@xpertss/projen-types 0.0.2 → 0.0.4

package/.jsii

@@ -106,7 +106,7 @@
   },
   "name": "@xpertss/projen-types",
   "readme": {
-    "markdown": "# @xpertss/projen-types\n\nProjen project types for CDK/TypeScript and Java/Maven projects.\n\nInstead of hand-maintaining `pom.xml`, `cdk.json`, and GitHub workflows, you declare a project type in a `.projenrc.ts` file and let [projen](https://github.com/projen/projen) generate (and keep up to date) the whole scaffold: build files, source skeletons, CI workflows, and deploy pipelines.\n\n## Project types at a glance\n\n| Type | What it is | Publishes to | Generated workflows |\n| --- | --- | --- | --- |\n| `CdkInfraProject` | Pure-infrastructure CDK stacks (CloudFront, Route53, SQS, API Gateway, Cognito, ECR/ECS for externally-built images) | - | `build` (PR checks), `deploy` (manual dispatch) |\n| `CdkAppProject` | Full TypeScript service behind API Gateway: infra + app source + database | - | `build`, `deploy`, `app-build` (PR checks) |\n| `JavaLibraryProject` | Reusable Java library | Maven Central | `build`, `upgrade` (nightly), `publish-maven-central`, `codeindex` |\n| `JavaServiceProject` | Spring Boot service | Docker Hub | `build`, `upgrade` (nightly), `publish-docker`, `deploy-cdk` |\n| `JavaAppProject` | GUI/TUI/CLI Java application | GitHub Packages | `build`, `upgrade` (nightly), `publish-ghpackages` |\n| `GitHubActionProject` | Reusable GitHub Action or Workflow | GitHub Releases | `build`, `test-dogfood`, `sonar`, `release` |\n\nTwo foundation classes are also exported for advanced use: `CdkTypescriptProject` (shared CDK + TypeScript base for the CDK types) and `JavaMavenProject` (shared Maven base for the Java types).\n\nAll project types:\n\n- run a **drift check** in PR builds - a job that re-runs projen and fails if generated files were hand-edited. Edit `.projenrc.ts`, then run `npx projen`; never edit generated files directly.\n- use the GitHub secret `PROJEN_GITHUB_TOKEN` (a fine-grained PAT) for projen's automation. Override with `gheTokenSecret`.\n- make all publishing/deploying **manual** (workflow_dispatch) rather than on every merge.\n\n## Getting started\n\nCreate a new git repository and install the dependencies:\n\n```bash\nmkdir my-project && cd my-project\ngit init\nnpm install -D projen constructs @xpertss/projen-types\n```\n\nWrite a `.projenrc.ts` (see examples below), then generate the project:\n\n```bash\nnpx projen\n```\n\nCommit the result. From then on, every change to the scaffold goes through `.projenrc.ts` followed by `npx projen`.\n\nThe `name` option must match the `name` field in the project's `package.json` (for the CDK types) or the project name used by projen's `java.JavaProject` (for the Java types).\n\n## Examples\n\n### CdkInfraProject\n\nPure infrastructure stacks with optional ECR/ECS and edge-networking constructs.\n\n```typescript\n// .projenrc.ts\nimport { CdkInfraProject } from '@xpertss/projen-types';\n\nconst project = new CdkInfraProject({\n  name: 'media-edge-infra',\n  environments: [\n    'dev',\n    { name: 'stage', accountId: '111111111111', region: 'eu-central-1' },\n    { name: 'prod', accountId: '222222222222', region: 'eu-central-1', requiresApproval: true },\n  ],\n  edgeResources: ['cloudfront', 'route53', 'sqs'],\n  ecrEcs: { enabled: true, externalImageSource: true },\n  slackWebhookSecret: 'SLACK_DEPLOY_WEBHOOK',\n});\n\nproject.synth();\n```\n\nYou get:\n\n- `cdk.json`, `cdk synth` / `cdk diff` / `cdk deploy` tasks, and the standard `AwsCdkTypeScriptApp` layout (CDK 2.189.1 by default).\n- `.github/workflows/build.yml` - PR build that hard-fails on projen drift.\n- `.github/workflows/deploy.yml` - manual dispatch with one `deploy-<env>` job per environment (runs `cdk deploy --all` with `--context environment=<env>`); `requiresApproval` environments get a GitHub Environment approval gate; a Slack notification step is added when `slackWebhookSecret` is set.\n- `src/constructs/edge-networking.ts` - helper constructs only for the requested `edgeResources` (`cloudfront`, `route53`, `apigateway`, `cognito`, `sqs`).\n- `src/constructs/ecr-ecs.ts` when `ecrEcs.enabled` - ECR repo + Fargate service; `externalImageSource: true` (default) means the service pulls an image built outside this repo.\n\n### CdkAppProject\n\n`CdkInfraProject` plus application source, a database construct, and an app-level build workflow.\n\n```typescript\n// .projenrc.ts\nimport { CdkAppProject } from '@xpertss/projen-types';\n\nconst project = new CdkAppProject({\n  name: 'video-api',\n  environments: ['dev', 'prod'],\n  edgeResources: ['apigateway'],\n  database: { engine: 'postgres', migrationTool: 'flyway' },\n  appEntryPoint: 'src/app.ts',\n});\n\nproject.synth();\n```\n\nEverything from `CdkInfraProject`, plus:\n\n- `src/app.ts` - application entrypoint stub (`export function handler()`).\n- `src/handlers/example.ts` - API Gateway proxy handler stub, with `@types/aws-lambda` added as a dev dependency.\n- `src/constructs/database.ts` - a `Database` construct stub for the chosen engine (`postgres`/`mysql` -> RDS, `dynamodb` -> DynamoDB). `migrationTool` (no default, intentionally) is added as a dev dependency and referenced in the stub - wiring it up is left to you.\n- `.github/workflows/app-build.yml` - runs the project's test task on every PR, then checks for projen drift.\n\n### JavaLibraryProject\n\nA reusable Java library published to Maven Central.\n\n```typescript\n// .projenrc.ts\nimport { JavaLibraryProject } from '@xpertss/projen-types';\n\nconst project = new JavaLibraryProject({\n  name: 'common-utils',\n  groupId: 'org.xpertss',\n  artifactId: 'common-utils',\n  version: '1.0.0',\n  sonarProjectKey: 'org.xpertss:common-utils',\n  mavenCentralOidc: true,\n});\n\nproject.synth();\n```\n\nYou get:\n\n- `pom.xml` (via projen's `java.JavaProject`) with the given GAV coordinates.\n- `.github/workflows/build.yml` - PR build + projen drift check, plus a SonarQube scan step when `sonarProjectKey` is set (needs a `SONAR_TOKEN` secret).\n- `.github/workflows/upgrade.yml` - nightly (03:00 UTC) PR running `mvn versions:use-latest-releases versions:update-properties`.\n- `.github/workflows/publish-maven-central.yml` - manual dispatch running `mvn -B deploy -P release`. With `mavenCentralOidc: true` it uses Maven Central's OIDC trusted publishing (no GPG secrets needed); otherwise it expects the secrets `MAVEN_GPG_PRIVATE_KEY`, `MAVEN_GPG_PASSPHRASE`, `MAVEN_CENTRAL_USERNAME`, `MAVEN_CENTRAL_PASSWORD`.\n- `.github/workflows/codeindex.yml` - on push to `main`, generates a Java source index under `.cai/` (disable with `publishCodeIndex: false`).\n\n### JavaServiceProject\n\nA Spring Boot service that publishes a Docker image and can trigger deploys in a companion CDK repo.\n\n```typescript\n// .projenrc.ts\nimport { JavaServiceProject } from '@xpertss/projen-types';\n\nconst project = new JavaServiceProject({\n  name: 'stream-processor',\n  groupId: 'org.xpertss',\n  artifactId: 'stream-processor',\n  dockerRegistry: 'docker.io/xpertss',\n  cdkDeployHook: { targetRepo: 'xpertss/stream-infra' },\n  environments: ['dev', { name: 'prod', requiresApproval: true }],\n});\n\nproject.synth();\n```\n\nYou get (everything from `JavaMavenProject` - `pom.xml`, `build` + drift check, nightly `upgrade` - plus):\n\n- `spring-boot-starter-web` added to the pom.\n- `.github/workflows/publish-docker.yml` - manual dispatch: `mvn -B package && docker build -t <registry>/<name>:<sha>`, logged in with the `DOCKER_USERNAME` / `DOCKER_PASSWORD` secrets. `dockerRegistry` defaults to `docker.io`.\n- Flyway wiring when `useFlyway` (default `true`): `flyway-maven-plugin` ^10 + `flyway-core` ^10 in the pom, and `src/main/resources/db/migration/V1__init.sql`.\n- `.github/workflows/deploy-cdk.yml` (the `CdkDeployHook`, enabled by default) - manual dispatch with an environment selector; each job sends a `workflow_dispatch` to `deploy.yml` in the companion `targetRepo` (a `CdkInfraProject`/`CdkAppProject` repo). `targetRepo` is required when the hook is enabled; disable it with `cdkDeployHook: { enabled: false }`. `environments` defaults to `['prod']`.\n\n### JavaAppProject\n\nA GUI/TUI/CLI Java application published to GitHub Packages only - no Maven Central, no Docker, no CDK deploy hook.\n\n```typescript\n// .projenrc.ts\nimport { JavaAppProject } from '@xpertss/projen-types';\n\nconst project = new JavaAppProject({\n  name: 'studio-cli',\n  groupId: 'org.xpertss',\n  artifactId: 'studio-cli',\n  ghPackagesRegistry: 'https://maven.pkg.github.com/xpertss/studio-cli',\n});\n\nproject.synth();\n```\n\nYou get everything from `JavaMavenProject`, plus `.github/workflows/publish-ghpackages.yml` - manual dispatch running `mvn -B deploy -DaltDeploymentRepository=github::<registry>`, authenticated with `GITHUB_TOKEN`. `ghPackagesRegistry` defaults to `https://maven.pkg.github.com/<repo>` derived from the repository URL.\n\n### GitHubActionProject\n\nA reusable GitHub Action or Workflow. This example scaffolds an action that stages a folder and, only if it changed, commits and pushes it.\n\n```typescript\n// .projenrc.ts\nimport { GitHubActionProject } from '@xpertss/projen-types';\n\nconst project = new GitHubActionProject({\n  name: 'auto-commit',\n  description: 'Stage a folder and, only if it changed, commit and push it',\n  sonarHostUrl: 'https://sonar.xpertss.org',   // required, no default - your self-hosted SonarQube\n  dogfood: {\n    // Two scenario steps: the \"changed\" path and the \"no-op\" path are both\n    // load-bearing behavior for this action (a double-commit or a\n    // push-when-empty bug is the failure mode a hand-rolled inline-shell\n    // alternative is most likely to introduce).\n    scenario: [\n      {\n        name: 'Changed path',\n        fixtureSteps: [\n          'echo \"$(date -u +%Y%m%dT%H%M%SZ)\" >> test/fixtures/dogfood-state.txt',\n        ],\n        inputs: {\n          commit_message: 'test: dogfood',\n          branches: 'test/dogfood',\n        },\n        assertions: [\n          // step id defaults to a slug of `name` - here \"changed-path-0\"\n          '[ \"${{ steps.changed-path-0.outputs.committed }}\" = \"true\" ]',\n        ],\n      },\n      {\n        // No fixture change this time - nothing new to commit.\n        name: 'No-op path',\n        id: 'no-op-check',            // pin an explicit id instead of relying on the default slug\n        inputs: {\n          commit_message: 'test: dogfood',\n          branches: 'test/dogfood',\n        },\n        assertions: [\n          '[ \"${{ steps.no-op-check.outputs.committed }}\" = \"false\" ]',\n        ],\n      },\n    ],\n    cleanup: [\n      'git push origin --delete test/dogfood || true',\n    ],\n  },\n});\n\nproject.synth();\n```\n\nYou get:\n\n- `action.yml` and `auto-commit.sh` are hand-written - this type only lints their content via `build.yml`'s shellcheck/yamllint/actionlint checks.\n- `.github/workflows/build.yml` - lint gate: `apt`-installed shellcheck/yamllint plus a pinned, SHA-256-verified `actionlint` release binary. Gates `main` alongside `sonar.yml`.\n- `.github/workflows/test-dogfood.yml` - runs the `dogfood.scenario` steps above against this repo's own `action.yml` (via `uses: .`), then the shared `cleanup`, on `workflow_dispatch`, every `pull_request`, and nightly.\n- `.github/workflows/sonar.yml` - self-hosted SonarQube via the Scanner CLI, scanning `action.yml`/`.github/workflows/**`/`**/*.sh` explicitly.\n- `.github/workflows/release.yml` - `feat:`/`fix:` commits on `main` bump the version, tag `vX.Y.Z`, and create a GitHub Release.\n- `.github/workflows/projen-drift-check.yml`, `workflow-change-notice.yml`, `actions-allowlist-guard.yml` - drift detection, a change notice, and an action allow-list guard, always included.\n- `package.json` (**private**, version source only), `tsconfig.json`, `.yamllint`, `LICENSE` (MIT by default), and a `README.md` template - all regenerated by `npx projen`.\n\nNeeds the same two secrets as everything else in this package: `PROJEN_GITHUB_TOKEN` (used for automated PR comments) and `SONAR_TOKEN` (the Sonar scan). Onboarding a brand-new action repo from scratch: `npm init -y && npm install -D projen constructs @xpertss/projen-types`, write the `.projenrc.ts` above, `npx projen && npm install`, then hand-write `action.yml`/`auto-commit.sh`/`test/fixtures/`.\n\n## Common options\n\nCDK project types (`CdkInfraProjectOptions` / `CdkAppProjectOptions`):\n\n| Option | Default | Description |\n| --- | --- | --- |\n| `name` | - (required) | Project name; must match `package.json` |\n| `cdkVersion` | `2.189.1` | AWS CDK version |\n| `gheTokenSecret` | `PROJEN_GITHUB_TOKEN` | GitHub secret holding projen's PAT |\n| `slackWebhookSecret` | - | GitHub secret with a Slack webhook URL for deploy notifications |\n| `environments` | - (required) | Deploy targets for the `deploy` workflow; strings or `EnvironmentOptions` |\n| `ecrEcs` | - | `EcrEcsOptions` - `enabled`, `externalImageSource` (default `true`) |\n| `edgeResources` | - | Subset of `cloudfront`, `route53`, `apigateway`, `cognito`, `sqs` |\n| `database` | - (app only) | `DatabaseOptions` - `engine` (`postgres`/`mysql`/`dynamodb`, default `postgres`), `migrationTool` |\n| `appEntryPoint` | `src/app.ts` (app only) | Path of the generated application entrypoint |\n\nJava project types (`JavaLibraryProjectOptions` / `JavaServiceProjectOptions` / `JavaAppProjectOptions`):\n\n| Option | Default | Description |\n| --- | --- | --- |\n| `name` | - (required) | Project name |\n| `groupId` | - (required) | Maven group id |\n| `artifactId` | - (required) | Maven artifact id |\n| `version` | `0.1.0` | Maven version |\n| `sonarProjectKey` | - | SonarQube project key; the sonar step is skipped when unset |\n| `gheTokenSecret` | `PROJEN_GITHUB_TOKEN` | GitHub secret holding projen's PAT |\n\n`EnvironmentOptions` for deploy targets:\n\n```typescript\ninterface EnvironmentOptions {\n  readonly name: string;              // e.g. \"dev\", \"stage\", \"prod\"\n  readonly accountId?: string;        // AWS account id (CDK deploys)\n  readonly region?: string;           // AWS region (CDK deploys)\n  readonly requiresApproval?: boolean; // GitHub Environment approval gate (default false)\n}\n```\n\nPlain strings (`'dev'`) are shorthand for `{ name: 'dev' }`.\n\n`GitHubActionProjectOptions`:\n\n| Option | Default | Description |\n| --- | --- | --- |\n| `name` | - (required) | Project name |\n| `description` | - | One-line description; used in the default README template and recorded in the private `package.json` |\n| `sonarHostUrl` | - (required) | URL of your self-hosted SonarQube instance; must be reachable from github.com-hosted runners |\n| `sonarTokenSecret` | `SONAR_TOKEN` | GitHub secret holding the Sonar token |\n| `sonarPullRequestGate` | `true` | Whether `sonar.yml` also runs on `pull_request` as a pass/fail gate |\n| `dogfood` | - (required) | `ActionDogfoodOptions` - the scenario that exercises the action end-to-end via `uses: .` |\n| `license` | `MIT` | SPDX identifier for the generated `LICENSE` |\n| `gheTokenSecret` | `PROJEN_GITHUB_TOKEN` | GitHub secret holding projen's PAT |\n\n`ActionDogfoodOptions`/`ActionDogfoodStep` - the dogfood scenario (`test-dogfood.yml`):\n\n```typescript\ninterface ActionDogfoodOptions {\n  readonly scenario: ActionDogfoodStep[]; // one or more, run in order - required\n  readonly cleanup: string[];             // shared, run once at the end with `if: always()` - required\n}\n\ninterface ActionDogfoodStep {\n  readonly name: string;                    // labels this step-group's generated workflow steps\n  readonly id?: string;                     // step id for the `uses: .` call; default: a slug of `name`\n  readonly fixtureSteps?: string[];         // shell, before the invocation (default: none)\n  readonly inputs?: Record<string, string>; // `with:` for this invocation (default: none)\n  readonly assertions: string[];            // shell, after the invocation - required, job fails unless all exit 0\n}\n```\n\nMost actions need exactly one `scenario` step. Actions with a re-run/no-op/idempotency behavior to verify (e.g. `auto-commit`'s no-op-on-no-change path, `create-pull-request`'s reuse-the-PR path) declare two - the second typically omits `fixtureSteps` so its invocation sees no new state, and its assertion checks the opposite outcome of the first. Reference an invocation's own outputs from a later assertion via `${{ steps.<id>.outputs.<name> }}`, using either the default slug or an explicit `id`.\n\n## Required GitHub secrets\n\n| Secret | Used by | Notes |\n| --- | --- | --- |\n| `PROJEN_GITHUB_TOKEN` | all types | PAT for projen's self-mutation/automation; override via `gheTokenSecret` |\n| `SONAR_TOKEN` | Java types with `sonarProjectKey`; `GitHubActionProject` | SonarQube scan step in `build.yml` / `sonar.yml`; override via `sonarTokenSecret` on `GitHubActionProject` |\n| `DOCKER_USERNAME` / `DOCKER_PASSWORD` | `JavaServiceProject` | Docker image push |\n| `MAVEN_GPG_PRIVATE_KEY`, `MAVEN_GPG_PASSPHRASE`, `MAVEN_CENTRAL_USERNAME`, `MAVEN_CENTRAL_PASSWORD` | `JavaLibraryProject` without `mavenCentralOidc` | Not needed with OIDC trusted publishing |\n| (your Slack webhook secret) | CDK types with `slackWebhookSecret` | Deploy notifications |\n\n## Going further\n\nThe project types are composed from smaller components you can also attach to your own projects:\n\n| Component | Applies to | Purpose |\n| --- | --- | --- |\n| `AppRuntimeScaffold` | `NodeProject` | App source skeleton (`app.ts` + handlers) |\n| `DatabaseComponent` | `NodeProject` | Database construct stub + migration tool wiring |\n| `EcrEcsConstructs` | `Project` | ECR + Fargate ECS construct helper |\n| `EdgeNetworkingConstructs` | `Project` | Per-resource edge networking construct helpers |\n| `MavenCentralPublish` | `JavaProject` | Manual-dispatch Maven Central publish workflow |\n| `DockerPublish` | `JavaProject` | Manual-dispatch Docker build+push workflow |\n| `GitHubPackagesPublish` | `JavaProject` | Manual-dispatch GitHub Packages publish workflow |\n| `FlywayMigration` | `JavaProject` | Flyway plugin/dependency + migrations directory |\n| `CdkDeployHook` | `JavaProject` | Manual-dispatch workflow that triggers `deploy.yml` in a companion CDK repo |\n| `CodeIndexWorkflow` | `JavaProject` | Code index generation on push to `main` |\n| `ActionBuildWorkflow` | `GitHubProject` | The `lint` task (shellcheck/yamllint/pinned actionlint) + `build.yml` |\n| `ActionDogfoodWorkflow` | `GitHubProject` | `test-dogfood.yml` from an `ActionDogfoodOptions` scenario |\n| `ActionSonarWorkflow` | `GitHubProject` | `sonar.yml` (self-hosted SonarQube via the Scanner CLI) |\n\nExample - adding a Docker publish to a plain projen `JavaProject`:\n\n```typescript\nimport { java } from 'projen';\nimport { DockerPublish } from '@xpertss/projen-types';\n\nconst project = new java.JavaProject({\n  name: 'my-service',\n  groupId: 'org.xpertss',\n  artifactId: 'my-service',\n});\n\nnew DockerPublish(project, { dockerRegistry: 'ghcr.io' });\n\nproject.synth();\n```\n\nThe full API reference, including every option and property, is in [API.md](./API.md).\n"
+    "markdown": "# @xpertss/projen-types\n\nProjen project types for CDK/TypeScript and Java/Maven projects.\n\nInstead of hand-maintaining `pom.xml`, `cdk.json`, and GitHub workflows, you declare a project type in a `.projenrc.ts` file and let [projen](https://github.com/projen/projen) generate (and keep up to date) the whole scaffold: build files, source skeletons, CI workflows, and deploy pipelines.\n\n## Project types at a glance\n\n| Type | What it is | Publishes to | Generated workflows |\n| --- | --- | --- | --- |\n| `CdkInfraProject` | Pure-infrastructure CDK stacks (CloudFront, Route53, SQS, API Gateway, Cognito, ECR/ECS for externally-built images) | - | `build` (PR checks), `deploy` (manual dispatch) |\n| `CdkAppProject` | Full TypeScript service behind API Gateway: infra + app source + database | - | `build`, `deploy`, `app-build` (PR checks) |\n| `JavaLibraryProject` | Reusable Java library | Maven Central | `build`, `upgrade` (nightly), `publish-maven-central`, `codeindex` |\n| `JavaServiceProject` | Spring Boot service | Docker Hub | `build`, `upgrade` (nightly), `publish-docker`, `deploy-cdk` |\n| `JavaAppProject` | GUI/TUI/CLI Java application | GitHub Packages | `build`, `upgrade` (nightly), `publish-ghpackages` |\n| `GitHubActionProject` | Reusable GitHub Action or Workflow | GitHub Releases | `build`, `test-dogfood`, `sonar`, `release` |\n\nTwo foundation classes are also exported for advanced use: `CdkTypescriptProject` (shared CDK + TypeScript base for the CDK types) and `JavaMavenProject` (shared Maven base for the Java types).\n\nAll project types:\n\n- run a **drift check** in PR builds - a job that re-runs projen and fails if generated files were hand-edited. Edit `.projenrc.ts`, then run `npx projen`; never edit generated files directly.\n- use the GitHub secret `PROJEN_GITHUB_TOKEN` (a fine-grained PAT) for projen's automation. Override with `gheTokenSecret`.\n- make all publishing/deploying **manual** (workflow_dispatch) rather than on every merge.\n\n## Getting started\n\nScaffold the repo with projen's own bootstrap, pointed at this package:\n\n```bash\nmkdir my-project && cd my-project\ngit init\nnpx projen new --from @xpertss/projen-types cdk_infra --name my-project\n```\n\nThat writes a starter `.projenrc.ts`, synthesizes the whole scaffold and\ninstalls dependencies. The type names `projen new` accepts are `cdk_infra`,\n`cdk_app`, `java_library`, `java_service`, `java_app` and\n`git_hub_action`; pass a bogus one to have it list them. Required options\nbecome flags: `--name` for every type, plus `--group-id`/`--artifact-id`\n(Java) and `--sonar-host-url` (`git_hub_action`). Any other plainly-typed\noption can be passed the same way - `--cdk-deploy-target-repo owner/repo`,\n`--docker-registry ghcr.io`, `--no-use-flyway`, and so on.\n\nCommit the result. From then on, every change to the scaffold goes through\n`.projenrc.ts` followed by `npx projen`:\n\n```bash\nnpx projen\n```\n\nEvery type scaffolds from that one command; no option is *required* that\n`projen new` cannot pass. The structured options - `environments` and\n`GitHubActionProject`'s `dogfood` - are ones projen's CLI cannot render\ninto a projenrc, so they are added afterwards by editing `.projenrc.ts` and\nre-running `npx projen`. Leaving `environments` out simply generates no\ndeploy workflow; leaving `dogfood` out (or a service's\n`cdkDeployTargetRepo`) still generates the workflow, with one step that\nfails and tells you what to add - a gate this package considers load-bearing\nis allowed to be missing loudly, never silently.\n\nThe `name` option must match the `name` field in the project's `package.json` (for the CDK types) or the project name used by projen's `java.JavaProject` (for the Java types).\n\n## Examples\n\n### CdkInfraProject\n\nPure infrastructure stacks with optional ECR/ECS and edge-networking constructs.\n\n```typescript\n// .projenrc.ts\nimport { CdkInfraProject } from '@xpertss/projen-types';\n\nconst project = new CdkInfraProject({\n  name: 'media-edge-infra',\n  environments: [\n    'dev',\n    { name: 'stage', accountId: '111111111111', region: 'eu-central-1' },\n    { name: 'prod', accountId: '222222222222', region: 'eu-central-1', requiresApproval: true },\n  ],\n  edgeResources: ['cloudfront', 'route53', 'sqs'],\n  ecrEcs: { enabled: true, externalImageSource: true },\n  slackWebhookSecret: 'SLACK_DEPLOY_WEBHOOK',\n});\n\nproject.synth();\n```\n\nYou get:\n\n- `cdk.json`, `cdk synth` / `cdk diff` / `cdk deploy` tasks, and the standard `AwsCdkTypeScriptApp` layout (CDK 2.189.1 by default).\n- `.github/workflows/build.yml` - PR build that hard-fails on projen drift.\n- `.github/workflows/deploy.yml` - manual dispatch with one `deploy-<env>` job per environment (runs `cdk deploy --all` with `--context environment=<env>`); `requiresApproval` environments get a GitHub Environment approval gate; a Slack notification step is added when `slackWebhookSecret` is set.\n- `src/constructs/edge-networking.ts` - helper constructs only for the requested `edgeResources` (`cloudfront`, `route53`, `apigateway`, `cognito`, `sqs`).\n- `src/constructs/ecr-ecs.ts` when `ecrEcs.enabled` - ECR repo + Fargate service; `externalImageSource: true` (default) means the service pulls an image built outside this repo.\n\n### CdkAppProject\n\n`CdkInfraProject` plus application source, a database construct, and an app-level build workflow.\n\n```typescript\n// .projenrc.ts\nimport { CdkAppProject } from '@xpertss/projen-types';\n\nconst project = new CdkAppProject({\n  name: 'video-api',\n  environments: ['dev', 'prod'],\n  edgeResources: ['apigateway'],\n  database: { engine: 'postgres', migrationTool: 'flyway' },\n  appEntryPoint: 'src/app.ts',\n});\n\nproject.synth();\n```\n\nEverything from `CdkInfraProject`, plus:\n\n- `src/app.ts` - application entrypoint stub (`export function handler()`).\n- `src/handlers/example.ts` - API Gateway proxy handler stub, with `@types/aws-lambda` added as a dev dependency.\n- `src/constructs/database.ts` - a `Database` construct stub for the chosen engine (`postgres`/`mysql` -> RDS, `dynamodb` -> DynamoDB). `migrationTool` (no default, intentionally) is added as a dev dependency and referenced in the stub - wiring it up is left to you.\n- `.github/workflows/app-build.yml` - runs the project's test task on every PR, then checks for projen drift.\n\n### JavaLibraryProject\n\nA reusable Java library published to Maven Central.\n\n```typescript\n// .projenrc.ts\nimport { JavaLibraryProject } from '@xpertss/projen-types';\n\nconst project = new JavaLibraryProject({\n  name: 'common-utils',\n  groupId: 'org.xpertss',\n  artifactId: 'common-utils',\n  version: '1.0.0',\n  sonarProjectKey: 'org.xpertss:common-utils',\n  mavenCentralOidc: true,\n});\n\nproject.synth();\n```\n\nYou get:\n\n- `pom.xml` (via projen's `java.JavaProject`) with the given GAV coordinates.\n- `.github/workflows/build.yml` - PR build + projen drift check, plus a SonarQube scan step when `sonarProjectKey` is set (needs a `SONAR_TOKEN` secret).\n- `.github/workflows/upgrade.yml` - nightly (03:00 UTC) PR running `mvn versions:use-latest-releases versions:update-properties`.\n- `.github/workflows/publish-maven-central.yml` - manual dispatch running `mvn -B deploy -P release`. With `mavenCentralOidc: true` it uses Maven Central's OIDC trusted publishing (no GPG secrets needed); otherwise it expects the secrets `MAVEN_GPG_PRIVATE_KEY`, `MAVEN_GPG_PASSPHRASE`, `MAVEN_CENTRAL_USERNAME`, `MAVEN_CENTRAL_PASSWORD`.\n- `.github/workflows/codeindex.yml` - on push to `main`, generates a Java source index under `.cai/` (disable with `publishCodeIndex: false`).\n\n### JavaServiceProject\n\nA Spring Boot service that publishes a Docker image and can trigger deploys in a companion CDK repo.\n\n```typescript\n// .projenrc.ts\nimport { JavaServiceProject } from '@xpertss/projen-types';\n\nconst project = new JavaServiceProject({\n  name: 'stream-processor',\n  groupId: 'org.xpertss',\n  artifactId: 'stream-processor',\n  dockerRegistry: 'docker.io/xpertss',\n  cdkDeployTargetRepo: 'xpertss/stream-infra',\n  environments: ['dev', { name: 'prod', requiresApproval: true }],\n});\n\nproject.synth();\n```\n\nYou get (everything from `JavaMavenProject` - `pom.xml`, `build` + drift check, nightly `upgrade` - plus):\n\n- `spring-boot-starter-web` added to the pom.\n- `.github/workflows/publish-docker.yml` - manual dispatch: `mvn -B package && docker build -t <registry>/<name>:<sha>`, logged in with the `DOCKER_USERNAME` / `DOCKER_PASSWORD` secrets. `dockerRegistry` defaults to `docker.io`.\n- Flyway wiring when `useFlyway` (default `true`): `flyway-maven-plugin` ^10 + `flyway-core` ^10 in the pom, and `src/main/resources/db/migration/V1__init.sql`.\n- `.github/workflows/deploy-cdk.yml` (the `CdkDeployHook`, generated by default) - manual dispatch with an environment selector; each job sends a `workflow_dispatch` to `deploy.yml` in the companion `cdkDeployTargetRepo` (a `CdkInfraProject`/`CdkAppProject` repo). With no `cdkDeployTargetRepo` set, the workflow is still generated but each job's only step fails with instructions - it is dispatch-only, so that lands on whoever tries to deploy rather than on every PR. Turn the workflow off entirely with `cdkDeployHook: false`. `environments` defaults to `['prod']`.\n\n### JavaAppProject\n\nA GUI/TUI/CLI Java application published to GitHub Packages only - no Maven Central, no Docker, no CDK deploy hook.\n\n```typescript\n// .projenrc.ts\nimport { JavaAppProject } from '@xpertss/projen-types';\n\nconst project = new JavaAppProject({\n  name: 'studio-cli',\n  groupId: 'org.xpertss',\n  artifactId: 'studio-cli',\n  ghPackagesRegistry: 'https://maven.pkg.github.com/xpertss/studio-cli',\n});\n\nproject.synth();\n```\n\nYou get everything from `JavaMavenProject`, plus `.github/workflows/publish-ghpackages.yml` - manual dispatch running `mvn -B deploy -DaltDeploymentRepository=github::<registry>`, authenticated with `GITHUB_TOKEN`. `ghPackagesRegistry` defaults to `https://maven.pkg.github.com/<repo>` derived from the repository URL.\n\n### GitHubActionProject\n\nA reusable GitHub Action or Workflow. This example scaffolds an action that stages a folder and, only if it changed, commits and pushes it.\n\n```typescript\n// .projenrc.ts\nimport { GitHubActionProject } from '@xpertss/projen-types';\n\nconst project = new GitHubActionProject({\n  name: 'auto-commit',\n  description: 'Stage a folder and, only if it changed, commit and push it',\n  sonarHostUrl: 'https://sonar.xpertss.org',   // required, no default - your self-hosted SonarQube\n  dogfood: {\n    // Two scenario steps: the \"changed\" path and the \"no-op\" path are both\n    // load-bearing behavior for this action (a double-commit or a\n    // push-when-empty bug is the failure mode a hand-rolled inline-shell\n    // alternative is most likely to introduce).\n    scenario: [\n      {\n        name: 'Changed path',\n        fixtureSteps: [\n          'echo \"$(date -u +%Y%m%dT%H%M%SZ)\" >> test/fixtures/dogfood-state.txt',\n        ],\n        inputs: {\n          commit_message: 'test: dogfood',\n          branches: 'test/dogfood',\n        },\n        assertions: [\n          // step id defaults to a slug of `name` - here \"changed-path-0\"\n          '[ \"${{ steps.changed-path-0.outputs.committed }}\" = \"true\" ]',\n        ],\n      },\n      {\n        // No fixture change this time - nothing new to commit.\n        name: 'No-op path',\n        id: 'no-op-check',            // pin an explicit id instead of relying on the default slug\n        inputs: {\n          commit_message: 'test: dogfood',\n          branches: 'test/dogfood',\n        },\n        assertions: [\n          '[ \"${{ steps.no-op-check.outputs.committed }}\" = \"false\" ]',\n        ],\n      },\n    ],\n    cleanup: [\n      'git push origin --delete test/dogfood || true',\n    ],\n  },\n});\n\nproject.synth();\n```\n\nYou get:\n\n- `action.yml` and `auto-commit.sh` are hand-written - this type only lints their content via `build.yml`'s shellcheck/yamllint/actionlint checks.\n- `.github/workflows/build.yml` - lint gate: `apt`-installed shellcheck/yamllint plus a pinned, SHA-256-verified `actionlint` release binary. Gates `main` alongside `sonar.yml`.\n- `.github/workflows/test-dogfood.yml` - runs the `dogfood.scenario` steps above against this repo's own `action.yml` (via `uses: .`), then the shared `cleanup`, on `workflow_dispatch`, every `pull_request`, and nightly. Omit `dogfood` and the workflow still exists, with one step that fails on every PR until you declare a scenario - AD-001 allows a dogfood to be missing loudly, never silently. A *partial* `dogfood` (a scenario with no cleanup) is a synth error.\n- `.github/workflows/sonar.yml` - self-hosted SonarQube via the Scanner CLI, scanning `action.yml`/`.github/workflows/**`/`**/*.sh` explicitly.\n- `.github/workflows/release.yml` - `feat:`/`fix:` commits on `main` bump the version, tag `vX.Y.Z`, and create a GitHub Release.\n- `.github/workflows/projen-drift-check.yml`, `workflow-change-notice.yml`, `actions-allowlist-guard.yml` - drift detection, a change notice, and an action allow-list guard, always included.\n- `package.json` (**private**, version source only), `.yamllint`, `LICENSE` (MIT by default), and a `README.md` template - all regenerated by `npx projen`.\n\nNeeds the same two secrets as everything else in this package: `PROJEN_GITHUB_TOKEN` (used for automated PR comments) and `SONAR_TOKEN` (the Sonar scan). Onboard a brand-new action repo following [Getting started](#getting-started), write the `.projenrc.ts` above, then hand-write `action.yml`/`auto-commit.sh`/`test/fixtures/`.\n\n## Common options\n\nCDK project types (`CdkInfraProjectOptions` / `CdkAppProjectOptions`):\n\n| Option | Default | Description |\n| --- | --- | --- |\n| `name` | - (required) | Project name; must match `package.json` |\n| `cdkVersion` | `2.189.1` | AWS CDK version |\n| `gheTokenSecret` | `PROJEN_GITHUB_TOKEN` | GitHub secret holding projen's PAT |\n| `slackWebhookSecret` | - | GitHub secret with a Slack webhook URL for deploy notifications |\n| `environments` | - (no `deploy` workflow) | Deploy targets for the `deploy` workflow; strings or `EnvironmentOptions` |\n| `ecrEcs` | - | `EcrEcsOptions` - `enabled`, `externalImageSource` (default `true`) |\n| `edgeResources` | - | Subset of `cloudfront`, `route53`, `apigateway`, `cognito`, `sqs` |\n| `database` | - (app only) | `DatabaseOptions` - `engine` (`postgres`/`mysql`/`dynamodb`, default `postgres`), `migrationTool` |\n| `appEntryPoint` | `src/app.ts` (app only) | Path of the generated application entrypoint |\n\nJava project types (`JavaLibraryProjectOptions` / `JavaServiceProjectOptions` / `JavaAppProjectOptions`):\n\n| Option | Default | Description |\n| --- | --- | --- |\n| `name` | - (required) | Project name |\n| `groupId` | - (required) | Maven group id |\n| `artifactId` | - (required) | Maven artifact id |\n| `version` | `0.1.0` | Maven version |\n| `sonarProjectKey` | - | SonarQube project key; the sonar step is skipped when unset |\n| `gheTokenSecret` | `PROJEN_GITHUB_TOKEN` | GitHub secret holding projen's PAT |\n| `cdkDeployTargetRepo` | - (service only; `deploy-cdk.yml` fails until set) | Companion CDK repo (`owner/repo`) whose `deploy.yml` the deploy hook dispatches |\n| `cdkDeployHook` | `true` (service only) | Whether to generate `deploy-cdk.yml` at all |\n| `dockerRegistry` | `docker.io` (service only) | Registry the Docker image is pushed to |\n| `useFlyway` | `true` (service only) | Flyway plugin/dependency + `V1__init.sql` |\n\n`EnvironmentOptions` for deploy targets:\n\n```text\ninterface EnvironmentOptions {\n  readonly name: string;              // e.g. \"dev\", \"stage\", \"prod\"\n  readonly accountId?: string;        // AWS account id (CDK deploys)\n  readonly region?: string;           // AWS region (CDK deploys)\n  readonly requiresApproval?: boolean; // GitHub Environment approval gate (default false)\n}\n```\n\nPlain strings (`'dev'`) are shorthand for `{ name: 'dev' }`.\n\n`GitHubActionProjectOptions`:\n\n| Option | Default | Description |\n| --- | --- | --- |\n| `name` | - (required) | Project name |\n| `description` | - | One-line description; used in the default README template and recorded in the private `package.json` |\n| `sonarHostUrl` | - (required) | URL of your self-hosted SonarQube instance; must be reachable from github.com-hosted runners |\n| `sonarTokenSecret` | `SONAR_TOKEN` | GitHub secret holding the Sonar token |\n| `sonarPullRequestGate` | `true` | Whether `sonar.yml` also runs on `pull_request` as a pass/fail gate |\n| `dogfood` | - (a `test-dogfood.yml` that fails until you declare one) | `ActionDogfoodOptions` - the scenario that exercises the action end-to-end via `uses: .` |\n| `license` | `MIT` | SPDX identifier for the generated `LICENSE` |\n| `gheTokenSecret` | `PROJEN_GITHUB_TOKEN` | GitHub secret holding projen's PAT |\n\n`ActionDogfoodOptions`/`ActionDogfoodStep` - the dogfood scenario (`test-dogfood.yml`):\n\n```text\ninterface ActionDogfoodOptions {\n  readonly scenario: ActionDogfoodStep[]; // one or more, run in order - required\n  readonly cleanup: string[];             // shared, run once at the end with `if: always()` - required\n}\n\ninterface ActionDogfoodStep {\n  readonly name: string;                    // labels this step-group's generated workflow steps\n  readonly id?: string;                     // step id for the `uses: .` call; default: a slug of `name`\n  readonly fixtureSteps?: string[];         // shell, before the invocation (default: none)\n  readonly inputs?: Record<string, string>; // `with:` for this invocation (default: none)\n  readonly assertions: string[];            // shell, after the invocation - required, job fails unless all exit 0\n}\n```\n\nMost actions need exactly one `scenario` step. Actions with a re-run/no-op/idempotency behavior to verify (e.g. `auto-commit`'s no-op-on-no-change path, `create-pull-request`'s reuse-the-PR path) declare two - the second typically omits `fixtureSteps` so its invocation sees no new state, and its assertion checks the opposite outcome of the first. Reference an invocation's own outputs from a later assertion via `${{ steps.<id>.outputs.<name> }}`, using either the default slug or an explicit `id`.\n\n## Required GitHub secrets\n\n| Secret | Used by | Notes |\n| --- | --- | --- |\n| `PROJEN_GITHUB_TOKEN` | all types | PAT for projen's self-mutation/automation; override via `gheTokenSecret` |\n| `SONAR_TOKEN` | Java types with `sonarProjectKey`; `GitHubActionProject` | SonarQube scan step in `build.yml` / `sonar.yml`; override via `sonarTokenSecret` on `GitHubActionProject` |\n| `DOCKER_USERNAME` / `DOCKER_PASSWORD` | `JavaServiceProject` | Docker image push |\n| `MAVEN_GPG_PRIVATE_KEY`, `MAVEN_GPG_PASSPHRASE`, `MAVEN_CENTRAL_USERNAME`, `MAVEN_CENTRAL_PASSWORD` | `JavaLibraryProject` without `mavenCentralOidc` | Not needed with OIDC trusted publishing |\n| (your Slack webhook secret) | CDK types with `slackWebhookSecret` | Deploy notifications |\n\n## Going further\n\nThe project types are composed from smaller components you can also attach to your own projects:\n\n| Component | Applies to | Purpose |\n| --- | --- | --- |\n| `AppRuntimeScaffold` | `NodeProject` | App source skeleton (`app.ts` + handlers) |\n| `DatabaseComponent` | `NodeProject` | Database construct stub + migration tool wiring |\n| `EcrEcsConstructs` | `Project` | ECR + Fargate ECS construct helper |\n| `EdgeNetworkingConstructs` | `Project` | Per-resource edge networking construct helpers |\n| `MavenCentralPublish` | `JavaProject` | Manual-dispatch Maven Central publish workflow |\n| `DockerPublish` | `JavaProject` | Manual-dispatch Docker build+push workflow |\n| `GitHubPackagesPublish` | `JavaProject` | Manual-dispatch GitHub Packages publish workflow |\n| `FlywayMigration` | `JavaProject` | Flyway plugin/dependency + migrations directory |\n| `CdkDeployHook` | `JavaProject` | Manual-dispatch workflow that triggers `deploy.yml` in a companion CDK repo |\n| `CodeIndexWorkflow` | `JavaProject` | Code index generation on push to `main` |\n| `ActionBuildWorkflow` | `GitHubProject` | The `lint` task (shellcheck/yamllint/pinned actionlint) + `build.yml` |\n| `ActionDogfoodWorkflow` | `GitHubProject` | `test-dogfood.yml` from an `ActionDogfoodOptions` scenario |\n| `ActionSonarWorkflow` | `GitHubProject` | `sonar.yml` (self-hosted SonarQube via the Scanner CLI) |\n\nExample - adding a Docker publish to a plain projen `JavaProject`:\n\n```typescript\nimport { java } from 'projen';\nimport { DockerPublish } from '@xpertss/projen-types';\n\nconst project = new java.JavaProject({\n  name: 'my-service',\n  groupId: 'org.xpertss',\n  artifactId: 'my-service',\n});\n\nnew DockerPublish(project, { dockerRegistry: 'ghcr.io' });\n\nproject.synth();\n```\n\nThe full API reference, including every option and property, is in [API.md](./API.md).\n"
   },
   "repository": {
     "type": "git",
@@ -365,6 +365,7 @@
       "assembly": "@xpertss/projen-types",
       "base": "projen.Component",
       "docs": {
+        "remarks": "Omitting `options` generates the workflow with a single failing step (see\n`UNCONFIGURED_STEPS`). A *partially* declared dogfood is still a synth\nerror: if you wrote a scenario by hand, you can write its cleanup too.",
         "stability": "experimental",
         "summary": "Per AD-001's dogfood test: the composite action is run **against this repo**, end-to-end, via a local `uses: .` reference - no external harness. Builds `test-dogfood.yml` from an ordered `scenario` of invocation steps (see `ActionDogfoodStep`) followed by a shared cleanup step."
       },
@@ -375,7 +376,7 @@
         },
         "locationInModule": {
           "filename": "src/actions/action-dogfood-workflow.ts",
-          "line": 72
+          "line": 88
         },
         "parameters": [
           {
@@ -386,6 +387,7 @@
           },
           {
             "name": "options",
+            "optional": true,
             "type": {
               "fqn": "@xpertss/projen-types.ActionDogfoodOptions"
             }
@@ -395,7 +397,7 @@
       "kind": "class",
       "locationInModule": {
         "filename": "src/actions/action-dogfood-workflow.ts",
-        "line": 69
+        "line": 85
       },
       "name": "ActionDogfoodWorkflow",
       "properties": [
@@ -406,7 +408,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/actions/action-dogfood-workflow.ts",
-            "line": 70
+            "line": 86
           },
           "name": "workflow",
           "type": {
@@ -737,7 +739,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "src/cdk/options.ts",
-        "line": 50
+        "line": 62
       },
       "name": "CdkAppProjectOptions",
       "properties": [
@@ -750,7 +752,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/cdk/options.ts",
-            "line": 54
+            "line": 66
           },
           "name": "appEntryPoint",
           "optional": true,
@@ -766,7 +768,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/cdk/options.ts",
-            "line": 51
+            "line": 63
           },
           "name": "database",
           "optional": true,
@@ -781,6 +783,7 @@
       "assembly": "@xpertss/projen-types",
       "base": "projen.Component",
       "docs": {
+        "remarks": "With no `targetRepo` the workflow is still generated, but every job's\nonly step fails with instructions. Synthesizing is not the place to\nenforce this: it would make the project type unscaffoldable by\n`projen new` (which cannot supply the value), and it is a dispatch-only\nworkflow - nobody hits the failure until they actually try to deploy,\nwhich is exactly when \"this repo has no deploy target\" needs saying.",
         "stability": "experimental",
         "summary": "Manual-dispatch workflow that invokes a downstream CDK deploy in a companion `CdkInfraProject`/`CdkAppProject` repo, using the same `ManualDeployWorkflow` contract those project types use for their own deploys - see the CDK spec's open question about sharing this contract."
       },
@@ -791,7 +794,7 @@
         },
         "locationInModule": {
           "filename": "src/java/components/cdk-deploy-hook.ts",
-          "line": 14
+          "line": 21
         },
         "parameters": [
           {
@@ -832,7 +835,7 @@
       "kind": "class",
       "locationInModule": {
         "filename": "src/java/components/cdk-deploy-hook.ts",
-        "line": 13
+        "line": 20
       },
       "name": "CdkDeployHook",
       "symbolId": "src/java/components/cdk-deploy-hook:CdkDeployHook"
@@ -854,30 +857,14 @@
         {
           "abstract": true,
           "docs": {
-            "default": "true",
-            "stability": "experimental"
-          },
-          "immutable": true,
-          "locationInModule": {
-            "filename": "src/java/options.ts",
-            "line": 28
-          },
-          "name": "enabled",
-          "optional": true,
-          "type": {
-            "primitive": "boolean"
-          }
-        },
-        {
-          "abstract": true,
-          "docs": {
+            "default": "- the workflow is still generated, but its only step fails with\ninstructions (see `CdkDeployHook`)",
             "stability": "experimental",
             "summary": "The companion CDK infra/app repo (owner/repo) that owns the actual infrastructure."
           },
           "immutable": true,
           "locationInModule": {
             "filename": "src/java/options.ts",
-            "line": 31
+            "line": 34
           },
           "name": "targetRepo",
           "optional": true,
@@ -942,31 +929,17 @@
         {
           "abstract": true,
           "docs": {
-            "stability": "experimental",
-            "summary": "Deploy targets for the manual-dispatch deploy workflow, e.g. [\"dev\", \"stage\", \"prod\"]."
+            "stability": "experimental"
           },
           "immutable": true,
           "locationInModule": {
             "filename": "src/cdk/options.ts",
-            "line": 35
+            "line": 49
           },
-          "name": "environments",
+          "name": "ecrEcs",
+          "optional": true,
           "type": {
-            "collection": {
-              "elementtype": {
-                "union": {
-                  "types": [
-                    {
-                      "primitive": "string"
-                    },
-                    {
-                      "fqn": "@xpertss/projen-types.EnvironmentOptions"
-                    }
-                  ]
-                }
-              },
-              "kind": "array"
-            }
+            "fqn": "@xpertss/projen-types.EcrEcsOptions"
           }
         },
         {
@@ -977,30 +950,47 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/cdk/options.ts",
-            "line": 37
+            "line": 51
           },
-          "name": "ecrEcs",
+          "name": "edgeResources",
           "optional": true,
           "type": {
-            "fqn": "@xpertss/projen-types.EcrEcsOptions"
+            "collection": {
+              "elementtype": {
+                "primitive": "string"
+              },
+              "kind": "array"
+            }
           }
         },
         {
           "abstract": true,
           "docs": {
-            "stability": "experimental"
+            "default": "- no deploy workflow",
+            "remarks": "Optional rather than required so that `projen new --from` can scaffold\nthe repo: its union type (`string | EnvironmentOptions`) is not\n\"JSON-like\", so projen's CLI cannot render a value for it into the\ninitial `.projenrc.ts` - and a *required* option it cannot render leaves\nbehind a projenrc that does not type-check.",
+            "stability": "experimental",
+            "summary": "Deploy targets for the manual-dispatch deploy workflow, e.g. [\"dev\", \"stage\", \"prod\"]. No `deploy` workflow is generated when this is empty or omitted."
           },
           "immutable": true,
           "locationInModule": {
             "filename": "src/cdk/options.ts",
-            "line": 39
+            "line": 47
           },
-          "name": "edgeResources",
+          "name": "environments",
           "optional": true,
           "type": {
             "collection": {
               "elementtype": {
-                "primitive": "string"
+                "union": {
+                  "types": [
+                    {
+                      "primitive": "string"
+                    },
+                    {
+                      "fqn": "@xpertss/projen-types.EnvironmentOptions"
+                    }
+                  ]
+                }
               },
               "kind": "array"
             }
@@ -1023,7 +1013,7 @@
         },
         "locationInModule": {
           "filename": "src/cdk/cdk-typescript-base.ts",
-          "line": 23
+          "line": 29
         },
         "parameters": [
           {
@@ -1037,7 +1027,7 @@
       "kind": "class",
       "locationInModule": {
         "filename": "src/cdk/cdk-typescript-base.ts",
-        "line": 22
+        "line": 28
       },
       "name": "CdkTypescriptProject",
       "symbolId": "src/cdk/cdk-typescript-base:CdkTypescriptProject"
@@ -1055,7 +1045,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "src/cdk/cdk-typescript-base.ts",
-        "line": 11
+        "line": 17
       },
       "name": "CdkTypescriptProjectOptions",
       "properties": [
@@ -1067,7 +1057,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/cdk/cdk-typescript-base.ts",
-            "line": 12
+            "line": 18
           },
           "name": "environments",
           "optional": true,
@@ -1356,7 +1346,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "src/cdk/options.ts",
-        "line": 42
+        "line": 54
       },
       "name": "DatabaseOptions",
       "properties": [
@@ -1369,7 +1359,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/cdk/options.ts",
-            "line": 44
+            "line": 56
           },
           "name": "engine",
           "optional": true,
@@ -1386,7 +1376,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/cdk/options.ts",
-            "line": 47
+            "line": 59
           },
           "name": "migrationTool",
           "optional": true,
@@ -1732,7 +1722,7 @@
       "base": "projen.github.GitHubProject",
       "docs": {
         "stability": "experimental",
-        "summary": "Scaffolds the repo lifecycle (AD-001) around a hand-committed, composite (shell) GitHub Action: the `build`/`test-dogfood`/`sonar`/`release` workflows, versioning and release discipline, the F003 verify components, the F009 allowlist guard, and repo boilerplate (`tsconfig.json` for `.projenrc.ts`, a private version-source `package.json`, `.yamllint`, `LICENSE`, and a `README.md` template). The action's own content (`action.yml`, its shell scripts, `test/` fixtures) is authored by hand per the action's own F### spec - this type only lints it."
+        "summary": "Scaffolds the repo lifecycle (AD-001) around a hand-committed, composite (shell) GitHub Action: the `build`/`test-dogfood`/`sonar`/`release` workflows, versioning and release discipline, the F003 verify components, the F009 allowlist guard, and repo boilerplate (a private version-source `package.json`, `.yamllint`, `LICENSE`, and a `README.md` template). The action's own content (`action.yml`, its shell scripts, `test/` fixtures) is authored by hand per the action's own F### spec - this type only lints it."
       },
       "fqn": "@xpertss/projen-types.GitHubActionProject",
       "initializer": {
@@ -1741,7 +1731,7 @@
         },
         "locationInModule": {
           "filename": "src/actions/github-action-project.ts",
-          "line": 126
+          "line": 133
         },
         "parameters": [
           {
@@ -1755,7 +1745,7 @@
       "kind": "class",
       "locationInModule": {
         "filename": "src/actions/github-action-project.ts",
-        "line": 120
+        "line": 127
       },
       "name": "GitHubActionProject",
       "properties": [
@@ -1766,7 +1756,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/actions/github-action-project.ts",
-            "line": 121
+            "line": 128
           },
           "name": "buildWorkflow",
           "type": {
@@ -1780,7 +1770,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/actions/github-action-project.ts",
-            "line": 122
+            "line": 129
           },
           "name": "dogfoodWorkflow",
           "type": {
@@ -1794,7 +1784,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/actions/github-action-project.ts",
-            "line": 124
+            "line": 131
           },
           "name": "release",
           "type": {
@@ -1808,7 +1798,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/actions/github-action-project.ts",
-            "line": 123
+            "line": 130
           },
           "name": "sonarWorkflow",
           "type": {
@@ -1831,40 +1821,41 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "src/actions/github-action-project.ts",
-        "line": 37
+        "line": 35
       },
       "name": "GitHubActionProjectOptions",
       "properties": [
         {
           "abstract": true,
           "docs": {
-            "remarks": "What fixture state, what to assert, and\nhow to clean up are specified by the action's own F### spec - the\nhighest-risk behavior of that action. Required: a default no-op\ndogfood would silently hollow out a load-bearing AD-001 workflow.",
+            "remarks": "MUST be reachable from\ngithub.com-hosted (public) runners (AD-001). Required, no default: a\nguessed server is worse than a loud failure.",
             "stability": "experimental",
-            "summary": "The dogfood scenario (AD-001)."
+            "summary": "URL of the org's self-hosted SonarQube instance."
           },
           "immutable": true,
           "locationInModule": {
             "filename": "src/actions/github-action-project.ts",
-            "line": 75
+            "line": 56
           },
-          "name": "dogfood",
+          "name": "sonarHostUrl",
           "type": {
-            "fqn": "@xpertss/projen-types.ActionDogfoodOptions"
+            "primitive": "string"
           }
         },
         {
           "abstract": true,
           "docs": {
-            "remarks": "MUST be reachable from\ngithub.com-hosted (public) runners (AD-001). Required, no default: a\nguessed server is worse than a loud failure.",
+            "remarks": "Used in the default README\ntemplate and recorded in the private `package.json`.",
             "stability": "experimental",
-            "summary": "URL of the org's self-hosted SonarQube instance."
+            "summary": "One-line description of the action."
           },
           "immutable": true,
           "locationInModule": {
             "filename": "src/actions/github-action-project.ts",
-            "line": 58
+            "line": 41
           },
-          "name": "sonarHostUrl",
+          "name": "description",
+          "optional": true,
           "type": {
             "primitive": "string"
           }
@@ -1872,19 +1863,20 @@
         {
           "abstract": true,
           "docs": {
-            "remarks": "Used in the default README\ntemplate and recorded in the private `package.json`.",
+            "default": "- `test-dogfood.yml` runs one failing step that tells you to\ndeclare a scenario",
+            "remarks": "What fixture state, what to assert, and\nhow to clean up are specified by the action's own F### spec - the\nhighest-risk behavior of that action.\n\nIts type is a struct, which projen's CLI cannot render into a projenrc,\nso it can only be written by hand - it is therefore optional, because a\n*required* option `projen new` cannot supply would make this project\ntype impossible to scaffold. AD-001's \"never a silent no-op dogfood\"\nrule is enforced instead by the workflow it generates in that case: a\nsingle step that fails on every PR until a scenario is declared.",
             "stability": "experimental",
-            "summary": "One-line description of the action."
+            "summary": "The dogfood scenario (AD-001)."
           },
           "immutable": true,
           "locationInModule": {
             "filename": "src/actions/github-action-project.ts",
-            "line": 43
+            "line": 82
           },
-          "name": "description",
+          "name": "dogfood",
           "optional": true,
           "type": {
-            "primitive": "string"
+            "fqn": "@xpertss/projen-types.ActionDogfoodOptions"
           }
         },
         {
@@ -1897,7 +1889,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/actions/github-action-project.ts",
-            "line": 51
+            "line": 49
           },
           "name": "gheTokenSecret",
           "optional": true,
@@ -1915,7 +1907,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/actions/github-action-project.ts",
-            "line": 81
+            "line": 88
           },
           "name": "license",
           "optional": true,
@@ -1933,7 +1925,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/actions/github-action-project.ts",
-            "line": 67
+            "line": 65
           },
           "name": "sonarPullRequestGate",
           "optional": true,
@@ -1950,7 +1942,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/actions/github-action-project.ts",
-            "line": 61
+            "line": 59
           },
           "name": "sonarTokenSecret",
           "optional": true,
@@ -2082,7 +2074,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "src/java/options.ts",
-        "line": 53
+        "line": 75
       },
       "name": "JavaAppProjectOptions",
       "properties": [
@@ -2095,7 +2087,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/java/options.ts",
-            "line": 55
+            "line": 77
           },
           "name": "ghPackagesRegistry",
           "optional": true,
@@ -2207,7 +2199,7 @@
         },
         "locationInModule": {
           "filename": "src/java/java-maven-base.ts",
-          "line": 22
+          "line": 23
         },
         "parameters": [
           {
@@ -2221,7 +2213,7 @@
       "kind": "class",
       "locationInModule": {
         "filename": "src/java/java-maven-base.ts",
-        "line": 18
+        "line": 19
       },
       "name": "JavaMavenProject",
       "properties": [
@@ -2232,7 +2224,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/java/java-maven-base.ts",
-            "line": 20
+            "line": 21
           },
           "name": "buildVerifyWorkflow",
           "type": {
@@ -2246,7 +2238,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/java/java-maven-base.ts",
-            "line": 19
+            "line": 20
           },
           "name": "upgradeTask",
           "type": {
@@ -2269,7 +2261,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "src/java/java-maven-base.ts",
-        "line": 10
+        "line": 11
       },
       "name": "JavaMavenProjectOptions",
       "symbolId": "src/java/java-maven-base:JavaMavenProjectOptions"
@@ -2321,25 +2313,48 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "src/java/options.ts",
-        "line": 34
+        "line": 37
       },
       "name": "JavaServiceProjectOptions",
       "properties": [
         {
           "abstract": true,
           "docs": {
-            "default": "{ enabled: true }",
-            "stability": "experimental"
+            "default": "true",
+            "stability": "experimental",
+            "summary": "Whether to generate the `deploy-cdk` workflow at all."
           },
           "immutable": true,
           "locationInModule": {
             "filename": "src/java/options.ts",
-            "line": 42
+            "line": 64
           },
           "name": "cdkDeployHook",
           "optional": true,
           "type": {
-            "fqn": "@xpertss/projen-types.CdkDeployHookOptions"
+            "primitive": "boolean"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "custom": {
+              "xpertss": "/projen-types java_service` can pass it\n(`--cdk-deploy-target-repo owner/repo`): projen's CLI can only render\noptions whose type is a string/number/boolean/array/enum, so a\nstruct-typed option is invisible to it."
+            },
+            "default": "- `deploy-cdk.yml` is generated with a single failing step that\ntells you to set this",
+            "remarks": "A plain string rather than a nested struct so that\n`projen new --from",
+            "stability": "experimental",
+            "summary": "The companion CDK infra/app repo (`owner/repo`) whose `deploy.yml` the `deploy-cdk` workflow dispatches."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/java/options.ts",
+            "line": 57
+          },
+          "name": "cdkDeployTargetRepo",
+          "optional": true,
+          "type": {
+            "primitive": "string"
           }
         },
         {
@@ -2351,7 +2366,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/java/options.ts",
-            "line": 36
+            "line": 39
           },
           "name": "dockerRegistry",
           "optional": true,
@@ -2369,7 +2384,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/java/options.ts",
-            "line": 50
+            "line": 72
           },
           "name": "environments",
           "optional": true,
@@ -2400,7 +2415,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/java/options.ts",
-            "line": 39
+            "line": 42
           },
           "name": "useFlyway",
           "optional": true,
@@ -2728,6 +2743,6 @@
       "symbolId": "src/common/workflow-change-notice-workflow:WorkflowChangeNoticeWorkflowOptions"
     }
   },
-  "version": "0.0.2",
-  "fingerprint": "SOREw4FllfwWFwxt950SKH0rCoRLyBQ4OrDsDR7T0SI="
+  "version": "0.0.4",
+  "fingerprint": "upjKAzwpYLVGzTXQERWb0kwu21837IMVW3dlmjdoEFk="
 }