonarTokenSecret` | `SONAR_TOKEN` | GitHub secret holding the Sonar token |
+| `sonarPullRequestGate` | `true` | Whether `sonar.yml` also runs on `pull_request` as a pass/fail gate |
+| `dogfood` | - (required) | `ActionDogfoodOptions` - the scenario that exercises the action end-to-end via `uses: .` |
+| `license` | `MIT` | SPDX identifier for the generated `LICENSE` |
+| `gheTokenSecret` | `PROJEN_GITHUB_TOKEN` | GitHub secret holding projen's PAT |
+
+`ActionDogfoodOptions`/`ActionDogfoodStep` - the dogfood scenario (`test-dogfood.yml`):
+
+```text
+interface ActionDogfoodOptions {
+  readonly scenario: ActionDogfoodStep[]; // one or more, run in order - required
+  readonly cleanup: string[];             // shared, run once at the end with `if: always()` - required
+}
+
+interface ActionDogfoodStep {
+  readonly name: string;                    // labels this step-group's generated workflow steps
+  readonly id?: string;                     // step id for the `uses: .` call; default: a slug of `name`
+  readonly fixtureSteps?: string[];         // shell, before the invocation (default: none)
+  readonly inputs?: Record<string, string>; // `with:` for this invocation (default: none)
+  readonly assertions: string[];            // shell, after the invocation - required, job fails unless all exit 0
+}
+```
+
+Most actions need exactly one `scenario` step. Actions with a re-run/no-op/idempotency behavior to verify (e.g. `auto-commit`'s no-op-on-no-change path, `create-pull-request`'s reuse-the-PR path) declare two - the second typically omits `fixtureSteps` so its invocation sees no new state, and its assertion checks the opposite outcome of the first. Reference an invocation's own outputs from a later assertion via `${{ steps.<id>.outputs.<name> }}`, using either the default slug or an explicit `id`.
+
 ## Required GitHub secrets
 
 | Secret | Used by | Notes |
 | --- | --- | --- |
 | `PROJEN_GITHUB_TOKEN` | all types | PAT for projen's self-mutation/automation; override via `gheTokenSecret` |
-| `SONAR_TOKEN` | Java types with `sonarProjectKey` | SonarQube scan step in `build.yml` |
+| `SONAR_TOKEN` | Java types with `sonarProjectKey`; `GitHubActionProject` | SonarQube scan step in `build.yml` / `sonar.yml`; override via `sonarTokenSecret` on `GitHubActionProject` |
 | `DOCKER_USERNAME` / `DOCKER_PASSWORD` | `JavaServiceProject` | Docker image push |
 | `MAVEN_GPG_PRIVATE_KEY`, `MAVEN_GPG_PASSPHRASE`, `MAVEN_CENTRAL_USERNAME`, `MAVEN_CENTRAL_PASSWORD` | `JavaLibraryProject` without `mavenCentralOidc` | Not needed with OIDC trusted publishing |
 | (your Slack webhook secret) | CDK types with `slackWebhookSecret` | Deploy notifications |
@@ -242,12 +341,15 @@ The project types are composed from smaller components you can also attach to yo
 | `FlywayMigration` | `JavaProject` | Flyway plugin/dependency + migrations directory |
 | `CdkDeployHook` | `JavaProject` | Manual-dispatch workflow that triggers `deploy.yml` in a companion CDK repo |
 | `CodeIndexWorkflow` | `JavaProject` | Code index generation on push to `main` |
+| `ActionBuildWorkflow` | `GitHubProject` | The `lint` task (shellcheck/yamllint/pinned actionlint) + `build.yml` |
+| `ActionDogfoodWorkflow` | `GitHubProject` | `test-dogfood.yml` from an `ActionDogfoodOptions` scenario |
+| `ActionSonarWorkflow` | `GitHubProject` | `sonar.yml` (self-hosted SonarQube via the Scanner CLI) |
 
 Example - adding a Docker publish to a plain projen `JavaProject`:
 
-```typescript
-import { java } from 'projen';
-import { DockerPublish } from '@xpertss/projen-types';
+```javascript
+const { java } = require('projen');
+const { DockerPublish } = require('@xpertss/projen-types');
 
 const project = new java.JavaProject({
   name: 'my-service',

package/lib/actions/action-build-workflow.d.ts

@@ -0,0 +1,17 @@
+import { Component, Task, github } from 'projen';
+/**
+ * The AD-001 Layer-1 lint gate for a composite-action repo: shellcheck,
+ * yamllint, and a pinned `actionlint` release binary (verified by SHA-256,
+ * never a marketplace action - org policy). Creates a dedicated `lint` task
+ * (named to avoid colliding with projen's own reserved `build` task, which
+ * spawns the unrelated default/pre-compile/compile/post-compile/test/package
+ * chain - including `default`, i.e. re-running `.projenrc.ts`, which is not
+ * what this gate is for) and wraps it in a `TaskWorkflow` (`build.yml`)
+ * triggered on push-to-`main` and `pull_request`. The same task is reused by
+ * the release build job, so the lint commands exist in exactly one place.
+ */
+export declare class ActionBuildWorkflow extends Component {
+    readonly task: Task;
+    readonly workflow: github.TaskWorkflow;
+    constructor(scope: github.GitHubProject);
+}

package/lib/actions/action-build-workflow.js

@@ -0,0 +1,52 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ActionBuildWorkflow = void 0;
+const JSII_RTTI_SYMBOL_1 = Symbol.for("jsii.rtti");
+const projen_1 = require("projen");
+// Pinned release + verified SHA-256 (linux_amd64) - upgrade is a reviewed
+// diff of this constant, never a floating version (AD-001).
+const ACTIONLINT_VERSION = '1.7.12';
+const ACTIONLINT_SHA256 = '8aca8db96f1b94770f1b0d72b6dddcb1ebb8123cb3712530b08cc387b349a3d8';
+/**
+ * The AD-001 Layer-1 lint gate for a composite-action repo: shellcheck,
+ * yamllint, and a pinned `actionlint` release binary (verified by SHA-256,
+ * never a marketplace action - org policy). Creates a dedicated `lint` task
+ * (named to avoid colliding with projen's own reserved `build` task, which
+ * spawns the unrelated default/pre-compile/compile/post-compile/test/package
+ * chain - including `default`, i.e. re-running `.projenrc.ts`, which is not
+ * what this gate is for) and wraps it in a `TaskWorkflow` (`build.yml`)
+ * triggered on push-to-`main` and `pull_request`. The same task is reused by
+ * the release build job, so the lint commands exist in exactly one place.
+ */
+class ActionBuildWorkflow extends projen_1.Component {
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@xpertss/projen-types.ActionBuildWorkflow", version: "0.0.3" };
+    task;
+    workflow;
+    constructor(scope) {
+        super(scope, 'ActionBuildWorkflow');
+        const gh = scope.github;
+        if (!gh) {
+            throw new Error('ActionBuildWorkflow requires GitHub integration to be enabled');
+        }
+        this.task = scope.addTask('lint', {
+            description: 'Lint the action (shellcheck, yamllint, actionlint)',
+        });
+        this.task.exec('sudo apt-get update -y && sudo apt-get install -y shellcheck yamllint');
+        this.task.exec(`curl -fsSL -o /tmp/actionlint.tar.gz "https://github.com/rhysd/actionlint/releases/download/v${ACTIONLINT_VERSION}/actionlint_${ACTIONLINT_VERSION}_linux_amd64.tar.gz"`);
+        this.task.exec(`echo "${ACTIONLINT_SHA256}  /tmp/actionlint.tar.gz" | sha256sum -c -`);
+        this.task.exec('tar -xzf /tmp/actionlint.tar.gz -C /tmp actionlint');
+        this.task.exec('find . -path ./node_modules -prune -o -name "*.sh" -print0 | xargs -0 -r shellcheck');
+        this.task.exec('yamllint -c .yamllint action.yml .github/workflows/*.yml');
+        this.task.exec('/tmp/actionlint action.yml .github/workflows/*.yml');
+        this.workflow = new projen_1.github.TaskWorkflow(gh, {
+            name: 'build',
+            jobId: 'build',
+            task: this.task,
+            triggers: { push: { branches: ['main'] }, pullRequest: {} },
+            permissions: { contents: projen_1.github.workflows.JobPermission.READ },
+            preBuildSteps: [{ name: 'Install dependencies', run: 'npm ci' }],
+        });
+    }
+}
+exports.ActionBuildWorkflow = ActionBuildWorkflow;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYWN0aW9uLWJ1aWxkLXdvcmtmbG93LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL2FjdGlvbnMvYWN0aW9uLWJ1aWxkLXdvcmtmbG93LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7Ozs7QUFBQSxtQ0FBaUQ7QUFFakQsMEVBQTBFO0FBQzFFLDREQUE0RDtBQUM1RCxNQUFNLGtCQUFrQixHQUFHLFFBQVEsQ0FBQztBQUNwQyxNQUFNLGlCQUFpQixHQUNyQixrRUFBa0UsQ0FBQztBQUVyRTs7Ozs7Ozs7OztHQVVHO0FBQ0gsTUFBYSxtQkFBb0IsU0FBUSxrQkFBUzs7SUFDaEMsSUFBSSxDQUFPO0lBQ1gsUUFBUSxDQUFzQjtJQUU5QyxZQUFZLEtBQTJCO1FBQ3JDLEtBQUssQ0FBQyxLQUFLLEVBQUUscUJBQXFCLENBQUMsQ0FBQztRQUVwQyxNQUFNLEVBQUUsR0FBRyxLQUFLLENBQUMsTUFBTSxDQUFDO1FBQ3hCLElBQUksQ0FBQyxFQUFFLEVBQUUsQ0FBQztZQUNSLE1BQU0sSUFBSSxLQUFLLENBQ2IsK0RBQStELENBQ2hFLENBQUM7UUFDSixDQUFDO1FBRUQsSUFBSSxDQUFDLElBQUksR0FBRyxLQUFLLENBQUMsT0FBTyxDQUFDLE1BQU0sRUFBRTtZQUNoQyxXQUFXLEVBQUUsb0RBQW9EO1NBQ2xFLENBQUMsQ0FBQztRQUNILElBQUksQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUNaLHVFQUF1RSxDQUN4RSxDQUFDO1FBQ0YsSUFBSSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQ1osZ0dBQWdHLGtCQUFrQixlQUFlLGtCQUFrQixzQkFBc0IsQ0FDMUssQ0FBQztRQUNGLElBQUksQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUNaLFNBQVMsaUJBQWlCLDRDQUE0QyxDQUN2RSxDQUFDO1FBQ0YsSUFBSSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsb0RBQW9ELENBQUMsQ0FBQztRQUNyRSxJQUFJLENBQUMsSUFBSSxDQUFDLElBQUksQ0FDWixxRkFBcUYsQ0FDdEYsQ0FBQztRQUNGLElBQUksQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLDBEQUEwRCxDQUFDLENBQUM7UUFDM0UsSUFBSSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsb0RBQW9ELENBQUMsQ0FBQztRQUVyRSxJQUFJLENBQUMsUUFBUSxHQUFHLElBQUksZUFBTSxDQUFDLFlBQVksQ0FBQyxFQUFFLEVBQUU7WUFDMUMsSUFBSSxFQUFFLE9BQU87WUFDYixLQUFLLEVBQUUsT0FBTztZQUNkLElBQUksRUFBRSxJQUFJLENBQUMsSUFBSTtZQUNmLFFBQVEsRUFBRSxFQUFFLElBQUksRUFBRSxFQUFFLFFBQVEsRUFBRSxDQUFDLE1BQU0sQ0FBQyxFQUFFLEVBQUUsV0FBVyxFQUFFLEVBQUUsRUFBRTtZQUMzRCxXQUFXLEVBQUUsRUFBRSxRQUFRLEVBQUUsZUFBTSxDQUFDLFNBQVMsQ0FBQyxhQUFhLENBQUMsSUFBSSxFQUFFO1lBQzlELGFBQWEsRUFBRSxDQUFDLEVBQUUsSUFBSSxFQUFFLHNCQUFzQixFQUFFLEdBQUcsRUFBRSxRQUFRLEVBQUUsQ0FBQztTQUNqRSxDQUFDLENBQUM7SUFDTCxDQUFDOztBQXpDSCxrREEwQ0MiLCJzb3VyY2VzQ29udGVudCI6WyJpbXBvcnQgeyBDb21wb25lbnQsIFRhc2ssIGdpdGh1YiB9IGZyb20gJ3Byb2plbic7XG5cbi8vIFBpbm5lZCByZWxlYXNlICsgdmVyaWZpZWQgU0hBLTI1NiAobGludXhfYW1kNjQpIC0gdXBncmFkZSBpcyBhIHJldmlld2VkXG4vLyBkaWZmIG9mIHRoaXMgY29uc3RhbnQsIG5ldmVyIGEgZmxvYXRpbmcgdmVyc2lvbiAoQUQtMDAxKS5cbmNvbnN0IEFDVElPTkxJTlRfVkVSU0lPTiA9ICcxLjcuMTInO1xuY29uc3QgQUNUSU9OTElOVF9TSEEyNTYgPVxuICAnOGFjYThkYjk2ZjFiOTQ3NzBmMWIwZDcyYjZkZGRjYjFlYmI4MTIzY2IzNzEyNTMwYjA4Y2MzODdiMzQ5YTNkOCc7XG5cbi8qKlxuICogVGhlIEFELTAwMSBMYXllci0xIGxpbnQgZ2F0ZSBmb3IgYSBjb21wb3NpdGUtYWN0aW9uIHJlcG86IHNoZWxsY2hlY2ssXG4gKiB5YW1sbGludCwgYW5kIGEgcGlubmVkIGBhY3Rpb25saW50YCByZWxlYXNlIGJpbmFyeSAodmVyaWZpZWQgYnkgU0hBLTI1NixcbiAqIG5ldmVyIGEgbWFya2V0cGxhY2UgYWN0aW9uIC0gb3JnIHBvbGljeSkuIENyZWF0ZXMgYSBkZWRpY2F0ZWQgYGxpbnRgIHRhc2tcbiAqIChuYW1lZCB0byBhdm9pZCBjb2xsaWRpbmcgd2l0aCBwcm9qZW4ncyBvd24gcmVzZXJ2ZWQgYGJ1aWxkYCB0YXNrLCB3aGljaFxuICogc3Bhd25zIHRoZSB1bnJlbGF0ZWQgZGVmYXVsdC9wcmUtY29tcGlsZS9jb21waWxlL3Bvc3QtY29tcGlsZS90ZXN0L3BhY2thZ2VcbiAqIGNoYWluIC0gaW5jbHVkaW5nIGBkZWZhdWx0YCwgaS5lLiByZS1ydW5uaW5nIGAucHJvamVucmMudHNgLCB3aGljaCBpcyBub3RcbiAqIHdoYXQgdGhpcyBnYXRlIGlzIGZvcikgYW5kIHdyYXBzIGl0IGluIGEgYFRhc2tXb3JrZmxvd2AgKGBidWlsZC55bWxgKVxuICogdHJpZ2dlcmVkIG9uIHB1c2gtdG8tYG1haW5gIGFuZCBgcHVsbF9yZXF1ZXN0YC4gVGhlIHNhbWUgdGFzayBpcyByZXVzZWQgYnlcbiAqIHRoZSByZWxlYXNlIGJ1aWxkIGpvYiwgc28gdGhlIGxpbnQgY29tbWFuZHMgZXhpc3QgaW4gZXhhY3RseSBvbmUgcGxhY2UuXG4gKi9cbmV4cG9ydCBjbGFzcyBBY3Rpb25CdWlsZFdvcmtmbG93IGV4dGVuZHMgQ29tcG9uZW50IHtcbiAgcHVibGljIHJlYWRvbmx5IHRhc2s6IFRhc2s7XG4gIHB1YmxpYyByZWFkb25seSB3b3JrZmxvdzogZ2l0aHViLlRhc2tXb3JrZmxvdztcblxuICBjb25zdHJ1Y3RvcihzY29wZTogZ2l0aHViLkdpdEh1YlByb2plY3QpIHtcbiAgICBzdXBlcihzY29wZSwgJ0FjdGlvbkJ1aWxkV29ya2Zsb3cnKTtcblxuICAgIGNvbnN0IGdoID0gc2NvcGUuZ2l0aHViO1xuICAgIGlmICghZ2gpIHtcbiAgICAgIHRocm93IG5ldyBFcnJvcihcbiAgICAgICAgJ0FjdGlvbkJ1aWxkV29ya2Zsb3cgcmVxdWlyZXMgR2l0SHViIGludGVncmF0aW9uIHRvIGJlIGVuYWJsZWQnLFxuICAgICAgKTtcbiAgICB9XG5cbiAgICB0aGlzLnRhc2sgPSBzY29wZS5hZGRUYXNrKCdsaW50Jywge1xuICAgICAgZGVzY3JpcHRpb246ICdMaW50IHRoZSBhY3Rpb24gKHNoZWxsY2hlY2ssIHlhbWxsaW50LCBhY3Rpb25saW50KScsXG4gICAgfSk7XG4gICAgdGhpcy50YXNrLmV4ZWMoXG4gICAgICAnc3VkbyBhcHQtZ2V0IHVwZGF0ZSAteSAmJiBzdWRvIGFwdC1nZXQgaW5zdGFsbCAteSBzaGVsbGNoZWNrIHlhbWxsaW50JyxcbiAgICApO1xuICAgIHRoaXMudGFzay5leGVjKFxuICAgICAgYGN1cmwgLWZzU0wgLW8gL3RtcC9hY3Rpb25saW50LnRhci5neiBcImh0dHBzOi8vZ2l0aHViLmNvbS9yaHlzZC9hY3Rpb25saW50L3JlbGVhc2VzL2Rvd25sb2FkL3Yke0FDVElPTkxJTlRfVkVSU0lPTn0vYWN0aW9ubGludF8ke0FDVElPTkxJTlRfVkVSU0lPTn1fbGludXhfYW1kNjQudGFyLmd6XCJgLFxuICAgICk7XG4gICAgdGhpcy50YXNrLmV4ZWMoXG4gICAgICBgZWNobyBcIiR7QUNUSU9OTElOVF9TSEEyNTZ9ICAvdG1wL2FjdGlvbmxpbnQudGFyLmd6XCIgfCBzaGEyNTZzdW0gLWMgLWAsXG4gICAgKTtcbiAgICB0aGlzLnRhc2suZXhlYygndGFyIC14emYgL3RtcC9hY3Rpb25saW50LnRhci5neiAtQyAvdG1wIGFjdGlvbmxpbnQnKTtcbiAgICB0aGlzLnRhc2suZXhlYyhcbiAgICAgICdmaW5kIC4gLXBhdGggLi9ub2RlX21vZHVsZXMgLXBydW5lIC1vIC1uYW1lIFwiKi5zaFwiIC1wcmludDAgfCB4YXJncyAtMCAtciBzaGVsbGNoZWNrJyxcbiAgICApO1xuICAgIHRoaXMudGFzay5leGVjKCd5YW1sbGludCAtYyAueWFtbGxpbnQgYWN0aW9uLnltbCAuZ2l0aHViL3dvcmtmbG93cy8qLnltbCcpO1xuICAgIHRoaXMudGFzay5leGVjKCcvdG1wL2FjdGlvbmxpbnQgYWN0aW9uLnltbCAuZ2l0aHViL3dvcmtmbG93cy8qLnltbCcpO1xuXG4gICAgdGhpcy53b3JrZmxvdyA9IG5ldyBnaXRodWIuVGFza1dvcmtmbG93KGdoLCB7XG4gICAgICBuYW1lOiAnYnVpbGQnLFxuICAgICAgam9iSWQ6ICdidWlsZCcsXG4gICAgICB0YXNrOiB0aGlzLnRhc2ssXG4gICAgICB0cmlnZ2VyczogeyBwdXNoOiB7IGJyYW5jaGVzOiBbJ21haW4nXSB9LCBwdWxsUmVxdWVzdDoge30gfSxcbiAgICAgIHBlcm1pc3Npb25zOiB7IGNvbnRlbnRzOiBnaXRodWIud29ya2Zsb3dzLkpvYlBlcm1pc3Npb24uUkVBRCB9LFxuICAgICAgcHJlQnVpbGRTdGVwczogW3sgbmFtZTogJ0luc3RhbGwgZGVwZW5kZW5jaWVzJywgcnVuOiAnbnBtIGNpJyB9XSxcbiAgICB9KTtcbiAgfVxufVxuIl19

package/lib/actions/action-dogfood-workflow.d.ts

@@ -0,0 +1,47 @@
+import { Component, github } from 'projen';
+/**
+ * One invocation of the action within the dogfood scenario: optional fixture
+ * setup, the `uses: .` call with this step's inputs, then this step's
+ * assertions. Most actions need exactly one; actions with a re-run/no-op
+ * behavior to verify (e.g. F006's reuse-the-PR path, F007's no-op-commit
+ * path) declare two.
+ */
+export interface ActionDogfoodStep {
+    /** Label used to name this step-group's generated workflow steps. */
+    readonly name: string;
+    /**
+     * Step id for the `uses: .` invocation, so a later assertion can
+     * reference this step's outputs via `${{ steps.<id>.outputs.<name> }}`.
+     * @default - a slug derived from `name`, disambiguated by position
+     */
+    readonly id?: string;
+    /**
+     * Shell steps executed before this invocation, to produce or alter
+     * fixture state.
+     * @default []
+     */
+    readonly fixtureSteps?: string[];
+    /**
+     * `with:` inputs for this invocation's local `uses: .` call.
+     * @default {}
+     */
+    readonly inputs?: Record<string, string>;
+    /** Shell assertions after this invocation - the job fails unless every one exits 0. */
+    readonly assertions: string[];
+}
+export interface ActionDogfoodOptions {
+    /** One or more scenario steps, run in order, in the dogfood job. */
+    readonly scenario: ActionDogfoodStep[];
+    /** Shell cleanup, run once at the end with `if: always()`, so repeated runs start clean. */
+    readonly cleanup: string[];
+}
+/**
+ * Per AD-001's dogfood test: the composite action is run **against this
+ * repo**, end-to-end, via a local `uses: .` reference - no external harness.
+ * Builds `test-dogfood.yml` from an ordered `scenario` of invocation steps
+ * (see `ActionDogfoodStep`) followed by a shared cleanup step.
+ */
+export declare class ActionDogfoodWorkflow extends Component {
+    readonly workflow: github.GithubWorkflow;
+    constructor(scope: github.GitHubProject, options: ActionDogfoodOptions);
+}

package/lib/actions/action-dogfood-workflow.js

@@ -0,0 +1,84 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ActionDogfoodWorkflow = void 0;
+const JSII_RTTI_SYMBOL_1 = Symbol.for("jsii.rtti");
+const projen_1 = require("projen");
+// Nightly environment-regression canary (AD-001/F006): re-runs the same
+// scenario against settled `main` in today's runner image, independent of
+// the pull_request gate. Quiet UTC hour; a component constant, not a
+// project option - upgrading it is a reviewed diff.
+const NIGHTLY_DOGFOOD_SCHEDULE = '17 3 * * *';
+// Lowercase, non-alphanumerics collapsed to a single `-`, trimmed - then
+// disambiguated by position so two steps sharing a name (or an unnamed
+// slug, e.g. punctuation-only) never collide.
+function slug(name, index) {
+    const base = name
+        .toLowerCase()
+        .replace(/[^a-z0-9]+/g, '-')
+        .replace(/^-+|-+$/g, '');
+    return `${base || 'step'}-${index}`;
+}
+/**
+ * Per AD-001's dogfood test: the composite action is run **against this
+ * repo**, end-to-end, via a local `uses: .` reference - no external harness.
+ * Builds `test-dogfood.yml` from an ordered `scenario` of invocation steps
+ * (see `ActionDogfoodStep`) followed by a shared cleanup step.
+ */
+class ActionDogfoodWorkflow extends projen_1.Component {
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@xpertss/projen-types.ActionDogfoodWorkflow", version: "0.0.3" };
+    workflow;
+    constructor(scope, options) {
+        super(scope, 'ActionDogfoodWorkflow');
+        if (!options.scenario || options.scenario.length === 0) {
+            throw new Error('ActionDogfoodWorkflow requires at least one dogfood.scenario step');
+        }
+        if (!options.cleanup || options.cleanup.length === 0) {
+            throw new Error('ActionDogfoodWorkflow requires dogfood.cleanup');
+        }
+        const gh = scope.github;
+        if (!gh) {
+            throw new Error('ActionDogfoodWorkflow requires GitHub integration to be enabled');
+        }
+        const steps = [projen_1.github.WorkflowSteps.checkout()];
+        options.scenario.forEach((step, index) => {
+            if (step.fixtureSteps && step.fixtureSteps.length > 0) {
+                steps.push({
+                    name: `${step.name}: fixture`,
+                    run: step.fixtureSteps.join('\n'),
+                });
+            }
+            const hasInputs = step.inputs && Object.keys(step.inputs).length > 0;
+            steps.push({
+                id: step.id ?? slug(step.name, index),
+                name: `${step.name}: run the action`,
+                uses: '.',
+                ...(hasInputs ? { with: step.inputs } : {}),
+            });
+            steps.push({
+                name: `${step.name}: assert`,
+                run: step.assertions.join('\n'),
+            });
+        });
+        steps.push({
+            name: 'Cleanup',
+            if: 'always()',
+            run: options.cleanup.join('\n'),
+        });
+        this.workflow = new projen_1.github.GithubWorkflow(gh, 'test-dogfood');
+        this.workflow.on({
+            workflowDispatch: {},
+            pullRequest: { branches: ['main'] },
+            schedule: [{ cron: NIGHTLY_DOGFOOD_SCHEDULE }],
+        });
+        this.workflow.addJob('dogfood', {
+            runsOn: ['ubuntu-latest'],
+            permissions: {
+                contents: projen_1.github.workflows.JobPermission.WRITE,
+                pullRequests: projen_1.github.workflows.JobPermission.WRITE,
+            },
+            steps,
+        });
+    }
+}
+exports.ActionDogfoodWorkflow = ActionDogfoodWorkflow;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYWN0aW9uLWRvZ2Zvb2Qtd29ya2Zsb3cuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvYWN0aW9ucy9hY3Rpb24tZG9nZm9vZC13b3JrZmxvdy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7O0FBQUEsbUNBQTJDO0FBRTNDLHdFQUF3RTtBQUN4RSwwRUFBMEU7QUFDMUUscUVBQXFFO0FBQ3JFLG9EQUFvRDtBQUNwRCxNQUFNLHdCQUF3QixHQUFHLFlBQVksQ0FBQztBQXFDOUMseUVBQXlFO0FBQ3pFLHVFQUF1RTtBQUN2RSw4Q0FBOEM7QUFDOUMsU0FBUyxJQUFJLENBQUMsSUFBWSxFQUFFLEtBQWE7SUFDdkMsTUFBTSxJQUFJLEdBQUcsSUFBSTtTQUNkLFdBQVcsRUFBRTtTQUNiLE9BQU8sQ0FBQyxhQUFhLEVBQUUsR0FBRyxDQUFDO1NBQzNCLE9BQU8sQ0FBQyxVQUFVLEVBQUUsRUFBRSxDQUFDLENBQUM7SUFDM0IsT0FBTyxHQUFHLElBQUksSUFBSSxNQUFNLElBQUksS0FBSyxFQUFFLENBQUM7QUFDdEMsQ0FBQztBQVVEOzs7OztHQUtHO0FBQ0gsTUFBYSxxQkFBc0IsU0FBUSxrQkFBUzs7SUFDbEMsUUFBUSxDQUF3QjtJQUVoRCxZQUFZLEtBQTJCLEVBQUUsT0FBNkI7UUFDcEUsS0FBSyxDQUFDLEtBQUssRUFBRSx1QkFBdUIsQ0FBQyxDQUFDO1FBRXRDLElBQUksQ0FBQyxPQUFPLENBQUMsUUFBUSxJQUFJLE9BQU8sQ0FBQyxRQUFRLENBQUMsTUFBTSxLQUFLLENBQUMsRUFBRSxDQUFDO1lBQ3ZELE1BQU0sSUFBSSxLQUFLLENBQ2IsbUVBQW1FLENBQ3BFLENBQUM7UUFDSixDQUFDO1FBQ0QsSUFBSSxDQUFDLE9BQU8sQ0FBQyxPQUFPLElBQUksT0FBTyxDQUFDLE9BQU8sQ0FBQyxNQUFNLEtBQUssQ0FBQyxFQUFFLENBQUM7WUFDckQsTUFBTSxJQUFJLEtBQUssQ0FBQyxnREFBZ0QsQ0FBQyxDQUFDO1FBQ3BFLENBQUM7UUFFRCxNQUFNLEVBQUUsR0FBRyxLQUFLLENBQUMsTUFBTSxDQUFDO1FBQ3hCLElBQUksQ0FBQyxFQUFFLEVBQUUsQ0FBQztZQUNSLE1BQU0sSUFBSSxLQUFLLENBQ2IsaUVBQWlFLENBQ2xFLENBQUM7UUFDSixDQUFDO1FBRUQsTUFBTSxLQUFLLEdBQStCLENBQUMsZUFBTSxDQUFDLGFBQWEsQ0FBQyxRQUFRLEVBQUUsQ0FBQyxDQUFDO1FBRTVFLE9BQU8sQ0FBQyxRQUFRLENBQUMsT0FBTyxDQUFDLENBQUMsSUFBSSxFQUFFLEtBQUssRUFBRSxFQUFFO1lBQ3ZDLElBQUksSUFBSSxDQUFDLFlBQVksSUFBSSxJQUFJLENBQUMsWUFBWSxDQUFDLE1BQU0sR0FBRyxDQUFDLEVBQUUsQ0FBQztnQkFDdEQsS0FBSyxDQUFDLElBQUksQ0FBQztvQkFDVCxJQUFJLEVBQUUsR0FBRyxJQUFJLENBQUMsSUFBSSxXQUFXO29CQUM3QixHQUFHLEVBQUUsSUFBSSxDQUFDLFlBQVksQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDO2lCQUNsQyxDQUFDLENBQUM7WUFDTCxDQUFDO1lBRUQsTUFBTSxTQUFTLEdBQUcsSUFBSSxDQUFDLE1BQU0sSUFBSSxNQUFNLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsQ0FBQyxNQUFNLEdBQUcsQ0FBQyxDQUFDO1lBQ3JFLEtBQUssQ0FBQyxJQUFJLENBQUM7Z0JBQ1QsRUFBRSxFQUFFLElBQUksQ0FBQyxFQUFFLElBQUksSUFBSSxDQUFDLElBQUksQ0FBQyxJQUFJLEVBQUUsS0FBSyxDQUFDO2dCQUNyQyxJQUFJLEVBQUUsR0FBRyxJQUFJLENBQUMsSUFBSSxrQkFBa0I7Z0JBQ3BDLElBQUksRUFBRSxHQUFHO2dCQUNULEdBQUcsQ0FBQyxTQUFTLENBQUMsQ0FBQyxDQUFDLEVBQUUsSUFBSSxFQUFFLElBQUksQ0FBQyxNQUFNLEVBQUUsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDO2FBQzVDLENBQUMsQ0FBQztZQUVILEtBQUssQ0FBQyxJQUFJLENBQUM7Z0JBQ1QsSUFBSSxFQUFFLEdBQUcsSUFBSSxDQUFDLElBQUksVUFBVTtnQkFDNUIsR0FBRyxFQUFFLElBQUksQ0FBQyxVQUFVLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQzthQUNoQyxDQUFDLENBQUM7UUFDTCxDQUFDLENBQUMsQ0FBQztRQUVILEtBQUssQ0FBQyxJQUFJLENBQUM7WUFDVCxJQUFJLEVBQUUsU0FBUztZQUNmLEVBQUUsRUFBRSxVQUFVO1lBQ2QsR0FBRyxFQUFFLE9BQU8sQ0FBQyxPQUFPLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQztTQUNoQyxDQUFDLENBQUM7UUFFSCxJQUFJLENBQUMsUUFBUSxHQUFHLElBQUksZUFBTSxDQUFDLGNBQWMsQ0FBQyxFQUFFLEVBQUUsY0FBYyxDQUFDLENBQUM7UUFDOUQsSUFBSSxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUM7WUFDZixnQkFBZ0IsRUFBRSxFQUFFO1lBQ3BCLFdBQVcsRUFBRSxFQUFFLFFBQVEsRUFBRSxDQUFDLE1BQU0sQ0FBQyxFQUFFO1lBQ25DLFFBQVEsRUFBRSxDQUFDLEVBQUUsSUFBSSxFQUFFLHdCQUF3QixFQUFFLENBQUM7U0FDL0MsQ0FBQyxDQUFDO1FBQ0gsSUFBSSxDQUFDLFFBQVEsQ0FBQyxNQUFNLENBQUMsU0FBUyxFQUFFO1lBQzlCLE1BQU0sRUFBRSxDQUFDLGVBQWUsQ0FBQztZQUN6QixXQUFXLEVBQUU7Z0JBQ1gsUUFBUSxFQUFFLGVBQU0sQ0FBQyxTQUFTLENBQUMsYUFBYSxDQUFDLEtBQUs7Z0JBQzlDLFlBQVksRUFBRSxlQUFNLENBQUMsU0FBUyxDQUFDLGFBQWEsQ0FBQyxLQUFLO2FBQ25EO1lBQ0QsS0FBSztTQUNOLENBQUMsQ0FBQztJQUNMLENBQUM7O0FBbEVILHNEQW1FQyIsInNvdXJjZXNDb250ZW50IjpbImltcG9ydCB7IENvbXBvbmVudCwgZ2l0aHViIH0gZnJvbSAncHJvamVuJztcblxuLy8gTmlnaHRseSBlbnZpcm9ubWVudC1yZWdyZXNzaW9uIGNhbmFyeSAoQUQtMDAxL0YwMDYpOiByZS1ydW5zIHRoZSBzYW1lXG4vLyBzY2VuYXJpbyBhZ2FpbnN0IHNldHRsZWQgYG1haW5gIGluIHRvZGF5J3MgcnVubmVyIGltYWdlLCBpbmRlcGVuZGVudCBvZlxuLy8gdGhlIHB1bGxfcmVxdWVzdCBnYXRlLiBRdWlldCBVVEMgaG91cjsgYSBjb21wb25lbnQgY29uc3RhbnQsIG5vdCBhXG4vLyBwcm9qZWN0IG9wdGlvbiAtIHVwZ3JhZGluZyBpdCBpcyBhIHJldmlld2VkIGRpZmYuXG5jb25zdCBOSUdIVExZX0RPR0ZPT0RfU0NIRURVTEUgPSAnMTcgMyAqICogKic7XG5cbi8qKlxuICogT25lIGludm9jYXRpb24gb2YgdGhlIGFjdGlvbiB3aXRoaW4gdGhlIGRvZ2Zvb2Qgc2NlbmFyaW86IG9wdGlvbmFsIGZpeHR1cmVcbiAqIHNldHVwLCB0aGUgYHVzZXM6IC5gIGNhbGwgd2l0aCB0aGlzIHN0ZXAncyBpbnB1dHMsIHRoZW4gdGhpcyBzdGVwJ3NcbiAqIGFzc2VydGlvbnMuIE1vc3QgYWN0aW9ucyBuZWVkIGV4YWN0bHkgb25lOyBhY3Rpb25zIHdpdGggYSByZS1ydW4vbm8tb3BcbiAqIGJlaGF2aW9yIHRvIHZlcmlmeSAoZS5nLiBGMDA2J3MgcmV1c2UtdGhlLVBSIHBhdGgsIEYwMDcncyBuby1vcC1jb21taXRcbiAqIHBhdGgpIGRlY2xhcmUgdHdvLlxuICovXG5leHBvcnQgaW50ZXJmYWNlIEFjdGlvbkRvZ2Zvb2RTdGVwIHtcbiAgLyoqIExhYmVsIHVzZWQgdG8gbmFtZSB0aGlzIHN0ZXAtZ3JvdXAncyBnZW5lcmF0ZWQgd29ya2Zsb3cgc3RlcHMuICovXG4gIHJlYWRvbmx5IG5hbWU6IHN0cmluZztcblxuICAvKipcbiAgICogU3RlcCBpZCBmb3IgdGhlIGB1c2VzOiAuYCBpbnZvY2F0aW9uLCBzbyBhIGxhdGVyIGFzc2VydGlvbiBjYW5cbiAgICogcmVmZXJlbmNlIHRoaXMgc3RlcCdzIG91dHB1dHMgdmlhIGAke3sgc3RlcHMuPGlkPi5vdXRwdXRzLjxuYW1lPiB9fWAuXG4gICAqIEBkZWZhdWx0IC0gYSBzbHVnIGRlcml2ZWQgZnJvbSBgbmFtZWAsIGRpc2FtYmlndWF0ZWQgYnkgcG9zaXRpb25cbiAgICovXG4gIHJlYWRvbmx5IGlkPzogc3RyaW5nO1xuXG4gIC8qKlxuICAgKiBTaGVsbCBzdGVwcyBleGVjdXRlZCBiZWZvcmUgdGhpcyBpbnZvY2F0aW9uLCB0byBwcm9kdWNlIG9yIGFsdGVyXG4gICAqIGZpeHR1cmUgc3RhdGUuXG4gICAqIEBkZWZhdWx0IFtdXG4gICAqL1xuICByZWFkb25seSBmaXh0dXJlU3RlcHM/OiBzdHJpbmdbXTtcblxuICAvKipcbiAgICogYHdpdGg6YCBpbnB1dHMgZm9yIHRoaXMgaW52b2NhdGlvbidzIGxvY2FsIGB1c2VzOiAuYCBjYWxsLlxuICAgKiBAZGVmYXVsdCB7fVxuICAgKi9cbiAgcmVhZG9ubHkgaW5wdXRzPzogUmVjb3JkPHN0cmluZywgc3RyaW5nPjtcblxuICAvKiogU2hlbGwgYXNzZXJ0aW9ucyBhZnRlciB0aGlzIGludm9jYXRpb24gLSB0aGUgam9iIGZhaWxzIHVubGVzcyBldmVyeSBvbmUgZXhpdHMgMC4gKi9cbiAgcmVhZG9ubHkgYXNzZXJ0aW9uczogc3RyaW5nW107XG59XG5cbi8vIExvd2VyY2FzZSwgbm9uLWFscGhhbnVtZXJpY3MgY29sbGFwc2VkIHRvIGEgc2luZ2xlIGAtYCwgdHJpbW1lZCAtIHRoZW5cbi8vIGRpc2FtYmlndWF0ZWQgYnkgcG9zaXRpb24gc28gdHdvIHN0ZXBzIHNoYXJpbmcgYSBuYW1lIChvciBhbiB1bm5hbWVkXG4vLyBzbHVnLCBlLmcuIHB1bmN0dWF0aW9uLW9ubHkpIG5ldmVyIGNvbGxpZGUuXG5mdW5jdGlvbiBzbHVnKG5hbWU6IHN0cmluZywgaW5kZXg6IG51bWJlcik6IHN0cmluZyB7XG4gIGNvbnN0IGJhc2UgPSBuYW1lXG4gICAgLnRvTG93ZXJDYXNlKClcbiAgICAucmVwbGFjZSgvW15hLXowLTldKy9nLCAnLScpXG4gICAgLnJlcGxhY2UoL14tK3wtKyQvZywgJycpO1xuICByZXR1cm4gYCR7YmFzZSB8fCAnc3RlcCd9LSR7aW5kZXh9YDtcbn1cblxuZXhwb3J0IGludGVyZmFjZSBBY3Rpb25Eb2dmb29kT3B0aW9ucyB7XG4gIC8qKiBPbmUgb3IgbW9yZSBzY2VuYXJpbyBzdGVwcywgcnVuIGluIG9yZGVyLCBpbiB0aGUgZG9nZm9vZCBqb2IuICovXG4gIHJlYWRvbmx5IHNjZW5hcmlvOiBBY3Rpb25Eb2dmb29kU3RlcFtdO1xuXG4gIC8qKiBTaGVsbCBjbGVhbnVwLCBydW4gb25jZSBhdCB0aGUgZW5kIHdpdGggYGlmOiBhbHdheXMoKWAsIHNvIHJlcGVhdGVkIHJ1bnMgc3RhcnQgY2xlYW4uICovXG4gIHJlYWRvbmx5IGNsZWFudXA6IHN0cmluZ1tdO1xufVxuXG4vKipcbiAqIFBlciBBRC0wMDEncyBkb2dmb29kIHRlc3Q6IHRoZSBjb21wb3NpdGUgYWN0aW9uIGlzIHJ1biAqKmFnYWluc3QgdGhpc1xuICogcmVwbyoqLCBlbmQtdG8tZW5kLCB2aWEgYSBsb2NhbCBgdXNlczogLmAgcmVmZXJlbmNlIC0gbm8gZXh0ZXJuYWwgaGFybmVzcy5cbiAqIEJ1aWxkcyBgdGVzdC1kb2dmb29kLnltbGAgZnJvbSBhbiBvcmRlcmVkIGBzY2VuYXJpb2Agb2YgaW52b2NhdGlvbiBzdGVwc1xuICogKHNlZSBgQWN0aW9uRG9nZm9vZFN0ZXBgKSBmb2xsb3dlZCBieSBhIHNoYXJlZCBjbGVhbnVwIHN0ZXAuXG4gKi9cbmV4cG9ydCBjbGFzcyBBY3Rpb25Eb2dmb29kV29ya2Zsb3cgZXh0ZW5kcyBDb21wb25lbnQge1xuICBwdWJsaWMgcmVhZG9ubHkgd29ya2Zsb3c6IGdpdGh1Yi5HaXRodWJXb3JrZmxvdztcblxuICBjb25zdHJ1Y3RvcihzY29wZTogZ2l0aHViLkdpdEh1YlByb2plY3QsIG9wdGlvbnM6IEFjdGlvbkRvZ2Zvb2RPcHRpb25zKSB7XG4gICAgc3VwZXIoc2NvcGUsICdBY3Rpb25Eb2dmb29kV29ya2Zsb3cnKTtcblxuICAgIGlmICghb3B0aW9ucy5zY2VuYXJpbyB8fCBvcHRpb25zLnNjZW5hcmlvLmxlbmd0aCA9PT0gMCkge1xuICAgICAgdGhyb3cgbmV3IEVycm9yKFxuICAgICAgICAnQWN0aW9uRG9nZm9vZFdvcmtmbG93IHJlcXVpcmVzIGF0IGxlYXN0IG9uZSBkb2dmb29kLnNjZW5hcmlvIHN0ZXAnLFxuICAgICAgKTtcbiAgICB9XG4gICAgaWYgKCFvcHRpb25zLmNsZWFudXAgfHwgb3B0aW9ucy5jbGVhbnVwLmxlbmd0aCA9PT0gMCkge1xuICAgICAgdGhyb3cgbmV3IEVycm9yKCdBY3Rpb25Eb2dmb29kV29ya2Zsb3cgcmVxdWlyZXMgZG9nZm9vZC5jbGVhbnVwJyk7XG4gICAgfVxuXG4gICAgY29uc3QgZ2ggPSBzY29wZS5naXRodWI7XG4gICAgaWYgKCFnaCkge1xuICAgICAgdGhyb3cgbmV3IEVycm9yKFxuICAgICAgICAnQWN0aW9uRG9nZm9vZFdvcmtmbG93IHJlcXVpcmVzIEdpdEh1YiBpbnRlZ3JhdGlvbiB0byBiZSBlbmFibGVkJyxcbiAgICAgICk7XG4gICAgfVxuXG4gICAgY29uc3Qgc3RlcHM6IGdpdGh1Yi53b3JrZmxvd3MuSm9iU3RlcFtdID0gW2dpdGh1Yi5Xb3JrZmxvd1N0ZXBzLmNoZWNrb3V0KCldO1xuXG4gICAgb3B0aW9ucy5zY2VuYXJpby5mb3JFYWNoKChzdGVwLCBpbmRleCkgPT4ge1xuICAgICAgaWYgKHN0ZXAuZml4dHVyZVN0ZXBzICYmIHN0ZXAuZml4dHVyZVN0ZXBzLmxlbmd0aCA+IDApIHtcbiAgICAgICAgc3RlcHMucHVzaCh7XG4gICAgICAgICAgbmFtZTogYCR7c3RlcC5uYW1lfTogZml4dHVyZWAsXG4gICAgICAgICAgcnVuOiBzdGVwLmZpeHR1cmVTdGVwcy5qb2luKCdcXG4nKSxcbiAgICAgICAgfSk7XG4gICAgICB9XG5cbiAgICAgIGNvbnN0IGhhc0lucHV0cyA9IHN0ZXAuaW5wdXRzICYmIE9iamVjdC5rZXlzKHN0ZXAuaW5wdXRzKS5sZW5ndGggPiAwO1xuICAgICAgc3RlcHMucHVzaCh7XG4gICAgICAgIGlkOiBzdGVwLmlkID8/IHNsdWcoc3RlcC5uYW1lLCBpbmRleCksXG4gICAgICAgIG5hbWU6IGAke3N0ZXAubmFtZX06IHJ1biB0aGUgYWN0aW9uYCxcbiAgICAgICAgdXNlczogJy4nLFxuICAgICAgICAuLi4oaGFzSW5wdXRzID8geyB3aXRoOiBzdGVwLmlucHV0cyB9IDoge30pLFxuICAgICAgfSk7XG5cbiAgICAgIHN0ZXBzLnB1c2goe1xuICAgICAgICBuYW1lOiBgJHtzdGVwLm5hbWV9OiBhc3NlcnRgLFxuICAgICAgICBydW46IHN0ZXAuYXNzZXJ0aW9ucy5qb2luKCdcXG4nKSxcbiAgICAgIH0pO1xuICAgIH0pO1xuXG4gICAgc3RlcHMucHVzaCh7XG4gICAgICBuYW1lOiAnQ2xlYW51cCcsXG4gICAgICBpZjogJ2Fsd2F5cygpJyxcbiAgICAgIHJ1bjogb3B0aW9ucy5jbGVhbnVwLmpvaW4oJ1xcbicpLFxuICAgIH0pO1xuXG4gICAgdGhpcy53b3JrZmxvdyA9IG5ldyBnaXRodWIuR2l0aHViV29ya2Zsb3coZ2gsICd0ZXN0LWRvZ2Zvb2QnKTtcbiAgICB0aGlzLndvcmtmbG93Lm9uKHtcbiAgICAgIHdvcmtmbG93RGlzcGF0Y2g6IHt9LFxuICAgICAgcHVsbFJlcXVlc3Q6IHsgYnJhbmNoZXM6IFsnbWFpbiddIH0sXG4gICAgICBzY2hlZHVsZTogW3sgY3JvbjogTklHSFRMWV9ET0dGT09EX1NDSEVEVUxFIH1dLFxuICAgIH0pO1xuICAgIHRoaXMud29ya2Zsb3cuYWRkSm9iKCdkb2dmb29kJywge1xuICAgICAgcnVuc09uOiBbJ3VidW50dS1sYXRlc3QnXSxcbiAgICAgIHBlcm1pc3Npb25zOiB7XG4gICAgICAgIGNvbnRlbnRzOiBnaXRodWIud29ya2Zsb3dzLkpvYlBlcm1pc3Npb24uV1JJVEUsXG4gICAgICAgIHB1bGxSZXF1ZXN0czogZ2l0aHViLndvcmtmbG93cy5Kb2JQZXJtaXNzaW9uLldSSVRFLFxuICAgICAgfSxcbiAgICAgIHN0ZXBzLFxuICAgIH0pO1xuICB9XG59XG4iXX0=

package/lib/actions/action-sonar-workflow.d.ts

@@ -0,0 +1,25 @@
+import { Component, github } from 'projen';
+export interface ActionSonarWorkflowOptions {
+    /**
+     * URL of the org's self-hosted SonarQube instance. Required, no default -
+     * a guessed server is worse than a loud failure.
+     */
+    readonly sonarHostUrl: string;
+    /** @default "SONAR_TOKEN" */
+    readonly sonarTokenSecret?: string;
+    /**
+     * Whether `sonar.yml` also runs on `pull_request` as a pass/fail gate.
+     * @default true
+     */
+    readonly sonarPullRequestGate?: boolean;
+}
+/**
+ * AD-001 Layer 2: self-hosted SonarQube Community Edition via the Scanner
+ * CLI only (never `SonarSource/sonarqube-scan-action` - third-party, and it
+ * carried a security advisory). `sonar.inclusions` is set explicitly since
+ * default inclusions may skip `action.yml` outside `.github/`.
+ */
+export declare class ActionSonarWorkflow extends Component {
+    readonly workflow: github.GithubWorkflow;
+    constructor(scope: github.GitHubProject, options: ActionSonarWorkflowOptions);
+}

package/lib/actions/action-sonar-workflow.js

@@ -0,0 +1,64 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ActionSonarWorkflow = void 0;
+const JSII_RTTI_SYMBOL_1 = Symbol.for("jsii.rtti");
+const projen_1 = require("projen");
+// Pinned release + verified SHA-256 (linux-x64) - upgrade is a reviewed diff
+// of this constant, never a floating version (AD-001).
+const SONAR_SCANNER_VERSION = '8.1.0.6389';
+const SONAR_SCANNER_SHA256 = 'bb8f709f9cb73352f8d1260a3b3c506c0f41146754bc630762c126d795499d0b';
+/**
+ * AD-001 Layer 2: self-hosted SonarQube Community Edition via the Scanner
+ * CLI only (never `SonarSource/sonarqube-scan-action` - third-party, and it
+ * carried a security advisory). `sonar.inclusions` is set explicitly since
+ * default inclusions may skip `action.yml` outside `.github/`.
+ */
+class ActionSonarWorkflow extends projen_1.Component {
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@xpertss/projen-types.ActionSonarWorkflow", version: "0.0.3" };
+    workflow;
+    constructor(scope, options) {
+        super(scope, 'ActionSonarWorkflow');
+        if (!options.sonarHostUrl) {
+            throw new Error('ActionSonarWorkflow requires sonarHostUrl');
+        }
+        const gh = scope.github;
+        if (!gh) {
+            throw new Error('ActionSonarWorkflow requires GitHub integration to be enabled');
+        }
+        const sonarTokenSecret = options.sonarTokenSecret ?? 'SONAR_TOKEN';
+        const pullRequestGate = options.sonarPullRequestGate ?? true;
+        this.workflow = new projen_1.github.GithubWorkflow(gh, 'sonar');
+        this.workflow.on({
+            push: { branches: ['main'] },
+            ...(pullRequestGate ? { pullRequest: {} } : {}),
+        });
+        this.workflow.addJob('sonar', {
+            runsOn: ['ubuntu-latest'],
+            permissions: { contents: projen_1.github.workflows.JobPermission.READ },
+            env: { SONAR_TOKEN: `\${{ secrets.${sonarTokenSecret} }}` },
+            steps: [
+                projen_1.github.WorkflowSteps.checkout(),
+                {
+                    name: 'Install sonar-scanner',
+                    run: `set -euo pipefail
+curl -fsSL -o /tmp/sonar-scanner.zip "https://binaries.sonarsource.com/Distribution/sonar-scanner-cli/sonar-scanner-cli-${SONAR_SCANNER_VERSION}-linux-x64.zip"
+echo "${SONAR_SCANNER_SHA256}  /tmp/sonar-scanner.zip" | sha256sum -c -
+unzip -q /tmp/sonar-scanner.zip -d /tmp
+echo "/tmp/sonar-scanner-${SONAR_SCANNER_VERSION}-linux-x64/bin" >> "$GITHUB_PATH"
+`,
+                },
+                {
+                    name: 'Scan',
+                    run: `sonar-scanner \\
+  -Dsonar.host.url=${options.sonarHostUrl} \\
+  -Dsonar.projectKey=${scope.name} \\
+  -Dsonar.projectVersion="$(git describe --tags --always)" \\
+  -Dsonar.inclusions=.github/workflows/**,action.yml,**/*.sh \\
+  -Dsonar.qualitygate.wait=true`,
+                },
+            ],
+        });
+    }
+}
+exports.ActionSonarWorkflow = ActionSonarWorkflow;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYWN0aW9uLXNvbmFyLXdvcmtmbG93LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL2FjdGlvbnMvYWN0aW9uLXNvbmFyLXdvcmtmbG93LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7Ozs7QUFBQSxtQ0FBMkM7QUFFM0MsNkVBQTZFO0FBQzdFLHVEQUF1RDtBQUN2RCxNQUFNLHFCQUFxQixHQUFHLFlBQVksQ0FBQztBQUMzQyxNQUFNLG9CQUFvQixHQUN4QixrRUFBa0UsQ0FBQztBQW1CckU7Ozs7O0dBS0c7QUFDSCxNQUFhLG1CQUFvQixTQUFRLGtCQUFTOztJQUNoQyxRQUFRLENBQXdCO0lBRWhELFlBQ0UsS0FBMkIsRUFDM0IsT0FBbUM7UUFFbkMsS0FBSyxDQUFDLEtBQUssRUFBRSxxQkFBcUIsQ0FBQyxDQUFDO1FBRXBDLElBQUksQ0FBQyxPQUFPLENBQUMsWUFBWSxFQUFFLENBQUM7WUFDMUIsTUFBTSxJQUFJLEtBQUssQ0FBQywyQ0FBMkMsQ0FBQyxDQUFDO1FBQy9ELENBQUM7UUFFRCxNQUFNLEVBQUUsR0FBRyxLQUFLLENBQUMsTUFBTSxDQUFDO1FBQ3hCLElBQUksQ0FBQyxFQUFFLEVBQUUsQ0FBQztZQUNSLE1BQU0sSUFBSSxLQUFLLENBQ2IsK0RBQStELENBQ2hFLENBQUM7UUFDSixDQUFDO1FBRUQsTUFBTSxnQkFBZ0IsR0FBRyxPQUFPLENBQUMsZ0JBQWdCLElBQUksYUFBYSxDQUFDO1FBQ25FLE1BQU0sZUFBZSxHQUFHLE9BQU8sQ0FBQyxvQkFBb0IsSUFBSSxJQUFJLENBQUM7UUFFN0QsSUFBSSxDQUFDLFFBQVEsR0FBRyxJQUFJLGVBQU0sQ0FBQyxjQUFjLENBQUMsRUFBRSxFQUFFLE9BQU8sQ0FBQyxDQUFDO1FBQ3ZELElBQUksQ0FBQyxRQUFRLENBQUMsRUFBRSxDQUFDO1lBQ2YsSUFBSSxFQUFFLEVBQUUsUUFBUSxFQUFFLENBQUMsTUFBTSxDQUFDLEVBQUU7WUFDNUIsR0FBRyxDQUFDLGVBQWUsQ0FBQyxDQUFDLENBQUMsRUFBRSxXQUFXLEVBQUUsRUFBRSxFQUFFLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQztTQUNoRCxDQUFDLENBQUM7UUFDSCxJQUFJLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQyxPQUFPLEVBQUU7WUFDNUIsTUFBTSxFQUFFLENBQUMsZUFBZSxDQUFDO1lBQ3pCLFdBQVcsRUFBRSxFQUFFLFFBQVEsRUFBRSxlQUFNLENBQUMsU0FBUyxDQUFDLGFBQWEsQ0FBQyxJQUFJLEVBQUU7WUFDOUQsR0FBRyxFQUFFLEVBQUUsV0FBVyxFQUFFLGdCQUFnQixnQkFBZ0IsS0FBSyxFQUFFO1lBQzNELEtBQUssRUFBRTtnQkFDTCxlQUFNLENBQUMsYUFBYSxDQUFDLFFBQVEsRUFBRTtnQkFDL0I7b0JBQ0UsSUFBSSxFQUFFLHVCQUF1QjtvQkFDN0IsR0FBRyxFQUFFOzBIQUMyRyxxQkFBcUI7UUFDdkksb0JBQW9COzsyQkFFRCxxQkFBcUI7Q0FDL0M7aUJBQ1E7Z0JBQ0Q7b0JBQ0UsSUFBSSxFQUFFLE1BQU07b0JBQ1osR0FBRyxFQUFFO3FCQUNNLE9BQU8sQ0FBQyxZQUFZO3VCQUNsQixLQUFLLENBQUMsSUFBSTs7O2dDQUdEO2lCQUN2QjthQUNGO1NBQ0YsQ0FBQyxDQUFDO0lBQ0wsQ0FBQzs7QUF0REgsa0RBdURDIiwic291cmNlc0NvbnRlbnQiOlsiaW1wb3J0IHsgQ29tcG9uZW50LCBnaXRodWIgfSBmcm9tICdwcm9qZW4nO1xuXG4vLyBQaW5uZWQgcmVsZWFzZSArIHZlcmlmaWVkIFNIQS0yNTYgKGxpbnV4LXg2NCkgLSB1cGdyYWRlIGlzIGEgcmV2aWV3ZWQgZGlmZlxuLy8gb2YgdGhpcyBjb25zdGFudCwgbmV2ZXIgYSBmbG9hdGluZyB2ZXJzaW9uIChBRC0wMDEpLlxuY29uc3QgU09OQVJfU0NBTk5FUl9WRVJTSU9OID0gJzguMS4wLjYzODknO1xuY29uc3QgU09OQVJfU0NBTk5FUl9TSEEyNTYgPVxuICAnYmI4ZjcwOWY5Y2I3MzM1MmY4ZDEyNjBhM2IzYzUwNmMwZjQxMTQ2NzU0YmM2MzA3NjJjMTI2ZDc5NTQ5OWQwYic7XG5cbmV4cG9ydCBpbnRlcmZhY2UgQWN0aW9uU29uYXJXb3JrZmxvd09wdGlvbnMge1xuICAvKipcbiAgICogVVJMIG9mIHRoZSBvcmcncyBzZWxmLWhvc3RlZCBTb25hclF1YmUgaW5zdGFuY2UuIFJlcXVpcmVkLCBubyBkZWZhdWx0IC1cbiAgICogYSBndWVzc2VkIHNlcnZlciBpcyB3b3JzZSB0aGFuIGEgbG91ZCBmYWlsdXJlLlxuICAgKi9cbiAgcmVhZG9ubHkgc29uYXJIb3N0VXJsOiBzdHJpbmc7XG5cbiAgLyoqIEBkZWZhdWx0IFwiU09OQVJfVE9LRU5cIiAqL1xuICByZWFkb25seSBzb25hclRva2VuU2VjcmV0Pzogc3RyaW5nO1xuXG4gIC8qKlxuICAgKiBXaGV0aGVyIGBzb25hci55bWxgIGFsc28gcnVucyBvbiBgcHVsbF9yZXF1ZXN0YCBhcyBhIHBhc3MvZmFpbCBnYXRlLlxuICAgKiBAZGVmYXVsdCB0cnVlXG4gICAqL1xuICByZWFkb25seSBzb25hclB1bGxSZXF1ZXN0R2F0ZT86IGJvb2xlYW47XG59XG5cbi8qKlxuICogQUQtMDAxIExheWVyIDI6IHNlbGYtaG9zdGVkIFNvbmFyUXViZSBDb21tdW5pdHkgRWRpdGlvbiB2aWEgdGhlIFNjYW5uZXJcbiAqIENMSSBvbmx5IChuZXZlciBgU29uYXJTb3VyY2Uvc29uYXJxdWJlLXNjYW4tYWN0aW9uYCAtIHRoaXJkLXBhcnR5LCBhbmQgaXRcbiAqIGNhcnJpZWQgYSBzZWN1cml0eSBhZHZpc29yeSkuIGBzb25hci5pbmNsdXNpb25zYCBpcyBzZXQgZXhwbGljaXRseSBzaW5jZVxuICogZGVmYXVsdCBpbmNsdXNpb25zIG1heSBza2lwIGBhY3Rpb24ueW1sYCBvdXRzaWRlIGAuZ2l0aHViL2AuXG4gKi9cbmV4cG9ydCBjbGFzcyBBY3Rpb25Tb25hcldvcmtmbG93IGV4dGVuZHMgQ29tcG9uZW50IHtcbiAgcHVibGljIHJlYWRvbmx5IHdvcmtmbG93OiBnaXRodWIuR2l0aHViV29ya2Zsb3c7XG5cbiAgY29uc3RydWN0b3IoXG4gICAgc2NvcGU6IGdpdGh1Yi5HaXRIdWJQcm9qZWN0LFxuICAgIG9wdGlvbnM6IEFjdGlvblNvbmFyV29ya2Zsb3dPcHRpb25zLFxuICApIHtcbiAgICBzdXBlcihzY29wZSwgJ0FjdGlvblNvbmFyV29ya2Zsb3cnKTtcblxuICAgIGlmICghb3B0aW9ucy5zb25hckhvc3RVcmwpIHtcbiAgICAgIHRocm93IG5ldyBFcnJvcignQWN0aW9uU29uYXJXb3JrZmxvdyByZXF1aXJlcyBzb25hckhvc3RVcmwnKTtcbiAgICB9XG5cbiAgICBjb25zdCBnaCA9IHNjb3BlLmdpdGh1YjtcbiAgICBpZiAoIWdoKSB7XG4gICAgICB0aHJvdyBuZXcgRXJyb3IoXG4gICAgICAgICdBY3Rpb25Tb25hcldvcmtmbG93IHJlcXVpcmVzIEdpdEh1YiBpbnRlZ3JhdGlvbiB0byBiZSBlbmFibGVkJyxcbiAgICAgICk7XG4gICAgfVxuXG4gICAgY29uc3Qgc29uYXJUb2tlblNlY3JldCA9IG9wdGlvbnMuc29uYXJUb2tlblNlY3JldCA/PyAnU09OQVJfVE9LRU4nO1xuICAgIGNvbnN0IHB1bGxSZXF1ZXN0R2F0ZSA9IG9wdGlvbnMuc29uYXJQdWxsUmVxdWVzdEdhdGUgPz8gdHJ1ZTtcblxuICAgIHRoaXMud29ya2Zsb3cgPSBuZXcgZ2l0aHViLkdpdGh1YldvcmtmbG93KGdoLCAnc29uYXInKTtcbiAgICB0aGlzLndvcmtmbG93Lm9uKHtcbiAgICAgIHB1c2g6IHsgYnJhbmNoZXM6IFsnbWFpbiddIH0sXG4gICAgICAuLi4ocHVsbFJlcXVlc3RHYXRlID8geyBwdWxsUmVxdWVzdDoge30gfSA6IHt9KSxcbiAgICB9KTtcbiAgICB0aGlzLndvcmtmbG93LmFkZEpvYignc29uYXInLCB7XG4gICAgICBydW5zT246IFsndWJ1bnR1LWxhdGVzdCddLFxuICAgICAgcGVybWlzc2lvbnM6IHsgY29udGVudHM6IGdpdGh1Yi53b3JrZmxvd3MuSm9iUGVybWlzc2lvbi5SRUFEIH0sXG4gICAgICBlbnY6IHsgU09OQVJfVE9LRU46IGBcXCR7eyBzZWNyZXRzLiR7c29uYXJUb2tlblNlY3JldH0gfX1gIH0sXG4gICAgICBzdGVwczogW1xuICAgICAgICBnaXRodWIuV29ya2Zsb3dTdGVwcy5jaGVja291dCgpLFxuICAgICAgICB7XG4gICAgICAgICAgbmFtZTogJ0luc3RhbGwgc29uYXItc2Nhbm5lcicsXG4gICAgICAgICAgcnVuOiBgc2V0IC1ldW8gcGlwZWZhaWxcbmN1cmwgLWZzU0wgLW8gL3RtcC9zb25hci1zY2FubmVyLnppcCBcImh0dHBzOi8vYmluYXJpZXMuc29uYXJzb3VyY2UuY29tL0Rpc3RyaWJ1dGlvbi9zb25hci1zY2FubmVyLWNsaS9zb25hci1zY2FubmVyLWNsaS0ke1NPTkFSX1NDQU5ORVJfVkVSU0lPTn0tbGludXgteDY0LnppcFwiXG5lY2hvIFwiJHtTT05BUl9TQ0FOTkVSX1NIQTI1Nn0gIC90bXAvc29uYXItc2Nhbm5lci56aXBcIiB8IHNoYTI1NnN1bSAtYyAtXG51bnppcCAtcSAvdG1wL3NvbmFyLXNjYW5uZXIuemlwIC1kIC90bXBcbmVjaG8gXCIvdG1wL3NvbmFyLXNjYW5uZXItJHtTT05BUl9TQ0FOTkVSX1ZFUlNJT059LWxpbnV4LXg2NC9iaW5cIiA+PiBcIiRHSVRIVUJfUEFUSFwiXG5gLFxuICAgICAgICB9LFxuICAgICAgICB7XG4gICAgICAgICAgbmFtZTogJ1NjYW4nLFxuICAgICAgICAgIHJ1bjogYHNvbmFyLXNjYW5uZXIgXFxcXFxuICAtRHNvbmFyLmhvc3QudXJsPSR7b3B0aW9ucy5zb25hckhvc3RVcmx9IFxcXFxcbiAgLURzb25hci5wcm9qZWN0S2V5PSR7c2NvcGUubmFtZX0gXFxcXFxuICAtRHNvbmFyLnByb2plY3RWZXJzaW9uPVwiJChnaXQgZGVzY3JpYmUgLS10YWdzIC0tYWx3YXlzKVwiIFxcXFxcbiAgLURzb25hci5pbmNsdXNpb25zPS5naXRodWIvd29ya2Zsb3dzLyoqLGFjdGlvbi55bWwsKiovKi5zaCBcXFxcXG4gIC1Ec29uYXIucXVhbGl0eWdhdGUud2FpdD10cnVlYCxcbiAgICAgICAgfSxcbiAgICAgIF0sXG4gICAgfSk7XG4gIH1cbn1cbiJdfQ==

package/lib/actions/github-action-project.d.ts

@@ -0,0 +1,60 @@
+import { github, release } from 'projen';
+import { ActionBuildWorkflow } from './action-build-workflow';
+import { ActionDogfoodOptions, ActionDogfoodWorkflow } from './action-dogfood-workflow';
+import { ActionSonarWorkflow } from './action-sonar-workflow';
+export interface GitHubActionProjectOptions extends github.GitHubProjectOptions {
+    /**
+     * One-line description of the action. Used in the default README
+     * template and recorded in the private `package.json`.
+     */
+    readonly description?: string;
+    /**
+     * Name of the GitHub Actions secret holding the PAT used for
+     * projen-automation PR comments (F003/F009) and, when the action has a
+     * `token` input, the dogfood's invocation of it.
+     * @default "PROJEN_GITHUB_TOKEN"
+     */
+    readonly gheTokenSecret?: string;
+    /**
+     * URL of the org's self-hosted SonarQube instance. MUST be reachable from
+     * github.com-hosted (public) runners (AD-001). Required, no default: a
+     * guessed server is worse than a loud failure.
+     */
+    readonly sonarHostUrl: string;
+    /** @default "SONAR_TOKEN" */
+    readonly sonarTokenSecret?: string;
+    /**
+     * Whether `sonar.yml` also runs on `pull_request` as a pass/fail gate.
+     * @default true
+     */
+    readonly sonarPullRequestGate?: boolean;
+    /**
+     * The dogfood scenario (AD-001). What fixture state, what to assert, and
+     * how to clean up are specified by the action's own F### spec - the
+     * highest-risk behavior of that action. Required: a default no-op
+     * dogfood would silently hollow out a load-bearing AD-001 workflow.
+     */
+    readonly dogfood: ActionDogfoodOptions;
+    /**
+     * SPDX identifier for the generated `LICENSE`.
+     * @default "MIT"
+     */
+    readonly license?: string;
+}
+/**
+ * Scaffolds the repo lifecycle (AD-001) around a hand-committed, composite
+ * (shell) GitHub Action: the `build`/`test-dogfood`/`sonar`/`release`
+ * workflows, versioning and release discipline, the F003 verify components,
+ * the F009 allowlist guard, and repo boilerplate (a private version-source
+ * `package.json`, `.yamllint`, `LICENSE`, and a `README.md` template). The
+ * action's own content
+ * (`action.yml`, its shell scripts, `test/` fixtures) is authored by hand
+ * per the action's own F### spec - this type only lints it.
+ */
+export declare class GitHubActionProject extends github.GitHubProject {
+    readonly buildWorkflow: ActionBuildWorkflow;
+    readonly dogfoodWorkflow: ActionDogfoodWorkflow;
+    readonly sonarWorkflow: ActionSonarWorkflow;
+    readonly release: release.Release;
+    constructor(options: GitHubActionProjectOptions);
+}