npm - @xpertss/projen-types - Versions diffs - 0.0.20 → 0.0.22 - Mend

@xpertss/projen-types 0.0.20 → 0.0.22

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (45) hide show

package/.jsii +535 -291
package/API.md +1808 -488
package/README.md +46 -17
package/lib/actions/action-build-workflow.js +1 -1
package/lib/actions/action-dogfood-workflow.js +1 -1
package/lib/actions/action-sonar-workflow.d.ts +10 -29
package/lib/actions/action-sonar-workflow.js +9 -58
package/lib/actions/github-action-project.d.ts +15 -22
package/lib/actions/github-action-project.js +18 -13
package/lib/cdk/app-runtime-scaffold.js +1 -1
package/lib/cdk/cdk-app-project.js +1 -1
package/lib/cdk/cdk-infra-project.js +1 -1
package/lib/cdk/cdk-typescript-base.d.ts +3 -0
package/lib/cdk/cdk-typescript-base.js +25 -2
package/lib/cdk/components/ecr-ecs-constructs.js +1 -1
package/lib/cdk/components/edge-networking-constructs.js +1 -1
package/lib/cdk/database-component.js +1 -1
package/lib/cdk/options.d.ts +22 -1
package/lib/cdk/options.js +1 -1
package/lib/common/projen-drift-check-workflow.js +1 -1
package/lib/common/sonar-options.d.ts +29 -0
package/lib/common/sonar-options.js +3 -0
package/lib/common/sonar-workflow.d.ts +48 -0
package/lib/common/sonar-workflow.js +75 -0
package/lib/common/workflow-change-notice-workflow.js +1 -1
package/lib/index.d.ts +2 -0
package/lib/index.js +3 -1
package/lib/java/components/cdk-deploy-hook.js +1 -1
package/lib/java/components/code-index-workflow.js +1 -1
package/lib/java/components/docker-publish.js +1 -1
package/lib/java/components/flyway-migration.js +1 -1
package/lib/java/components/github-packages-publish.js +1 -1
package/lib/java/components/maven-central-publish.js +1 -1
package/lib/java/components/maven-upgrade-report.js +1 -1
package/lib/java/java-app-project.js +1 -1
package/lib/java/java-library-project.js +1 -1
package/lib/java/java-maven-base.d.ts +6 -2
package/lib/java/java-maven-base.js +19 -15
package/lib/java/java-service-project.js +1 -1
package/lib/java/java-spring-boot-project.js +1 -1
package/lib/java/maven/maven-module.js +1 -1
package/lib/java/maven/maven-pom.js +1 -1
package/lib/java/options.d.ts +3 -4
package/lib/java/options.js +1 -1
package/package.json +1 -1

package/API.md CHANGED Viewed

@@ -500,23 +500,18 @@ public readonly workflow: GithubWorkflow;
 ### ActionSonarWorkflow <a name="ActionSonarWorkflow" id="@xpertss/projen-types.ActionSonarWorkflow"></a>
-AD-001 Layer 2: SonarCloud via the Scanner CLI only (never `SonarSource/sonarqube-scan-action` - third-party, and it carried a security advisory).
-`sonar.inclusions` is set explicitly since default
-inclusions may skip `action.yml` outside `.github/`.
 #### Initializers <a name="Initializers" id="@xpertss/projen-types.ActionSonarWorkflow.Initializer"></a>
 ```typescript
 import { ActionSonarWorkflow } from '@xpertss/projen-types'
-new ActionSonarWorkflow(scope: GitHubProject, options: ActionSonarWorkflowOptions)
+new ActionSonarWorkflow(scope: GitHubProject, options: SonarWorkflowOptions)
 ```
 | **Name** | **Type** | **Description** |
 | --- | --- | --- |
 | <code><a href="#@xpertss/projen-types.ActionSonarWorkflow.Initializer.parameter.scope">scope</a></code> | <code>projen.github.GitHubProject</code> | *No description.* |
-| <code><a href="#@xpertss/projen-types.ActionSonarWorkflow.Initializer.parameter.options">options</a></code> | <code><a href="#@xpertss/projen-types.ActionSonarWorkflowOptions">ActionSonarWorkflowOptions</a></code> | *No description.* |
+| <code><a href="#@xpertss/projen-types.ActionSonarWorkflow.Initializer.parameter.options">options</a></code> | <code><a href="#@xpertss/projen-types.SonarWorkflowOptions">SonarWorkflowOptions</a></code> | *No description.* |
 ---
@@ -528,7 +523,7 @@ new ActionSonarWorkflow(scope: GitHubProject, options: ActionSonarWorkflowOption
 ##### `options`<sup>Required</sup> <a name="options" id="@xpertss/projen-types.ActionSonarWorkflow.Initializer.parameter.options"></a>
-- *Type:* <a href="#@xpertss/projen-types.ActionSonarWorkflowOptions">ActionSonarWorkflowOptions</a>
+- *Type:* <a href="#@xpertss/projen-types.SonarWorkflowOptions">SonarWorkflowOptions</a>
 ---
@@ -546,7 +541,7 @@ new ActionSonarWorkflow(scope: GitHubProject, options: ActionSonarWorkflowOption
 ---
-##### `toString` <a name="toString" id="@xpertss/projen-types.ActionSonarWorkflow.toString"></a>
+##### ~~`toString`~~ <a name="toString" id="@xpertss/projen-types.ActionSonarWorkflow.toString"></a>
 ```typescript
 public toString(): string
@@ -554,7 +549,7 @@ public toString(): string
 Returns a string representation of this construct.
-##### `with` <a name="with" id="@xpertss/projen-types.ActionSonarWorkflow.with"></a>
+##### ~~`with`~~ <a name="with" id="@xpertss/projen-types.ActionSonarWorkflow.with"></a>
 ```typescript
 public with(mixins: ...IMixin[]): IConstruct
@@ -575,7 +570,7 @@ The mixins to apply.
 ---
-##### `postProjectCreation` <a name="postProjectCreation" id="@xpertss/projen-types.ActionSonarWorkflow.postProjectCreation"></a>
+##### ~~`postProjectCreation`~~ <a name="postProjectCreation" id="@xpertss/projen-types.ActionSonarWorkflow.postProjectCreation"></a>
 ```typescript
 public postProjectCreation(initProject: InitProject): void
@@ -596,7 +591,7 @@ Details about how the project was created, e.g. its type and the original CLI ar
 ---
-##### `postSynthesize` <a name="postSynthesize" id="@xpertss/projen-types.ActionSonarWorkflow.postSynthesize"></a>
+##### ~~`postSynthesize`~~ <a name="postSynthesize" id="@xpertss/projen-types.ActionSonarWorkflow.postSynthesize"></a>
 ```typescript
 public postSynthesize(): void
@@ -606,7 +601,7 @@ Called after synthesis.
 Order is *not* guaranteed.
-##### `preSynthesize` <a name="preSynthesize" id="@xpertss/projen-types.ActionSonarWorkflow.preSynthesize"></a>
+##### ~~`preSynthesize`~~ <a name="preSynthesize" id="@xpertss/projen-types.ActionSonarWorkflow.preSynthesize"></a>
 ```typescript
 public preSynthesize(): void
@@ -614,7 +609,7 @@ public preSynthesize(): void
 Called before synthesis.
-##### `projectCreation` <a name="projectCreation" id="@xpertss/projen-types.ActionSonarWorkflow.projectCreation"></a>
+##### ~~`projectCreation`~~ <a name="projectCreation" id="@xpertss/projen-types.ActionSonarWorkflow.projectCreation"></a>
 ```typescript
 public projectCreation(initProject: InitProject): void
@@ -633,7 +628,7 @@ Details about how the project was created, e.g. its type and the original CLI ar
 ---
-##### `synthesize` <a name="synthesize" id="@xpertss/projen-types.ActionSonarWorkflow.synthesize"></a>
+##### ~~`synthesize`~~ <a name="synthesize" id="@xpertss/projen-types.ActionSonarWorkflow.synthesize"></a>
 ```typescript
 public synthesize(): void
@@ -650,7 +645,7 @@ Synthesizes files to the project output directory.
 ---
-##### `isConstruct` <a name="isConstruct" id="@xpertss/projen-types.ActionSonarWorkflow.isConstruct"></a>
+##### ~~`isConstruct`~~ <a name="isConstruct" id="@xpertss/projen-types.ActionSonarWorkflow.isConstruct"></a>
 ```typescript
 import { ActionSonarWorkflow } from '@xpertss/projen-types'
@@ -682,7 +677,7 @@ Any object.
 ---
-##### `isComponent` <a name="isComponent" id="@xpertss/projen-types.ActionSonarWorkflow.isComponent"></a>
+##### ~~`isComponent`~~ <a name="isComponent" id="@xpertss/projen-types.ActionSonarWorkflow.isComponent"></a>
 ```typescript
 import { ActionSonarWorkflow } from '@xpertss/projen-types'
@@ -708,7 +703,12 @@ Test whether the given construct is a component.
 ---
-##### `node`<sup>Required</sup> <a name="node" id="@xpertss/projen-types.ActionSonarWorkflow.property.node"></a>
+##### ~~`node`~~<sup>Required</sup> <a name="node" id="@xpertss/projen-types.ActionSonarWorkflow.property.node"></a>
+- *Deprecated:* Renamed to `SonarWorkflow` (now in `src/common/` and applied to
+every project type, not just actions). Use `SonarWorkflow` instead; this
+subclass is kept only so existing imports of `ActionSonarWorkflow` keep
+compiling. It behaves identically to `SonarWorkflow`.
 ```typescript
 public readonly node: Node;
@@ -720,7 +720,12 @@ The tree node.
 ---
-##### `project`<sup>Required</sup> <a name="project" id="@xpertss/projen-types.ActionSonarWorkflow.property.project"></a>
+##### ~~`project`~~<sup>Required</sup> <a name="project" id="@xpertss/projen-types.ActionSonarWorkflow.property.project"></a>
+- *Deprecated:* Renamed to `SonarWorkflow` (now in `src/common/` and applied to
+every project type, not just actions). Use `SonarWorkflow` instead; this
+subclass is kept only so existing imports of `ActionSonarWorkflow` keep
+compiling. It behaves identically to `SonarWorkflow`.
 ```typescript
 public readonly project: Project;
@@ -730,7 +735,12 @@ public readonly project: Project;
 ---
-##### `workflow`<sup>Required</sup> <a name="workflow" id="@xpertss/projen-types.ActionSonarWorkflow.property.workflow"></a>
+##### ~~`workflow`~~<sup>Required</sup> <a name="workflow" id="@xpertss/projen-types.ActionSonarWorkflow.property.workflow"></a>
+- *Deprecated:* Renamed to `SonarWorkflow` (now in `src/common/` and applied to
+every project type, not just actions). Use `SonarWorkflow` instead; this
+subclass is kept only so existing imports of `ActionSonarWorkflow` keep
+compiling. It behaves identically to `SonarWorkflow`.
 ```typescript
 public readonly workflow: GithubWorkflow;
@@ -1634,6 +1644,7 @@ When given a project, this it the project itself.
 | <code><a href="#@xpertss/projen-types.CdkAppProject.property.cdkDeps">cdkDeps</a></code> | <code>projen.awscdk.AwsCdkDeps</code> | *No description.* |
 | <code><a href="#@xpertss/projen-types.CdkAppProject.property.cdkTasks">cdkTasks</a></code> | <code>projen.awscdk.CdkTasks</code> | Common CDK tasks. |
 | <code><a href="#@xpertss/projen-types.CdkAppProject.property.cdkVersion">cdkVersion</a></code> | <code>string</code> | The CDK version this app is using. |
+| <code><a href="#@xpertss/projen-types.CdkAppProject.property.sonarWorkflow">sonarWorkflow</a></code> | <code><a href="#@xpertss/projen-types.SonarWorkflow">SonarWorkflow</a></code> | Set only when `sonarHostUrl` is provided. |
 ---
@@ -2392,6 +2403,18 @@ The CDK version this app is using.
 ---
+##### `sonarWorkflow`<sup>Optional</sup> <a name="sonarWorkflow" id="@xpertss/projen-types.CdkAppProject.property.sonarWorkflow"></a>
+```typescript
+public readonly sonarWorkflow: SonarWorkflow;
+```
+- *Type:* <a href="#@xpertss/projen-types.SonarWorkflow">SonarWorkflow</a>
+Set only when `sonarHostUrl` is provided.
+---
 #### Constants <a name="Constants" id="Constants"></a>
 | **Name** | **Type** | **Description** |
@@ -3335,6 +3358,7 @@ When given a project, this it the project itself.
 | <code><a href="#@xpertss/projen-types.CdkInfraProject.property.cdkDeps">cdkDeps</a></code> | <code>projen.awscdk.AwsCdkDeps</code> | *No description.* |
 | <code><a href="#@xpertss/projen-types.CdkInfraProject.property.cdkTasks">cdkTasks</a></code> | <code>projen.awscdk.CdkTasks</code> | Common CDK tasks. |
 | <code><a href="#@xpertss/projen-types.CdkInfraProject.property.cdkVersion">cdkVersion</a></code> | <code>string</code> | The CDK version this app is using. |
+| <code><a href="#@xpertss/projen-types.CdkInfraProject.property.sonarWorkflow">sonarWorkflow</a></code> | <code><a href="#@xpertss/projen-types.SonarWorkflow">SonarWorkflow</a></code> | Set only when `sonarHostUrl` is provided. |
 ---
@@ -4093,6 +4117,18 @@ The CDK version this app is using.
 ---
+##### `sonarWorkflow`<sup>Optional</sup> <a name="sonarWorkflow" id="@xpertss/projen-types.CdkInfraProject.property.sonarWorkflow"></a>
+```typescript
+public readonly sonarWorkflow: SonarWorkflow;
+```
+- *Type:* <a href="#@xpertss/projen-types.SonarWorkflow">SonarWorkflow</a>
+Set only when `sonarHostUrl` is provided.
+---
 #### Constants <a name="Constants" id="Constants"></a>
 | **Name** | **Type** | **Description** |
@@ -4791,6 +4827,7 @@ When given a project, this it the project itself.
 | <code><a href="#@xpertss/projen-types.CdkTypescriptProject.property.cdkDeps">cdkDeps</a></code> | <code>projen.awscdk.AwsCdkDeps</code> | *No description.* |
 | <code><a href="#@xpertss/projen-types.CdkTypescriptProject.property.cdkTasks">cdkTasks</a></code> | <code>projen.awscdk.CdkTasks</code> | Common CDK tasks. |
 | <code><a href="#@xpertss/projen-types.CdkTypescriptProject.property.cdkVersion">cdkVersion</a></code> | <code>string</code> | The CDK version this app is using. |
+| <code><a href="#@xpertss/projen-types.CdkTypescriptProject.property.sonarWorkflow">sonarWorkflow</a></code> | <code><a href="#@xpertss/projen-types.SonarWorkflow">SonarWorkflow</a></code> | Set only when `sonarHostUrl` is provided. |
 ---
@@ -5549,6 +5586,18 @@ The CDK version this app is using.
 ---
+##### `sonarWorkflow`<sup>Optional</sup> <a name="sonarWorkflow" id="@xpertss/projen-types.CdkTypescriptProject.property.sonarWorkflow"></a>
+```typescript
+public readonly sonarWorkflow: SonarWorkflow;
+```
+- *Type:* <a href="#@xpertss/projen-types.SonarWorkflow">SonarWorkflow</a>
+Set only when `sonarHostUrl` is provided.
+---
 #### Constants <a name="Constants" id="Constants"></a>
 | **Name** | **Type** | **Description** |
@@ -7370,7 +7419,7 @@ When given a project, this it the project itself.
 | <code><a href="#@xpertss/projen-types.GitHubActionProject.property.buildWorkflow">buildWorkflow</a></code> | <code><a href="#@xpertss/projen-types.ActionBuildWorkflow">ActionBuildWorkflow</a></code> | *No description.* |
 | <code><a href="#@xpertss/projen-types.GitHubActionProject.property.dogfoodWorkflow">dogfoodWorkflow</a></code> | <code><a href="#@xpertss/projen-types.ActionDogfoodWorkflow">ActionDogfoodWorkflow</a></code> | *No description.* |
 | <code><a href="#@xpertss/projen-types.GitHubActionProject.property.release">release</a></code> | <code>projen.release.Release</code> | *No description.* |
-| <code><a href="#@xpertss/projen-types.GitHubActionProject.property.sonarWorkflow">sonarWorkflow</a></code> | <code><a href="#@xpertss/projen-types.ActionSonarWorkflow">ActionSonarWorkflow</a></code> | *No description.* |
+| <code><a href="#@xpertss/projen-types.GitHubActionProject.property.sonarWorkflow">sonarWorkflow</a></code> | <code><a href="#@xpertss/projen-types.SonarWorkflow">SonarWorkflow</a></code> | Set only when `sonarHostUrl` is provided. |
 ---
@@ -7771,13 +7820,15 @@ public readonly release: Release;
 ---
-##### `sonarWorkflow`<sup>Required</sup> <a name="sonarWorkflow" id="@xpertss/projen-types.GitHubActionProject.property.sonarWorkflow"></a>
+##### `sonarWorkflow`<sup>Optional</sup> <a name="sonarWorkflow" id="@xpertss/projen-types.GitHubActionProject.property.sonarWorkflow"></a>
 ```typescript
-public readonly sonarWorkflow: ActionSonarWorkflow;
+public readonly sonarWorkflow: SonarWorkflow;
 ```
-- *Type:* <a href="#@xpertss/projen-types.ActionSonarWorkflow">ActionSonarWorkflow</a>
+- *Type:* <a href="#@xpertss/projen-types.SonarWorkflow">SonarWorkflow</a>
+Set only when `sonarHostUrl` is provided.
 ---
@@ -8580,6 +8631,7 @@ When given a project, this it the project itself.
 | <code><a href="#@xpertss/projen-types.JavaAppProject.property.modules">modules</a></code> | <code><a href="#@xpertss/projen-types.MavenModule">MavenModule</a>[]</code> | The modules added with `addModule()`, in order. |
 | <code><a href="#@xpertss/projen-types.JavaAppProject.property.pom">pom</a></code> | <code><a href="#@xpertss/projen-types.MavenPom">MavenPom</a></code> | The root `pom.xml`. |
 | <code><a href="#@xpertss/projen-types.JavaAppProject.property.upgradeTask">upgradeTask</a></code> | <code>projen.Task</code> | Prints available dependency/plugin updates (`npx projen upgrade`). |
+| <code><a href="#@xpertss/projen-types.JavaAppProject.property.sonarWorkflow">sonarWorkflow</a></code> | <code><a href="#@xpertss/projen-types.SonarWorkflow">SonarWorkflow</a></code> | Set only when `sonarHostUrl` is provided. |
 ---
@@ -9022,6 +9074,18 @@ Prints available dependency/plugin updates (`npx projen upgrade`).
 ---
+##### `sonarWorkflow`<sup>Optional</sup> <a name="sonarWorkflow" id="@xpertss/projen-types.JavaAppProject.property.sonarWorkflow"></a>
+```typescript
+public readonly sonarWorkflow: SonarWorkflow;
+```
+- *Type:* <a href="#@xpertss/projen-types.SonarWorkflow">SonarWorkflow</a>
+Set only when `sonarHostUrl` is provided.
+---
 #### Constants <a name="Constants" id="Constants"></a>
 | **Name** | **Type** | **Description** |
@@ -9593,6 +9657,7 @@ When given a project, this it the project itself.
 | <code><a href="#@xpertss/projen-types.JavaLibraryProject.property.modules">modules</a></code> | <code><a href="#@xpertss/projen-types.MavenModule">MavenModule</a>[]</code> | The modules added with `addModule()`, in order. |
 | <code><a href="#@xpertss/projen-types.JavaLibraryProject.property.pom">pom</a></code> | <code><a href="#@xpertss/projen-types.MavenPom">MavenPom</a></code> | The root `pom.xml`. |
 | <code><a href="#@xpertss/projen-types.JavaLibraryProject.property.upgradeTask">upgradeTask</a></code> | <code>projen.Task</code> | Prints available dependency/plugin updates (`npx projen upgrade`). |
+| <code><a href="#@xpertss/projen-types.JavaLibraryProject.property.sonarWorkflow">sonarWorkflow</a></code> | <code><a href="#@xpertss/projen-types.SonarWorkflow">SonarWorkflow</a></code> | Set only when `sonarHostUrl` is provided. |
 ---
@@ -10035,6 +10100,18 @@ Prints available dependency/plugin updates (`npx projen upgrade`).
 ---
+##### `sonarWorkflow`<sup>Optional</sup> <a name="sonarWorkflow" id="@xpertss/projen-types.JavaLibraryProject.property.sonarWorkflow"></a>
+```typescript
+public readonly sonarWorkflow: SonarWorkflow;
+```
+- *Type:* <a href="#@xpertss/projen-types.SonarWorkflow">SonarWorkflow</a>
+Set only when `sonarHostUrl` is provided.
+---
 #### Constants <a name="Constants" id="Constants"></a>
 | **Name** | **Type** | **Description** |
@@ -10075,8 +10152,9 @@ usable on its own (`projen new ... java_maven`).
   modules inherit its plugins and test dependencies.
 - `npx projen build` synthesizes, then runs Maven once: `mvn -B verify`
   (unit tests via surefire, `*IT` tests via failsafe).
-- CI: a PR build (with an optional SonarQube scan), the projen drift
-  check, and a nightly report-only update check.
+ - CI: a PR build, the projen drift check, an optional SonarCloud scan
+ (`sonar.yml`, when `sonarHostUrl` is set), and a nightly report-only
+ update check.
 #### Initializers <a name="Initializers" id="@xpertss/projen-types.JavaMavenProject.Initializer"></a>
@@ -10618,6 +10696,7 @@ When given a project, this it the project itself.
 | <code><a href="#@xpertss/projen-types.JavaMavenProject.property.modules">modules</a></code> | <code><a href="#@xpertss/projen-types.MavenModule">MavenModule</a>[]</code> | The modules added with `addModule()`, in order. |
 | <code><a href="#@xpertss/projen-types.JavaMavenProject.property.pom">pom</a></code> | <code><a href="#@xpertss/projen-types.MavenPom">MavenPom</a></code> | The root `pom.xml`. |
 | <code><a href="#@xpertss/projen-types.JavaMavenProject.property.upgradeTask">upgradeTask</a></code> | <code>projen.Task</code> | Prints available dependency/plugin updates (`npx projen upgrade`). |
+| <code><a href="#@xpertss/projen-types.JavaMavenProject.property.sonarWorkflow">sonarWorkflow</a></code> | <code><a href="#@xpertss/projen-types.SonarWorkflow">SonarWorkflow</a></code> | Set only when `sonarHostUrl` is provided. |
 ---
@@ -11060,6 +11139,18 @@ Prints available dependency/plugin updates (`npx projen upgrade`).
 ---
+##### `sonarWorkflow`<sup>Optional</sup> <a name="sonarWorkflow" id="@xpertss/projen-types.JavaMavenProject.property.sonarWorkflow"></a>
+```typescript
+public readonly sonarWorkflow: SonarWorkflow;
+```
+- *Type:* <a href="#@xpertss/projen-types.SonarWorkflow">SonarWorkflow</a>
+Set only when `sonarHostUrl` is provided.
+---
 #### Constants <a name="Constants" id="Constants"></a>
 | **Name** | **Type** | **Description** |
@@ -11646,6 +11737,7 @@ When given a project, this it the project itself.
 | <code><a href="#@xpertss/projen-types.JavaServiceProject.property.modules">modules</a></code> | <code><a href="#@xpertss/projen-types.MavenModule">MavenModule</a>[]</code> | The modules added with `addModule()`, in order. |
 | <code><a href="#@xpertss/projen-types.JavaServiceProject.property.pom">pom</a></code> | <code><a href="#@xpertss/projen-types.MavenPom">MavenPom</a></code> | The root `pom.xml`. |
 | <code><a href="#@xpertss/projen-types.JavaServiceProject.property.upgradeTask">upgradeTask</a></code> | <code>projen.Task</code> | Prints available dependency/plugin updates (`npx projen upgrade`). |
+| <code><a href="#@xpertss/projen-types.JavaServiceProject.property.sonarWorkflow">sonarWorkflow</a></code> | <code><a href="#@xpertss/projen-types.SonarWorkflow">SonarWorkflow</a></code> | Set only when `sonarHostUrl` is provided. |
 | <code><a href="#@xpertss/projen-types.JavaServiceProject.property.springBootVersion">springBootVersion</a></code> | <code>string</code> | The Spring Boot version (BOM and Maven plugin). |
 ---
@@ -12089,6 +12181,18 @@ Prints available dependency/plugin updates (`npx projen upgrade`).
 ---
+##### `sonarWorkflow`<sup>Optional</sup> <a name="sonarWorkflow" id="@xpertss/projen-types.JavaServiceProject.property.sonarWorkflow"></a>
+```typescript
+public readonly sonarWorkflow: SonarWorkflow;
+```
+- *Type:* <a href="#@xpertss/projen-types.SonarWorkflow">SonarWorkflow</a>
+Set only when `sonarHostUrl` is provided.
+---
 ##### `springBootVersion`<sup>Required</sup> <a name="springBootVersion" id="@xpertss/projen-types.JavaServiceProject.property.springBootVersion"></a>
 ```typescript
@@ -12694,6 +12798,7 @@ When given a project, this it the project itself.
 | <code><a href="#@xpertss/projen-types.JavaSpringBootProject.property.modules">modules</a></code> | <code><a href="#@xpertss/projen-types.MavenModule">MavenModule</a>[]</code> | The modules added with `addModule()`, in order. |
 | <code><a href="#@xpertss/projen-types.JavaSpringBootProject.property.pom">pom</a></code> | <code><a href="#@xpertss/projen-types.MavenPom">MavenPom</a></code> | The root `pom.xml`. |
 | <code><a href="#@xpertss/projen-types.JavaSpringBootProject.property.upgradeTask">upgradeTask</a></code> | <code>projen.Task</code> | Prints available dependency/plugin updates (`npx projen upgrade`). |
+| <code><a href="#@xpertss/projen-types.JavaSpringBootProject.property.sonarWorkflow">sonarWorkflow</a></code> | <code><a href="#@xpertss/projen-types.SonarWorkflow">SonarWorkflow</a></code> | Set only when `sonarHostUrl` is provided. |
 | <code><a href="#@xpertss/projen-types.JavaSpringBootProject.property.springBootVersion">springBootVersion</a></code> | <code>string</code> | The Spring Boot version (BOM and Maven plugin). |
 ---
@@ -13137,6 +13242,18 @@ Prints available dependency/plugin updates (`npx projen upgrade`).
 ---
+##### `sonarWorkflow`<sup>Optional</sup> <a name="sonarWorkflow" id="@xpertss/projen-types.JavaSpringBootProject.property.sonarWorkflow"></a>
+```typescript
+public readonly sonarWorkflow: SonarWorkflow;
+```
+- *Type:* <a href="#@xpertss/projen-types.SonarWorkflow">SonarWorkflow</a>
+Set only when `sonarHostUrl` is provided.
+---
 ##### `springBootVersion`<sup>Required</sup> <a name="springBootVersion" id="@xpertss/projen-types.JavaSpringBootProject.property.springBootVersion"></a>
 ```typescript
@@ -14824,32 +14941,39 @@ public readonly workflow: GithubWorkflow;
 ---
-### WorkflowChangeNoticeWorkflow <a name="WorkflowChangeNoticeWorkflow" id="@xpertss/projen-types.WorkflowChangeNoticeWorkflow"></a>
+### SonarWorkflow <a name="SonarWorkflow" id="@xpertss/projen-types.SonarWorkflow"></a>
-#### Initializers <a name="Initializers" id="@xpertss/projen-types.WorkflowChangeNoticeWorkflow.Initializer"></a>
+AD-001 Layer 2: SonarCloud via the Scanner CLI only (never `SonarSource/sonarqube-scan-action` - third-party, and it carried a security advisory).
+`sonar.projectKey` defaults to
+`${sonarOrganization}_${name}` (the org + project key SonarCloud uses);
+`sonar.inclusions` is emitted only when provided, since the defaults are
+enough for default-recognized languages.
+#### Initializers <a name="Initializers" id="@xpertss/projen-types.SonarWorkflow.Initializer"></a>
 ```typescript
-import { WorkflowChangeNoticeWorkflow } from '@xpertss/projen-types'
+import { SonarWorkflow } from '@xpertss/projen-types'
-new WorkflowChangeNoticeWorkflow(scope: GitHubProject, options?: WorkflowChangeNoticeWorkflowOptions)
+new SonarWorkflow(scope: GitHubProject, options: SonarWorkflowOptions)
 ```
 | **Name** | **Type** | **Description** |
 | --- | --- | --- |
-| <code><a href="#@xpertss/projen-types.WorkflowChangeNoticeWorkflow.Initializer.parameter.scope">scope</a></code> | <code>projen.github.GitHubProject</code> | *No description.* |
-| <code><a href="#@xpertss/projen-types.WorkflowChangeNoticeWorkflow.Initializer.parameter.options">options</a></code> | <code><a href="#@xpertss/projen-types.WorkflowChangeNoticeWorkflowOptions">WorkflowChangeNoticeWorkflowOptions</a></code> | *No description.* |
+| <code><a href="#@xpertss/projen-types.SonarWorkflow.Initializer.parameter.scope">scope</a></code> | <code>projen.github.GitHubProject</code> | *No description.* |
+| <code><a href="#@xpertss/projen-types.SonarWorkflow.Initializer.parameter.options">options</a></code> | <code><a href="#@xpertss/projen-types.SonarWorkflowOptions">SonarWorkflowOptions</a></code> | *No description.* |
 ---
-##### `scope`<sup>Required</sup> <a name="scope" id="@xpertss/projen-types.WorkflowChangeNoticeWorkflow.Initializer.parameter.scope"></a>
+##### `scope`<sup>Required</sup> <a name="scope" id="@xpertss/projen-types.SonarWorkflow.Initializer.parameter.scope"></a>
 - *Type:* projen.github.GitHubProject
 ---
-##### `options`<sup>Optional</sup> <a name="options" id="@xpertss/projen-types.WorkflowChangeNoticeWorkflow.Initializer.parameter.options"></a>
+##### `options`<sup>Required</sup> <a name="options" id="@xpertss/projen-types.SonarWorkflow.Initializer.parameter.options"></a>
-- *Type:* <a href="#@xpertss/projen-types.WorkflowChangeNoticeWorkflowOptions">WorkflowChangeNoticeWorkflowOptions</a>
+- *Type:* <a href="#@xpertss/projen-types.SonarWorkflowOptions">SonarWorkflowOptions</a>
 ---
@@ -14857,17 +14981,17 @@ new WorkflowChangeNoticeWorkflow(scope: GitHubProject, options?: WorkflowChangeN
 | **Name** | **Description** |
 | --- | --- |
-| <code><a href="#@xpertss/projen-types.WorkflowChangeNoticeWorkflow.toString">toString</a></code> | Returns a string representation of this construct. |
-| <code><a href="#@xpertss/projen-types.WorkflowChangeNoticeWorkflow.with">with</a></code> | Applies one or more mixins to this construct. |
-| <code><a href="#@xpertss/projen-types.WorkflowChangeNoticeWorkflow.postProjectCreation">postProjectCreation</a></code> | Called once, right after `postSynthesize()`, only when the project is created for the first time. |
-| <code><a href="#@xpertss/projen-types.WorkflowChangeNoticeWorkflow.postSynthesize">postSynthesize</a></code> | Called after synthesis. |
-| <code><a href="#@xpertss/projen-types.WorkflowChangeNoticeWorkflow.preSynthesize">preSynthesize</a></code> | Called before synthesis. |
-| <code><a href="#@xpertss/projen-types.WorkflowChangeNoticeWorkflow.projectCreation">projectCreation</a></code> | Called once, right after `synthesize()`, only when the project is created for the first time. |
-| <code><a href="#@xpertss/projen-types.WorkflowChangeNoticeWorkflow.synthesize">synthesize</a></code> | Synthesizes files to the project output directory. |
+| <code><a href="#@xpertss/projen-types.SonarWorkflow.toString">toString</a></code> | Returns a string representation of this construct. |
+| <code><a href="#@xpertss/projen-types.SonarWorkflow.with">with</a></code> | Applies one or more mixins to this construct. |
+| <code><a href="#@xpertss/projen-types.SonarWorkflow.postProjectCreation">postProjectCreation</a></code> | Called once, right after `postSynthesize()`, only when the project is created for the first time. |
+| <code><a href="#@xpertss/projen-types.SonarWorkflow.postSynthesize">postSynthesize</a></code> | Called after synthesis. |
+| <code><a href="#@xpertss/projen-types.SonarWorkflow.preSynthesize">preSynthesize</a></code> | Called before synthesis. |
+| <code><a href="#@xpertss/projen-types.SonarWorkflow.projectCreation">projectCreation</a></code> | Called once, right after `synthesize()`, only when the project is created for the first time. |
+| <code><a href="#@xpertss/projen-types.SonarWorkflow.synthesize">synthesize</a></code> | Synthesizes files to the project output directory. |
 ---
-##### `toString` <a name="toString" id="@xpertss/projen-types.WorkflowChangeNoticeWorkflow.toString"></a>
+##### `toString` <a name="toString" id="@xpertss/projen-types.SonarWorkflow.toString"></a>
 ```typescript
 public toString(): string
@@ -14875,7 +14999,7 @@ public toString(): string
 Returns a string representation of this construct.
-##### `with` <a name="with" id="@xpertss/projen-types.WorkflowChangeNoticeWorkflow.with"></a>
+##### `with` <a name="with" id="@xpertss/projen-types.SonarWorkflow.with"></a>
 ```typescript
 public with(mixins: ...IMixin[]): IConstruct
@@ -14888,7 +15012,7 @@ start of the call, so constructs added by a mixin will not be visited.
 Use multiple `with()` calls if subsequent mixins should apply to added
 constructs.
-###### `mixins`<sup>Required</sup> <a name="mixins" id="@xpertss/projen-types.WorkflowChangeNoticeWorkflow.with.parameter.mixins"></a>
+###### `mixins`<sup>Required</sup> <a name="mixins" id="@xpertss/projen-types.SonarWorkflow.with.parameter.mixins"></a>
 - *Type:* ...constructs.IMixin[]
@@ -14896,7 +15020,7 @@ The mixins to apply.
 ---
-##### `postProjectCreation` <a name="postProjectCreation" id="@xpertss/projen-types.WorkflowChangeNoticeWorkflow.postProjectCreation"></a>
+##### `postProjectCreation` <a name="postProjectCreation" id="@xpertss/projen-types.SonarWorkflow.postProjectCreation"></a>
 ```typescript
 public postProjectCreation(initProject: InitProject): void
@@ -14909,7 +15033,7 @@ It is also skipped when post-synthesis steps are disabled, e.g. `--no-post` or `
 Use it for one-off setup that can be turned off by the user, like running a task to give the user immediate
 feedback on their new project. Order across components is not guaranteed.
-###### `initProject`<sup>Required</sup> <a name="initProject" id="@xpertss/projen-types.WorkflowChangeNoticeWorkflow.postProjectCreation.parameter.initProject"></a>
+###### `initProject`<sup>Required</sup> <a name="initProject" id="@xpertss/projen-types.SonarWorkflow.postProjectCreation.parameter.initProject"></a>
 - *Type:* projen.InitProject
@@ -14917,7 +15041,7 @@ Details about how the project was created, e.g. its type and the original CLI ar
 ---
-##### `postSynthesize` <a name="postSynthesize" id="@xpertss/projen-types.WorkflowChangeNoticeWorkflow.postSynthesize"></a>
+##### `postSynthesize` <a name="postSynthesize" id="@xpertss/projen-types.SonarWorkflow.postSynthesize"></a>
 ```typescript
 public postSynthesize(): void
@@ -14927,7 +15051,7 @@ Called after synthesis.
 Order is *not* guaranteed.
-##### `preSynthesize` <a name="preSynthesize" id="@xpertss/projen-types.WorkflowChangeNoticeWorkflow.preSynthesize"></a>
+##### `preSynthesize` <a name="preSynthesize" id="@xpertss/projen-types.SonarWorkflow.preSynthesize"></a>
 ```typescript
 public preSynthesize(): void
@@ -14935,7 +15059,7 @@ public preSynthesize(): void
 Called before synthesis.
-##### `projectCreation` <a name="projectCreation" id="@xpertss/projen-types.WorkflowChangeNoticeWorkflow.projectCreation"></a>
+##### `projectCreation` <a name="projectCreation" id="@xpertss/projen-types.SonarWorkflow.projectCreation"></a>
 ```typescript
 public projectCreation(initProject: InitProject): void
@@ -14946,7 +15070,7 @@ Called once, right after `synthesize()`, only when the project is created for th
 It does not run on later `projen` invocations. It only fires for `projen new` (or `Projects.createProject`).
 Use it for deterministic, one-off file generation. Order across components is not guaranteed.
-###### `initProject`<sup>Required</sup> <a name="initProject" id="@xpertss/projen-types.WorkflowChangeNoticeWorkflow.projectCreation.parameter.initProject"></a>
+###### `initProject`<sup>Required</sup> <a name="initProject" id="@xpertss/projen-types.SonarWorkflow.projectCreation.parameter.initProject"></a>
 - *Type:* projen.InitProject
@@ -14954,7 +15078,7 @@ Details about how the project was created, e.g. its type and the original CLI ar
 ---
-##### `synthesize` <a name="synthesize" id="@xpertss/projen-types.WorkflowChangeNoticeWorkflow.synthesize"></a>
+##### `synthesize` <a name="synthesize" id="@xpertss/projen-types.SonarWorkflow.synthesize"></a>
 ```typescript
 public synthesize(): void
@@ -14966,17 +15090,17 @@ Synthesizes files to the project output directory.
 | **Name** | **Description** |
 | --- | --- |
-| <code><a href="#@xpertss/projen-types.WorkflowChangeNoticeWorkflow.isConstruct">isConstruct</a></code> | Checks if `x` is a construct. |
-| <code><a href="#@xpertss/projen-types.WorkflowChangeNoticeWorkflow.isComponent">isComponent</a></code> | Test whether the given construct is a component. |
+| <code><a href="#@xpertss/projen-types.SonarWorkflow.isConstruct">isConstruct</a></code> | Checks if `x` is a construct. |
+| <code><a href="#@xpertss/projen-types.SonarWorkflow.isComponent">isComponent</a></code> | Test whether the given construct is a component. |
 ---
-##### `isConstruct` <a name="isConstruct" id="@xpertss/projen-types.WorkflowChangeNoticeWorkflow.isConstruct"></a>
+##### `isConstruct` <a name="isConstruct" id="@xpertss/projen-types.SonarWorkflow.isConstruct"></a>
 ```typescript
-import { WorkflowChangeNoticeWorkflow } from '@xpertss/projen-types'
+import { SonarWorkflow } from '@xpertss/projen-types'
-WorkflowChangeNoticeWorkflow.isConstruct(x: any)
+SonarWorkflow.isConstruct(x: any)
 ```
 Checks if `x` is a construct.
@@ -14995,7 +15119,7 @@ library can be accidentally installed, and `instanceof` will behave
 unpredictably. It is safest to avoid using `instanceof`, and using
 this type-testing method instead.
-###### `x`<sup>Required</sup> <a name="x" id="@xpertss/projen-types.WorkflowChangeNoticeWorkflow.isConstruct.parameter.x"></a>
+###### `x`<sup>Required</sup> <a name="x" id="@xpertss/projen-types.SonarWorkflow.isConstruct.parameter.x"></a>
 - *Type:* any
@@ -15003,17 +15127,17 @@ Any object.
 ---
-##### `isComponent` <a name="isComponent" id="@xpertss/projen-types.WorkflowChangeNoticeWorkflow.isComponent"></a>
+##### `isComponent` <a name="isComponent" id="@xpertss/projen-types.SonarWorkflow.isComponent"></a>
 ```typescript
-import { WorkflowChangeNoticeWorkflow } from '@xpertss/projen-types'
+import { SonarWorkflow } from '@xpertss/projen-types'
-WorkflowChangeNoticeWorkflow.isComponent(x: any)
+SonarWorkflow.isComponent(x: any)
 ```
 Test whether the given construct is a component.
-###### `x`<sup>Required</sup> <a name="x" id="@xpertss/projen-types.WorkflowChangeNoticeWorkflow.isComponent.parameter.x"></a>
+###### `x`<sup>Required</sup> <a name="x" id="@xpertss/projen-types.SonarWorkflow.isComponent.parameter.x"></a>
 - *Type:* any
@@ -15023,13 +15147,13 @@ Test whether the given construct is a component.
 | **Name** | **Type** | **Description** |
 | --- | --- | --- |
-| <code><a href="#@xpertss/projen-types.WorkflowChangeNoticeWorkflow.property.node">node</a></code> | <code>constructs.Node</code> | The tree node. |
-| <code><a href="#@xpertss/projen-types.WorkflowChangeNoticeWorkflow.property.project">project</a></code> | <code>projen.Project</code> | *No description.* |
-| <code><a href="#@xpertss/projen-types.WorkflowChangeNoticeWorkflow.property.workflow">workflow</a></code> | <code>projen.github.GithubWorkflow</code> | *No description.* |
+| <code><a href="#@xpertss/projen-types.SonarWorkflow.property.node">node</a></code> | <code>constructs.Node</code> | The tree node. |
+| <code><a href="#@xpertss/projen-types.SonarWorkflow.property.project">project</a></code> | <code>projen.Project</code> | *No description.* |
+| <code><a href="#@xpertss/projen-types.SonarWorkflow.property.workflow">workflow</a></code> | <code>projen.github.GithubWorkflow</code> | *No description.* |
 ---
-##### `node`<sup>Required</sup> <a name="node" id="@xpertss/projen-types.WorkflowChangeNoticeWorkflow.property.node"></a>
+##### `node`<sup>Required</sup> <a name="node" id="@xpertss/projen-types.SonarWorkflow.property.node"></a>
 ```typescript
 public readonly node: Node;
@@ -15041,7 +15165,7 @@ The tree node.
 ---
-##### `project`<sup>Required</sup> <a name="project" id="@xpertss/projen-types.WorkflowChangeNoticeWorkflow.property.project"></a>
+##### `project`<sup>Required</sup> <a name="project" id="@xpertss/projen-types.SonarWorkflow.property.project"></a>
 ```typescript
 public readonly project: Project;
@@ -15051,7 +15175,7 @@ public readonly project: Project;
 ---
-##### `workflow`<sup>Required</sup> <a name="workflow" id="@xpertss/projen-types.WorkflowChangeNoticeWorkflow.property.workflow"></a>
+##### `workflow`<sup>Required</sup> <a name="workflow" id="@xpertss/projen-types.SonarWorkflow.property.workflow"></a>
 ```typescript
 public readonly workflow: GithubWorkflow;
@@ -15062,213 +15186,381 @@ public readonly workflow: GithubWorkflow;
 ---
-## Structs <a name="Structs" id="Structs"></a>
-### ActionDogfoodOptions <a name="ActionDogfoodOptions" id="@xpertss/projen-types.ActionDogfoodOptions"></a>
+### WorkflowChangeNoticeWorkflow <a name="WorkflowChangeNoticeWorkflow" id="@xpertss/projen-types.WorkflowChangeNoticeWorkflow"></a>
-#### Initializer <a name="Initializer" id="@xpertss/projen-types.ActionDogfoodOptions.Initializer"></a>
+#### Initializers <a name="Initializers" id="@xpertss/projen-types.WorkflowChangeNoticeWorkflow.Initializer"></a>
 ```typescript
-import { ActionDogfoodOptions } from '@xpertss/projen-types'
+import { WorkflowChangeNoticeWorkflow } from '@xpertss/projen-types'
-const actionDogfoodOptions: ActionDogfoodOptions = { ... }
+new WorkflowChangeNoticeWorkflow(scope: GitHubProject, options?: WorkflowChangeNoticeWorkflowOptions)
 ```
-#### Properties <a name="Properties" id="Properties"></a>
 | **Name** | **Type** | **Description** |
 | --- | --- | --- |
-| <code><a href="#@xpertss/projen-types.ActionDogfoodOptions.property.cleanup">cleanup</a></code> | <code>string[]</code> | Shell cleanup, run once at the end with `if: always()` so repeated runs start clean. |
-| <code><a href="#@xpertss/projen-types.ActionDogfoodOptions.property.scenario">scenario</a></code> | <code><a href="#@xpertss/projen-types.ActionDogfoodStep">ActionDogfoodStep</a>[]</code> | One or more scenario steps, run in order, in the dogfood job. |
+| <code><a href="#@xpertss/projen-types.WorkflowChangeNoticeWorkflow.Initializer.parameter.scope">scope</a></code> | <code>projen.github.GitHubProject</code> | *No description.* |
+| <code><a href="#@xpertss/projen-types.WorkflowChangeNoticeWorkflow.Initializer.parameter.options">options</a></code> | <code><a href="#@xpertss/projen-types.WorkflowChangeNoticeWorkflowOptions">WorkflowChangeNoticeWorkflowOptions</a></code> | *No description.* |
 ---
-##### `cleanup`<sup>Required</sup> <a name="cleanup" id="@xpertss/projen-types.ActionDogfoodOptions.property.cleanup"></a>
+##### `scope`<sup>Required</sup> <a name="scope" id="@xpertss/projen-types.WorkflowChangeNoticeWorkflow.Initializer.parameter.scope"></a>
-```typescript
-public readonly cleanup: string[];
-```
+- *Type:* projen.github.GitHubProject
-- *Type:* string[]
+---
-Shell cleanup, run once at the end with `if: always()` so repeated runs start clean.
+##### `options`<sup>Optional</sup> <a name="options" id="@xpertss/projen-types.WorkflowChangeNoticeWorkflow.Initializer.parameter.options"></a>
-Intentionally **best-effort**: unlike the assert step it does
-*not* run under `set -e`, so a failing line (e.g. deleting an already
-deleted ref) does not fail the job.
+- *Type:* <a href="#@xpertss/projen-types.WorkflowChangeNoticeWorkflowOptions">WorkflowChangeNoticeWorkflowOptions</a>
 ---
-##### `scenario`<sup>Required</sup> <a name="scenario" id="@xpertss/projen-types.ActionDogfoodOptions.property.scenario"></a>
-```typescript
-public readonly scenario: ActionDogfoodStep[];
-```
-- *Type:* <a href="#@xpertss/projen-types.ActionDogfoodStep">ActionDogfoodStep</a>[]
+#### Methods <a name="Methods" id="Methods"></a>
-One or more scenario steps, run in order, in the dogfood job.
+| **Name** | **Description** |
+| --- | --- |
+| <code><a href="#@xpertss/projen-types.WorkflowChangeNoticeWorkflow.toString">toString</a></code> | Returns a string representation of this construct. |
+| <code><a href="#@xpertss/projen-types.WorkflowChangeNoticeWorkflow.with">with</a></code> | Applies one or more mixins to this construct. |
+| <code><a href="#@xpertss/projen-types.WorkflowChangeNoticeWorkflow.postProjectCreation">postProjectCreation</a></code> | Called once, right after `postSynthesize()`, only when the project is created for the first time. |
+| <code><a href="#@xpertss/projen-types.WorkflowChangeNoticeWorkflow.postSynthesize">postSynthesize</a></code> | Called after synthesis. |
+| <code><a href="#@xpertss/projen-types.WorkflowChangeNoticeWorkflow.preSynthesize">preSynthesize</a></code> | Called before synthesis. |
+| <code><a href="#@xpertss/projen-types.WorkflowChangeNoticeWorkflow.projectCreation">projectCreation</a></code> | Called once, right after `synthesize()`, only when the project is created for the first time. |
+| <code><a href="#@xpertss/projen-types.WorkflowChangeNoticeWorkflow.synthesize">synthesize</a></code> | Synthesizes files to the project output directory. |
 ---
-### ActionDogfoodStep <a name="ActionDogfoodStep" id="@xpertss/projen-types.ActionDogfoodStep"></a>
-One invocation of the action within the dogfood scenario: optional fixture setup, the `uses: ./` call with this step's inputs, then this step's assertions. Most actions need exactly one; actions with a re-run/no-op behavior to verify (e.g. F006's reuse-the-PR path, F007's no-op-commit path) declare two.
-#### Initializer <a name="Initializer" id="@xpertss/projen-types.ActionDogfoodStep.Initializer"></a>
+##### `toString` <a name="toString" id="@xpertss/projen-types.WorkflowChangeNoticeWorkflow.toString"></a>
 ```typescript
-import { ActionDogfoodStep } from '@xpertss/projen-types'
-const actionDogfoodStep: ActionDogfoodStep = { ... }
+public toString(): string
 ```
-#### Properties <a name="Properties" id="Properties"></a>
-| **Name** | **Type** | **Description** |
-| --- | --- | --- |
-| <code><a href="#@xpertss/projen-types.ActionDogfoodStep.property.assertions">assertions</a></code> | <code>string[]</code> | Shell assertions after this invocation - the job fails unless every one exits 0. |
-| <code><a href="#@xpertss/projen-types.ActionDogfoodStep.property.name">name</a></code> | <code>string</code> | Label used to name this step-group's generated workflow steps. |
-| <code><a href="#@xpertss/projen-types.ActionDogfoodStep.property.fixtureSteps">fixtureSteps</a></code> | <code>string[]</code> | Shell steps executed before this invocation, to produce or alter fixture state. |
-| <code><a href="#@xpertss/projen-types.ActionDogfoodStep.property.id">id</a></code> | <code>string</code> | Step id for the `uses: ./` invocation, so a later assertion can reference this step's outputs via `${{ steps.<id>.outputs.<name> }}`. |
-| <code><a href="#@xpertss/projen-types.ActionDogfoodStep.property.inputs">inputs</a></code> | <code>{[ key: string ]: string}</code> | `with:` inputs for this invocation's local `uses: ./` call. |
----
+Returns a string representation of this construct.
-##### `assertions`<sup>Required</sup> <a name="assertions" id="@xpertss/projen-types.ActionDogfoodStep.property.assertions"></a>
+##### `with` <a name="with" id="@xpertss/projen-types.WorkflowChangeNoticeWorkflow.with"></a>
 ```typescript
-public readonly assertions: string[];
+public with(mixins: ...IMixin[]): IConstruct
 ```
-- *Type:* string[]
+Applies one or more mixins to this construct.
-Shell assertions after this invocation - the job fails unless every one exits 0.
+Mixins are applied in order. The list of constructs is captured at the
+start of the call, so constructs added by a mixin will not be visited.
+Use multiple `with()` calls if subsequent mixins should apply to added
+constructs.
-The generated step runs under `set -euo pipefail`, so a failing
-assertion fails the step immediately rather than being masked by a later,
-passing one.
+###### `mixins`<sup>Required</sup> <a name="mixins" id="@xpertss/projen-types.WorkflowChangeNoticeWorkflow.with.parameter.mixins"></a>
+- *Type:* ...constructs.IMixin[]
+The mixins to apply.
 ---
-##### `name`<sup>Required</sup> <a name="name" id="@xpertss/projen-types.ActionDogfoodStep.property.name"></a>
+##### `postProjectCreation` <a name="postProjectCreation" id="@xpertss/projen-types.WorkflowChangeNoticeWorkflow.postProjectCreation"></a>
 ```typescript
-public readonly name: string;
+public postProjectCreation(initProject: InitProject): void
 ```
-- *Type:* string
-Label used to name this step-group's generated workflow steps.
----
+Called once, right after `postSynthesize()`, only when the project is created for the first time.
-##### `fixtureSteps`<sup>Optional</sup> <a name="fixtureSteps" id="@xpertss/projen-types.ActionDogfoodStep.property.fixtureSteps"></a>
+It does not run on later `projen` invocations. It only fires for `projen new` (or `Projects.createProject`).
+It is also skipped when post-synthesis steps are disabled, e.g. `--no-post` or `PROJEN_DISABLE_POST`.
+Use it for one-off setup that can be turned off by the user, like running a task to give the user immediate
+feedback on their new project. Order across components is not guaranteed.
-```typescript
-public readonly fixtureSteps: string[];
-```
+###### `initProject`<sup>Required</sup> <a name="initProject" id="@xpertss/projen-types.WorkflowChangeNoticeWorkflow.postProjectCreation.parameter.initProject"></a>
-- *Type:* string[]
-- *Default:* []
+- *Type:* projen.InitProject
-Shell steps executed before this invocation, to produce or alter fixture state.
+Details about how the project was created, e.g. its type and the original CLI args.
 ---
-##### `id`<sup>Optional</sup> <a name="id" id="@xpertss/projen-types.ActionDogfoodStep.property.id"></a>
+##### `postSynthesize` <a name="postSynthesize" id="@xpertss/projen-types.WorkflowChangeNoticeWorkflow.postSynthesize"></a>
 ```typescript
-public readonly id: string;
+public postSynthesize(): void
 ```
-- *Type:* string
-- *Default:* a slug derived from `name`, disambiguated by position
-Step id for the `uses: ./` invocation, so a later assertion can reference this step's outputs via `${{ steps.<id>.outputs.<name> }}`.
+Called after synthesis.
----
+Order is *not* guaranteed.
-##### `inputs`<sup>Optional</sup> <a name="inputs" id="@xpertss/projen-types.ActionDogfoodStep.property.inputs"></a>
+##### `preSynthesize` <a name="preSynthesize" id="@xpertss/projen-types.WorkflowChangeNoticeWorkflow.preSynthesize"></a>
 ```typescript
-public readonly inputs: {[ key: string ]: string};
+public preSynthesize(): void
 ```
-- *Type:* {[ key: string ]: string}
-- *Default:* {}
-`with:` inputs for this invocation's local `uses: ./` call.
----
-### ActionSonarWorkflowOptions <a name="ActionSonarWorkflowOptions" id="@xpertss/projen-types.ActionSonarWorkflowOptions"></a>
+Called before synthesis.
-#### Initializer <a name="Initializer" id="@xpertss/projen-types.ActionSonarWorkflowOptions.Initializer"></a>
+##### `projectCreation` <a name="projectCreation" id="@xpertss/projen-types.WorkflowChangeNoticeWorkflow.projectCreation"></a>
 ```typescript
-import { ActionSonarWorkflowOptions } from '@xpertss/projen-types'
-const actionSonarWorkflowOptions: ActionSonarWorkflowOptions = { ... }
+public projectCreation(initProject: InitProject): void
 ```
-#### Properties <a name="Properties" id="Properties"></a>
+Called once, right after `synthesize()`, only when the project is created for the first time.
+It does not run on later `projen` invocations. It only fires for `projen new` (or `Projects.createProject`).
+Use it for deterministic, one-off file generation. Order across components is not guaranteed.
+###### `initProject`<sup>Required</sup> <a name="initProject" id="@xpertss/projen-types.WorkflowChangeNoticeWorkflow.projectCreation.parameter.initProject"></a>
+- *Type:* projen.InitProject
+Details about how the project was created, e.g. its type and the original CLI args.
+---
+##### `synthesize` <a name="synthesize" id="@xpertss/projen-types.WorkflowChangeNoticeWorkflow.synthesize"></a>
+```typescript
+public synthesize(): void
+```
+Synthesizes files to the project output directory.
+#### Static Functions <a name="Static Functions" id="Static Functions"></a>
+| **Name** | **Description** |
+| --- | --- |
+| <code><a href="#@xpertss/projen-types.WorkflowChangeNoticeWorkflow.isConstruct">isConstruct</a></code> | Checks if `x` is a construct. |
+| <code><a href="#@xpertss/projen-types.WorkflowChangeNoticeWorkflow.isComponent">isComponent</a></code> | Test whether the given construct is a component. |
+---
+##### `isConstruct` <a name="isConstruct" id="@xpertss/projen-types.WorkflowChangeNoticeWorkflow.isConstruct"></a>
+```typescript
+import { WorkflowChangeNoticeWorkflow } from '@xpertss/projen-types'
+WorkflowChangeNoticeWorkflow.isConstruct(x: any)
+```
+Checks if `x` is a construct.
+Use this method instead of `instanceof` to properly detect `Construct`
+instances, even when the construct library is symlinked.
+Explanation: in JavaScript, multiple copies of the `constructs` library on
+disk are seen as independent, completely different libraries. As a
+consequence, the class `Construct` in each copy of the `constructs` library
+is seen as a different class, and an instance of one class will not test as
+`instanceof` the other class. `npm install` will not create installations
+like this, but users may manually symlink construct libraries together or
+use a monorepo tool: in those cases, multiple copies of the `constructs`
+library can be accidentally installed, and `instanceof` will behave
+unpredictably. It is safest to avoid using `instanceof`, and using
+this type-testing method instead.
+###### `x`<sup>Required</sup> <a name="x" id="@xpertss/projen-types.WorkflowChangeNoticeWorkflow.isConstruct.parameter.x"></a>
+- *Type:* any
+Any object.
+---
+##### `isComponent` <a name="isComponent" id="@xpertss/projen-types.WorkflowChangeNoticeWorkflow.isComponent"></a>
+```typescript
+import { WorkflowChangeNoticeWorkflow } from '@xpertss/projen-types'
+WorkflowChangeNoticeWorkflow.isComponent(x: any)
+```
+Test whether the given construct is a component.
+###### `x`<sup>Required</sup> <a name="x" id="@xpertss/projen-types.WorkflowChangeNoticeWorkflow.isComponent.parameter.x"></a>
+- *Type:* any
+---
+#### Properties <a name="Properties" id="Properties"></a>
 | **Name** | **Type** | **Description** |
 | --- | --- | --- |
-| <code><a href="#@xpertss/projen-types.ActionSonarWorkflowOptions.property.sonarHostUrl">sonarHostUrl</a></code> | <code>string</code> | URL of the org's SonarCloud instance (e.g. `https://sonarcloud.io`). Required, no default - a guessed server is worse than a loud failure. |
-| <code><a href="#@xpertss/projen-types.ActionSonarWorkflowOptions.property.sonarOrganization">sonarOrganization</a></code> | <code>string</code> | SonarCloud organization key (`sonar.organization`). Mandatory for the Scanner CLI on SonarCloud - it is not derived from the token, so a scan without it always fails. |
-| <code><a href="#@xpertss/projen-types.ActionSonarWorkflowOptions.property.sonarPullRequestGate">sonarPullRequestGate</a></code> | <code>boolean</code> | Whether `sonar.yml` also runs on `pull_request` as a pass/fail gate. |
-| <code><a href="#@xpertss/projen-types.ActionSonarWorkflowOptions.property.sonarTokenSecret">sonarTokenSecret</a></code> | <code>string</code> | *No description.* |
+| <code><a href="#@xpertss/projen-types.WorkflowChangeNoticeWorkflow.property.node">node</a></code> | <code>constructs.Node</code> | The tree node. |
+| <code><a href="#@xpertss/projen-types.WorkflowChangeNoticeWorkflow.property.project">project</a></code> | <code>projen.Project</code> | *No description.* |
+| <code><a href="#@xpertss/projen-types.WorkflowChangeNoticeWorkflow.property.workflow">workflow</a></code> | <code>projen.github.GithubWorkflow</code> | *No description.* |
 ---
-##### `sonarHostUrl`<sup>Required</sup> <a name="sonarHostUrl" id="@xpertss/projen-types.ActionSonarWorkflowOptions.property.sonarHostUrl"></a>
+##### `node`<sup>Required</sup> <a name="node" id="@xpertss/projen-types.WorkflowChangeNoticeWorkflow.property.node"></a>
 ```typescript
-public readonly sonarHostUrl: string;
+public readonly node: Node;
 ```
-- *Type:* string
+- *Type:* constructs.Node
-URL of the org's SonarCloud instance (e.g. `https://sonarcloud.io`). Required, no default - a guessed server is worse than a loud failure.
+The tree node.
 ---
-##### `sonarOrganization`<sup>Optional</sup> <a name="sonarOrganization" id="@xpertss/projen-types.ActionSonarWorkflowOptions.property.sonarOrganization"></a>
+##### `project`<sup>Required</sup> <a name="project" id="@xpertss/projen-types.WorkflowChangeNoticeWorkflow.property.project"></a>
 ```typescript
-public readonly sonarOrganization: string;
+public readonly project: Project;
+```
+- *Type:* projen.Project
+---
+##### `workflow`<sup>Required</sup> <a name="workflow" id="@xpertss/projen-types.WorkflowChangeNoticeWorkflow.property.workflow"></a>
+```typescript
+public readonly workflow: GithubWorkflow;
+```
+- *Type:* projen.github.GithubWorkflow
+---
+## Structs <a name="Structs" id="Structs"></a>
+### ActionDogfoodOptions <a name="ActionDogfoodOptions" id="@xpertss/projen-types.ActionDogfoodOptions"></a>
+#### Initializer <a name="Initializer" id="@xpertss/projen-types.ActionDogfoodOptions.Initializer"></a>
+```typescript
+import { ActionDogfoodOptions } from '@xpertss/projen-types'
+const actionDogfoodOptions: ActionDogfoodOptions = { ... }
+```
+#### Properties <a name="Properties" id="Properties"></a>
+| **Name** | **Type** | **Description** |
+| --- | --- | --- |
+| <code><a href="#@xpertss/projen-types.ActionDogfoodOptions.property.cleanup">cleanup</a></code> | <code>string[]</code> | Shell cleanup, run once at the end with `if: always()` so repeated runs start clean. |
+| <code><a href="#@xpertss/projen-types.ActionDogfoodOptions.property.scenario">scenario</a></code> | <code><a href="#@xpertss/projen-types.ActionDogfoodStep">ActionDogfoodStep</a>[]</code> | One or more scenario steps, run in order, in the dogfood job. |
+---
+##### `cleanup`<sup>Required</sup> <a name="cleanup" id="@xpertss/projen-types.ActionDogfoodOptions.property.cleanup"></a>
+```typescript
+public readonly cleanup: string[];
+```
+- *Type:* string[]
+Shell cleanup, run once at the end with `if: always()` so repeated runs start clean.
+Intentionally **best-effort**: unlike the assert step it does
+*not* run under `set -e`, so a failing line (e.g. deleting an already
+deleted ref) does not fail the job.
+---
+##### `scenario`<sup>Required</sup> <a name="scenario" id="@xpertss/projen-types.ActionDogfoodOptions.property.scenario"></a>
+```typescript
+public readonly scenario: ActionDogfoodStep[];
+```
+- *Type:* <a href="#@xpertss/projen-types.ActionDogfoodStep">ActionDogfoodStep</a>[]
+One or more scenario steps, run in order, in the dogfood job.
+---
+### ActionDogfoodStep <a name="ActionDogfoodStep" id="@xpertss/projen-types.ActionDogfoodStep"></a>
+One invocation of the action within the dogfood scenario: optional fixture setup, the `uses: ./` call with this step's inputs, then this step's assertions. Most actions need exactly one; actions with a re-run/no-op behavior to verify (e.g. F006's reuse-the-PR path, F007's no-op-commit path) declare two.
+#### Initializer <a name="Initializer" id="@xpertss/projen-types.ActionDogfoodStep.Initializer"></a>
+```typescript
+import { ActionDogfoodStep } from '@xpertss/projen-types'
+const actionDogfoodStep: ActionDogfoodStep = { ... }
+```
+#### Properties <a name="Properties" id="Properties"></a>
+| **Name** | **Type** | **Description** |
+| --- | --- | --- |
+| <code><a href="#@xpertss/projen-types.ActionDogfoodStep.property.assertions">assertions</a></code> | <code>string[]</code> | Shell assertions after this invocation - the job fails unless every one exits 0. |
+| <code><a href="#@xpertss/projen-types.ActionDogfoodStep.property.name">name</a></code> | <code>string</code> | Label used to name this step-group's generated workflow steps. |
+| <code><a href="#@xpertss/projen-types.ActionDogfoodStep.property.fixtureSteps">fixtureSteps</a></code> | <code>string[]</code> | Shell steps executed before this invocation, to produce or alter fixture state. |
+| <code><a href="#@xpertss/projen-types.ActionDogfoodStep.property.id">id</a></code> | <code>string</code> | Step id for the `uses: ./` invocation, so a later assertion can reference this step's outputs via `${{ steps.<id>.outputs.<name> }}`. |
+| <code><a href="#@xpertss/projen-types.ActionDogfoodStep.property.inputs">inputs</a></code> | <code>{[ key: string ]: string}</code> | `with:` inputs for this invocation's local `uses: ./` call. |
+---
+##### `assertions`<sup>Required</sup> <a name="assertions" id="@xpertss/projen-types.ActionDogfoodStep.property.assertions"></a>
+```typescript
+public readonly assertions: string[];
+```
+- *Type:* string[]
+Shell assertions after this invocation - the job fails unless every one exits 0.
+The generated step runs under `set -euo pipefail`, so a failing
+assertion fails the step immediately rather than being masked by a later,
+passing one.
+---
+##### `name`<sup>Required</sup> <a name="name" id="@xpertss/projen-types.ActionDogfoodStep.property.name"></a>
+```typescript
+public readonly name: string;
 ```
 - *Type:* string
-- *Default:* "xpertss"
-SonarCloud organization key (`sonar.organization`). Mandatory for the Scanner CLI on SonarCloud - it is not derived from the token, so a scan without it always fails.
+Label used to name this step-group's generated workflow steps.
 ---
-##### `sonarPullRequestGate`<sup>Optional</sup> <a name="sonarPullRequestGate" id="@xpertss/projen-types.ActionSonarWorkflowOptions.property.sonarPullRequestGate"></a>
+##### `fixtureSteps`<sup>Optional</sup> <a name="fixtureSteps" id="@xpertss/projen-types.ActionDogfoodStep.property.fixtureSteps"></a>
 ```typescript
-public readonly sonarPullRequestGate: boolean;
+public readonly fixtureSteps: string[];
 ```
-- *Type:* boolean
-- *Default:* true
+- *Type:* string[]
+- *Default:* []
-Whether `sonar.yml` also runs on `pull_request` as a pass/fail gate.
+Shell steps executed before this invocation, to produce or alter fixture state.
 ---
-##### `sonarTokenSecret`<sup>Optional</sup> <a name="sonarTokenSecret" id="@xpertss/projen-types.ActionSonarWorkflowOptions.property.sonarTokenSecret"></a>
+##### `id`<sup>Optional</sup> <a name="id" id="@xpertss/projen-types.ActionDogfoodStep.property.id"></a>
 ```typescript
-public readonly sonarTokenSecret: string;
+public readonly id: string;
 ```
 - *Type:* string
-- *Default:* "SONAR_TOKEN"
+- *Default:* a slug derived from `name`, disambiguated by position
+Step id for the `uses: ./` invocation, so a later assertion can reference this step's outputs via `${{ steps.<id>.outputs.<name> }}`.
+---
+##### `inputs`<sup>Optional</sup> <a name="inputs" id="@xpertss/projen-types.ActionDogfoodStep.property.inputs"></a>
+```typescript
+public readonly inputs: {[ key: string ]: string};
+```
+- *Type:* {[ key: string ]: string}
+- *Default:* {}
+`with:` inputs for this invocation's local `uses: ./` call.
 ---
@@ -15286,10 +15578,19 @@ const cdkAppProjectOptions: CdkAppProjectOptions = { ... }
 | **Name** | **Type** | **Description** |
 | --- | --- | --- |
+| <code><a href="#@xpertss/projen-types.CdkAppProjectOptions.property.sonarHostUrl">sonarHostUrl</a></code> | <code>string</code> | URL of the org's SonarCloud instance (e.g. `https://sonarcloud.io`). When set, a `sonar.yml` SonarScanner workflow is generated; when omitted, no Sonar workflow is produced. Must be reachable from github.com-hosted (public) runners (AD-001). |
+| <code><a href="#@xpertss/projen-types.CdkAppProjectOptions.property.sonarOrganization">sonarOrganization</a></code> | <code>string</code> | SonarCloud organization key (`sonar.organization`). Mandatory for the Scanner CLI on SonarCloud - it is not derived from the token, so a scan without it always fails. |
+| <code><a href="#@xpertss/projen-types.CdkAppProjectOptions.property.sonarProjectKey">sonarProjectKey</a></code> | <code>string</code> | `sonar.projectKey`. |
+| <code><a href="#@xpertss/projen-types.CdkAppProjectOptions.property.sonarPullRequestGate">sonarPullRequestGate</a></code> | <code>boolean</code> | Whether `sonar.yml` also runs on `pull_request` as a pass/fail gate. |
+| <code><a href="#@xpertss/projen-types.CdkAppProjectOptions.property.sonarTokenSecret">sonarTokenSecret</a></code> | <code>string</code> | *No description.* |
 | <code><a href="#@xpertss/projen-types.CdkAppProjectOptions.property.name">name</a></code> | <code>string</code> | *No description.* |
 | <code><a href="#@xpertss/projen-types.CdkAppProjectOptions.property.cdkVersion">cdkVersion</a></code> | <code>string</code> | *No description.* |
+| <code><a href="#@xpertss/projen-types.CdkAppProjectOptions.property.copyrightOwner">copyrightOwner</a></code> | <code>string</code> | Copyright owner named in the `LICENSE`. |
+| <code><a href="#@xpertss/projen-types.CdkAppProjectOptions.property.copyrightPeriod">copyrightPeriod</a></code> | <code>string</code> | Copyright period named in the `LICENSE`. |
 | <code><a href="#@xpertss/projen-types.CdkAppProjectOptions.property.editorconfig">editorconfig</a></code> | <code>boolean</code> | Write a projen-managed `.editorconfig`. |
 | <code><a href="#@xpertss/projen-types.CdkAppProjectOptions.property.gheTokenSecret">gheTokenSecret</a></code> | <code>string</code> | *No description.* |
+| <code><a href="#@xpertss/projen-types.CdkAppProjectOptions.property.license">license</a></code> | <code>string</code> | SPDX identifier for the generated `LICENSE`. |
+| <code><a href="#@xpertss/projen-types.CdkAppProjectOptions.property.licensed">licensed</a></code> | <code>boolean</code> | Write a `LICENSE`. |
 | <code><a href="#@xpertss/projen-types.CdkAppProjectOptions.property.ecrEcs">ecrEcs</a></code> | <code><a href="#@xpertss/projen-types.EcrEcsOptions">EcrEcsOptions</a></code> | *No description.* |
 | <code><a href="#@xpertss/projen-types.CdkAppProjectOptions.property.edgeResources">edgeResources</a></code> | <code>string[]</code> | *No description.* |
 | <code><a href="#@xpertss/projen-types.CdkAppProjectOptions.property.environments">environments</a></code> | <code>string \| <a href="#@xpertss/projen-types.EnvironmentOptions">EnvironmentOptions</a>[]</code> | Deploy targets for the manual-dispatch deploy workflow, e.g. ["dev", "stage", "prod"]. No `deploy` workflow is generated when this is empty or omitted. |
@@ -15298,52 +15599,449 @@ const cdkAppProjectOptions: CdkAppProjectOptions = { ... }
 ---
-##### `name`<sup>Required</sup> <a name="name" id="@xpertss/projen-types.CdkAppProjectOptions.property.name"></a>
+##### `sonarHostUrl`<sup>Optional</sup> <a name="sonarHostUrl" id="@xpertss/projen-types.CdkAppProjectOptions.property.sonarHostUrl"></a>
 ```typescript
-public readonly name: string;
+public readonly sonarHostUrl: string;
 ```
 - *Type:* string
+URL of the org's SonarCloud instance (e.g. `https://sonarcloud.io`). When set, a `sonar.yml` SonarScanner workflow is generated; when omitted, no Sonar workflow is produced. Must be reachable from github.com-hosted (public) runners (AD-001).
 ---
-##### `cdkVersion`<sup>Optional</sup> <a name="cdkVersion" id="@xpertss/projen-types.CdkAppProjectOptions.property.cdkVersion"></a>
+##### `sonarOrganization`<sup>Optional</sup> <a name="sonarOrganization" id="@xpertss/projen-types.CdkAppProjectOptions.property.sonarOrganization"></a>
 ```typescript
-public readonly cdkVersion: string;
+public readonly sonarOrganization: string;
 ```
 - *Type:* string
-- *Default:* "2.189.1"
+- *Default:* "xpertss"
+SonarCloud organization key (`sonar.organization`). Mandatory for the Scanner CLI on SonarCloud - it is not derived from the token, so a scan without it always fails.
 ---
-##### `editorconfig`<sup>Optional</sup> <a name="editorconfig" id="@xpertss/projen-types.CdkAppProjectOptions.property.editorconfig"></a>
+##### `sonarProjectKey`<sup>Optional</sup> <a name="sonarProjectKey" id="@xpertss/projen-types.CdkAppProjectOptions.property.sonarProjectKey"></a>
 ```typescript
-public readonly editorconfig: boolean;
+public readonly sonarProjectKey: string;
 ```
-- *Type:* boolean
-- *Default:* true
+- *Type:* string
+- *Default:* `${sonarOrganization}_${name}` (the org + project key SonarCloud uses, e.g. `xpertss_create-pull-request`)
+`sonar.projectKey`.
+---
+##### `sonarPullRequestGate`<sup>Optional</sup> <a name="sonarPullRequestGate" id="@xpertss/projen-types.CdkAppProjectOptions.property.sonarPullRequestGate"></a>
+```typescript
+public readonly sonarPullRequestGate: boolean;
+```
+- *Type:* boolean
+- *Default:* true
+Whether `sonar.yml` also runs on `pull_request` as a pass/fail gate.
+---
+##### `sonarTokenSecret`<sup>Optional</sup> <a name="sonarTokenSecret" id="@xpertss/projen-types.CdkAppProjectOptions.property.sonarTokenSecret"></a>
+```typescript
+public readonly sonarTokenSecret: string;
+```
+- *Type:* string
+- *Default:* "SONAR_TOKEN"
+---
+##### `name`<sup>Required</sup> <a name="name" id="@xpertss/projen-types.CdkAppProjectOptions.property.name"></a>
+```typescript
+public readonly name: string;
+```
+- *Type:* string
+---
+##### `cdkVersion`<sup>Optional</sup> <a name="cdkVersion" id="@xpertss/projen-types.CdkAppProjectOptions.property.cdkVersion"></a>
+```typescript
+public readonly cdkVersion: string;
+```
+- *Type:* string
+- *Default:* "2.189.1"
+---
+##### `copyrightOwner`<sup>Optional</sup> <a name="copyrightOwner" id="@xpertss/projen-types.CdkAppProjectOptions.property.copyrightOwner"></a>
+```typescript
+public readonly copyrightOwner: string;
+```
+- *Type:* string
+- *Default:* "Xpert Software"
+Copyright owner named in the `LICENSE`.
+---
+##### `copyrightPeriod`<sup>Optional</sup> <a name="copyrightPeriod" id="@xpertss/projen-types.CdkAppProjectOptions.property.copyrightPeriod"></a>
+```typescript
+public readonly copyrightPeriod: string;
+```
+- *Type:* string
+- *Default:* the current year
+Copyright period named in the `LICENSE`.
+---
+##### `editorconfig`<sup>Optional</sup> <a name="editorconfig" id="@xpertss/projen-types.CdkAppProjectOptions.property.editorconfig"></a>
+```typescript
+public readonly editorconfig: boolean;
+```
+- *Type:* boolean
+- *Default:* true
+Write a projen-managed `.editorconfig`.
+---
+##### `gheTokenSecret`<sup>Optional</sup> <a name="gheTokenSecret" id="@xpertss/projen-types.CdkAppProjectOptions.property.gheTokenSecret"></a>
+```typescript
+public readonly gheTokenSecret: string;
+```
+- *Type:* string
+- *Default:* "PROJEN_GITHUB_TOKEN"
+---
+##### `license`<sup>Optional</sup> <a name="license" id="@xpertss/projen-types.CdkAppProjectOptions.property.license"></a>
+```typescript
+public readonly license: string;
+```
+- *Type:* string
+- *Default:* "MIT"
+SPDX identifier for the generated `LICENSE`.
+---
+##### `licensed`<sup>Optional</sup> <a name="licensed" id="@xpertss/projen-types.CdkAppProjectOptions.property.licensed"></a>
+```typescript
+public readonly licensed: boolean;
+```
+- *Type:* boolean
+- *Default:* true
+Write a `LICENSE`.
+---
+##### `ecrEcs`<sup>Optional</sup> <a name="ecrEcs" id="@xpertss/projen-types.CdkAppProjectOptions.property.ecrEcs"></a>
+```typescript
+public readonly ecrEcs: EcrEcsOptions;
+```
+- *Type:* <a href="#@xpertss/projen-types.EcrEcsOptions">EcrEcsOptions</a>
+---
+##### `edgeResources`<sup>Optional</sup> <a name="edgeResources" id="@xpertss/projen-types.CdkAppProjectOptions.property.edgeResources"></a>
+```typescript
+public readonly edgeResources: string[];
+```
+- *Type:* string[]
+---
+##### `environments`<sup>Optional</sup> <a name="environments" id="@xpertss/projen-types.CdkAppProjectOptions.property.environments"></a>
+```typescript
+public readonly environments: (string | EnvironmentOptions)[];
+```
+- *Type:* string | <a href="#@xpertss/projen-types.EnvironmentOptions">EnvironmentOptions</a>[]
+- *Default:* no deploy workflow
+Deploy targets for the manual-dispatch deploy workflow, e.g. ["dev", "stage", "prod"]. No `deploy` workflow is generated when this is empty or omitted.
+Optional rather than required so that `projen new --from` can scaffold
+the repo: its union type (`string | EnvironmentOptions`) is not
+"JSON-like", so projen's CLI cannot render a value for it into the
+initial `.projenrc.ts` - and a *required* option it cannot render leaves
+behind a projenrc that does not type-check.
+---
+##### `appEntryPoint`<sup>Optional</sup> <a name="appEntryPoint" id="@xpertss/projen-types.CdkAppProjectOptions.property.appEntryPoint"></a>
+```typescript
+public readonly appEntryPoint: string;
+```
+- *Type:* string
+- *Default:* "src/app.ts"
+---
+##### `database`<sup>Optional</sup> <a name="database" id="@xpertss/projen-types.CdkAppProjectOptions.property.database"></a>
+```typescript
+public readonly database: DatabaseOptions;
+```
+- *Type:* <a href="#@xpertss/projen-types.DatabaseOptions">DatabaseOptions</a>
+---
+### CdkDeployHookOptions <a name="CdkDeployHookOptions" id="@xpertss/projen-types.CdkDeployHookOptions"></a>
+#### Initializer <a name="Initializer" id="@xpertss/projen-types.CdkDeployHookOptions.Initializer"></a>
+```typescript
+import { CdkDeployHookOptions } from '@xpertss/projen-types'
+const cdkDeployHookOptions: CdkDeployHookOptions = { ... }
+```
+#### Properties <a name="Properties" id="Properties"></a>
+| **Name** | **Type** | **Description** |
+| --- | --- | --- |
+| <code><a href="#@xpertss/projen-types.CdkDeployHookOptions.property.targetRepo">targetRepo</a></code> | <code>string</code> | The companion CDK infra/app repo (owner/repo) that owns the actual infrastructure. |
+---
+##### `targetRepo`<sup>Optional</sup> <a name="targetRepo" id="@xpertss/projen-types.CdkDeployHookOptions.property.targetRepo"></a>
+```typescript
+public readonly targetRepo: string;
+```
+- *Type:* string
+- *Default:* the workflow is still generated, but its only step fails with instructions (see `CdkDeployHook`)
+The companion CDK infra/app repo (owner/repo) that owns the actual infrastructure.
+---
+### CdkInfraProjectOptions <a name="CdkInfraProjectOptions" id="@xpertss/projen-types.CdkInfraProjectOptions"></a>
+#### Initializer <a name="Initializer" id="@xpertss/projen-types.CdkInfraProjectOptions.Initializer"></a>
+```typescript
+import { CdkInfraProjectOptions } from '@xpertss/projen-types'
+const cdkInfraProjectOptions: CdkInfraProjectOptions = { ... }
+```
+#### Properties <a name="Properties" id="Properties"></a>
+| **Name** | **Type** | **Description** |
+| --- | --- | --- |
+| <code><a href="#@xpertss/projen-types.CdkInfraProjectOptions.property.sonarHostUrl">sonarHostUrl</a></code> | <code>string</code> | URL of the org's SonarCloud instance (e.g. `https://sonarcloud.io`). When set, a `sonar.yml` SonarScanner workflow is generated; when omitted, no Sonar workflow is produced. Must be reachable from github.com-hosted (public) runners (AD-001). |
+| <code><a href="#@xpertss/projen-types.CdkInfraProjectOptions.property.sonarOrganization">sonarOrganization</a></code> | <code>string</code> | SonarCloud organization key (`sonar.organization`). Mandatory for the Scanner CLI on SonarCloud - it is not derived from the token, so a scan without it always fails. |
+| <code><a href="#@xpertss/projen-types.CdkInfraProjectOptions.property.sonarProjectKey">sonarProjectKey</a></code> | <code>string</code> | `sonar.projectKey`. |
+| <code><a href="#@xpertss/projen-types.CdkInfraProjectOptions.property.sonarPullRequestGate">sonarPullRequestGate</a></code> | <code>boolean</code> | Whether `sonar.yml` also runs on `pull_request` as a pass/fail gate. |
+| <code><a href="#@xpertss/projen-types.CdkInfraProjectOptions.property.sonarTokenSecret">sonarTokenSecret</a></code> | <code>string</code> | *No description.* |
+| <code><a href="#@xpertss/projen-types.CdkInfraProjectOptions.property.name">name</a></code> | <code>string</code> | *No description.* |
+| <code><a href="#@xpertss/projen-types.CdkInfraProjectOptions.property.cdkVersion">cdkVersion</a></code> | <code>string</code> | *No description.* |
+| <code><a href="#@xpertss/projen-types.CdkInfraProjectOptions.property.copyrightOwner">copyrightOwner</a></code> | <code>string</code> | Copyright owner named in the `LICENSE`. |
+| <code><a href="#@xpertss/projen-types.CdkInfraProjectOptions.property.copyrightPeriod">copyrightPeriod</a></code> | <code>string</code> | Copyright period named in the `LICENSE`. |
+| <code><a href="#@xpertss/projen-types.CdkInfraProjectOptions.property.editorconfig">editorconfig</a></code> | <code>boolean</code> | Write a projen-managed `.editorconfig`. |
+| <code><a href="#@xpertss/projen-types.CdkInfraProjectOptions.property.gheTokenSecret">gheTokenSecret</a></code> | <code>string</code> | *No description.* |
+| <code><a href="#@xpertss/projen-types.CdkInfraProjectOptions.property.license">license</a></code> | <code>string</code> | SPDX identifier for the generated `LICENSE`. |
+| <code><a href="#@xpertss/projen-types.CdkInfraProjectOptions.property.licensed">licensed</a></code> | <code>boolean</code> | Write a `LICENSE`. |
+| <code><a href="#@xpertss/projen-types.CdkInfraProjectOptions.property.ecrEcs">ecrEcs</a></code> | <code><a href="#@xpertss/projen-types.EcrEcsOptions">EcrEcsOptions</a></code> | *No description.* |
+| <code><a href="#@xpertss/projen-types.CdkInfraProjectOptions.property.edgeResources">edgeResources</a></code> | <code>string[]</code> | *No description.* |
+| <code><a href="#@xpertss/projen-types.CdkInfraProjectOptions.property.environments">environments</a></code> | <code>string \| <a href="#@xpertss/projen-types.EnvironmentOptions">EnvironmentOptions</a>[]</code> | Deploy targets for the manual-dispatch deploy workflow, e.g. ["dev", "stage", "prod"]. No `deploy` workflow is generated when this is empty or omitted. |
+---
+##### `sonarHostUrl`<sup>Optional</sup> <a name="sonarHostUrl" id="@xpertss/projen-types.CdkInfraProjectOptions.property.sonarHostUrl"></a>
+```typescript
+public readonly sonarHostUrl: string;
+```
+- *Type:* string
+URL of the org's SonarCloud instance (e.g. `https://sonarcloud.io`). When set, a `sonar.yml` SonarScanner workflow is generated; when omitted, no Sonar workflow is produced. Must be reachable from github.com-hosted (public) runners (AD-001).
+---
+##### `sonarOrganization`<sup>Optional</sup> <a name="sonarOrganization" id="@xpertss/projen-types.CdkInfraProjectOptions.property.sonarOrganization"></a>
+```typescript
+public readonly sonarOrganization: string;
+```
+- *Type:* string
+- *Default:* "xpertss"
+SonarCloud organization key (`sonar.organization`). Mandatory for the Scanner CLI on SonarCloud - it is not derived from the token, so a scan without it always fails.
+---
+##### `sonarProjectKey`<sup>Optional</sup> <a name="sonarProjectKey" id="@xpertss/projen-types.CdkInfraProjectOptions.property.sonarProjectKey"></a>
+```typescript
+public readonly sonarProjectKey: string;
+```
+- *Type:* string
+- *Default:* `${sonarOrganization}_${name}` (the org + project key SonarCloud uses, e.g. `xpertss_create-pull-request`)
+`sonar.projectKey`.
+---
+##### `sonarPullRequestGate`<sup>Optional</sup> <a name="sonarPullRequestGate" id="@xpertss/projen-types.CdkInfraProjectOptions.property.sonarPullRequestGate"></a>
+```typescript
+public readonly sonarPullRequestGate: boolean;
+```
+- *Type:* boolean
+- *Default:* true
+Whether `sonar.yml` also runs on `pull_request` as a pass/fail gate.
+---
+##### `sonarTokenSecret`<sup>Optional</sup> <a name="sonarTokenSecret" id="@xpertss/projen-types.CdkInfraProjectOptions.property.sonarTokenSecret"></a>
+```typescript
+public readonly sonarTokenSecret: string;
+```
+- *Type:* string
+- *Default:* "SONAR_TOKEN"
+---
+##### `name`<sup>Required</sup> <a name="name" id="@xpertss/projen-types.CdkInfraProjectOptions.property.name"></a>
+```typescript
+public readonly name: string;
+```
+- *Type:* string
+---
+##### `cdkVersion`<sup>Optional</sup> <a name="cdkVersion" id="@xpertss/projen-types.CdkInfraProjectOptions.property.cdkVersion"></a>
+```typescript
+public readonly cdkVersion: string;
+```
+- *Type:* string
+- *Default:* "2.189.1"
+---
+##### `copyrightOwner`<sup>Optional</sup> <a name="copyrightOwner" id="@xpertss/projen-types.CdkInfraProjectOptions.property.copyrightOwner"></a>
+```typescript
+public readonly copyrightOwner: string;
+```
+- *Type:* string
+- *Default:* "Xpert Software"
+Copyright owner named in the `LICENSE`.
+---
+##### `copyrightPeriod`<sup>Optional</sup> <a name="copyrightPeriod" id="@xpertss/projen-types.CdkInfraProjectOptions.property.copyrightPeriod"></a>
+```typescript
+public readonly copyrightPeriod: string;
+```
+- *Type:* string
+- *Default:* the current year
+Copyright period named in the `LICENSE`.
+---
+##### `editorconfig`<sup>Optional</sup> <a name="editorconfig" id="@xpertss/projen-types.CdkInfraProjectOptions.property.editorconfig"></a>
+```typescript
+public readonly editorconfig: boolean;
+```
+- *Type:* boolean
+- *Default:* true
+Write a projen-managed `.editorconfig`.
+---
+##### `gheTokenSecret`<sup>Optional</sup> <a name="gheTokenSecret" id="@xpertss/projen-types.CdkInfraProjectOptions.property.gheTokenSecret"></a>
+```typescript
+public readonly gheTokenSecret: string;
+```
+- *Type:* string
+- *Default:* "PROJEN_GITHUB_TOKEN"
+---
+##### `license`<sup>Optional</sup> <a name="license" id="@xpertss/projen-types.CdkInfraProjectOptions.property.license"></a>
+```typescript
+public readonly license: string;
+```
+- *Type:* string
+- *Default:* "MIT"
-Write a projen-managed `.editorconfig`.
+SPDX identifier for the generated `LICENSE`.
 ---
-##### `gheTokenSecret`<sup>Optional</sup> <a name="gheTokenSecret" id="@xpertss/projen-types.CdkAppProjectOptions.property.gheTokenSecret"></a>
+##### `licensed`<sup>Optional</sup> <a name="licensed" id="@xpertss/projen-types.CdkInfraProjectOptions.property.licensed"></a>
 ```typescript
-public readonly gheTokenSecret: string;
+public readonly licensed: boolean;
 ```
-- *Type:* string
-- *Default:* "PROJEN_GITHUB_TOKEN"
+- *Type:* boolean
+- *Default:* true
+Write a `LICENSE`.
 ---
-##### `ecrEcs`<sup>Optional</sup> <a name="ecrEcs" id="@xpertss/projen-types.CdkAppProjectOptions.property.ecrEcs"></a>
+##### `ecrEcs`<sup>Optional</sup> <a name="ecrEcs" id="@xpertss/projen-types.CdkInfraProjectOptions.property.ecrEcs"></a>
 ```typescript
 public readonly ecrEcs: EcrEcsOptions;
@@ -15353,7 +16051,7 @@ public readonly ecrEcs: EcrEcsOptions;
 ---
-##### `edgeResources`<sup>Optional</sup> <a name="edgeResources" id="@xpertss/projen-types.CdkAppProjectOptions.property.edgeResources"></a>
+##### `edgeResources`<sup>Optional</sup> <a name="edgeResources" id="@xpertss/projen-types.CdkInfraProjectOptions.property.edgeResources"></a>
 ```typescript
 public readonly edgeResources: string[];
@@ -15363,7 +16061,7 @@ public readonly edgeResources: string[];
 ---
-##### `environments`<sup>Optional</sup> <a name="environments" id="@xpertss/projen-types.CdkAppProjectOptions.property.environments"></a>
+##### `environments`<sup>Optional</sup> <a name="environments" id="@xpertss/projen-types.CdkInfraProjectOptions.property.environments"></a>
 ```typescript
 public readonly environments: (string | EnvironmentOptions)[];
@@ -15382,83 +16080,100 @@ behind a projenrc that does not type-check.
 ---
-##### `appEntryPoint`<sup>Optional</sup> <a name="appEntryPoint" id="@xpertss/projen-types.CdkAppProjectOptions.property.appEntryPoint"></a>
+### CdkTypescriptProjectOptions <a name="CdkTypescriptProjectOptions" id="@xpertss/projen-types.CdkTypescriptProjectOptions"></a>
+#### Initializer <a name="Initializer" id="@xpertss/projen-types.CdkTypescriptProjectOptions.Initializer"></a>
 ```typescript
-public readonly appEntryPoint: string;
+import { CdkTypescriptProjectOptions } from '@xpertss/projen-types'
+const cdkTypescriptProjectOptions: CdkTypescriptProjectOptions = { ... }
 ```
-- *Type:* string
-- *Default:* "src/app.ts"
+#### Properties <a name="Properties" id="Properties"></a>
+| **Name** | **Type** | **Description** |
+| --- | --- | --- |
+| <code><a href="#@xpertss/projen-types.CdkTypescriptProjectOptions.property.sonarHostUrl">sonarHostUrl</a></code> | <code>string</code> | URL of the org's SonarCloud instance (e.g. `https://sonarcloud.io`). When set, a `sonar.yml` SonarScanner workflow is generated; when omitted, no Sonar workflow is produced. Must be reachable from github.com-hosted (public) runners (AD-001). |
+| <code><a href="#@xpertss/projen-types.CdkTypescriptProjectOptions.property.sonarOrganization">sonarOrganization</a></code> | <code>string</code> | SonarCloud organization key (`sonar.organization`). Mandatory for the Scanner CLI on SonarCloud - it is not derived from the token, so a scan without it always fails. |
+| <code><a href="#@xpertss/projen-types.CdkTypescriptProjectOptions.property.sonarProjectKey">sonarProjectKey</a></code> | <code>string</code> | `sonar.projectKey`. |
+| <code><a href="#@xpertss/projen-types.CdkTypescriptProjectOptions.property.sonarPullRequestGate">sonarPullRequestGate</a></code> | <code>boolean</code> | Whether `sonar.yml` also runs on `pull_request` as a pass/fail gate. |
+| <code><a href="#@xpertss/projen-types.CdkTypescriptProjectOptions.property.sonarTokenSecret">sonarTokenSecret</a></code> | <code>string</code> | *No description.* |
+| <code><a href="#@xpertss/projen-types.CdkTypescriptProjectOptions.property.name">name</a></code> | <code>string</code> | *No description.* |
+| <code><a href="#@xpertss/projen-types.CdkTypescriptProjectOptions.property.cdkVersion">cdkVersion</a></code> | <code>string</code> | *No description.* |
+| <code><a href="#@xpertss/projen-types.CdkTypescriptProjectOptions.property.copyrightOwner">copyrightOwner</a></code> | <code>string</code> | Copyright owner named in the `LICENSE`. |
+| <code><a href="#@xpertss/projen-types.CdkTypescriptProjectOptions.property.copyrightPeriod">copyrightPeriod</a></code> | <code>string</code> | Copyright period named in the `LICENSE`. |
+| <code><a href="#@xpertss/projen-types.CdkTypescriptProjectOptions.property.editorconfig">editorconfig</a></code> | <code>boolean</code> | Write a projen-managed `.editorconfig`. |
+| <code><a href="#@xpertss/projen-types.CdkTypescriptProjectOptions.property.gheTokenSecret">gheTokenSecret</a></code> | <code>string</code> | *No description.* |
+| <code><a href="#@xpertss/projen-types.CdkTypescriptProjectOptions.property.license">license</a></code> | <code>string</code> | SPDX identifier for the generated `LICENSE`. |
+| <code><a href="#@xpertss/projen-types.CdkTypescriptProjectOptions.property.licensed">licensed</a></code> | <code>boolean</code> | Write a `LICENSE`. |
+| <code><a href="#@xpertss/projen-types.CdkTypescriptProjectOptions.property.environments">environments</a></code> | <code>string \| <a href="#@xpertss/projen-types.EnvironmentOptions">EnvironmentOptions</a>[]</code> | *No description.* |
 ---
-##### `database`<sup>Optional</sup> <a name="database" id="@xpertss/projen-types.CdkAppProjectOptions.property.database"></a>
+##### `sonarHostUrl`<sup>Optional</sup> <a name="sonarHostUrl" id="@xpertss/projen-types.CdkTypescriptProjectOptions.property.sonarHostUrl"></a>
 ```typescript
-public readonly database: DatabaseOptions;
+public readonly sonarHostUrl: string;
 ```
-- *Type:* <a href="#@xpertss/projen-types.DatabaseOptions">DatabaseOptions</a>
+- *Type:* string
----
+URL of the org's SonarCloud instance (e.g. `https://sonarcloud.io`). When set, a `sonar.yml` SonarScanner workflow is generated; when omitted, no Sonar workflow is produced. Must be reachable from github.com-hosted (public) runners (AD-001).
-### CdkDeployHookOptions <a name="CdkDeployHookOptions" id="@xpertss/projen-types.CdkDeployHookOptions"></a>
+---
-#### Initializer <a name="Initializer" id="@xpertss/projen-types.CdkDeployHookOptions.Initializer"></a>
+##### `sonarOrganization`<sup>Optional</sup> <a name="sonarOrganization" id="@xpertss/projen-types.CdkTypescriptProjectOptions.property.sonarOrganization"></a>
 ```typescript
-import { CdkDeployHookOptions } from '@xpertss/projen-types'
-const cdkDeployHookOptions: CdkDeployHookOptions = { ... }
+public readonly sonarOrganization: string;
 ```
-#### Properties <a name="Properties" id="Properties"></a>
+- *Type:* string
+- *Default:* "xpertss"
-| **Name** | **Type** | **Description** |
-| --- | --- | --- |
-| <code><a href="#@xpertss/projen-types.CdkDeployHookOptions.property.targetRepo">targetRepo</a></code> | <code>string</code> | The companion CDK infra/app repo (owner/repo) that owns the actual infrastructure. |
+SonarCloud organization key (`sonar.organization`). Mandatory for the Scanner CLI on SonarCloud - it is not derived from the token, so a scan without it always fails.
 ---
-##### `targetRepo`<sup>Optional</sup> <a name="targetRepo" id="@xpertss/projen-types.CdkDeployHookOptions.property.targetRepo"></a>
+##### `sonarProjectKey`<sup>Optional</sup> <a name="sonarProjectKey" id="@xpertss/projen-types.CdkTypescriptProjectOptions.property.sonarProjectKey"></a>
 ```typescript
-public readonly targetRepo: string;
+public readonly sonarProjectKey: string;
 ```
 - *Type:* string
-- *Default:* the workflow is still generated, but its only step fails with instructions (see `CdkDeployHook`)
+- *Default:* `${sonarOrganization}_${name}` (the org + project key SonarCloud uses, e.g. `xpertss_create-pull-request`)
-The companion CDK infra/app repo (owner/repo) that owns the actual infrastructure.
+`sonar.projectKey`.
 ---
-### CdkInfraProjectOptions <a name="CdkInfraProjectOptions" id="@xpertss/projen-types.CdkInfraProjectOptions"></a>
-#### Initializer <a name="Initializer" id="@xpertss/projen-types.CdkInfraProjectOptions.Initializer"></a>
+##### `sonarPullRequestGate`<sup>Optional</sup> <a name="sonarPullRequestGate" id="@xpertss/projen-types.CdkTypescriptProjectOptions.property.sonarPullRequestGate"></a>
 ```typescript
-import { CdkInfraProjectOptions } from '@xpertss/projen-types'
-const cdkInfraProjectOptions: CdkInfraProjectOptions = { ... }
+public readonly sonarPullRequestGate: boolean;
 ```
-#### Properties <a name="Properties" id="Properties"></a>
+- *Type:* boolean
+- *Default:* true
-| **Name** | **Type** | **Description** |
-| --- | --- | --- |
-| <code><a href="#@xpertss/projen-types.CdkInfraProjectOptions.property.name">name</a></code> | <code>string</code> | *No description.* |
-| <code><a href="#@xpertss/projen-types.CdkInfraProjectOptions.property.cdkVersion">cdkVersion</a></code> | <code>string</code> | *No description.* |
-| <code><a href="#@xpertss/projen-types.CdkInfraProjectOptions.property.editorconfig">editorconfig</a></code> | <code>boolean</code> | Write a projen-managed `.editorconfig`. |
-| <code><a href="#@xpertss/projen-types.CdkInfraProjectOptions.property.gheTokenSecret">gheTokenSecret</a></code> | <code>string</code> | *No description.* |
-| <code><a href="#@xpertss/projen-types.CdkInfraProjectOptions.property.ecrEcs">ecrEcs</a></code> | <code><a href="#@xpertss/projen-types.EcrEcsOptions">EcrEcsOptions</a></code> | *No description.* |
-| <code><a href="#@xpertss/projen-types.CdkInfraProjectOptions.property.edgeResources">edgeResources</a></code> | <code>string[]</code> | *No description.* |
-| <code><a href="#@xpertss/projen-types.CdkInfraProjectOptions.property.environments">environments</a></code> | <code>string \| <a href="#@xpertss/projen-types.EnvironmentOptions">EnvironmentOptions</a>[]</code> | Deploy targets for the manual-dispatch deploy workflow, e.g. ["dev", "stage", "prod"]. No `deploy` workflow is generated when this is empty or omitted. |
+Whether `sonar.yml` also runs on `pull_request` as a pass/fail gate.
 ---
-##### `name`<sup>Required</sup> <a name="name" id="@xpertss/projen-types.CdkInfraProjectOptions.property.name"></a>
+##### `sonarTokenSecret`<sup>Optional</sup> <a name="sonarTokenSecret" id="@xpertss/projen-types.CdkTypescriptProjectOptions.property.sonarTokenSecret"></a>
+```typescript
+public readonly sonarTokenSecret: string;
+```
+- *Type:* string
+- *Default:* "SONAR_TOKEN"
+---
+##### `name`<sup>Required</sup> <a name="name" id="@xpertss/projen-types.CdkTypescriptProjectOptions.property.name"></a>
 ```typescript
 public readonly name: string;
@@ -15468,7 +16183,7 @@ public readonly name: string;
 ---
-##### `cdkVersion`<sup>Optional</sup> <a name="cdkVersion" id="@xpertss/projen-types.CdkInfraProjectOptions.property.cdkVersion"></a>
+##### `cdkVersion`<sup>Optional</sup> <a name="cdkVersion" id="@xpertss/projen-types.CdkTypescriptProjectOptions.property.cdkVersion"></a>
 ```typescript
 public readonly cdkVersion: string;
@@ -15479,7 +16194,33 @@ public readonly cdkVersion: string;
 ---
-##### `editorconfig`<sup>Optional</sup> <a name="editorconfig" id="@xpertss/projen-types.CdkInfraProjectOptions.property.editorconfig"></a>
+##### `copyrightOwner`<sup>Optional</sup> <a name="copyrightOwner" id="@xpertss/projen-types.CdkTypescriptProjectOptions.property.copyrightOwner"></a>
+```typescript
+public readonly copyrightOwner: string;
+```
+- *Type:* string
+- *Default:* "Xpert Software"
+Copyright owner named in the `LICENSE`.
+---
+##### `copyrightPeriod`<sup>Optional</sup> <a name="copyrightPeriod" id="@xpertss/projen-types.CdkTypescriptProjectOptions.property.copyrightPeriod"></a>
+```typescript
+public readonly copyrightPeriod: string;
+```
+- *Type:* string
+- *Default:* the current year
+Copyright period named in the `LICENSE`.
+---
+##### `editorconfig`<sup>Optional</sup> <a name="editorconfig" id="@xpertss/projen-types.CdkTypescriptProjectOptions.property.editorconfig"></a>
 ```typescript
 public readonly editorconfig: boolean;
@@ -15492,7 +16233,7 @@ Write a projen-managed `.editorconfig`.
 ---
-##### `gheTokenSecret`<sup>Optional</sup> <a name="gheTokenSecret" id="@xpertss/projen-types.CdkInfraProjectOptions.property.gheTokenSecret"></a>
+##### `gheTokenSecret`<sup>Optional</sup> <a name="gheTokenSecret" id="@xpertss/projen-types.CdkTypescriptProjectOptions.property.gheTokenSecret"></a>
 ```typescript
 public readonly gheTokenSecret: string;
@@ -15503,161 +16244,178 @@ public readonly gheTokenSecret: string;
 ---
-##### `ecrEcs`<sup>Optional</sup> <a name="ecrEcs" id="@xpertss/projen-types.CdkInfraProjectOptions.property.ecrEcs"></a>
+##### `license`<sup>Optional</sup> <a name="license" id="@xpertss/projen-types.CdkTypescriptProjectOptions.property.license"></a>
 ```typescript
-public readonly ecrEcs: EcrEcsOptions;
+public readonly license: string;
 ```
-- *Type:* <a href="#@xpertss/projen-types.EcrEcsOptions">EcrEcsOptions</a>
+- *Type:* string
+- *Default:* "MIT"
+SPDX identifier for the generated `LICENSE`.
 ---
-##### `edgeResources`<sup>Optional</sup> <a name="edgeResources" id="@xpertss/projen-types.CdkInfraProjectOptions.property.edgeResources"></a>
+##### `licensed`<sup>Optional</sup> <a name="licensed" id="@xpertss/projen-types.CdkTypescriptProjectOptions.property.licensed"></a>
 ```typescript
-public readonly edgeResources: string[];
+public readonly licensed: boolean;
 ```
-- *Type:* string[]
+- *Type:* boolean
+- *Default:* true
+Write a `LICENSE`.
 ---
-##### `environments`<sup>Optional</sup> <a name="environments" id="@xpertss/projen-types.CdkInfraProjectOptions.property.environments"></a>
+##### `environments`<sup>Optional</sup> <a name="environments" id="@xpertss/projen-types.CdkTypescriptProjectOptions.property.environments"></a>
 ```typescript
 public readonly environments: (string | EnvironmentOptions)[];
 ```
 - *Type:* string | <a href="#@xpertss/projen-types.EnvironmentOptions">EnvironmentOptions</a>[]
-- *Default:* no deploy workflow
-Deploy targets for the manual-dispatch deploy workflow, e.g. ["dev", "stage", "prod"]. No `deploy` workflow is generated when this is empty or omitted.
-Optional rather than required so that `projen new --from` can scaffold
-the repo: its union type (`string | EnvironmentOptions`) is not
-"JSON-like", so projen's CLI cannot render a value for it into the
-initial `.projenrc.ts` - and a *required* option it cannot render leaves
-behind a projenrc that does not type-check.
 ---
-### CdkTypescriptProjectOptions <a name="CdkTypescriptProjectOptions" id="@xpertss/projen-types.CdkTypescriptProjectOptions"></a>
+### CommonCdkOptions <a name="CommonCdkOptions" id="@xpertss/projen-types.CommonCdkOptions"></a>
-#### Initializer <a name="Initializer" id="@xpertss/projen-types.CdkTypescriptProjectOptions.Initializer"></a>
+#### Initializer <a name="Initializer" id="@xpertss/projen-types.CommonCdkOptions.Initializer"></a>
 ```typescript
-import { CdkTypescriptProjectOptions } from '@xpertss/projen-types'
+import { CommonCdkOptions } from '@xpertss/projen-types'
-const cdkTypescriptProjectOptions: CdkTypescriptProjectOptions = { ... }
+const commonCdkOptions: CommonCdkOptions = { ... }
 ```
 #### Properties <a name="Properties" id="Properties"></a>
 | **Name** | **Type** | **Description** |
 | --- | --- | --- |
-| <code><a href="#@xpertss/projen-types.CdkTypescriptProjectOptions.property.name">name</a></code> | <code>string</code> | *No description.* |
-| <code><a href="#@xpertss/projen-types.CdkTypescriptProjectOptions.property.cdkVersion">cdkVersion</a></code> | <code>string</code> | *No description.* |
-| <code><a href="#@xpertss/projen-types.CdkTypescriptProjectOptions.property.editorconfig">editorconfig</a></code> | <code>boolean</code> | Write a projen-managed `.editorconfig`. |
-| <code><a href="#@xpertss/projen-types.CdkTypescriptProjectOptions.property.gheTokenSecret">gheTokenSecret</a></code> | <code>string</code> | *No description.* |
-| <code><a href="#@xpertss/projen-types.CdkTypescriptProjectOptions.property.environments">environments</a></code> | <code>string \| <a href="#@xpertss/projen-types.EnvironmentOptions">EnvironmentOptions</a>[]</code> | *No description.* |
+| <code><a href="#@xpertss/projen-types.CommonCdkOptions.property.sonarHostUrl">sonarHostUrl</a></code> | <code>string</code> | URL of the org's SonarCloud instance (e.g. `https://sonarcloud.io`). When set, a `sonar.yml` SonarScanner workflow is generated; when omitted, no Sonar workflow is produced. Must be reachable from github.com-hosted (public) runners (AD-001). |
+| <code><a href="#@xpertss/projen-types.CommonCdkOptions.property.sonarOrganization">sonarOrganization</a></code> | <code>string</code> | SonarCloud organization key (`sonar.organization`). Mandatory for the Scanner CLI on SonarCloud - it is not derived from the token, so a scan without it always fails. |
+| <code><a href="#@xpertss/projen-types.CommonCdkOptions.property.sonarProjectKey">sonarProjectKey</a></code> | <code>string</code> | `sonar.projectKey`. |
+| <code><a href="#@xpertss/projen-types.CommonCdkOptions.property.sonarPullRequestGate">sonarPullRequestGate</a></code> | <code>boolean</code> | Whether `sonar.yml` also runs on `pull_request` as a pass/fail gate. |
+| <code><a href="#@xpertss/projen-types.CommonCdkOptions.property.sonarTokenSecret">sonarTokenSecret</a></code> | <code>string</code> | *No description.* |
+| <code><a href="#@xpertss/projen-types.CommonCdkOptions.property.name">name</a></code> | <code>string</code> | *No description.* |
+| <code><a href="#@xpertss/projen-types.CommonCdkOptions.property.cdkVersion">cdkVersion</a></code> | <code>string</code> | *No description.* |
+| <code><a href="#@xpertss/projen-types.CommonCdkOptions.property.copyrightOwner">copyrightOwner</a></code> | <code>string</code> | Copyright owner named in the `LICENSE`. |
+| <code><a href="#@xpertss/projen-types.CommonCdkOptions.property.copyrightPeriod">copyrightPeriod</a></code> | <code>string</code> | Copyright period named in the `LICENSE`. |
+| <code><a href="#@xpertss/projen-types.CommonCdkOptions.property.editorconfig">editorconfig</a></code> | <code>boolean</code> | Write a projen-managed `.editorconfig`. |
+| <code><a href="#@xpertss/projen-types.CommonCdkOptions.property.gheTokenSecret">gheTokenSecret</a></code> | <code>string</code> | *No description.* |
+| <code><a href="#@xpertss/projen-types.CommonCdkOptions.property.license">license</a></code> | <code>string</code> | SPDX identifier for the generated `LICENSE`. |
+| <code><a href="#@xpertss/projen-types.CommonCdkOptions.property.licensed">licensed</a></code> | <code>boolean</code> | Write a `LICENSE`. |
 ---
-##### `name`<sup>Required</sup> <a name="name" id="@xpertss/projen-types.CdkTypescriptProjectOptions.property.name"></a>
+##### `sonarHostUrl`<sup>Optional</sup> <a name="sonarHostUrl" id="@xpertss/projen-types.CommonCdkOptions.property.sonarHostUrl"></a>
 ```typescript
-public readonly name: string;
+public readonly sonarHostUrl: string;
 ```
 - *Type:* string
+URL of the org's SonarCloud instance (e.g. `https://sonarcloud.io`). When set, a `sonar.yml` SonarScanner workflow is generated; when omitted, no Sonar workflow is produced. Must be reachable from github.com-hosted (public) runners (AD-001).
 ---
-##### `cdkVersion`<sup>Optional</sup> <a name="cdkVersion" id="@xpertss/projen-types.CdkTypescriptProjectOptions.property.cdkVersion"></a>
+##### `sonarOrganization`<sup>Optional</sup> <a name="sonarOrganization" id="@xpertss/projen-types.CommonCdkOptions.property.sonarOrganization"></a>
 ```typescript
-public readonly cdkVersion: string;
+public readonly sonarOrganization: string;
 ```
 - *Type:* string
-- *Default:* "2.189.1"
+- *Default:* "xpertss"
+SonarCloud organization key (`sonar.organization`). Mandatory for the Scanner CLI on SonarCloud - it is not derived from the token, so a scan without it always fails.
 ---
-##### `editorconfig`<sup>Optional</sup> <a name="editorconfig" id="@xpertss/projen-types.CdkTypescriptProjectOptions.property.editorconfig"></a>
+##### `sonarProjectKey`<sup>Optional</sup> <a name="sonarProjectKey" id="@xpertss/projen-types.CommonCdkOptions.property.sonarProjectKey"></a>
 ```typescript
-public readonly editorconfig: boolean;
+public readonly sonarProjectKey: string;
+```
+- *Type:* string
+- *Default:* `${sonarOrganization}_${name}` (the org + project key SonarCloud uses, e.g. `xpertss_create-pull-request`)
+`sonar.projectKey`.
+---
+##### `sonarPullRequestGate`<sup>Optional</sup> <a name="sonarPullRequestGate" id="@xpertss/projen-types.CommonCdkOptions.property.sonarPullRequestGate"></a>
+```typescript
+public readonly sonarPullRequestGate: boolean;
 ```
 - *Type:* boolean
 - *Default:* true
-Write a projen-managed `.editorconfig`.
+Whether `sonar.yml` also runs on `pull_request` as a pass/fail gate.
 ---
-##### `gheTokenSecret`<sup>Optional</sup> <a name="gheTokenSecret" id="@xpertss/projen-types.CdkTypescriptProjectOptions.property.gheTokenSecret"></a>
+##### `sonarTokenSecret`<sup>Optional</sup> <a name="sonarTokenSecret" id="@xpertss/projen-types.CommonCdkOptions.property.sonarTokenSecret"></a>
 ```typescript
-public readonly gheTokenSecret: string;
+public readonly sonarTokenSecret: string;
 ```
 - *Type:* string
-- *Default:* "PROJEN_GITHUB_TOKEN"
+- *Default:* "SONAR_TOKEN"
 ---
-##### `environments`<sup>Optional</sup> <a name="environments" id="@xpertss/projen-types.CdkTypescriptProjectOptions.property.environments"></a>
+##### `name`<sup>Required</sup> <a name="name" id="@xpertss/projen-types.CommonCdkOptions.property.name"></a>
 ```typescript
-public readonly environments: (string | EnvironmentOptions)[];
+public readonly name: string;
 ```
-- *Type:* string | <a href="#@xpertss/projen-types.EnvironmentOptions">EnvironmentOptions</a>[]
+- *Type:* string
 ---
-### CommonCdkOptions <a name="CommonCdkOptions" id="@xpertss/projen-types.CommonCdkOptions"></a>
-#### Initializer <a name="Initializer" id="@xpertss/projen-types.CommonCdkOptions.Initializer"></a>
+##### `cdkVersion`<sup>Optional</sup> <a name="cdkVersion" id="@xpertss/projen-types.CommonCdkOptions.property.cdkVersion"></a>
 ```typescript
-import { CommonCdkOptions } from '@xpertss/projen-types'
-const commonCdkOptions: CommonCdkOptions = { ... }
+public readonly cdkVersion: string;
 ```
-#### Properties <a name="Properties" id="Properties"></a>
-| **Name** | **Type** | **Description** |
-| --- | --- | --- |
-| <code><a href="#@xpertss/projen-types.CommonCdkOptions.property.name">name</a></code> | <code>string</code> | *No description.* |
-| <code><a href="#@xpertss/projen-types.CommonCdkOptions.property.cdkVersion">cdkVersion</a></code> | <code>string</code> | *No description.* |
-| <code><a href="#@xpertss/projen-types.CommonCdkOptions.property.editorconfig">editorconfig</a></code> | <code>boolean</code> | Write a projen-managed `.editorconfig`. |
-| <code><a href="#@xpertss/projen-types.CommonCdkOptions.property.gheTokenSecret">gheTokenSecret</a></code> | <code>string</code> | *No description.* |
+- *Type:* string
+- *Default:* "2.189.1"
 ---
-##### `name`<sup>Required</sup> <a name="name" id="@xpertss/projen-types.CommonCdkOptions.property.name"></a>
+##### `copyrightOwner`<sup>Optional</sup> <a name="copyrightOwner" id="@xpertss/projen-types.CommonCdkOptions.property.copyrightOwner"></a>
 ```typescript
-public readonly name: string;
+public readonly copyrightOwner: string;
 ```
 - *Type:* string
+- *Default:* "Xpert Software"
+Copyright owner named in the `LICENSE`.
 ---
-##### `cdkVersion`<sup>Optional</sup> <a name="cdkVersion" id="@xpertss/projen-types.CommonCdkOptions.property.cdkVersion"></a>
+##### `copyrightPeriod`<sup>Optional</sup> <a name="copyrightPeriod" id="@xpertss/projen-types.CommonCdkOptions.property.copyrightPeriod"></a>
 ```typescript
-public readonly cdkVersion: string;
+public readonly copyrightPeriod: string;
 ```
 - *Type:* string
-- *Default:* "2.189.1"
+- *Default:* the current year
+Copyright period named in the `LICENSE`.
 ---
@@ -15667,21 +16425,47 @@ public readonly cdkVersion: string;
 public readonly editorconfig: boolean;
 ```
-- *Type:* boolean
-- *Default:* true
+- *Type:* boolean
+- *Default:* true
+Write a projen-managed `.editorconfig`.
+---
+##### `gheTokenSecret`<sup>Optional</sup> <a name="gheTokenSecret" id="@xpertss/projen-types.CommonCdkOptions.property.gheTokenSecret"></a>
+```typescript
+public readonly gheTokenSecret: string;
+```
+- *Type:* string
+- *Default:* "PROJEN_GITHUB_TOKEN"
+---
+##### `license`<sup>Optional</sup> <a name="license" id="@xpertss/projen-types.CommonCdkOptions.property.license"></a>
+```typescript
+public readonly license: string;
+```
+- *Type:* string
+- *Default:* "MIT"
-Write a projen-managed `.editorconfig`.
+SPDX identifier for the generated `LICENSE`.
 ---
-##### `gheTokenSecret`<sup>Optional</sup> <a name="gheTokenSecret" id="@xpertss/projen-types.CommonCdkOptions.property.gheTokenSecret"></a>
+##### `licensed`<sup>Optional</sup> <a name="licensed" id="@xpertss/projen-types.CommonCdkOptions.property.licensed"></a>
 ```typescript
-public readonly gheTokenSecret: string;
+public readonly licensed: boolean;
 ```
-- *Type:* string
-- *Default:* "PROJEN_GITHUB_TOKEN"
+- *Type:* boolean
+- *Default:* true
+Write a `LICENSE`.
 ---
@@ -15699,6 +16483,11 @@ const commonJavaOptions: CommonJavaOptions = { ... }
 | **Name** | **Type** | **Description** |
 | --- | --- | --- |
+| <code><a href="#@xpertss/projen-types.CommonJavaOptions.property.sonarHostUrl">sonarHostUrl</a></code> | <code>string</code> | URL of the org's SonarCloud instance (e.g. `https://sonarcloud.io`). When set, a `sonar.yml` SonarScanner workflow is generated; when omitted, no Sonar workflow is produced. Must be reachable from github.com-hosted (public) runners (AD-001). |
+| <code><a href="#@xpertss/projen-types.CommonJavaOptions.property.sonarOrganization">sonarOrganization</a></code> | <code>string</code> | SonarCloud organization key (`sonar.organization`). Mandatory for the Scanner CLI on SonarCloud - it is not derived from the token, so a scan without it always fails. |
+| <code><a href="#@xpertss/projen-types.CommonJavaOptions.property.sonarProjectKey">sonarProjectKey</a></code> | <code>string</code> | `sonar.projectKey`. |
+| <code><a href="#@xpertss/projen-types.CommonJavaOptions.property.sonarPullRequestGate">sonarPullRequestGate</a></code> | <code>boolean</code> | Whether `sonar.yml` also runs on `pull_request` as a pass/fail gate. |
+| <code><a href="#@xpertss/projen-types.CommonJavaOptions.property.sonarTokenSecret">sonarTokenSecret</a></code> | <code>string</code> | *No description.* |
 | <code><a href="#@xpertss/projen-types.CommonJavaOptions.property.artifactId">artifactId</a></code> | <code>string</code> | *No description.* |
 | <code><a href="#@xpertss/projen-types.CommonJavaOptions.property.groupId">groupId</a></code> | <code>string</code> | *No description.* |
 | <code><a href="#@xpertss/projen-types.CommonJavaOptions.property.name">name</a></code> | <code>string</code> | *No description.* |
@@ -15716,13 +16505,74 @@ const commonJavaOptions: CommonJavaOptions = { ... }
 | <code><a href="#@xpertss/projen-types.CommonJavaOptions.property.packaging">packaging</a></code> | <code>string</code> | Maven packaging of the root pom while the project has no modules. |
 | <code><a href="#@xpertss/projen-types.CommonJavaOptions.property.pluginVersions">pluginVersions</a></code> | <code>{[ key: string ]: string}</code> | Overrides for the plugin/BOM versions this package pins by default, keyed by `groupId/artifactId`, e.g. `{ 'org.apache.maven.plugins/maven-surefire-plugin': '3.5.6' }`. Values must be exact versions. |
 | <code><a href="#@xpertss/projen-types.CommonJavaOptions.property.sample">sample</a></code> | <code>boolean</code> | Write a starter `Main` class and test under the `groupId` package, if `src/` does not exist yet. |
-| <code><a href="#@xpertss/projen-types.CommonJavaOptions.property.sonarProjectKey">sonarProjectKey</a></code> | <code>string</code> | SonarCloud project key. |
 | <code><a href="#@xpertss/projen-types.CommonJavaOptions.property.upgradeWorkflow">upgradeWorkflow</a></code> | <code>boolean</code> | Generate the nightly `upgrade.yml` workflow, which reports available dependency and plugin updates in the job summary (it never edits files - versions are changed in `.projenrc.ts`). |
 | <code><a href="#@xpertss/projen-types.CommonJavaOptions.property.url">url</a></code> | <code>string</code> | Project URL, written to the root pom. |
 | <code><a href="#@xpertss/projen-types.CommonJavaOptions.property.version">version</a></code> | <code>string</code> | *No description.* |
 ---
+##### `sonarHostUrl`<sup>Optional</sup> <a name="sonarHostUrl" id="@xpertss/projen-types.CommonJavaOptions.property.sonarHostUrl"></a>
+```typescript
+public readonly sonarHostUrl: string;
+```
+- *Type:* string
+URL of the org's SonarCloud instance (e.g. `https://sonarcloud.io`). When set, a `sonar.yml` SonarScanner workflow is generated; when omitted, no Sonar workflow is produced. Must be reachable from github.com-hosted (public) runners (AD-001).
+---
+##### `sonarOrganization`<sup>Optional</sup> <a name="sonarOrganization" id="@xpertss/projen-types.CommonJavaOptions.property.sonarOrganization"></a>
+```typescript
+public readonly sonarOrganization: string;
+```
+- *Type:* string
+- *Default:* "xpertss"
+SonarCloud organization key (`sonar.organization`). Mandatory for the Scanner CLI on SonarCloud - it is not derived from the token, so a scan without it always fails.
+---
+##### `sonarProjectKey`<sup>Optional</sup> <a name="sonarProjectKey" id="@xpertss/projen-types.CommonJavaOptions.property.sonarProjectKey"></a>
+```typescript
+public readonly sonarProjectKey: string;
+```
+- *Type:* string
+- *Default:* `${sonarOrganization}_${name}` (the org + project key SonarCloud uses, e.g. `xpertss_create-pull-request`)
+`sonar.projectKey`.
+---
+##### `sonarPullRequestGate`<sup>Optional</sup> <a name="sonarPullRequestGate" id="@xpertss/projen-types.CommonJavaOptions.property.sonarPullRequestGate"></a>
+```typescript
+public readonly sonarPullRequestGate: boolean;
+```
+- *Type:* boolean
+- *Default:* true
+Whether `sonar.yml` also runs on `pull_request` as a pass/fail gate.
+---
+##### `sonarTokenSecret`<sup>Optional</sup> <a name="sonarTokenSecret" id="@xpertss/projen-types.CommonJavaOptions.property.sonarTokenSecret"></a>
+```typescript
+public readonly sonarTokenSecret: string;
+```
+- *Type:* string
+- *Default:* "SONAR_TOKEN"
+---
 ##### `artifactId`<sup>Required</sup> <a name="artifactId" id="@xpertss/projen-types.CommonJavaOptions.property.artifactId"></a>
 ```typescript
@@ -15760,7 +16610,7 @@ public readonly copyrightOwner: string;
 ```
 - *Type:* string
-- *Default:* "xpertss" (same as `GitHubActionProject`)
+- *Default:* "Xpert Software"
 Copyright owner named in the `LICENSE`.
@@ -15950,20 +16800,6 @@ Never written for a multi-module project.
 ---
-##### `sonarProjectKey`<sup>Optional</sup> <a name="sonarProjectKey" id="@xpertss/projen-types.CommonJavaOptions.property.sonarProjectKey"></a>
-```typescript
-public readonly sonarProjectKey: string;
-```
-- *Type:* string
-SonarCloud project key.
-If unset, the sonar scan step is skipped.
----
 ##### `upgradeWorkflow`<sup>Optional</sup> <a name="upgradeWorkflow" id="@xpertss/projen-types.CommonJavaOptions.property.upgradeWorkflow"></a>
 ```typescript
@@ -16227,15 +17063,18 @@ const gitHubActionProjectOptions: GitHubActionProjectOptions = { ... }
 | <code><a href="#@xpertss/projen-types.GitHubActionProjectOptions.property.stale">stale</a></code> | <code>boolean</code> | Auto-close of stale issues and pull request. |
 | <code><a href="#@xpertss/projen-types.GitHubActionProjectOptions.property.staleOptions">staleOptions</a></code> | <code>projen.github.StaleOptions</code> | Auto-close stale issues and pull requests. |
 | <code><a href="#@xpertss/projen-types.GitHubActionProjectOptions.property.vscode">vscode</a></code> | <code>boolean</code> | Enable VSCode integration. |
-| <code><a href="#@xpertss/projen-types.GitHubActionProjectOptions.property.sonarHostUrl">sonarHostUrl</a></code> | <code>string</code> | URL of the org's SonarCloud instance (e.g. `https://sonarcloud.io`). MUST be reachable from github.com-hosted (public) runners (AD-001). Required, no default: a guessed server is worse than a loud failure. |
+| <code><a href="#@xpertss/projen-types.GitHubActionProjectOptions.property.sonarHostUrl">sonarHostUrl</a></code> | <code>string</code> | URL of the org's SonarCloud instance (e.g. `https://sonarcloud.io`). When set, a `sonar.yml` SonarScanner workflow is generated; when omitted, no Sonar workflow is produced. Must be reachable from github.com-hosted (public) runners (AD-001). |
+| <code><a href="#@xpertss/projen-types.GitHubActionProjectOptions.property.sonarOrganization">sonarOrganization</a></code> | <code>string</code> | SonarCloud organization key (`sonar.organization`). Mandatory for the Scanner CLI on SonarCloud - it is not derived from the token, so a scan without it always fails. |
+| <code><a href="#@xpertss/projen-types.GitHubActionProjectOptions.property.sonarProjectKey">sonarProjectKey</a></code> | <code>string</code> | `sonar.projectKey`. |
+| <code><a href="#@xpertss/projen-types.GitHubActionProjectOptions.property.sonarPullRequestGate">sonarPullRequestGate</a></code> | <code>boolean</code> | Whether `sonar.yml` also runs on `pull_request` as a pass/fail gate. |
+| <code><a href="#@xpertss/projen-types.GitHubActionProjectOptions.property.sonarTokenSecret">sonarTokenSecret</a></code> | <code>string</code> | *No description.* |
+| <code><a href="#@xpertss/projen-types.GitHubActionProjectOptions.property.copyrightOwner">copyrightOwner</a></code> | <code>string</code> | Copyright owner named in the `LICENSE`. |
+| <code><a href="#@xpertss/projen-types.GitHubActionProjectOptions.property.copyrightPeriod">copyrightPeriod</a></code> | <code>string</code> | Copyright period named in the `LICENSE`. |
 | <code><a href="#@xpertss/projen-types.GitHubActionProjectOptions.property.description">description</a></code> | <code>string</code> | One-line description of the action. |
 | <code><a href="#@xpertss/projen-types.GitHubActionProjectOptions.property.dogfood">dogfood</a></code> | <code><a href="#@xpertss/projen-types.ActionDogfoodOptions">ActionDogfoodOptions</a></code> | The dogfood scenario (AD-001). |
 | <code><a href="#@xpertss/projen-types.GitHubActionProjectOptions.property.editorconfig">editorconfig</a></code> | <code>boolean</code> | Write a projen-managed `.editorconfig`. |
 | <code><a href="#@xpertss/projen-types.GitHubActionProjectOptions.property.gheTokenSecret">gheTokenSecret</a></code> | <code>string</code> | Name of the GitHub Actions secret holding the PAT used for projen-automation PR comments (F003) and the drift-check's PR comments. |
 | <code><a href="#@xpertss/projen-types.GitHubActionProjectOptions.property.license">license</a></code> | <code>string</code> | SPDX identifier for the generated `LICENSE`. |
-| <code><a href="#@xpertss/projen-types.GitHubActionProjectOptions.property.sonarOrganization">sonarOrganization</a></code> | <code>string</code> | SonarCloud organization key (`sonar.organization`), required by the Scanner CLI on SonarCloud. |
-| <code><a href="#@xpertss/projen-types.GitHubActionProjectOptions.property.sonarPullRequestGate">sonarPullRequestGate</a></code> | <code>boolean</code> | Whether `sonar.yml` also runs on `pull_request` as a pass/fail gate. |
-| <code><a href="#@xpertss/projen-types.GitHubActionProjectOptions.property.sonarTokenSecret">sonarTokenSecret</a></code> | <code>string</code> | *No description.* |
 ---
@@ -16607,7 +17446,7 @@ Enabled by default for root projects. Disabled for non-root projects.
 ---
-##### `sonarHostUrl`<sup>Required</sup> <a name="sonarHostUrl" id="@xpertss/projen-types.GitHubActionProjectOptions.property.sonarHostUrl"></a>
+##### `sonarHostUrl`<sup>Optional</sup> <a name="sonarHostUrl" id="@xpertss/projen-types.GitHubActionProjectOptions.property.sonarHostUrl"></a>
 ```typescript
 public readonly sonarHostUrl: string;
@@ -16615,7 +17454,83 @@ public readonly sonarHostUrl: string;
 - *Type:* string
-URL of the org's SonarCloud instance (e.g. `https://sonarcloud.io`). MUST be reachable from github.com-hosted (public) runners (AD-001). Required, no default: a guessed server is worse than a loud failure.
+URL of the org's SonarCloud instance (e.g. `https://sonarcloud.io`). When set, a `sonar.yml` SonarScanner workflow is generated; when omitted, no Sonar workflow is produced. Must be reachable from github.com-hosted (public) runners (AD-001).
+---
+##### `sonarOrganization`<sup>Optional</sup> <a name="sonarOrganization" id="@xpertss/projen-types.GitHubActionProjectOptions.property.sonarOrganization"></a>
+```typescript
+public readonly sonarOrganization: string;
+```
+- *Type:* string
+- *Default:* "xpertss"
+SonarCloud organization key (`sonar.organization`). Mandatory for the Scanner CLI on SonarCloud - it is not derived from the token, so a scan without it always fails.
+---
+##### `sonarProjectKey`<sup>Optional</sup> <a name="sonarProjectKey" id="@xpertss/projen-types.GitHubActionProjectOptions.property.sonarProjectKey"></a>
+```typescript
+public readonly sonarProjectKey: string;
+```
+- *Type:* string
+- *Default:* `${sonarOrganization}_${name}` (the org + project key SonarCloud uses, e.g. `xpertss_create-pull-request`)
+`sonar.projectKey`.
+---
+##### `sonarPullRequestGate`<sup>Optional</sup> <a name="sonarPullRequestGate" id="@xpertss/projen-types.GitHubActionProjectOptions.property.sonarPullRequestGate"></a>
+```typescript
+public readonly sonarPullRequestGate: boolean;
+```
+- *Type:* boolean
+- *Default:* true
+Whether `sonar.yml` also runs on `pull_request` as a pass/fail gate.
+---
+##### `sonarTokenSecret`<sup>Optional</sup> <a name="sonarTokenSecret" id="@xpertss/projen-types.GitHubActionProjectOptions.property.sonarTokenSecret"></a>
+```typescript
+public readonly sonarTokenSecret: string;
+```
+- *Type:* string
+- *Default:* "SONAR_TOKEN"
+---
+##### `copyrightOwner`<sup>Optional</sup> <a name="copyrightOwner" id="@xpertss/projen-types.GitHubActionProjectOptions.property.copyrightOwner"></a>
+```typescript
+public readonly copyrightOwner: string;
+```
+- *Type:* string
+- *Default:* "Xpert Software"
+Copyright owner named in the `LICENSE`.
+---
+##### `copyrightPeriod`<sup>Optional</sup> <a name="copyrightPeriod" id="@xpertss/projen-types.GitHubActionProjectOptions.property.copyrightPeriod"></a>
+```typescript
+public readonly copyrightPeriod: string;
+```
+- *Type:* string
+- *Default:* the current year
+Copyright period named in the `LICENSE`.
 ---
@@ -16701,108 +17616,137 @@ SPDX identifier for the generated `LICENSE`.
 ---
-##### `sonarOrganization`<sup>Optional</sup> <a name="sonarOrganization" id="@xpertss/projen-types.GitHubActionProjectOptions.property.sonarOrganization"></a>
+### GitHubPackagesPublishOptions <a name="GitHubPackagesPublishOptions" id="@xpertss/projen-types.GitHubPackagesPublishOptions"></a>
+#### Initializer <a name="Initializer" id="@xpertss/projen-types.GitHubPackagesPublishOptions.Initializer"></a>
 ```typescript
-public readonly sonarOrganization: string;
+import { GitHubPackagesPublishOptions } from '@xpertss/projen-types'
+const gitHubPackagesPublishOptions: GitHubPackagesPublishOptions = { ... }
 ```
-- *Type:* string
-- *Default:* "xpertss"
+#### Properties <a name="Properties" id="Properties"></a>
-SonarCloud organization key (`sonar.organization`), required by the Scanner CLI on SonarCloud.
+| **Name** | **Type** | **Description** |
+| --- | --- | --- |
+| <code><a href="#@xpertss/projen-types.GitHubPackagesPublishOptions.property.ghPackagesRegistry">ghPackagesRegistry</a></code> | <code>string</code> | *No description.* |
 ---
-##### `sonarPullRequestGate`<sup>Optional</sup> <a name="sonarPullRequestGate" id="@xpertss/projen-types.GitHubActionProjectOptions.property.sonarPullRequestGate"></a>
+##### `ghPackagesRegistry`<sup>Optional</sup> <a name="ghPackagesRegistry" id="@xpertss/projen-types.GitHubPackagesPublishOptions.property.ghPackagesRegistry"></a>
 ```typescript
-public readonly sonarPullRequestGate: boolean;
+public readonly ghPackagesRegistry: string;
 ```
-- *Type:* boolean
-- *Default:* true
+- *Type:* string
+- *Default:* derived from the repository URL
-Whether `sonar.yml` also runs on `pull_request` as a pass/fail gate.
+---
+### JavaAppProjectOptions <a name="JavaAppProjectOptions" id="@xpertss/projen-types.JavaAppProjectOptions"></a>
+#### Initializer <a name="Initializer" id="@xpertss/projen-types.JavaAppProjectOptions.Initializer"></a>
+```typescript
+import { JavaAppProjectOptions } from '@xpertss/projen-types'
+const javaAppProjectOptions: JavaAppProjectOptions = { ... }
+```
+#### Properties <a name="Properties" id="Properties"></a>
+| **Name** | **Type** | **Description** |
+| --- | --- | --- |
+| <code><a href="#@xpertss/projen-types.JavaAppProjectOptions.property.sonarHostUrl">sonarHostUrl</a></code> | <code>string</code> | URL of the org's SonarCloud instance (e.g. `https://sonarcloud.io`). When set, a `sonar.yml` SonarScanner workflow is generated; when omitted, no Sonar workflow is produced. Must be reachable from github.com-hosted (public) runners (AD-001). |
+| <code><a href="#@xpertss/projen-types.JavaAppProjectOptions.property.sonarOrganization">sonarOrganization</a></code> | <code>string</code> | SonarCloud organization key (`sonar.organization`). Mandatory for the Scanner CLI on SonarCloud - it is not derived from the token, so a scan without it always fails. |
+| <code><a href="#@xpertss/projen-types.JavaAppProjectOptions.property.sonarProjectKey">sonarProjectKey</a></code> | <code>string</code> | `sonar.projectKey`. |
+| <code><a href="#@xpertss/projen-types.JavaAppProjectOptions.property.sonarPullRequestGate">sonarPullRequestGate</a></code> | <code>boolean</code> | Whether `sonar.yml` also runs on `pull_request` as a pass/fail gate. |
+| <code><a href="#@xpertss/projen-types.JavaAppProjectOptions.property.sonarTokenSecret">sonarTokenSecret</a></code> | <code>string</code> | *No description.* |
+| <code><a href="#@xpertss/projen-types.JavaAppProjectOptions.property.artifactId">artifactId</a></code> | <code>string</code> | *No description.* |
+| <code><a href="#@xpertss/projen-types.JavaAppProjectOptions.property.groupId">groupId</a></code> | <code>string</code> | *No description.* |
+| <code><a href="#@xpertss/projen-types.JavaAppProjectOptions.property.name">name</a></code> | <code>string</code> | *No description.* |
+| <code><a href="#@xpertss/projen-types.JavaAppProjectOptions.property.copyrightOwner">copyrightOwner</a></code> | <code>string</code> | Copyright owner named in the `LICENSE`. |
+| <code><a href="#@xpertss/projen-types.JavaAppProjectOptions.property.copyrightPeriod">copyrightPeriod</a></code> | <code>string</code> | Copyright period named in the `LICENSE`. |
+| <code><a href="#@xpertss/projen-types.JavaAppProjectOptions.property.description">description</a></code> | <code>string</code> | Project description, written to the root pom. |
+| <code><a href="#@xpertss/projen-types.JavaAppProjectOptions.property.editorconfig">editorconfig</a></code> | <code>boolean</code> | Write a projen-managed `.editorconfig`. |
+| <code><a href="#@xpertss/projen-types.JavaAppProjectOptions.property.enforcer">enforcer</a></code> | <code>boolean</code> | Add `maven-enforcer-plugin`, which fails the build up front when the JDK or Maven running it is older than the project needs (rather than later, with confusing compiler errors). |
+| <code><a href="#@xpertss/projen-types.JavaAppProjectOptions.property.gheTokenSecret">gheTokenSecret</a></code> | <code>string</code> | *No description.* |
+| <code><a href="#@xpertss/projen-types.JavaAppProjectOptions.property.javaDistribution">javaDistribution</a></code> | <code>string</code> | `actions/setup-java` distribution CI installs the JDK from. |
+| <code><a href="#@xpertss/projen-types.JavaAppProjectOptions.property.javaVersion">javaVersion</a></code> | <code>string</code> | Java line the build targets: `1.8` (alias `8`), `17`, `21`, or `25`. |
+| <code><a href="#@xpertss/projen-types.JavaAppProjectOptions.property.license">license</a></code> | <code>string</code> | SPDX identifier for the generated `LICENSE`. |
+| <code><a href="#@xpertss/projen-types.JavaAppProjectOptions.property.licensed">licensed</a></code> | <code>boolean</code> | Write a `LICENSE` file. |
+| <code><a href="#@xpertss/projen-types.JavaAppProjectOptions.property.minMavenVersion">minMavenVersion</a></code> | <code>string</code> | Lowest Maven version the enforcer accepts (`requireMavenVersion [<this>,)`). |
+| <code><a href="#@xpertss/projen-types.JavaAppProjectOptions.property.packaging">packaging</a></code> | <code>string</code> | Maven packaging of the root pom while the project has no modules. |
+| <code><a href="#@xpertss/projen-types.JavaAppProjectOptions.property.pluginVersions">pluginVersions</a></code> | <code>{[ key: string ]: string}</code> | Overrides for the plugin/BOM versions this package pins by default, keyed by `groupId/artifactId`, e.g. `{ 'org.apache.maven.plugins/maven-surefire-plugin': '3.5.6' }`. Values must be exact versions. |
+| <code><a href="#@xpertss/projen-types.JavaAppProjectOptions.property.sample">sample</a></code> | <code>boolean</code> | Write a starter `Main` class and test under the `groupId` package, if `src/` does not exist yet. |
+| <code><a href="#@xpertss/projen-types.JavaAppProjectOptions.property.upgradeWorkflow">upgradeWorkflow</a></code> | <code>boolean</code> | Generate the nightly `upgrade.yml` workflow, which reports available dependency and plugin updates in the job summary (it never edits files - versions are changed in `.projenrc.ts`). |
+| <code><a href="#@xpertss/projen-types.JavaAppProjectOptions.property.url">url</a></code> | <code>string</code> | Project URL, written to the root pom. |
+| <code><a href="#@xpertss/projen-types.JavaAppProjectOptions.property.version">version</a></code> | <code>string</code> | *No description.* |
+| <code><a href="#@xpertss/projen-types.JavaAppProjectOptions.property.ghPackagesRegistry">ghPackagesRegistry</a></code> | <code>string</code> | *No description.* |
 ---
-##### `sonarTokenSecret`<sup>Optional</sup> <a name="sonarTokenSecret" id="@xpertss/projen-types.GitHubActionProjectOptions.property.sonarTokenSecret"></a>
+##### `sonarHostUrl`<sup>Optional</sup> <a name="sonarHostUrl" id="@xpertss/projen-types.JavaAppProjectOptions.property.sonarHostUrl"></a>
 ```typescript
-public readonly sonarTokenSecret: string;
+public readonly sonarHostUrl: string;
 ```
 - *Type:* string
-- *Default:* "SONAR_TOKEN"
----
+URL of the org's SonarCloud instance (e.g. `https://sonarcloud.io`). When set, a `sonar.yml` SonarScanner workflow is generated; when omitted, no Sonar workflow is produced. Must be reachable from github.com-hosted (public) runners (AD-001).
-### GitHubPackagesPublishOptions <a name="GitHubPackagesPublishOptions" id="@xpertss/projen-types.GitHubPackagesPublishOptions"></a>
+---
-#### Initializer <a name="Initializer" id="@xpertss/projen-types.GitHubPackagesPublishOptions.Initializer"></a>
+##### `sonarOrganization`<sup>Optional</sup> <a name="sonarOrganization" id="@xpertss/projen-types.JavaAppProjectOptions.property.sonarOrganization"></a>
 ```typescript
-import { GitHubPackagesPublishOptions } from '@xpertss/projen-types'
-const gitHubPackagesPublishOptions: GitHubPackagesPublishOptions = { ... }
+public readonly sonarOrganization: string;
 ```
-#### Properties <a name="Properties" id="Properties"></a>
+- *Type:* string
+- *Default:* "xpertss"
-| **Name** | **Type** | **Description** |
-| --- | --- | --- |
-| <code><a href="#@xpertss/projen-types.GitHubPackagesPublishOptions.property.ghPackagesRegistry">ghPackagesRegistry</a></code> | <code>string</code> | *No description.* |
+SonarCloud organization key (`sonar.organization`). Mandatory for the Scanner CLI on SonarCloud - it is not derived from the token, so a scan without it always fails.
 ---
-##### `ghPackagesRegistry`<sup>Optional</sup> <a name="ghPackagesRegistry" id="@xpertss/projen-types.GitHubPackagesPublishOptions.property.ghPackagesRegistry"></a>
+##### `sonarProjectKey`<sup>Optional</sup> <a name="sonarProjectKey" id="@xpertss/projen-types.JavaAppProjectOptions.property.sonarProjectKey"></a>
 ```typescript
-public readonly ghPackagesRegistry: string;
+public readonly sonarProjectKey: string;
 ```
 - *Type:* string
-- *Default:* derived from the repository URL
+- *Default:* `${sonarOrganization}_${name}` (the org + project key SonarCloud uses, e.g. `xpertss_create-pull-request`)
----
+`sonar.projectKey`.
-### JavaAppProjectOptions <a name="JavaAppProjectOptions" id="@xpertss/projen-types.JavaAppProjectOptions"></a>
+---
-#### Initializer <a name="Initializer" id="@xpertss/projen-types.JavaAppProjectOptions.Initializer"></a>
+##### `sonarPullRequestGate`<sup>Optional</sup> <a name="sonarPullRequestGate" id="@xpertss/projen-types.JavaAppProjectOptions.property.sonarPullRequestGate"></a>
 ```typescript
-import { JavaAppProjectOptions } from '@xpertss/projen-types'
+public readonly sonarPullRequestGate: boolean;
+```
-const javaAppProjectOptions: JavaAppProjectOptions = { ... }
+- *Type:* boolean
+- *Default:* true
+Whether `sonar.yml` also runs on `pull_request` as a pass/fail gate.
+---
+##### `sonarTokenSecret`<sup>Optional</sup> <a name="sonarTokenSecret" id="@xpertss/projen-types.JavaAppProjectOptions.property.sonarTokenSecret"></a>
+```typescript
+public readonly sonarTokenSecret: string;
 ```
-#### Properties <a name="Properties" id="Properties"></a>
-| **Name** | **Type** | **Description** |
-| --- | --- | --- |
-| <code><a href="#@xpertss/projen-types.JavaAppProjectOptions.property.artifactId">artifactId</a></code> | <code>string</code> | *No description.* |
-| <code><a href="#@xpertss/projen-types.JavaAppProjectOptions.property.groupId">groupId</a></code> | <code>string</code> | *No description.* |
-| <code><a href="#@xpertss/projen-types.JavaAppProjectOptions.property.name">name</a></code> | <code>string</code> | *No description.* |
-| <code><a href="#@xpertss/projen-types.JavaAppProjectOptions.property.copyrightOwner">copyrightOwner</a></code> | <code>string</code> | Copyright owner named in the `LICENSE`. |
-| <code><a href="#@xpertss/projen-types.JavaAppProjectOptions.property.copyrightPeriod">copyrightPeriod</a></code> | <code>string</code> | Copyright period named in the `LICENSE`. |
-| <code><a href="#@xpertss/projen-types.JavaAppProjectOptions.property.description">description</a></code> | <code>string</code> | Project description, written to the root pom. |
-| <code><a href="#@xpertss/projen-types.JavaAppProjectOptions.property.editorconfig">editorconfig</a></code> | <code>boolean</code> | Write a projen-managed `.editorconfig`. |
-| <code><a href="#@xpertss/projen-types.JavaAppProjectOptions.property.enforcer">enforcer</a></code> | <code>boolean</code> | Add `maven-enforcer-plugin`, which fails the build up front when the JDK or Maven running it is older than the project needs (rather than later, with confusing compiler errors). |
-| <code><a href="#@xpertss/projen-types.JavaAppProjectOptions.property.gheTokenSecret">gheTokenSecret</a></code> | <code>string</code> | *No description.* |
-| <code><a href="#@xpertss/projen-types.JavaAppProjectOptions.property.javaDistribution">javaDistribution</a></code> | <code>string</code> | `actions/setup-java` distribution CI installs the JDK from. |
-| <code><a href="#@xpertss/projen-types.JavaAppProjectOptions.property.javaVersion">javaVersion</a></code> | <code>string</code> | Java line the build targets: `1.8` (alias `8`), `17`, `21`, or `25`. |
-| <code><a href="#@xpertss/projen-types.JavaAppProjectOptions.property.license">license</a></code> | <code>string</code> | SPDX identifier for the generated `LICENSE`. |
-| <code><a href="#@xpertss/projen-types.JavaAppProjectOptions.property.licensed">licensed</a></code> | <code>boolean</code> | Write a `LICENSE` file. |
-| <code><a href="#@xpertss/projen-types.JavaAppProjectOptions.property.minMavenVersion">minMavenVersion</a></code> | <code>string</code> | Lowest Maven version the enforcer accepts (`requireMavenVersion [<this>,)`). |
-| <code><a href="#@xpertss/projen-types.JavaAppProjectOptions.property.packaging">packaging</a></code> | <code>string</code> | Maven packaging of the root pom while the project has no modules. |
-| <code><a href="#@xpertss/projen-types.JavaAppProjectOptions.property.pluginVersions">pluginVersions</a></code> | <code>{[ key: string ]: string}</code> | Overrides for the plugin/BOM versions this package pins by default, keyed by `groupId/artifactId`, e.g. `{ 'org.apache.maven.plugins/maven-surefire-plugin': '3.5.6' }`. Values must be exact versions. |
-| <code><a href="#@xpertss/projen-types.JavaAppProjectOptions.property.sample">sample</a></code> | <code>boolean</code> | Write a starter `Main` class and test under the `groupId` package, if `src/` does not exist yet. |
-| <code><a href="#@xpertss/projen-types.JavaAppProjectOptions.property.sonarProjectKey">sonarProjectKey</a></code> | <code>string</code> | SonarCloud project key. |
-| <code><a href="#@xpertss/projen-types.JavaAppProjectOptions.property.upgradeWorkflow">upgradeWorkflow</a></code> | <code>boolean</code> | Generate the nightly `upgrade.yml` workflow, which reports available dependency and plugin updates in the job summary (it never edits files - versions are changed in `.projenrc.ts`). |
-| <code><a href="#@xpertss/projen-types.JavaAppProjectOptions.property.url">url</a></code> | <code>string</code> | Project URL, written to the root pom. |
-| <code><a href="#@xpertss/projen-types.JavaAppProjectOptions.property.version">version</a></code> | <code>string</code> | *No description.* |
-| <code><a href="#@xpertss/projen-types.JavaAppProjectOptions.property.ghPackagesRegistry">ghPackagesRegistry</a></code> | <code>string</code> | *No description.* |
+- *Type:* string
+- *Default:* "SONAR_TOKEN"
 ---
@@ -16843,7 +17787,7 @@ public readonly copyrightOwner: string;
 ```
 - *Type:* string
-- *Default:* "xpertss" (same as `GitHubActionProject`)
+- *Default:* "Xpert Software"
 Copyright owner named in the `LICENSE`.
@@ -17033,20 +17977,6 @@ Never written for a multi-module project.
 ---
-##### `sonarProjectKey`<sup>Optional</sup> <a name="sonarProjectKey" id="@xpertss/projen-types.JavaAppProjectOptions.property.sonarProjectKey"></a>
-```typescript
-public readonly sonarProjectKey: string;
-```
-- *Type:* string
-SonarCloud project key.
-If unset, the sonar scan step is skipped.
----
 ##### `upgradeWorkflow`<sup>Optional</sup> <a name="upgradeWorkflow" id="@xpertss/projen-types.JavaAppProjectOptions.property.upgradeWorkflow"></a>
 ```typescript
@@ -17109,6 +18039,11 @@ const javaLibraryProjectOptions: JavaLibraryProjectOptions = { ... }
 | **Name** | **Type** | **Description** |
 | --- | --- | --- |
+| <code><a href="#@xpertss/projen-types.JavaLibraryProjectOptions.property.sonarHostUrl">sonarHostUrl</a></code> | <code>string</code> | URL of the org's SonarCloud instance (e.g. `https://sonarcloud.io`). When set, a `sonar.yml` SonarScanner workflow is generated; when omitted, no Sonar workflow is produced. Must be reachable from github.com-hosted (public) runners (AD-001). |
+| <code><a href="#@xpertss/projen-types.JavaLibraryProjectOptions.property.sonarOrganization">sonarOrganization</a></code> | <code>string</code> | SonarCloud organization key (`sonar.organization`). Mandatory for the Scanner CLI on SonarCloud - it is not derived from the token, so a scan without it always fails. |
+| <code><a href="#@xpertss/projen-types.JavaLibraryProjectOptions.property.sonarProjectKey">sonarProjectKey</a></code> | <code>string</code> | `sonar.projectKey`. |
+| <code><a href="#@xpertss/projen-types.JavaLibraryProjectOptions.property.sonarPullRequestGate">sonarPullRequestGate</a></code> | <code>boolean</code> | Whether `sonar.yml` also runs on `pull_request` as a pass/fail gate. |
+| <code><a href="#@xpertss/projen-types.JavaLibraryProjectOptions.property.sonarTokenSecret">sonarTokenSecret</a></code> | <code>string</code> | *No description.* |
 | <code><a href="#@xpertss/projen-types.JavaLibraryProjectOptions.property.artifactId">artifactId</a></code> | <code>string</code> | *No description.* |
 | <code><a href="#@xpertss/projen-types.JavaLibraryProjectOptions.property.groupId">groupId</a></code> | <code>string</code> | *No description.* |
 | <code><a href="#@xpertss/projen-types.JavaLibraryProjectOptions.property.name">name</a></code> | <code>string</code> | *No description.* |
@@ -17126,7 +18061,6 @@ const javaLibraryProjectOptions: JavaLibraryProjectOptions = { ... }
 | <code><a href="#@xpertss/projen-types.JavaLibraryProjectOptions.property.packaging">packaging</a></code> | <code>string</code> | Maven packaging of the root pom while the project has no modules. |
 | <code><a href="#@xpertss/projen-types.JavaLibraryProjectOptions.property.pluginVersions">pluginVersions</a></code> | <code>{[ key: string ]: string}</code> | Overrides for the plugin/BOM versions this package pins by default, keyed by `groupId/artifactId`, e.g. `{ 'org.apache.maven.plugins/maven-surefire-plugin': '3.5.6' }`. Values must be exact versions. |
 | <code><a href="#@xpertss/projen-types.JavaLibraryProjectOptions.property.sample">sample</a></code> | <code>boolean</code> | Write a starter `Main` class and test under the `groupId` package, if `src/` does not exist yet. |
-| <code><a href="#@xpertss/projen-types.JavaLibraryProjectOptions.property.sonarProjectKey">sonarProjectKey</a></code> | <code>string</code> | SonarCloud project key. |
 | <code><a href="#@xpertss/projen-types.JavaLibraryProjectOptions.property.upgradeWorkflow">upgradeWorkflow</a></code> | <code>boolean</code> | Generate the nightly `upgrade.yml` workflow, which reports available dependency and plugin updates in the job summary (it never edits files - versions are changed in `.projenrc.ts`). |
 | <code><a href="#@xpertss/projen-types.JavaLibraryProjectOptions.property.url">url</a></code> | <code>string</code> | Project URL, written to the root pom. |
 | <code><a href="#@xpertss/projen-types.JavaLibraryProjectOptions.property.version">version</a></code> | <code>string</code> | *No description.* |
@@ -17135,6 +18069,68 @@ const javaLibraryProjectOptions: JavaLibraryProjectOptions = { ... }
 ---
+##### `sonarHostUrl`<sup>Optional</sup> <a name="sonarHostUrl" id="@xpertss/projen-types.JavaLibraryProjectOptions.property.sonarHostUrl"></a>
+```typescript
+public readonly sonarHostUrl: string;
+```
+- *Type:* string
+URL of the org's SonarCloud instance (e.g. `https://sonarcloud.io`). When set, a `sonar.yml` SonarScanner workflow is generated; when omitted, no Sonar workflow is produced. Must be reachable from github.com-hosted (public) runners (AD-001).
+---
+##### `sonarOrganization`<sup>Optional</sup> <a name="sonarOrganization" id="@xpertss/projen-types.JavaLibraryProjectOptions.property.sonarOrganization"></a>
+```typescript
+public readonly sonarOrganization: string;
+```
+- *Type:* string
+- *Default:* "xpertss"
+SonarCloud organization key (`sonar.organization`). Mandatory for the Scanner CLI on SonarCloud - it is not derived from the token, so a scan without it always fails.
+---
+##### `sonarProjectKey`<sup>Optional</sup> <a name="sonarProjectKey" id="@xpertss/projen-types.JavaLibraryProjectOptions.property.sonarProjectKey"></a>
+```typescript
+public readonly sonarProjectKey: string;
+```
+- *Type:* string
+- *Default:* `${sonarOrganization}_${name}` (the org + project key SonarCloud uses, e.g. `xpertss_create-pull-request`)
+`sonar.projectKey`.
+---
+##### `sonarPullRequestGate`<sup>Optional</sup> <a name="sonarPullRequestGate" id="@xpertss/projen-types.JavaLibraryProjectOptions.property.sonarPullRequestGate"></a>
+```typescript
+public readonly sonarPullRequestGate: boolean;
+```
+- *Type:* boolean
+- *Default:* true
+Whether `sonar.yml` also runs on `pull_request` as a pass/fail gate.
+---
+##### `sonarTokenSecret`<sup>Optional</sup> <a name="sonarTokenSecret" id="@xpertss/projen-types.JavaLibraryProjectOptions.property.sonarTokenSecret"></a>
+```typescript
+public readonly sonarTokenSecret: string;
+```
+- *Type:* string
+- *Default:* "SONAR_TOKEN"
+---
 ##### `artifactId`<sup>Required</sup> <a name="artifactId" id="@xpertss/projen-types.JavaLibraryProjectOptions.property.artifactId"></a>
 ```typescript
@@ -17172,7 +18168,7 @@ public readonly copyrightOwner: string;
 ```
 - *Type:* string
-- *Default:* "xpertss" (same as `GitHubActionProject`)
+- *Default:* "Xpert Software"
 Copyright owner named in the `LICENSE`.
@@ -17362,20 +18358,6 @@ Never written for a multi-module project.
 ---
-##### `sonarProjectKey`<sup>Optional</sup> <a name="sonarProjectKey" id="@xpertss/projen-types.JavaLibraryProjectOptions.property.sonarProjectKey"></a>
-```typescript
-public readonly sonarProjectKey: string;
-```
-- *Type:* string
-SonarCloud project key.
-If unset, the sonar scan step is skipped.
----
 ##### `upgradeWorkflow`<sup>Optional</sup> <a name="upgradeWorkflow" id="@xpertss/projen-types.JavaLibraryProjectOptions.property.upgradeWorkflow"></a>
 ```typescript
@@ -17452,6 +18434,11 @@ const javaMavenProjectOptions: JavaMavenProjectOptions = { ... }
 | **Name** | **Type** | **Description** |
 | --- | --- | --- |
+| <code><a href="#@xpertss/projen-types.JavaMavenProjectOptions.property.sonarHostUrl">sonarHostUrl</a></code> | <code>string</code> | URL of the org's SonarCloud instance (e.g. `https://sonarcloud.io`). When set, a `sonar.yml` SonarScanner workflow is generated; when omitted, no Sonar workflow is produced. Must be reachable from github.com-hosted (public) runners (AD-001). |
+| <code><a href="#@xpertss/projen-types.JavaMavenProjectOptions.property.sonarOrganization">sonarOrganization</a></code> | <code>string</code> | SonarCloud organization key (`sonar.organization`). Mandatory for the Scanner CLI on SonarCloud - it is not derived from the token, so a scan without it always fails. |
+| <code><a href="#@xpertss/projen-types.JavaMavenProjectOptions.property.sonarProjectKey">sonarProjectKey</a></code> | <code>string</code> | `sonar.projectKey`. |
+| <code><a href="#@xpertss/projen-types.JavaMavenProjectOptions.property.sonarPullRequestGate">sonarPullRequestGate</a></code> | <code>boolean</code> | Whether `sonar.yml` also runs on `pull_request` as a pass/fail gate. |
+| <code><a href="#@xpertss/projen-types.JavaMavenProjectOptions.property.sonarTokenSecret">sonarTokenSecret</a></code> | <code>string</code> | *No description.* |
 | <code><a href="#@xpertss/projen-types.JavaMavenProjectOptions.property.artifactId">artifactId</a></code> | <code>string</code> | *No description.* |
 | <code><a href="#@xpertss/projen-types.JavaMavenProjectOptions.property.groupId">groupId</a></code> | <code>string</code> | *No description.* |
 | <code><a href="#@xpertss/projen-types.JavaMavenProjectOptions.property.name">name</a></code> | <code>string</code> | *No description.* |
@@ -17469,13 +18456,74 @@ const javaMavenProjectOptions: JavaMavenProjectOptions = { ... }
 | <code><a href="#@xpertss/projen-types.JavaMavenProjectOptions.property.packaging">packaging</a></code> | <code>string</code> | Maven packaging of the root pom while the project has no modules. |
 | <code><a href="#@xpertss/projen-types.JavaMavenProjectOptions.property.pluginVersions">pluginVersions</a></code> | <code>{[ key: string ]: string}</code> | Overrides for the plugin/BOM versions this package pins by default, keyed by `groupId/artifactId`, e.g. `{ 'org.apache.maven.plugins/maven-surefire-plugin': '3.5.6' }`. Values must be exact versions. |
 | <code><a href="#@xpertss/projen-types.JavaMavenProjectOptions.property.sample">sample</a></code> | <code>boolean</code> | Write a starter `Main` class and test under the `groupId` package, if `src/` does not exist yet. |
-| <code><a href="#@xpertss/projen-types.JavaMavenProjectOptions.property.sonarProjectKey">sonarProjectKey</a></code> | <code>string</code> | SonarCloud project key. |
 | <code><a href="#@xpertss/projen-types.JavaMavenProjectOptions.property.upgradeWorkflow">upgradeWorkflow</a></code> | <code>boolean</code> | Generate the nightly `upgrade.yml` workflow, which reports available dependency and plugin updates in the job summary (it never edits files - versions are changed in `.projenrc.ts`). |
 | <code><a href="#@xpertss/projen-types.JavaMavenProjectOptions.property.url">url</a></code> | <code>string</code> | Project URL, written to the root pom. |
 | <code><a href="#@xpertss/projen-types.JavaMavenProjectOptions.property.version">version</a></code> | <code>string</code> | *No description.* |
 ---
+##### `sonarHostUrl`<sup>Optional</sup> <a name="sonarHostUrl" id="@xpertss/projen-types.JavaMavenProjectOptions.property.sonarHostUrl"></a>
+```typescript
+public readonly sonarHostUrl: string;
+```
+- *Type:* string
+URL of the org's SonarCloud instance (e.g. `https://sonarcloud.io`). When set, a `sonar.yml` SonarScanner workflow is generated; when omitted, no Sonar workflow is produced. Must be reachable from github.com-hosted (public) runners (AD-001).
+---
+##### `sonarOrganization`<sup>Optional</sup> <a name="sonarOrganization" id="@xpertss/projen-types.JavaMavenProjectOptions.property.sonarOrganization"></a>
+```typescript
+public readonly sonarOrganization: string;
+```
+- *Type:* string
+- *Default:* "xpertss"
+SonarCloud organization key (`sonar.organization`). Mandatory for the Scanner CLI on SonarCloud - it is not derived from the token, so a scan without it always fails.
+---
+##### `sonarProjectKey`<sup>Optional</sup> <a name="sonarProjectKey" id="@xpertss/projen-types.JavaMavenProjectOptions.property.sonarProjectKey"></a>
+```typescript
+public readonly sonarProjectKey: string;
+```
+- *Type:* string
+- *Default:* `${sonarOrganization}_${name}` (the org + project key SonarCloud uses, e.g. `xpertss_create-pull-request`)
+`sonar.projectKey`.
+---
+##### `sonarPullRequestGate`<sup>Optional</sup> <a name="sonarPullRequestGate" id="@xpertss/projen-types.JavaMavenProjectOptions.property.sonarPullRequestGate"></a>
+```typescript
+public readonly sonarPullRequestGate: boolean;
+```
+- *Type:* boolean
+- *Default:* true
+Whether `sonar.yml` also runs on `pull_request` as a pass/fail gate.
+---
+##### `sonarTokenSecret`<sup>Optional</sup> <a name="sonarTokenSecret" id="@xpertss/projen-types.JavaMavenProjectOptions.property.sonarTokenSecret"></a>
+```typescript
+public readonly sonarTokenSecret: string;
+```
+- *Type:* string
+- *Default:* "SONAR_TOKEN"
+---
 ##### `artifactId`<sup>Required</sup> <a name="artifactId" id="@xpertss/projen-types.JavaMavenProjectOptions.property.artifactId"></a>
 ```typescript
@@ -17513,7 +18561,7 @@ public readonly copyrightOwner: string;
 ```
 - *Type:* string
-- *Default:* "xpertss" (same as `GitHubActionProject`)
+- *Default:* "Xpert Software"
 Copyright owner named in the `LICENSE`.
@@ -17703,20 +18751,6 @@ Never written for a multi-module project.
 ---
-##### `sonarProjectKey`<sup>Optional</sup> <a name="sonarProjectKey" id="@xpertss/projen-types.JavaMavenProjectOptions.property.sonarProjectKey"></a>
-```typescript
-public readonly sonarProjectKey: string;
-```
-- *Type:* string
-SonarCloud project key.
-If unset, the sonar scan step is skipped.
----
 ##### `upgradeWorkflow`<sup>Optional</sup> <a name="upgradeWorkflow" id="@xpertss/projen-types.JavaMavenProjectOptions.property.upgradeWorkflow"></a>
 ```typescript
@@ -17764,37 +18798,103 @@ import { JavaServiceProjectOptions } from '@xpertss/projen-types'
 const javaServiceProjectOptions: JavaServiceProjectOptions = { ... }
 ```
-#### Properties <a name="Properties" id="Properties"></a>
-| **Name** | **Type** | **Description** |
-| --- | --- | --- |
-| <code><a href="#@xpertss/projen-types.JavaServiceProjectOptions.property.artifactId">artifactId</a></code> | <code>string</code> | *No description.* |
-| <code><a href="#@xpertss/projen-types.JavaServiceProjectOptions.property.groupId">groupId</a></code> | <code>string</code> | *No description.* |
-| <code><a href="#@xpertss/projen-types.JavaServiceProjectOptions.property.name">name</a></code> | <code>string</code> | *No description.* |
-| <code><a href="#@xpertss/projen-types.JavaServiceProjectOptions.property.copyrightOwner">copyrightOwner</a></code> | <code>string</code> | Copyright owner named in the `LICENSE`. |
-| <code><a href="#@xpertss/projen-types.JavaServiceProjectOptions.property.copyrightPeriod">copyrightPeriod</a></code> | <code>string</code> | Copyright period named in the `LICENSE`. |
-| <code><a href="#@xpertss/projen-types.JavaServiceProjectOptions.property.description">description</a></code> | <code>string</code> | Project description, written to the root pom. |
-| <code><a href="#@xpertss/projen-types.JavaServiceProjectOptions.property.editorconfig">editorconfig</a></code> | <code>boolean</code> | Write a projen-managed `.editorconfig`. |
-| <code><a href="#@xpertss/projen-types.JavaServiceProjectOptions.property.enforcer">enforcer</a></code> | <code>boolean</code> | Add `maven-enforcer-plugin`, which fails the build up front when the JDK or Maven running it is older than the project needs (rather than later, with confusing compiler errors). |
-| <code><a href="#@xpertss/projen-types.JavaServiceProjectOptions.property.gheTokenSecret">gheTokenSecret</a></code> | <code>string</code> | *No description.* |
-| <code><a href="#@xpertss/projen-types.JavaServiceProjectOptions.property.javaDistribution">javaDistribution</a></code> | <code>string</code> | `actions/setup-java` distribution CI installs the JDK from. |
-| <code><a href="#@xpertss/projen-types.JavaServiceProjectOptions.property.javaVersion">javaVersion</a></code> | <code>string</code> | Java line the build targets: `1.8` (alias `8`), `17`, `21`, or `25`. |
-| <code><a href="#@xpertss/projen-types.JavaServiceProjectOptions.property.license">license</a></code> | <code>string</code> | SPDX identifier for the generated `LICENSE`. |
-| <code><a href="#@xpertss/projen-types.JavaServiceProjectOptions.property.licensed">licensed</a></code> | <code>boolean</code> | Write a `LICENSE` file. |
-| <code><a href="#@xpertss/projen-types.JavaServiceProjectOptions.property.minMavenVersion">minMavenVersion</a></code> | <code>string</code> | Lowest Maven version the enforcer accepts (`requireMavenVersion [<this>,)`). |
-| <code><a href="#@xpertss/projen-types.JavaServiceProjectOptions.property.packaging">packaging</a></code> | <code>string</code> | Maven packaging of the root pom while the project has no modules. |
-| <code><a href="#@xpertss/projen-types.JavaServiceProjectOptions.property.pluginVersions">pluginVersions</a></code> | <code>{[ key: string ]: string}</code> | Overrides for the plugin/BOM versions this package pins by default, keyed by `groupId/artifactId`, e.g. `{ 'org.apache.maven.plugins/maven-surefire-plugin': '3.5.6' }`. Values must be exact versions. |
-| <code><a href="#@xpertss/projen-types.JavaServiceProjectOptions.property.sample">sample</a></code> | <code>boolean</code> | Write a starter `Main` class and test under the `groupId` package, if `src/` does not exist yet. |
-| <code><a href="#@xpertss/projen-types.JavaServiceProjectOptions.property.sonarProjectKey">sonarProjectKey</a></code> | <code>string</code> | SonarCloud project key. |
-| <code><a href="#@xpertss/projen-types.JavaServiceProjectOptions.property.upgradeWorkflow">upgradeWorkflow</a></code> | <code>boolean</code> | Generate the nightly `upgrade.yml` workflow, which reports available dependency and plugin updates in the job summary (it never edits files - versions are changed in `.projenrc.ts`). |
-| <code><a href="#@xpertss/projen-types.JavaServiceProjectOptions.property.url">url</a></code> | <code>string</code> | Project URL, written to the root pom. |
-| <code><a href="#@xpertss/projen-types.JavaServiceProjectOptions.property.version">version</a></code> | <code>string</code> | *No description.* |
-| <code><a href="#@xpertss/projen-types.JavaServiceProjectOptions.property.springBootVersion">springBootVersion</a></code> | <code>string</code> | Spring Boot version: imports `spring-boot-dependencies` as the first BOM, and versions `spring-boot-maven-plugin`. |
-| <code><a href="#@xpertss/projen-types.JavaServiceProjectOptions.property.cdkDeployHook">cdkDeployHook</a></code> | <code>boolean</code> | Whether to generate the `deploy-cdk` workflow at all. |
-| <code><a href="#@xpertss/projen-types.JavaServiceProjectOptions.property.cdkDeployTargetRepo">cdkDeployTargetRepo</a></code> | <code>string</code> | The companion CDK infra/app repo (`owner/repo`) whose `deploy.yml` the `deploy-cdk` workflow dispatches. |
-| <code><a href="#@xpertss/projen-types.JavaServiceProjectOptions.property.dockerRegistry">dockerRegistry</a></code> | <code>string</code> | *No description.* |
-| <code><a href="#@xpertss/projen-types.JavaServiceProjectOptions.property.environments">environments</a></code> | <code>string \| <a href="#@xpertss/projen-types.EnvironmentOptions">EnvironmentOptions</a>[]</code> | Deploy targets to offer on the `CdkDeployHook`'s manual-dispatch workflow, when the hook is enabled. |
-| <code><a href="#@xpertss/projen-types.JavaServiceProjectOptions.property.useFlyway">useFlyway</a></code> | <code>boolean</code> | *No description.* |
+#### Properties <a name="Properties" id="Properties"></a>
+| **Name** | **Type** | **Description** |
+| --- | --- | --- |
+| <code><a href="#@xpertss/projen-types.JavaServiceProjectOptions.property.sonarHostUrl">sonarHostUrl</a></code> | <code>string</code> | URL of the org's SonarCloud instance (e.g. `https://sonarcloud.io`). When set, a `sonar.yml` SonarScanner workflow is generated; when omitted, no Sonar workflow is produced. Must be reachable from github.com-hosted (public) runners (AD-001). |
+| <code><a href="#@xpertss/projen-types.JavaServiceProjectOptions.property.sonarOrganization">sonarOrganization</a></code> | <code>string</code> | SonarCloud organization key (`sonar.organization`). Mandatory for the Scanner CLI on SonarCloud - it is not derived from the token, so a scan without it always fails. |
+| <code><a href="#@xpertss/projen-types.JavaServiceProjectOptions.property.sonarProjectKey">sonarProjectKey</a></code> | <code>string</code> | `sonar.projectKey`. |
+| <code><a href="#@xpertss/projen-types.JavaServiceProjectOptions.property.sonarPullRequestGate">sonarPullRequestGate</a></code> | <code>boolean</code> | Whether `sonar.yml` also runs on `pull_request` as a pass/fail gate. |
+| <code><a href="#@xpertss/projen-types.JavaServiceProjectOptions.property.sonarTokenSecret">sonarTokenSecret</a></code> | <code>string</code> | *No description.* |
+| <code><a href="#@xpertss/projen-types.JavaServiceProjectOptions.property.artifactId">artifactId</a></code> | <code>string</code> | *No description.* |
+| <code><a href="#@xpertss/projen-types.JavaServiceProjectOptions.property.groupId">groupId</a></code> | <code>string</code> | *No description.* |
+| <code><a href="#@xpertss/projen-types.JavaServiceProjectOptions.property.name">name</a></code> | <code>string</code> | *No description.* |
+| <code><a href="#@xpertss/projen-types.JavaServiceProjectOptions.property.copyrightOwner">copyrightOwner</a></code> | <code>string</code> | Copyright owner named in the `LICENSE`. |
+| <code><a href="#@xpertss/projen-types.JavaServiceProjectOptions.property.copyrightPeriod">copyrightPeriod</a></code> | <code>string</code> | Copyright period named in the `LICENSE`. |
+| <code><a href="#@xpertss/projen-types.JavaServiceProjectOptions.property.description">description</a></code> | <code>string</code> | Project description, written to the root pom. |
+| <code><a href="#@xpertss/projen-types.JavaServiceProjectOptions.property.editorconfig">editorconfig</a></code> | <code>boolean</code> | Write a projen-managed `.editorconfig`. |
+| <code><a href="#@xpertss/projen-types.JavaServiceProjectOptions.property.enforcer">enforcer</a></code> | <code>boolean</code> | Add `maven-enforcer-plugin`, which fails the build up front when the JDK or Maven running it is older than the project needs (rather than later, with confusing compiler errors). |
+| <code><a href="#@xpertss/projen-types.JavaServiceProjectOptions.property.gheTokenSecret">gheTokenSecret</a></code> | <code>string</code> | *No description.* |
+| <code><a href="#@xpertss/projen-types.JavaServiceProjectOptions.property.javaDistribution">javaDistribution</a></code> | <code>string</code> | `actions/setup-java` distribution CI installs the JDK from. |
+| <code><a href="#@xpertss/projen-types.JavaServiceProjectOptions.property.javaVersion">javaVersion</a></code> | <code>string</code> | Java line the build targets: `1.8` (alias `8`), `17`, `21`, or `25`. |
+| <code><a href="#@xpertss/projen-types.JavaServiceProjectOptions.property.license">license</a></code> | <code>string</code> | SPDX identifier for the generated `LICENSE`. |
+| <code><a href="#@xpertss/projen-types.JavaServiceProjectOptions.property.licensed">licensed</a></code> | <code>boolean</code> | Write a `LICENSE` file. |
+| <code><a href="#@xpertss/projen-types.JavaServiceProjectOptions.property.minMavenVersion">minMavenVersion</a></code> | <code>string</code> | Lowest Maven version the enforcer accepts (`requireMavenVersion [<this>,)`). |
+| <code><a href="#@xpertss/projen-types.JavaServiceProjectOptions.property.packaging">packaging</a></code> | <code>string</code> | Maven packaging of the root pom while the project has no modules. |
+| <code><a href="#@xpertss/projen-types.JavaServiceProjectOptions.property.pluginVersions">pluginVersions</a></code> | <code>{[ key: string ]: string}</code> | Overrides for the plugin/BOM versions this package pins by default, keyed by `groupId/artifactId`, e.g. `{ 'org.apache.maven.plugins/maven-surefire-plugin': '3.5.6' }`. Values must be exact versions. |
+| <code><a href="#@xpertss/projen-types.JavaServiceProjectOptions.property.sample">sample</a></code> | <code>boolean</code> | Write a starter `Main` class and test under the `groupId` package, if `src/` does not exist yet. |
+| <code><a href="#@xpertss/projen-types.JavaServiceProjectOptions.property.upgradeWorkflow">upgradeWorkflow</a></code> | <code>boolean</code> | Generate the nightly `upgrade.yml` workflow, which reports available dependency and plugin updates in the job summary (it never edits files - versions are changed in `.projenrc.ts`). |
+| <code><a href="#@xpertss/projen-types.JavaServiceProjectOptions.property.url">url</a></code> | <code>string</code> | Project URL, written to the root pom. |
+| <code><a href="#@xpertss/projen-types.JavaServiceProjectOptions.property.version">version</a></code> | <code>string</code> | *No description.* |
+| <code><a href="#@xpertss/projen-types.JavaServiceProjectOptions.property.springBootVersion">springBootVersion</a></code> | <code>string</code> | Spring Boot version: imports `spring-boot-dependencies` as the first BOM, and versions `spring-boot-maven-plugin`. |
+| <code><a href="#@xpertss/projen-types.JavaServiceProjectOptions.property.cdkDeployHook">cdkDeployHook</a></code> | <code>boolean</code> | Whether to generate the `deploy-cdk` workflow at all. |
+| <code><a href="#@xpertss/projen-types.JavaServiceProjectOptions.property.cdkDeployTargetRepo">cdkDeployTargetRepo</a></code> | <code>string</code> | The companion CDK infra/app repo (`owner/repo`) whose `deploy.yml` the `deploy-cdk` workflow dispatches. |
+| <code><a href="#@xpertss/projen-types.JavaServiceProjectOptions.property.dockerRegistry">dockerRegistry</a></code> | <code>string</code> | *No description.* |
+| <code><a href="#@xpertss/projen-types.JavaServiceProjectOptions.property.environments">environments</a></code> | <code>string \| <a href="#@xpertss/projen-types.EnvironmentOptions">EnvironmentOptions</a>[]</code> | Deploy targets to offer on the `CdkDeployHook`'s manual-dispatch workflow, when the hook is enabled. |
+| <code><a href="#@xpertss/projen-types.JavaServiceProjectOptions.property.useFlyway">useFlyway</a></code> | <code>boolean</code> | *No description.* |
+---
+##### `sonarHostUrl`<sup>Optional</sup> <a name="sonarHostUrl" id="@xpertss/projen-types.JavaServiceProjectOptions.property.sonarHostUrl"></a>
+```typescript
+public readonly sonarHostUrl: string;
+```
+- *Type:* string
+URL of the org's SonarCloud instance (e.g. `https://sonarcloud.io`). When set, a `sonar.yml` SonarScanner workflow is generated; when omitted, no Sonar workflow is produced. Must be reachable from github.com-hosted (public) runners (AD-001).
+---
+##### `sonarOrganization`<sup>Optional</sup> <a name="sonarOrganization" id="@xpertss/projen-types.JavaServiceProjectOptions.property.sonarOrganization"></a>
+```typescript
+public readonly sonarOrganization: string;
+```
+- *Type:* string
+- *Default:* "xpertss"
+SonarCloud organization key (`sonar.organization`). Mandatory for the Scanner CLI on SonarCloud - it is not derived from the token, so a scan without it always fails.
+---
+##### `sonarProjectKey`<sup>Optional</sup> <a name="sonarProjectKey" id="@xpertss/projen-types.JavaServiceProjectOptions.property.sonarProjectKey"></a>
+```typescript
+public readonly sonarProjectKey: string;
+```
+- *Type:* string
+- *Default:* `${sonarOrganization}_${name}` (the org + project key SonarCloud uses, e.g. `xpertss_create-pull-request`)
+`sonar.projectKey`.
+---
+##### `sonarPullRequestGate`<sup>Optional</sup> <a name="sonarPullRequestGate" id="@xpertss/projen-types.JavaServiceProjectOptions.property.sonarPullRequestGate"></a>
+```typescript
+public readonly sonarPullRequestGate: boolean;
+```
+- *Type:* boolean
+- *Default:* true
+Whether `sonar.yml` also runs on `pull_request` as a pass/fail gate.
+---
+##### `sonarTokenSecret`<sup>Optional</sup> <a name="sonarTokenSecret" id="@xpertss/projen-types.JavaServiceProjectOptions.property.sonarTokenSecret"></a>
+```typescript
+public readonly sonarTokenSecret: string;
+```
+- *Type:* string
+- *Default:* "SONAR_TOKEN"
 ---
@@ -17835,7 +18935,7 @@ public readonly copyrightOwner: string;
 ```
 - *Type:* string
-- *Default:* "xpertss" (same as `GitHubActionProject`)
+- *Default:* "Xpert Software"
 Copyright owner named in the `LICENSE`.
@@ -18025,20 +19125,6 @@ Never written for a multi-module project.
 ---
-##### `sonarProjectKey`<sup>Optional</sup> <a name="sonarProjectKey" id="@xpertss/projen-types.JavaServiceProjectOptions.property.sonarProjectKey"></a>
-```typescript
-public readonly sonarProjectKey: string;
-```
-- *Type:* string
-SonarCloud project key.
-If unset, the sonar scan step is skipped.
----
 ##### `upgradeWorkflow`<sup>Optional</sup> <a name="upgradeWorkflow" id="@xpertss/projen-types.JavaServiceProjectOptions.property.upgradeWorkflow"></a>
 ```typescript
@@ -18173,6 +19259,11 @@ const javaSpringBootProjectOptions: JavaSpringBootProjectOptions = { ... }
 | **Name** | **Type** | **Description** |
 | --- | --- | --- |
+| <code><a href="#@xpertss/projen-types.JavaSpringBootProjectOptions.property.sonarHostUrl">sonarHostUrl</a></code> | <code>string</code> | URL of the org's SonarCloud instance (e.g. `https://sonarcloud.io`). When set, a `sonar.yml` SonarScanner workflow is generated; when omitted, no Sonar workflow is produced. Must be reachable from github.com-hosted (public) runners (AD-001). |
+| <code><a href="#@xpertss/projen-types.JavaSpringBootProjectOptions.property.sonarOrganization">sonarOrganization</a></code> | <code>string</code> | SonarCloud organization key (`sonar.organization`). Mandatory for the Scanner CLI on SonarCloud - it is not derived from the token, so a scan without it always fails. |
+| <code><a href="#@xpertss/projen-types.JavaSpringBootProjectOptions.property.sonarProjectKey">sonarProjectKey</a></code> | <code>string</code> | `sonar.projectKey`. |
+| <code><a href="#@xpertss/projen-types.JavaSpringBootProjectOptions.property.sonarPullRequestGate">sonarPullRequestGate</a></code> | <code>boolean</code> | Whether `sonar.yml` also runs on `pull_request` as a pass/fail gate. |
+| <code><a href="#@xpertss/projen-types.JavaSpringBootProjectOptions.property.sonarTokenSecret">sonarTokenSecret</a></code> | <code>string</code> | *No description.* |
 | <code><a href="#@xpertss/projen-types.JavaSpringBootProjectOptions.property.artifactId">artifactId</a></code> | <code>string</code> | *No description.* |
 | <code><a href="#@xpertss/projen-types.JavaSpringBootProjectOptions.property.groupId">groupId</a></code> | <code>string</code> | *No description.* |
 | <code><a href="#@xpertss/projen-types.JavaSpringBootProjectOptions.property.name">name</a></code> | <code>string</code> | *No description.* |
@@ -18190,7 +19281,6 @@ const javaSpringBootProjectOptions: JavaSpringBootProjectOptions = { ... }
 | <code><a href="#@xpertss/projen-types.JavaSpringBootProjectOptions.property.packaging">packaging</a></code> | <code>string</code> | Maven packaging of the root pom while the project has no modules. |
 | <code><a href="#@xpertss/projen-types.JavaSpringBootProjectOptions.property.pluginVersions">pluginVersions</a></code> | <code>{[ key: string ]: string}</code> | Overrides for the plugin/BOM versions this package pins by default, keyed by `groupId/artifactId`, e.g. `{ 'org.apache.maven.plugins/maven-surefire-plugin': '3.5.6' }`. Values must be exact versions. |
 | <code><a href="#@xpertss/projen-types.JavaSpringBootProjectOptions.property.sample">sample</a></code> | <code>boolean</code> | Write a starter `Main` class and test under the `groupId` package, if `src/` does not exist yet. |
-| <code><a href="#@xpertss/projen-types.JavaSpringBootProjectOptions.property.sonarProjectKey">sonarProjectKey</a></code> | <code>string</code> | SonarCloud project key. |
 | <code><a href="#@xpertss/projen-types.JavaSpringBootProjectOptions.property.upgradeWorkflow">upgradeWorkflow</a></code> | <code>boolean</code> | Generate the nightly `upgrade.yml` workflow, which reports available dependency and plugin updates in the job summary (it never edits files - versions are changed in `.projenrc.ts`). |
 | <code><a href="#@xpertss/projen-types.JavaSpringBootProjectOptions.property.url">url</a></code> | <code>string</code> | Project URL, written to the root pom. |
 | <code><a href="#@xpertss/projen-types.JavaSpringBootProjectOptions.property.version">version</a></code> | <code>string</code> | *No description.* |
@@ -18198,6 +19288,68 @@ const javaSpringBootProjectOptions: JavaSpringBootProjectOptions = { ... }
 ---
+##### `sonarHostUrl`<sup>Optional</sup> <a name="sonarHostUrl" id="@xpertss/projen-types.JavaSpringBootProjectOptions.property.sonarHostUrl"></a>
+```typescript
+public readonly sonarHostUrl: string;
+```
+- *Type:* string
+URL of the org's SonarCloud instance (e.g. `https://sonarcloud.io`). When set, a `sonar.yml` SonarScanner workflow is generated; when omitted, no Sonar workflow is produced. Must be reachable from github.com-hosted (public) runners (AD-001).
+---
+##### `sonarOrganization`<sup>Optional</sup> <a name="sonarOrganization" id="@xpertss/projen-types.JavaSpringBootProjectOptions.property.sonarOrganization"></a>
+```typescript
+public readonly sonarOrganization: string;
+```
+- *Type:* string
+- *Default:* "xpertss"
+SonarCloud organization key (`sonar.organization`). Mandatory for the Scanner CLI on SonarCloud - it is not derived from the token, so a scan without it always fails.
+---
+##### `sonarProjectKey`<sup>Optional</sup> <a name="sonarProjectKey" id="@xpertss/projen-types.JavaSpringBootProjectOptions.property.sonarProjectKey"></a>
+```typescript
+public readonly sonarProjectKey: string;
+```
+- *Type:* string
+- *Default:* `${sonarOrganization}_${name}` (the org + project key SonarCloud uses, e.g. `xpertss_create-pull-request`)
+`sonar.projectKey`.
+---
+##### `sonarPullRequestGate`<sup>Optional</sup> <a name="sonarPullRequestGate" id="@xpertss/projen-types.JavaSpringBootProjectOptions.property.sonarPullRequestGate"></a>
+```typescript
+public readonly sonarPullRequestGate: boolean;
+```
+- *Type:* boolean
+- *Default:* true
+Whether `sonar.yml` also runs on `pull_request` as a pass/fail gate.
+---
+##### `sonarTokenSecret`<sup>Optional</sup> <a name="sonarTokenSecret" id="@xpertss/projen-types.JavaSpringBootProjectOptions.property.sonarTokenSecret"></a>
+```typescript
+public readonly sonarTokenSecret: string;
+```
+- *Type:* string
+- *Default:* "SONAR_TOKEN"
+---
 ##### `artifactId`<sup>Required</sup> <a name="artifactId" id="@xpertss/projen-types.JavaSpringBootProjectOptions.property.artifactId"></a>
 ```typescript
@@ -18235,7 +19387,7 @@ public readonly copyrightOwner: string;
 ```
 - *Type:* string
-- *Default:* "xpertss" (same as `GitHubActionProject`)
+- *Default:* "Xpert Software"
 Copyright owner named in the `LICENSE`.
@@ -18425,20 +19577,6 @@ Never written for a multi-module project.
 ---
-##### `sonarProjectKey`<sup>Optional</sup> <a name="sonarProjectKey" id="@xpertss/projen-types.JavaSpringBootProjectOptions.property.sonarProjectKey"></a>
-```typescript
-public readonly sonarProjectKey: string;
-```
-- *Type:* string
-SonarCloud project key.
-If unset, the sonar scan step is skipped.
----
 ##### `upgradeWorkflow`<sup>Optional</sup> <a name="upgradeWorkflow" id="@xpertss/projen-types.JavaSpringBootProjectOptions.property.upgradeWorkflow"></a>
 ```typescript
@@ -18906,6 +20044,188 @@ public readonly workflowName: string;
 ---
+### SonarScanOptions <a name="SonarScanOptions" id="@xpertss/projen-types.SonarScanOptions"></a>
+#### Initializer <a name="Initializer" id="@xpertss/projen-types.SonarScanOptions.Initializer"></a>
+```typescript
+import { SonarScanOptions } from '@xpertss/projen-types'
+const sonarScanOptions: SonarScanOptions = { ... }
+```
+#### Properties <a name="Properties" id="Properties"></a>
+| **Name** | **Type** | **Description** |
+| --- | --- | --- |
+| <code><a href="#@xpertss/projen-types.SonarScanOptions.property.sonarHostUrl">sonarHostUrl</a></code> | <code>string</code> | URL of the org's SonarCloud instance (e.g. `https://sonarcloud.io`). When set, a `sonar.yml` SonarScanner workflow is generated; when omitted, no Sonar workflow is produced. Must be reachable from github.com-hosted (public) runners (AD-001). |
+| <code><a href="#@xpertss/projen-types.SonarScanOptions.property.sonarOrganization">sonarOrganization</a></code> | <code>string</code> | SonarCloud organization key (`sonar.organization`). Mandatory for the Scanner CLI on SonarCloud - it is not derived from the token, so a scan without it always fails. |
+| <code><a href="#@xpertss/projen-types.SonarScanOptions.property.sonarProjectKey">sonarProjectKey</a></code> | <code>string</code> | `sonar.projectKey`. |
+| <code><a href="#@xpertss/projen-types.SonarScanOptions.property.sonarPullRequestGate">sonarPullRequestGate</a></code> | <code>boolean</code> | Whether `sonar.yml` also runs on `pull_request` as a pass/fail gate. |
+| <code><a href="#@xpertss/projen-types.SonarScanOptions.property.sonarTokenSecret">sonarTokenSecret</a></code> | <code>string</code> | *No description.* |
+---
+##### `sonarHostUrl`<sup>Optional</sup> <a name="sonarHostUrl" id="@xpertss/projen-types.SonarScanOptions.property.sonarHostUrl"></a>
+```typescript
+public readonly sonarHostUrl: string;
+```
+- *Type:* string
+URL of the org's SonarCloud instance (e.g. `https://sonarcloud.io`). When set, a `sonar.yml` SonarScanner workflow is generated; when omitted, no Sonar workflow is produced. Must be reachable from github.com-hosted (public) runners (AD-001).
+---
+##### `sonarOrganization`<sup>Optional</sup> <a name="sonarOrganization" id="@xpertss/projen-types.SonarScanOptions.property.sonarOrganization"></a>
+```typescript
+public readonly sonarOrganization: string;
+```
+- *Type:* string
+- *Default:* "xpertss"
+SonarCloud organization key (`sonar.organization`). Mandatory for the Scanner CLI on SonarCloud - it is not derived from the token, so a scan without it always fails.
+---
+##### `sonarProjectKey`<sup>Optional</sup> <a name="sonarProjectKey" id="@xpertss/projen-types.SonarScanOptions.property.sonarProjectKey"></a>
+```typescript
+public readonly sonarProjectKey: string;
+```
+- *Type:* string
+- *Default:* `${sonarOrganization}_${name}` (the org + project key SonarCloud uses, e.g. `xpertss_create-pull-request`)
+`sonar.projectKey`.
+---
+##### `sonarPullRequestGate`<sup>Optional</sup> <a name="sonarPullRequestGate" id="@xpertss/projen-types.SonarScanOptions.property.sonarPullRequestGate"></a>
+```typescript
+public readonly sonarPullRequestGate: boolean;
+```
+- *Type:* boolean
+- *Default:* true
+Whether `sonar.yml` also runs on `pull_request` as a pass/fail gate.
+---
+##### `sonarTokenSecret`<sup>Optional</sup> <a name="sonarTokenSecret" id="@xpertss/projen-types.SonarScanOptions.property.sonarTokenSecret"></a>
+```typescript
+public readonly sonarTokenSecret: string;
+```
+- *Type:* string
+- *Default:* "SONAR_TOKEN"
+---
+### SonarWorkflowOptions <a name="SonarWorkflowOptions" id="@xpertss/projen-types.SonarWorkflowOptions"></a>
+#### Initializer <a name="Initializer" id="@xpertss/projen-types.SonarWorkflowOptions.Initializer"></a>
+```typescript
+import { SonarWorkflowOptions } from '@xpertss/projen-types'
+const sonarWorkflowOptions: SonarWorkflowOptions = { ... }
+```
+#### Properties <a name="Properties" id="Properties"></a>
+| **Name** | **Type** | **Description** |
+| --- | --- | --- |
+| <code><a href="#@xpertss/projen-types.SonarWorkflowOptions.property.sonarHostUrl">sonarHostUrl</a></code> | <code>string</code> | URL of the org's SonarCloud instance (e.g. `https://sonarcloud.io`). Required, no default - a guessed server is worse than a loud failure. |
+| <code><a href="#@xpertss/projen-types.SonarWorkflowOptions.property.sonarInclusions">sonarInclusions</a></code> | <code>string</code> | `sonar.inclusions` glob, only needed for files Sonar's default inclusions skip - e.g. a composite action's `action.yml` and `*.sh` scripts, which live outside the defaults. Omit it for default-recognized languages (Java, TypeScript, ...). |
+| <code><a href="#@xpertss/projen-types.SonarWorkflowOptions.property.sonarOrganization">sonarOrganization</a></code> | <code>string</code> | SonarCloud organization key (`sonar.organization`). Mandatory for the Scanner CLI on SonarCloud - it is not derived from the token, so a scan without it always fails. |
+| <code><a href="#@xpertss/projen-types.SonarWorkflowOptions.property.sonarProjectKey">sonarProjectKey</a></code> | <code>string</code> | `sonar.projectKey`. |
+| <code><a href="#@xpertss/projen-types.SonarWorkflowOptions.property.sonarPullRequestGate">sonarPullRequestGate</a></code> | <code>boolean</code> | Whether `sonar.yml` also runs on `pull_request` as a pass/fail gate. |
+| <code><a href="#@xpertss/projen-types.SonarWorkflowOptions.property.sonarTokenSecret">sonarTokenSecret</a></code> | <code>string</code> | *No description.* |
+---
+##### `sonarHostUrl`<sup>Required</sup> <a name="sonarHostUrl" id="@xpertss/projen-types.SonarWorkflowOptions.property.sonarHostUrl"></a>
+```typescript
+public readonly sonarHostUrl: string;
+```
+- *Type:* string
+URL of the org's SonarCloud instance (e.g. `https://sonarcloud.io`). Required, no default - a guessed server is worse than a loud failure.
+---
+##### `sonarInclusions`<sup>Optional</sup> <a name="sonarInclusions" id="@xpertss/projen-types.SonarWorkflowOptions.property.sonarInclusions"></a>
+```typescript
+public readonly sonarInclusions: string;
+```
+- *Type:* string
+- *Default:* none (Sonar's default inclusions)
+`sonar.inclusions` glob, only needed for files Sonar's default inclusions skip - e.g. a composite action's `action.yml` and `*.sh` scripts, which live outside the defaults. Omit it for default-recognized languages (Java, TypeScript, ...).
+---
+##### `sonarOrganization`<sup>Optional</sup> <a name="sonarOrganization" id="@xpertss/projen-types.SonarWorkflowOptions.property.sonarOrganization"></a>
+```typescript
+public readonly sonarOrganization: string;
+```
+- *Type:* string
+- *Default:* "xpertss"
+SonarCloud organization key (`sonar.organization`). Mandatory for the Scanner CLI on SonarCloud - it is not derived from the token, so a scan without it always fails.
+---
+##### `sonarProjectKey`<sup>Optional</sup> <a name="sonarProjectKey" id="@xpertss/projen-types.SonarWorkflowOptions.property.sonarProjectKey"></a>
+```typescript
+public readonly sonarProjectKey: string;
+```
+- *Type:* string
+- *Default:* `${sonarOrganization}_${name}` (the org + project key SonarCloud uses, e.g. `xpertss_create-pull-request`)
+`sonar.projectKey`.
+---
+##### `sonarPullRequestGate`<sup>Optional</sup> <a name="sonarPullRequestGate" id="@xpertss/projen-types.SonarWorkflowOptions.property.sonarPullRequestGate"></a>
+```typescript
+public readonly sonarPullRequestGate: boolean;
+```
+- *Type:* boolean
+- *Default:* true
+Whether `sonar.yml` also runs on `pull_request` as a pass/fail gate.
+---
+##### `sonarTokenSecret`<sup>Optional</sup> <a name="sonarTokenSecret" id="@xpertss/projen-types.SonarWorkflowOptions.property.sonarTokenSecret"></a>
+```typescript
+public readonly sonarTokenSecret: string;
+```
+- *Type:* string
+- *Default:* "SONAR_TOKEN"
+---
 ### WorkflowChangeNoticeWorkflowOptions <a name="WorkflowChangeNoticeWorkflowOptions" id="@xpertss/projen-types.WorkflowChangeNoticeWorkflowOptions"></a>
 PR-triggered, tamper-proof notice that a PR touches GitHub Actions workflow or action files.