@xpertss/projen-types 0.0.6 → 0.0.8

package/.jsii

@@ -106,7 +106,7 @@
   },
   "name": "@xpertss/projen-types",
   "readme": {
-    "markdown": "# @xpertss/projen-types\n\nProjen project types for CDK/TypeScript and Java/Maven projects.\n\nInstead of hand-maintaining `pom.xml`, `cdk.json`, and GitHub workflows, you declare a project type in a `.projenrc.ts` file and let [projen](https://github.com/projen/projen) generate (and keep up to date) the whole scaffold: build files, source skeletons, CI workflows, and deploy pipelines.\n\n## Project types at a glance\n\n| Type | What it is | Publishes to | Generated workflows |\n| --- | --- | --- | --- |\n| `CdkInfraProject` | Pure-infrastructure CDK stacks (CloudFront, Route53, SQS, API Gateway, Cognito, ECR/ECS for externally-built images) | - | `build` (PR checks), `deploy` (manual dispatch) |\n| `CdkAppProject` | Full TypeScript service behind API Gateway: infra + app source + database | - | `build`, `deploy`, `app-build` (PR checks) |\n| `JavaLibraryProject` | Reusable Java library | Maven Central | `build`, `upgrade` (nightly), `publish-maven-central`, `codeindex` |\n| `JavaServiceProject` | Spring Boot service | Docker Hub | `build`, `upgrade` (nightly), `publish-docker`, `deploy-cdk` |\n| `JavaAppProject` | GUI/TUI/CLI Java application | GitHub Packages | `build`, `upgrade` (nightly), `publish-ghpackages` |\n| `GitHubActionProject` | Reusable GitHub Action or Workflow | GitHub Releases | `build`, `test-dogfood`, `sonar`, `release` |\n\nTwo foundation classes are also exported for advanced use: `CdkTypescriptProject` (shared CDK + TypeScript base for the CDK types) and `JavaMavenProject` (shared Maven base for the Java types).\n\nAll project types:\n\n- run a **drift check** in PR builds - a job that re-runs projen and fails if generated files were hand-edited. Edit `.projenrc.ts`, then run `npx projen`; never edit generated files directly.\n- use the GitHub secret `PROJEN_GITHUB_TOKEN` (a fine-grained PAT) for projen's automation. Override with `gheTokenSecret`.\n- make all publishing/deploying **manual** (workflow_dispatch) rather than on every merge.\n\n## Getting started\n\nScaffold the repo with projen's own bootstrap, pointed at this package:\n\n```bash\nmkdir my-project && cd my-project\ngit init\nnpx projen new --from @xpertss/projen-types cdk_infra --name my-project\n```\n\nThat writes a starter `.projenrc.ts`, synthesizes the whole scaffold and\ninstalls dependencies. The type names `projen new` accepts are `cdk_infra`,\n`cdk_app`, `java_library`, `java_service`, `java_app` and\n`git_hub_action`; pass a bogus one to have it list them. Required options\nbecome flags: `--name` for every type, plus `--group-id`/`--artifact-id`\n(Java) and `--sonar-host-url` (`git_hub_action`). Any other plainly-typed\noption can be passed the same way - `--cdk-deploy-target-repo owner/repo`,\n`--docker-registry ghcr.io`, `--no-use-flyway`, and so on.\n\nCommit the result. From then on, every change to the scaffold goes through\n`.projenrc.ts` followed by `npx projen`:\n\n```bash\nnpx projen\n```\n\nEvery type scaffolds from that one command; no option is *required* that\n`projen new` cannot pass. The structured options - `environments` and\n`GitHubActionProject`'s `dogfood` - are ones projen's CLI cannot render\ninto a projenrc, so they are added afterwards by editing `.projenrc.ts` and\nre-running `npx projen`. Leaving `environments` out simply generates no\ndeploy workflow; leaving `dogfood` out (or a service's\n`cdkDeployTargetRepo`) still generates the workflow, with one step that\nfails and tells you what to add - a gate this package considers load-bearing\nis allowed to be missing loudly, never silently.\n\nThe `name` option must match the `name` field in the project's `package.json` (for the CDK types) or the project name used by projen's `java.JavaProject` (for the Java types).\n\n## Examples\n\n### CdkInfraProject\n\nPure infrastructure stacks with optional ECR/ECS and edge-networking constructs.\n\n```typescript\n// .projenrc.ts\nimport { CdkInfraProject } from '@xpertss/projen-types';\n\nconst project = new CdkInfraProject({\n  name: 'media-edge-infra',\n  environments: [\n    'dev',\n    { name: 'stage', accountId: '111111111111', region: 'eu-central-1' },\n    { name: 'prod', accountId: '222222222222', region: 'eu-central-1', requiresApproval: true },\n  ],\n  edgeResources: ['cloudfront', 'route53', 'sqs'],\n  ecrEcs: { enabled: true, externalImageSource: true },\n  slackWebhookSecret: 'SLACK_DEPLOY_WEBHOOK',\n});\n\nproject.synth();\n```\n\nYou get:\n\n- `cdk.json`, `cdk synth` / `cdk diff` / `cdk deploy` tasks, and the standard `AwsCdkTypeScriptApp` layout (CDK 2.189.1 by default).\n- `.github/workflows/build.yml` - PR build that hard-fails on projen drift.\n- `.github/workflows/deploy.yml` - manual dispatch with one `deploy-<env>` job per environment (runs `cdk deploy --all` with `--context environment=<env>`); `requiresApproval` environments get a GitHub Environment approval gate; a Slack notification step is added when `slackWebhookSecret` is set.\n- `src/constructs/edge-networking.ts` - helper constructs only for the requested `edgeResources` (`cloudfront`, `route53`, `apigateway`, `cognito`, `sqs`).\n- `src/constructs/ecr-ecs.ts` when `ecrEcs.enabled` - ECR repo + Fargate service; `externalImageSource: true` (default) means the service pulls an image built outside this repo.\n\n### CdkAppProject\n\n`CdkInfraProject` plus application source, a database construct, and an app-level build workflow.\n\n```typescript\n// .projenrc.ts\nimport { CdkAppProject } from '@xpertss/projen-types';\n\nconst project = new CdkAppProject({\n  name: 'video-api',\n  environments: ['dev', 'prod'],\n  edgeResources: ['apigateway'],\n  database: { engine: 'postgres', migrationTool: 'flyway' },\n  appEntryPoint: 'src/app.ts',\n});\n\nproject.synth();\n```\n\nEverything from `CdkInfraProject`, plus:\n\n- `src/app.ts` - application entrypoint stub (`export function handler()`).\n- `src/handlers/example.ts` - API Gateway proxy handler stub, with `@types/aws-lambda` added as a dev dependency.\n- `src/constructs/database.ts` - a `Database` construct stub for the chosen engine (`postgres`/`mysql` -> RDS, `dynamodb` -> DynamoDB). `migrationTool` (no default, intentionally) is added as a dev dependency and referenced in the stub - wiring it up is left to you.\n- `.github/workflows/app-build.yml` - runs the project's test task on every PR, then checks for projen drift.\n\n### JavaLibraryProject\n\nA reusable Java library published to Maven Central.\n\n```typescript\n// .projenrc.ts\nimport { JavaLibraryProject } from '@xpertss/projen-types';\n\nconst project = new JavaLibraryProject({\n  name: 'common-utils',\n  groupId: 'org.xpertss',\n  artifactId: 'common-utils',\n  version: '1.0.0',\n  sonarProjectKey: 'org.xpertss:common-utils',\n  mavenCentralOidc: true,\n});\n\nproject.synth();\n```\n\nYou get:\n\n- `pom.xml` (via projen's `java.JavaProject`) with the given GAV coordinates.\n- `.github/workflows/build.yml` - PR build + projen drift check, plus a SonarQube scan step when `sonarProjectKey` is set (needs a `SONAR_TOKEN` secret).\n- `.github/workflows/upgrade.yml` - nightly (03:00 UTC) PR running `mvn versions:use-latest-releases versions:update-properties`.\n- `.github/workflows/publish-maven-central.yml` - manual dispatch running `mvn -B deploy -P release`. With `mavenCentralOidc: true` it uses Maven Central's OIDC trusted publishing (no GPG secrets needed); otherwise it expects the secrets `MAVEN_GPG_PRIVATE_KEY`, `MAVEN_GPG_PASSPHRASE`, `MAVEN_CENTRAL_USERNAME`, `MAVEN_CENTRAL_PASSWORD`.\n- `.github/workflows/codeindex.yml` - on push to `main`, generates a Java source index under `.cai/` (disable with `publishCodeIndex: false`).\n\n### JavaServiceProject\n\nA Spring Boot service that publishes a Docker image and can trigger deploys in a companion CDK repo.\n\n```typescript\n// .projenrc.ts\nimport { JavaServiceProject } from '@xpertss/projen-types';\n\nconst project = new JavaServiceProject({\n  name: 'stream-processor',\n  groupId: 'org.xpertss',\n  artifactId: 'stream-processor',\n  dockerRegistry: 'docker.io/xpertss',\n  cdkDeployTargetRepo: 'xpertss/stream-infra',\n  environments: ['dev', { name: 'prod', requiresApproval: true }],\n});\n\nproject.synth();\n```\n\nYou get (everything from `JavaMavenProject` - `pom.xml`, `build` + drift check, nightly `upgrade` - plus):\n\n- `spring-boot-starter-web` added to the pom.\n- `.github/workflows/publish-docker.yml` - manual dispatch: `mvn -B package && docker build -t <registry>/<name>:<sha>`, logged in with the `DOCKER_USERNAME` / `DOCKER_PASSWORD` secrets. `dockerRegistry` defaults to `docker.io`.\n- Flyway wiring when `useFlyway` (default `true`): `flyway-maven-plugin` ^10 + `flyway-core` ^10 in the pom, and `src/main/resources/db/migration/V1__init.sql`.\n- `.github/workflows/deploy-cdk.yml` (the `CdkDeployHook`, generated by default) - manual dispatch with an environment selector; each job sends a `workflow_dispatch` to `deploy.yml` in the companion `cdkDeployTargetRepo` (a `CdkInfraProject`/`CdkAppProject` repo). With no `cdkDeployTargetRepo` set, the workflow is still generated but each job's only step fails with instructions - it is dispatch-only, so that lands on whoever tries to deploy rather than on every PR. Turn the workflow off entirely with `cdkDeployHook: false`. `environments` defaults to `['prod']`.\n\n### JavaAppProject\n\nA GUI/TUI/CLI Java application published to GitHub Packages only - no Maven Central, no Docker, no CDK deploy hook.\n\n```typescript\n// .projenrc.ts\nimport { JavaAppProject } from '@xpertss/projen-types';\n\nconst project = new JavaAppProject({\n  name: 'studio-cli',\n  groupId: 'org.xpertss',\n  artifactId: 'studio-cli',\n  ghPackagesRegistry: 'https://maven.pkg.github.com/xpertss/studio-cli',\n});\n\nproject.synth();\n```\n\nYou get everything from `JavaMavenProject`, plus `.github/workflows/publish-ghpackages.yml` - manual dispatch running `mvn -B deploy -DaltDeploymentRepository=github::<registry>`, authenticated with `GITHUB_TOKEN`. `ghPackagesRegistry` defaults to `https://maven.pkg.github.com/<repo>` derived from the repository URL.\n\n### GitHubActionProject\n\nA reusable GitHub Action or Workflow. This example scaffolds an action that stages a folder and, only if it changed, commits and pushes it.\n\n```typescript\n// .projenrc.ts\nimport { GitHubActionProject } from '@xpertss/projen-types';\n\nconst project = new GitHubActionProject({\n  name: 'auto-commit',\n  description: 'Stage a folder and, only if it changed, commit and push it',\n  sonarHostUrl: 'https://sonar.xpertss.org',   // required, no default - your self-hosted SonarQube\n  dogfood: {\n    // Two scenario steps: the \"changed\" path and the \"no-op\" path are both\n    // load-bearing behavior for this action (a double-commit or a\n    // push-when-empty bug is the failure mode a hand-rolled inline-shell\n    // alternative is most likely to introduce).\n    scenario: [\n      {\n        name: 'Changed path',\n        fixtureSteps: [\n          'echo \"$(date -u +%Y%m%dT%H%M%SZ)\" >> test/fixtures/dogfood-state.txt',\n        ],\n        inputs: {\n          commit_message: 'test: dogfood',\n          branches: 'test/dogfood',\n        },\n        assertions: [\n          // step id defaults to a slug of `name` - here \"changed-path-0\"\n          '[ \"${{ steps.changed-path-0.outputs.committed }}\" = \"true\" ]',\n        ],\n      },\n      {\n        // No fixture change this time - nothing new to commit.\n        name: 'No-op path',\n        id: 'no-op-check',            // pin an explicit id instead of relying on the default slug\n        inputs: {\n          commit_message: 'test: dogfood',\n          branches: 'test/dogfood',\n        },\n        assertions: [\n          '[ \"${{ steps.no-op-check.outputs.committed }}\" = \"false\" ]',\n        ],\n      },\n    ],\n    cleanup: [\n      'git push origin --delete test/dogfood || true',\n    ],\n  },\n});\n\nproject.synth();\n```\n\nYou get:\n\n- `action.yml` and `auto-commit.sh` are hand-written - this type only lints their content via `build.yml`'s shellcheck/yamllint/actionlint checks.\n- `.github/workflows/build.yml` - lint gate: `apt`-installed shellcheck/yamllint plus a pinned, SHA-256-verified `actionlint` release binary. Gates `main` alongside `sonar.yml`.\n- `.github/workflows/test-dogfood.yml` - runs the `dogfood.scenario` steps above against this repo's own `action.yml` (via `uses: .`), then the shared `cleanup`, on `workflow_dispatch`, every `pull_request`, and nightly. Omit `dogfood` and the workflow still exists, with one step that fails on every PR until you declare a scenario - AD-001 allows a dogfood to be missing loudly, never silently. A *partial* `dogfood` (a scenario with no cleanup) is a synth error.\n- `.github/workflows/sonar.yml` - self-hosted SonarQube via the Scanner CLI, scanning `action.yml`/`.github/workflows/**`/`**/*.sh` explicitly.\n- `.github/workflows/release.yml` - `feat:`/`fix:` commits on `main` bump the version, tag `vX.Y.Z`, and create a GitHub Release.\n- `.github/workflows/projen-drift-check.yml`, `workflow-change-notice.yml`, `actions-allowlist-guard.yml` - drift detection, a change notice, and an action allow-list guard, always included.\n- `package.json` (**private**, version source only), `.yamllint`, `LICENSE` (MIT by default), and a `README.md` template - all regenerated by `npx projen`.\n\nNeeds the same two secrets as everything else in this package: `PROJEN_GITHUB_TOKEN` (used for automated PR comments) and `SONAR_TOKEN` (the Sonar scan). Onboard a brand-new action repo following [Getting started](#getting-started), write the `.projenrc.ts` above, then hand-write `action.yml`/`auto-commit.sh`/`test/fixtures/`.\n\n## Common options\n\nCDK project types (`CdkInfraProjectOptions` / `CdkAppProjectOptions`):\n\n| Option | Default | Description |\n| --- | --- | --- |\n| `name` | - (required) | Project name; must match `package.json` |\n| `cdkVersion` | `2.189.1` | AWS CDK version |\n| `gheTokenSecret` | `PROJEN_GITHUB_TOKEN` | GitHub secret holding projen's PAT |\n| `slackWebhookSecret` | - | GitHub secret with a Slack webhook URL for deploy notifications |\n| `environments` | - (no `deploy` workflow) | Deploy targets for the `deploy` workflow; strings or `EnvironmentOptions` |\n| `ecrEcs` | - | `EcrEcsOptions` - `enabled`, `externalImageSource` (default `true`) |\n| `edgeResources` | - | Subset of `cloudfront`, `route53`, `apigateway`, `cognito`, `sqs` |\n| `database` | - (app only) | `DatabaseOptions` - `engine` (`postgres`/`mysql`/`dynamodb`, default `postgres`), `migrationTool` |\n| `appEntryPoint` | `src/app.ts` (app only) | Path of the generated application entrypoint |\n\nJava project types (`JavaLibraryProjectOptions` / `JavaServiceProjectOptions` / `JavaAppProjectOptions`):\n\n| Option | Default | Description |\n| --- | --- | --- |\n| `name` | - (required) | Project name |\n| `groupId` | - (required) | Maven group id |\n| `artifactId` | - (required) | Maven artifact id |\n| `version` | `0.1.0` | Maven version |\n| `sonarProjectKey` | - | SonarQube project key; the sonar step is skipped when unset |\n| `gheTokenSecret` | `PROJEN_GITHUB_TOKEN` | GitHub secret holding projen's PAT |\n| `cdkDeployTargetRepo` | - (service only; `deploy-cdk.yml` fails until set) | Companion CDK repo (`owner/repo`) whose `deploy.yml` the deploy hook dispatches |\n| `cdkDeployHook` | `true` (service only) | Whether to generate `deploy-cdk.yml` at all |\n| `dockerRegistry` | `docker.io` (service only) | Registry the Docker image is pushed to |\n| `useFlyway` | `true` (service only) | Flyway plugin/dependency + `V1__init.sql` |\n\n`EnvironmentOptions` for deploy targets:\n\n```text\ninterface EnvironmentOptions {\n  readonly name: string;              // e.g. \"dev\", \"stage\", \"prod\"\n  readonly accountId?: string;        // AWS account id (CDK deploys)\n  readonly region?: string;           // AWS region (CDK deploys)\n  readonly requiresApproval?: boolean; // GitHub Environment approval gate (default false)\n}\n```\n\nPlain strings (`'dev'`) are shorthand for `{ name: 'dev' }`.\n\n`GitHubActionProjectOptions`:\n\n| Option | Default | Description |\n| --- | --- | --- |\n| `name` | - (required) | Project name |\n| `description` | - | One-line description; used in the default README template and recorded in the private `package.json` |\n| `sonarHostUrl` | - (required) | URL of your self-hosted SonarQube instance; must be reachable from github.com-hosted runners |\n| `sonarTokenSecret` | `SONAR_TOKEN` | GitHub secret holding the Sonar token |\n| `sonarPullRequestGate` | `true` | Whether `sonar.yml` also runs on `pull_request` as a pass/fail gate |\n| `dogfood` | - (a `test-dogfood.yml` that fails until you declare one) | `ActionDogfoodOptions` - the scenario that exercises the action end-to-end via `uses: .` |\n| `license` | `MIT` | SPDX identifier for the generated `LICENSE` |\n| `gheTokenSecret` | `PROJEN_GITHUB_TOKEN` | GitHub secret holding projen's PAT |\n\n`ActionDogfoodOptions`/`ActionDogfoodStep` - the dogfood scenario (`test-dogfood.yml`):\n\n```text\ninterface ActionDogfoodOptions {\n  readonly scenario: ActionDogfoodStep[]; // one or more, run in order - required\n  readonly cleanup: string[];             // shared, run once at the end with `if: always()` - required\n}\n\ninterface ActionDogfoodStep {\n  readonly name: string;                    // labels this step-group's generated workflow steps\n  readonly id?: string;                     // step id for the `uses: .` call; default: a slug of `name`\n  readonly fixtureSteps?: string[];         // shell, before the invocation (default: none)\n  readonly inputs?: Record<string, string>; // `with:` for this invocation (default: none)\n  readonly assertions: string[];            // shell, after the invocation - required, job fails unless all exit 0\n}\n```\n\nMost actions need exactly one `scenario` step. Actions with a re-run/no-op/idempotency behavior to verify (e.g. `auto-commit`'s no-op-on-no-change path, `create-pull-request`'s reuse-the-PR path) declare two - the second typically omits `fixtureSteps` so its invocation sees no new state, and its assertion checks the opposite outcome of the first. Reference an invocation's own outputs from a later assertion via `${{ steps.<id>.outputs.<name> }}`, using either the default slug or an explicit `id`.\n\n## Required GitHub secrets\n\n| Secret | Used by | Notes |\n| --- | --- | --- |\n| `PROJEN_GITHUB_TOKEN` | all types | PAT for projen's self-mutation/automation; override via `gheTokenSecret` |\n| `SONAR_TOKEN` | Java types with `sonarProjectKey`; `GitHubActionProject` | SonarQube scan step in `build.yml` / `sonar.yml`; override via `sonarTokenSecret` on `GitHubActionProject` |\n| `DOCKER_USERNAME` / `DOCKER_PASSWORD` | `JavaServiceProject` | Docker image push |\n| `MAVEN_GPG_PRIVATE_KEY`, `MAVEN_GPG_PASSPHRASE`, `MAVEN_CENTRAL_USERNAME`, `MAVEN_CENTRAL_PASSWORD` | `JavaLibraryProject` without `mavenCentralOidc` | Not needed with OIDC trusted publishing |\n| (your Slack webhook secret) | CDK types with `slackWebhookSecret` | Deploy notifications |\n\n## Going further\n\nThe project types are composed from smaller components you can also attach to your own projects:\n\n| Component | Applies to | Purpose |\n| --- | --- | --- |\n| `AppRuntimeScaffold` | `NodeProject` | App source skeleton (`app.ts` + handlers) |\n| `DatabaseComponent` | `NodeProject` | Database construct stub + migration tool wiring |\n| `EcrEcsConstructs` | `Project` | ECR + Fargate ECS construct helper |\n| `EdgeNetworkingConstructs` | `Project` | Per-resource edge networking construct helpers |\n| `MavenCentralPublish` | `JavaProject` | Manual-dispatch Maven Central publish workflow |\n| `DockerPublish` | `JavaProject` | Manual-dispatch Docker build+push workflow |\n| `GitHubPackagesPublish` | `JavaProject` | Manual-dispatch GitHub Packages publish workflow |\n| `FlywayMigration` | `JavaProject` | Flyway plugin/dependency + migrations directory |\n| `CdkDeployHook` | `JavaProject` | Manual-dispatch workflow that triggers `deploy.yml` in a companion CDK repo |\n| `CodeIndexWorkflow` | `JavaProject` | Code index generation on push to `main` |\n| `ActionBuildWorkflow` | `GitHubProject` | The `lint` task (shellcheck/yamllint/pinned actionlint) + `build.yml` |\n| `ActionDogfoodWorkflow` | `GitHubProject` | `test-dogfood.yml` from an `ActionDogfoodOptions` scenario |\n| `ActionSonarWorkflow` | `GitHubProject` | `sonar.yml` (self-hosted SonarQube via the Scanner CLI) |\n\nExample - adding a Docker publish to a plain projen `JavaProject`:\n\n```typescript\nimport { java } from 'projen';\nimport { DockerPublish } from '@xpertss/projen-types';\n\nconst project = new java.JavaProject({\n  name: 'my-service',\n  groupId: 'org.xpertss',\n  artifactId: 'my-service',\n});\n\nnew DockerPublish(project, { dockerRegistry: 'ghcr.io' });\n\nproject.synth();\n```\n\nThe full API reference, including every option and property, is in [API.md](./API.md).\n"
+    "markdown": "# @xpertss/projen-types\n\nProjen project types for CDK/TypeScript and Java/Maven projects.\n\nInstead of hand-maintaining `pom.xml`, `cdk.json`, and GitHub workflows, you declare a project type in a `.projenrc.ts` file and let [projen](https://github.com/projen/projen) generate (and keep up to date) the whole scaffold: build files, source skeletons, CI workflows, and deploy pipelines.\n\n## Project types at a glance\n\n| Type | What it is | Publishes to | Generated workflows |\n| --- | --- | --- | --- |\n| `CdkInfraProject` | Pure-infrastructure CDK stacks (CloudFront, Route53, SQS, API Gateway, Cognito, ECR/ECS for externally-built images) | - | `build` (PR checks), `deploy` (manual dispatch) |\n| `CdkAppProject` | Full TypeScript service behind API Gateway: infra + app source + database | - | `build`, `deploy`, `app-build` (PR checks) |\n| `JavaLibraryProject` | Reusable Java library | Maven Central | `build`, `upgrade` (nightly), `publish-maven-central`, `codeindex` |\n| `JavaServiceProject` | Spring Boot service | Docker Hub | `build`, `upgrade` (nightly), `publish-docker`, `deploy-cdk` |\n| `JavaAppProject` | GUI/TUI/CLI Java application | GitHub Packages | `build`, `upgrade` (nightly), `publish-ghpackages` |\n| `GitHubActionProject` | Reusable GitHub Action or Workflow | GitHub Releases | `build`, `test-dogfood`, `sonar`, `release` |\n\nTwo foundation classes are also exported for advanced use: `CdkTypescriptProject` (shared CDK + TypeScript base for the CDK types) and `JavaMavenProject` (shared Maven base for the Java types).\n\nAll project types:\n\n- run a **drift check** in PR builds - a job that re-runs projen and fails if generated files were hand-edited. Edit `.projenrc.ts`, then run `npx projen`; never edit generated files directly.\n- use the GitHub secret `PROJEN_GITHUB_TOKEN` (a fine-grained PAT) for projen's automation. Override with `gheTokenSecret`.\n- make all publishing/deploying **manual** (workflow_dispatch) rather than on every merge.\n\n## Getting started\n\nScaffold the repo with projen's own bootstrap, pointed at this package:\n\n```bash\nmkdir my-project && cd my-project\ngit init\nnpx projen new --from @xpertss/projen-types cdk_infra --name my-project\n```\n\nThat writes a starter `.projenrc.ts`, synthesizes the whole scaffold and\ninstalls dependencies. The type names `projen new` accepts are `cdk_infra`,\n`cdk_app`, `java_library`, `java_service`, `java_app` and\n`git_hub_action`; pass a bogus one to have it list them. Required options\nbecome flags: `--name` for every type, plus `--group-id`/`--artifact-id`\n(Java) and `--sonar-host-url` (`git_hub_action`). Any other plainly-typed\noption can be passed the same way - `--cdk-deploy-target-repo owner/repo`,\n`--docker-registry ghcr.io`, `--no-use-flyway`, and so on.\n\nCommit the result. From then on, every change to the scaffold goes through\n`.projenrc.ts` followed by `npx projen`:\n\n```bash\nnpx projen\n```\n\nEvery type scaffolds from that one command; no option is *required* that\n`projen new` cannot pass. The structured options - `environments` and\n`GitHubActionProject`'s `dogfood` - are ones projen's CLI cannot render\ninto a projenrc, so they are added afterwards by editing `.projenrc.ts` and\nre-running `npx projen`. Leaving `environments` out simply generates no\ndeploy workflow; leaving `dogfood` out (or a service's\n`cdkDeployTargetRepo`) still generates the workflow, with one step that\nfails and tells you what to add - a gate this package considers load-bearing\nis allowed to be missing loudly, never silently.\n\nThe `name` option must match the `name` field in the project's `package.json` (for the CDK types) or the project name used by projen's `java.JavaProject` (for the Java types).\n\n## Updating an existing project when this package changes\n\nYour generated scaffold reflects the *installed* version of `@xpertss/projen-types` - `npx projen` reads your project type from the package in `node_modules`, not from this repository. So when this package ships a change (a bug fix, a new generated file, or altered workflow behavior), an existing project picks it up by bumping the dependency and re-synthesizing. A stale `node_modules` silently regenerates with the old behavior, so the bump is the load-bearing step.\n\nUsing the [`auto-commit` action](#githubactionproject) as a running example, say a new release adds the `# Purpose:` workflow header and SonarCloud wording. In the `auto-commit` repo:\n\n```bash\nnpm view @xpertss/projen-types version        # what's the newest release?\nnpm i -D @xpertss/projen-types@latest         # bump the installed project type\nnpx projen                                    # re-synthesize every generated file\ngit diff                                      # review before committing\n```\n\nThe diff here is the workflows gaining a `# Purpose:` comment and `sonar.yml` reflecting the SonarCloud wording. Commit the result with a normal `chore:` or `fix:` message - you never hand-edit the generated files themselves.\n\n## Examples\n\n### CdkInfraProject\n\nPure infrastructure stacks with optional ECR/ECS and edge-networking constructs.\n\n```typescript\n// .projenrc.ts\nimport { CdkInfraProject } from '@xpertss/projen-types';\n\nconst project = new CdkInfraProject({\n  name: 'media-edge-infra',\n  environments: [\n    'dev',\n    { name: 'stage', accountId: '111111111111', region: 'eu-central-1' },\n    { name: 'prod', accountId: '222222222222', region: 'eu-central-1', requiresApproval: true },\n  ],\n  edgeResources: ['cloudfront', 'route53', 'sqs'],\n  ecrEcs: { enabled: true, externalImageSource: true },\n  slackWebhookSecret: 'SLACK_DEPLOY_WEBHOOK',\n});\n\nproject.synth();\n```\n\nYou get:\n\n- `cdk.json`, `cdk synth` / `cdk diff` / `cdk deploy` tasks, and the standard `AwsCdkTypeScriptApp` layout (CDK 2.189.1 by default).\n- `.github/workflows/build.yml` - PR build that hard-fails on projen drift.\n- `.github/workflows/deploy.yml` - manual dispatch with one `deploy-<env>` job per environment (runs `cdk deploy --all` with `--context environment=<env>`); `requiresApproval` environments get a GitHub Environment approval gate; a Slack notification step is added when `slackWebhookSecret` is set.\n- `src/constructs/edge-networking.ts` - helper constructs only for the requested `edgeResources` (`cloudfront`, `route53`, `apigateway`, `cognito`, `sqs`).\n- `src/constructs/ecr-ecs.ts` when `ecrEcs.enabled` - ECR repo + Fargate service; `externalImageSource: true` (default) means the service pulls an image built outside this repo.\n\n### CdkAppProject\n\n`CdkInfraProject` plus application source, a database construct, and an app-level build workflow.\n\n```typescript\n// .projenrc.ts\nimport { CdkAppProject } from '@xpertss/projen-types';\n\nconst project = new CdkAppProject({\n  name: 'video-api',\n  environments: ['dev', 'prod'],\n  edgeResources: ['apigateway'],\n  database: { engine: 'postgres', migrationTool: 'flyway' },\n  appEntryPoint: 'src/app.ts',\n});\n\nproject.synth();\n```\n\nEverything from `CdkInfraProject`, plus:\n\n- `src/app.ts` - application entrypoint stub (`export function handler()`).\n- `src/handlers/example.ts` - API Gateway proxy handler stub, with `@types/aws-lambda` added as a dev dependency.\n- `src/constructs/database.ts` - a `Database` construct stub for the chosen engine (`postgres`/`mysql` -> RDS, `dynamodb` -> DynamoDB). `migrationTool` (no default, intentionally) is added as a dev dependency and referenced in the stub - wiring it up is left to you.\n- `.github/workflows/app-build.yml` - runs the project's test task on every PR, then checks for projen drift.\n\n### JavaLibraryProject\n\nA reusable Java library published to Maven Central.\n\n```typescript\n// .projenrc.ts\nimport { JavaLibraryProject } from '@xpertss/projen-types';\n\nconst project = new JavaLibraryProject({\n  name: 'common-utils',\n  groupId: 'org.xpertss',\n  artifactId: 'common-utils',\n  version: '1.0.0',\n  sonarProjectKey: 'org.xpertss:common-utils',\n  mavenCentralOidc: true,\n});\n\nproject.synth();\n```\n\nYou get:\n\n- `pom.xml` (via projen's `java.JavaProject`) with the given GAV coordinates.\n- `.github/workflows/build.yml` - PR build + projen drift check, plus a SonarQube scan step when `sonarProjectKey` is set (needs a `SONAR_TOKEN` secret).\n- `.github/workflows/upgrade.yml` - nightly (03:00 UTC) PR running `mvn versions:use-latest-releases versions:update-properties`.\n- `.github/workflows/publish-maven-central.yml` - manual dispatch running `mvn -B deploy -P release`. With `mavenCentralOidc: true` it uses Maven Central's OIDC trusted publishing (no GPG secrets needed); otherwise it expects the secrets `MAVEN_GPG_PRIVATE_KEY`, `MAVEN_GPG_PASSPHRASE`, `MAVEN_CENTRAL_USERNAME`, `MAVEN_CENTRAL_PASSWORD`.\n- `.github/workflows/codeindex.yml` - on push to `main`, generates a Java source index under `.cai/` (disable with `publishCodeIndex: false`).\n\n### JavaServiceProject\n\nA Spring Boot service that publishes a Docker image and can trigger deploys in a companion CDK repo.\n\n```typescript\n// .projenrc.ts\nimport { JavaServiceProject } from '@xpertss/projen-types';\n\nconst project = new JavaServiceProject({\n  name: 'stream-processor',\n  groupId: 'org.xpertss',\n  artifactId: 'stream-processor',\n  dockerRegistry: 'docker.io/xpertss',\n  cdkDeployTargetRepo: 'xpertss/stream-infra',\n  environments: ['dev', { name: 'prod', requiresApproval: true }],\n});\n\nproject.synth();\n```\n\nYou get (everything from `JavaMavenProject` - `pom.xml`, `build` + drift check, nightly `upgrade` - plus):\n\n- `spring-boot-starter-web` added to the pom.\n- `.github/workflows/publish-docker.yml` - manual dispatch: `mvn -B package && docker build -t <registry>/<name>:<sha>`, logged in with the `DOCKER_USERNAME` / `DOCKER_PASSWORD` secrets. `dockerRegistry` defaults to `docker.io`.\n- Flyway wiring when `useFlyway` (default `true`): `flyway-maven-plugin` ^10 + `flyway-core` ^10 in the pom, and `src/main/resources/db/migration/V1__init.sql`.\n- `.github/workflows/deploy-cdk.yml` (the `CdkDeployHook`, generated by default) - manual dispatch with an environment selector; each job sends a `workflow_dispatch` to `deploy.yml` in the companion `cdkDeployTargetRepo` (a `CdkInfraProject`/`CdkAppProject` repo). With no `cdkDeployTargetRepo` set, the workflow is still generated but each job's only step fails with instructions - it is dispatch-only, so that lands on whoever tries to deploy rather than on every PR. Turn the workflow off entirely with `cdkDeployHook: false`. `environments` defaults to `['prod']`.\n\n### JavaAppProject\n\nA GUI/TUI/CLI Java application published to GitHub Packages only - no Maven Central, no Docker, no CDK deploy hook.\n\n```typescript\n// .projenrc.ts\nimport { JavaAppProject } from '@xpertss/projen-types';\n\nconst project = new JavaAppProject({\n  name: 'studio-cli',\n  groupId: 'org.xpertss',\n  artifactId: 'studio-cli',\n  ghPackagesRegistry: 'https://maven.pkg.github.com/xpertss/studio-cli',\n});\n\nproject.synth();\n```\n\nYou get everything from `JavaMavenProject`, plus `.github/workflows/publish-ghpackages.yml` - manual dispatch running `mvn -B deploy -DaltDeploymentRepository=github::<registry>`, authenticated with `GITHUB_TOKEN`. `ghPackagesRegistry` defaults to `https://maven.pkg.github.com/<repo>` derived from the repository URL.\n\n### GitHubActionProject\n\nA reusable GitHub Action or Workflow. This example scaffolds an action that stages a folder and, only if it changed, commits and pushes it.\n\n```typescript\n// .projenrc.ts\nimport { GitHubActionProject } from '@xpertss/projen-types';\n\nconst project = new GitHubActionProject({\n  name: 'auto-commit',\n  description: 'Stage a folder and, only if it changed, commit and push it',\n  sonarHostUrl: 'https://sonarcloud.io',       // required, no default - your SonarCloud URL\n  dogfood: {\n    // Two scenario steps: the \"changed\" path and the \"no-op\" path are both\n    // load-bearing behavior for this action (a double-commit or a\n    // push-when-empty bug is the failure mode a hand-rolled inline-shell\n    // alternative is most likely to introduce).\n    scenario: [\n      {\n        name: 'Changed path',\n        fixtureSteps: [\n          'echo \"$(date -u +%Y%m%dT%H%M%SZ)\" >> test/fixtures/dogfood-state.txt',\n        ],\n        inputs: {\n          commit_message: 'test: dogfood',\n          branches: 'test/dogfood',\n        },\n        assertions: [\n          // step id defaults to a slug of `name` - here \"changed-path-0\"\n          '[ \"${{ steps.changed-path-0.outputs.committed }}\" = \"true\" ]',\n        ],\n      },\n      {\n        // No fixture change this time - nothing new to commit.\n        name: 'No-op path',\n        id: 'no-op-check',            // pin an explicit id instead of relying on the default slug\n        inputs: {\n          commit_message: 'test: dogfood',\n          branches: 'test/dogfood',\n        },\n        assertions: [\n          '[ \"${{ steps.no-op-check.outputs.committed }}\" = \"false\" ]',\n        ],\n      },\n    ],\n    cleanup: [\n      'git push origin --delete test/dogfood || true',\n    ],\n  },\n});\n\nproject.synth();\n```\n\nYou get:\n\n- `action.yml` and `auto-commit.sh` are hand-written - this type only lints their content via `build.yml`'s shellcheck/yamllint/actionlint checks.\n- `.github/workflows/build.yml` - lint gate: `apt`-installed shellcheck/yamllint plus a pinned, SHA-256-verified `actionlint` release binary. Gates `main` alongside `sonar.yml`.\n- `.github/workflows/test-dogfood.yml` - runs the `dogfood.scenario` steps above against this repo's own `action.yml` (via `uses: .`), then the shared `cleanup`, on `workflow_dispatch`, every `pull_request`, and nightly. Omit `dogfood` and the workflow still exists, with one step that fails on every PR until you declare a scenario - AD-001 allows a dogfood to be missing loudly, never silently. A *partial* `dogfood` (a scenario with no cleanup) is a synth error.\n- `.github/workflows/sonar.yml` - SonarCloud scan via the Scanner CLI (the quality gate blocks the PR), scanning `action.yml`/`.github/workflows/**`/`**/*.sh` explicitly.\n- `.github/workflows/release.yml` - `feat:`/`fix:` commits on `main` bump the version, tag `vX.Y.Z`, and create a GitHub Release.\n- `.github/workflows/projen-drift-check.yml` and `workflow-change-notice.yml` - drift detection and a change notice, always included.\n- `package.json` (**private**, version source only), `.yamllint`, `LICENSE` (MIT by default), and a `README.md` template - all regenerated by `npx projen`.\n\nNeeds the same two secrets as everything else in this package: `PROJEN_GITHUB_TOKEN` (used for automated PR comments) and `SONAR_TOKEN` (the Sonar scan). Onboard a brand-new action repo following [Getting started](#getting-started), write the `.projenrc.ts` above, then hand-write `action.yml`/`auto-commit.sh`/`test/fixtures/`.\n\n## Common options\n\nCDK project types (`CdkInfraProjectOptions` / `CdkAppProjectOptions`):\n\n| Option | Default | Description |\n| --- | --- | --- |\n| `name` | - (required) | Project name; must match `package.json` |\n| `cdkVersion` | `2.189.1` | AWS CDK version |\n| `gheTokenSecret` | `PROJEN_GITHUB_TOKEN` | GitHub secret holding projen's PAT |\n| `slackWebhookSecret` | - | GitHub secret with a Slack webhook URL for deploy notifications |\n| `environments` | - (no `deploy` workflow) | Deploy targets for the `deploy` workflow; strings or `EnvironmentOptions` |\n| `ecrEcs` | - | `EcrEcsOptions` - `enabled`, `externalImageSource` (default `true`) |\n| `edgeResources` | - | Subset of `cloudfront`, `route53`, `apigateway`, `cognito`, `sqs` |\n| `database` | - (app only) | `DatabaseOptions` - `engine` (`postgres`/`mysql`/`dynamodb`, default `postgres`), `migrationTool` |\n| `appEntryPoint` | `src/app.ts` (app only) | Path of the generated application entrypoint |\n\nJava project types (`JavaLibraryProjectOptions` / `JavaServiceProjectOptions` / `JavaAppProjectOptions`):\n\n| Option | Default | Description |\n| --- | --- | --- |\n| `name` | - (required) | Project name |\n| `groupId` | - (required) | Maven group id |\n| `artifactId` | - (required) | Maven artifact id |\n| `version` | `0.1.0` | Maven version |\n| `sonarProjectKey` | - | SonarQube project key; the sonar step is skipped when unset |\n| `gheTokenSecret` | `PROJEN_GITHUB_TOKEN` | GitHub secret holding projen's PAT |\n| `cdkDeployTargetRepo` | - (service only; `deploy-cdk.yml` fails until set) | Companion CDK repo (`owner/repo`) whose `deploy.yml` the deploy hook dispatches |\n| `cdkDeployHook` | `true` (service only) | Whether to generate `deploy-cdk.yml` at all |\n| `dockerRegistry` | `docker.io` (service only) | Registry the Docker image is pushed to |\n| `useFlyway` | `true` (service only) | Flyway plugin/dependency + `V1__init.sql` |\n\n`EnvironmentOptions` for deploy targets:\n\n```text\ninterface EnvironmentOptions {\n  readonly name: string;              // e.g. \"dev\", \"stage\", \"prod\"\n  readonly accountId?: string;        // AWS account id (CDK deploys)\n  readonly region?: string;           // AWS region (CDK deploys)\n  readonly requiresApproval?: boolean; // GitHub Environment approval gate (default false)\n}\n```\n\nPlain strings (`'dev'`) are shorthand for `{ name: 'dev' }`.\n\n`GitHubActionProjectOptions`:\n\n| Option | Default | Description |\n| --- | --- | --- |\n| `name` | - (required) | Project name |\n| `description` | - | One-line description; used in the default README template and recorded in the private `package.json` |\n| `sonarHostUrl` | - (required) | URL of your SonarCloud instance (e.g. `https://sonarcloud.io`); must be reachable from github.com-hosted runners |\n| `sonarTokenSecret` | `SONAR_TOKEN` | GitHub secret holding the Sonar token |\n| `sonarPullRequestGate` | `true` | Whether `sonar.yml` also runs on `pull_request` as a pass/fail gate |\n| `dogfood` | - (a `test-dogfood.yml` that fails until you declare one) | `ActionDogfoodOptions` - the scenario that exercises the action end-to-end via `uses: .` |\n| `license` | `MIT` | SPDX identifier for the generated `LICENSE` |\n| `gheTokenSecret` | `PROJEN_GITHUB_TOKEN` | GitHub secret holding projen's PAT |\n\n`ActionDogfoodOptions`/`ActionDogfoodStep` - the dogfood scenario (`test-dogfood.yml`):\n\n```text\ninterface ActionDogfoodOptions {\n  readonly scenario: ActionDogfoodStep[]; // one or more, run in order - required\n  readonly cleanup: string[];             // shared, run once at the end with `if: always()` - required\n}\n\ninterface ActionDogfoodStep {\n  readonly name: string;                    // labels this step-group's generated workflow steps\n  readonly id?: string;                     // step id for the `uses: .` call; default: a slug of `name`\n  readonly fixtureSteps?: string[];         // shell, before the invocation (default: none)\n  readonly inputs?: Record<string, string>; // `with:` for this invocation (default: none)\n  readonly assertions: string[];            // shell, after the invocation - required, job fails unless all exit 0\n}\n```\n\nMost actions need exactly one `scenario` step. Actions with a re-run/no-op/idempotency behavior to verify (e.g. `auto-commit`'s no-op-on-no-change path, `create-pull-request`'s reuse-the-PR path) declare two - the second typically omits `fixtureSteps` so its invocation sees no new state, and its assertion checks the opposite outcome of the first. Reference an invocation's own outputs from a later assertion via `${{ steps.<id>.outputs.<name> }}`, using either the default slug or an explicit `id`.\n\n## Required GitHub secrets\n\n| Secret | Used by | Notes |\n| --- | --- | --- |\n| `PROJEN_GITHUB_TOKEN` | all types | PAT for projen's self-mutation/automation; override via `gheTokenSecret` |\n| `SONAR_TOKEN` | Java types with `sonarProjectKey`; `GitHubActionProject` | SonarQube scan step in `build.yml` / `sonar.yml`; override via `sonarTokenSecret` on `GitHubActionProject` |\n| `DOCKER_USERNAME` / `DOCKER_PASSWORD` | `JavaServiceProject` | Docker image push |\n| `MAVEN_GPG_PRIVATE_KEY`, `MAVEN_GPG_PASSPHRASE`, `MAVEN_CENTRAL_USERNAME`, `MAVEN_CENTRAL_PASSWORD` | `JavaLibraryProject` without `mavenCentralOidc` | Not needed with OIDC trusted publishing |\n| (your Slack webhook secret) | CDK types with `slackWebhookSecret` | Deploy notifications |\n\n## Going further\n\nThe project types are composed from smaller components you can also attach to your own projects:\n\n| Component | Applies to | Purpose |\n| --- | --- | --- |\n| `AppRuntimeScaffold` | `NodeProject` | App source skeleton (`app.ts` + handlers) |\n| `DatabaseComponent` | `NodeProject` | Database construct stub + migration tool wiring |\n| `EcrEcsConstructs` | `Project` | ECR + Fargate ECS construct helper |\n| `EdgeNetworkingConstructs` | `Project` | Per-resource edge networking construct helpers |\n| `MavenCentralPublish` | `JavaProject` | Manual-dispatch Maven Central publish workflow |\n| `DockerPublish` | `JavaProject` | Manual-dispatch Docker build+push workflow |\n| `GitHubPackagesPublish` | `JavaProject` | Manual-dispatch GitHub Packages publish workflow |\n| `FlywayMigration` | `JavaProject` | Flyway plugin/dependency + migrations directory |\n| `CdkDeployHook` | `JavaProject` | Manual-dispatch workflow that triggers `deploy.yml` in a companion CDK repo |\n| `CodeIndexWorkflow` | `JavaProject` | Code index generation on push to `main` |\n| `ActionBuildWorkflow` | `GitHubProject` | The `lint` task (shellcheck/yamllint/pinned actionlint) + `build.yml` |\n| `ActionDogfoodWorkflow` | `GitHubProject` | `test-dogfood.yml` from an `ActionDogfoodOptions` scenario |\n| `ActionSonarWorkflow` | `GitHubProject` | `sonar.yml` (SonarCloud scan via the Scanner CLI) |\n\nExample - adding a Docker publish to a plain projen `JavaProject`:\n\n```typescript\nimport { java } from 'projen';\nimport { DockerPublish } from '@xpertss/projen-types';\n\nconst project = new java.JavaProject({\n  name: 'my-service',\n  groupId: 'org.xpertss',\n  artifactId: 'my-service',\n});\n\nnew DockerPublish(project, { dockerRegistry: 'ghcr.io' });\n\nproject.synth();\n```\n\nThe full API reference, including every option and property, is in [API.md](./API.md).\n"
   },
   "repository": {
     "type": "git",
@@ -134,7 +134,7 @@
         },
         "locationInModule": {
           "filename": "src/actions/action-build-workflow.ts",
-          "line": 24
+          "line": 25
         },
         "parameters": [
           {
@@ -148,7 +148,7 @@
       "kind": "class",
       "locationInModule": {
         "filename": "src/actions/action-build-workflow.ts",
-        "line": 20
+        "line": 21
       },
       "name": "ActionBuildWorkflow",
       "properties": [
@@ -159,7 +159,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/actions/action-build-workflow.ts",
-            "line": 21
+            "line": 22
           },
           "name": "task",
           "type": {
@@ -173,7 +173,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/actions/action-build-workflow.ts",
-            "line": 22
+            "line": 23
           },
           "name": "workflow",
           "type": {
@@ -193,7 +193,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "src/actions/action-dogfood-workflow.ts",
-        "line": 55
+        "line": 56
       },
       "name": "ActionDogfoodOptions",
       "properties": [
@@ -206,7 +206,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/actions/action-dogfood-workflow.ts",
-            "line": 60
+            "line": 61
           },
           "name": "cleanup",
           "type": {
@@ -227,7 +227,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/actions/action-dogfood-workflow.ts",
-            "line": 57
+            "line": 58
           },
           "name": "scenario",
           "type": {
@@ -253,7 +253,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "src/actions/action-dogfood-workflow.ts",
-        "line": 16
+        "line": 17
       },
       "name": "ActionDogfoodStep",
       "properties": [
@@ -266,7 +266,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/actions/action-dogfood-workflow.ts",
-            "line": 41
+            "line": 42
           },
           "name": "assertions",
           "type": {
@@ -287,7 +287,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/actions/action-dogfood-workflow.ts",
-            "line": 18
+            "line": 19
           },
           "name": "name",
           "type": {
@@ -304,7 +304,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/actions/action-dogfood-workflow.ts",
-            "line": 32
+            "line": 33
           },
           "name": "fixtureSteps",
           "optional": true,
@@ -327,7 +327,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/actions/action-dogfood-workflow.ts",
-            "line": 25
+            "line": 26
           },
           "name": "id",
           "optional": true,
@@ -345,7 +345,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/actions/action-dogfood-workflow.ts",
-            "line": 38
+            "line": 39
           },
           "name": "inputs",
           "optional": true,
@@ -376,7 +376,7 @@
         },
         "locationInModule": {
           "filename": "src/actions/action-dogfood-workflow.ts",
-          "line": 88
+          "line": 89
         },
         "parameters": [
           {
@@ -397,7 +397,7 @@
       "kind": "class",
       "locationInModule": {
         "filename": "src/actions/action-dogfood-workflow.ts",
-        "line": 85
+        "line": 86
       },
       "name": "ActionDogfoodWorkflow",
       "properties": [
@@ -408,7 +408,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/actions/action-dogfood-workflow.ts",
-            "line": 86
+            "line": 87
           },
           "name": "workflow",
           "type": {
@@ -422,9 +422,9 @@
       "assembly": "@xpertss/projen-types",
       "base": "projen.Component",
       "docs": {
-        "remarks": "`sonar.inclusions` is set explicitly since\ndefault inclusions may skip `action.yml` outside `.github/`.",
+        "remarks": "`sonar.inclusions` is set explicitly since default\ninclusions may skip `action.yml` outside `.github/`.",
         "stability": "experimental",
-        "summary": "AD-001 Layer 2: self-hosted SonarQube Community Edition via the Scanner CLI only (never `SonarSource/sonarqube-scan-action` - third-party, and it carried a security advisory)."
+        "summary": "AD-001 Layer 2: SonarCloud via the Scanner CLI only (never `SonarSource/sonarqube-scan-action` - third-party, and it carried a security advisory)."
       },
       "fqn": "@xpertss/projen-types.ActionSonarWorkflow",
       "initializer": {
@@ -433,7 +433,7 @@
         },
         "locationInModule": {
           "filename": "src/actions/action-sonar-workflow.ts",
-          "line": 35
+          "line": 36
         },
         "parameters": [
           {
@@ -453,7 +453,7 @@
       "kind": "class",
       "locationInModule": {
         "filename": "src/actions/action-sonar-workflow.ts",
-        "line": 32
+        "line": 33
       },
       "name": "ActionSonarWorkflow",
       "properties": [
@@ -464,7 +464,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/actions/action-sonar-workflow.ts",
-            "line": 33
+            "line": 34
           },
           "name": "workflow",
           "type": {
@@ -484,21 +484,20 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "src/actions/action-sonar-workflow.ts",
-        "line": 9
+        "line": 10
       },
       "name": "ActionSonarWorkflowOptions",
       "properties": [
         {
           "abstract": true,
           "docs": {
-            "remarks": "Required, no default -\na guessed server is worse than a loud failure.",
             "stability": "experimental",
-            "summary": "URL of the org's self-hosted SonarQube instance."
+            "summary": "URL of the org's SonarCloud instance (e.g. `https://sonarcloud.io`). Required, no default - a guessed server is worse than a loud failure."
           },
           "immutable": true,
           "locationInModule": {
             "filename": "src/actions/action-sonar-workflow.ts",
-            "line": 14
+            "line": 15
           },
           "name": "sonarHostUrl",
           "type": {
@@ -515,7 +514,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/actions/action-sonar-workflow.ts",
-            "line": 23
+            "line": 24
           },
           "name": "sonarPullRequestGate",
           "optional": true,
@@ -532,7 +531,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/actions/action-sonar-workflow.ts",
-            "line": 17
+            "line": 18
           },
           "name": "sonarTokenSecret",
           "optional": true,
@@ -543,116 +542,6 @@
       ],
       "symbolId": "src/actions/action-sonar-workflow:ActionSonarWorkflowOptions"
     },
-    "@xpertss/projen-types.ActionsAllowlistGuard": {
-      "assembly": "@xpertss/projen-types",
-      "base": "projen.Component",
-      "docs": {
-        "stability": "experimental"
-      },
-      "fqn": "@xpertss/projen-types.ActionsAllowlistGuard",
-      "initializer": {
-        "docs": {
-          "stability": "experimental"
-        },
-        "locationInModule": {
-          "filename": "src/common/actions-allowlist-guard.ts",
-          "line": 41
-        },
-        "parameters": [
-          {
-            "name": "scope",
-            "type": {
-              "fqn": "projen.github.GitHubProject"
-            }
-          },
-          {
-            "name": "options",
-            "optional": true,
-            "type": {
-              "fqn": "@xpertss/projen-types.ActionsAllowlistGuardOptions"
-            }
-          }
-        ]
-      },
-      "kind": "class",
-      "locationInModule": {
-        "filename": "src/common/actions-allowlist-guard.ts",
-        "line": 38
-      },
-      "name": "ActionsAllowlistGuard",
-      "properties": [
-        {
-          "docs": {
-            "stability": "experimental"
-          },
-          "immutable": true,
-          "locationInModule": {
-            "filename": "src/common/actions-allowlist-guard.ts",
-            "line": 39
-          },
-          "name": "workflow",
-          "type": {
-            "fqn": "projen.github.GithubWorkflow"
-          }
-        }
-      ],
-      "symbolId": "src/common/actions-allowlist-guard:ActionsAllowlistGuard"
-    },
-    "@xpertss/projen-types.ActionsAllowlistGuardOptions": {
-      "assembly": "@xpertss/projen-types",
-      "datatype": true,
-      "docs": {
-        "remarks": "Runs on `pull_request_target` so it always executes the copy of this\nworkflow committed on the base branch - a PR cannot edit this file to\ndisable or weaken the check. It checks out and executes nothing from the\nPR; it only reads the PR head's file content via the GitHub API. Because\n`pull_request_target` runs with the base repo's token even for\nfork-originated PRs, the failure comment posts reliably.\n\n It performs a flat, unconditional scan of the PR's head ref (no\n base-vs-head comparison): fetch the content of every GitHub workflow and\n composite-action file, extract every `uses:` value, and fail if any does\n not start with one of the three trusted namespaces from AD-001\n (`actions/`, `docker/`, `xpertss/`). The single\nexemption is a local same-repo reference (`uses: .` or\n`uses: ./.github/actions/<name>`) - the repo's own hand-committed action,\nto which the org policy's \"allow select actions\" setting does not apply.",
-        "stability": "experimental",
-        "summary": "Blocking, tamper-proof PR check that stops a disallowed GitHub Action reference from ever (re)appearing in a repo's workflow or composite-action files."
-      },
-      "fqn": "@xpertss/projen-types.ActionsAllowlistGuardOptions",
-      "kind": "interface",
-      "locationInModule": {
-        "filename": "src/common/actions-allowlist-guard.ts",
-        "line": 25
-      },
-      "name": "ActionsAllowlistGuardOptions",
-      "properties": [
-        {
-          "abstract": true,
-          "docs": {
-            "default": "\"PROJEN_GITHUB_TOKEN\"",
-            "remarks": "The check still fails without it, so fork PRs -\nwhich get no secrets - are only missing the extra comment.",
-            "stability": "experimental",
-            "summary": "GitHub secret holding a token with permission to comment on PRs, used for the failure comment."
-          },
-          "immutable": true,
-          "locationInModule": {
-            "filename": "src/common/actions-allowlist-guard.ts",
-            "line": 32
-          },
-          "name": "gheTokenSecret",
-          "optional": true,
-          "type": {
-            "primitive": "string"
-          }
-        },
-        {
-          "abstract": true,
-          "docs": {
-            "default": "\"actions-allowlist-guard\"",
-            "stability": "experimental"
-          },
-          "immutable": true,
-          "locationInModule": {
-            "filename": "src/common/actions-allowlist-guard.ts",
-            "line": 35
-          },
-          "name": "workflowName",
-          "optional": true,
-          "type": {
-            "primitive": "string"
-          }
-        }
-      ],
-      "symbolId": "src/common/actions-allowlist-guard:ActionsAllowlistGuardOptions"
-    },
     "@xpertss/projen-types.AppRuntimeScaffold": {
       "assembly": "@xpertss/projen-types",
       "base": "projen.Component",
@@ -707,7 +596,7 @@
         },
         "locationInModule": {
           "filename": "src/cdk/cdk-app-project.ts",
-          "line": 13
+          "line": 14
         },
         "parameters": [
           {
@@ -721,7 +610,7 @@
       "kind": "class",
       "locationInModule": {
         "filename": "src/cdk/cdk-app-project.ts",
-        "line": 12
+        "line": 13
       },
       "name": "CdkAppProject",
       "symbolId": "src/cdk/cdk-app-project:CdkAppProject"
@@ -1096,7 +985,7 @@
         },
         "locationInModule": {
           "filename": "src/java/components/code-index-workflow.ts",
-          "line": 6
+          "line": 7
         },
         "parameters": [
           {
@@ -1110,7 +999,7 @@
       "kind": "class",
       "locationInModule": {
         "filename": "src/java/components/code-index-workflow.ts",
-        "line": 5
+        "line": 6
       },
       "name": "CodeIndexWorkflow",
       "symbolId": "src/java/components/code-index-workflow:CodeIndexWorkflow"
@@ -1262,7 +1151,7 @@
           "docs": {
             "remarks": "If unset, the sonar scan step is skipped.",
             "stability": "experimental",
-            "summary": "SonarQube project key."
+            "summary": "SonarCloud project key."
           },
           "immutable": true,
           "locationInModule": {
@@ -1401,7 +1290,7 @@
         },
         "locationInModule": {
           "filename": "src/java/components/docker-publish.ts",
-          "line": 11
+          "line": 12
         },
         "parameters": [
           {
@@ -1422,7 +1311,7 @@
       "kind": "class",
       "locationInModule": {
         "filename": "src/java/components/docker-publish.ts",
-        "line": 10
+        "line": 11
       },
       "name": "DockerPublish",
       "symbolId": "src/java/components/docker-publish:DockerPublish"
@@ -1437,7 +1326,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "src/java/components/docker-publish.ts",
-        "line": 4
+        "line": 5
       },
       "name": "DockerPublishOptions",
       "properties": [
@@ -1450,7 +1339,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/java/components/docker-publish.ts",
-            "line": 6
+            "line": 7
           },
           "name": "dockerRegistry",
           "optional": true,
@@ -1722,7 +1611,7 @@
       "base": "projen.github.GitHubProject",
       "docs": {
         "stability": "experimental",
-        "summary": "Scaffolds the repo lifecycle (AD-001) around a hand-committed, composite (shell) GitHub Action: the `build`/`test-dogfood`/`sonar`/`release` workflows, versioning and release discipline, the F003 verify components, the F009 allowlist guard, and repo boilerplate (a private version-source `package.json`, `.yamllint`, `LICENSE`, and a `README.md` template). The action's own content (`action.yml`, its shell scripts, `test/` fixtures) is authored by hand per the action's own F### spec - this type only lints it."
+        "summary": "Scaffolds the repo lifecycle (AD-001) around a hand-committed, composite (shell) GitHub Action: the `build`/`test-dogfood`/`sonar`/`release`  workflows, versioning and release discipline, the F003 verify components,  and repo boilerplate (a private version-source `package.json`, `.yamllint`,  `LICENSE`, and a `README.md` template). The action's own content (`action.yml`, its shell scripts, `test/` fixtures) is authored by hand per the action's own F### spec - this type only lints it."
       },
       "fqn": "@xpertss/projen-types.GitHubActionProject",
       "initializer": {
@@ -1828,9 +1717,8 @@
         {
           "abstract": true,
           "docs": {
-            "remarks": "MUST be reachable from\ngithub.com-hosted (public) runners (AD-001). Required, no default: a\nguessed server is worse than a loud failure.",
             "stability": "experimental",
-            "summary": "URL of the org's self-hosted SonarQube instance."
+            "summary": "URL of the org's SonarCloud instance (e.g. `https://sonarcloud.io`). MUST be reachable from github.com-hosted (public) runners (AD-001). Required, no default: a guessed server is worse than a loud failure."
           },
           "immutable": true,
           "locationInModule": {
@@ -1884,7 +1772,7 @@
           "docs": {
             "default": "\"PROJEN_GITHUB_TOKEN\"",
             "stability": "experimental",
-            "summary": "Name of the GitHub Actions secret holding the PAT used for projen-automation PR comments (F003/F009) and, when the action has a `token` input, the dogfood's invocation of it."
+            "summary": "Name of the GitHub Actions secret holding the PAT used for projen-automation PR comments (F003) and, when the action has a `token` input, the dogfood's invocation of it."
           },
           "immutable": true,
           "locationInModule": {
@@ -1967,7 +1855,7 @@
         },
         "locationInModule": {
           "filename": "src/java/components/github-packages-publish.ts",
-          "line": 11
+          "line": 12
         },
         "parameters": [
           {
@@ -1988,7 +1876,7 @@
       "kind": "class",
       "locationInModule": {
         "filename": "src/java/components/github-packages-publish.ts",
-        "line": 10
+        "line": 11
       },
       "name": "GitHubPackagesPublish",
       "symbolId": "src/java/components/github-packages-publish:GitHubPackagesPublish"
@@ -2003,7 +1891,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "src/java/components/github-packages-publish.ts",
-        "line": 4
+        "line": 5
       },
       "name": "GitHubPackagesPublishOptions",
       "properties": [
@@ -2016,7 +1904,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/java/components/github-packages-publish.ts",
-            "line": 6
+            "line": 7
           },
           "name": "ghPackagesRegistry",
           "optional": true,
@@ -2440,7 +2328,7 @@
         },
         "locationInModule": {
           "filename": "src/java/components/maven-central-publish.ts",
-          "line": 14
+          "line": 15
         },
         "parameters": [
           {
@@ -2461,7 +2349,7 @@
       "kind": "class",
       "locationInModule": {
         "filename": "src/java/components/maven-central-publish.ts",
-        "line": 13
+        "line": 14
       },
       "name": "MavenCentralPublish",
       "symbolId": "src/java/components/maven-central-publish:MavenCentralPublish"
@@ -2476,7 +2364,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "src/java/components/maven-central-publish.ts",
-        "line": 4
+        "line": 5
       },
       "name": "MavenCentralPublishOptions",
       "properties": [
@@ -2489,7 +2377,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/java/components/maven-central-publish.ts",
-            "line": 6
+            "line": 7
           },
           "name": "mavenCentralOidc",
           "optional": true,
@@ -2513,7 +2401,7 @@
         },
         "locationInModule": {
           "filename": "src/common/projen-drift-check-workflow.ts",
-          "line": 40
+          "line": 41
         },
         "parameters": [
           {
@@ -2534,7 +2422,7 @@
       "kind": "class",
       "locationInModule": {
         "filename": "src/common/projen-drift-check-workflow.ts",
-        "line": 37
+        "line": 38
       },
       "name": "ProjenDriftCheckWorkflow",
       "properties": [
@@ -2545,7 +2433,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/common/projen-drift-check-workflow.ts",
-            "line": 38
+            "line": 39
           },
           "name": "workflow",
           "type": {
@@ -2567,7 +2455,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "src/common/projen-drift-check-workflow.ts",
-        "line": 17
+        "line": 18
       },
       "name": "ProjenDriftCheckWorkflowOptions",
       "properties": [
@@ -2582,7 +2470,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/common/projen-drift-check-workflow.ts",
-            "line": 31
+            "line": 32
           },
           "name": "gheTokenSecret",
           "optional": true,
@@ -2600,7 +2488,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/common/projen-drift-check-workflow.ts",
-            "line": 22
+            "line": 23
           },
           "name": "projenCommand",
           "optional": true,
@@ -2617,7 +2505,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/common/projen-drift-check-workflow.ts",
-            "line": 34
+            "line": 35
           },
           "name": "workflowName",
           "optional": true,
@@ -2641,7 +2529,7 @@
         },
         "locationInModule": {
           "filename": "src/common/workflow-change-notice-workflow.ts",
-          "line": 36
+          "line": 37
         },
         "parameters": [
           {
@@ -2662,7 +2550,7 @@
       "kind": "class",
       "locationInModule": {
         "filename": "src/common/workflow-change-notice-workflow.ts",
-        "line": 33
+        "line": 34
       },
       "name": "WorkflowChangeNoticeWorkflow",
       "properties": [
@@ -2673,7 +2561,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/common/workflow-change-notice-workflow.ts",
-            "line": 34
+            "line": 35
           },
           "name": "workflow",
           "type": {
@@ -2695,7 +2583,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "src/common/workflow-change-notice-workflow.ts",
-        "line": 20
+        "line": 21
       },
       "name": "WorkflowChangeNoticeWorkflowOptions",
       "properties": [
@@ -2709,7 +2597,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/common/workflow-change-notice-workflow.ts",
-            "line": 27
+            "line": 28
           },
           "name": "watchPaths",
           "optional": true,
@@ -2731,7 +2619,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/common/workflow-change-notice-workflow.ts",
-            "line": 30
+            "line": 31
           },
           "name": "workflowName",
           "optional": true,
@@ -2743,6 +2631,6 @@
       "symbolId": "src/common/workflow-change-notice-workflow:WorkflowChangeNoticeWorkflowOptions"
     }
   },
-  "version": "0.0.6",
-  "fingerprint": "1XCl00RhqEO1ATeyAv8AdyUrUGIIQTcw3w9sOyHocDo="
+  "version": "0.0.8",
+  "fingerprint": "zxHJWTVJMWqWf0DnPuj1az/5dZHbjWmk6U04R59/9Lw="
 }