@xpertss/projen-types 0.0.21 → 0.0.22

package/.jsii

@@ -106,7 +106,7 @@
   },
   "name": "@xpertss/projen-types",
   "readme": {
-    "markdown": "# @xpertss/projen-types\n\nProjen project types for CDK/TypeScript and Java/Maven projects.\n\nInstead of hand-maintaining `pom.xml`, `cdk.json`, and GitHub workflows, you declare a project type in a `.projenrc.ts` file and let [projen](https://github.com/projen/projen) generate (and keep up to date) the whole scaffold: build files, source skeletons, CI workflows, and deploy pipelines.\n\n## Project types at a glance\n\n| Type | What it is | Publishes to | Generated workflows |\n| --- | --- | --- | --- |\n| `CdkInfraProject` | Pure-infrastructure CDK stacks (CloudFront, Route53, SQS, API Gateway, Cognito, ECR/ECS for externally-built images) | - | `build` (PR checks), `deploy` (manual dispatch) |\n| `CdkAppProject` | Full TypeScript service behind API Gateway: infra + app source + database | - | `build`, `deploy`, `app-build` (PR checks) |\n| `JavaMavenProject` | Plain Maven project, single- or multi-module, no framework | - | `build`, `upgrade` (nightly report) |\n| `JavaLibraryProject` | Reusable Java library | Maven Central | `build`, `upgrade` (nightly report), `publish-maven-central`, `codeindex` |\n| `JavaAppProject` | GUI/TUI/CLI Java application | GitHub Packages | `build`, `upgrade` (nightly report), `publish-ghpackages` |\n| `JavaSpringBootProject` | Spring Boot on Maven, single- or multi-module, **no Docker** | - | `build`, `upgrade` (nightly report) |\n| `JavaServiceProject` | Spring Boot service deployed as a container | Docker Hub | `build`, `upgrade` (nightly report), `publish-docker`, `deploy-cdk` |\n| `GitHubActionProject` | Reusable GitHub Action or Workflow | GitHub Releases | `build`, `test-dogfood`, `sonar`, `release` |\n\nThe Java types are layered, so pick the lowest layer that does what you need:\n\n```text\nJavaMavenProject            java_maven         Maven only; single- or multi-module; any supported Java line\n├── JavaLibraryProject      java_library       + Maven Central publish, source/javadoc jars, code index\n├── JavaAppProject          java_app           + GitHub Packages publish\n└── JavaSpringBootProject   java_spring_boot   + Spring Boot BOM and executable-jar repackaging; no Docker/Flyway/CDK\n    └── JavaServiceProject  java_service       + Docker publish, Flyway, CDK deploy hook (single-module)\n```\n\nEvery Java type targets a configurable Java line (`javaVersion`: `1.8`, `17`, `21` or `25`; see [Java version support](#java-version-support)), and every one except `JavaServiceProject` can be a multi-module Maven reactor (see [JavaMavenProject](#javamavenproject)).\n\nOne foundation class is also exported for advanced use: `CdkTypescriptProject` (shared CDK + TypeScript base for the CDK types).\n\nAll project types:\n\n- run a **drift check** in PR builds - a job that re-runs projen and fails if generated files were hand-edited. Edit `.projenrc.ts`, then run `npx projen`; never edit generated files directly.\n- use the GitHub secret `PROJEN_GITHUB_TOKEN` (a fine-grained PAT) for projen's automation. Override with `gheTokenSecret`.\n- make all publishing/deploying **manual** (workflow_dispatch) rather than on every merge.\n\n## Getting started\n\nHow you start depends on what is already in the directory:\n\n| Starting point | Do this |\n| --- | --- |\n| Empty directory | `projen new --from` (below) |\n| Existing repo, no `.projenrc.ts` | `projen new --from ... --no-git` (below) |\n| A `.projenrc.ts` but no `.projen/` directory - copied from another repo, or one of the [examples](#examples) pasted into a fresh repo | [Starting from an existing `.projenrc.ts`](#starting-from-an-existing-projenrcts) |\n\nScaffold the repo with projen's own bootstrap, pointed at this package:\n\n```bash\nmkdir my-project && cd my-project\ngit init\nnpx projen new --from @xpertss/projen-types cdk_infra --name my-project\n```\n\nThat writes a starter `.projenrc.ts`, synthesizes the whole scaffold and\ninstalls dependencies. The type names `projen new` accepts are `cdk_infra`,\n`cdk_app`, `java_maven`, `java_library`, `java_app`, `java_spring_boot`,\n`java_service` and `git_hub_action`; pass a bogus one to have it list them.\nRequired options become flags: `--name` for every type, plus\n`--group-id`/`--artifact-id` (Java) and `--sonar-host-url`\n(`git_hub_action`). Any other plainly-typed option can be passed the same\nway - `--java-version 1.8`, `--cdk-deploy-target-repo owner/repo`,\n`--docker-registry ghcr.io`, `--no-use-flyway`, and so on. Modules can't be\npassed on the command line; add them to `.projenrc.ts` afterwards (see\n[JavaMavenProject](#javamavenproject)).\n\n**Adding projen to a repo that already has content.** `projen new` runs\n`git init` and commits the scaffold by default. In a repo with existing work,\npass `--no-git` so it writes the files and leaves committing to you:\n\n```bash\ncd existing-repo\nnpx projen new --from @xpertss/projen-types java_spring_boot --name obeya --group-id org.xpertss.obeya --artifact-id obeya-parent --no-git\n```\n\n**Commit a lockfile.** The generated `build.yml` and drift check install the\ntoolchain with `npm ci`, which needs a committed `package-lock.json`, and\n`projen new` doesn't always leave one behind. Run `npm install` once and\ncommit `package-lock.json` along with the scaffold. Without it those\nworkflows fail with an `::error::` that says exactly this. For the Java\ntypes, `package.json` is generated, and it pins `projen` and\n`@xpertss/projen-types` to **exact** versions (no `^`), so every machine and\nCI run uses the same generator. A floating range would make the drift check\nreport the differences between generator versions as drift.\n\nCommit the result. From then on, every change to the scaffold goes through\n`.projenrc.ts` followed by `npx projen`:\n\n```bash\nnpx projen\n```\n\nEvery type scaffolds from that one command; no option is *required* that\n`projen new` cannot pass. The structured options - `environments` and\n`GitHubActionProject`'s `dogfood` - are ones projen's CLI cannot render\ninto a projenrc, so they are added afterwards by editing `.projenrc.ts` and\nre-running `npx projen`. Leaving `environments` out simply generates no\ndeploy workflow; leaving `dogfood` out (or a service's\n`cdkDeployTargetRepo`) still generates the workflow, with one step that\nfails and tells you what to add - a gate this package considers load-bearing\nis allowed to be missing loudly, never silently.\n\nThe `name` option must match the `name` field in the project's `package.json` (for the CDK types). For the Java types it becomes the root pom's `<name>` and the generated `package.json` name.\n\n> **Never write projen's generated-file marker text literally in `.projenrc.ts`.** projen deletes, as an orphaned generated file, any file containing the marker line (`~~ Generated by projen. To modify, ...`), and that includes `.projenrc.ts` itself. When you generate a file yourself (for example with `TextFile`), insert the marker through the file's `marker` property: ``file.addLine(`# ${file.marker}`)``.\n\n## Starting from an existing `.projenrc.ts`\n\nA directory that has a `.projenrc.ts` but no `.projen/` directory has never\nbeen synthesized. This happens when you copy the rc from another repo, or paste\none of the [examples](#examples) into a fresh repo. In that state `npx projen`\nfails with:\n\n```\n👾 Unable to find projen project. Use \"projen new\" to create a new project.\n```\n\n`npx projen` doesn't run `.projenrc.ts` itself. It runs the `default` task\nlisted in `.projen/tasks.json`, and that file is written by the first synth.\nDo the first synth one of these two ways. After that, `npx projen` works as\nusual.\n\n**Option 1 (recommended): run `projen new` over the existing rc.** `projen\nnew` leaves an existing `.projenrc.ts` untouched and writes the rest of the\nscaffold, `.projen/` included. Pass the type and its required flags as you\nwould for a new repo. Their values don't have to match your rc, because the\n`npx projen` that follows re-synthesizes everything from the rc:\n\n```bash\nnpx projen new --from @xpertss/projen-types git_hub_action --name pull-request --sonar-host-url https://sonarcloud.io --no-git\nnpx projen\n```\n\nThe first command's output reflects only the flags. For example, a\n`GitHubActionProject`'s `test-dogfood.yml` is still the failing placeholder.\nThe second command applies everything in the rc (`dogfood`, `environments`,\nmodules, and so on).\n\n**Option 2 (Java types and `GitHubActionProject`): run the rc directly,\nonce.** The CDK types run their rc differently, so for those use option 1.\nInstall what the rc imports, give\nts-node a placeholder `tsconfig.projen.json` (the synth overwrites it with the\ngenerated one), and run the same command the generated `default` task runs:\n\n```bash\nnpm i -D projen @xpertss/projen-types constructs\necho '{}' > tsconfig.projen.json\nnpx -y -p ts-node@10.9.2 -p typescript@6.0.3 ts-node --project tsconfig.projen.json .projenrc.ts\nnpx projen\n```\n\nThe `echo` line works in bash and PowerShell. Don't drop `--project`: without\na tsconfig, ts-node fails on Node 22+ with `Unknown file extension \".ts\"`.\n\nEither way, commit `.projen/` along with the rest of the scaffold. A fresh\nclone then has its `tasks.json`, and `npx projen` works there straight away.\n\n## Updating an existing project when this package changes\n\nYour generated scaffold reflects the *installed* version of `@xpertss/projen-types` - `npx projen` reads your project type from the package in `node_modules`, not from this repository. So when this package ships a change (a bug fix, a new generated file, or altered workflow behavior), an existing project picks it up by bumping the dependency and re-synthesizing. A stale `node_modules` silently regenerates with the old behavior, so the bump is the load-bearing step.\n\nUsing the [`auto-commit` action](#githubactionproject) as a running example, say a new release adds the `# Purpose:` workflow header and SonarCloud wording. In the `auto-commit` repo:\n\n```bash\nnpm view @xpertss/projen-types version        # what's the newest release?\nnpm i -D @xpertss/projen-types@latest         # bump the installed project type\nnpx projen                                    # re-synthesize every generated file\ngit diff                                      # review before committing\n```\n\nThe diff here is the workflows gaining a `# Purpose:` comment and `sonar.yml` reflecting the SonarCloud wording. Commit the result with a normal `chore:` or `fix:` message - you never hand-edit the generated files themselves.\n\n## Examples\n\nEach example shows the `projen new` command first, then a fuller\n`.projenrc.ts`. Run the command first, then replace the generated\n`.projenrc.ts` with the example (or merge it in) and run `npx projen`. If you\npasted the example into a fresh repo first instead, see\n[Starting from an existing `.projenrc.ts`](#starting-from-an-existing-projenrcts).\n\n### CdkInfraProject\n\nPure infrastructure stacks with optional ECR/ECS and edge-networking constructs.\n\nScaffold it with the `cdk_infra` type:\n\n```bash\nnpx projen new --from @xpertss/projen-types cdk_infra --name media-edge-infra\n```\n\n```typescript\n// .projenrc.ts\nimport { CdkInfraProject } from '@xpertss/projen-types';\n\nconst project = new CdkInfraProject({\n  name: 'media-edge-infra',\n  environments: [\n    'dev',\n    { name: 'stage', accountId: '111111111111', region: 'eu-central-1' },\n    { name: 'prod', accountId: '222222222222', region: 'eu-central-1', requiresApproval: true },\n  ],\n  edgeResources: ['cloudfront', 'route53', 'sqs'],\n  ecrEcs: { enabled: true, externalImageSource: true },\n});\n\nproject.synth();\n```\n\nYou get:\n\n- `cdk.json`, `cdk synth` / `cdk diff` / `cdk deploy` tasks, and the standard `AwsCdkTypeScriptApp` layout (CDK 2.189.1 by default).\n- `.github/workflows/build.yml` - PR build that hard-fails on projen drift.\n- `.github/workflows/deploy.yml` - manual dispatch with one `deploy-<env>` job per environment (runs `cdk deploy --all` with `--context environment=<env>`); `requiresApproval` environments get a GitHub Environment approval gate.\n- `LICENSE` (MIT by default), `.editorconfig`, and the projen drift check.\n- `src/constructs/edge-networking.ts` - helper constructs only for the requested `edgeResources` (`cloudfront`, `route53`, `apigateway`, `cognito`, `sqs`).\n- `src/constructs/ecr-ecs.ts` when `ecrEcs.enabled` - ECR repo + Fargate service; `externalImageSource: true` (default) means the service pulls an image built outside this repo.\n\n### CdkAppProject\n\n`CdkInfraProject` plus application source, a database construct, and an app-level build workflow.\n\nScaffold it with the `cdk_app` type:\n\n```bash\nnpx projen new --from @xpertss/projen-types cdk_app --name video-api\n```\n\n```typescript\n// .projenrc.ts\nimport { CdkAppProject } from '@xpertss/projen-types';\n\nconst project = new CdkAppProject({\n  name: 'video-api',\n  environments: ['dev', 'prod'],\n  edgeResources: ['apigateway'],\n  database: { engine: 'postgres', migrationTool: 'flyway' },\n  appEntryPoint: 'src/app.ts',\n});\n\nproject.synth();\n```\n\nEverything from `CdkInfraProject`, plus:\n\n- `src/app.ts` - application entrypoint stub (`export function handler()`).\n- `src/handlers/example.ts` - API Gateway proxy handler stub, with `@types/aws-lambda` added as a dev dependency.\n- `src/constructs/database.ts` - a `Database` construct stub for the chosen engine (`postgres`/`mysql` -> RDS, `dynamodb` -> DynamoDB). `migrationTool` (no default, intentionally) is added as a dev dependency and referenced in the stub - wiring it up is left to you.\n- `.github/workflows/app-build.yml` - runs the project's test task on every PR, then checks for projen drift.\n\n### JavaMavenProject\n\nA plain Maven build with no framework and no publish target. It's the base of every other Java type, and it's usable on its own. It's single-module until you add a module, then it's a multi-module reactor.\n\nScaffold it with the `java_maven` type:\n\n```bash\nnpx projen new --from @xpertss/projen-types java_maven --name legacy-tools --group-id org.xpertss --artifact-id legacy-tools --java-version 1.8\n```\n\n**Single module:**\n\n```typescript\n// .projenrc.ts\nimport { JavaMavenProject } from '@xpertss/projen-types';\n\nconst project = new JavaMavenProject({\n  name: 'legacy-tools',\n  groupId: 'org.xpertss',\n  artifactId: 'legacy-tools',\n  javaVersion: '1.8',\n});\n\nproject.addDependency('commons-io/commons-io@2.20.0');    // exact version\nproject.addTestDependency('org.assertj/assertj-core@3.27.3');\n\nproject.synth();\n```\n\n**Multi-module:** each `addModule()` call adds a module directory with its own generated `pom.xml`. The root pom becomes the `pom`-packaged reactor parent. Everything stays one projen project, with one `.projen/`, one `.gitignore` and one `tasks.json`.\n\n```typescript\n// .projenrc.ts\nimport { JavaMavenProject } from '@xpertss/projen-types';\n\nconst project = new JavaMavenProject({\n  name: 'toolkit',\n  groupId: 'org.xpertss.toolkit',\n  artifactId: 'toolkit-parent',\n  version: '0.1.0-SNAPSHOT',\n  javaVersion: '17',\n});\n\nconst model = project.addModule({ dir: 'toolkit-model', artifactId: 'toolkit-model', description: 'Domain model' });\nconst stub = project.addModule({ dir: 'tools/stub-model', artifactId: 'toolkit-stub-model' }); // nested dirs are fine\nconst cli = project.addModule({ dir: 'toolkit-cli', artifactId: 'toolkit-cli' });\n\nstub.addModuleDependency(model);                     // sibling module: versionless\ncli.addModuleDependency(model);\ncli.addDependency('info.picocli/picocli@4.7.7');     // pinned: the version moves to the parent\ncli.addDependency('org.yaml/snakeyaml');             // versionless: managed below\nproject.addManagedDependency('org.yaml/snakeyaml@2.4');\nproject.addBom('org.testcontainers/testcontainers-bom@1.21.3');\n\nproject.synth();\n```\n\nWhat the reactor looks like:\n\n- **Root `pom.xml`:**\n  - `<packaging>pom</packaging>`, with `<modules>` in `addModule` order.\n  - `<dependencyManagement>` holds the BOM imports first (`type=pom`, `scope=import`), then every module at `${project.version}`, then every pinned version.\n  - `<pluginManagement>` holds the plugin versions, and versionless `<plugins>` are inherited by every module: compiler, surefire, failsafe, jar, and enforcer.\n  - `junit-jupiter` is a test dependency every module inherits. Its version comes from `junit-bom`, or from the Spring Boot BOM in the Spring Boot types.\n- **Module `pom.xml`:** `<parent>` with the right `relativePath` (`tools/stub-model` → `../../pom.xml`), then `artifactId`, `name`, `description`, and versionless `<dependencies>`. Nothing else, unless the module adds plugins.\n- A version given to `module.addDependency`/`addTestDependency`/`addPlugin` is moved into the parent's `<dependencyManagement>`/`<pluginManagement>`, so every module that uses an artifact gets the same version. Pinning one artifact at two different versions fails the synth.\n- The synth fails with a clear message on:\n  - two modules with the same `artifactId`\n  - two modules with the same `dir`, or one `dir` nested inside another\n  - a `dir` outside the repo\n  - a module depending on itself\n  - `packaging` set to anything but `pom` on a project with modules\n\nYou get:\n\n- the root `pom.xml` (and one per module), written by this package:\n  - **exact versions only**: a range such as `^1`, `~1.2` or `[1,2)` fails the synth\n  - the compiler level, enforcer rule and JUnit line all follow `javaVersion`\n- one Maven run per build. `npx projen build` synthesizes, then runs `mvn -B verify`: compile, unit tests (surefire), package, and `*IT` integration tests (failsafe). There is no `mvn deploy` and no `dist/`.\n- `.github/workflows/build.yml`: a PR build that installs the pinned Node toolchain (`npm ci`) and the project's JDK (`actions/setup-java`, Maven cache), then runs `npx projen build`, plus a SonarQube step when `sonarProjectKey` is set. See [Adding CI jobs](#adding-ci-jobs-to-a-java-project).\n- `.github/workflows/upgrade.yml`: a nightly (03:00 UTC) **report** of available dependency and plugin updates in the job summary. It changes nothing, because every version comes from `.projenrc.ts`; apply an update there. Turn it off with `upgradeWorkflow: false`. The same report runs locally with `npx projen upgrade`.\n- the projen drift check, `LICENSE` (MIT by default), `.editorconfig`, and a generated `package.json` that pins the projen toolchain exactly.\n- no sample code, unless `sample: true` on a single-module project.\n\n### JavaLibraryProject\n\nA reusable Java library published to Maven Central.\n\nScaffold it with the `java_library` type:\n\n```bash\nnpx projen new --from @xpertss/projen-types java_library --name common-utils --group-id org.xpertss --artifact-id common-utils\n```\n\n```typescript\n// .projenrc.ts\nimport { JavaLibraryProject } from '@xpertss/projen-types';\n\nconst project = new JavaLibraryProject({\n  name: 'common-utils',\n  groupId: 'org.xpertss',\n  artifactId: 'common-utils',\n  version: '1.0.0',\n  sonarProjectKey: 'org.xpertss:common-utils',\n  mavenCentralOidc: true,\n});\n\nproject.synth();\n```\n\nYou get everything from [`JavaMavenProject`](#javamavenproject), so modules work here too, plus:\n\n- `maven-source-plugin` and `maven-javadoc-plugin`, attaching the `-sources`/`-javadoc` jars Maven Central requires. In a multi-module library every module attaches them.\n- `.github/workflows/publish-maven-central.yml` - manual dispatch running `mvn -B deploy -P release`. With `mavenCentralOidc: true` it uses Maven Central's OIDC trusted publishing (no GPG secrets needed); otherwise it expects the secrets `MAVEN_GPG_PRIVATE_KEY`, `MAVEN_GPG_PASSPHRASE`, `MAVEN_CENTRAL_USERNAME`, `MAVEN_CENTRAL_PASSWORD`.\n- `.github/workflows/codeindex.yml` - on push to `main`, generates a Java source index under `.cai/` covering every module (disable with `publishCodeIndex: false`).\n\n### JavaSpringBootProject\n\nSpring Boot on Maven, single- or multi-module, **without** Docker, Flyway or a deploy hook. It's [`JavaMavenProject`](#javamavenproject) plus Spring Boot dependency management. Use it for a Spring Boot repo that ships something other than this package's container image, such as a multi-module control plane, or for a Boot app you deploy your own way.\n\nScaffold it with the `java_spring_boot` type:\n\n```bash\nnpx projen new --from @xpertss/projen-types java_spring_boot --name obeya --group-id org.xpertss.obeya --artifact-id obeya-parent\n```\n\n```typescript\n// .projenrc.ts\nimport { JavaSpringBootProject } from '@xpertss/projen-types';\n\nconst project = new JavaSpringBootProject({\n  name: 'obeya',\n  groupId: 'org.xpertss.obeya',\n  artifactId: 'obeya-parent',\n  version: '0.1.0-SNAPSHOT',\n  javaVersion: '21',\n  copyrightOwner: 'Xpert Software',\n});\n\n// plain jar modules: shared libraries, clients, tools\nconst model = project.addModule({ dir: 'obeya-model', artifactId: 'obeya-model' });\nconst client = project.addModule({ dir: 'obeya-api-client', artifactId: 'obeya-api-client' });\nclient.addModuleDependency(model);\n\n// a Spring Boot application module, repackaged into an executable jar\nconst server = project.addSpringBootModule({ dir: 'obeya-server', artifactId: 'obeya-server' });\nserver.addModuleDependency(model);\nserver.addDependency('org.springframework.boot/spring-boot-starter-web');      // versionless: Boot's BOM manages it\nserver.addTestDependency('org.springframework.boot/spring-boot-starter-test');\n\nproject.addBom('org.testcontainers/testcontainers-bom@1.21.3');\n\nproject.synth();\n```\n\nYou get everything from [`JavaMavenProject`](#javamavenproject), plus:\n\n- `spring-boot-dependencies` imported as the **first** BOM, so starters and every library Boot manages (JUnit included) are added without a version. `springBootVersion` sets it; the default is the newest release of the line that supports `javaVersion` (see [Java version support](#java-version-support)).\n- `spring-boot-maven-plugin`, versioned in `<pluginManagement>`:\n  - In a **single-module** project the root jar is repackaged into an executable jar.\n  - In a **multi-module** project only modules added with `addSpringBootModule()` are repackaged; `addModule()` modules stay plain jars.\n  - A repackaged module needs its `@SpringBootApplication` class before `mvn verify` passes, because `repackage` fails with `Unable to find main class` until one exists. Add a module as a plain `addModule()` while it's still empty.\n- failsafe configured to run integration tests against the compiled classes rather than the repackaged jar (as `spring-boot-starter-parent` does).\n- no starters, no Docker, no Flyway, no CDK. Add the starters you need with `addDependency`.\n\n### JavaServiceProject\n\nA Spring Boot service that publishes a Docker image and can trigger deploys in a companion CDK repo. It is [`JavaSpringBootProject`](#javaspringbootproject) plus Docker, Flyway and a deploy hook. It is **single-module**, because the Docker build, the migrations and the deploy hook all assume one deployable at the repo root; `addModule()` fails and points you to `JavaSpringBootProject`.\n\nScaffold it with the `java_service` type:\n\n```bash\nnpx projen new --from @xpertss/projen-types java_service --name stream-processor --group-id org.xpertss --artifact-id stream-processor\n```\n\n```typescript\n// .projenrc.ts\nimport { JavaServiceProject } from '@xpertss/projen-types';\n\nconst project = new JavaServiceProject({\n  name: 'stream-processor',\n  groupId: 'org.xpertss',\n  artifactId: 'stream-processor',\n  dockerRegistry: 'docker.io/xpertss',\n  cdkDeployTargetRepo: 'xpertss/stream-infra',\n  environments: ['dev', { name: 'prod', requiresApproval: true }],\n});\n\nproject.synth();\n```\n\nYou get everything from [`JavaSpringBootProject`](#javaspringbootproject) (and so from `JavaMavenProject`), plus:\n\n- `spring-boot-starter-web` added to the pom (versionless; Boot's BOM manages it).\n- `.github/workflows/publish-docker.yml` - manual dispatch: `mvn -B package && docker build -t <registry>/<name>:<sha>`, logged in with the `DOCKER_USERNAME` / `DOCKER_PASSWORD` secrets. `dockerRegistry` defaults to `docker.io`.\n- Flyway wiring when `useFlyway` (default `true`): `flyway-core` (versionless, so it matches what Boot's Flyway auto-configuration expects), `flyway-maven-plugin` pinned for the Java line, and `src/main/resources/db/migration/V1__init.sql`.\n- `.github/workflows/deploy-cdk.yml` (the `CdkDeployHook`, generated by default) - manual dispatch with an environment selector; each job sends a `workflow_dispatch` to `deploy.yml` in the companion `cdkDeployTargetRepo` (a `CdkInfraProject`/`CdkAppProject` repo). With no `cdkDeployTargetRepo` set, the workflow is still generated but each job's only step fails with instructions - it is dispatch-only, so that lands on whoever tries to deploy rather than on every PR. Turn the workflow off entirely with `cdkDeployHook: false`. `environments` defaults to `['prod']`.\n\n### JavaAppProject\n\nA GUI/TUI/CLI Java application published to GitHub Packages only - no Maven Central, no Docker, no CDK deploy hook.\n\nScaffold it with the `java_app` type:\n\n```bash\nnpx projen new --from @xpertss/projen-types java_app --name studio-cli --group-id org.xpertss --artifact-id studio-cli\n```\n\n```typescript\n// .projenrc.ts\nimport { JavaAppProject } from '@xpertss/projen-types';\n\nconst project = new JavaAppProject({\n  name: 'studio-cli',\n  groupId: 'org.xpertss',\n  artifactId: 'studio-cli',\n  ghPackagesRegistry: 'https://maven.pkg.github.com/xpertss/studio-cli',\n});\n\nproject.synth();\n```\n\nYou get everything from [`JavaMavenProject`](#javamavenproject) (modules included), plus `.github/workflows/publish-ghpackages.yml` - manual dispatch running `mvn -B deploy -DaltDeploymentRepository=github::<registry>`, authenticated with `GITHUB_TOKEN`. `ghPackagesRegistry` defaults to `https://maven.pkg.github.com/<repo>` derived from the repository URL.\n\n### GitHubActionProject\n\nA reusable GitHub Action or Workflow. This example scaffolds an action that stages a folder and, only if it changed, commits and pushes it.\n\nScaffold it with the `git_hub_action` type:\n\n```bash\nnpx projen new --from @xpertss/projen-types git_hub_action --name auto-commit --sonar-host-url https://sonarcloud.io\n```\n\n```typescript\n// .projenrc.ts\nimport { GitHubActionProject } from '@xpertss/projen-types';\n\nconst project = new GitHubActionProject({\n  name: 'auto-commit',\n  description: 'Stage a folder and, only if it changed, commit and push it',\n  sonarHostUrl: 'https://sonarcloud.io',       // required, no default - your SonarCloud URL\n  sonarOrganization: 'xpertss',                 // default - your SonarCloud org key\n  dogfood: {\n    // Two scenario steps: the \"changed\" path and the \"no-op\" path are both\n    // load-bearing behavior for this action (a double-commit or a\n    // push-when-empty bug is the failure mode a hand-rolled inline-shell\n    // alternative is most likely to introduce).\n    scenario: [\n      {\n        name: 'Changed path',\n        fixtureSteps: [\n          'echo \"$(date -u +%Y%m%dT%H%M%SZ)\" >> test/fixtures/dogfood-state.txt',\n        ],\n        inputs: {\n          commit_message: 'test: dogfood',\n          branches: 'test/dogfood',\n        },\n        assertions: [\n          // step id defaults to a slug of `name` - here \"changed-path-0\"\n          '[ \"${{ steps.changed-path-0.outputs.committed }}\" = \"true\" ]',\n        ],\n      },\n      {\n        // No fixture change this time - nothing new to commit.\n        name: 'No-op path',\n        id: 'no-op-check',            // pin an explicit id instead of relying on the default slug\n        inputs: {\n          commit_message: 'test: dogfood',\n          branches: 'test/dogfood',\n        },\n        assertions: [\n          '[ \"${{ steps.no-op-check.outputs.committed }}\" = \"false\" ]',\n        ],\n      },\n    ],\n    cleanup: [\n      'git push origin --delete test/dogfood || true',\n    ],\n  },\n});\n\nproject.synth();\n```\n\nYou get:\n\n- `action.yml` and `auto-commit.sh` are hand-written - this type only lints their content via `build.yml`'s shellcheck/yamllint/actionlint checks.\n- `.github/workflows/build.yml` - lint gate: `apt`-installed shellcheck/yamllint plus a pinned, SHA-256-verified `actionlint` release binary. Gates `main` alongside `sonar.yml`.\n- `.github/workflows/test-dogfood.yml` - runs the `dogfood.scenario` steps above against this repo's own `action.yml` (via `uses: ./`), then the shared `cleanup`, on `workflow_dispatch`, every `pull_request`, and nightly. Omit `dogfood` and the workflow still exists, with one step that fails on every PR until you declare a scenario - AD-001 allows a dogfood to be missing loudly, never silently. A *partial* `dogfood` (a scenario with no cleanup) is a synth error.\n- `.github/workflows/sonar.yml` - SonarCloud scan via the Scanner CLI (the quality gate blocks the PR), scanning `action.yml`/`.github/workflows/**`/`**/*.sh` explicitly.\n- `.github/workflows/release.yml` - `feat:`/`fix:` commits on `main` bump the version, tag `vX.Y.Z`, and create a GitHub Release.\n- `.github/workflows/projen-drift-check.yml` and `workflow-change-notice.yml` - drift detection and a change notice, always included.\n- `package.json` (**private**, version source only), `.yamllint`, `LICENSE` (MIT by default), and a `README.md` template - all regenerated by `npx projen`.\n\nNeeds the same two secrets as everything else in this package: `PROJEN_GITHUB_TOKEN` (used for automated PR comments) and `SONAR_TOKEN` (the Sonar scan). Onboard a brand-new action repo by running the `projen new` command above first (see [Getting started](#getting-started)), then replace the generated `.projenrc.ts` with the one above and run `npx projen`, then hand-write `action.yml`/`auto-commit.sh`/`test/fixtures/`. If you wrote the `.projenrc.ts` before running `projen new`, see [Starting from an existing `.projenrc.ts`](#starting-from-an-existing-projenrcts).\n\n## Java version support\n\n`javaVersion` picks the Java line a Java project targets. It defaults to `21`; the supported lines are `1.8` (alias `8`), `17`, `21` and `25`, and any other value fails the synth with that list. **Nothing in the generated build is hard-coded to one Java line.** Everything that depends on it comes from one table in this package, grouped by line:\n\n| | `1.8` | `17` | `21` | `25` |\n| --- | --- | --- | --- | --- |\n| Compiler level | `maven.compiler.source`/`target` = `1.8` (javac 8 has no `--release`) | `maven.compiler.release` = `17` | `release` = `21` | `release` = `25` |\n| Enforcer `requireJavaVersion` | `[1.8,)` | `[17,)` | `[21,)` | `[25,)` |\n| JUnit (`junit-bom`) | 5.14.4 (JUnit 6 needs Java 17) | 6.1.3 | 6.1.3 | 6.1.3 |\n| Default Spring Boot (`JavaSpringBootProject`) | 2.7.18 (Boot 3+ needs Java 17; a 3.x+ `springBootVersion` fails the synth) | 4.1.1 | 4.1.1 | 4.1.1 |\n| `flyway-maven-plugin` (`JavaServiceProject`) | 9.22.3 | 13.9.0 | 13.9.0 | 13.9.0 |\n| CI JDK (`actions/setup-java` `java-version`) | `8` | `17` | `21` | `25` |\n\nMaven plugins (the same on every line, because all of them run on JDK 8): `maven-compiler-plugin` 3.16.0, `maven-surefire-plugin`/`maven-failsafe-plugin` 3.6.0, `maven-jar-plugin` 3.5.1, `maven-enforcer-plugin` 3.6.3, `maven-source-plugin` 3.4.0 and `maven-javadoc-plugin` 3.12.0 (library only), `versions-maven-plugin` 2.22.0 (the `upgrade` report).\n\n**The enforcer.** `maven-enforcer-plugin` fails the build at the start when the JDK or Maven running it is older than the project needs. Without it you get confusing compiler errors later, or a jar built for the wrong runtime. Its Java rule always follows `javaVersion`. The Maven rule defaults to `[3.9,)`; change it with `minMavenVersion`, or drop the plugin entirely with `enforcer: false`. CI installs the matching JDK through `setup-java`, so the rule only fires on a developer machine with the wrong JDK. A Java 1.8 project builds on any newer JDK (the rule is a minimum), but the JDK 8 runtime API is guaranteed only when you build on JDK 8.\n\n**Overriding a version.** `pluginVersions` replaces any default in the table, keyed by `groupId/artifactId`, with an exact version:\n\n```typescript\nnew JavaMavenProject({\n  name: 'svc',\n  groupId: 'org.xpertss',\n  artifactId: 'svc',\n  pluginVersions: {\n    'org.apache.maven.plugins/maven-surefire-plugin': '3.5.6',\n    'org.junit/junit-bom': '5.14.4',\n  },\n});\n```\n\n`project.pinnedVersion('org.apache.maven.plugins/maven-surefire-plugin')` returns the version in effect, for reuse in your own plugin config.\n\n**New Java lines** are one new row in this package's version table and a release. Until a line is listed, `javaVersion` rejects it rather than guessing.\n\n## Adding CI jobs to a Java project\n\n`build.yml` is exposed as `project.buildVerifyWorkflow`, so jobs are added through projen's `addJob` rather than `addOverride`. `project.ciSetupSteps` holds the steps every Maven job here needs: pinned Node, `npm ci`, and the project's JDK with a Maven cache. Every job in `build.yml` can then be made a required check on `main`.\n\n```typescript\nimport { github } from 'projen';\n\nproject.buildVerifyWorkflow.addJob('integration', {\n  name: 'Container integration tests',\n  runsOn: ['self-hosted', 'linux', 'fedora', 'podman'],\n  permissions: { contents: github.workflows.JobPermission.READ },\n  steps: [\n    { name: 'Checkout', uses: 'actions/checkout@v7' },\n    ...project.ciSetupSteps,\n    { name: 'Integration tests', run: 'mvn -B verify -Pcontainer-its' },\n  ],\n});\n```\n\n## Common options\n\nCDK project types (`CdkInfraProjectOptions` / `CdkAppProjectOptions`):\n\n| Option | Default | Description |\n| --- | --- | --- |\n| `name` | - (required) | Project name; must match `package.json` |\n| `cdkVersion` | `2.189.1` | AWS CDK version |\n| `gheTokenSecret` | `PROJEN_GITHUB_TOKEN` | GitHub secret holding projen's PAT |\n| `licensed` | `true` | Write a `LICENSE` |\n| `license` | `MIT` | SPDX identifier for the `LICENSE` |\n| `copyrightOwner` / `copyrightPeriod` | `Xpert Software` / current year | Named in the `LICENSE` |\n| `environments` | - (no `deploy` workflow) | Deploy targets for the `deploy` workflow; strings or `EnvironmentOptions` |\n| `ecrEcs` | - | `EcrEcsOptions` - `enabled`, `externalImageSource` (default `true`) |\n| `edgeResources` | - | Subset of `cloudfront`, `route53`, `apigateway`, `cognito`, `sqs` |\n| `database` | - (app only) | `DatabaseOptions` - `engine` (`postgres`/`mysql`/`dynamodb`, default `postgres`), `migrationTool` |\n| `appEntryPoint` | `src/app.ts` (app only) | Path of the generated application entrypoint |\n\nJava project types (`JavaMavenProjectOptions` and everything built on it - `JavaLibraryProjectOptions`, `JavaAppProjectOptions`, `JavaSpringBootProjectOptions`, `JavaServiceProjectOptions`):\n\n| Option | Default | Description |\n| --- | --- | --- |\n| `name` | - (required) | Project name |\n| `groupId` | - (required) | Maven group id |\n| `artifactId` | - (required) | Maven artifact id (of the reactor parent, in a multi-module project) |\n| `version` | `0.1.0` | Maven version; must be exact |\n| `description` / `url` | - | Written to the root pom |\n| `javaVersion` | `21` | Java line: `1.8`, `17`, `21`, `25` - see [Java version support](#java-version-support) |\n| `javaDistribution` | `temurin` | `actions/setup-java` distribution for CI |\n| `packaging` | `jar` | Root packaging while the project has no modules; a project with modules is always `pom` |\n| `sample` | `false` | Starter `Main` + test under the `groupId` package (single-module only) |\n| `enforcer` | `true` | `maven-enforcer-plugin` with Maven and Java version rules |\n| `minMavenVersion` | `3.9` | The enforcer's `requireMavenVersion` minimum |\n| `pluginVersions` | - | Exact-version overrides for this package's defaults, keyed by `groupId/artifactId` |\n| `licensed` | `true` | Write a `LICENSE` |\n| `license` | `MIT` | SPDX identifier for the `LICENSE` |\n| `copyrightOwner` / `copyrightPeriod` | `Xpert Software` / current year | Named in the `LICENSE` |\n| `editorconfig` | `true` | Write a projen-managed `.editorconfig` (also on the CDK and action types) |\n| `upgradeWorkflow` | `true` | Generate the nightly update report (`upgrade.yml`) |\n| `sonarProjectKey` | - | SonarQube project key; the sonar step is skipped when unset |\n| `gheTokenSecret` | `PROJEN_GITHUB_TOKEN` | GitHub secret holding projen's PAT |\n| `springBootVersion` | newest Boot for `javaVersion` (Spring Boot types only) | Exact Spring Boot version: the BOM and `spring-boot-maven-plugin` |\n| `cdkDeployTargetRepo` | - (service only; `deploy-cdk.yml` fails until set) | Companion CDK repo (`owner/repo`) whose `deploy.yml` the deploy hook dispatches |\n| `cdkDeployHook` | `true` (service only) | Whether to generate `deploy-cdk.yml` at all |\n| `dockerRegistry` | `docker.io` (service only) | Registry the Docker image is pushed to |\n| `useFlyway` | `true` (service only) | Flyway plugin/dependency + `V1__init.sql` |\n\nWith the default MIT license, the generated `LICENSE` looks like:\n\n```\nMIT License\n\nCopyright (c) 2024-2026 Xpert Software\n\nPermission is hereby granted, ...\n```\n\nThe header line (`MIT License`) is specific to the license type — an `Apache-2.0` project would instead show `Apache-2.0`.\n\nOverride the license type and copyright fields:\n\n```typescript\nnew JavaMavenProject({\n  name: 'my-lib',\n  groupId: 'org.xpertss',\n  artifactId: 'my-lib',\n  license: 'Apache-2.0',            // any SPDX id projen ships a template for\n  copyrightOwner: 'Xpert Software',\n  copyrightPeriod: '2024-2026',\n});\n```\n\n`EnvironmentOptions` for deploy targets:\n\n```text\ninterface EnvironmentOptions {\n  readonly name: string;              // e.g. \"dev\", \"stage\", \"prod\"\n  readonly accountId?: string;        // AWS account id (CDK deploys)\n  readonly region?: string;           // AWS region (CDK deploys)\n  readonly requiresApproval?: boolean; // GitHub Environment approval gate (default false)\n}\n```\n\nPlain strings (`'dev'`) are shorthand for `{ name: 'dev' }`.\n\n`GitHubActionProjectOptions`:\n\n| Option | Default | Description |\n| --- | --- | --- |\n| `name` | - (required) | Project name |\n| `description` | - | One-line description; used in the default README template and recorded in the private `package.json` |\n| `sonarHostUrl` | - (required) | URL of your SonarCloud instance (e.g. `https://sonarcloud.io`); must be reachable from github.com-hosted runners |\n| `sonarOrganization` | `xpertss` | SonarCloud org key (`sonar.organization`); required by the Scanner CLI, not derived from the token |\n| `sonarTokenSecret` | `SONAR_TOKEN` | GitHub secret holding the Sonar token |\n| `sonarPullRequestGate` | `true` | Whether `sonar.yml` also runs on `pull_request` as a pass/fail gate |\n| `dogfood` | - (a `test-dogfood.yml` that fails until you declare one) | `ActionDogfoodOptions` - the scenario that exercises the action end-to-end via `uses: ./` |\n| `license` | `MIT` | SPDX identifier for the generated `LICENSE` |\n| `copyrightOwner` / `copyrightPeriod` | `Xpert Software` / current year | Named in the `LICENSE` |\n| `gheTokenSecret` | `PROJEN_GITHUB_TOKEN` | GitHub secret holding projen's PAT (drift-check PR comments); a dogfood that passes a `token` input must reference this secret in the step's `inputs` |\n\n`ActionDogfoodOptions`/`ActionDogfoodStep` - the dogfood scenario (`test-dogfood.yml`):\n\n```text\ninterface ActionDogfoodOptions {\n  readonly scenario: ActionDogfoodStep[]; // one or more, run in order - required\n  readonly cleanup: string[];             // shared, run once at the end with `if: always()` - required\n}\n\ninterface ActionDogfoodStep {\n  readonly name: string;                    // labels this step-group's generated workflow steps\n  readonly id?: string;                     // step id for the `uses: ./` call; default: a slug of `name`\n  readonly fixtureSteps?: string[];         // shell, before the invocation (default: none)\n  readonly inputs?: Record<string, string>; // `with:` for this invocation (default: none)\n   readonly assertions: string[];            // shell, after the invocation - required; the step runs under set -euo pipefail so any failing line fails the job\n}\n```\n\nMost actions need exactly one `scenario` step. Actions with a re-run/no-op/idempotency behavior to verify (e.g. `auto-commit`'s no-op-on-no-change path, `create-pull-request`'s reuse-the-PR path) declare two - the second typically omits `fixtureSteps` so its invocation sees no new state, and its assertion checks the opposite outcome of the first. Reference an invocation's own outputs from a later assertion via `${{ steps.<id>.outputs.<name> }}`, using either the default slug or an explicit `id`.\n\n## Required GitHub secrets\n\n| Secret | Used by | Notes |\n| --- | --- | --- |\n| `PROJEN_GITHUB_TOKEN` | all types | PAT for projen's self-mutation/automation; override via `gheTokenSecret` |\n| `SONAR_TOKEN` | Java types with `sonarProjectKey`; `GitHubActionProject` | SonarQube scan step in `build.yml` / `sonar.yml`; override via `sonarTokenSecret` on `GitHubActionProject` |\n| `DOCKER_USERNAME` / `DOCKER_PASSWORD` | `JavaServiceProject` | Docker image push |\n| `MAVEN_GPG_PRIVATE_KEY`, `MAVEN_GPG_PASSPHRASE`, `MAVEN_CENTRAL_USERNAME`, `MAVEN_CENTRAL_PASSWORD` | `JavaLibraryProject` without `mavenCentralOidc` | Not needed with OIDC trusted publishing |\n\n## Customizing `.gitignore`\n\nEvery project type already ignores JetBrains IDE state (`/.idea/*`) and the `/spec/` directory with all of its subdirectories (local plans and specs, never committed). The Java types also ignore Maven `target/` output and Eclipse files. To ignore more, call the inherited `addGitIgnore()` method after constructing the project in your `.projenrc.ts`:\n\n```typescript\n// .projenrc.ts\nimport { CdkInfraProject } from '@xpertss/projen-types';\n\nconst project = new CdkInfraProject({\n  name: 'my-infra',\n});\n\nproject.addGitIgnore('*.log');\nproject.addGitIgnore('.env.*');\nproject.addGitIgnore('/build/');\n\nproject.synth();\n```\n\nThe same works for every type - just swap the class (e.g. `JavaServiceProject`, `GitHubActionProject`). Each call takes one standard gitignore glob pattern. There is no `gitignore` constructor option: the project types' option interfaces do not expose one, so patterns go through `addGitIgnore()` instead.\n\nRe-run `npx projen` after editing - `.gitignore` is a generated file, so hand-editing it is caught by the drift check.\n\n## Troubleshooting\n\n**`Unable to find projen project. Use \"projen new\" to create a new project.`**\nIf the directory already has a `.projenrc.ts`, this error means the rc has\nnever been synthesized (there's no `.projen/tasks.json`), not that you need a\nnew project. See [Starting from an existing `.projenrc.ts`](#starting-from-an-existing-projenrcts).\n\n## Going further\n\nThe project types are composed from smaller components you can also attach to your own projects:\n\n| Component | Applies to | Purpose |\n| --- | --- | --- |\n| `AppRuntimeScaffold` | `NodeProject` | App source skeleton (`app.ts` + handlers) |\n| `DatabaseComponent` | `NodeProject` | Database construct stub + migration tool wiring |\n| `EcrEcsConstructs` | `Project` | ECR + Fargate ECS construct helper |\n| `EdgeNetworkingConstructs` | `Project` | Per-resource edge networking construct helpers |\n| `MavenPom` | `Project` | A `pom.xml` with modules, BOM imports, dependency/plugin management, and exact versions only |\n| `MavenModule` | `JavaMavenProject` | One module of a reactor (created by `addModule()`) |\n| `MavenUpgradeReport` | `GitHubProject` | Nightly report-only `upgrade.yml` |\n| `MavenCentralPublish` | `JavaMavenProject` | Manual-dispatch Maven Central publish workflow |\n| `DockerPublish` | `JavaMavenProject` | Manual-dispatch Docker build+push workflow |\n| `GitHubPackagesPublish` | `JavaMavenProject` | Manual-dispatch GitHub Packages publish workflow |\n| `FlywayMigration` | `JavaSpringBootProject` | Flyway plugin/dependency + migrations directory |\n| `CdkDeployHook` | `JavaMavenProject` | Manual-dispatch workflow that triggers `deploy.yml` in a companion CDK repo |\n| `CodeIndexWorkflow` | `JavaMavenProject` | Code index generation on push to `main` |\n| `ActionBuildWorkflow` | `GitHubProject` | The `lint` task (shellcheck/yamllint/pinned actionlint) + `build.yml` |\n| `ActionDogfoodWorkflow` | `GitHubProject` | `test-dogfood.yml` from an `ActionDogfoodOptions` scenario |\n| `ActionSonarWorkflow` | `GitHubProject` | `sonar.yml` (SonarCloud scan via the Scanner CLI) |\n\nExample - adding a Docker publish to a `JavaMavenProject` (`JavaServiceProject` is the packaged version of this, with Spring Boot):\n\n```typescript\nimport { DockerPublish, JavaMavenProject } from '@xpertss/projen-types';\n\nconst project = new JavaMavenProject({\n  name: 'my-service',\n  groupId: 'org.xpertss',\n  artifactId: 'my-service',\n});\n\nnew DockerPublish(project, { dockerRegistry: 'ghcr.io' });\n\nproject.synth();\n```\n\nThe full API reference, including every option and property, is in [API.md](./API.md).\n"
+    "markdown": "# @xpertss/projen-types\n\nProjen project types for CDK/TypeScript and Java/Maven projects.\n\nInstead of hand-maintaining `pom.xml`, `cdk.json`, and GitHub workflows, you declare a project type in a `.projenrc.ts` file and let [projen](https://github.com/projen/projen) generate (and keep up to date) the whole scaffold: build files, source skeletons, CI workflows, and deploy pipelines.\n\n## Project types at a glance\n\n| Type | What it is | Publishes to | Generated workflows |\n| --- | --- | --- | --- |\n| `CdkInfraProject` | Pure-infrastructure CDK stacks (CloudFront, Route53, SQS, API Gateway, Cognito, ECR/ECS for externally-built images) | - | `build` (PR checks), `deploy` (manual dispatch) |\n| `CdkAppProject` | Full TypeScript service behind API Gateway: infra + app source + database | - | `build`, `deploy`, `app-build` (PR checks) |\n| `JavaMavenProject` | Plain Maven project, single- or multi-module, no framework | - | `build`, `upgrade` (nightly report) |\n| `JavaLibraryProject` | Reusable Java library | Maven Central | `build`, `upgrade` (nightly report), `publish-maven-central`, `codeindex` |\n| `JavaAppProject` | GUI/TUI/CLI Java application | GitHub Packages | `build`, `upgrade` (nightly report), `publish-ghpackages` |\n| `JavaSpringBootProject` | Spring Boot on Maven, single- or multi-module, **no Docker** | - | `build`, `upgrade` (nightly report) |\n| `JavaServiceProject` | Spring Boot service deployed as a container | Docker Hub | `build`, `upgrade` (nightly report), `publish-docker`, `deploy-cdk` |\n| `GitHubActionProject` | Reusable GitHub Action or Workflow | GitHub Releases | `build`, `test-dogfood`, `sonar`, `release` |\n\nThe Java types are layered, so pick the lowest layer that does what you need:\n\n```text\nJavaMavenProject            java_maven         Maven only; single- or multi-module; any supported Java line\n├── JavaLibraryProject      java_library       + Maven Central publish, source/javadoc jars, code index\n├── JavaAppProject          java_app           + GitHub Packages publish\n└── JavaSpringBootProject   java_spring_boot   + Spring Boot BOM and executable-jar repackaging; no Docker/Flyway/CDK\n    └── JavaServiceProject  java_service       + Docker publish, Flyway, CDK deploy hook (single-module)\n```\n\nEvery Java type targets a configurable Java line (`javaVersion`: `1.8`, `17`, `21` or `25`; see [Java version support](#java-version-support)), and every one except `JavaServiceProject` can be a multi-module Maven reactor (see [JavaMavenProject](#javamavenproject)).\n\nOne foundation class is also exported for advanced use: `CdkTypescriptProject` (shared CDK + TypeScript base for the CDK types).\n\nAll project types:\n\n- run a **drift check** in PR builds - a job that re-runs projen and fails if generated files were hand-edited. Edit `.projenrc.ts`, then run `npx projen`; never edit generated files directly.\n- use the GitHub secret `PROJEN_GITHUB_TOKEN` (a fine-grained PAT) for projen's automation. Override with `gheTokenSecret`.\n- make all publishing/deploying **manual** (workflow_dispatch) rather than on every merge.\n- offer an opt-in SonarCloud scan (`sonar.yml`) on any type via `sonarHostUrl` (see [SonarCloud (opt-in)](#sonarcloud-opt-in)).\n\n## Getting started\n\nHow you start depends on what is already in the directory:\n\n| Starting point | Do this |\n| --- | --- |\n| Empty directory | `projen new --from` (below) |\n| Existing repo, no `.projenrc.ts` | `projen new --from ... --no-git` (below) |\n| A `.projenrc.ts` but no `.projen/` directory - copied from another repo, or one of the [examples](#examples) pasted into a fresh repo | [Starting from an existing `.projenrc.ts`](#starting-from-an-existing-projenrcts) |\n\nScaffold the repo with projen's own bootstrap, pointed at this package:\n\n```bash\nmkdir my-project && cd my-project\ngit init\nnpx projen new --from @xpertss/projen-types cdk_infra --name my-project\n```\n\nThat writes a starter `.projenrc.ts`, synthesizes the whole scaffold and\ninstalls dependencies. The type names `projen new` accepts are `cdk_infra`,\n`cdk_app`, `java_maven`, `java_library`, `java_app`, `java_spring_boot`,\n`java_service` and `git_hub_action`; pass a bogus one to have it list them.\nRequired options become flags: `--name` for every type, plus\n`--group-id`/`--artifact-id` (Java). Any other plainly-typed option can be\npassed the same way - `--sonar-host-url` (opt-in Sonar, all types),\n`--java-version 1.8`, `--cdk-deploy-target-repo owner/repo`,\n`--docker-registry ghcr.io`, `--no-use-flyway`, and so on. Modules can't be\npassed on the command line; add them to `.projenrc.ts` afterwards (see\n[JavaMavenProject](#javamavenproject)).\n\n**Adding projen to a repo that already has content.** `projen new` runs\n`git init` and commits the scaffold by default. In a repo with existing work,\npass `--no-git` so it writes the files and leaves committing to you:\n\n```bash\ncd existing-repo\nnpx projen new --from @xpertss/projen-types java_spring_boot --name obeya --group-id org.xpertss.obeya --artifact-id obeya-parent --no-git\n```\n\n**Commit a lockfile.** The generated `build.yml` and drift check install the\ntoolchain with `npm ci`, which needs a committed `package-lock.json`, and\n`projen new` doesn't always leave one behind. Run `npm install` once and\ncommit `package-lock.json` along with the scaffold. Without it those\nworkflows fail with an `::error::` that says exactly this. For the Java\ntypes, `package.json` is generated, and it pins `projen` and\n`@xpertss/projen-types` to **exact** versions (no `^`), so every machine and\nCI run uses the same generator. A floating range would make the drift check\nreport the differences between generator versions as drift.\n\nCommit the result. From then on, every change to the scaffold goes through\n`.projenrc.ts` followed by `npx projen`:\n\n```bash\nnpx projen\n```\n\nEvery type scaffolds from that one command; no option is *required* that\n`projen new` cannot pass. The structured options - `environments` and\n`GitHubActionProject`'s `dogfood` - are ones projen's CLI cannot render\ninto a projenrc, so they are added afterwards by editing `.projenrc.ts` and\nre-running `npx projen`. Leaving `environments` out simply generates no\ndeploy workflow; leaving `dogfood` out (or a service's\n`cdkDeployTargetRepo`) still generates the workflow, with one step that\nfails and tells you what to add - a gate this package considers load-bearing\nis allowed to be missing loudly, never silently.\n\nThe `name` option must match the `name` field in the project's `package.json` (for the CDK types). For the Java types it becomes the root pom's `<name>` and the generated `package.json` name.\n\n> **Never write projen's generated-file marker text literally in `.projenrc.ts`.** projen deletes, as an orphaned generated file, any file containing the marker line (`~~ Generated by projen. To modify, ...`), and that includes `.projenrc.ts` itself. When you generate a file yourself (for example with `TextFile`), insert the marker through the file's `marker` property: ``file.addLine(`# ${file.marker}`)``.\n\n## Starting from an existing `.projenrc.ts`\n\nA directory that has a `.projenrc.ts` but no `.projen/` directory has never\nbeen synthesized. This happens when you copy the rc from another repo, or paste\none of the [examples](#examples) into a fresh repo. In that state `npx projen`\nfails with:\n\n```\n👾 Unable to find projen project. Use \"projen new\" to create a new project.\n```\n\n`npx projen` doesn't run `.projenrc.ts` itself. It runs the `default` task\nlisted in `.projen/tasks.json`, and that file is written by the first synth.\nDo the first synth one of these two ways. After that, `npx projen` works as\nusual.\n\n**Option 1 (recommended): run `projen new` over the existing rc.** `projen\nnew` leaves an existing `.projenrc.ts` untouched and writes the rest of the\nscaffold, `.projen/` included. Pass the type and its required flags as you\nwould for a new repo. Their values don't have to match your rc, because the\n`npx projen` that follows re-synthesizes everything from the rc:\n\n```bash\nnpx projen new --from @xpertss/projen-types git_hub_action --name pull-request --sonar-host-url https://sonarcloud.io --no-git\nnpx projen\n```\n\nThe first command's output reflects only the flags. For example, a\n`GitHubActionProject`'s `test-dogfood.yml` is still the failing placeholder.\nThe second command applies everything in the rc (`dogfood`, `environments`,\nmodules, and so on).\n\n**Option 2 (Java types and `GitHubActionProject`): run the rc directly,\nonce.** The CDK types run their rc differently, so for those use option 1.\nInstall what the rc imports, give\nts-node a placeholder `tsconfig.projen.json` (the synth overwrites it with the\ngenerated one), and run the same command the generated `default` task runs:\n\n```bash\nnpm i -D projen @xpertss/projen-types constructs\necho '{}' > tsconfig.projen.json\nnpx -y -p ts-node@10.9.2 -p typescript@6.0.3 ts-node --project tsconfig.projen.json .projenrc.ts\nnpx projen\n```\n\nThe `echo` line works in bash and PowerShell. Don't drop `--project`: without\na tsconfig, ts-node fails on Node 22+ with `Unknown file extension \".ts\"`.\n\nEither way, commit `.projen/` along with the rest of the scaffold. A fresh\nclone then has its `tasks.json`, and `npx projen` works there straight away.\n\n## Updating an existing project when this package changes\n\nYour generated scaffold reflects the *installed* version of `@xpertss/projen-types` - `npx projen` reads your project type from the package in `node_modules`, not from this repository. So when this package ships a change (a bug fix, a new generated file, or altered workflow behavior), an existing project picks it up by bumping the dependency and re-synthesizing. A stale `node_modules` silently regenerates with the old behavior, so the bump is the load-bearing step.\n\nUsing the [`auto-commit` action](#githubactionproject) as a running example, say a new release adds the `# Purpose:` workflow header and SonarCloud wording. In the `auto-commit` repo:\n\n```bash\nnpm view @xpertss/projen-types version        # what's the newest release?\nnpm i -D @xpertss/projen-types@latest         # bump the installed project type\nnpx projen                                    # re-synthesize every generated file\ngit diff                                      # review before committing\n```\n\nThe diff here is the workflows gaining a `# Purpose:` comment and `sonar.yml` reflecting the SonarCloud wording. Commit the result with a normal `chore:` or `fix:` message - you never hand-edit the generated files themselves.\n\n## Examples\n\nEach example shows the `projen new` command first, then a fuller\n`.projenrc.ts`. Run the command first, then replace the generated\n`.projenrc.ts` with the example (or merge it in) and run `npx projen`. If you\npasted the example into a fresh repo first instead, see\n[Starting from an existing `.projenrc.ts`](#starting-from-an-existing-projenrcts).\n\n### CdkInfraProject\n\nPure infrastructure stacks with optional ECR/ECS and edge-networking constructs.\n\nScaffold it with the `cdk_infra` type:\n\n```bash\nnpx projen new --from @xpertss/projen-types cdk_infra --name media-edge-infra\n```\n\n```typescript\n// .projenrc.ts\nimport { CdkInfraProject } from '@xpertss/projen-types';\n\nconst project = new CdkInfraProject({\n  name: 'media-edge-infra',\n  environments: [\n    'dev',\n    { name: 'stage', accountId: '111111111111', region: 'eu-central-1' },\n    { name: 'prod', accountId: '222222222222', region: 'eu-central-1', requiresApproval: true },\n  ],\n  edgeResources: ['cloudfront', 'route53', 'sqs'],\n  ecrEcs: { enabled: true, externalImageSource: true },\n});\n\nproject.synth();\n```\n\nYou get:\n\n- `cdk.json`, `cdk synth` / `cdk diff` / `cdk deploy` tasks, and the standard `AwsCdkTypeScriptApp` layout (CDK 2.189.1 by default).\n- `.github/workflows/build.yml` - PR build that hard-fails on projen drift.\n- `.github/workflows/deploy.yml` - manual dispatch with one `deploy-<env>` job per environment (runs `cdk deploy --all` with `--context environment=<env>`); `requiresApproval` environments get a GitHub Environment approval gate.\n- `LICENSE` (MIT by default), `.editorconfig`, and the projen drift check.\n- `src/constructs/edge-networking.ts` - helper constructs only for the requested `edgeResources` (`cloudfront`, `route53`, `apigateway`, `cognito`, `sqs`).\n- `src/constructs/ecr-ecs.ts` when `ecrEcs.enabled` - ECR repo + Fargate service; `externalImageSource: true` (default) means the service pulls an image built outside this repo.\n\n### CdkAppProject\n\n`CdkInfraProject` plus application source, a database construct, and an app-level build workflow.\n\nScaffold it with the `cdk_app` type:\n\n```bash\nnpx projen new --from @xpertss/projen-types cdk_app --name video-api\n```\n\n```typescript\n// .projenrc.ts\nimport { CdkAppProject } from '@xpertss/projen-types';\n\nconst project = new CdkAppProject({\n  name: 'video-api',\n  environments: ['dev', 'prod'],\n  edgeResources: ['apigateway'],\n  database: { engine: 'postgres', migrationTool: 'flyway' },\n  appEntryPoint: 'src/app.ts',\n});\n\nproject.synth();\n```\n\nEverything from `CdkInfraProject`, plus:\n\n- `src/app.ts` - application entrypoint stub (`export function handler()`).\n- `src/handlers/example.ts` - API Gateway proxy handler stub, with `@types/aws-lambda` added as a dev dependency.\n- `src/constructs/database.ts` - a `Database` construct stub for the chosen engine (`postgres`/`mysql` -> RDS, `dynamodb` -> DynamoDB). `migrationTool` (no default, intentionally) is added as a dev dependency and referenced in the stub - wiring it up is left to you.\n- `.github/workflows/app-build.yml` - runs the project's test task on every PR, then checks for projen drift.\n\n### JavaMavenProject\n\nA plain Maven build with no framework and no publish target. It's the base of every other Java type, and it's usable on its own. It's single-module until you add a module, then it's a multi-module reactor.\n\nScaffold it with the `java_maven` type:\n\n```bash\nnpx projen new --from @xpertss/projen-types java_maven --name legacy-tools --group-id org.xpertss --artifact-id legacy-tools --java-version 1.8\n```\n\n**Single module:**\n\n```typescript\n// .projenrc.ts\nimport { JavaMavenProject } from '@xpertss/projen-types';\n\nconst project = new JavaMavenProject({\n  name: 'legacy-tools',\n  groupId: 'org.xpertss',\n  artifactId: 'legacy-tools',\n  javaVersion: '1.8',\n});\n\nproject.addDependency('commons-io/commons-io@2.20.0');    // exact version\nproject.addTestDependency('org.assertj/assertj-core@3.27.3');\n\nproject.synth();\n```\n\n**Multi-module:** each `addModule()` call adds a module directory with its own generated `pom.xml`. The root pom becomes the `pom`-packaged reactor parent. Everything stays one projen project, with one `.projen/`, one `.gitignore` and one `tasks.json`.\n\n```typescript\n// .projenrc.ts\nimport { JavaMavenProject } from '@xpertss/projen-types';\n\nconst project = new JavaMavenProject({\n  name: 'toolkit',\n  groupId: 'org.xpertss.toolkit',\n  artifactId: 'toolkit-parent',\n  version: '0.1.0-SNAPSHOT',\n  javaVersion: '17',\n});\n\nconst model = project.addModule({ dir: 'toolkit-model', artifactId: 'toolkit-model', description: 'Domain model' });\nconst stub = project.addModule({ dir: 'tools/stub-model', artifactId: 'toolkit-stub-model' }); // nested dirs are fine\nconst cli = project.addModule({ dir: 'toolkit-cli', artifactId: 'toolkit-cli' });\n\nstub.addModuleDependency(model);                     // sibling module: versionless\ncli.addModuleDependency(model);\ncli.addDependency('info.picocli/picocli@4.7.7');     // pinned: the version moves to the parent\ncli.addDependency('org.yaml/snakeyaml');             // versionless: managed below\nproject.addManagedDependency('org.yaml/snakeyaml@2.4');\nproject.addBom('org.testcontainers/testcontainers-bom@1.21.3');\n\nproject.synth();\n```\n\nWhat the reactor looks like:\n\n- **Root `pom.xml`:**\n  - `<packaging>pom</packaging>`, with `<modules>` in `addModule` order.\n  - `<dependencyManagement>` holds the BOM imports first (`type=pom`, `scope=import`), then every module at `${project.version}`, then every pinned version.\n  - `<pluginManagement>` holds the plugin versions, and versionless `<plugins>` are inherited by every module: compiler, surefire, failsafe, jar, and enforcer.\n  - `junit-jupiter` is a test dependency every module inherits. Its version comes from `junit-bom`, or from the Spring Boot BOM in the Spring Boot types.\n- **Module `pom.xml`:** `<parent>` with the right `relativePath` (`tools/stub-model` → `../../pom.xml`), then `artifactId`, `name`, `description`, and versionless `<dependencies>`. Nothing else, unless the module adds plugins.\n- A version given to `module.addDependency`/`addTestDependency`/`addPlugin` is moved into the parent's `<dependencyManagement>`/`<pluginManagement>`, so every module that uses an artifact gets the same version. Pinning one artifact at two different versions fails the synth.\n- The synth fails with a clear message on:\n  - two modules with the same `artifactId`\n  - two modules with the same `dir`, or one `dir` nested inside another\n  - a `dir` outside the repo\n  - a module depending on itself\n  - `packaging` set to anything but `pom` on a project with modules\n\nYou get:\n\n- the root `pom.xml` (and one per module), written by this package:\n  - **exact versions only**: a range such as `^1`, `~1.2` or `[1,2)` fails the synth\n  - the compiler level, enforcer rule and JUnit line all follow `javaVersion`\n- one Maven run per build. `npx projen build` synthesizes, then runs `mvn -B verify`: compile, unit tests (surefire), package, and `*IT` integration tests (failsafe). There is no `mvn deploy` and no `dist/`.\n- `.github/workflows/build.yml`: a PR build that installs the pinned Node toolchain (`npm ci`) and the project's JDK (`actions/setup-java`, Maven cache), then runs `npx projen build`. The Maven build itself never runs a Sonar step - SonarCloud scanning is a separate, opt-in `sonar.yml` (set `sonarHostUrl`). See [Adding CI jobs](#adding-ci-jobs-to-a-java-project) and [SonarCloud (opt-in)](#sonarcloud-opt-in).\n- `.github/workflows/upgrade.yml`: a nightly (03:00 UTC) **report** of available dependency and plugin updates in the job summary. It changes nothing, because every version comes from `.projenrc.ts`; apply an update there. Turn it off with `upgradeWorkflow: false`. The same report runs locally with `npx projen upgrade`.\n- the projen drift check, `LICENSE` (MIT by default), `.editorconfig`, and a generated `package.json` that pins the projen toolchain exactly.\n- no sample code, unless `sample: true` on a single-module project.\n\n### JavaLibraryProject\n\nA reusable Java library published to Maven Central.\n\nScaffold it with the `java_library` type:\n\n```bash\nnpx projen new --from @xpertss/projen-types java_library --name common-utils --group-id org.xpertss --artifact-id common-utils\n```\n\n```typescript\n// .projenrc.ts\nimport { JavaLibraryProject } from '@xpertss/projen-types';\n\nconst project = new JavaLibraryProject({\n  name: 'common-utils',\n  groupId: 'org.xpertss',\n  artifactId: 'common-utils',\n  version: '1.0.0',\n  sonarHostUrl: 'https://sonarcloud.io',   // opt-in: adds sonar.yml (see SonarCloud)\n  mavenCentralOidc: true,\n});\n\nproject.synth();\n```\n\nYou get everything from [`JavaMavenProject`](#javamavenproject), so modules work here too, plus:\n\n- `maven-source-plugin` and `maven-javadoc-plugin`, attaching the `-sources`/`-javadoc` jars Maven Central requires. In a multi-module library every module attaches them.\n- `.github/workflows/publish-maven-central.yml` - manual dispatch running `mvn -B deploy -P release`. With `mavenCentralOidc: true` it uses Maven Central's OIDC trusted publishing (no GPG secrets needed); otherwise it expects the secrets `MAVEN_GPG_PRIVATE_KEY`, `MAVEN_GPG_PASSPHRASE`, `MAVEN_CENTRAL_USERNAME`, `MAVEN_CENTRAL_PASSWORD`.\n- `.github/workflows/codeindex.yml` - on push to `main`, generates a Java source index under `.cai/` covering every module (disable with `publishCodeIndex: false`).\n\n### JavaSpringBootProject\n\nSpring Boot on Maven, single- or multi-module, **without** Docker, Flyway or a deploy hook. It's [`JavaMavenProject`](#javamavenproject) plus Spring Boot dependency management. Use it for a Spring Boot repo that ships something other than this package's container image, such as a multi-module control plane, or for a Boot app you deploy your own way.\n\nScaffold it with the `java_spring_boot` type:\n\n```bash\nnpx projen new --from @xpertss/projen-types java_spring_boot --name obeya --group-id org.xpertss.obeya --artifact-id obeya-parent\n```\n\n```typescript\n// .projenrc.ts\nimport { JavaSpringBootProject } from '@xpertss/projen-types';\n\nconst project = new JavaSpringBootProject({\n  name: 'obeya',\n  groupId: 'org.xpertss.obeya',\n  artifactId: 'obeya-parent',\n  version: '0.1.0-SNAPSHOT',\n  javaVersion: '21',\n  copyrightOwner: 'Xpert Software',\n});\n\n// plain jar modules: shared libraries, clients, tools\nconst model = project.addModule({ dir: 'obeya-model', artifactId: 'obeya-model' });\nconst client = project.addModule({ dir: 'obeya-api-client', artifactId: 'obeya-api-client' });\nclient.addModuleDependency(model);\n\n// a Spring Boot application module, repackaged into an executable jar\nconst server = project.addSpringBootModule({ dir: 'obeya-server', artifactId: 'obeya-server' });\nserver.addModuleDependency(model);\nserver.addDependency('org.springframework.boot/spring-boot-starter-web');      // versionless: Boot's BOM manages it\nserver.addTestDependency('org.springframework.boot/spring-boot-starter-test');\n\nproject.addBom('org.testcontainers/testcontainers-bom@1.21.3');\n\nproject.synth();\n```\n\nYou get everything from [`JavaMavenProject`](#javamavenproject), plus:\n\n- `spring-boot-dependencies` imported as the **first** BOM, so starters and every library Boot manages (JUnit included) are added without a version. `springBootVersion` sets it; the default is the newest release of the line that supports `javaVersion` (see [Java version support](#java-version-support)).\n- `spring-boot-maven-plugin`, versioned in `<pluginManagement>`:\n  - In a **single-module** project the root jar is repackaged into an executable jar.\n  - In a **multi-module** project only modules added with `addSpringBootModule()` are repackaged; `addModule()` modules stay plain jars.\n  - A repackaged module needs its `@SpringBootApplication` class before `mvn verify` passes, because `repackage` fails with `Unable to find main class` until one exists. Add a module as a plain `addModule()` while it's still empty.\n- failsafe configured to run integration tests against the compiled classes rather than the repackaged jar (as `spring-boot-starter-parent` does).\n- no starters, no Docker, no Flyway, no CDK. Add the starters you need with `addDependency`.\n\n### JavaServiceProject\n\nA Spring Boot service that publishes a Docker image and can trigger deploys in a companion CDK repo. It is [`JavaSpringBootProject`](#javaspringbootproject) plus Docker, Flyway and a deploy hook. It is **single-module**, because the Docker build, the migrations and the deploy hook all assume one deployable at the repo root; `addModule()` fails and points you to `JavaSpringBootProject`.\n\nScaffold it with the `java_service` type:\n\n```bash\nnpx projen new --from @xpertss/projen-types java_service --name stream-processor --group-id org.xpertss --artifact-id stream-processor\n```\n\n```typescript\n// .projenrc.ts\nimport { JavaServiceProject } from '@xpertss/projen-types';\n\nconst project = new JavaServiceProject({\n  name: 'stream-processor',\n  groupId: 'org.xpertss',\n  artifactId: 'stream-processor',\n  dockerRegistry: 'docker.io/xpertss',\n  cdkDeployTargetRepo: 'xpertss/stream-infra',\n  environments: ['dev', { name: 'prod', requiresApproval: true }],\n});\n\nproject.synth();\n```\n\nYou get everything from [`JavaSpringBootProject`](#javaspringbootproject) (and so from `JavaMavenProject`), plus:\n\n- `spring-boot-starter-web` added to the pom (versionless; Boot's BOM manages it).\n- `.github/workflows/publish-docker.yml` - manual dispatch: `mvn -B package && docker build -t <registry>/<name>:<sha>`, logged in with the `DOCKER_USERNAME` / `DOCKER_PASSWORD` secrets. `dockerRegistry` defaults to `docker.io`.\n- Flyway wiring when `useFlyway` (default `true`): `flyway-core` (versionless, so it matches what Boot's Flyway auto-configuration expects), `flyway-maven-plugin` pinned for the Java line, and `src/main/resources/db/migration/V1__init.sql`.\n- `.github/workflows/deploy-cdk.yml` (the `CdkDeployHook`, generated by default) - manual dispatch with an environment selector; each job sends a `workflow_dispatch` to `deploy.yml` in the companion `cdkDeployTargetRepo` (a `CdkInfraProject`/`CdkAppProject` repo). With no `cdkDeployTargetRepo` set, the workflow is still generated but each job's only step fails with instructions - it is dispatch-only, so that lands on whoever tries to deploy rather than on every PR. Turn the workflow off entirely with `cdkDeployHook: false`. `environments` defaults to `['prod']`.\n\n### JavaAppProject\n\nA GUI/TUI/CLI Java application published to GitHub Packages only - no Maven Central, no Docker, no CDK deploy hook.\n\nScaffold it with the `java_app` type:\n\n```bash\nnpx projen new --from @xpertss/projen-types java_app --name studio-cli --group-id org.xpertss --artifact-id studio-cli\n```\n\n```typescript\n// .projenrc.ts\nimport { JavaAppProject } from '@xpertss/projen-types';\n\nconst project = new JavaAppProject({\n  name: 'studio-cli',\n  groupId: 'org.xpertss',\n  artifactId: 'studio-cli',\n  ghPackagesRegistry: 'https://maven.pkg.github.com/xpertss/studio-cli',\n});\n\nproject.synth();\n```\n\nYou get everything from [`JavaMavenProject`](#javamavenproject) (modules included), plus `.github/workflows/publish-ghpackages.yml` - manual dispatch running `mvn -B deploy -DaltDeploymentRepository=github::<registry>`, authenticated with `GITHUB_TOKEN`. `ghPackagesRegistry` defaults to `https://maven.pkg.github.com/<repo>` derived from the repository URL.\n\n### GitHubActionProject\n\nA reusable GitHub Action or Workflow. This example scaffolds an action that stages a folder and, only if it changed, commits and pushes it.\n\nScaffold it with the `git_hub_action` type:\n\n```bash\nnpx projen new --from @xpertss/projen-types git_hub_action --name auto-commit --sonar-host-url https://sonarcloud.io\n```\n\n```typescript\n// .projenrc.ts\nimport { GitHubActionProject } from '@xpertss/projen-types';\n\nconst project = new GitHubActionProject({\n  name: 'auto-commit',\n  description: 'Stage a folder and, only if it changed, commit and push it',\n  sonarHostUrl: 'https://sonarcloud.io',       // optional - set it to add sonar.yml (see SonarCloud)\n  sonarOrganization: 'xpertss',                 // default - your SonarCloud org key\n  dogfood: {\n    // Two scenario steps: the \"changed\" path and the \"no-op\" path are both\n    // load-bearing behavior for this action (a double-commit or a\n    // push-when-empty bug is the failure mode a hand-rolled inline-shell\n    // alternative is most likely to introduce).\n    scenario: [\n      {\n        name: 'Changed path',\n        fixtureSteps: [\n          'echo \"$(date -u +%Y%m%dT%H%M%SZ)\" >> test/fixtures/dogfood-state.txt',\n        ],\n        inputs: {\n          commit_message: 'test: dogfood',\n          branches: 'test/dogfood',\n        },\n        assertions: [\n          // step id defaults to a slug of `name` - here \"changed-path-0\"\n          '[ \"${{ steps.changed-path-0.outputs.committed }}\" = \"true\" ]',\n        ],\n      },\n      {\n        // No fixture change this time - nothing new to commit.\n        name: 'No-op path',\n        id: 'no-op-check',            // pin an explicit id instead of relying on the default slug\n        inputs: {\n          commit_message: 'test: dogfood',\n          branches: 'test/dogfood',\n        },\n        assertions: [\n          '[ \"${{ steps.no-op-check.outputs.committed }}\" = \"false\" ]',\n        ],\n      },\n    ],\n    cleanup: [\n      'git push origin --delete test/dogfood || true',\n    ],\n  },\n});\n\nproject.synth();\n```\n\nYou get:\n\n- `action.yml` and `auto-commit.sh` are hand-written - this type only lints their content via `build.yml`'s shellcheck/yamllint/actionlint checks.\n- `.github/workflows/build.yml` - lint gate: `apt`-installed shellcheck/yamllint plus a pinned, SHA-256-verified `actionlint` release binary. Gates `main` (alongside `sonar.yml` when Sonar is enabled).\n- `.github/workflows/test-dogfood.yml` - runs the `dogfood.scenario` steps above against this repo's own `action.yml` (via `uses: ./`), then the shared `cleanup`, on `workflow_dispatch`, every `pull_request`, and nightly. Omit `dogfood` and the workflow still exists, with one step that fails on every PR until you declare a scenario - AD-001 allows a dogfood to be missing loudly, never silently. A *partial* `dogfood` (a scenario with no cleanup) is a synth error.\n- `.github/workflows/sonar.yml` - SonarCloud scan via the Scanner CLI (the quality gate blocks the PR), scanning `action.yml`/`.github/workflows/**`/`**/*.sh` explicitly. Opt-in: generated only when `sonarHostUrl` is set (see [SonarCloud (opt-in)](#sonarcloud-opt-in)).\n- `.github/workflows/release.yml` - `feat:`/`fix:` commits on `main` bump the version, tag `vX.Y.Z`, and create a GitHub Release.\n- `.github/workflows/projen-drift-check.yml` and `workflow-change-notice.yml` - drift detection and a change notice, always included.\n- `package.json` (**private**, version source only), `.yamllint`, `LICENSE` (MIT by default), and a `README.md` template - all regenerated by `npx projen`.\n\nNeeds `PROJEN_GITHUB_TOKEN` (used for automated PR comments), and `SONAR_TOKEN` only when Sonar is enabled (see [SonarCloud (opt-in)](#sonarcloud-opt-in)). Onboard a brand-new action repo by running the `projen new` command above first (see [Getting started](#getting-started)), then replace the generated `.projenrc.ts` with the one above and run `npx projen`, then hand-write `action.yml`/`auto-commit.sh`/`test/fixtures/`. If you wrote the `.projenrc.ts` before running `projen new`, see [Starting from an existing `.projenrc.ts`](#starting-from-an-existing-projenrcts).\n\n## Java version support\n\n`javaVersion` picks the Java line a Java project targets. It defaults to `21`; the supported lines are `1.8` (alias `8`), `17`, `21` and `25`, and any other value fails the synth with that list. **Nothing in the generated build is hard-coded to one Java line.** Everything that depends on it comes from one table in this package, grouped by line:\n\n| | `1.8` | `17` | `21` | `25` |\n| --- | --- | --- | --- | --- |\n| Compiler level | `maven.compiler.source`/`target` = `1.8` (javac 8 has no `--release`) | `maven.compiler.release` = `17` | `release` = `21` | `release` = `25` |\n| Enforcer `requireJavaVersion` | `[1.8,)` | `[17,)` | `[21,)` | `[25,)` |\n| JUnit (`junit-bom`) | 5.14.4 (JUnit 6 needs Java 17) | 6.1.3 | 6.1.3 | 6.1.3 |\n| Default Spring Boot (`JavaSpringBootProject`) | 2.7.18 (Boot 3+ needs Java 17; a 3.x+ `springBootVersion` fails the synth) | 4.1.1 | 4.1.1 | 4.1.1 |\n| `flyway-maven-plugin` (`JavaServiceProject`) | 9.22.3 | 13.9.0 | 13.9.0 | 13.9.0 |\n| CI JDK (`actions/setup-java` `java-version`) | `8` | `17` | `21` | `25` |\n\nMaven plugins (the same on every line, because all of them run on JDK 8): `maven-compiler-plugin` 3.16.0, `maven-surefire-plugin`/`maven-failsafe-plugin` 3.6.0, `maven-jar-plugin` 3.5.1, `maven-enforcer-plugin` 3.6.3, `maven-source-plugin` 3.4.0 and `maven-javadoc-plugin` 3.12.0 (library only), `versions-maven-plugin` 2.22.0 (the `upgrade` report).\n\n**The enforcer.** `maven-enforcer-plugin` fails the build at the start when the JDK or Maven running it is older than the project needs. Without it you get confusing compiler errors later, or a jar built for the wrong runtime. Its Java rule always follows `javaVersion`. The Maven rule defaults to `[3.9,)`; change it with `minMavenVersion`, or drop the plugin entirely with `enforcer: false`. CI installs the matching JDK through `setup-java`, so the rule only fires on a developer machine with the wrong JDK. A Java 1.8 project builds on any newer JDK (the rule is a minimum), but the JDK 8 runtime API is guaranteed only when you build on JDK 8.\n\n**Overriding a version.** `pluginVersions` replaces any default in the table, keyed by `groupId/artifactId`, with an exact version:\n\n```typescript\nnew JavaMavenProject({\n  name: 'svc',\n  groupId: 'org.xpertss',\n  artifactId: 'svc',\n  pluginVersions: {\n    'org.apache.maven.plugins/maven-surefire-plugin': '3.5.6',\n    'org.junit/junit-bom': '5.14.4',\n  },\n});\n```\n\n`project.pinnedVersion('org.apache.maven.plugins/maven-surefire-plugin')` returns the version in effect, for reuse in your own plugin config.\n\n**New Java lines** are one new row in this package's version table and a release. Until a line is listed, `javaVersion` rejects it rather than guessing.\n\n## Adding CI jobs to a Java project\n\n`build.yml` is exposed as `project.buildVerifyWorkflow`, so jobs are added through projen's `addJob` rather than `addOverride`. `project.ciSetupSteps` holds the steps every Maven job here needs: pinned Node, `npm ci`, and the project's JDK with a Maven cache. Every job in `build.yml` can then be made a required check on `main`.\n\n```typescript\nimport { github } from 'projen';\n\nproject.buildVerifyWorkflow.addJob('integration', {\n  name: 'Container integration tests',\n  runsOn: ['self-hosted', 'linux', 'fedora', 'podman'],\n  permissions: { contents: github.workflows.JobPermission.READ },\n  steps: [\n    { name: 'Checkout', uses: 'actions/checkout@v7' },\n    ...project.ciSetupSteps,\n    { name: 'Integration tests', run: 'mvn -B verify -Pcontainer-its' },\n  ],\n});\n```\n\n## Common options\n\nCDK project types (`CdkInfraProjectOptions` / `CdkAppProjectOptions`):\n\n| Option | Default | Description |\n| --- | --- | --- |\n| `name` | - (required) | Project name; must match `package.json` |\n| `cdkVersion` | `2.189.1` | AWS CDK version |\n| `gheTokenSecret` | `PROJEN_GITHUB_TOKEN` | GitHub secret holding projen's PAT |\n| `licensed` | `true` | Write a `LICENSE` |\n| `license` | `MIT` | SPDX identifier for the `LICENSE` |\n| `copyrightOwner` / `copyrightPeriod` | `Xpert Software` / current year | Named in the `LICENSE` |\n| `environments` | - (no `deploy` workflow) | Deploy targets for the `deploy` workflow; strings or `EnvironmentOptions` |\n| `ecrEcs` | - | `EcrEcsOptions` - `enabled`, `externalImageSource` (default `true`) |\n| `edgeResources` | - | Subset of `cloudfront`, `route53`, `apigateway`, `cognito`, `sqs` |\n| `database` | - (app only) | `DatabaseOptions` - `engine` (`postgres`/`mysql`/`dynamodb`, default `postgres`), `migrationTool` |\n| `appEntryPoint` | `src/app.ts` (app only) | Path of the generated application entrypoint |\n\nJava project types (`JavaMavenProjectOptions` and everything built on it - `JavaLibraryProjectOptions`, `JavaAppProjectOptions`, `JavaSpringBootProjectOptions`, `JavaServiceProjectOptions`):\n\n| Option | Default | Description |\n| --- | --- | --- |\n| `name` | - (required) | Project name |\n| `groupId` | - (required) | Maven group id |\n| `artifactId` | - (required) | Maven artifact id (of the reactor parent, in a multi-module project) |\n| `version` | `0.1.0` | Maven version; must be exact |\n| `description` / `url` | - | Written to the root pom |\n| `javaVersion` | `21` | Java line: `1.8`, `17`, `21`, `25` - see [Java version support](#java-version-support) |\n| `javaDistribution` | `temurin` | `actions/setup-java` distribution for CI |\n| `packaging` | `jar` | Root packaging while the project has no modules; a project with modules is always `pom` |\n| `sample` | `false` | Starter `Main` + test under the `groupId` package (single-module only) |\n| `enforcer` | `true` | `maven-enforcer-plugin` with Maven and Java version rules |\n| `minMavenVersion` | `3.9` | The enforcer's `requireMavenVersion` minimum |\n| `pluginVersions` | - | Exact-version overrides for this package's defaults, keyed by `groupId/artifactId` |\n| `licensed` | `true` | Write a `LICENSE` |\n| `license` | `MIT` | SPDX identifier for the `LICENSE` |\n| `copyrightOwner` / `copyrightPeriod` | `Xpert Software` / current year | Named in the `LICENSE` |\n| `editorconfig` | `true` | Write a projen-managed `.editorconfig` (also on the CDK and action types) |\n| `upgradeWorkflow` | `true` | Generate the nightly update report (`upgrade.yml`) |\n| Sonar options | - | `sonarHostUrl`, `sonarOrganization`, `sonarTokenSecret`, `sonarPullRequestGate`, `sonarProjectKey` - SonarCloud is opt-in; see [SonarCloud (opt-in)](#sonarcloud-opt-in) |\n| `gheTokenSecret` | `PROJEN_GITHUB_TOKEN` | GitHub secret holding projen's PAT |\n| `springBootVersion` | newest Boot for `javaVersion` (Spring Boot types only) | Exact Spring Boot version: the BOM and `spring-boot-maven-plugin` |\n| `cdkDeployTargetRepo` | - (service only; `deploy-cdk.yml` fails until set) | Companion CDK repo (`owner/repo`) whose `deploy.yml` the deploy hook dispatches |\n| `cdkDeployHook` | `true` (service only) | Whether to generate `deploy-cdk.yml` at all |\n| `dockerRegistry` | `docker.io` (service only) | Registry the Docker image is pushed to |\n| `useFlyway` | `true` (service only) | Flyway plugin/dependency + `V1__init.sql` |\n\nWith the default MIT license, the generated `LICENSE` looks like:\n\n```\nMIT License\n\nCopyright (c) 2024-2026 Xpert Software\n\nPermission is hereby granted, ...\n```\n\nThe header line (`MIT License`) is specific to the license type — an `Apache-2.0` project would instead show `Apache-2.0`.\n\nOverride the license type and copyright fields:\n\n```typescript\nnew JavaMavenProject({\n  name: 'my-lib',\n  groupId: 'org.xpertss',\n  artifactId: 'my-lib',\n  license: 'Apache-2.0',            // any SPDX id projen ships a template for\n  copyrightOwner: 'Xpert Software',\n  copyrightPeriod: '2024-2026',\n});\n```\n\n`EnvironmentOptions` for deploy targets:\n\n```text\ninterface EnvironmentOptions {\n  readonly name: string;              // e.g. \"dev\", \"stage\", \"prod\"\n  readonly accountId?: string;        // AWS account id (CDK deploys)\n  readonly region?: string;           // AWS region (CDK deploys)\n  readonly requiresApproval?: boolean; // GitHub Environment approval gate (default false)\n}\n```\n\nPlain strings (`'dev'`) are shorthand for `{ name: 'dev' }`.\n\n`GitHubActionProjectOptions`:\n\n| Option | Default | Description |\n| --- | --- | --- |\n| `name` | - (required) | Project name |\n| `description` | - | One-line description; used in the default README template and recorded in the private `package.json` |\n| Sonar options | - | `sonarHostUrl`, `sonarOrganization`, `sonarTokenSecret`, `sonarPullRequestGate`, `sonarProjectKey` - SonarCloud is opt-in; see [SonarCloud (opt-in)](#sonarcloud-opt-in) |\n| `dogfood` | - (a `test-dogfood.yml` that fails until you declare one) | `ActionDogfoodOptions` - the scenario that exercises the action end-to-end via `uses: ./` |\n| `license` | `MIT` | SPDX identifier for the generated `LICENSE` |\n| `copyrightOwner` / `copyrightPeriod` | `Xpert Software` / current year | Named in the `LICENSE` |\n| `gheTokenSecret` | `PROJEN_GITHUB_TOKEN` | GitHub secret holding projen's PAT (drift-check PR comments); a dogfood that passes a `token` input must reference this secret in the step's `inputs` |\n\n`ActionDogfoodOptions`/`ActionDogfoodStep` - the dogfood scenario (`test-dogfood.yml`):\n\n```text\ninterface ActionDogfoodOptions {\n  readonly scenario: ActionDogfoodStep[]; // one or more, run in order - required\n  readonly cleanup: string[];             // shared, run once at the end with `if: always()` - required\n}\n\ninterface ActionDogfoodStep {\n  readonly name: string;                    // labels this step-group's generated workflow steps\n  readonly id?: string;                     // step id for the `uses: ./` call; default: a slug of `name`\n  readonly fixtureSteps?: string[];         // shell, before the invocation (default: none)\n  readonly inputs?: Record<string, string>; // `with:` for this invocation (default: none)\n   readonly assertions: string[];            // shell, after the invocation - required; the step runs under set -euo pipefail so any failing line fails the job\n}\n```\n\nMost actions need exactly one `scenario` step. Actions with a re-run/no-op/idempotency behavior to verify (e.g. `auto-commit`'s no-op-on-no-change path, `create-pull-request`'s reuse-the-PR path) declare two - the second typically omits `fixtureSteps` so its invocation sees no new state, and its assertion checks the opposite outcome of the first. Reference an invocation's own outputs from a later assertion via `${{ steps.<id>.outputs.<name> }}`, using either the default slug or an explicit `id`.\n\n## SonarCloud (opt-in)\n\nSonarCloud is a shared, **opt-in** capability on every project type (CDK, Java, and GitHub Action). Set `sonarHostUrl` on any type and it generates a `.github/workflows/sonar.yml` that runs a pinned, SHA-256-verified Sonar Scanner CLI and blocks the PR on the quality gate. Omit it and no `sonar.yml` is generated. The Maven build itself never runs a Sonar step.\n\nShared options (accepted by the CDK types, every Java type, and `GitHubActionProject`):\n\n| Option | Default | Description |\n| --- | --- | --- |\n| `sonarHostUrl` | - (required to enable) | URL of your SonarCloud instance (e.g. `https://sonarcloud.io`); must be reachable from github.com-hosted runners |\n| `sonarOrganization` | `xpertss` | SonarCloud org key (`sonar.organization`); required by the Scanner CLI, not derived from the token |\n| `sonarProjectKey` | `${sonarOrganization}_${name}` | `sonar.projectKey` - the org + project key SonarCloud uses (e.g. `xpertss_create-pull-request`) |\n| `sonarTokenSecret` | `SONAR_TOKEN` | GitHub secret holding the Sonar token |\n| `sonarPullRequestGate` | `true` | Whether `sonar.yml` also runs on `pull_request` as a pass/fail gate |\n\nInclusions differ by type: a `GitHubActionProject` scans `action.yml`/`.github/workflows/**`/`**/*.sh` explicitly (YAML and shell are not in Sonar's default-recognized set), while the CDK and Java types rely on Sonar's default inclusions for their languages.\n\n```typescript\nnew CdkInfraProject({\n  name: 'my-infra',\n  environments: ['dev', 'prod'],\n  sonarHostUrl: 'https://sonarcloud.io',   // adds sonar.yml\n});\n```\n\nRequires the `SONAR_TOKEN` secret (rename it with `sonarTokenSecret`).\n\n## Required GitHub secrets\n\n| Secret | Used by | Notes |\n| --- | --- | --- |\n| `PROJEN_GITHUB_TOKEN` | all types | PAT for projen's self-mutation/automation; override via `gheTokenSecret` |\n| `SONAR_TOKEN` | any type with `sonarHostUrl` set | SonarCloud scan in `sonar.yml`; override the secret name via `sonarTokenSecret` |\n| `DOCKER_USERNAME` / `DOCKER_PASSWORD` | `JavaServiceProject` | Docker image push |\n| `MAVEN_GPG_PRIVATE_KEY`, `MAVEN_GPG_PASSPHRASE`, `MAVEN_CENTRAL_USERNAME`, `MAVEN_CENTRAL_PASSWORD` | `JavaLibraryProject` without `mavenCentralOidc` | Not needed with OIDC trusted publishing |\n\n## Customizing `.gitignore`\n\nEvery project type already ignores JetBrains IDE state (`/.idea/*`) and the `/spec/` directory with all of its subdirectories (local plans and specs, never committed). The Java types also ignore Maven `target/` output and Eclipse files. To ignore more, call the inherited `addGitIgnore()` method after constructing the project in your `.projenrc.ts`:\n\n```typescript\n// .projenrc.ts\nimport { CdkInfraProject } from '@xpertss/projen-types';\n\nconst project = new CdkInfraProject({\n  name: 'my-infra',\n});\n\nproject.addGitIgnore('*.log');\nproject.addGitIgnore('.env.*');\nproject.addGitIgnore('/build/');\n\nproject.synth();\n```\n\nThe same works for every type - just swap the class (e.g. `JavaServiceProject`, `GitHubActionProject`). Each call takes one standard gitignore glob pattern. There is no `gitignore` constructor option: the project types' option interfaces do not expose one, so patterns go through `addGitIgnore()` instead.\n\nRe-run `npx projen` after editing - `.gitignore` is a generated file, so hand-editing it is caught by the drift check.\n\n## Troubleshooting\n\n**`Unable to find projen project. Use \"projen new\" to create a new project.`**\nIf the directory already has a `.projenrc.ts`, this error means the rc has\nnever been synthesized (there's no `.projen/tasks.json`), not that you need a\nnew project. See [Starting from an existing `.projenrc.ts`](#starting-from-an-existing-projenrcts).\n\n## Going further\n\nThe project types are composed from smaller components you can also attach to your own projects:\n\n| Component | Applies to | Purpose |\n| --- | --- | --- |\n| `AppRuntimeScaffold` | `NodeProject` | App source skeleton (`app.ts` + handlers) |\n| `DatabaseComponent` | `NodeProject` | Database construct stub + migration tool wiring |\n| `EcrEcsConstructs` | `Project` | ECR + Fargate ECS construct helper |\n| `EdgeNetworkingConstructs` | `Project` | Per-resource edge networking construct helpers |\n| `MavenPom` | `Project` | A `pom.xml` with modules, BOM imports, dependency/plugin management, and exact versions only |\n| `MavenModule` | `JavaMavenProject` | One module of a reactor (created by `addModule()`) |\n| `MavenUpgradeReport` | `GitHubProject` | Nightly report-only `upgrade.yml` |\n| `MavenCentralPublish` | `JavaMavenProject` | Manual-dispatch Maven Central publish workflow |\n| `DockerPublish` | `JavaMavenProject` | Manual-dispatch Docker build+push workflow |\n| `GitHubPackagesPublish` | `JavaMavenProject` | Manual-dispatch GitHub Packages publish workflow |\n| `FlywayMigration` | `JavaSpringBootProject` | Flyway plugin/dependency + migrations directory |\n| `CdkDeployHook` | `JavaMavenProject` | Manual-dispatch workflow that triggers `deploy.yml` in a companion CDK repo |\n| `CodeIndexWorkflow` | `JavaMavenProject` | Code index generation on push to `main` |\n| `ActionBuildWorkflow` | `GitHubProject` | The `lint` task (shellcheck/yamllint/pinned actionlint) + `build.yml` |\n| `ActionDogfoodWorkflow` | `GitHubProject` | `test-dogfood.yml` from an `ActionDogfoodOptions` scenario |\n| `SonarWorkflow` | `GitHubProject` | `sonar.yml` (SonarCloud scan via the Scanner CLI); opt-in, shared by every type via `sonarHostUrl` |\n\nExample - adding a Docker publish to a `JavaMavenProject` (`JavaServiceProject` is the packaged version of this, with Spring Boot):\n\n```typescript\nimport { DockerPublish, JavaMavenProject } from '@xpertss/projen-types';\n\nconst project = new JavaMavenProject({\n  name: 'my-service',\n  groupId: 'org.xpertss',\n  artifactId: 'my-service',\n});\n\nnew DockerPublish(project, { dockerRegistry: 'ghcr.io' });\n\nproject.synth();\n```\n\nThe full API reference, including every option and property, is in [API.md](./API.md).\n"
   },
   "repository": {
     "type": "git",
@@ -422,20 +422,19 @@
     },
     "@xpertss/projen-types.ActionSonarWorkflow": {
       "assembly": "@xpertss/projen-types",
-      "base": "projen.Component",
+      "base": "@xpertss/projen-types.SonarWorkflow",
       "docs": {
-        "remarks": "`sonar.inclusions` is set explicitly since default\ninclusions may skip `action.yml` outside `.github/`.",
-        "stability": "experimental",
-        "summary": "AD-001 Layer 2: SonarCloud via the Scanner CLI only (never `SonarSource/sonarqube-scan-action` - third-party, and it carried a security advisory)."
+        "deprecated": "Renamed to `SonarWorkflow` (now in `src/common/` and applied to\nevery project type, not just actions). Use `SonarWorkflow` instead; this\nsubclass is kept only so existing imports of `ActionSonarWorkflow` keep\ncompiling. It behaves identically to `SonarWorkflow`.",
+        "stability": "deprecated"
       },
       "fqn": "@xpertss/projen-types.ActionSonarWorkflow",
       "initializer": {
         "docs": {
-          "stability": "experimental"
+          "stability": "deprecated"
         },
         "locationInModule": {
           "filename": "src/actions/action-sonar-workflow.ts",
-          "line": 44
+          "line": 11
         },
         "parameters": [
           {
@@ -447,7 +446,7 @@
           {
             "name": "options",
             "type": {
-              "fqn": "@xpertss/projen-types.ActionSonarWorkflowOptions"
+              "fqn": "@xpertss/projen-types.SonarWorkflowOptions"
             }
           }
         ]
@@ -455,113 +454,11 @@
       "kind": "class",
       "locationInModule": {
         "filename": "src/actions/action-sonar-workflow.ts",
-        "line": 41
+        "line": 10
       },
       "name": "ActionSonarWorkflow",
-      "properties": [
-        {
-          "docs": {
-            "stability": "experimental"
-          },
-          "immutable": true,
-          "locationInModule": {
-            "filename": "src/actions/action-sonar-workflow.ts",
-            "line": 42
-          },
-          "name": "workflow",
-          "type": {
-            "fqn": "projen.github.GithubWorkflow"
-          }
-        }
-      ],
       "symbolId": "src/actions/action-sonar-workflow:ActionSonarWorkflow"
     },
-    "@xpertss/projen-types.ActionSonarWorkflowOptions": {
-      "assembly": "@xpertss/projen-types",
-      "datatype": true,
-      "docs": {
-        "stability": "experimental"
-      },
-      "fqn": "@xpertss/projen-types.ActionSonarWorkflowOptions",
-      "kind": "interface",
-      "locationInModule": {
-        "filename": "src/actions/action-sonar-workflow.ts",
-        "line": 10
-      },
-      "name": "ActionSonarWorkflowOptions",
-      "properties": [
-        {
-          "abstract": true,
-          "docs": {
-            "stability": "experimental",
-            "summary": "URL of the org's SonarCloud instance (e.g. `https://sonarcloud.io`). Required, no default - a guessed server is worse than a loud failure."
-          },
-          "immutable": true,
-          "locationInModule": {
-            "filename": "src/actions/action-sonar-workflow.ts",
-            "line": 15
-          },
-          "name": "sonarHostUrl",
-          "type": {
-            "primitive": "string"
-          }
-        },
-        {
-          "abstract": true,
-          "docs": {
-            "default": "\"xpertss\"",
-            "stability": "experimental",
-            "summary": "SonarCloud organization key (`sonar.organization`). Mandatory for the Scanner CLI on SonarCloud - it is not derived from the token, so a scan without it always fails."
-          },
-          "immutable": true,
-          "locationInModule": {
-            "filename": "src/actions/action-sonar-workflow.ts",
-            "line": 23
-          },
-          "name": "sonarOrganization",
-          "optional": true,
-          "type": {
-            "primitive": "string"
-          }
-        },
-        {
-          "abstract": true,
-          "docs": {
-            "default": "true",
-            "stability": "experimental",
-            "summary": "Whether `sonar.yml` also runs on `pull_request` as a pass/fail gate."
-          },
-          "immutable": true,
-          "locationInModule": {
-            "filename": "src/actions/action-sonar-workflow.ts",
-            "line": 32
-          },
-          "name": "sonarPullRequestGate",
-          "optional": true,
-          "type": {
-            "primitive": "boolean"
-          }
-        },
-        {
-          "abstract": true,
-          "docs": {
-            "default": "\"SONAR_TOKEN\"",
-            "stability": "experimental"
-          },
-          "immutable": true,
-          "locationInModule": {
-            "filename": "src/actions/action-sonar-workflow.ts",
-            "line": 26
-          },
-          "name": "sonarTokenSecret",
-          "optional": true,
-          "type": {
-            "primitive": "string"
-          }
-        }
-      ],
-      "symbolId": "src/actions/action-sonar-workflow:ActionSonarWorkflowOptions"
-    },
     "@xpertss/projen-types.AppRuntimeScaffold": {
       "assembly": "@xpertss/projen-types",
       "base": "projen.Component",
@@ -648,7 +545,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "src/cdk/options.ts",
-        "line": 92
+        "line": 93
       },
       "name": "CdkAppProjectOptions",
       "properties": [
@@ -661,7 +558,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/cdk/options.ts",
-            "line": 96
+            "line": 97
           },
           "name": "appEntryPoint",
           "optional": true,
@@ -677,7 +574,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/cdk/options.ts",
-            "line": 93
+            "line": 94
           },
           "name": "database",
           "optional": true,
@@ -759,7 +656,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "src/java/options.ts",
-        "line": 152
+        "line": 150
       },
       "name": "CdkDeployHookOptions",
       "properties": [
@@ -773,7 +670,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/java/options.ts",
-            "line": 160
+            "line": 158
           },
           "name": "targetRepo",
           "optional": true,
@@ -831,7 +728,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "src/cdk/options.ts",
-        "line": 63
+        "line": 64
       },
       "name": "CdkInfraProjectOptions",
       "properties": [
@@ -843,7 +740,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/cdk/options.ts",
-            "line": 79
+            "line": 80
           },
           "name": "ecrEcs",
           "optional": true,
@@ -859,7 +756,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/cdk/options.ts",
-            "line": 81
+            "line": 82
           },
           "name": "edgeResources",
           "optional": true,
@@ -883,7 +780,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/cdk/options.ts",
-            "line": 77
+            "line": 78
           },
           "name": "environments",
           "optional": true,
@@ -922,7 +819,7 @@
         },
         "locationInModule": {
           "filename": "src/cdk/cdk-typescript-base.ts",
-          "line": 31
+          "line": 35
         },
         "parameters": [
           {
@@ -936,9 +833,27 @@
       "kind": "class",
       "locationInModule": {
         "filename": "src/cdk/cdk-typescript-base.ts",
-        "line": 30
+        "line": 31
       },
       "name": "CdkTypescriptProject",
+      "properties": [
+        {
+          "docs": {
+            "stability": "experimental",
+            "summary": "Set only when `sonarHostUrl` is provided."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/cdk/cdk-typescript-base.ts",
+            "line": 33
+          },
+          "name": "sonarWorkflow",
+          "optional": true,
+          "type": {
+            "fqn": "@xpertss/projen-types.SonarWorkflow"
+          }
+        }
+      ],
       "symbolId": "src/cdk/cdk-typescript-base:CdkTypescriptProject"
     },
     "@xpertss/projen-types.CdkTypescriptProjectOptions": {
@@ -954,7 +869,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "src/cdk/cdk-typescript-base.ts",
-        "line": 19
+        "line": 20
       },
       "name": "CdkTypescriptProjectOptions",
       "properties": [
@@ -966,7 +881,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/cdk/cdk-typescript-base.ts",
-            "line": 20
+            "line": 21
           },
           "name": "environments",
           "optional": true,
@@ -1031,10 +946,13 @@
         "stability": "experimental"
       },
       "fqn": "@xpertss/projen-types.CommonCdkOptions",
+      "interfaces": [
+        "@xpertss/projen-types.SonarScanOptions"
+      ],
       "kind": "interface",
       "locationInModule": {
         "filename": "src/cdk/options.ts",
-        "line": 23
+        "line": 24
       },
       "name": "CommonCdkOptions",
       "properties": [
@@ -1046,7 +964,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/cdk/options.ts",
-            "line": 24
+            "line": 25
           },
           "name": "name",
           "type": {
@@ -1062,7 +980,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/cdk/options.ts",
-            "line": 27
+            "line": 28
           },
           "name": "cdkVersion",
           "optional": true,
@@ -1080,7 +998,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/cdk/options.ts",
-            "line": 48
+            "line": 49
           },
           "name": "copyrightOwner",
           "optional": true,
@@ -1098,7 +1016,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/cdk/options.ts",
-            "line": 54
+            "line": 55
           },
           "name": "copyrightPeriod",
           "optional": true,
@@ -1116,7 +1034,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/cdk/options.ts",
-            "line": 60
+            "line": 61
           },
           "name": "editorconfig",
           "optional": true,
@@ -1133,7 +1051,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/cdk/options.ts",
-            "line": 30
+            "line": 31
           },
           "name": "gheTokenSecret",
           "optional": true,
@@ -1151,7 +1069,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/cdk/options.ts",
-            "line": 42
+            "line": 43
           },
           "name": "license",
           "optional": true,
@@ -1169,7 +1087,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/cdk/options.ts",
-            "line": 36
+            "line": 37
           },
           "name": "licensed",
           "optional": true,
@@ -1187,10 +1105,13 @@
         "stability": "experimental"
       },
       "fqn": "@xpertss/projen-types.CommonJavaOptions",
+      "interfaces": [
+        "@xpertss/projen-types.SonarScanOptions"
+      ],
       "kind": "interface",
       "locationInModule": {
         "filename": "src/java/options.ts",
-        "line": 3
+        "line": 4
       },
       "name": "CommonJavaOptions",
       "properties": [
@@ -1202,7 +1123,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/java/options.ts",
-            "line": 6
+            "line": 7
           },
           "name": "artifactId",
           "type": {
@@ -1217,7 +1138,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/java/options.ts",
-            "line": 5
+            "line": 6
           },
           "name": "groupId",
           "type": {
@@ -1232,7 +1153,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/java/options.ts",
-            "line": 4
+            "line": 5
           },
           "name": "name",
           "type": {
@@ -1249,7 +1170,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/java/options.ts",
-            "line": 103
+            "line": 101
           },
           "name": "copyrightOwner",
           "optional": true,
@@ -1267,7 +1188,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/java/options.ts",
-            "line": 109
+            "line": 107
           },
           "name": "copyrightPeriod",
           "optional": true,
@@ -1285,7 +1206,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/java/options.ts",
-            "line": 12
+            "line": 13
           },
           "name": "description",
           "optional": true,
@@ -1303,7 +1224,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/java/options.ts",
-            "line": 115
+            "line": 113
           },
           "name": "editorconfig",
           "optional": true,
@@ -1322,7 +1243,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/java/options.ts",
-            "line": 67
+            "line": 65
           },
           "name": "enforcer",
           "optional": true,
@@ -1339,7 +1260,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/java/options.ts",
-            "line": 21
+            "line": 19
           },
           "name": "gheTokenSecret",
           "optional": true,
@@ -1357,7 +1278,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/java/options.ts",
-            "line": 40
+            "line": 38
           },
           "name": "javaDistribution",
           "optional": true,
@@ -1376,7 +1297,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/java/options.ts",
-            "line": 34
+            "line": 32
           },
           "name": "javaVersion",
           "optional": true,
@@ -1394,7 +1315,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/java/options.ts",
-            "line": 97
+            "line": 95
           },
           "name": "license",
           "optional": true,
@@ -1412,7 +1333,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/java/options.ts",
-            "line": 91
+            "line": 89
           },
           "name": "licensed",
           "optional": true,
@@ -1431,7 +1352,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/java/options.ts",
-            "line": 75
+            "line": 73
           },
           "name": "minMavenVersion",
           "optional": true,
@@ -1450,7 +1371,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/java/options.ts",
-            "line": 49
+            "line": 47
           },
           "name": "packaging",
           "optional": true,
@@ -1468,7 +1389,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/java/options.ts",
-            "line": 85
+            "line": 83
           },
           "name": "pluginVersions",
           "optional": true,
@@ -1492,7 +1413,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/java/options.ts",
-            "line": 57
+            "line": 55
           },
           "name": "sample",
           "optional": true,
@@ -1500,24 +1421,6 @@
             "primitive": "boolean"
           }
         },
-        {
-          "abstract": true,
-          "docs": {
-            "remarks": "If unset, the sonar scan step is skipped.",
-            "stability": "experimental",
-            "summary": "SonarCloud project key."
-          },
-          "immutable": true,
-          "locationInModule": {
-            "filename": "src/java/options.ts",
-            "line": 18
-          },
-          "name": "sonarProjectKey",
-          "optional": true,
-          "type": {
-            "primitive": "string"
-          }
-        },
         {
           "abstract": true,
           "docs": {
@@ -1528,7 +1431,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/java/options.ts",
-            "line": 124
+            "line": 122
           },
           "name": "upgradeWorkflow",
           "optional": true,
@@ -1546,7 +1449,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/java/options.ts",
-            "line": 15
+            "line": 16
           },
           "name": "url",
           "optional": true,
@@ -1563,7 +1466,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/java/options.ts",
-            "line": 9
+            "line": 10
           },
           "name": "version",
           "optional": true,
@@ -1625,7 +1528,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "src/cdk/options.ts",
-        "line": 84
+        "line": 85
       },
       "name": "DatabaseOptions",
       "properties": [
@@ -1638,7 +1541,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/cdk/options.ts",
-            "line": 86
+            "line": 87
           },
           "name": "engine",
           "optional": true,
@@ -1655,7 +1558,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/cdk/options.ts",
-            "line": 89
+            "line": 90
           },
           "name": "migrationTool",
           "optional": true,
@@ -1791,7 +1694,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "src/cdk/options.ts",
-        "line": 10
+        "line": 11
       },
       "name": "EcrEcsOptions",
       "properties": [
@@ -1804,7 +1707,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/cdk/options.ts",
-            "line": 12
+            "line": 13
           },
           "name": "enabled",
           "optional": true,
@@ -1822,7 +1725,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/cdk/options.ts",
-            "line": 20
+            "line": 21
           },
           "name": "externalImageSource",
           "optional": true,
@@ -2011,7 +1914,7 @@
         },
         "locationInModule": {
           "filename": "src/actions/github-action-project.ts",
-          "line": 161
+          "line": 141
         },
         "parameters": [
           {
@@ -2025,7 +1928,7 @@
       "kind": "class",
       "locationInModule": {
         "filename": "src/actions/github-action-project.ts",
-        "line": 155
+        "line": 134
       },
       "name": "GitHubActionProject",
       "properties": [
@@ -2036,7 +1939,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/actions/github-action-project.ts",
-            "line": 156
+            "line": 135
           },
           "name": "buildWorkflow",
           "type": {
@@ -2050,7 +1953,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/actions/github-action-project.ts",
-            "line": 157
+            "line": 136
           },
           "name": "dogfoodWorkflow",
           "type": {
@@ -2064,7 +1967,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/actions/github-action-project.ts",
-            "line": 159
+            "line": 139
           },
           "name": "release",
           "type": {
@@ -2073,16 +1976,18 @@
         },
         {
           "docs": {
-            "stability": "experimental"
+            "stability": "experimental",
+            "summary": "Set only when `sonarHostUrl` is provided."
           },
           "immutable": true,
           "locationInModule": {
             "filename": "src/actions/github-action-project.ts",
-            "line": 158
+            "line": 138
           },
           "name": "sonarWorkflow",
+          "optional": true,
           "type": {
-            "fqn": "@xpertss/projen-types.ActionSonarWorkflow"
+            "fqn": "@xpertss/projen-types.SonarWorkflow"
           }
         }
       ],
@@ -2096,31 +2001,16 @@
       },
       "fqn": "@xpertss/projen-types.GitHubActionProjectOptions",
       "interfaces": [
-        "projen.github.GitHubProjectOptions"
+        "projen.github.GitHubProjectOptions",
+        "@xpertss/projen-types.SonarScanOptions"
       ],
       "kind": "interface",
       "locationInModule": {
         "filename": "src/actions/github-action-project.ts",
-        "line": 36
+        "line": 37
       },
       "name": "GitHubActionProjectOptions",
       "properties": [
-        {
-          "abstract": true,
-          "docs": {
-            "stability": "experimental",
-            "summary": "URL of the org's SonarCloud instance (e.g. `https://sonarcloud.io`). MUST be reachable from github.com-hosted (public) runners (AD-001). Required, no default: a guessed server is worse than a loud failure."
-          },
-          "immutable": true,
-          "locationInModule": {
-            "filename": "src/actions/github-action-project.ts",
-            "line": 59
-          },
-          "name": "sonarHostUrl",
-          "type": {
-            "primitive": "string"
-          }
-        },
         {
           "abstract": true,
           "docs": {
@@ -2131,7 +2021,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/actions/github-action-project.ts",
-            "line": 104
+            "line": 83
           },
           "name": "copyrightOwner",
           "optional": true,
@@ -2149,7 +2039,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/actions/github-action-project.ts",
-            "line": 110
+            "line": 89
           },
           "name": "copyrightPeriod",
           "optional": true,
@@ -2167,7 +2057,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/actions/github-action-project.ts",
-            "line": 42
+            "line": 44
           },
           "name": "description",
           "optional": true,
@@ -2186,7 +2076,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/actions/github-action-project.ts",
-            "line": 92
+            "line": 71
           },
           "name": "dogfood",
           "optional": true,
@@ -2204,7 +2094,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/actions/github-action-project.ts",
-            "line": 116
+            "line": 95
           },
           "name": "editorconfig",
           "optional": true,
@@ -2223,7 +2113,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/actions/github-action-project.ts",
-            "line": 52
+            "line": 54
           },
           "name": "gheTokenSecret",
           "optional": true,
@@ -2241,66 +2131,13 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/actions/github-action-project.ts",
-            "line": 98
+            "line": 77
           },
           "name": "license",
           "optional": true,
           "type": {
             "primitive": "string"
           }
-        },
-        {
-          "abstract": true,
-          "docs": {
-            "default": "\"xpertss\"",
-            "stability": "experimental",
-            "summary": "SonarCloud organization key (`sonar.organization`), required by the Scanner CLI on SonarCloud."
-          },
-          "immutable": true,
-          "locationInModule": {
-            "filename": "src/actions/github-action-project.ts",
-            "line": 66
-          },
-          "name": "sonarOrganization",
-          "optional": true,
-          "type": {
-            "primitive": "string"
-          }
-        },
-        {
-          "abstract": true,
-          "docs": {
-            "default": "true",
-            "stability": "experimental",
-            "summary": "Whether `sonar.yml` also runs on `pull_request` as a pass/fail gate."
-          },
-          "immutable": true,
-          "locationInModule": {
-            "filename": "src/actions/github-action-project.ts",
-            "line": 75
-          },
-          "name": "sonarPullRequestGate",
-          "optional": true,
-          "type": {
-            "primitive": "boolean"
-          }
-        },
-        {
-          "abstract": true,
-          "docs": {
-            "default": "\"SONAR_TOKEN\"",
-            "stability": "experimental"
-          },
-          "immutable": true,
-          "locationInModule": {
-            "filename": "src/actions/github-action-project.ts",
-            "line": 69
-          },
-          "name": "sonarTokenSecret",
-          "optional": true,
-          "type": {
-            "primitive": "string"
-          }
         }
       ],
       "symbolId": "src/actions/github-action-project:GitHubActionProjectOptions"
@@ -2426,7 +2263,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "src/java/options.ts",
-        "line": 201
+        "line": 199
       },
       "name": "JavaAppProjectOptions",
       "properties": [
@@ -2439,7 +2276,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/java/options.ts",
-            "line": 203
+            "line": 201
           },
           "name": "ghPackagesRegistry",
           "optional": true,
@@ -2497,7 +2334,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "src/java/options.ts",
-        "line": 144
+        "line": 142
       },
       "name": "JavaLibraryProjectOptions",
       "properties": [
@@ -2510,7 +2347,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/java/options.ts",
-            "line": 146
+            "line": 144
           },
           "name": "mavenCentralOidc",
           "optional": true,
@@ -2527,7 +2364,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/java/options.ts",
-            "line": 149
+            "line": 147
           },
           "name": "publishCodeIndex",
           "optional": true,
@@ -2542,7 +2379,7 @@
       "assembly": "@xpertss/projen-types",
       "base": "projen.github.GitHubProject",
       "docs": {
-        "remarks": "It is the base of every Java type in this package and is\nusable on its own (`projen new ... java_maven`).\n\n- The pom is written by this package (`MavenPom`), not projen's\n  `java.Pom`: exact versions only, BOM imports, `<modules>`,\n  `<dependencyManagement>`, `<pluginManagement>`.\n- Everything Java-version-dependent (compiler level, enforcer rule, JUnit\n  line, CI JDK) follows `javaVersion`.\n- With no `addModule()` calls the root pom is the artifact. After the\n  first `addModule()` it is a `pom`-packaged reactor parent and the\n  modules inherit its plugins and test dependencies.\n- `npx projen build` synthesizes, then runs Maven once: `mvn -B verify`\n  (unit tests via surefire, `*IT` tests via failsafe).\n- CI: a PR build (with an optional SonarQube scan), the projen drift\n  check, and a nightly report-only update check.",
+        "remarks": "It is the base of every Java type in this package and is\nusable on its own (`projen new ... java_maven`).\n\n- The pom is written by this package (`MavenPom`), not projen's\n  `java.Pom`: exact versions only, BOM imports, `<modules>`,\n  `<dependencyManagement>`, `<pluginManagement>`.\n- Everything Java-version-dependent (compiler level, enforcer rule, JUnit\n  line, CI JDK) follows `javaVersion`.\n- With no `addModule()` calls the root pom is the artifact. After the\n  first `addModule()` it is a `pom`-packaged reactor parent and the\n  modules inherit its plugins and test dependencies.\n- `npx projen build` synthesizes, then runs Maven once: `mvn -B verify`\n  (unit tests via surefire, `*IT` tests via failsafe).\n - CI: a PR build, the projen drift check, an optional SonarCloud scan\n (`sonar.yml`, when `sonarHostUrl` is set), and a nightly report-only\n update check.",
         "stability": "experimental",
         "summary": "Baseline Maven project, single- or multi-module, with no framework assumptions."
       },
@@ -2553,7 +2390,7 @@
         },
         "locationInModule": {
           "filename": "src/java/java-maven-base.ts",
-          "line": 85
+          "line": 90
         },
         "parameters": [
           {
@@ -2567,7 +2404,7 @@
       "kind": "class",
       "locationInModule": {
         "filename": "src/java/java-maven-base.ts",
-        "line": 56
+        "line": 58
       },
       "methods": [
         {
@@ -2577,7 +2414,7 @@
           },
           "locationInModule": {
             "filename": "src/java/java-maven-base.ts",
-            "line": 275
+            "line": 280
           },
           "name": "addBom",
           "parameters": [
@@ -2600,7 +2437,7 @@
           },
           "locationInModule": {
             "filename": "src/java/java-maven-base.ts",
-            "line": 297
+            "line": 302
           },
           "name": "addDependency",
           "parameters": [
@@ -2622,7 +2459,7 @@
           },
           "locationInModule": {
             "filename": "src/java/java-maven-base.ts",
-            "line": 285
+            "line": 290
           },
           "name": "addManagedDependency",
           "parameters": [
@@ -2645,7 +2482,7 @@
           },
           "locationInModule": {
             "filename": "src/java/java-maven-base.ts",
-            "line": 244
+            "line": 249
           },
           "name": "addModule",
           "parameters": [
@@ -2669,7 +2506,7 @@
           },
           "locationInModule": {
             "filename": "src/java/java-maven-base.ts",
-            "line": 307
+            "line": 312
           },
           "name": "addPlugin",
           "parameters": [
@@ -2695,7 +2532,7 @@
           },
           "locationInModule": {
             "filename": "src/java/java-maven-base.ts",
-            "line": 302
+            "line": 307
           },
           "name": "addTestDependency",
           "parameters": [
@@ -2714,7 +2551,7 @@
           },
           "locationInModule": {
             "filename": "src/java/java-maven-base.ts",
-            "line": 335
+            "line": 340
           },
           "name": "maxSpringBootMajor",
           "protected": true,
@@ -2732,7 +2569,7 @@
           },
           "locationInModule": {
             "filename": "src/java/java-maven-base.ts",
-            "line": 323
+            "line": 328
           },
           "name": "pinnedVersion",
           "parameters": [
@@ -2756,7 +2593,7 @@
           },
           "locationInModule": {
             "filename": "src/java/java-maven-base.ts",
-            "line": 311
+            "line": 316
           },
           "name": "preSynthesize",
           "overrides": "projen.Project"
@@ -2772,7 +2609,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/java/java-maven-base.ts",
-            "line": 71
+            "line": 73
           },
           "name": "buildVerifyWorkflow",
           "type": {
@@ -2787,7 +2624,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/java/java-maven-base.ts",
-            "line": 77
+            "line": 79
           },
           "name": "ciSetupSteps",
           "type": {
@@ -2807,7 +2644,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/java/java-maven-base.ts",
-            "line": 61
+            "line": 63
           },
           "name": "javaVersion",
           "type": {
@@ -2822,7 +2659,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/java/java-maven-base.ts",
-            "line": 233
+            "line": 238
           },
           "name": "modules",
           "type": {
@@ -2842,26 +2679,42 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/java/java-maven-base.ts",
-            "line": 58
+            "line": 60
+          },
+          "name": "pom",
+          "type": {
+            "fqn": "@xpertss/projen-types.MavenPom"
+          }
+        },
+        {
+          "docs": {
+            "stability": "experimental",
+            "summary": "Prints available dependency/plugin updates (`npx projen upgrade`)."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/java/java-maven-base.ts",
+            "line": 66
           },
-          "name": "pom",
+          "name": "upgradeTask",
           "type": {
-            "fqn": "@xpertss/projen-types.MavenPom"
+            "fqn": "projen.Task"
           }
         },
         {
           "docs": {
             "stability": "experimental",
-            "summary": "Prints available dependency/plugin updates (`npx projen upgrade`)."
+            "summary": "Set only when `sonarHostUrl` is provided."
           },
           "immutable": true,
           "locationInModule": {
             "filename": "src/java/java-maven-base.ts",
-            "line": 64
+            "line": 82
           },
-          "name": "upgradeTask",
+          "name": "sonarWorkflow",
+          "optional": true,
           "type": {
-            "fqn": "projen.Task"
+            "fqn": "@xpertss/projen-types.SonarWorkflow"
           }
         }
       ],
@@ -2881,7 +2734,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "src/java/options.ts",
-        "line": 128
+        "line": 126
       },
       "name": "JavaMavenProjectOptions",
       "symbolId": "src/java/options:JavaMavenProjectOptions"
@@ -2961,7 +2814,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "src/java/options.ts",
-        "line": 163
+        "line": 161
       },
       "name": "JavaServiceProjectOptions",
       "properties": [
@@ -2975,7 +2828,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/java/options.ts",
-            "line": 190
+            "line": 188
           },
           "name": "cdkDeployHook",
           "optional": true,
@@ -2997,7 +2850,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/java/options.ts",
-            "line": 183
+            "line": 181
           },
           "name": "cdkDeployTargetRepo",
           "optional": true,
@@ -3014,7 +2867,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/java/options.ts",
-            "line": 165
+            "line": 163
           },
           "name": "dockerRegistry",
           "optional": true,
@@ -3032,7 +2885,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/java/options.ts",
-            "line": 198
+            "line": 196
           },
           "name": "environments",
           "optional": true,
@@ -3063,7 +2916,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/java/options.ts",
-            "line": 168
+            "line": 166
           },
           "name": "useFlyway",
           "optional": true,
@@ -3177,7 +3030,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "src/java/options.ts",
-        "line": 131
+        "line": 129
       },
       "name": "JavaSpringBootProjectOptions",
       "properties": [
@@ -3192,7 +3045,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/java/options.ts",
-            "line": 141
+            "line": 139
           },
           "name": "springBootVersion",
           "optional": true,
@@ -3547,7 +3400,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "src/java/options.ts",
-        "line": 207
+        "line": 205
       },
       "name": "MavenModuleOptions",
       "properties": [
@@ -3559,7 +3412,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/java/options.ts",
-            "line": 214
+            "line": 212
           },
           "name": "artifactId",
           "type": {
@@ -3575,7 +3428,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/java/options.ts",
-            "line": 212
+            "line": 210
           },
           "name": "dir",
           "type": {
@@ -3591,7 +3444,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/java/options.ts",
-            "line": 220
+            "line": 218
           },
           "name": "description",
           "optional": true,
@@ -3608,7 +3461,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/java/options.ts",
-            "line": 217
+            "line": 215
           },
           "name": "name",
           "optional": true,
@@ -3625,7 +3478,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/java/options.ts",
-            "line": 223
+            "line": 221
           },
           "name": "packaging",
           "optional": true,
@@ -4515,6 +4368,289 @@
       ],
       "symbolId": "src/common/projen-drift-check-workflow:ProjenDriftCheckWorkflowOptions"
     },
+    "@xpertss/projen-types.SonarScanOptions": {
+      "assembly": "@xpertss/projen-types",
+      "datatype": true,
+      "docs": {
+        "stability": "experimental"
+      },
+      "fqn": "@xpertss/projen-types.SonarScanOptions",
+      "kind": "interface",
+      "locationInModule": {
+        "filename": "src/common/sonar-options.ts",
+        "line": 1
+      },
+      "name": "SonarScanOptions",
+      "properties": [
+        {
+          "abstract": true,
+          "docs": {
+            "stability": "experimental",
+            "summary": "URL of the org's SonarCloud instance (e.g. `https://sonarcloud.io`). When set, a `sonar.yml` SonarScanner workflow is generated; when omitted, no Sonar workflow is produced. Must be reachable from github.com-hosted (public) runners (AD-001)."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/common/sonar-options.ts",
+            "line": 8
+          },
+          "name": "sonarHostUrl",
+          "optional": true,
+          "type": {
+            "primitive": "string"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "\"xpertss\"",
+            "stability": "experimental",
+            "summary": "SonarCloud organization key (`sonar.organization`). Mandatory for the Scanner CLI on SonarCloud - it is not derived from the token, so a scan without it always fails."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/common/sonar-options.ts",
+            "line": 16
+          },
+          "name": "sonarOrganization",
+          "optional": true,
+          "type": {
+            "primitive": "string"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "- `${sonarOrganization}_${name}` (the org + project key SonarCloud\nuses, e.g. `xpertss_create-pull-request`)",
+            "stability": "experimental",
+            "summary": "`sonar.projectKey`."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/common/sonar-options.ts",
+            "line": 32
+          },
+          "name": "sonarProjectKey",
+          "optional": true,
+          "type": {
+            "primitive": "string"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "true",
+            "stability": "experimental",
+            "summary": "Whether `sonar.yml` also runs on `pull_request` as a pass/fail gate."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/common/sonar-options.ts",
+            "line": 25
+          },
+          "name": "sonarPullRequestGate",
+          "optional": true,
+          "type": {
+            "primitive": "boolean"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "\"SONAR_TOKEN\"",
+            "stability": "experimental"
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/common/sonar-options.ts",
+            "line": 19
+          },
+          "name": "sonarTokenSecret",
+          "optional": true,
+          "type": {
+            "primitive": "string"
+          }
+        }
+      ],
+      "symbolId": "src/common/sonar-options:SonarScanOptions"
+    },
+    "@xpertss/projen-types.SonarWorkflow": {
+      "assembly": "@xpertss/projen-types",
+      "base": "projen.Component",
+      "docs": {
+        "remarks": "`sonar.projectKey` defaults to\n`${sonarOrganization}_${name}` (the org + project key SonarCloud uses);\n`sonar.inclusions` is emitted only when provided, since the defaults are\nenough for default-recognized languages.",
+        "stability": "experimental",
+        "summary": "AD-001 Layer 2: SonarCloud via the Scanner CLI only (never `SonarSource/sonarqube-scan-action` - third-party, and it carried a security advisory)."
+      },
+      "fqn": "@xpertss/projen-types.SonarWorkflow",
+      "initializer": {
+        "docs": {
+          "stability": "experimental"
+        },
+        "locationInModule": {
+          "filename": "src/common/sonar-workflow.ts",
+          "line": 62
+        },
+        "parameters": [
+          {
+            "name": "scope",
+            "type": {
+              "fqn": "projen.github.GitHubProject"
+            }
+          },
+          {
+            "name": "options",
+            "type": {
+              "fqn": "@xpertss/projen-types.SonarWorkflowOptions"
+            }
+          }
+        ]
+      },
+      "kind": "class",
+      "locationInModule": {
+        "filename": "src/common/sonar-workflow.ts",
+        "line": 59
+      },
+      "name": "SonarWorkflow",
+      "properties": [
+        {
+          "docs": {
+            "stability": "experimental"
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/common/sonar-workflow.ts",
+            "line": 60
+          },
+          "name": "workflow",
+          "type": {
+            "fqn": "projen.github.GithubWorkflow"
+          }
+        }
+      ],
+      "symbolId": "src/common/sonar-workflow:SonarWorkflow"
+    },
+    "@xpertss/projen-types.SonarWorkflowOptions": {
+      "assembly": "@xpertss/projen-types",
+      "datatype": true,
+      "docs": {
+        "stability": "experimental"
+      },
+      "fqn": "@xpertss/projen-types.SonarWorkflowOptions",
+      "kind": "interface",
+      "locationInModule": {
+        "filename": "src/common/sonar-workflow.ts",
+        "line": 10
+      },
+      "name": "SonarWorkflowOptions",
+      "properties": [
+        {
+          "abstract": true,
+          "docs": {
+            "stability": "experimental",
+            "summary": "URL of the org's SonarCloud instance (e.g. `https://sonarcloud.io`). Required, no default - a guessed server is worse than a loud failure."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/common/sonar-workflow.ts",
+            "line": 15
+          },
+          "name": "sonarHostUrl",
+          "type": {
+            "primitive": "string"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "- none (Sonar's default inclusions)",
+            "stability": "experimental",
+            "summary": "`sonar.inclusions` glob, only needed for files Sonar's default inclusions skip - e.g. a composite action's `action.yml` and `*.sh` scripts, which live outside the defaults. Omit it for default-recognized languages (Java, TypeScript, ...)."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/common/sonar-workflow.ts",
+            "line": 48
+          },
+          "name": "sonarInclusions",
+          "optional": true,
+          "type": {
+            "primitive": "string"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "\"xpertss\"",
+            "stability": "experimental",
+            "summary": "SonarCloud organization key (`sonar.organization`). Mandatory for the Scanner CLI on SonarCloud - it is not derived from the token, so a scan without it always fails."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/common/sonar-workflow.ts",
+            "line": 23
+          },
+          "name": "sonarOrganization",
+          "optional": true,
+          "type": {
+            "primitive": "string"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "- `${sonarOrganization}_${name}` (the org + project key SonarCloud\nuses, e.g. `xpertss_create-pull-request`)",
+            "stability": "experimental",
+            "summary": "`sonar.projectKey`."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/common/sonar-workflow.ts",
+            "line": 39
+          },
+          "name": "sonarProjectKey",
+          "optional": true,
+          "type": {
+            "primitive": "string"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "true",
+            "stability": "experimental",
+            "summary": "Whether `sonar.yml` also runs on `pull_request` as a pass/fail gate."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/common/sonar-workflow.ts",
+            "line": 32
+          },
+          "name": "sonarPullRequestGate",
+          "optional": true,
+          "type": {
+            "primitive": "boolean"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "\"SONAR_TOKEN\"",
+            "stability": "experimental"
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/common/sonar-workflow.ts",
+            "line": 26
+          },
+          "name": "sonarTokenSecret",
+          "optional": true,
+          "type": {
+            "primitive": "string"
+          }
+        }
+      ],
+      "symbolId": "src/common/sonar-workflow:SonarWorkflowOptions"
+    },
     "@xpertss/projen-types.WorkflowChangeNoticeWorkflow": {
       "assembly": "@xpertss/projen-types",
       "base": "projen.Component",
@@ -4630,6 +4766,6 @@
       "symbolId": "src/common/workflow-change-notice-workflow:WorkflowChangeNoticeWorkflowOptions"
     }
   },
-  "version": "0.0.21",
-  "fingerprint": "Lpw7m6GjVomXI8FrDCx1XCdRdN23DRQOtGauO0smzeY="
+  "version": "0.0.22",
+  "fingerprint": "X29Pe4ieYhnrNjcCkP20geT95pIeT0dvl9TcMcDDd1A="
 }