@xpertss/projen-types 0.0.1 → 0.0.3

package/lib/actions/github-action-project.js

@@ -0,0 +1,157 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GitHubActionProject = void 0;
+const JSII_RTTI_SYMBOL_1 = Symbol.for("jsii.rtti");
+const projen_1 = require("projen");
+const action_build_workflow_1 = require("./action-build-workflow");
+const action_dogfood_workflow_1 = require("./action-dogfood-workflow");
+const action_sonar_workflow_1 = require("./action-sonar-workflow");
+const actions_allowlist_guard_1 = require("../common/actions-allowlist-guard");
+const constants_1 = require("../common/constants");
+const internal_actions_1 = require("../common/internal-actions");
+const projen_drift_check_workflow_1 = require("../common/projen-drift-check-workflow");
+const workflow_change_notice_workflow_1 = require("../common/workflow-change-notice-workflow");
+// `require('projen/package.json')`/`require('../../package.json')` resolve
+// via Node's normal module resolution, so in a *published* package these
+// read the versions actually installed in the consuming repo's
+// node_modules - exactly the "PROJEN_VERSION of the synth" / "version of
+// this package that scaffolded the repo" the private package.json's
+// devDependencies need to pin (see F010 CI-dependencies section).
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const PROJEN_VERSION = require('projen/package.json').version;
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const PROJEN_TYPES_VERSION = require('../../package.json').version;
+// Exact pin, recorded as a component constant (AD-001: no latest/moving
+// tag/semver range in anything a generated repo depends on). Upgrading this
+// is a reviewed diff of this file.
+const COMMIT_AND_TAG_VERSION = '13.2.1';
+function defaultReadmeContents(options) {
+    return `# ${options.name}
+
+${options.description ?? ''}
+
+## Usage
+
+\`\`\`yaml
+- uses: xpertss/${options.name}@<ref>
+\`\`\`
+
+## Bumping
+
+A \`feat:\`/\`fix:\` commit pushed to \`main\` is released automatically: bump,
+tag \`vX.Y.Z\`, GitHub Release. See \`.github/workflows/release.yml\`.
+
+## Trust contract
+
+This is a composite (shell) action - no Node/npm at runtime, no Docker. Its
+CI lint gate (\`build.yml\`), dogfood test (\`test-dogfood.yml\`), and Sonar
+scan (\`sonar.yml\`) are scaffolded by \`@xpertss/projen-types\`'
+\`GitHubActionProject\`; only \`action.yml\` and its shell scripts are
+hand-committed.
+`;
+}
+/**
+ * Scaffolds the repo lifecycle (AD-001) around a hand-committed, composite
+ * (shell) GitHub Action: the `build`/`test-dogfood`/`sonar`/`release`
+ * workflows, versioning and release discipline, the F003 verify components,
+ * the F009 allowlist guard, and repo boilerplate (a private version-source
+ * `package.json`, `.yamllint`, `LICENSE`, and a `README.md` template). The
+ * action's own content
+ * (`action.yml`, its shell scripts, `test/` fixtures) is authored by hand
+ * per the action's own F### spec - this type only lints it.
+ */
+class GitHubActionProject extends projen_1.github.GitHubProject {
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@xpertss/projen-types.GitHubActionProject", version: "0.0.3" };
+    buildWorkflow;
+    dogfoodWorkflow;
+    sonarWorkflow;
+    release;
+    constructor(options) {
+        if (!options.sonarHostUrl) {
+            throw new Error('GitHubActionProject requires sonarHostUrl');
+        }
+        if (!options.dogfood?.scenario || options.dogfood.scenario.length === 0) {
+            throw new Error('GitHubActionProject requires dogfood.scenario with at least one step');
+        }
+        if (!options.dogfood.cleanup || options.dogfood.cleanup.length === 0) {
+            throw new Error('GitHubActionProject requires dogfood.cleanup');
+        }
+        super({
+            ...options,
+            readme: options.readme ?? { contents: defaultReadmeContents(options) },
+        });
+        const gh = this.github;
+        if (!gh) {
+            throw new Error('GitHubActionProject requires GitHub integration to be enabled');
+        }
+        (0, internal_actions_1.applyInternalActionOverrides)(gh);
+        new projen_drift_check_workflow_1.ProjenDriftCheckWorkflow(this, {
+            gheTokenSecret: options.gheTokenSecret ?? constants_1.DEFAULT_GHE_TOKEN_SECRET,
+        });
+        new workflow_change_notice_workflow_1.WorkflowChangeNoticeWorkflow(this);
+        new actions_allowlist_guard_1.ActionsAllowlistGuard(this);
+        new projen_1.License(this, {
+            spdx: options.license ?? 'MIT',
+            copyrightOwner: 'xpertss',
+        });
+        // Wires the default task to run `.projenrc.js` via plain `node` - a
+        // bare GitHubProject has no default task that does this on its own.
+        // Deliberately plain JS, not TS: a `.projenrc.ts` here would need
+        // `ts-node`/`typescript` pinned to a mutually-compatible version before
+        // the *first* synth can ever run (chicken-and-egg - `npx projen` can't
+        // bootstrap a `default` task that doesn't exist yet), and this package
+        // can't ship that pin for consumers (jsii's package-info check rejects
+        // non-jsii `dependencies` unless bundled, and `typescript` must stay a
+        // devDependency of *this* repo to build it, so it can never be bundled).
+        // This action has no real TypeScript source anyway (action.yml/
+        // auto-commit.sh are hand-written shell/YAML), so there's nothing lost.
+        new projen_1.javascript.Projenrc(this);
+        new projen_1.JsonFile(this, 'package.json', {
+            obj: {
+                name: options.name,
+                version: '0.0.0',
+                private: true,
+                description: options.description,
+                devDependencies: {
+                    'projen': PROJEN_VERSION,
+                    '@xpertss/projen-types': PROJEN_TYPES_VERSION,
+                    'commit-and-tag-version': COMMIT_AND_TAG_VERSION,
+                },
+            },
+        });
+        new projen_1.YamlFile(this, '.yamllint', {
+            obj: {
+                extends: 'default',
+                rules: { 'line-length': { max: 120 } },
+            },
+        });
+        this.buildWorkflow = new action_build_workflow_1.ActionBuildWorkflow(this);
+        this.dogfoodWorkflow = new action_dogfood_workflow_1.ActionDogfoodWorkflow(this, options.dogfood);
+        this.sonarWorkflow = new action_sonar_workflow_1.ActionSonarWorkflow(this, {
+            sonarHostUrl: options.sonarHostUrl,
+            sonarTokenSecret: options.sonarTokenSecret,
+            sonarPullRequestGate: options.sonarPullRequestGate,
+        });
+        // `githubRelease` defaults to true, which auto-wires
+        // `publishToGitHubReleases` - its `gh release create ... --target
+        // $GITHUB_SHA` creates the tag *and* the release together for our
+        // continuous (push-to-main) trigger. No separate `publishToGit` call
+        // needed (that path only fires for a manual release trigger).
+        this.release = new projen_1.release.Release(this, {
+            branch: 'main',
+            // No build artifact for a composite action (AD-001) - this is only
+            // where Release stages its own version/changelog files.
+            artifactsDirectory: 'dist',
+            tasks: [this.buildWorkflow.task],
+            versionFile: 'package.json',
+            releasableCommits: projen_1.ReleasableCommits.featuresAndFixes(),
+            releaseTrigger: projen_1.release.ReleaseTrigger.continuous(),
+            bumpPackage: `commit-and-tag-version@${COMMIT_AND_TAG_VERSION}`,
+            releaseWorkflowSetupSteps: [
+                { name: 'Install dependencies', run: 'npm ci' },
+            ],
+        });
+    }
+}
+exports.GitHubActionProject = GitHubActionProject;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZ2l0aHViLWFjdGlvbi1wcm9qZWN0LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL2FjdGlvbnMvZ2l0aHViLWFjdGlvbi1wcm9qZWN0LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7Ozs7QUFBQSxtQ0FRZ0I7QUFDaEIsbUVBQThEO0FBQzlELHVFQUF3RjtBQUN4RixtRUFBOEQ7QUFDOUQsK0VBQTBFO0FBQzFFLG1EQUErRDtBQUMvRCxpRUFBMEU7QUFDMUUsdUZBQWlGO0FBQ2pGLCtGQUF5RjtBQUV6RiwyRUFBMkU7QUFDM0UseUVBQXlFO0FBQ3pFLCtEQUErRDtBQUMvRCx5RUFBeUU7QUFDekUsb0VBQW9FO0FBQ3BFLGtFQUFrRTtBQUNsRSxpRUFBaUU7QUFDakUsTUFBTSxjQUFjLEdBQVcsT0FBTyxDQUFDLHFCQUFxQixDQUFDLENBQUMsT0FBTyxDQUFDO0FBQ3RFLGlFQUFpRTtBQUNqRSxNQUFNLG9CQUFvQixHQUFXLE9BQU8sQ0FBQyxvQkFBb0IsQ0FBQyxDQUFDLE9BQU8sQ0FBQztBQUUzRSx3RUFBd0U7QUFDeEUsNEVBQTRFO0FBQzVFLG1DQUFtQztBQUNuQyxNQUFNLHNCQUFzQixHQUFHLFFBQVEsQ0FBQztBQWlEeEMsU0FBUyxxQkFBcUIsQ0FBQyxPQUFtQztJQUNoRSxPQUFPLEtBQUssT0FBTyxDQUFDLElBQUk7O0VBRXhCLE9BQU8sQ0FBQyxXQUFXLElBQUksRUFBRTs7Ozs7a0JBS1QsT0FBTyxDQUFDLElBQUk7Ozs7Ozs7Ozs7Ozs7OztDQWU3QixDQUFDO0FBQ0YsQ0FBQztBQUVEOzs7Ozs7Ozs7R0FTRztBQUNILE1BQWEsbUJBQW9CLFNBQVEsZUFBTSxDQUFDLGFBQWE7O0lBQzNDLGFBQWEsQ0FBc0I7SUFDbkMsZUFBZSxDQUF3QjtJQUN2QyxhQUFhLENBQXNCO0lBQ25DLE9BQU8sQ0FBa0I7SUFFekMsWUFBWSxPQUFtQztRQUM3QyxJQUFJLENBQUMsT0FBTyxDQUFDLFlBQVksRUFBRSxDQUFDO1lBQzFCLE1BQU0sSUFBSSxLQUFLLENBQUMsMkNBQTJDLENBQUMsQ0FBQztRQUMvRCxDQUFDO1FBQ0QsSUFBSSxDQUFDLE9BQU8sQ0FBQyxPQUFPLEVBQUUsUUFBUSxJQUFJLE9BQU8sQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLE1BQU0sS0FBSyxDQUFDLEVBQUUsQ0FBQztZQUN4RSxNQUFNLElBQUksS0FBSyxDQUNiLHNFQUFzRSxDQUN2RSxDQUFDO1FBQ0osQ0FBQztRQUNELElBQUksQ0FBQyxPQUFPLENBQUMsT0FBTyxDQUFDLE9BQU8sSUFBSSxPQUFPLENBQUMsT0FBTyxDQUFDLE9BQU8sQ0FBQyxNQUFNLEtBQUssQ0FBQyxFQUFFLENBQUM7WUFDckUsTUFBTSxJQUFJLEtBQUssQ0FBQyw4Q0FBOEMsQ0FBQyxDQUFDO1FBQ2xFLENBQUM7UUFFRCxLQUFLLENBQUM7WUFDSixHQUFHLE9BQU87WUFDVixNQUFNLEVBQUUsT0FBTyxDQUFDLE1BQU0sSUFBSSxFQUFFLFFBQVEsRUFBRSxxQkFBcUIsQ0FBQyxPQUFPLENBQUMsRUFBRTtTQUN2RSxDQUFDLENBQUM7UUFFSCxNQUFNLEVBQUUsR0FBRyxJQUFJLENBQUMsTUFBTSxDQUFDO1FBQ3ZCLElBQUksQ0FBQyxFQUFFLEVBQUUsQ0FBQztZQUNSLE1BQU0sSUFBSSxLQUFLLENBQ2IsK0RBQStELENBQ2hFLENBQUM7UUFDSixDQUFDO1FBQ0QsSUFBQSwrQ0FBNEIsRUFBQyxFQUFFLENBQUMsQ0FBQztRQUVqQyxJQUFJLHNEQUF3QixDQUFDLElBQUksRUFBRTtZQUNqQyxjQUFjLEVBQUUsT0FBTyxDQUFDLGNBQWMsSUFBSSxvQ0FBd0I7U0FDbkUsQ0FBQyxDQUFDO1FBQ0gsSUFBSSw4REFBNEIsQ0FBQyxJQUFJLENBQUMsQ0FBQztRQUN2QyxJQUFJLCtDQUFxQixDQUFDLElBQUksQ0FBQyxDQUFDO1FBRWhDLElBQUksZ0JBQU8sQ0FBQyxJQUFJLEVBQUU7WUFDaEIsSUFBSSxFQUFFLE9BQU8sQ0FBQyxPQUFPLElBQUksS0FBSztZQUM5QixjQUFjLEVBQUUsU0FBUztTQUMxQixDQUFDLENBQUM7UUFFSCxvRUFBb0U7UUFDcEUsb0VBQW9FO1FBQ3BFLGtFQUFrRTtRQUNsRSx3RUFBd0U7UUFDeEUsdUVBQXVFO1FBQ3ZFLHVFQUF1RTtRQUN2RSx1RUFBdUU7UUFDdkUsdUVBQXVFO1FBQ3ZFLHlFQUF5RTtRQUN6RSxnRUFBZ0U7UUFDaEUsd0VBQXdFO1FBQ3hFLElBQUksbUJBQVUsQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLENBQUM7UUFFOUIsSUFBSSxpQkFBUSxDQUFDLElBQUksRUFBRSxjQUFjLEVBQUU7WUFDakMsR0FBRyxFQUFFO2dCQUNILElBQUksRUFBRSxPQUFPLENBQUMsSUFBSTtnQkFDbEIsT0FBTyxFQUFFLE9BQU87Z0JBQ2hCLE9BQU8sRUFBRSxJQUFJO2dCQUNiLFdBQVcsRUFBRSxPQUFPLENBQUMsV0FBVztnQkFDaEMsZUFBZSxFQUFFO29CQUNmLFFBQVEsRUFBRSxjQUFjO29CQUN4Qix1QkFBdUIsRUFBRSxvQkFBb0I7b0JBQzdDLHdCQUF3QixFQUFFLHNCQUFzQjtpQkFDakQ7YUFDRjtTQUNGLENBQUMsQ0FBQztRQUVILElBQUksaUJBQVEsQ0FBQyxJQUFJLEVBQUUsV0FBVyxFQUFFO1lBQzlCLEdBQUcsRUFBRTtnQkFDSCxPQUFPLEVBQUUsU0FBUztnQkFDbEIsS0FBSyxFQUFFLEVBQUUsYUFBYSxFQUFFLEVBQUUsR0FBRyxFQUFFLEdBQUcsRUFBRSxFQUFFO2FBQ3ZDO1NBQ0YsQ0FBQyxDQUFDO1FBRUgsSUFBSSxDQUFDLGFBQWEsR0FBRyxJQUFJLDJDQUFtQixDQUFDLElBQUksQ0FBQyxDQUFDO1FBRW5ELElBQUksQ0FBQyxlQUFlLEdBQUcsSUFBSSwrQ0FBcUIsQ0FBQyxJQUFJLEVBQUUsT0FBTyxDQUFDLE9BQU8sQ0FBQyxDQUFDO1FBRXhFLElBQUksQ0FBQyxhQUFhLEdBQUcsSUFBSSwyQ0FBbUIsQ0FBQyxJQUFJLEVBQUU7WUFDakQsWUFBWSxFQUFFLE9BQU8sQ0FBQyxZQUFZO1lBQ2xDLGdCQUFnQixFQUFFLE9BQU8sQ0FBQyxnQkFBZ0I7WUFDMUMsb0JBQW9CLEVBQUUsT0FBTyxDQUFDLG9CQUFvQjtTQUNuRCxDQUFDLENBQUM7UUFFSCxxREFBcUQ7UUFDckQsa0VBQWtFO1FBQ2xFLGtFQUFrRTtRQUNsRSxxRUFBcUU7UUFDckUsOERBQThEO1FBQzlELElBQUksQ0FBQyxPQUFPLEdBQUcsSUFBSSxnQkFBTyxDQUFDLE9BQU8sQ0FBQyxJQUFJLEVBQUU7WUFDdkMsTUFBTSxFQUFFLE1BQU07WUFDZCxtRUFBbUU7WUFDbkUsd0RBQXdEO1lBQ3hELGtCQUFrQixFQUFFLE1BQU07WUFDMUIsS0FBSyxFQUFFLENBQUMsSUFBSSxDQUFDLGFBQWEsQ0FBQyxJQUFJLENBQUM7WUFDaEMsV0FBVyxFQUFFLGNBQWM7WUFDM0IsaUJBQWlCLEVBQUUsMEJBQWlCLENBQUMsZ0JBQWdCLEVBQUU7WUFDdkQsY0FBYyxFQUFFLGdCQUFPLENBQUMsY0FBYyxDQUFDLFVBQVUsRUFBRTtZQUNuRCxXQUFXLEVBQUUsMEJBQTBCLHNCQUFzQixFQUFFO1lBQy9ELHlCQUF5QixFQUFFO2dCQUN6QixFQUFFLElBQUksRUFBRSxzQkFBc0IsRUFBRSxHQUFHLEVBQUUsUUFBUSxFQUFFO2FBQ2hEO1NBQ0YsQ0FBQyxDQUFDO0lBQ0wsQ0FBQzs7QUExR0gsa0RBMkdDIiwic291cmNlc0NvbnRlbnQiOlsiaW1wb3J0IHtcbiAgSnNvbkZpbGUsXG4gIExpY2Vuc2UsXG4gIFJlbGVhc2FibGVDb21taXRzLFxuICBZYW1sRmlsZSxcbiAgZ2l0aHViLFxuICBqYXZhc2NyaXB0LFxuICByZWxlYXNlLFxufSBmcm9tICdwcm9qZW4nO1xuaW1wb3J0IHsgQWN0aW9uQnVpbGRXb3JrZmxvdyB9IGZyb20gJy4vYWN0aW9uLWJ1aWxkLXdvcmtmbG93JztcbmltcG9ydCB7IEFjdGlvbkRvZ2Zvb2RPcHRpb25zLCBBY3Rpb25Eb2dmb29kV29ya2Zsb3cgfSBmcm9tICcuL2FjdGlvbi1kb2dmb29kLXdvcmtmbG93JztcbmltcG9ydCB7IEFjdGlvblNvbmFyV29ya2Zsb3cgfSBmcm9tICcuL2FjdGlvbi1zb25hci13b3JrZmxvdyc7XG5pbXBvcnQgeyBBY3Rpb25zQWxsb3dsaXN0R3VhcmQgfSBmcm9tICcuLi9jb21tb24vYWN0aW9ucy1hbGxvd2xpc3QtZ3VhcmQnO1xuaW1wb3J0IHsgREVGQVVMVF9HSEVfVE9LRU5fU0VDUkVUIH0gZnJvbSAnLi4vY29tbW9uL2NvbnN0YW50cyc7XG5pbXBvcnQgeyBhcHBseUludGVybmFsQWN0aW9uT3ZlcnJpZGVzIH0gZnJvbSAnLi4vY29tbW9uL2ludGVybmFsLWFjdGlvbnMnO1xuaW1wb3J0IHsgUHJvamVuRHJpZnRDaGVja1dvcmtmbG93IH0gZnJvbSAnLi4vY29tbW9uL3Byb2plbi1kcmlmdC1jaGVjay13b3JrZmxvdyc7XG5pbXBvcnQgeyBXb3JrZmxvd0NoYW5nZU5vdGljZVdvcmtmbG93IH0gZnJvbSAnLi4vY29tbW9uL3dvcmtmbG93LWNoYW5nZS1ub3RpY2Utd29ya2Zsb3cnO1xuXG4vLyBgcmVxdWlyZSgncHJvamVuL3BhY2thZ2UuanNvbicpYC9gcmVxdWlyZSgnLi4vLi4vcGFja2FnZS5qc29uJylgIHJlc29sdmVcbi8vIHZpYSBOb2RlJ3Mgbm9ybWFsIG1vZHVsZSByZXNvbHV0aW9uLCBzbyBpbiBhICpwdWJsaXNoZWQqIHBhY2thZ2UgdGhlc2Vcbi8vIHJlYWQgdGhlIHZlcnNpb25zIGFjdHVhbGx5IGluc3RhbGxlZCBpbiB0aGUgY29uc3VtaW5nIHJlcG8nc1xuLy8gbm9kZV9tb2R1bGVzIC0gZXhhY3RseSB0aGUgXCJQUk9KRU5fVkVSU0lPTiBvZiB0aGUgc3ludGhcIiAvIFwidmVyc2lvbiBvZlxuLy8gdGhpcyBwYWNrYWdlIHRoYXQgc2NhZmZvbGRlZCB0aGUgcmVwb1wiIHRoZSBwcml2YXRlIHBhY2thZ2UuanNvbidzXG4vLyBkZXZEZXBlbmRlbmNpZXMgbmVlZCB0byBwaW4gKHNlZSBGMDEwIENJLWRlcGVuZGVuY2llcyBzZWN0aW9uKS5cbi8vIGVzbGludC1kaXNhYmxlLW5leHQtbGluZSBAdHlwZXNjcmlwdC1lc2xpbnQvbm8tcmVxdWlyZS1pbXBvcnRzXG5jb25zdCBQUk9KRU5fVkVSU0lPTjogc3RyaW5nID0gcmVxdWlyZSgncHJvamVuL3BhY2thZ2UuanNvbicpLnZlcnNpb247XG4vLyBlc2xpbnQtZGlzYWJsZS1uZXh0LWxpbmUgQHR5cGVzY3JpcHQtZXNsaW50L25vLXJlcXVpcmUtaW1wb3J0c1xuY29uc3QgUFJPSkVOX1RZUEVTX1ZFUlNJT046IHN0cmluZyA9IHJlcXVpcmUoJy4uLy4uL3BhY2thZ2UuanNvbicpLnZlcnNpb247XG5cbi8vIEV4YWN0IHBpbiwgcmVjb3JkZWQgYXMgYSBjb21wb25lbnQgY29uc3RhbnQgKEFELTAwMTogbm8gbGF0ZXN0L21vdmluZ1xuLy8gdGFnL3NlbXZlciByYW5nZSBpbiBhbnl0aGluZyBhIGdlbmVyYXRlZCByZXBvIGRlcGVuZHMgb24pLiBVcGdyYWRpbmcgdGhpc1xuLy8gaXMgYSByZXZpZXdlZCBkaWZmIG9mIHRoaXMgZmlsZS5cbmNvbnN0IENPTU1JVF9BTkRfVEFHX1ZFUlNJT04gPSAnMTMuMi4xJztcblxuZXhwb3J0IGludGVyZmFjZSBHaXRIdWJBY3Rpb25Qcm9qZWN0T3B0aW9uc1xuICBleHRlbmRzIGdpdGh1Yi5HaXRIdWJQcm9qZWN0T3B0aW9ucyB7XG4gIC8qKlxuICAgKiBPbmUtbGluZSBkZXNjcmlwdGlvbiBvZiB0aGUgYWN0aW9uLiBVc2VkIGluIHRoZSBkZWZhdWx0IFJFQURNRVxuICAgKiB0ZW1wbGF0ZSBhbmQgcmVjb3JkZWQgaW4gdGhlIHByaXZhdGUgYHBhY2thZ2UuanNvbmAuXG4gICAqL1xuICByZWFkb25seSBkZXNjcmlwdGlvbj86IHN0cmluZztcblxuICAvKipcbiAgICogTmFtZSBvZiB0aGUgR2l0SHViIEFjdGlvbnMgc2VjcmV0IGhvbGRpbmcgdGhlIFBBVCB1c2VkIGZvclxuICAgKiBwcm9qZW4tYXV0b21hdGlvbiBQUiBjb21tZW50cyAoRjAwMy9GMDA5KSBhbmQsIHdoZW4gdGhlIGFjdGlvbiBoYXMgYVxuICAgKiBgdG9rZW5gIGlucHV0LCB0aGUgZG9nZm9vZCdzIGludm9jYXRpb24gb2YgaXQuXG4gICAqIEBkZWZhdWx0IFwiUFJPSkVOX0dJVEhVQl9UT0tFTlwiXG4gICAqL1xuICByZWFkb25seSBnaGVUb2tlblNlY3JldD86IHN0cmluZztcblxuICAvKipcbiAgICogVVJMIG9mIHRoZSBvcmcncyBzZWxmLWhvc3RlZCBTb25hclF1YmUgaW5zdGFuY2UuIE1VU1QgYmUgcmVhY2hhYmxlIGZyb21cbiAgICogZ2l0aHViLmNvbS1ob3N0ZWQgKHB1YmxpYykgcnVubmVycyAoQUQtMDAxKS4gUmVxdWlyZWQsIG5vIGRlZmF1bHQ6IGFcbiAgICogZ3Vlc3NlZCBzZXJ2ZXIgaXMgd29yc2UgdGhhbiBhIGxvdWQgZmFpbHVyZS5cbiAgICovXG4gIHJlYWRvbmx5IHNvbmFySG9zdFVybDogc3RyaW5nO1xuXG4gIC8qKiBAZGVmYXVsdCBcIlNPTkFSX1RPS0VOXCIgKi9cbiAgcmVhZG9ubHkgc29uYXJUb2tlblNlY3JldD86IHN0cmluZztcblxuICAvKipcbiAgICogV2hldGhlciBgc29uYXIueW1sYCBhbHNvIHJ1bnMgb24gYHB1bGxfcmVxdWVzdGAgYXMgYSBwYXNzL2ZhaWwgZ2F0ZS5cbiAgICogQGRlZmF1bHQgdHJ1ZVxuICAgKi9cbiAgcmVhZG9ubHkgc29uYXJQdWxsUmVxdWVzdEdhdGU/OiBib29sZWFuO1xuXG4gIC8qKlxuICAgKiBUaGUgZG9nZm9vZCBzY2VuYXJpbyAoQUQtMDAxKS4gV2hhdCBmaXh0dXJlIHN0YXRlLCB3aGF0IHRvIGFzc2VydCwgYW5kXG4gICAqIGhvdyB0byBjbGVhbiB1cCBhcmUgc3BlY2lmaWVkIGJ5IHRoZSBhY3Rpb24ncyBvd24gRiMjIyBzcGVjIC0gdGhlXG4gICAqIGhpZ2hlc3QtcmlzayBiZWhhdmlvciBvZiB0aGF0IGFjdGlvbi4gUmVxdWlyZWQ6IGEgZGVmYXVsdCBuby1vcFxuICAgKiBkb2dmb29kIHdvdWxkIHNpbGVudGx5IGhvbGxvdyBvdXQgYSBsb2FkLWJlYXJpbmcgQUQtMDAxIHdvcmtmbG93LlxuICAgKi9cbiAgcmVhZG9ubHkgZG9nZm9vZDogQWN0aW9uRG9nZm9vZE9wdGlvbnM7XG5cbiAgLyoqXG4gICAqIFNQRFggaWRlbnRpZmllciBmb3IgdGhlIGdlbmVyYXRlZCBgTElDRU5TRWAuXG4gICAqIEBkZWZhdWx0IFwiTUlUXCJcbiAgICovXG4gIHJlYWRvbmx5IGxpY2Vuc2U/OiBzdHJpbmc7XG59XG5cbmZ1bmN0aW9uIGRlZmF1bHRSZWFkbWVDb250ZW50cyhvcHRpb25zOiBHaXRIdWJBY3Rpb25Qcm9qZWN0T3B0aW9ucyk6IHN0cmluZyB7XG4gIHJldHVybiBgIyAke29wdGlvbnMubmFtZX1cblxuJHtvcHRpb25zLmRlc2NyaXB0aW9uID8/ICcnfVxuXG4jIyBVc2FnZVxuXG5cXGBcXGBcXGB5YW1sXG4tIHVzZXM6IHhwZXJ0c3MvJHtvcHRpb25zLm5hbWV9QDxyZWY+XG5cXGBcXGBcXGBcblxuIyMgQnVtcGluZ1xuXG5BIFxcYGZlYXQ6XFxgL1xcYGZpeDpcXGAgY29tbWl0IHB1c2hlZCB0byBcXGBtYWluXFxgIGlzIHJlbGVhc2VkIGF1dG9tYXRpY2FsbHk6IGJ1bXAsXG50YWcgXFxgdlguWS5aXFxgLCBHaXRIdWIgUmVsZWFzZS4gU2VlIFxcYC5naXRodWIvd29ya2Zsb3dzL3JlbGVhc2UueW1sXFxgLlxuXG4jIyBUcnVzdCBjb250cmFjdFxuXG5UaGlzIGlzIGEgY29tcG9zaXRlIChzaGVsbCkgYWN0aW9uIC0gbm8gTm9kZS9ucG0gYXQgcnVudGltZSwgbm8gRG9ja2VyLiBJdHNcbkNJIGxpbnQgZ2F0ZSAoXFxgYnVpbGQueW1sXFxgKSwgZG9nZm9vZCB0ZXN0IChcXGB0ZXN0LWRvZ2Zvb2QueW1sXFxgKSwgYW5kIFNvbmFyXG5zY2FuIChcXGBzb25hci55bWxcXGApIGFyZSBzY2FmZm9sZGVkIGJ5IFxcYEB4cGVydHNzL3Byb2plbi10eXBlc1xcYCdcblxcYEdpdEh1YkFjdGlvblByb2plY3RcXGA7IG9ubHkgXFxgYWN0aW9uLnltbFxcYCBhbmQgaXRzIHNoZWxsIHNjcmlwdHMgYXJlXG5oYW5kLWNvbW1pdHRlZC5cbmA7XG59XG5cbi8qKlxuICogU2NhZmZvbGRzIHRoZSByZXBvIGxpZmVjeWNsZSAoQUQtMDAxKSBhcm91bmQgYSBoYW5kLWNvbW1pdHRlZCwgY29tcG9zaXRlXG4gKiAoc2hlbGwpIEdpdEh1YiBBY3Rpb246IHRoZSBgYnVpbGRgL2B0ZXN0LWRvZ2Zvb2RgL2Bzb25hcmAvYHJlbGVhc2VgXG4gKiB3b3JrZmxvd3MsIHZlcnNpb25pbmcgYW5kIHJlbGVhc2UgZGlzY2lwbGluZSwgdGhlIEYwMDMgdmVyaWZ5IGNvbXBvbmVudHMsXG4gKiB0aGUgRjAwOSBhbGxvd2xpc3QgZ3VhcmQsIGFuZCByZXBvIGJvaWxlcnBsYXRlIChhIHByaXZhdGUgdmVyc2lvbi1zb3VyY2VcbiAqIGBwYWNrYWdlLmpzb25gLCBgLnlhbWxsaW50YCwgYExJQ0VOU0VgLCBhbmQgYSBgUkVBRE1FLm1kYCB0ZW1wbGF0ZSkuIFRoZVxuICogYWN0aW9uJ3Mgb3duIGNvbnRlbnRcbiAqIChgYWN0aW9uLnltbGAsIGl0cyBzaGVsbCBzY3JpcHRzLCBgdGVzdC9gIGZpeHR1cmVzKSBpcyBhdXRob3JlZCBieSBoYW5kXG4gKiBwZXIgdGhlIGFjdGlvbidzIG93biBGIyMjIHNwZWMgLSB0aGlzIHR5cGUgb25seSBsaW50cyBpdC5cbiAqL1xuZXhwb3J0IGNsYXNzIEdpdEh1YkFjdGlvblByb2plY3QgZXh0ZW5kcyBnaXRodWIuR2l0SHViUHJvamVjdCB7XG4gIHB1YmxpYyByZWFkb25seSBidWlsZFdvcmtmbG93OiBBY3Rpb25CdWlsZFdvcmtmbG93O1xuICBwdWJsaWMgcmVhZG9ubHkgZG9nZm9vZFdvcmtmbG93OiBBY3Rpb25Eb2dmb29kV29ya2Zsb3c7XG4gIHB1YmxpYyByZWFkb25seSBzb25hcldvcmtmbG93OiBBY3Rpb25Tb25hcldvcmtmbG93O1xuICBwdWJsaWMgcmVhZG9ubHkgcmVsZWFzZTogcmVsZWFzZS5SZWxlYXNlO1xuXG4gIGNvbnN0cnVjdG9yKG9wdGlvbnM6IEdpdEh1YkFjdGlvblByb2plY3RPcHRpb25zKSB7XG4gICAgaWYgKCFvcHRpb25zLnNvbmFySG9zdFVybCkge1xuICAgICAgdGhyb3cgbmV3IEVycm9yKCdHaXRIdWJBY3Rpb25Qcm9qZWN0IHJlcXVpcmVzIHNvbmFySG9zdFVybCcpO1xuICAgIH1cbiAgICBpZiAoIW9wdGlvbnMuZG9nZm9vZD8uc2NlbmFyaW8gfHwgb3B0aW9ucy5kb2dmb29kLnNjZW5hcmlvLmxlbmd0aCA9PT0gMCkge1xuICAgICAgdGhyb3cgbmV3IEVycm9yKFxuICAgICAgICAnR2l0SHViQWN0aW9uUHJvamVjdCByZXF1aXJlcyBkb2dmb29kLnNjZW5hcmlvIHdpdGggYXQgbGVhc3Qgb25lIHN0ZXAnLFxuICAgICAgKTtcbiAgICB9XG4gICAgaWYgKCFvcHRpb25zLmRvZ2Zvb2QuY2xlYW51cCB8fCBvcHRpb25zLmRvZ2Zvb2QuY2xlYW51cC5sZW5ndGggPT09IDApIHtcbiAgICAgIHRocm93IG5ldyBFcnJvcignR2l0SHViQWN0aW9uUHJvamVjdCByZXF1aXJlcyBkb2dmb29kLmNsZWFudXAnKTtcbiAgICB9XG5cbiAgICBzdXBlcih7XG4gICAgICAuLi5vcHRpb25zLFxuICAgICAgcmVhZG1lOiBvcHRpb25zLnJlYWRtZSA/PyB7IGNvbnRlbnRzOiBkZWZhdWx0UmVhZG1lQ29udGVudHMob3B0aW9ucykgfSxcbiAgICB9KTtcblxuICAgIGNvbnN0IGdoID0gdGhpcy5naXRodWI7XG4gICAgaWYgKCFnaCkge1xuICAgICAgdGhyb3cgbmV3IEVycm9yKFxuICAgICAgICAnR2l0SHViQWN0aW9uUHJvamVjdCByZXF1aXJlcyBHaXRIdWIgaW50ZWdyYXRpb24gdG8gYmUgZW5hYmxlZCcsXG4gICAgICApO1xuICAgIH1cbiAgICBhcHBseUludGVybmFsQWN0aW9uT3ZlcnJpZGVzKGdoKTtcblxuICAgIG5ldyBQcm9qZW5EcmlmdENoZWNrV29ya2Zsb3codGhpcywge1xuICAgICAgZ2hlVG9rZW5TZWNyZXQ6IG9wdGlvbnMuZ2hlVG9rZW5TZWNyZXQgPz8gREVGQVVMVF9HSEVfVE9LRU5fU0VDUkVULFxuICAgIH0pO1xuICAgIG5ldyBXb3JrZmxvd0NoYW5nZU5vdGljZVdvcmtmbG93KHRoaXMpO1xuICAgIG5ldyBBY3Rpb25zQWxsb3dsaXN0R3VhcmQodGhpcyk7XG5cbiAgICBuZXcgTGljZW5zZSh0aGlzLCB7XG4gICAgICBzcGR4OiBvcHRpb25zLmxpY2Vuc2UgPz8gJ01JVCcsXG4gICAgICBjb3B5cmlnaHRPd25lcjogJ3hwZXJ0c3MnLFxuICAgIH0pO1xuXG4gICAgLy8gV2lyZXMgdGhlIGRlZmF1bHQgdGFzayB0byBydW4gYC5wcm9qZW5yYy5qc2AgdmlhIHBsYWluIGBub2RlYCAtIGFcbiAgICAvLyBiYXJlIEdpdEh1YlByb2plY3QgaGFzIG5vIGRlZmF1bHQgdGFzayB0aGF0IGRvZXMgdGhpcyBvbiBpdHMgb3duLlxuICAgIC8vIERlbGliZXJhdGVseSBwbGFpbiBKUywgbm90IFRTOiBhIGAucHJvamVucmMudHNgIGhlcmUgd291bGQgbmVlZFxuICAgIC8vIGB0cy1ub2RlYC9gdHlwZXNjcmlwdGAgcGlubmVkIHRvIGEgbXV0dWFsbHktY29tcGF0aWJsZSB2ZXJzaW9uIGJlZm9yZVxuICAgIC8vIHRoZSAqZmlyc3QqIHN5bnRoIGNhbiBldmVyIHJ1biAoY2hpY2tlbi1hbmQtZWdnIC0gYG5weCBwcm9qZW5gIGNhbid0XG4gICAgLy8gYm9vdHN0cmFwIGEgYGRlZmF1bHRgIHRhc2sgdGhhdCBkb2Vzbid0IGV4aXN0IHlldCksIGFuZCB0aGlzIHBhY2thZ2VcbiAgICAvLyBjYW4ndCBzaGlwIHRoYXQgcGluIGZvciBjb25zdW1lcnMgKGpzaWkncyBwYWNrYWdlLWluZm8gY2hlY2sgcmVqZWN0c1xuICAgIC8vIG5vbi1qc2lpIGBkZXBlbmRlbmNpZXNgIHVubGVzcyBidW5kbGVkLCBhbmQgYHR5cGVzY3JpcHRgIG11c3Qgc3RheSBhXG4gICAgLy8gZGV2RGVwZW5kZW5jeSBvZiAqdGhpcyogcmVwbyB0byBidWlsZCBpdCwgc28gaXQgY2FuIG5ldmVyIGJlIGJ1bmRsZWQpLlxuICAgIC8vIFRoaXMgYWN0aW9uIGhhcyBubyByZWFsIFR5cGVTY3JpcHQgc291cmNlIGFueXdheSAoYWN0aW9uLnltbC9cbiAgICAvLyBhdXRvLWNvbW1pdC5zaCBhcmUgaGFuZC13cml0dGVuIHNoZWxsL1lBTUwpLCBzbyB0aGVyZSdzIG5vdGhpbmcgbG9zdC5cbiAgICBuZXcgamF2YXNjcmlwdC5Qcm9qZW5yYyh0aGlzKTtcblxuICAgIG5ldyBKc29uRmlsZSh0aGlzLCAncGFja2FnZS5qc29uJywge1xuICAgICAgb2JqOiB7XG4gICAgICAgIG5hbWU6IG9wdGlvbnMubmFtZSxcbiAgICAgICAgdmVyc2lvbjogJzAuMC4wJyxcbiAgICAgICAgcHJpdmF0ZTogdHJ1ZSxcbiAgICAgICAgZGVzY3JpcHRpb246IG9wdGlvbnMuZGVzY3JpcHRpb24sXG4gICAgICAgIGRldkRlcGVuZGVuY2llczoge1xuICAgICAgICAgICdwcm9qZW4nOiBQUk9KRU5fVkVSU0lPTixcbiAgICAgICAgICAnQHhwZXJ0c3MvcHJvamVuLXR5cGVzJzogUFJPSkVOX1RZUEVTX1ZFUlNJT04sXG4gICAgICAgICAgJ2NvbW1pdC1hbmQtdGFnLXZlcnNpb24nOiBDT01NSVRfQU5EX1RBR19WRVJTSU9OLFxuICAgICAgICB9LFxuICAgICAgfSxcbiAgICB9KTtcblxuICAgIG5ldyBZYW1sRmlsZSh0aGlzLCAnLnlhbWxsaW50Jywge1xuICAgICAgb2JqOiB7XG4gICAgICAgIGV4dGVuZHM6ICdkZWZhdWx0JyxcbiAgICAgICAgcnVsZXM6IHsgJ2xpbmUtbGVuZ3RoJzogeyBtYXg6IDEyMCB9IH0sXG4gICAgICB9LFxuICAgIH0pO1xuXG4gICAgdGhpcy5idWlsZFdvcmtmbG93ID0gbmV3IEFjdGlvbkJ1aWxkV29ya2Zsb3codGhpcyk7XG5cbiAgICB0aGlzLmRvZ2Zvb2RXb3JrZmxvdyA9IG5ldyBBY3Rpb25Eb2dmb29kV29ya2Zsb3codGhpcywgb3B0aW9ucy5kb2dmb29kKTtcblxuICAgIHRoaXMuc29uYXJXb3JrZmxvdyA9IG5ldyBBY3Rpb25Tb25hcldvcmtmbG93KHRoaXMsIHtcbiAgICAgIHNvbmFySG9zdFVybDogb3B0aW9ucy5zb25hckhvc3RVcmwsXG4gICAgICBzb25hclRva2VuU2VjcmV0OiBvcHRpb25zLnNvbmFyVG9rZW5TZWNyZXQsXG4gICAgICBzb25hclB1bGxSZXF1ZXN0R2F0ZTogb3B0aW9ucy5zb25hclB1bGxSZXF1ZXN0R2F0ZSxcbiAgICB9KTtcblxuICAgIC8vIGBnaXRodWJSZWxlYXNlYCBkZWZhdWx0cyB0byB0cnVlLCB3aGljaCBhdXRvLXdpcmVzXG4gICAgLy8gYHB1Ymxpc2hUb0dpdEh1YlJlbGVhc2VzYCAtIGl0cyBgZ2ggcmVsZWFzZSBjcmVhdGUgLi4uIC0tdGFyZ2V0XG4gICAgLy8gJEdJVEhVQl9TSEFgIGNyZWF0ZXMgdGhlIHRhZyAqYW5kKiB0aGUgcmVsZWFzZSB0b2dldGhlciBmb3Igb3VyXG4gICAgLy8gY29udGludW91cyAocHVzaC10by1tYWluKSB0cmlnZ2VyLiBObyBzZXBhcmF0ZSBgcHVibGlzaFRvR2l0YCBjYWxsXG4gICAgLy8gbmVlZGVkICh0aGF0IHBhdGggb25seSBmaXJlcyBmb3IgYSBtYW51YWwgcmVsZWFzZSB0cmlnZ2VyKS5cbiAgICB0aGlzLnJlbGVhc2UgPSBuZXcgcmVsZWFzZS5SZWxlYXNlKHRoaXMsIHtcbiAgICAgIGJyYW5jaDogJ21haW4nLFxuICAgICAgLy8gTm8gYnVpbGQgYXJ0aWZhY3QgZm9yIGEgY29tcG9zaXRlIGFjdGlvbiAoQUQtMDAxKSAtIHRoaXMgaXMgb25seVxuICAgICAgLy8gd2hlcmUgUmVsZWFzZSBzdGFnZXMgaXRzIG93biB2ZXJzaW9uL2NoYW5nZWxvZyBmaWxlcy5cbiAgICAgIGFydGlmYWN0c0RpcmVjdG9yeTogJ2Rpc3QnLFxuICAgICAgdGFza3M6IFt0aGlzLmJ1aWxkV29ya2Zsb3cudGFza10sXG4gICAgICB2ZXJzaW9uRmlsZTogJ3BhY2thZ2UuanNvbicsXG4gICAgICByZWxlYXNhYmxlQ29tbWl0czogUmVsZWFzYWJsZUNvbW1pdHMuZmVhdHVyZXNBbmRGaXhlcygpLFxuICAgICAgcmVsZWFzZVRyaWdnZXI6IHJlbGVhc2UuUmVsZWFzZVRyaWdnZXIuY29udGludW91cygpLFxuICAgICAgYnVtcFBhY2thZ2U6IGBjb21taXQtYW5kLXRhZy12ZXJzaW9uQCR7Q09NTUlUX0FORF9UQUdfVkVSU0lPTn1gLFxuICAgICAgcmVsZWFzZVdvcmtmbG93U2V0dXBTdGVwczogW1xuICAgICAgICB7IG5hbWU6ICdJbnN0YWxsIGRlcGVuZGVuY2llcycsIHJ1bjogJ25wbSBjaScgfSxcbiAgICAgIF0sXG4gICAgfSk7XG4gIH1cbn1cbiJdfQ==

package/lib/cdk/app-runtime-scaffold.js

@@ -8,7 +8,7 @@ const projen_1 = require("projen");
  * layered on top of `CdkTypescriptProject`'s pure-infra scaffold.
  */
 class AppRuntimeScaffold extends projen_1.Component {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "@xpertss/projen-types.AppRuntimeScaffold", version: "0.0.1" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@xpertss/projen-types.AppRuntimeScaffold", version: "0.0.3" };
     constructor(project, appEntryPoint = 'src/app.ts') {
         super(project, 'AppRuntimeScaffold');
         const app = new projen_1.SourceCode(project, appEntryPoint);

package/lib/cdk/cdk-app-project.js

@@ -6,14 +6,13 @@ const projen_1 = require("projen");
 const app_runtime_scaffold_1 = require("./app-runtime-scaffold");
 const cdk_infra_project_1 = require("./cdk-infra-project");
 const database_component_1 = require("./database-component");
-const drift_check_1 = require("../common/drift-check");
 /**
  * Full TypeScript service application running behind API Gateway (or
  * similar), with the infra to support it - `CdkInfraProject` plus
  * application source, a database, and an app-level build/test workflow.
  */
 class CdkAppProject extends cdk_infra_project_1.CdkInfraProject {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "@xpertss/projen-types.CdkAppProject", version: "0.0.1" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@xpertss/projen-types.CdkAppProject", version: "0.0.3" };
     constructor(options) {
         super(options);
         new app_runtime_scaffold_1.AppRuntimeScaffold(this, options.appEntryPoint ?? 'src/app.ts');
@@ -26,10 +25,9 @@ class CdkAppProject extends cdk_infra_project_1.CdkInfraProject {
                 task: this.testTask,
                 triggers: { pullRequest: {}, workflowDispatch: {} },
                 permissions: { contents: projen_1.github.workflows.JobPermission.READ },
-                postBuildSteps: (0, drift_check_1.driftCheckSteps)(),
             });
         }
     }
 }
 exports.CdkAppProject = CdkAppProject;
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2RrLWFwcC1wcm9qZWN0LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL2Nkay9jZGstYXBwLXByb2plY3QudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7OztBQUFBLG1DQUFnQztBQUNoQyxpRUFBNEQ7QUFDNUQsMkRBQXNEO0FBQ3RELDZEQUF5RDtBQUV6RCx1REFBd0Q7QUFFeEQ7Ozs7R0FJRztBQUNILE1BQWEsYUFBYyxTQUFRLG1DQUFlOztJQUNoRCxZQUFZLE9BQTZCO1FBQ3ZDLEtBQUssQ0FBQyxPQUFPLENBQUMsQ0FBQztRQUVmLElBQUkseUNBQWtCLENBQUMsSUFBSSxFQUFFLE9BQU8sQ0FBQyxhQUFhLElBQUksWUFBWSxDQUFDLENBQUM7UUFDcEUsSUFBSSxzQ0FBaUIsQ0FBQyxJQUFJLEVBQUUsT0FBTyxDQUFDLFFBQVEsQ0FBQyxDQUFDO1FBRTlDLE1BQU0sRUFBRSxHQUFHLElBQUksQ0FBQyxNQUFNLENBQUM7UUFDdkIsSUFBSSxFQUFFLEVBQUUsQ0FBQztZQUNQLElBQUksZUFBTSxDQUFDLFlBQVksQ0FBQyxFQUFFLEVBQUU7Z0JBQzFCLElBQUksRUFBRSxXQUFXO2dCQUNqQixLQUFLLEVBQUUsV0FBVztnQkFDbEIsSUFBSSxFQUFFLElBQUksQ0FBQyxRQUFRO2dCQUNuQixRQUFRLEVBQUUsRUFBRSxXQUFXLEVBQUUsRUFBRSxFQUFFLGdCQUFnQixFQUFFLEVBQUUsRUFBRTtnQkFDbkQsV0FBVyxFQUFFLEVBQUUsUUFBUSxFQUFFLGVBQU0sQ0FBQyxTQUFTLENBQUMsYUFBYSxDQUFDLElBQUksRUFBRTtnQkFDOUQsY0FBYyxFQUFFLElBQUEsNkJBQWUsR0FBRTthQUNsQyxDQUFDLENBQUM7UUFDTCxDQUFDO0lBQ0gsQ0FBQzs7QUFsQkgsc0NBbUJDIiwic291cmNlc0NvbnRlbnQiOlsiaW1wb3J0IHsgZ2l0aHViIH0gZnJvbSAncHJvamVuJztcbmltcG9ydCB7IEFwcFJ1bnRpbWVTY2FmZm9sZCB9IGZyb20gJy4vYXBwLXJ1bnRpbWUtc2NhZmZvbGQnO1xuaW1wb3J0IHsgQ2RrSW5mcmFQcm9qZWN0IH0gZnJvbSAnLi9jZGstaW5mcmEtcHJvamVjdCc7XG5pbXBvcnQgeyBEYXRhYmFzZUNvbXBvbmVudCB9IGZyb20gJy4vZGF0YWJhc2UtY29tcG9uZW50JztcbmltcG9ydCB7IENka0FwcFByb2plY3RPcHRpb25zIH0gZnJvbSAnLi9vcHRpb25zJztcbmltcG9ydCB7IGRyaWZ0Q2hlY2tTdGVwcyB9IGZyb20gJy4uL2NvbW1vbi9kcmlmdC1jaGVjayc7XG5cbi8qKlxuICogRnVsbCBUeXBlU2NyaXB0IHNlcnZpY2UgYXBwbGljYXRpb24gcnVubmluZyBiZWhpbmQgQVBJIEdhdGV3YXkgKG9yXG4gKiBzaW1pbGFyKSwgd2l0aCB0aGUgaW5mcmEgdG8gc3VwcG9ydCBpdCAtIGBDZGtJbmZyYVByb2plY3RgIHBsdXNcbiAqIGFwcGxpY2F0aW9uIHNvdXJjZSwgYSBkYXRhYmFzZSwgYW5kIGFuIGFwcC1sZXZlbCBidWlsZC90ZXN0IHdvcmtmbG93LlxuICovXG5leHBvcnQgY2xhc3MgQ2RrQXBwUHJvamVjdCBleHRlbmRzIENka0luZnJhUHJvamVjdCB7XG4gIGNvbnN0cnVjdG9yKG9wdGlvbnM6IENka0FwcFByb2plY3RPcHRpb25zKSB7XG4gICAgc3VwZXIob3B0aW9ucyk7XG5cbiAgICBuZXcgQXBwUnVudGltZVNjYWZmb2xkKHRoaXMsIG9wdGlvbnMuYXBwRW50cnlQb2ludCA/PyAnc3JjL2FwcC50cycpO1xuICAgIG5ldyBEYXRhYmFzZUNvbXBvbmVudCh0aGlzLCBvcHRpb25zLmRhdGFiYXNlKTtcblxuICAgIGNvbnN0IGdoID0gdGhpcy5naXRodWI7XG4gICAgaWYgKGdoKSB7XG4gICAgICBuZXcgZ2l0aHViLlRhc2tXb3JrZmxvdyhnaCwge1xuICAgICAgICBuYW1lOiAnYXBwLWJ1aWxkJyxcbiAgICAgICAgam9iSWQ6ICdhcHAtYnVpbGQnLFxuICAgICAgICB0YXNrOiB0aGlzLnRlc3RUYXNrLFxuICAgICAgICB0cmlnZ2VyczogeyBwdWxsUmVxdWVzdDoge30sIHdvcmtmbG93RGlzcGF0Y2g6IHt9IH0sXG4gICAgICAgIHBlcm1pc3Npb25zOiB7IGNvbnRlbnRzOiBnaXRodWIud29ya2Zsb3dzLkpvYlBlcm1pc3Npb24uUkVBRCB9LFxuICAgICAgICBwb3N0QnVpbGRTdGVwczogZHJpZnRDaGVja1N0ZXBzKCksXG4gICAgICB9KTtcbiAgICB9XG4gIH1cbn1cbiJdfQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2RrLWFwcC1wcm9qZWN0LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL2Nkay9jZGstYXBwLXByb2plY3QudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7OztBQUFBLG1DQUFnQztBQUNoQyxpRUFBNEQ7QUFDNUQsMkRBQXNEO0FBQ3RELDZEQUF5RDtBQUd6RDs7OztHQUlHO0FBQ0gsTUFBYSxhQUFjLFNBQVEsbUNBQWU7O0lBQ2hELFlBQVksT0FBNkI7UUFDdkMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxDQUFDO1FBRWYsSUFBSSx5Q0FBa0IsQ0FBQyxJQUFJLEVBQUUsT0FBTyxDQUFDLGFBQWEsSUFBSSxZQUFZLENBQUMsQ0FBQztRQUNwRSxJQUFJLHNDQUFpQixDQUFDLElBQUksRUFBRSxPQUFPLENBQUMsUUFBUSxDQUFDLENBQUM7UUFFOUMsTUFBTSxFQUFFLEdBQUcsSUFBSSxDQUFDLE1BQU0sQ0FBQztRQUN2QixJQUFJLEVBQUUsRUFBRSxDQUFDO1lBQ1AsSUFBSSxlQUFNLENBQUMsWUFBWSxDQUFDLEVBQUUsRUFBRTtnQkFDMUIsSUFBSSxFQUFFLFdBQVc7Z0JBQ2pCLEtBQUssRUFBRSxXQUFXO2dCQUNsQixJQUFJLEVBQUUsSUFBSSxDQUFDLFFBQVE7Z0JBQ25CLFFBQVEsRUFBRSxFQUFFLFdBQVcsRUFBRSxFQUFFLEVBQUUsZ0JBQWdCLEVBQUUsRUFBRSxFQUFFO2dCQUNuRCxXQUFXLEVBQUUsRUFBRSxRQUFRLEVBQUUsZUFBTSxDQUFDLFNBQVMsQ0FBQyxhQUFhLENBQUMsSUFBSSxFQUFFO2FBQy9ELENBQUMsQ0FBQztRQUNMLENBQUM7SUFDSCxDQUFDOztBQWpCSCxzQ0FrQkMiLCJzb3VyY2VzQ29udGVudCI6WyJpbXBvcnQgeyBnaXRodWIgfSBmcm9tICdwcm9qZW4nO1xuaW1wb3J0IHsgQXBwUnVudGltZVNjYWZmb2xkIH0gZnJvbSAnLi9hcHAtcnVudGltZS1zY2FmZm9sZCc7XG5pbXBvcnQgeyBDZGtJbmZyYVByb2plY3QgfSBmcm9tICcuL2Nkay1pbmZyYS1wcm9qZWN0JztcbmltcG9ydCB7IERhdGFiYXNlQ29tcG9uZW50IH0gZnJvbSAnLi9kYXRhYmFzZS1jb21wb25lbnQnO1xuaW1wb3J0IHsgQ2RrQXBwUHJvamVjdE9wdGlvbnMgfSBmcm9tICcuL29wdGlvbnMnO1xuXG4vKipcbiAqIEZ1bGwgVHlwZVNjcmlwdCBzZXJ2aWNlIGFwcGxpY2F0aW9uIHJ1bm5pbmcgYmVoaW5kIEFQSSBHYXRld2F5IChvclxuICogc2ltaWxhciksIHdpdGggdGhlIGluZnJhIHRvIHN1cHBvcnQgaXQgLSBgQ2RrSW5mcmFQcm9qZWN0YCBwbHVzXG4gKiBhcHBsaWNhdGlvbiBzb3VyY2UsIGEgZGF0YWJhc2UsIGFuZCBhbiBhcHAtbGV2ZWwgYnVpbGQvdGVzdCB3b3JrZmxvdy5cbiAqL1xuZXhwb3J0IGNsYXNzIENka0FwcFByb2plY3QgZXh0ZW5kcyBDZGtJbmZyYVByb2plY3Qge1xuICBjb25zdHJ1Y3RvcihvcHRpb25zOiBDZGtBcHBQcm9qZWN0T3B0aW9ucykge1xuICAgIHN1cGVyKG9wdGlvbnMpO1xuXG4gICAgbmV3IEFwcFJ1bnRpbWVTY2FmZm9sZCh0aGlzLCBvcHRpb25zLmFwcEVudHJ5UG9pbnQgPz8gJ3NyYy9hcHAudHMnKTtcbiAgICBuZXcgRGF0YWJhc2VDb21wb25lbnQodGhpcywgb3B0aW9ucy5kYXRhYmFzZSk7XG5cbiAgICBjb25zdCBnaCA9IHRoaXMuZ2l0aHViO1xuICAgIGlmIChnaCkge1xuICAgICAgbmV3IGdpdGh1Yi5UYXNrV29ya2Zsb3coZ2gsIHtcbiAgICAgICAgbmFtZTogJ2FwcC1idWlsZCcsXG4gICAgICAgIGpvYklkOiAnYXBwLWJ1aWxkJyxcbiAgICAgICAgdGFzazogdGhpcy50ZXN0VGFzayxcbiAgICAgICAgdHJpZ2dlcnM6IHsgcHVsbFJlcXVlc3Q6IHt9LCB3b3JrZmxvd0Rpc3BhdGNoOiB7fSB9LFxuICAgICAgICBwZXJtaXNzaW9uczogeyBjb250ZW50czogZ2l0aHViLndvcmtmbG93cy5Kb2JQZXJtaXNzaW9uLlJFQUQgfSxcbiAgICAgIH0pO1xuICAgIH1cbiAgfVxufVxuIl19

package/lib/cdk/cdk-infra-project.js

@@ -11,7 +11,7 @@ const edge_networking_constructs_1 = require("./components/edge-networking-const
  * externally-built images). Reference example: SimulcastAVDelivery.
  */
 class CdkInfraProject extends cdk_typescript_base_1.CdkTypescriptProject {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "@xpertss/projen-types.CdkInfraProject", version: "0.0.1" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@xpertss/projen-types.CdkInfraProject", version: "0.0.3" };
     constructor(options) {
         super(options);
         if (options.ecrEcs?.enabled) {

package/lib/cdk/cdk-typescript-base.js

@@ -3,8 +3,12 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.CdkTypescriptProject = void 0;
 const JSII_RTTI_SYMBOL_1 = Symbol.for("jsii.rtti");
 const projen_1 = require("projen");
+const actions_allowlist_guard_1 = require("../common/actions-allowlist-guard");
 const constants_1 = require("../common/constants");
+const internal_actions_1 = require("../common/internal-actions");
 const manual_deploy_workflow_1 = require("../common/manual-deploy-workflow");
+const projen_drift_check_workflow_1 = require("../common/projen-drift-check-workflow");
+const workflow_change_notice_workflow_1 = require("../common/workflow-change-notice-workflow");
 /**
  * Shared CDK + TypeScript foundation for `CdkInfraProject` and
  * `CdkAppProject`: standard app structure (via `AwsCdkTypeScriptApp`,
@@ -13,7 +17,7 @@ const manual_deploy_workflow_1 = require("../common/manual-deploy-workflow");
  * `ManualDeployWorkflow` when `environments` is provided.
  */
 class CdkTypescriptProject extends projen_1.awscdk.AwsCdkTypeScriptApp {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "@xpertss/projen-types.CdkTypescriptProject", version: "0.0.1" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@xpertss/projen-types.CdkTypescriptProject", version: "0.0.3" };
     constructor(options) {
         super({
             name: options.name,
@@ -27,10 +31,19 @@ class CdkTypescriptProject extends projen_1.awscdk.AwsCdkTypeScriptApp {
             }),
         });
         this.addDevDeps('esbuild');
+        const gh = this.github;
+        if (!gh) {
+            throw new Error('CdkTypescriptProject requires GitHub integration to be enabled');
+        }
+        (0, internal_actions_1.applyInternalActionOverrides)(gh);
+        new projen_drift_check_workflow_1.ProjenDriftCheckWorkflow(this, {
+            gheTokenSecret: options.gheTokenSecret ?? constants_1.DEFAULT_GHE_TOKEN_SECRET,
+        });
+        new workflow_change_notice_workflow_1.WorkflowChangeNoticeWorkflow(this);
+        new actions_allowlist_guard_1.ActionsAllowlistGuard(this);
         if (options.environments && options.environments.length > 0) {
             new manual_deploy_workflow_1.ManualDeployWorkflow(this, {
                 environments: options.environments,
-                slackWebhookSecret: options.slackWebhookSecret,
                 deploySteps: (env) => [
                     {
                         name: 'Install',
@@ -50,4 +63,4 @@ class CdkTypescriptProject extends projen_1.awscdk.AwsCdkTypeScriptApp {
     }
 }
 exports.CdkTypescriptProject = CdkTypescriptProject;
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2RrLXR5cGVzY3JpcHQtYmFzZS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9jZGsvY2RrLXR5cGVzY3JpcHQtYmFzZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7O0FBQUEsbUNBQXdDO0FBRXhDLG1EQUErRDtBQUUvRCw2RUFBd0U7QUFNeEU7Ozs7OztHQU1HO0FBQ0gsTUFBYSxvQkFBcUIsU0FBUSxlQUFNLENBQUMsbUJBQW1COztJQUNsRSxZQUFZLE9BQW9DO1FBQzlDLEtBQUssQ0FBQztZQUNKLElBQUksRUFBRSxPQUFPLENBQUMsSUFBSTtZQUNsQixVQUFVLEVBQUUsT0FBTyxDQUFDLFVBQVUsSUFBSSxTQUFTO1lBQzNDLG9CQUFvQixFQUFFLE1BQU07WUFDNUIsVUFBVSxFQUFFLElBQUk7WUFDaEIsc0VBQXNFO1lBQ3RFLG9CQUFvQixFQUFFLEVBQUUsWUFBWSxFQUFFLEtBQUssRUFBRTtZQUM3QyxpQkFBaUIsRUFBRSxlQUFNLENBQUMsaUJBQWlCLENBQUMsdUJBQXVCLENBQUM7Z0JBQ2xFLE1BQU0sRUFBRSxPQUFPLENBQUMsY0FBYyxJQUFJLG9DQUF3QjthQUMzRCxDQUFDO1NBQ0gsQ0FBQyxDQUFDO1FBRUgsSUFBSSxDQUFDLFVBQVUsQ0FBQyxTQUFTLENBQUMsQ0FBQztRQUUzQixJQUFJLE9BQU8sQ0FBQyxZQUFZLElBQUksT0FBTyxDQUFDLFlBQVksQ0FBQyxNQUFNLEdBQUcsQ0FBQyxFQUFFLENBQUM7WUFDNUQsSUFBSSw2Q0FBb0IsQ0FBQyxJQUFJLEVBQUU7Z0JBQzdCLFlBQVksRUFBRSxPQUFPLENBQUMsWUFBWTtnQkFDbEMsa0JBQWtCLEVBQUUsT0FBTyxDQUFDLGtCQUFrQjtnQkFDOUMsV0FBVyxFQUFFLENBQUMsR0FBRyxFQUFFLEVBQUUsQ0FBQztvQkFDcEI7d0JBQ0UsSUFBSSxFQUFFLFNBQVM7d0JBQ2YsR0FBRyxFQUFFLFFBQVE7cUJBQ2Q7b0JBQ0Q7d0JBQ0UsSUFBSSxFQUFFLGVBQWUsR0FBRyxDQUFDLElBQUksR0FBRzt3QkFDaEMsR0FBRyxFQUFFLHVFQUF1RSxHQUFHLENBQUMsSUFBSSxFQUFFO3dCQUN0RixHQUFHLEVBQUU7NEJBQ0gsR0FBRyxDQUFDLEdBQUcsQ0FBQyxTQUFTLENBQUMsQ0FBQyxDQUFDLEVBQUUsbUJBQW1CLEVBQUUsR0FBRyxDQUFDLFNBQVMsRUFBRSxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUM7NEJBQ2hFLEdBQUcsQ0FBQyxHQUFHLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQyxFQUFFLGtCQUFrQixFQUFFLEdBQUcsQ0FBQyxNQUFNLEVBQUUsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDO3lCQUMxRDtxQkFDRjtpQkFDRjthQUNGLENBQUMsQ0FBQztRQUNMLENBQUM7SUFDSCxDQUFDOztBQXBDSCxvREFxQ0MiLCJzb3VyY2VzQ29udGVudCI6WyJpbXBvcnQgeyBhd3NjZGssIGdpdGh1YiB9IGZyb20gJ3Byb2plbic7XG5pbXBvcnQgeyBDb21tb25DZGtPcHRpb25zIH0gZnJvbSAnLi9vcHRpb25zJztcbmltcG9ydCB7IERFRkFVTFRfR0hFX1RPS0VOX1NFQ1JFVCB9IGZyb20gJy4uL2NvbW1vbi9jb25zdGFudHMnO1xuaW1wb3J0IHsgRW52aXJvbm1lbnRPcHRpb25zIH0gZnJvbSAnLi4vY29tbW9uL2Vudmlyb25tZW50LW9wdGlvbnMnO1xuaW1wb3J0IHsgTWFudWFsRGVwbG95V29ya2Zsb3cgfSBmcm9tICcuLi9jb21tb24vbWFudWFsLWRlcGxveS13b3JrZmxvdyc7XG5cbmV4cG9ydCBpbnRlcmZhY2UgQ2RrVHlwZXNjcmlwdFByb2plY3RPcHRpb25zIGV4dGVuZHMgQ29tbW9uQ2RrT3B0aW9ucyB7XG4gIHJlYWRvbmx5IGVudmlyb25tZW50cz86IChzdHJpbmcgfCBFbnZpcm9ubWVudE9wdGlvbnMpW107XG59XG5cbi8qKlxuICogU2hhcmVkIENESyArIFR5cGVTY3JpcHQgZm91bmRhdGlvbiBmb3IgYENka0luZnJhUHJvamVjdGAgYW5kXG4gKiBgQ2RrQXBwUHJvamVjdGA6IHN0YW5kYXJkIGFwcCBzdHJ1Y3R1cmUgKHZpYSBgQXdzQ2RrVHlwZVNjcmlwdEFwcGAsXG4gKiBgY2RrLmpzb25gLCBgY2RrIHN5bnRoYC9gY2RrIGRpZmZgIHRhc2tzKSwgYSBQUi1jaGVjayBidWlsZCB0aGF0IGhhcmQtZmFpbHNcbiAqIG9uIHByb2plbiBkcmlmdCAocmF0aGVyIHRoYW4gc2VsZi1tdXRhdGluZyksIGFuZCBhbiBvcHRpb25hbFxuICogYE1hbnVhbERlcGxveVdvcmtmbG93YCB3aGVuIGBlbnZpcm9ubWVudHNgIGlzIHByb3ZpZGVkLlxuICovXG5leHBvcnQgY2xhc3MgQ2RrVHlwZXNjcmlwdFByb2plY3QgZXh0ZW5kcyBhd3NjZGsuQXdzQ2RrVHlwZVNjcmlwdEFwcCB7XG4gIGNvbnN0cnVjdG9yKG9wdGlvbnM6IENka1R5cGVzY3JpcHRQcm9qZWN0T3B0aW9ucykge1xuICAgIHN1cGVyKHtcbiAgICAgIG5hbWU6IG9wdGlvbnMubmFtZSxcbiAgICAgIGNka1ZlcnNpb246IG9wdGlvbnMuY2RrVmVyc2lvbiA/PyAnMi4xODkuMScsXG4gICAgICBkZWZhdWx0UmVsZWFzZUJyYW5jaDogJ21haW4nLFxuICAgICAgc2FtcGxlQ29kZTogdHJ1ZSxcbiAgICAgIC8vIEZhaWwgUFIgY2hlY2tzIG9uIGRyaWZ0IGluc3RlYWQgb2YgYXV0by1jb21taXR0aW5nIHByb2plbidzIG91dHB1dC5cbiAgICAgIGJ1aWxkV29ya2Zsb3dPcHRpb25zOiB7IG11dGFibGVCdWlsZDogZmFsc2UgfSxcbiAgICAgIHByb2plbkNyZWRlbnRpYWxzOiBnaXRodWIuR2l0aHViQ3JlZGVudGlhbHMuZnJvbVBlcnNvbmFsQWNjZXNzVG9rZW4oe1xuICAgICAgICBzZWNyZXQ6IG9wdGlvbnMuZ2hlVG9rZW5TZWNyZXQgPz8gREVGQVVMVF9HSEVfVE9LRU5fU0VDUkVULFxuICAgICAgfSksXG4gICAgfSk7XG5cbiAgICB0aGlzLmFkZERldkRlcHMoJ2VzYnVpbGQnKTtcblxuICAgIGlmIChvcHRpb25zLmVudmlyb25tZW50cyAmJiBvcHRpb25zLmVudmlyb25tZW50cy5sZW5ndGggPiAwKSB7XG4gICAgICBuZXcgTWFudWFsRGVwbG95V29ya2Zsb3codGhpcywge1xuICAgICAgICBlbnZpcm9ubWVudHM6IG9wdGlvbnMuZW52aXJvbm1lbnRzLFxuICAgICAgICBzbGFja1dlYmhvb2tTZWNyZXQ6IG9wdGlvbnMuc2xhY2tXZWJob29rU2VjcmV0LFxuICAgICAgICBkZXBsb3lTdGVwczogKGVudikgPT4gW1xuICAgICAgICAgIHtcbiAgICAgICAgICAgIG5hbWU6ICdJbnN0YWxsJyxcbiAgICAgICAgICAgIHJ1bjogJ25wbSBjaScsXG4gICAgICAgICAgfSxcbiAgICAgICAgICB7XG4gICAgICAgICAgICBuYW1lOiBgY2RrIGRlcGxveSAoJHtlbnYubmFtZX0pYCxcbiAgICAgICAgICAgIHJ1bjogYG5weCBjZGsgZGVwbG95IC0tYWxsIC0tcmVxdWlyZS1hcHByb3ZhbCBuZXZlciAtLWNvbnRleHQgZW52aXJvbm1lbnQ9JHtlbnYubmFtZX1gLFxuICAgICAgICAgICAgZW52OiB7XG4gICAgICAgICAgICAgIC4uLihlbnYuYWNjb3VudElkID8geyBDREtfREVGQVVMVF9BQ0NPVU5UOiBlbnYuYWNjb3VudElkIH0gOiB7fSksXG4gICAgICAgICAgICAgIC4uLihlbnYucmVnaW9uID8geyBDREtfREVGQVVMVF9SRUdJT046IGVudi5yZWdpb24gfSA6IHt9KSxcbiAgICAgICAgICAgIH0sXG4gICAgICAgICAgfSxcbiAgICAgICAgXSxcbiAgICAgIH0pO1xuICAgIH1cbiAgfVxufVxuIl19
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2RrLXR5cGVzY3JpcHQtYmFzZS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9jZGsvY2RrLXR5cGVzY3JpcHQtYmFzZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7O0FBQUEsbUNBQXdDO0FBRXhDLCtFQUEwRTtBQUMxRSxtREFBK0Q7QUFFL0QsaUVBQTBFO0FBQzFFLDZFQUF3RTtBQUN4RSx1RkFBaUY7QUFDakYsK0ZBQXlGO0FBTXpGOzs7Ozs7R0FNRztBQUNILE1BQWEsb0JBQXFCLFNBQVEsZUFBTSxDQUFDLG1CQUFtQjs7SUFDbEUsWUFBWSxPQUFvQztRQUM5QyxLQUFLLENBQUM7WUFDSixJQUFJLEVBQUUsT0FBTyxDQUFDLElBQUk7WUFDbEIsVUFBVSxFQUFFLE9BQU8sQ0FBQyxVQUFVLElBQUksU0FBUztZQUMzQyxvQkFBb0IsRUFBRSxNQUFNO1lBQzVCLFVBQVUsRUFBRSxJQUFJO1lBQ2hCLHNFQUFzRTtZQUN0RSxvQkFBb0IsRUFBRSxFQUFFLFlBQVksRUFBRSxLQUFLLEVBQUU7WUFDN0MsaUJBQWlCLEVBQUUsZUFBTSxDQUFDLGlCQUFpQixDQUFDLHVCQUF1QixDQUFDO2dCQUNsRSxNQUFNLEVBQUUsT0FBTyxDQUFDLGNBQWMsSUFBSSxvQ0FBd0I7YUFDM0QsQ0FBQztTQUNILENBQUMsQ0FBQztRQUVILElBQUksQ0FBQyxVQUFVLENBQUMsU0FBUyxDQUFDLENBQUM7UUFFM0IsTUFBTSxFQUFFLEdBQUcsSUFBSSxDQUFDLE1BQU0sQ0FBQztRQUN2QixJQUFJLENBQUMsRUFBRSxFQUFFLENBQUM7WUFDUixNQUFNLElBQUksS0FBSyxDQUNiLGdFQUFnRSxDQUNqRSxDQUFDO1FBQ0osQ0FBQztRQUNELElBQUEsK0NBQTRCLEVBQUMsRUFBRSxDQUFDLENBQUM7UUFFakMsSUFBSSxzREFBd0IsQ0FBQyxJQUFJLEVBQUU7WUFDakMsY0FBYyxFQUFFLE9BQU8sQ0FBQyxjQUFjLElBQUksb0NBQXdCO1NBQ25FLENBQUMsQ0FBQztRQUNILElBQUksOERBQTRCLENBQUMsSUFBSSxDQUFDLENBQUM7UUFDdkMsSUFBSSwrQ0FBcUIsQ0FBQyxJQUFJLENBQUMsQ0FBQztRQUVoQyxJQUFJLE9BQU8sQ0FBQyxZQUFZLElBQUksT0FBTyxDQUFDLFlBQVksQ0FBQyxNQUFNLEdBQUcsQ0FBQyxFQUFFLENBQUM7WUFDNUQsSUFBSSw2Q0FBb0IsQ0FBQyxJQUFJLEVBQUU7Z0JBQzdCLFlBQVksRUFBRSxPQUFPLENBQUMsWUFBWTtnQkFDbEMsV0FBVyxFQUFFLENBQUMsR0FBRyxFQUFFLEVBQUUsQ0FBQztvQkFDcEI7d0JBQ0UsSUFBSSxFQUFFLFNBQVM7d0JBQ2YsR0FBRyxFQUFFLFFBQVE7cUJBQ2Q7b0JBQ0Q7d0JBQ0UsSUFBSSxFQUFFLGVBQWUsR0FBRyxDQUFDLElBQUksR0FBRzt3QkFDaEMsR0FBRyxFQUFFLHVFQUF1RSxHQUFHLENBQUMsSUFBSSxFQUFFO3dCQUN0RixHQUFHLEVBQUU7NEJBQ0gsR0FBRyxDQUFDLEdBQUcsQ0FBQyxTQUFTLENBQUMsQ0FBQyxDQUFDLEVBQUUsbUJBQW1CLEVBQUUsR0FBRyxDQUFDLFNBQVMsRUFBRSxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUM7NEJBQ2hFLEdBQUcsQ0FBQyxHQUFHLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQyxFQUFFLGtCQUFrQixFQUFFLEdBQUcsQ0FBQyxNQUFNLEVBQUUsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDO3lCQUMxRDtxQkFDRjtpQkFDRjthQUNGLENBQUMsQ0FBQztRQUNMLENBQUM7SUFDSCxDQUFDOztBQWpESCxvREFrREMiLCJzb3VyY2VzQ29udGVudCI6WyJpbXBvcnQgeyBhd3NjZGssIGdpdGh1YiB9IGZyb20gJ3Byb2plbic7XG5pbXBvcnQgeyBDb21tb25DZGtPcHRpb25zIH0gZnJvbSAnLi9vcHRpb25zJztcbmltcG9ydCB7IEFjdGlvbnNBbGxvd2xpc3RHdWFyZCB9IGZyb20gJy4uL2NvbW1vbi9hY3Rpb25zLWFsbG93bGlzdC1ndWFyZCc7XG5pbXBvcnQgeyBERUZBVUxUX0dIRV9UT0tFTl9TRUNSRVQgfSBmcm9tICcuLi9jb21tb24vY29uc3RhbnRzJztcbmltcG9ydCB7IEVudmlyb25tZW50T3B0aW9ucyB9IGZyb20gJy4uL2NvbW1vbi9lbnZpcm9ubWVudC1vcHRpb25zJztcbmltcG9ydCB7IGFwcGx5SW50ZXJuYWxBY3Rpb25PdmVycmlkZXMgfSBmcm9tICcuLi9jb21tb24vaW50ZXJuYWwtYWN0aW9ucyc7XG5pbXBvcnQgeyBNYW51YWxEZXBsb3lXb3JrZmxvdyB9IGZyb20gJy4uL2NvbW1vbi9tYW51YWwtZGVwbG95LXdvcmtmbG93JztcbmltcG9ydCB7IFByb2plbkRyaWZ0Q2hlY2tXb3JrZmxvdyB9IGZyb20gJy4uL2NvbW1vbi9wcm9qZW4tZHJpZnQtY2hlY2std29ya2Zsb3cnO1xuaW1wb3J0IHsgV29ya2Zsb3dDaGFuZ2VOb3RpY2VXb3JrZmxvdyB9IGZyb20gJy4uL2NvbW1vbi93b3JrZmxvdy1jaGFuZ2Utbm90aWNlLXdvcmtmbG93JztcblxuZXhwb3J0IGludGVyZmFjZSBDZGtUeXBlc2NyaXB0UHJvamVjdE9wdGlvbnMgZXh0ZW5kcyBDb21tb25DZGtPcHRpb25zIHtcbiAgcmVhZG9ubHkgZW52aXJvbm1lbnRzPzogKHN0cmluZyB8IEVudmlyb25tZW50T3B0aW9ucylbXTtcbn1cblxuLyoqXG4gKiBTaGFyZWQgQ0RLICsgVHlwZVNjcmlwdCBmb3VuZGF0aW9uIGZvciBgQ2RrSW5mcmFQcm9qZWN0YCBhbmRcbiAqIGBDZGtBcHBQcm9qZWN0YDogc3RhbmRhcmQgYXBwIHN0cnVjdHVyZSAodmlhIGBBd3NDZGtUeXBlU2NyaXB0QXBwYCxcbiAqIGBjZGsuanNvbmAsIGBjZGsgc3ludGhgL2BjZGsgZGlmZmAgdGFza3MpLCBhIFBSLWNoZWNrIGJ1aWxkIHRoYXQgaGFyZC1mYWlsc1xuICogb24gcHJvamVuIGRyaWZ0IChyYXRoZXIgdGhhbiBzZWxmLW11dGF0aW5nKSwgYW5kIGFuIG9wdGlvbmFsXG4gKiBgTWFudWFsRGVwbG95V29ya2Zsb3dgIHdoZW4gYGVudmlyb25tZW50c2AgaXMgcHJvdmlkZWQuXG4gKi9cbmV4cG9ydCBjbGFzcyBDZGtUeXBlc2NyaXB0UHJvamVjdCBleHRlbmRzIGF3c2Nkay5Bd3NDZGtUeXBlU2NyaXB0QXBwIHtcbiAgY29uc3RydWN0b3Iob3B0aW9uczogQ2RrVHlwZXNjcmlwdFByb2plY3RPcHRpb25zKSB7XG4gICAgc3VwZXIoe1xuICAgICAgbmFtZTogb3B0aW9ucy5uYW1lLFxuICAgICAgY2RrVmVyc2lvbjogb3B0aW9ucy5jZGtWZXJzaW9uID8/ICcyLjE4OS4xJyxcbiAgICAgIGRlZmF1bHRSZWxlYXNlQnJhbmNoOiAnbWFpbicsXG4gICAgICBzYW1wbGVDb2RlOiB0cnVlLFxuICAgICAgLy8gRmFpbCBQUiBjaGVja3Mgb24gZHJpZnQgaW5zdGVhZCBvZiBhdXRvLWNvbW1pdHRpbmcgcHJvamVuJ3Mgb3V0cHV0LlxuICAgICAgYnVpbGRXb3JrZmxvd09wdGlvbnM6IHsgbXV0YWJsZUJ1aWxkOiBmYWxzZSB9LFxuICAgICAgcHJvamVuQ3JlZGVudGlhbHM6IGdpdGh1Yi5HaXRodWJDcmVkZW50aWFscy5mcm9tUGVyc29uYWxBY2Nlc3NUb2tlbih7XG4gICAgICAgIHNlY3JldDogb3B0aW9ucy5naGVUb2tlblNlY3JldCA/PyBERUZBVUxUX0dIRV9UT0tFTl9TRUNSRVQsXG4gICAgICB9KSxcbiAgICB9KTtcblxuICAgIHRoaXMuYWRkRGV2RGVwcygnZXNidWlsZCcpO1xuXG4gICAgY29uc3QgZ2ggPSB0aGlzLmdpdGh1YjtcbiAgICBpZiAoIWdoKSB7XG4gICAgICB0aHJvdyBuZXcgRXJyb3IoXG4gICAgICAgICdDZGtUeXBlc2NyaXB0UHJvamVjdCByZXF1aXJlcyBHaXRIdWIgaW50ZWdyYXRpb24gdG8gYmUgZW5hYmxlZCcsXG4gICAgICApO1xuICAgIH1cbiAgICBhcHBseUludGVybmFsQWN0aW9uT3ZlcnJpZGVzKGdoKTtcblxuICAgIG5ldyBQcm9qZW5EcmlmdENoZWNrV29ya2Zsb3codGhpcywge1xuICAgICAgZ2hlVG9rZW5TZWNyZXQ6IG9wdGlvbnMuZ2hlVG9rZW5TZWNyZXQgPz8gREVGQVVMVF9HSEVfVE9LRU5fU0VDUkVULFxuICAgIH0pO1xuICAgIG5ldyBXb3JrZmxvd0NoYW5nZU5vdGljZVdvcmtmbG93KHRoaXMpO1xuICAgIG5ldyBBY3Rpb25zQWxsb3dsaXN0R3VhcmQodGhpcyk7XG5cbiAgICBpZiAob3B0aW9ucy5lbnZpcm9ubWVudHMgJiYgb3B0aW9ucy5lbnZpcm9ubWVudHMubGVuZ3RoID4gMCkge1xuICAgICAgbmV3IE1hbnVhbERlcGxveVdvcmtmbG93KHRoaXMsIHtcbiAgICAgICAgZW52aXJvbm1lbnRzOiBvcHRpb25zLmVudmlyb25tZW50cyxcbiAgICAgICAgZGVwbG95U3RlcHM6IChlbnYpID0+IFtcbiAgICAgICAgICB7XG4gICAgICAgICAgICBuYW1lOiAnSW5zdGFsbCcsXG4gICAgICAgICAgICBydW46ICducG0gY2knLFxuICAgICAgICAgIH0sXG4gICAgICAgICAge1xuICAgICAgICAgICAgbmFtZTogYGNkayBkZXBsb3kgKCR7ZW52Lm5hbWV9KWAsXG4gICAgICAgICAgICBydW46IGBucHggY2RrIGRlcGxveSAtLWFsbCAtLXJlcXVpcmUtYXBwcm92YWwgbmV2ZXIgLS1jb250ZXh0IGVudmlyb25tZW50PSR7ZW52Lm5hbWV9YCxcbiAgICAgICAgICAgIGVudjoge1xuICAgICAgICAgICAgICAuLi4oZW52LmFjY291bnRJZCA/IHsgQ0RLX0RFRkFVTFRfQUNDT1VOVDogZW52LmFjY291bnRJZCB9IDoge30pLFxuICAgICAgICAgICAgICAuLi4oZW52LnJlZ2lvbiA/IHsgQ0RLX0RFRkFVTFRfUkVHSU9OOiBlbnYucmVnaW9uIH0gOiB7fSksXG4gICAgICAgICAgICB9LFxuICAgICAgICAgIH0sXG4gICAgICAgIF0sXG4gICAgICB9KTtcbiAgICB9XG4gIH1cbn1cbiJdfQ==

package/lib/cdk/components/ecr-ecs-constructs.js

@@ -10,7 +10,7 @@ const projen_1 = require("projen");
  * built from this project's own source (app projects).
  */
 class EcrEcsConstructs extends projen_1.Component {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "@xpertss/projen-types.EcrEcsConstructs", version: "0.0.1" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@xpertss/projen-types.EcrEcsConstructs", version: "0.0.3" };
     constructor(project, options = {}) {
         super(project, 'EcrEcsConstructs');
         const externalImageSource = options.externalImageSource ?? true;

package/lib/cdk/components/edge-networking-constructs.js

@@ -42,7 +42,7 @@ const HELPERS = {
  * to whichever `edgeResources` the consuming project type opts into.
  */
 class EdgeNetworkingConstructs extends projen_1.Component {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "@xpertss/projen-types.EdgeNetworkingConstructs", version: "0.0.1" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@xpertss/projen-types.EdgeNetworkingConstructs", version: "0.0.3" };
     constructor(project, resources) {
         super(project, 'EdgeNetworkingConstructs');
         if (resources.length === 0) {

package/lib/cdk/database-component.js

@@ -10,7 +10,7 @@ const projen_1 = require("projen");
  * the consuming team to wire up; no opinionated default is imposed.
  */
 class DatabaseComponent extends projen_1.Component {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "@xpertss/projen-types.DatabaseComponent", version: "0.0.1" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@xpertss/projen-types.DatabaseComponent", version: "0.0.3" };
     constructor(project, options = {}) {
         super(project, 'DatabaseComponent');
         const engine = options.engine ?? 'postgres';

package/lib/cdk/options.d.ts

@@ -17,8 +17,6 @@ export interface CommonCdkOptions {
     readonly cdkVersion?: string;
     /** @default "PROJEN_GITHUB_TOKEN" */
     readonly gheTokenSecret?: string;
-    /** GitHub secret holding a Slack webhook URL for deploy notifications. */
-    readonly slackWebhookSecret?: string;
 }
 export interface CdkInfraProjectOptions extends CommonCdkOptions {
     /** Deploy targets for the manual-dispatch deploy workflow, e.g. ["dev", "stage", "prod"]. */

package/lib/cdk/options.js

@@ -1,3 +1,3 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoib3B0aW9ucy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9jZGsvb3B0aW9ucy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiIiwic291cmNlc0NvbnRlbnQiOlsiaW1wb3J0IHsgRW52aXJvbm1lbnRPcHRpb25zIH0gZnJvbSAnLi4vY29tbW9uL2Vudmlyb25tZW50LW9wdGlvbnMnO1xuXG5leHBvcnQgdHlwZSBFZGdlUmVzb3VyY2UgPVxuICB8ICdjbG91ZGZyb250J1xuICB8ICdyb3V0ZTUzJ1xuICB8ICdhcGlnYXRld2F5J1xuICB8ICdjb2duaXRvJ1xuICB8ICdzcXMnO1xuXG5leHBvcnQgaW50ZXJmYWNlIEVjckVjc09wdGlvbnMge1xuICAvKiogQGRlZmF1bHQgZmFsc2UgKi9cbiAgcmVhZG9ubHkgZW5hYmxlZD86IGJvb2xlYW47XG5cbiAgLyoqXG4gICAqIFdoZXRoZXIgdGhlIEVDUyBzZXJ2aWNlIHN0YW5kcyB1cCBhbiBleHRlcm5hbGx5LWJ1aWx0IGltYWdlIChpbmZyYS1vbmx5KVxuICAgKiByYXRoZXIgdGhhbiBvbmUgYnVpbHQgZnJvbSB0aGlzIHByb2plY3QncyBvd24gc291cmNlLlxuICAgKlxuICAgKiBAZGVmYXVsdCB0cnVlXG4gICAqL1xuICByZWFkb25seSBleHRlcm5hbEltYWdlU291cmNlPzogYm9vbGVhbjtcbn1cblxuZXhwb3J0IGludGVyZmFjZSBDb21tb25DZGtPcHRpb25zIHtcbiAgcmVhZG9ubHkgbmFtZTogc3RyaW5nO1xuXG4gIC8qKiBAZGVmYXVsdCBcIjIuMTg5LjFcIiAqL1xuICByZWFkb25seSBjZGtWZXJzaW9uPzogc3RyaW5nO1xuXG4gIC8qKiBAZGVmYXVsdCBcIlBST0pFTl9HSVRIVUJfVE9LRU5cIiAqL1xuICByZWFkb25seSBnaGVUb2tlblNlY3JldD86IHN0cmluZztcblxuICAvKiogR2l0SHViIHNlY3JldCBob2xkaW5nIGEgU2xhY2sgd2ViaG9vayBVUkwgZm9yIGRlcGxveSBub3RpZmljYXRpb25zLiAqL1xuICByZWFkb25seSBzbGFja1dlYmhvb2tTZWNyZXQ/OiBzdHJpbmc7XG59XG5cbmV4cG9ydCBpbnRlcmZhY2UgQ2RrSW5mcmFQcm9qZWN0T3B0aW9ucyBleHRlbmRzIENvbW1vbkNka09wdGlvbnMge1xuICAvKiogRGVwbG95IHRhcmdldHMgZm9yIHRoZSBtYW51YWwtZGlzcGF0Y2ggZGVwbG95IHdvcmtmbG93LCBlLmcuIFtcImRldlwiLCBcInN0YWdlXCIsIFwicHJvZFwiXS4gKi9cbiAgcmVhZG9ubHkgZW52aXJvbm1lbnRzOiAoc3RyaW5nIHwgRW52aXJvbm1lbnRPcHRpb25zKVtdO1xuXG4gIHJlYWRvbmx5IGVjckVjcz86IEVjckVjc09wdGlvbnM7XG5cbiAgcmVhZG9ubHkgZWRnZVJlc291cmNlcz86IEVkZ2VSZXNvdXJjZVtdO1xufVxuXG5leHBvcnQgaW50ZXJmYWNlIERhdGFiYXNlT3B0aW9ucyB7XG4gIC8qKiBAZGVmYXVsdCBcInBvc3RncmVzXCIgKi9cbiAgcmVhZG9ubHkgZW5naW5lPzogJ3Bvc3RncmVzJyB8ICdteXNxbCcgfCAnZHluYW1vZGInO1xuXG4gIC8qKiBNaWdyYXRpb24gdG9vbCB0byB3aXJlIHVwLCBlLmcuIFwiZmx5d2F5XCIsIFwibGlxdWliYXNlXCIsIFwicHJpc21hXCIuIExlZnQgcGx1Z2dhYmxlIC0gbm8gZGVmYXVsdC4gKi9cbiAgcmVhZG9ubHkgbWlncmF0aW9uVG9vbD86IHN0cmluZztcbn1cblxuZXhwb3J0IGludGVyZmFjZSBDZGtBcHBQcm9qZWN0T3B0aW9ucyBleHRlbmRzIENka0luZnJhUHJvamVjdE9wdGlvbnMge1xuICByZWFkb25seSBkYXRhYmFzZT86IERhdGFiYXNlT3B0aW9ucztcblxuICAvKiogQGRlZmF1bHQgXCJzcmMvYXBwLnRzXCIgKi9cbiAgcmVhZG9ubHkgYXBwRW50cnlQb2ludD86IHN0cmluZztcbn1cbiJdfQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoib3B0aW9ucy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9jZGsvb3B0aW9ucy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiIiwic291cmNlc0NvbnRlbnQiOlsiaW1wb3J0IHsgRW52aXJvbm1lbnRPcHRpb25zIH0gZnJvbSAnLi4vY29tbW9uL2Vudmlyb25tZW50LW9wdGlvbnMnO1xuXG5leHBvcnQgdHlwZSBFZGdlUmVzb3VyY2UgPVxuICB8ICdjbG91ZGZyb250J1xuICB8ICdyb3V0ZTUzJ1xuICB8ICdhcGlnYXRld2F5J1xuICB8ICdjb2duaXRvJ1xuICB8ICdzcXMnO1xuXG5leHBvcnQgaW50ZXJmYWNlIEVjckVjc09wdGlvbnMge1xuICAvKiogQGRlZmF1bHQgZmFsc2UgKi9cbiAgcmVhZG9ubHkgZW5hYmxlZD86IGJvb2xlYW47XG5cbiAgLyoqXG4gICAqIFdoZXRoZXIgdGhlIEVDUyBzZXJ2aWNlIHN0YW5kcyB1cCBhbiBleHRlcm5hbGx5LWJ1aWx0IGltYWdlIChpbmZyYS1vbmx5KVxuICAgKiByYXRoZXIgdGhhbiBvbmUgYnVpbHQgZnJvbSB0aGlzIHByb2plY3QncyBvd24gc291cmNlLlxuICAgKlxuICAgKiBAZGVmYXVsdCB0cnVlXG4gICAqL1xuICByZWFkb25seSBleHRlcm5hbEltYWdlU291cmNlPzogYm9vbGVhbjtcbn1cblxuZXhwb3J0IGludGVyZmFjZSBDb21tb25DZGtPcHRpb25zIHtcbiAgcmVhZG9ubHkgbmFtZTogc3RyaW5nO1xuXG4gIC8qKiBAZGVmYXVsdCBcIjIuMTg5LjFcIiAqL1xuICByZWFkb25seSBjZGtWZXJzaW9uPzogc3RyaW5nO1xuXG4gIC8qKiBAZGVmYXVsdCBcIlBST0pFTl9HSVRIVUJfVE9LRU5cIiAqL1xuICByZWFkb25seSBnaGVUb2tlblNlY3JldD86IHN0cmluZztcbn1cblxuZXhwb3J0IGludGVyZmFjZSBDZGtJbmZyYVByb2plY3RPcHRpb25zIGV4dGVuZHMgQ29tbW9uQ2RrT3B0aW9ucyB7XG4gIC8qKiBEZXBsb3kgdGFyZ2V0cyBmb3IgdGhlIG1hbnVhbC1kaXNwYXRjaCBkZXBsb3kgd29ya2Zsb3csIGUuZy4gW1wiZGV2XCIsIFwic3RhZ2VcIiwgXCJwcm9kXCJdLiAqL1xuICByZWFkb25seSBlbnZpcm9ubWVudHM6IChzdHJpbmcgfCBFbnZpcm9ubWVudE9wdGlvbnMpW107XG5cbiAgcmVhZG9ubHkgZWNyRWNzPzogRWNyRWNzT3B0aW9ucztcblxuICByZWFkb25seSBlZGdlUmVzb3VyY2VzPzogRWRnZVJlc291cmNlW107XG59XG5cbmV4cG9ydCBpbnRlcmZhY2UgRGF0YWJhc2VPcHRpb25zIHtcbiAgLyoqIEBkZWZhdWx0IFwicG9zdGdyZXNcIiAqL1xuICByZWFkb25seSBlbmdpbmU/OiAncG9zdGdyZXMnIHwgJ215c3FsJyB8ICdkeW5hbW9kYic7XG5cbiAgLyoqIE1pZ3JhdGlvbiB0b29sIHRvIHdpcmUgdXAsIGUuZy4gXCJmbHl3YXlcIiwgXCJsaXF1aWJhc2VcIiwgXCJwcmlzbWFcIi4gTGVmdCBwbHVnZ2FibGUgLSBubyBkZWZhdWx0LiAqL1xuICByZWFkb25seSBtaWdyYXRpb25Ub29sPzogc3RyaW5nO1xufVxuXG5leHBvcnQgaW50ZXJmYWNlIENka0FwcFByb2plY3RPcHRpb25zIGV4dGVuZHMgQ2RrSW5mcmFQcm9qZWN0T3B0aW9ucyB7XG4gIHJlYWRvbmx5IGRhdGFiYXNlPzogRGF0YWJhc2VPcHRpb25zO1xuXG4gIC8qKiBAZGVmYXVsdCBcInNyYy9hcHAudHNcIiAqL1xuICByZWFkb25seSBhcHBFbnRyeVBvaW50Pzogc3RyaW5nO1xufVxuIl19

package/lib/common/actions-allowlist-guard.d.ts

@@ -0,0 +1,37 @@
+import { Component, github } from 'projen';
+/**
+ * Blocking, tamper-proof PR check that stops a disallowed GitHub Action
+ * reference from ever (re)appearing in a repo's workflow or composite-action
+ * files.
+ *
+ * Runs on `pull_request_target` so it always executes the copy of this
+ * workflow committed on the base branch - a PR cannot edit this file to
+ * disable or weaken the check. It checks out and executes nothing from the
+ * PR; it only reads the PR head's file content via the GitHub API. Because
+ * `pull_request_target` runs with the base repo's token even for
+ * fork-originated PRs, the failure comment posts reliably.
+ *
+  * It performs a flat, unconditional scan of the PR's head ref (no
+  * base-vs-head comparison): fetch the content of every GitHub workflow and
+  * composite-action file, extract every `uses:` value, and fail if any does
+  * not start with one of the three trusted namespaces from AD-001
+  * (`actions/`, `docker/`, `xpertss/`). The single
+ * exemption is a local same-repo reference (`uses: .` or
+ * `uses: ./.github/actions/<name>`) - the repo's own hand-committed action,
+ * to which the org policy's "allow select actions" setting does not apply.
+ */
+export interface ActionsAllowlistGuardOptions {
+    /**
+     * GitHub secret holding a token with permission to comment on PRs, used
+     * for the failure comment. The check still fails without it, so fork PRs -
+     * which get no secrets - are only missing the extra comment.
+     * @default "PROJEN_GITHUB_TOKEN"
+     */
+    readonly gheTokenSecret?: string;
+    /** @default "actions-allowlist-guard" */
+    readonly workflowName?: string;
+}
+export declare class ActionsAllowlistGuard extends Component {
+    readonly workflow: github.GithubWorkflow;
+    constructor(scope: github.GitHubProject, options?: ActionsAllowlistGuardOptions);
+}

package/lib/common/actions-allowlist-guard.js

@@ -0,0 +1,70 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ActionsAllowlistGuard = void 0;
+const JSII_RTTI_SYMBOL_1 = Symbol.for("jsii.rtti");
+const projen_1 = require("projen");
+const constants_1 = require("./constants");
+class ActionsAllowlistGuard extends projen_1.Component {
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@xpertss/projen-types.ActionsAllowlistGuard", version: "0.0.3" };
+    workflow;
+    constructor(scope, options = {}) {
+        super(scope, 'ActionsAllowlistGuard');
+        const gh = scope.github;
+        if (!gh) {
+            throw new Error('ActionsAllowlistGuard requires GitHub integration to be enabled');
+        }
+        const gheTokenSecret = options.gheTokenSecret ?? constants_1.DEFAULT_GHE_TOKEN_SECRET;
+        this.workflow = new projen_1.github.GithubWorkflow(gh, options.workflowName ?? 'actions-allowlist-guard');
+        this.workflow.on({ pullRequestTarget: {} });
+        this.workflow.addJob('check', {
+            runsOn: ['ubuntu-latest'],
+            permissions: {
+                contents: projen_1.github.workflows.JobPermission.READ,
+                pullRequests: projen_1.github.workflows.JobPermission.WRITE,
+            },
+            env: { GH_TOKEN: `\${{ secrets.${gheTokenSecret} }}` },
+            steps: [
+                {
+                    name: 'Enforce action allow-list',
+                    run: `set -uo pipefail
+head_sha="\${{ github.event.pull_request.head.sha }}"
+pr_number="\${{ github.event.number }}"
+repo="\${GITHUB_REPOSITORY}"
+# All files at the PR head (recursive tree), narrowed to workflow and
+# composite-action files.
+files="$(gh api "repos/$repo/git/trees/$head_sha?recursive=1" --jq '.tree[] | select(.type=="blob") | .path' | grep -E '^\\.github/(workflows/[^/]+\\.(yml|yaml)|actions/[^/]+/action\\.(yml|yaml))$' || true)"
+violations=()
+while IFS= read -r path; do
+  [ -z "$path" ] && continue
+  content="$(gh api "repos/$repo/contents/$path?ref=$head_sha" --jq -r '.content' 2>/dev/null | base64 -d 2>/dev/null || true)"
+  lineno=0
+  while IFS= read -r line; do
+    lineno=$((lineno + 1))
+    value="$(printf '%s\\n' "$line" | sed -n 's/^[[:space:]]*uses:[[:space:]]*//p' | tr -d '\\\"')"
+    [ -z "$value" ] && continue
+    case "$value" in
+      actions/*|docker/*|xpertss/*|.|./*) ;;
+      *) violations+=("  - $path:$lineno — uses: $value") ;;
+    esac
+  done <<< "$content"
+done <<< "$files"
+if [ "\${#violations[@]}" -gt 0 ]; then
+  {
+    echo "❌ Disallowed GitHub Action reference"
+    echo ""
+    echo "This PR references an action outside the allow-list:"
+    echo ""
+    printf '%s\\n' "\${violations[@]}"
+    echo ""
+    echo "Org policy trusts only actions/*, docker/*, and xpertss/*. Use an equivalent internal action, or ask its maintainers to add one."
+  } | gh pr comment "$pr_number" --body-file - || echo "::warning::could not post PR comment (fork PR or missing token)"
+  exit 1
+fi
+`,
+                },
+            ],
+        });
+    }
+}
+exports.ActionsAllowlistGuard = ActionsAllowlistGuard;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYWN0aW9ucy1hbGxvd2xpc3QtZ3VhcmQuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvY29tbW9uL2FjdGlvbnMtYWxsb3dsaXN0LWd1YXJkLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7Ozs7QUFBQSxtQ0FBMkM7QUFDM0MsMkNBQXVEO0FBb0N2RCxNQUFhLHFCQUFzQixTQUFRLGtCQUFTOztJQUNsQyxRQUFRLENBQXdCO0lBRWhELFlBQ0UsS0FBMkIsRUFDM0IsVUFBd0MsRUFBRTtRQUUxQyxLQUFLLENBQUMsS0FBSyxFQUFFLHVCQUF1QixDQUFDLENBQUM7UUFFdEMsTUFBTSxFQUFFLEdBQUcsS0FBSyxDQUFDLE1BQU0sQ0FBQztRQUN4QixJQUFJLENBQUMsRUFBRSxFQUFFLENBQUM7WUFDUixNQUFNLElBQUksS0FBSyxDQUNiLGlFQUFpRSxDQUNsRSxDQUFDO1FBQ0osQ0FBQztRQUVELE1BQU0sY0FBYyxHQUNsQixPQUFPLENBQUMsY0FBYyxJQUFJLG9DQUF3QixDQUFDO1FBRXJELElBQUksQ0FBQyxRQUFRLEdBQUcsSUFBSSxlQUFNLENBQUMsY0FBYyxDQUN2QyxFQUFFLEVBQ0YsT0FBTyxDQUFDLFlBQVksSUFBSSx5QkFBeUIsQ0FDbEQsQ0FBQztRQUNGLElBQUksQ0FBQyxRQUFRLENBQUMsRUFBRSxDQUFDLEVBQUUsaUJBQWlCLEVBQUUsRUFBRSxFQUFFLENBQUMsQ0FBQztRQUM1QyxJQUFJLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQyxPQUFPLEVBQUU7WUFDNUIsTUFBTSxFQUFFLENBQUMsZUFBZSxDQUFDO1lBQ3pCLFdBQVcsRUFBRTtnQkFDWCxRQUFRLEVBQUUsZUFBTSxDQUFDLFNBQVMsQ0FBQyxhQUFhLENBQUMsSUFBSTtnQkFDN0MsWUFBWSxFQUFFLGVBQU0sQ0FBQyxTQUFTLENBQUMsYUFBYSxDQUFDLEtBQUs7YUFDbkQ7WUFDRCxHQUFHLEVBQUUsRUFBRSxRQUFRLEVBQUUsZ0JBQWdCLGNBQWMsS0FBSyxFQUFFO1lBQ3RELEtBQUssRUFBRTtnQkFDTDtvQkFDRSxJQUFJLEVBQUUsMkJBQTJCO29CQUNqQyxHQUFHLEVBQUU7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Q0FrQ2Q7aUJBQ1E7YUFDRjtTQUNGLENBQUMsQ0FBQztJQUNMLENBQUM7O0FBeEVILHNEQXlFQyIsInNvdXJjZXNDb250ZW50IjpbImltcG9ydCB7IENvbXBvbmVudCwgZ2l0aHViIH0gZnJvbSAncHJvamVuJztcbmltcG9ydCB7IERFRkFVTFRfR0hFX1RPS0VOX1NFQ1JFVCB9IGZyb20gJy4vY29uc3RhbnRzJztcblxuLyoqXG4gKiBCbG9ja2luZywgdGFtcGVyLXByb29mIFBSIGNoZWNrIHRoYXQgc3RvcHMgYSBkaXNhbGxvd2VkIEdpdEh1YiBBY3Rpb25cbiAqIHJlZmVyZW5jZSBmcm9tIGV2ZXIgKHJlKWFwcGVhcmluZyBpbiBhIHJlcG8ncyB3b3JrZmxvdyBvciBjb21wb3NpdGUtYWN0aW9uXG4gKiBmaWxlcy5cbiAqXG4gKiBSdW5zIG9uIGBwdWxsX3JlcXVlc3RfdGFyZ2V0YCBzbyBpdCBhbHdheXMgZXhlY3V0ZXMgdGhlIGNvcHkgb2YgdGhpc1xuICogd29ya2Zsb3cgY29tbWl0dGVkIG9uIHRoZSBiYXNlIGJyYW5jaCAtIGEgUFIgY2Fubm90IGVkaXQgdGhpcyBmaWxlIHRvXG4gKiBkaXNhYmxlIG9yIHdlYWtlbiB0aGUgY2hlY2suIEl0IGNoZWNrcyBvdXQgYW5kIGV4ZWN1dGVzIG5vdGhpbmcgZnJvbSB0aGVcbiAqIFBSOyBpdCBvbmx5IHJlYWRzIHRoZSBQUiBoZWFkJ3MgZmlsZSBjb250ZW50IHZpYSB0aGUgR2l0SHViIEFQSS4gQmVjYXVzZVxuICogYHB1bGxfcmVxdWVzdF90YXJnZXRgIHJ1bnMgd2l0aCB0aGUgYmFzZSByZXBvJ3MgdG9rZW4gZXZlbiBmb3JcbiAqIGZvcmstb3JpZ2luYXRlZCBQUnMsIHRoZSBmYWlsdXJlIGNvbW1lbnQgcG9zdHMgcmVsaWFibHkuXG4gKlxuICAqIEl0IHBlcmZvcm1zIGEgZmxhdCwgdW5jb25kaXRpb25hbCBzY2FuIG9mIHRoZSBQUidzIGhlYWQgcmVmIChub1xuICAqIGJhc2UtdnMtaGVhZCBjb21wYXJpc29uKTogZmV0Y2ggdGhlIGNvbnRlbnQgb2YgZXZlcnkgR2l0SHViIHdvcmtmbG93IGFuZFxuICAqIGNvbXBvc2l0ZS1hY3Rpb24gZmlsZSwgZXh0cmFjdCBldmVyeSBgdXNlczpgIHZhbHVlLCBhbmQgZmFpbCBpZiBhbnkgZG9lc1xuICAqIG5vdCBzdGFydCB3aXRoIG9uZSBvZiB0aGUgdGhyZWUgdHJ1c3RlZCBuYW1lc3BhY2VzIGZyb20gQUQtMDAxXG4gICogKGBhY3Rpb25zL2AsIGBkb2NrZXIvYCwgYHhwZXJ0c3MvYCkuIFRoZSBzaW5nbGVcbiAqIGV4ZW1wdGlvbiBpcyBhIGxvY2FsIHNhbWUtcmVwbyByZWZlcmVuY2UgKGB1c2VzOiAuYCBvclxuICogYHVzZXM6IC4vLmdpdGh1Yi9hY3Rpb25zLzxuYW1lPmApIC0gdGhlIHJlcG8ncyBvd24gaGFuZC1jb21taXR0ZWQgYWN0aW9uLFxuICogdG8gd2hpY2ggdGhlIG9yZyBwb2xpY3kncyBcImFsbG93IHNlbGVjdCBhY3Rpb25zXCIgc2V0dGluZyBkb2VzIG5vdCBhcHBseS5cbiAqL1xuZXhwb3J0IGludGVyZmFjZSBBY3Rpb25zQWxsb3dsaXN0R3VhcmRPcHRpb25zIHtcbiAgLyoqXG4gICAqIEdpdEh1YiBzZWNyZXQgaG9sZGluZyBhIHRva2VuIHdpdGggcGVybWlzc2lvbiB0byBjb21tZW50IG9uIFBScywgdXNlZFxuICAgKiBmb3IgdGhlIGZhaWx1cmUgY29tbWVudC4gVGhlIGNoZWNrIHN0aWxsIGZhaWxzIHdpdGhvdXQgaXQsIHNvIGZvcmsgUFJzIC1cbiAgICogd2hpY2ggZ2V0IG5vIHNlY3JldHMgLSBhcmUgb25seSBtaXNzaW5nIHRoZSBleHRyYSBjb21tZW50LlxuICAgKiBAZGVmYXVsdCBcIlBST0pFTl9HSVRIVUJfVE9LRU5cIlxuICAgKi9cbiAgcmVhZG9ubHkgZ2hlVG9rZW5TZWNyZXQ/OiBzdHJpbmc7XG5cbiAgLyoqIEBkZWZhdWx0IFwiYWN0aW9ucy1hbGxvd2xpc3QtZ3VhcmRcIiAqL1xuICByZWFkb25seSB3b3JrZmxvd05hbWU/OiBzdHJpbmc7XG59XG5cbmV4cG9ydCBjbGFzcyBBY3Rpb25zQWxsb3dsaXN0R3VhcmQgZXh0ZW5kcyBDb21wb25lbnQge1xuICBwdWJsaWMgcmVhZG9ubHkgd29ya2Zsb3c6IGdpdGh1Yi5HaXRodWJXb3JrZmxvdztcblxuICBjb25zdHJ1Y3RvcihcbiAgICBzY29wZTogZ2l0aHViLkdpdEh1YlByb2plY3QsXG4gICAgb3B0aW9uczogQWN0aW9uc0FsbG93bGlzdEd1YXJkT3B0aW9ucyA9IHt9LFxuICApIHtcbiAgICBzdXBlcihzY29wZSwgJ0FjdGlvbnNBbGxvd2xpc3RHdWFyZCcpO1xuXG4gICAgY29uc3QgZ2ggPSBzY29wZS5naXRodWI7XG4gICAgaWYgKCFnaCkge1xuICAgICAgdGhyb3cgbmV3IEVycm9yKFxuICAgICAgICAnQWN0aW9uc0FsbG93bGlzdEd1YXJkIHJlcXVpcmVzIEdpdEh1YiBpbnRlZ3JhdGlvbiB0byBiZSBlbmFibGVkJyxcbiAgICAgICk7XG4gICAgfVxuXG4gICAgY29uc3QgZ2hlVG9rZW5TZWNyZXQgPVxuICAgICAgb3B0aW9ucy5naGVUb2tlblNlY3JldCA/PyBERUZBVUxUX0dIRV9UT0tFTl9TRUNSRVQ7XG5cbiAgICB0aGlzLndvcmtmbG93ID0gbmV3IGdpdGh1Yi5HaXRodWJXb3JrZmxvdyhcbiAgICAgIGdoLFxuICAgICAgb3B0aW9ucy53b3JrZmxvd05hbWUgPz8gJ2FjdGlvbnMtYWxsb3dsaXN0LWd1YXJkJyxcbiAgICApO1xuICAgIHRoaXMud29ya2Zsb3cub24oeyBwdWxsUmVxdWVzdFRhcmdldDoge30gfSk7XG4gICAgdGhpcy53b3JrZmxvdy5hZGRKb2IoJ2NoZWNrJywge1xuICAgICAgcnVuc09uOiBbJ3VidW50dS1sYXRlc3QnXSxcbiAgICAgIHBlcm1pc3Npb25zOiB7XG4gICAgICAgIGNvbnRlbnRzOiBnaXRodWIud29ya2Zsb3dzLkpvYlBlcm1pc3Npb24uUkVBRCxcbiAgICAgICAgcHVsbFJlcXVlc3RzOiBnaXRodWIud29ya2Zsb3dzLkpvYlBlcm1pc3Npb24uV1JJVEUsXG4gICAgICB9LFxuICAgICAgZW52OiB7IEdIX1RPS0VOOiBgXFwke3sgc2VjcmV0cy4ke2doZVRva2VuU2VjcmV0fSB9fWAgfSxcbiAgICAgIHN0ZXBzOiBbXG4gICAgICAgIHtcbiAgICAgICAgICBuYW1lOiAnRW5mb3JjZSBhY3Rpb24gYWxsb3ctbGlzdCcsXG4gICAgICAgICAgcnVuOiBgc2V0IC11byBwaXBlZmFpbFxuaGVhZF9zaGE9XCJcXCR7eyBnaXRodWIuZXZlbnQucHVsbF9yZXF1ZXN0LmhlYWQuc2hhIH19XCJcbnByX251bWJlcj1cIlxcJHt7IGdpdGh1Yi5ldmVudC5udW1iZXIgfX1cIlxucmVwbz1cIlxcJHtHSVRIVUJfUkVQT1NJVE9SWX1cIlxuIyBBbGwgZmlsZXMgYXQgdGhlIFBSIGhlYWQgKHJlY3Vyc2l2ZSB0cmVlKSwgbmFycm93ZWQgdG8gd29ya2Zsb3cgYW5kXG4jIGNvbXBvc2l0ZS1hY3Rpb24gZmlsZXMuXG5maWxlcz1cIiQoZ2ggYXBpIFwicmVwb3MvJHJlcG8vZ2l0L3RyZWVzLyRoZWFkX3NoYT9yZWN1cnNpdmU9MVwiIC0tanEgJy50cmVlW10gfCBzZWxlY3QoLnR5cGU9PVwiYmxvYlwiKSB8IC5wYXRoJyB8IGdyZXAgLUUgJ15cXFxcLmdpdGh1Yi8od29ya2Zsb3dzL1teL10rXFxcXC4oeW1sfHlhbWwpfGFjdGlvbnMvW14vXSsvYWN0aW9uXFxcXC4oeW1sfHlhbWwpKSQnIHx8IHRydWUpXCJcbnZpb2xhdGlvbnM9KClcbndoaWxlIElGUz0gcmVhZCAtciBwYXRoOyBkb1xuICBbIC16IFwiJHBhdGhcIiBdICYmIGNvbnRpbnVlXG4gIGNvbnRlbnQ9XCIkKGdoIGFwaSBcInJlcG9zLyRyZXBvL2NvbnRlbnRzLyRwYXRoP3JlZj0kaGVhZF9zaGFcIiAtLWpxIC1yICcuY29udGVudCcgMj4vZGV2L251bGwgfCBiYXNlNjQgLWQgMj4vZGV2L251bGwgfHwgdHJ1ZSlcIlxuICBsaW5lbm89MFxuICB3aGlsZSBJRlM9IHJlYWQgLXIgbGluZTsgZG9cbiAgICBsaW5lbm89JCgobGluZW5vICsgMSkpXG4gICAgdmFsdWU9XCIkKHByaW50ZiAnJXNcXFxcbicgXCIkbGluZVwiIHwgc2VkIC1uICdzL15bWzpzcGFjZTpdXSp1c2VzOltbOnNwYWNlOl1dKi8vcCcgfCB0ciAtZCAnXFxcXFxcXCInKVwiXG4gICAgWyAteiBcIiR2YWx1ZVwiIF0gJiYgY29udGludWVcbiAgICBjYXNlIFwiJHZhbHVlXCIgaW5cbiAgICAgIGFjdGlvbnMvKnxkb2NrZXIvKnx4cGVydHNzLyp8LnwuLyopIDs7XG4gICAgICAqKSB2aW9sYXRpb25zKz0oXCIgIC0gJHBhdGg6JGxpbmVubyDigJQgdXNlczogJHZhbHVlXCIpIDs7XG4gICAgZXNhY1xuICBkb25lIDw8PCBcIiRjb250ZW50XCJcbmRvbmUgPDw8IFwiJGZpbGVzXCJcbmlmIFsgXCJcXCR7I3Zpb2xhdGlvbnNbQF19XCIgLWd0IDAgXTsgdGhlblxuICB7XG4gICAgZWNobyBcIuKdjCBEaXNhbGxvd2VkIEdpdEh1YiBBY3Rpb24gcmVmZXJlbmNlXCJcbiAgICBlY2hvIFwiXCJcbiAgICBlY2hvIFwiVGhpcyBQUiByZWZlcmVuY2VzIGFuIGFjdGlvbiBvdXRzaWRlIHRoZSBhbGxvdy1saXN0OlwiXG4gICAgZWNobyBcIlwiXG4gICAgcHJpbnRmICclc1xcXFxuJyBcIlxcJHt2aW9sYXRpb25zW0BdfVwiXG4gICAgZWNobyBcIlwiXG4gICAgZWNobyBcIk9yZyBwb2xpY3kgdHJ1c3RzIG9ubHkgYWN0aW9ucy8qLCBkb2NrZXIvKiwgYW5kIHhwZXJ0c3MvKi4gVXNlIGFuIGVxdWl2YWxlbnQgaW50ZXJuYWwgYWN0aW9uLCBvciBhc2sgaXRzIG1haW50YWluZXJzIHRvIGFkZCBvbmUuXCJcbiAgfSB8IGdoIHByIGNvbW1lbnQgXCIkcHJfbnVtYmVyXCIgLS1ib2R5LWZpbGUgLSB8fCBlY2hvIFwiOjp3YXJuaW5nOjpjb3VsZCBub3QgcG9zdCBQUiBjb21tZW50IChmb3JrIFBSIG9yIG1pc3NpbmcgdG9rZW4pXCJcbiAgZXhpdCAxXG5maVxuYCxcbiAgICAgICAgfSxcbiAgICAgIF0sXG4gICAgfSk7XG4gIH1cbn1cbiJdfQ==

package/lib/common/internal-actions.d.ts

@@ -0,0 +1,10 @@
+import { github } from 'projen';
+/**
+ * Redirects every out-of-policy third-party action reference to the
+ * first-party `xpertss/*` internal actions across the whole project, using
+ * projen's `GitHubActionsProvider`. Call once per `GitHubProject`. Because
+ * every generated `uses:` is resolved through this map at synth time -
+ * including projen's built-in `upgrade-main` / `pull-request-lint` workflows
+ * - this single call covers all current out-of-policy call sites.
+ */
+export declare function applyInternalActionOverrides(gh: github.GitHub): void;

package/lib/common/internal-actions.js

@@ -0,0 +1,33 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.applyInternalActionOverrides = applyInternalActionOverrides;
+// Placeholder until the internal action repos are built and released (AD-002
+// Phase 1, step 8) - a real 40-char SHA replaces this in each entry at that
+// point. Landed with placeholders so the override mechanism is in place while
+// the untrusted workflows it retargets are non-gating (AD-002 Phase 0).
+const PLACEHOLDER_SHA = 'PLACEHOLDER_SHA';
+// Name (without ref) -> SHA-pinned internal-action override. Per projen's
+// GitHubActionsProvider.get() a name-keyed override redirects every ref
+// variant at once, so a single entry covers both this package's literals
+// (@v7/@v5) and projen's built-in workflows (@v8.1.1/SHA) for the same
+// action. Only actions outside the trusted namespaces (actions/*, docker/*,
+// xpertss/*) ever need an entry.
+const ACTION_OVERRIDES = {
+    'peter-evans/create-pull-request': `xpertss/create-pull-request@${PLACEHOLDER_SHA}`,
+    'stefanzweifel/git-auto-commit-action': `xpertss/auto-commit@${PLACEHOLDER_SHA}`,
+    'amannn/action-semantic-pull-request': `xpertss/semantic-pull-request@${PLACEHOLDER_SHA}`,
+};
+/**
+ * Redirects every out-of-policy third-party action reference to the
+ * first-party `xpertss/*` internal actions across the whole project, using
+ * projen's `GitHubActionsProvider`. Call once per `GitHubProject`. Because
+ * every generated `uses:` is resolved through this map at synth time -
+ * including projen's built-in `upgrade-main` / `pull-request-lint` workflows
+ * - this single call covers all current out-of-policy call sites.
+ */
+function applyInternalActionOverrides(gh) {
+    for (const [action, override] of Object.entries(ACTION_OVERRIDES)) {
+        gh.actions.set(action, override);
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW50ZXJuYWwtYWN0aW9ucy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9jb21tb24vaW50ZXJuYWwtYWN0aW9ucy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOztBQTRCQSxvRUFJQztBQTlCRCw2RUFBNkU7QUFDN0UsNEVBQTRFO0FBQzVFLDhFQUE4RTtBQUM5RSx3RUFBd0U7QUFDeEUsTUFBTSxlQUFlLEdBQUcsaUJBQWlCLENBQUM7QUFFMUMsMEVBQTBFO0FBQzFFLHdFQUF3RTtBQUN4RSx5RUFBeUU7QUFDekUsdUVBQXVFO0FBQ3ZFLDRFQUE0RTtBQUM1RSxpQ0FBaUM7QUFDakMsTUFBTSxnQkFBZ0IsR0FBMkI7SUFDL0MsaUNBQWlDLEVBQUUsK0JBQStCLGVBQWUsRUFBRTtJQUNuRixzQ0FBc0MsRUFBRSx1QkFBdUIsZUFBZSxFQUFFO0lBQ2hGLHFDQUFxQyxFQUFFLGlDQUFpQyxlQUFlLEVBQUU7Q0FDMUYsQ0FBQztBQUVGOzs7Ozs7O0dBT0c7QUFDSCxTQUFnQiw0QkFBNEIsQ0FBQyxFQUFpQjtJQUM1RCxLQUFLLE1BQU0sQ0FBQyxNQUFNLEVBQUUsUUFBUSxDQUFDLElBQUksTUFBTSxDQUFDLE9BQU8sQ0FBQyxnQkFBZ0IsQ0FBQyxFQUFFLENBQUM7UUFDbEUsRUFBRSxDQUFDLE9BQU8sQ0FBQyxHQUFHLENBQUMsTUFBTSxFQUFFLFFBQVEsQ0FBQyxDQUFDO0lBQ25DLENBQUM7QUFDSCxDQUFDIiwic291cmNlc0NvbnRlbnQiOlsiaW1wb3J0IHsgZ2l0aHViIH0gZnJvbSAncHJvamVuJztcblxuLy8gUGxhY2Vob2xkZXIgdW50aWwgdGhlIGludGVybmFsIGFjdGlvbiByZXBvcyBhcmUgYnVpbHQgYW5kIHJlbGVhc2VkIChBRC0wMDJcbi8vIFBoYXNlIDEsIHN0ZXAgOCkgLSBhIHJlYWwgNDAtY2hhciBTSEEgcmVwbGFjZXMgdGhpcyBpbiBlYWNoIGVudHJ5IGF0IHRoYXRcbi8vIHBvaW50LiBMYW5kZWQgd2l0aCBwbGFjZWhvbGRlcnMgc28gdGhlIG92ZXJyaWRlIG1lY2hhbmlzbSBpcyBpbiBwbGFjZSB3aGlsZVxuLy8gdGhlIHVudHJ1c3RlZCB3b3JrZmxvd3MgaXQgcmV0YXJnZXRzIGFyZSBub24tZ2F0aW5nIChBRC0wMDIgUGhhc2UgMCkuXG5jb25zdCBQTEFDRUhPTERFUl9TSEEgPSAnUExBQ0VIT0xERVJfU0hBJztcblxuLy8gTmFtZSAod2l0aG91dCByZWYpIC0+IFNIQS1waW5uZWQgaW50ZXJuYWwtYWN0aW9uIG92ZXJyaWRlLiBQZXIgcHJvamVuJ3Ncbi8vIEdpdEh1YkFjdGlvbnNQcm92aWRlci5nZXQoKSBhIG5hbWUta2V5ZWQgb3ZlcnJpZGUgcmVkaXJlY3RzIGV2ZXJ5IHJlZlxuLy8gdmFyaWFudCBhdCBvbmNlLCBzbyBhIHNpbmdsZSBlbnRyeSBjb3ZlcnMgYm90aCB0aGlzIHBhY2thZ2UncyBsaXRlcmFsc1xuLy8gKEB2Ny9AdjUpIGFuZCBwcm9qZW4ncyBidWlsdC1pbiB3b3JrZmxvd3MgKEB2OC4xLjEvU0hBKSBmb3IgdGhlIHNhbWVcbi8vIGFjdGlvbi4gT25seSBhY3Rpb25zIG91dHNpZGUgdGhlIHRydXN0ZWQgbmFtZXNwYWNlcyAoYWN0aW9ucy8qLCBkb2NrZXIvKixcbi8vIHhwZXJ0c3MvKikgZXZlciBuZWVkIGFuIGVudHJ5LlxuY29uc3QgQUNUSU9OX09WRVJSSURFUzogUmVjb3JkPHN0cmluZywgc3RyaW5nPiA9IHtcbiAgJ3BldGVyLWV2YW5zL2NyZWF0ZS1wdWxsLXJlcXVlc3QnOiBgeHBlcnRzcy9jcmVhdGUtcHVsbC1yZXF1ZXN0QCR7UExBQ0VIT0xERVJfU0hBfWAsXG4gICdzdGVmYW56d2VpZmVsL2dpdC1hdXRvLWNvbW1pdC1hY3Rpb24nOiBgeHBlcnRzcy9hdXRvLWNvbW1pdEAke1BMQUNFSE9MREVSX1NIQX1gLFxuICAnYW1hbm5uL2FjdGlvbi1zZW1hbnRpYy1wdWxsLXJlcXVlc3QnOiBgeHBlcnRzcy9zZW1hbnRpYy1wdWxsLXJlcXVlc3RAJHtQTEFDRUhPTERFUl9TSEF9YCxcbn07XG5cbi8qKlxuICogUmVkaXJlY3RzIGV2ZXJ5IG91dC1vZi1wb2xpY3kgdGhpcmQtcGFydHkgYWN0aW9uIHJlZmVyZW5jZSB0byB0aGVcbiAqIGZpcnN0LXBhcnR5IGB4cGVydHNzLypgIGludGVybmFsIGFjdGlvbnMgYWNyb3NzIHRoZSB3aG9sZSBwcm9qZWN0LCB1c2luZ1xuICogcHJvamVuJ3MgYEdpdEh1YkFjdGlvbnNQcm92aWRlcmAuIENhbGwgb25jZSBwZXIgYEdpdEh1YlByb2plY3RgLiBCZWNhdXNlXG4gKiBldmVyeSBnZW5lcmF0ZWQgYHVzZXM6YCBpcyByZXNvbHZlZCB0aHJvdWdoIHRoaXMgbWFwIGF0IHN5bnRoIHRpbWUgLVxuICogaW5jbHVkaW5nIHByb2plbidzIGJ1aWx0LWluIGB1cGdyYWRlLW1haW5gIC8gYHB1bGwtcmVxdWVzdC1saW50YCB3b3JrZmxvd3NcbiAqIC0gdGhpcyBzaW5nbGUgY2FsbCBjb3ZlcnMgYWxsIGN1cnJlbnQgb3V0LW9mLXBvbGljeSBjYWxsIHNpdGVzLlxuICovXG5leHBvcnQgZnVuY3Rpb24gYXBwbHlJbnRlcm5hbEFjdGlvbk92ZXJyaWRlcyhnaDogZ2l0aHViLkdpdEh1Yik6IHZvaWQge1xuICBmb3IgKGNvbnN0IFthY3Rpb24sIG92ZXJyaWRlXSBvZiBPYmplY3QuZW50cmllcyhBQ1RJT05fT1ZFUlJJREVTKSkge1xuICAgIGdoLmFjdGlvbnMuc2V0KGFjdGlvbiwgb3ZlcnJpZGUpO1xuICB9XG59XG4iXX0=

package/lib/common/manual-deploy-workflow.d.ts

@@ -24,8 +24,6 @@ export interface ManualDeployWorkflowOptions {
      * `repository_dispatch` to a companion infra repo).
      */
     readonly deploySteps?: (env: EnvironmentOptions) => github.workflows.JobStep[];
-    /** GitHub secret holding a Slack webhook URL used to notify on deploy. */
-    readonly slackWebhookSecret?: string;
 }
 /** @internal */
 export declare class ManualDeployWorkflow extends Component {

package/lib/common/manual-deploy-workflow.js

@@ -49,17 +49,6 @@ class ManualDeployWorkflow extends projen_1.Component {
                 },
                 ...deploySteps(env),
             ];
-            if (options.slackWebhookSecret) {
-                steps.push({
-                    name: 'Notify Slack',
-                    if: 'always()',
-                    uses: 'slackapi/slack-github-action@v2',
-                    with: { 'webhook-type': 'incoming-webhook' },
-                    env: {
-                        SLACK_WEBHOOK_URL: `\${{ secrets.${options.slackWebhookSecret} }}`,
-                    },
-                });
-            }
             this.workflow.addJob(`deploy-${env.name}`, {
                 name: `Deploy (${env.name})`,
                 if: `github.event.inputs.environment == '${env.name}'`,
@@ -75,4 +64,4 @@ class ManualDeployWorkflow extends projen_1.Component {
     }
 }
 exports.ManualDeployWorkflow = ManualDeployWorkflow;
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibWFudWFsLWRlcGxveS13b3JrZmxvdy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9jb21tb24vbWFudWFsLWRlcGxveS13b3JrZmxvdy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7QUFBQSxtQ0FBMkM7QUFDM0MsK0RBRytCO0FBbUMvQixnQkFBZ0I7QUFDaEIsTUFBYSxvQkFBcUIsU0FBUSxrQkFBUztJQUNqQyxRQUFRLENBQXdCO0lBRWhELFlBQ0UsS0FBMkIsRUFDM0IsT0FBb0M7UUFFcEMsS0FBSyxDQUFDLEtBQUssRUFBRSxzQkFBc0IsQ0FBQyxDQUFDO1FBRXJDLE1BQU0sWUFBWSxHQUFHLElBQUEsMkNBQXFCLEVBQUMsT0FBTyxDQUFDLFlBQVksQ0FBQyxDQUFDO1FBQ2pFLE1BQU0sRUFBRSxHQUFHLEtBQUssQ0FBQyxNQUFNLENBQUM7UUFDeEIsSUFBSSxDQUFDLEVBQUUsRUFBRSxDQUFDO1lBQ1IsTUFBTSxJQUFJLEtBQUssQ0FDYixnRUFBZ0UsQ0FDakUsQ0FBQztRQUNKLENBQUM7UUFFRCxNQUFNLFlBQVksR0FBRyxPQUFPLENBQUMsWUFBWSxJQUFJLFFBQVEsQ0FBQztRQUN0RCxNQUFNLFdBQVcsR0FDZixPQUFPLENBQUMsV0FBVztZQUNuQixDQUFDLENBQUMsR0FBdUIsRUFBOEIsRUFBRSxDQUFDO2dCQUN4RDtvQkFDRSxJQUFJLEVBQUUsVUFBVSxHQUFHLENBQUMsSUFBSSxFQUFFO29CQUMxQixHQUFHLEVBQUUsdURBQXVELEdBQUcsQ0FBQyxJQUFJLElBQUk7aUJBQ3pFO2FBQ0YsQ0FBQyxDQUFDO1FBRUwsSUFBSSxDQUFDLFFBQVEsR0FBRyxJQUFJLGVBQU0sQ0FBQyxjQUFjLENBQUMsRUFBRSxFQUFFLFlBQVksQ0FBQyxDQUFDO1FBQzVELElBQUksQ0FBQyxRQUFRLENBQUMsRUFBRSxDQUFDO1lBQ2YsZ0JBQWdCLEVBQUU7Z0JBQ2hCLE1BQU0sRUFBRTtvQkFDTixXQUFXLEVBQUU7d0JBQ1gsV0FBVyxFQUFFLHVCQUF1Qjt3QkFDcEMsUUFBUSxFQUFFLElBQUk7d0JBQ2QsSUFBSSxFQUFFLFFBQVE7d0JBQ2QsT0FBTyxFQUFFLFlBQVksQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLEVBQUUsRUFBRSxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUM7cUJBQ3pDO29CQUNELE9BQU8sRUFBRTt3QkFDUCxXQUFXLEVBQ1QsZ0VBQWdFO3dCQUNsRSxRQUFRLEVBQUUsS0FBSztxQkFDaEI7aUJBQ0Y7YUFDRjtTQUNGLENBQUMsQ0FBQztRQUVILEtBQUssTUFBTSxHQUFHLElBQUksWUFBWSxFQUFFLENBQUM7WUFDL0IsTUFBTSxLQUFLLEdBQStCO2dCQUN4QztvQkFDRSxJQUFJLEVBQUUsVUFBVTtvQkFDaEIsSUFBSSxFQUFFLHFCQUFxQjtvQkFDM0IsSUFBSSxFQUFFO3dCQUNKLEdBQUcsRUFBRSxrREFBa0Q7cUJBQ3hEO2lCQUNGO2dCQUNELEdBQUcsV0FBVyxDQUFDLEdBQUcsQ0FBQzthQUNwQixDQUFDO1lBRUYsSUFBSSxPQUFPLENBQUMsa0JBQWtCLEVBQUUsQ0FBQztnQkFDL0IsS0FBSyxDQUFDLElBQUksQ0FBQztvQkFDVCxJQUFJLEVBQUUsY0FBYztvQkFDcEIsRUFBRSxFQUFFLFVBQVU7b0JBQ2QsSUFBSSxFQUFFLGlDQUFpQztvQkFDdkMsSUFBSSxFQUFFLEVBQUUsY0FBYyxFQUFFLGtCQUFrQixFQUFFO29CQUM1QyxHQUFHLEVBQUU7d0JBQ0gsaUJBQWlCLEVBQUUsZ0JBQWdCLE9BQU8sQ0FBQyxrQkFBa0IsS0FBSztxQkFDbkU7aUJBQ0YsQ0FBQyxDQUFDO1lBQ0wsQ0FBQztZQUVELElBQUksQ0FBQyxRQUFRLENBQUMsTUFBTSxDQUFDLFVBQVUsR0FBRyxDQUFDLElBQUksRUFBRSxFQUFFO2dCQUN6QyxJQUFJLEVBQUUsV0FBVyxHQUFHLENBQUMsSUFBSSxHQUFHO2dCQUM1QixFQUFFLEVBQUUsdUNBQXVDLEdBQUcsQ0FBQyxJQUFJLEdBQUc7Z0JBQ3RELE1BQU0sRUFBRSxDQUFDLGVBQWUsQ0FBQztnQkFDekIsV0FBVyxFQUFFLEdBQUcsQ0FBQyxnQkFBZ0IsQ0FBQyxDQUFDLENBQUMsR0FBRyxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUMsU0FBUztnQkFDeEQsV0FBVyxFQUFFO29CQUNYLE9BQU8sRUFBRSxlQUFNLENBQUMsU0FBUyxDQUFDLGFBQWEsQ0FBQyxLQUFLO29CQUM3QyxRQUFRLEVBQUUsZUFBTSxDQUFDLFNBQVMsQ0FBQyxhQUFhLENBQUMsSUFBSTtpQkFDOUM7Z0JBQ0QsS0FBSzthQUNOLENBQUMsQ0FBQztRQUNMLENBQUM7SUFDSCxDQUFDO0NBQ0Y7QUFuRkQsb0RBbUZDIiwic291cmNlc0NvbnRlbnQiOlsiaW1wb3J0IHsgQ29tcG9uZW50LCBnaXRodWIgfSBmcm9tICdwcm9qZW4nO1xuaW1wb3J0IHtcbiAgRW52aXJvbm1lbnRPcHRpb25zLFxuICBub3JtYWxpemVFbnZpcm9ubWVudHMsXG59IGZyb20gJy4vZW52aXJvbm1lbnQtb3B0aW9ucyc7XG5cbi8qKlxuICogU2hhcmVkLCBlbnZpcm9ubWVudC1wYXJhbWV0ZXJpemVkIG1hbnVhbC1kaXNwYXRjaCBkZXBsb3kgd29ya2Zsb3cuXG4gKlxuICogVGhpcyBpcyB0aGUgb25lIFwidHJpZ2dlciBhIGRlcGxveVwiIGNvbnRyYWN0IHVzZWQgYnkgYm90aCB0aGUgQ0RLIHByb2plY3RcbiAqIHR5cGVzIChkZXBsb3lpbmcgdGhlaXIgb3duIHN0YWNrcykgYW5kIHRoZSBKYXZhIGBDZGtEZXBsb3lIb29rYCBjb21wb25lbnRcbiAqIChkaXNwYXRjaGluZyBhIGRlcGxveSBpbiBhIGNvbXBhbmlvbiBDREsgcmVwbykgLSBzZWUgdGhlIFwiT3BlbiBRdWVzdGlvbnNcIlxuICogc2VjdGlvbnMgb2YgdGhlIHR3byBzcGVjcy5cbiAqXG4gKiBAaW50ZXJuYWwgLSBub3QgcGFydCBvZiB0aGUganNpaS1leHBvcnRlZCBBUEkgKGl0cyBgZGVwbG95U3RlcHNgIGNhbGxiYWNrXG4gKiBpc24ndCByZXByZXNlbnRhYmxlIGFjcm9zcyBqc2lpIGxhbmd1YWdlcyk7IGNvbnN1bWVkIGRpcmVjdGx5IGJ5IG90aGVyXG4gKiBUeXBlU2NyaXB0IHNvdXJjZSBpbiB0aGlzIHBhY2thZ2UuXG4gKi9cbmV4cG9ydCBpbnRlcmZhY2UgTWFudWFsRGVwbG95V29ya2Zsb3dPcHRpb25zIHtcbiAgLyoqIERlcGxveSB0YXJnZXRzIGV4cG9zZWQgYXMgdGhlIGBlbnZpcm9ubWVudGAgd29ya2Zsb3dfZGlzcGF0Y2ggY2hvaWNlLiAqL1xuICByZWFkb25seSBlbnZpcm9ubWVudHM6IChzdHJpbmcgfCBFbnZpcm9ubWVudE9wdGlvbnMpW107XG5cbiAgLyoqIEBkZWZhdWx0IFwiZGVwbG95XCIgKi9cbiAgcmVhZG9ubHkgd29ya2Zsb3dOYW1lPzogc3RyaW5nO1xuXG4gIC8qKlxuICAgKiBUaGUgc3RlcHMgdGhhdCBhY3R1YWxseSBwZXJmb3JtIHRoZSBkZXBsb3kgZm9yIGEgZ2l2ZW4gZW52aXJvbm1lbnQuXG4gICAqIERlZmF1bHRzIHRvIGEgcGxhY2Vob2xkZXIgYGVjaG9gIHN0ZXAgLSBwcm9qZWN0IHR5cGVzIGFyZSBleHBlY3RlZCB0b1xuICAgKiBvdmVycmlkZSB0aGlzIHdpdGggc29tZXRoaW5nIHJlYWwgKGUuZy4gYGNkayBkZXBsb3lgLCBvciBhXG4gICAqIGByZXBvc2l0b3J5X2Rpc3BhdGNoYCB0byBhIGNvbXBhbmlvbiBpbmZyYSByZXBvKS5cbiAgICovXG4gIHJlYWRvbmx5IGRlcGxveVN0ZXBzPzogKFxuICAgIGVudjogRW52aXJvbm1lbnRPcHRpb25zLFxuICApID0+IGdpdGh1Yi53b3JrZmxvd3MuSm9iU3RlcFtdO1xuXG4gIC8qKiBHaXRIdWIgc2VjcmV0IGhvbGRpbmcgYSBTbGFjayB3ZWJob29rIFVSTCB1c2VkIHRvIG5vdGlmeSBvbiBkZXBsb3kuICovXG4gIHJlYWRvbmx5IHNsYWNrV2ViaG9va1NlY3JldD86IHN0cmluZztcbn1cblxuLyoqIEBpbnRlcm5hbCAqL1xuZXhwb3J0IGNsYXNzIE1hbnVhbERlcGxveVdvcmtmbG93IGV4dGVuZHMgQ29tcG9uZW50IHtcbiAgcHVibGljIHJlYWRvbmx5IHdvcmtmbG93OiBnaXRodWIuR2l0aHViV29ya2Zsb3c7XG5cbiAgY29uc3RydWN0b3IoXG4gICAgc2NvcGU6IGdpdGh1Yi5HaXRIdWJQcm9qZWN0LFxuICAgIG9wdGlvbnM6IE1hbnVhbERlcGxveVdvcmtmbG93T3B0aW9ucyxcbiAgKSB7XG4gICAgc3VwZXIoc2NvcGUsICdNYW51YWxEZXBsb3lXb3JrZmxvdycpO1xuXG4gICAgY29uc3QgZW52aXJvbm1lbnRzID0gbm9ybWFsaXplRW52aXJvbm1lbnRzKG9wdGlvbnMuZW52aXJvbm1lbnRzKTtcbiAgICBjb25zdCBnaCA9IHNjb3BlLmdpdGh1YjtcbiAgICBpZiAoIWdoKSB7XG4gICAgICB0aHJvdyBuZXcgRXJyb3IoXG4gICAgICAgICdNYW51YWxEZXBsb3lXb3JrZmxvdyByZXF1aXJlcyBHaXRIdWIgaW50ZWdyYXRpb24gdG8gYmUgZW5hYmxlZCcsXG4gICAgICApO1xuICAgIH1cblxuICAgIGNvbnN0IHdvcmtmbG93TmFtZSA9IG9wdGlvbnMud29ya2Zsb3dOYW1lID8/ICdkZXBsb3knO1xuICAgIGNvbnN0IGRlcGxveVN0ZXBzID1cbiAgICAgIG9wdGlvbnMuZGVwbG95U3RlcHMgPz9cbiAgICAgICgoZW52OiBFbnZpcm9ubWVudE9wdGlvbnMpOiBnaXRodWIud29ya2Zsb3dzLkpvYlN0ZXBbXSA9PiBbXG4gICAgICAgIHtcbiAgICAgICAgICBuYW1lOiBgRGVwbG95ICR7ZW52Lm5hbWV9YCxcbiAgICAgICAgICBydW46IGBlY2hvIFwiVE9ETzogaW1wbGVtZW50IGRlcGxveSBzdGVwcyBmb3IgZW52aXJvbm1lbnQgJyR7ZW52Lm5hbWV9J1wiYCxcbiAgICAgICAgfSxcbiAgICAgIF0pO1xuXG4gICAgdGhpcy53b3JrZmxvdyA9IG5ldyBnaXRodWIuR2l0aHViV29ya2Zsb3coZ2gsIHdvcmtmbG93TmFtZSk7XG4gICAgdGhpcy53b3JrZmxvdy5vbih7XG4gICAgICB3b3JrZmxvd0Rpc3BhdGNoOiB7XG4gICAgICAgIGlucHV0czoge1xuICAgICAgICAgIGVudmlyb25tZW50OiB7XG4gICAgICAgICAgICBkZXNjcmlwdGlvbjogJ0Vudmlyb25tZW50IHRvIGRlcGxveScsXG4gICAgICAgICAgICByZXF1aXJlZDogdHJ1ZSxcbiAgICAgICAgICAgIHR5cGU6ICdjaG9pY2UnLFxuICAgICAgICAgICAgb3B0aW9uczogZW52aXJvbm1lbnRzLm1hcCgoZSkgPT4gZS5uYW1lKSxcbiAgICAgICAgICB9LFxuICAgICAgICAgIGdpdF9zaGE6IHtcbiAgICAgICAgICAgIGRlc2NyaXB0aW9uOlxuICAgICAgICAgICAgICAnT3B0aW9uYWwgY29tbWl0IFNIQSB0byBkZXBsb3kgKGRlZmF1bHRzIHRvIHRoZSBkZWZhdWx0IGJyYW5jaCknLFxuICAgICAgICAgICAgcmVxdWlyZWQ6IGZhbHNlLFxuICAgICAgICAgIH0sXG4gICAgICAgIH0sXG4gICAgICB9LFxuICAgIH0pO1xuXG4gICAgZm9yIChjb25zdCBlbnYgb2YgZW52aXJvbm1lbnRzKSB7XG4gICAgICBjb25zdCBzdGVwczogZ2l0aHViLndvcmtmbG93cy5Kb2JTdGVwW10gPSBbXG4gICAgICAgIHtcbiAgICAgICAgICBuYW1lOiAnQ2hlY2tvdXQnLFxuICAgICAgICAgIHVzZXM6ICdhY3Rpb25zL2NoZWNrb3V0QHY0JyxcbiAgICAgICAgICB3aXRoOiB7XG4gICAgICAgICAgICByZWY6ICcke3sgZ2l0aHViLmV2ZW50LmlucHV0cy5naXRfc2hhIHx8IGdpdGh1Yi5zaGEgfX0nLFxuICAgICAgICAgIH0sXG4gICAgICAgIH0sXG4gICAgICAgIC4uLmRlcGxveVN0ZXBzKGVudiksXG4gICAgICBdO1xuXG4gICAgICBpZiAob3B0aW9ucy5zbGFja1dlYmhvb2tTZWNyZXQpIHtcbiAgICAgICAgc3RlcHMucHVzaCh7XG4gICAgICAgICAgbmFtZTogJ05vdGlmeSBTbGFjaycsXG4gICAgICAgICAgaWY6ICdhbHdheXMoKScsXG4gICAgICAgICAgdXNlczogJ3NsYWNrYXBpL3NsYWNrLWdpdGh1Yi1hY3Rpb25AdjInLFxuICAgICAgICAgIHdpdGg6IHsgJ3dlYmhvb2stdHlwZSc6ICdpbmNvbWluZy13ZWJob29rJyB9LFxuICAgICAgICAgIGVudjoge1xuICAgICAgICAgICAgU0xBQ0tfV0VCSE9PS19VUkw6IGBcXCR7eyBzZWNyZXRzLiR7b3B0aW9ucy5zbGFja1dlYmhvb2tTZWNyZXR9IH19YCxcbiAgICAgICAgICB9LFxuICAgICAgICB9KTtcbiAgICAgIH1cblxuICAgICAgdGhpcy53b3JrZmxvdy5hZGRKb2IoYGRlcGxveS0ke2Vudi5uYW1lfWAsIHtcbiAgICAgICAgbmFtZTogYERlcGxveSAoJHtlbnYubmFtZX0pYCxcbiAgICAgICAgaWY6IGBnaXRodWIuZXZlbnQuaW5wdXRzLmVudmlyb25tZW50ID09ICcke2Vudi5uYW1lfSdgLFxuICAgICAgICBydW5zT246IFsndWJ1bnR1LWxhdGVzdCddLFxuICAgICAgICBlbnZpcm9ubWVudDogZW52LnJlcXVpcmVzQXBwcm92YWwgPyBlbnYubmFtZSA6IHVuZGVmaW5lZCxcbiAgICAgICAgcGVybWlzc2lvbnM6IHtcbiAgICAgICAgICBpZFRva2VuOiBnaXRodWIud29ya2Zsb3dzLkpvYlBlcm1pc3Npb24uV1JJVEUsXG4gICAgICAgICAgY29udGVudHM6IGdpdGh1Yi53b3JrZmxvd3MuSm9iUGVybWlzc2lvbi5SRUFELFxuICAgICAgICB9LFxuICAgICAgICBzdGVwcyxcbiAgICAgIH0pO1xuICAgIH1cbiAgfVxufVxuIl19
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibWFudWFsLWRlcGxveS13b3JrZmxvdy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9jb21tb24vbWFudWFsLWRlcGxveS13b3JrZmxvdy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7QUFBQSxtQ0FBMkM7QUFDM0MsK0RBRytCO0FBZ0MvQixnQkFBZ0I7QUFDaEIsTUFBYSxvQkFBcUIsU0FBUSxrQkFBUztJQUNqQyxRQUFRLENBQXdCO0lBRWhELFlBQ0UsS0FBMkIsRUFDM0IsT0FBb0M7UUFFcEMsS0FBSyxDQUFDLEtBQUssRUFBRSxzQkFBc0IsQ0FBQyxDQUFDO1FBRXJDLE1BQU0sWUFBWSxHQUFHLElBQUEsMkNBQXFCLEVBQUMsT0FBTyxDQUFDLFlBQVksQ0FBQyxDQUFDO1FBQ2pFLE1BQU0sRUFBRSxHQUFHLEtBQUssQ0FBQyxNQUFNLENBQUM7UUFDeEIsSUFBSSxDQUFDLEVBQUUsRUFBRSxDQUFDO1lBQ1IsTUFBTSxJQUFJLEtBQUssQ0FDYixnRUFBZ0UsQ0FDakUsQ0FBQztRQUNKLENBQUM7UUFFRCxNQUFNLFlBQVksR0FBRyxPQUFPLENBQUMsWUFBWSxJQUFJLFFBQVEsQ0FBQztRQUN0RCxNQUFNLFdBQVcsR0FDZixPQUFPLENBQUMsV0FBVztZQUNuQixDQUFDLENBQUMsR0FBdUIsRUFBOEIsRUFBRSxDQUFDO2dCQUN4RDtvQkFDRSxJQUFJLEVBQUUsVUFBVSxHQUFHLENBQUMsSUFBSSxFQUFFO29CQUMxQixHQUFHLEVBQUUsdURBQXVELEdBQUcsQ0FBQyxJQUFJLElBQUk7aUJBQ3pFO2FBQ0YsQ0FBQyxDQUFDO1FBRUwsSUFBSSxDQUFDLFFBQVEsR0FBRyxJQUFJLGVBQU0sQ0FBQyxjQUFjLENBQUMsRUFBRSxFQUFFLFlBQVksQ0FBQyxDQUFDO1FBQzVELElBQUksQ0FBQyxRQUFRLENBQUMsRUFBRSxDQUFDO1lBQ2YsZ0JBQWdCLEVBQUU7Z0JBQ2hCLE1BQU0sRUFBRTtvQkFDTixXQUFXLEVBQUU7d0JBQ1gsV0FBVyxFQUFFLHVCQUF1Qjt3QkFDcEMsUUFBUSxFQUFFLElBQUk7d0JBQ2QsSUFBSSxFQUFFLFFBQVE7d0JBQ2QsT0FBTyxFQUFFLFlBQVksQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLEVBQUUsRUFBRSxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUM7cUJBQ3pDO29CQUNELE9BQU8sRUFBRTt3QkFDUCxXQUFXLEVBQ1QsZ0VBQWdFO3dCQUNsRSxRQUFRLEVBQUUsS0FBSztxQkFDaEI7aUJBQ0Y7YUFDRjtTQUNGLENBQUMsQ0FBQztRQUVILEtBQUssTUFBTSxHQUFHLElBQUksWUFBWSxFQUFFLENBQUM7WUFDL0IsTUFBTSxLQUFLLEdBQStCO2dCQUN4QztvQkFDRSxJQUFJLEVBQUUsVUFBVTtvQkFDaEIsSUFBSSxFQUFFLHFCQUFxQjtvQkFDM0IsSUFBSSxFQUFFO3dCQUNKLEdBQUcsRUFBRSxrREFBa0Q7cUJBQ3hEO2lCQUNGO2dCQUNELEdBQUcsV0FBVyxDQUFDLEdBQUcsQ0FBQzthQUNwQixDQUFDO1lBRUYsSUFBSSxDQUFDLFFBQVEsQ0FBQyxNQUFNLENBQUMsVUFBVSxHQUFHLENBQUMsSUFBSSxFQUFFLEVBQUU7Z0JBQ3pDLElBQUksRUFBRSxXQUFXLEdBQUcsQ0FBQyxJQUFJLEdBQUc7Z0JBQzVCLEVBQUUsRUFBRSx1Q0FBdUMsR0FBRyxDQUFDLElBQUksR0FBRztnQkFDdEQsTUFBTSxFQUFFLENBQUMsZUFBZSxDQUFDO2dCQUN6QixXQUFXLEVBQUUsR0FBRyxDQUFDLGdCQUFnQixDQUFDLENBQUMsQ0FBQyxHQUFHLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxTQUFTO2dCQUN4RCxXQUFXLEVBQUU7b0JBQ1gsT0FBTyxFQUFFLGVBQU0sQ0FBQyxTQUFTLENBQUMsYUFBYSxDQUFDLEtBQUs7b0JBQzdDLFFBQVEsRUFBRSxlQUFNLENBQUMsU0FBUyxDQUFDLGFBQWEsQ0FBQyxJQUFJO2lCQUM5QztnQkFDRCxLQUFLO2FBQ04sQ0FBQyxDQUFDO1FBQ0wsQ0FBQztJQUNILENBQUM7Q0FDRjtBQXZFRCxvREF1RUMiLCJzb3VyY2VzQ29udGVudCI6WyJpbXBvcnQgeyBDb21wb25lbnQsIGdpdGh1YiB9IGZyb20gJ3Byb2plbic7XG5pbXBvcnQge1xuICBFbnZpcm9ubWVudE9wdGlvbnMsXG4gIG5vcm1hbGl6ZUVudmlyb25tZW50cyxcbn0gZnJvbSAnLi9lbnZpcm9ubWVudC1vcHRpb25zJztcblxuLyoqXG4gKiBTaGFyZWQsIGVudmlyb25tZW50LXBhcmFtZXRlcml6ZWQgbWFudWFsLWRpc3BhdGNoIGRlcGxveSB3b3JrZmxvdy5cbiAqXG4gKiBUaGlzIGlzIHRoZSBvbmUgXCJ0cmlnZ2VyIGEgZGVwbG95XCIgY29udHJhY3QgdXNlZCBieSBib3RoIHRoZSBDREsgcHJvamVjdFxuICogdHlwZXMgKGRlcGxveWluZyB0aGVpciBvd24gc3RhY2tzKSBhbmQgdGhlIEphdmEgYENka0RlcGxveUhvb2tgIGNvbXBvbmVudFxuICogKGRpc3BhdGNoaW5nIGEgZGVwbG95IGluIGEgY29tcGFuaW9uIENESyByZXBvKSAtIHNlZSB0aGUgXCJPcGVuIFF1ZXN0aW9uc1wiXG4gKiBzZWN0aW9ucyBvZiB0aGUgdHdvIHNwZWNzLlxuICpcbiAqIEBpbnRlcm5hbCAtIG5vdCBwYXJ0IG9mIHRoZSBqc2lpLWV4cG9ydGVkIEFQSSAoaXRzIGBkZXBsb3lTdGVwc2AgY2FsbGJhY2tcbiAqIGlzbid0IHJlcHJlc2VudGFibGUgYWNyb3NzIGpzaWkgbGFuZ3VhZ2VzKTsgY29uc3VtZWQgZGlyZWN0bHkgYnkgb3RoZXJcbiAqIFR5cGVTY3JpcHQgc291cmNlIGluIHRoaXMgcGFja2FnZS5cbiAqL1xuZXhwb3J0IGludGVyZmFjZSBNYW51YWxEZXBsb3lXb3JrZmxvd09wdGlvbnMge1xuICAvKiogRGVwbG95IHRhcmdldHMgZXhwb3NlZCBhcyB0aGUgYGVudmlyb25tZW50YCB3b3JrZmxvd19kaXNwYXRjaCBjaG9pY2UuICovXG4gIHJlYWRvbmx5IGVudmlyb25tZW50czogKHN0cmluZyB8IEVudmlyb25tZW50T3B0aW9ucylbXTtcblxuICAvKiogQGRlZmF1bHQgXCJkZXBsb3lcIiAqL1xuICByZWFkb25seSB3b3JrZmxvd05hbWU/OiBzdHJpbmc7XG5cbiAgLyoqXG4gICAqIFRoZSBzdGVwcyB0aGF0IGFjdHVhbGx5IHBlcmZvcm0gdGhlIGRlcGxveSBmb3IgYSBnaXZlbiBlbnZpcm9ubWVudC5cbiAgICogRGVmYXVsdHMgdG8gYSBwbGFjZWhvbGRlciBgZWNob2Agc3RlcCAtIHByb2plY3QgdHlwZXMgYXJlIGV4cGVjdGVkIHRvXG4gICAqIG92ZXJyaWRlIHRoaXMgd2l0aCBzb21ldGhpbmcgcmVhbCAoZS5nLiBgY2RrIGRlcGxveWAsIG9yIGFcbiAgICogYHJlcG9zaXRvcnlfZGlzcGF0Y2hgIHRvIGEgY29tcGFuaW9uIGluZnJhIHJlcG8pLlxuICAgKi9cbiAgcmVhZG9ubHkgZGVwbG95U3RlcHM/OiAoXG4gICAgZW52OiBFbnZpcm9ubWVudE9wdGlvbnMsXG4gICkgPT4gZ2l0aHViLndvcmtmbG93cy5Kb2JTdGVwW107XG59XG5cbi8qKiBAaW50ZXJuYWwgKi9cbmV4cG9ydCBjbGFzcyBNYW51YWxEZXBsb3lXb3JrZmxvdyBleHRlbmRzIENvbXBvbmVudCB7XG4gIHB1YmxpYyByZWFkb25seSB3b3JrZmxvdzogZ2l0aHViLkdpdGh1YldvcmtmbG93O1xuXG4gIGNvbnN0cnVjdG9yKFxuICAgIHNjb3BlOiBnaXRodWIuR2l0SHViUHJvamVjdCxcbiAgICBvcHRpb25zOiBNYW51YWxEZXBsb3lXb3JrZmxvd09wdGlvbnMsXG4gICkge1xuICAgIHN1cGVyKHNjb3BlLCAnTWFudWFsRGVwbG95V29ya2Zsb3cnKTtcblxuICAgIGNvbnN0IGVudmlyb25tZW50cyA9IG5vcm1hbGl6ZUVudmlyb25tZW50cyhvcHRpb25zLmVudmlyb25tZW50cyk7XG4gICAgY29uc3QgZ2ggPSBzY29wZS5naXRodWI7XG4gICAgaWYgKCFnaCkge1xuICAgICAgdGhyb3cgbmV3IEVycm9yKFxuICAgICAgICAnTWFudWFsRGVwbG95V29ya2Zsb3cgcmVxdWlyZXMgR2l0SHViIGludGVncmF0aW9uIHRvIGJlIGVuYWJsZWQnLFxuICAgICAgKTtcbiAgICB9XG5cbiAgICBjb25zdCB3b3JrZmxvd05hbWUgPSBvcHRpb25zLndvcmtmbG93TmFtZSA/PyAnZGVwbG95JztcbiAgICBjb25zdCBkZXBsb3lTdGVwcyA9XG4gICAgICBvcHRpb25zLmRlcGxveVN0ZXBzID8/XG4gICAgICAoKGVudjogRW52aXJvbm1lbnRPcHRpb25zKTogZ2l0aHViLndvcmtmbG93cy5Kb2JTdGVwW10gPT4gW1xuICAgICAgICB7XG4gICAgICAgICAgbmFtZTogYERlcGxveSAke2Vudi5uYW1lfWAsXG4gICAgICAgICAgcnVuOiBgZWNobyBcIlRPRE86IGltcGxlbWVudCBkZXBsb3kgc3RlcHMgZm9yIGVudmlyb25tZW50ICcke2Vudi5uYW1lfSdcImAsXG4gICAgICAgIH0sXG4gICAgICBdKTtcblxuICAgIHRoaXMud29ya2Zsb3cgPSBuZXcgZ2l0aHViLkdpdGh1YldvcmtmbG93KGdoLCB3b3JrZmxvd05hbWUpO1xuICAgIHRoaXMud29ya2Zsb3cub24oe1xuICAgICAgd29ya2Zsb3dEaXNwYXRjaDoge1xuICAgICAgICBpbnB1dHM6IHtcbiAgICAgICAgICBlbnZpcm9ubWVudDoge1xuICAgICAgICAgICAgZGVzY3JpcHRpb246ICdFbnZpcm9ubWVudCB0byBkZXBsb3knLFxuICAgICAgICAgICAgcmVxdWlyZWQ6IHRydWUsXG4gICAgICAgICAgICB0eXBlOiAnY2hvaWNlJyxcbiAgICAgICAgICAgIG9wdGlvbnM6IGVudmlyb25tZW50cy5tYXAoKGUpID0+IGUubmFtZSksXG4gICAgICAgICAgfSxcbiAgICAgICAgICBnaXRfc2hhOiB7XG4gICAgICAgICAgICBkZXNjcmlwdGlvbjpcbiAgICAgICAgICAgICAgJ09wdGlvbmFsIGNvbW1pdCBTSEEgdG8gZGVwbG95IChkZWZhdWx0cyB0byB0aGUgZGVmYXVsdCBicmFuY2gpJyxcbiAgICAgICAgICAgIHJlcXVpcmVkOiBmYWxzZSxcbiAgICAgICAgICB9LFxuICAgICAgICB9LFxuICAgICAgfSxcbiAgICB9KTtcblxuICAgIGZvciAoY29uc3QgZW52IG9mIGVudmlyb25tZW50cykge1xuICAgICAgY29uc3Qgc3RlcHM6IGdpdGh1Yi53b3JrZmxvd3MuSm9iU3RlcFtdID0gW1xuICAgICAgICB7XG4gICAgICAgICAgbmFtZTogJ0NoZWNrb3V0JyxcbiAgICAgICAgICB1c2VzOiAnYWN0aW9ucy9jaGVja291dEB2NCcsXG4gICAgICAgICAgd2l0aDoge1xuICAgICAgICAgICAgcmVmOiAnJHt7IGdpdGh1Yi5ldmVudC5pbnB1dHMuZ2l0X3NoYSB8fCBnaXRodWIuc2hhIH19JyxcbiAgICAgICAgICB9LFxuICAgICAgICB9LFxuICAgICAgICAuLi5kZXBsb3lTdGVwcyhlbnYpLFxuICAgICAgXTtcblxuICAgICAgdGhpcy53b3JrZmxvdy5hZGRKb2IoYGRlcGxveS0ke2Vudi5uYW1lfWAsIHtcbiAgICAgICAgbmFtZTogYERlcGxveSAoJHtlbnYubmFtZX0pYCxcbiAgICAgICAgaWY6IGBnaXRodWIuZXZlbnQuaW5wdXRzLmVudmlyb25tZW50ID09ICcke2Vudi5uYW1lfSdgLFxuICAgICAgICBydW5zT246IFsndWJ1bnR1LWxhdGVzdCddLFxuICAgICAgICBlbnZpcm9ubWVudDogZW52LnJlcXVpcmVzQXBwcm92YWwgPyBlbnYubmFtZSA6IHVuZGVmaW5lZCxcbiAgICAgICAgcGVybWlzc2lvbnM6IHtcbiAgICAgICAgICBpZFRva2VuOiBnaXRodWIud29ya2Zsb3dzLkpvYlBlcm1pc3Npb24uV1JJVEUsXG4gICAgICAgICAgY29udGVudHM6IGdpdGh1Yi53b3JrZmxvd3MuSm9iUGVybWlzc2lvbi5SRUFELFxuICAgICAgICB9LFxuICAgICAgICBzdGVwcyxcbiAgICAgIH0pO1xuICAgIH1cbiAgfVxufVxuIl19