aws-cdk-github-oidc 4.0.0 → 4.1.0

package/.gitleaks.toml

@@ -0,0 +1,24 @@
+[extend]
+useDefault = true
+
+[[rules]]
+id = "aws-account-id"
+description = "AWS account ID"
+regex = '''\b\d{12}\b'''
+tags = ["aws", "account-id", "security"]
+
+[[rules.allowlists]]
+description = "Ignore the gitleaks configuration file itself"
+paths = ['''^\.gitleaks\.toml$''']
+
+[[rules.allowlists]]
+description = "Ignore example AWS account IDs"
+regexes = ['''^(123456789012|111111111111|000000000000)$''']
+
+[[rules]]
+id = "generic-api-key"
+
+[[rules.allowlists]]
+description = "Ignore secret-like zip file names"
+regexTarget = "match"
+regexes = ['''(?i)[a-f0-9]{32,}\.zip''']

package/.jsii

@@ -4613,6 +4613,6 @@
       "symbolId": "src/iam-role-props:RoleProps"
     }
   },
-  "version": "4.0.0",
-  "fingerprint": "7u65GWBkqER5gdjeYaC/ks3Apk6sdZ5JE+7tOumkieU="
+  "version": "4.1.0",
+  "fingerprint": "I8ZPKzhSWX00T5elYYWo/QBp+Tib/sx+Z0Q8UjR/tKA="
 }

package/CONTRIBUTE.md

@@ -0,0 +1,46 @@
+# Contributing
+
+## Setup
+
+
+1. Active correct NodeJS version using your Node Version Manager of choice. Example with [fnm](https://github.com/Schniz/fnm):
+    ```sh
+    fnm use
+    ```
+
+2. Ensure [pnpm](https://pnpm.io/) is installed. Example with Corepack:
+    ```sh
+    corepack enable pnpm
+    ```
+
+3. Install dependencies:
+    ```sh
+    pnpm install --frozen-lockfile
+    ```
+
+4. Setup pre-commit hooks
+    ```sh
+    pnpm run prepare
+    ```
+
+5. Run Projen:
+    ```sh
+    pnpm exec projen
+    ```
+
+
+## Checking for secrets
+
+```sh
+pnpm run gitleaks:dir
+```
+
+```sh
+pnpm run gitleaks:history
+```
+
+## Running integration tests
+
+```sh
+AWS_PROFILE=<YOUR_PROFILE> pnpm run integ:test
+```

package/lefthook.yml

@@ -0,0 +1,4 @@
+pre-commit:
+  commands:
+    gitleaks:
+      run: "pnpm run gitleaks:dir"

package/lib/provider.js

@@ -53,6 +53,6 @@ class GithubActionsIdentityProvider extends iam.OidcProviderNative {
 }
 exports.GithubActionsIdentityProvider = GithubActionsIdentityProvider;
 _a = JSII_RTTI_SYMBOL_1;
-GithubActionsIdentityProvider[_a] = { fqn: "aws-cdk-github-oidc.GithubActionsIdentityProvider", version: "4.0.0" };
+GithubActionsIdentityProvider[_a] = { fqn: "aws-cdk-github-oidc.GithubActionsIdentityProvider", version: "4.1.0" };
 GithubActionsIdentityProvider.issuer = "token.actions.githubusercontent.com";
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicHJvdmlkZXIuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi9zcmMvcHJvdmlkZXIudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7QUFBQSxtQ0FBbUM7QUFDbkMsMkNBQTJDO0FBUTNDOzs7Ozs7Ozs7R0FTRztBQUNILE1BQWEsNkJBQ1gsU0FBUSxHQUFHLENBQUMsa0JBQWtCO0lBSzlCOzs7Ozs7Ozs7Ozs7T0FZRztJQUNJLE1BQU0sQ0FBQyxXQUFXLENBQ3ZCLEtBQWdCLEVBQ2hCLEVBQVU7UUFFVixNQUFNLFNBQVMsR0FBRyxHQUFHLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQyxLQUFLLENBQUMsQ0FBQyxPQUFPLENBQUM7UUFDOUMsTUFBTSxXQUFXLEdBQUcsZ0JBQWdCLFNBQVMsa0JBQWtCLDZCQUE2QixDQUFDLE1BQU0sRUFBRSxDQUFDO1FBQ3RHLE9BQU8sR0FBRyxDQUFDLGtCQUFrQixDQUFDLG1CQUFtQixDQUFDLEtBQUssRUFBRSxFQUFFLEVBQUUsV0FBVyxDQUFDLENBQUM7SUFDNUUsQ0FBQztJQUVEOzs7Ozs7Ozs7T0FTRztJQUNILFlBQVksS0FBZ0IsRUFBRSxFQUFVO1FBQ3RDLEtBQUssQ0FBQyxLQUFLLEVBQUUsRUFBRSxFQUFFO1lBQ2YsR0FBRyxFQUFFLFdBQVcsNkJBQTZCLENBQUMsTUFBTSxFQUFFO1lBQ3RELFNBQVMsRUFBRSxDQUFDLG1CQUFtQixDQUFDO1NBQ2pDLENBQUMsQ0FBQztJQUNMLENBQUM7O0FBM0NILHNFQTRDQzs7O0FBeEN3QixvQ0FBTSxHQUFXLHFDQUFxQyxDQUFDIiwic291cmNlc0NvbnRlbnQiOlsiaW1wb3J0ICogYXMgY2RrIGZyb20gXCJhd3MtY2RrLWxpYlwiO1xuaW1wb3J0ICogYXMgaWFtIGZyb20gXCJhd3MtY2RrLWxpYi9hd3MtaWFtXCI7XG5pbXBvcnQgeyBDb25zdHJ1Y3QgfSBmcm9tIFwiY29uc3RydWN0c1wiO1xuXG4vKipcbiAqIERlc2NyaWJlcyBhIEdpdGh1YiBPcGVuSUQgQ29ubmVjdCBJZGVudGl0eSBQcm92aWRlciBmb3IgQVdTIElBTS5cbiAqL1xuZXhwb3J0IGludGVyZmFjZSBJR2l0aHViQWN0aW9uc0lkZW50aXR5UHJvdmlkZXIgZXh0ZW5kcyBpYW0uSU9pZGNQcm92aWRlciB7fVxuXG4vKipcbiAqIEdpdGh1YiBBY3Rpb25zIGFzIE9wZW5JRCBDb25uZWN0IElkZW50aXR5IFByb3ZpZGVyIGZvciBBV1MgSUFNLlxuICogVGhlcmUgY2FuIGJlIG9ubHkgb25lIChwZXIgQVdTIEFjY291bnQpLlxuICpcbiAqIFVzZSBgZnJvbUFjY291bnRgIHRvIHJldHJpZXZlIGEgcmVmZXJlbmNlIHRvIGV4aXN0aW5nIEdpdGh1YiBPSURDIHByb3ZpZGVyLlxuICpcbiAqIFVzZXMgdGhlIG5hdGl2ZSBDbG91ZEZvcm1hdGlvbiByZXNvdXJjZSBBV1M6OklBTTo6T0lEQ1Byb3ZpZGVyIChubyBMYW1iZGEgZnVuY3Rpb25zKS5cbiAqXG4gKiBAc2VlIGh0dHBzOi8vZG9jcy5naXRodWIuY29tL2VuL2FjdGlvbnMvZGVwbG95bWVudC9zZWN1cml0eS1oYXJkZW5pbmcteW91ci1kZXBsb3ltZW50cy9jb25maWd1cmluZy1vcGVuaWQtY29ubmVjdC1pbi1hbWF6b24td2ViLXNlcnZpY2VzXG4gKi9cbmV4cG9ydCBjbGFzcyBHaXRodWJBY3Rpb25zSWRlbnRpdHlQcm92aWRlclxuICBleHRlbmRzIGlhbS5PaWRjUHJvdmlkZXJOYXRpdmVcbiAgaW1wbGVtZW50cyBJR2l0aHViQWN0aW9uc0lkZW50aXR5UHJvdmlkZXJcbntcbiAgcHVibGljIHN0YXRpYyByZWFkb25seSBpc3N1ZXI6IHN0cmluZyA9IFwidG9rZW4uYWN0aW9ucy5naXRodWJ1c2VyY29udGVudC5jb21cIjtcblxuICAvKipcbiAgICogUmV0cmlldmUgYSByZWZlcmVuY2UgdG8gZXhpc3RpbmcgR2l0aHViIE9JREMgcHJvdmlkZXIgaW4geW91ciBBV1MgYWNjb3VudC5cbiAgICogQW4gQVdTIGFjY291bnQgY2FuIG9ubHkgaGF2ZSBzaW5nbGUgR2l0aHViIE9JREMgcHJvdmlkZXIgY29uZmlndXJlZCBpbnRvIGl0LFxuICAgKiBzbyBpbnRlcm5hbGx5IHRoZSByZWZlcmVuY2UgaXMgbWFkZSBieSBjb25zdHJ1Y3RpbmcgdGhlIEFSTiBmcm9tIEFXU1xuICAgKiBBY2NvdW50IElEICYgR2l0aHViIGlzc3VlciBVUkwuXG4gICAqXG4gICAqIEBwYXJhbSBzY29wZSBDREsgU3RhY2sgb3IgQ29uc3RydWN0IHRvIHdoaWNoIHRoZSBwcm92aWRlciBpcyBhc3NpZ25lZCB0b1xuICAgKiBAcGFyYW0gaWQgQ0RLIENvbnN0cnVjdCBJRCBnaXZlbiB0byB0aGUgY29uc3RydWN0XG4gICAqIEByZXR1cm5zIGEgQ0RLIENvbnN0cnVjdCByZXByZXNlbnRpbmcgdGhlIEdpdGh1YiBPSURDIHByb3ZpZGVyXG4gICAqXG4gICAqIEBleGFtcGxlXG4gICAqIEdpdGh1YkFjdGlvbnNJZGVudGl0eVByb3ZpZGVyLmZyb21BY2NvdW50KHNjb3BlLCBcIkdpdGh1YlByb3ZpZGVyXCIpO1xuICAgKi9cbiAgcHVibGljIHN0YXRpYyBmcm9tQWNjb3VudChcbiAgICBzY29wZTogQ29uc3RydWN0LFxuICAgIGlkOiBzdHJpbmcsXG4gICk6IElHaXRodWJBY3Rpb25zSWRlbnRpdHlQcm92aWRlciB7XG4gICAgY29uc3QgYWNjb3VudElkID0gY2RrLlN0YWNrLm9mKHNjb3BlKS5hY2NvdW50O1xuICAgIGNvbnN0IHByb3ZpZGVyQXJuID0gYGFybjphd3M6aWFtOjoke2FjY291bnRJZH06b2lkYy1wcm92aWRlci8ke0dpdGh1YkFjdGlvbnNJZGVudGl0eVByb3ZpZGVyLmlzc3Vlcn1gO1xuICAgIHJldHVybiBpYW0uT2lkY1Byb3ZpZGVyTmF0aXZlLmZyb21PaWRjUHJvdmlkZXJBcm4oc2NvcGUsIGlkLCBwcm92aWRlckFybik7XG4gIH1cblxuICAvKipcbiAgICogRGVmaW5lIGEgbmV3IEdpdGh1YiBPcGVuSUQgQ29ubmVjdCBJZGVudGl0eSBQcm92aWRlciBmb3IgQVdTIElBTS5cbiAgICogVGhlcmUgY2FuIGJlIG9ubHkgb25lIChwZXIgQVdTIEFjY291bnQpLlxuICAgKlxuICAgKiBAcGFyYW0gc2NvcGUgQ0RLIFN0YWNrIG9yIENvbnN0cnVjdCB0byB3aGljaCB0aGUgcHJvdmlkZXIgaXMgYXNzaWduZWQgdG9cbiAgICogQHBhcmFtIGlkIENESyBDb25zdHJ1Y3QgSUQgZ2l2ZW4gdG8gdGhlIGNvbnN0cnVjdFxuICAgKlxuICAgKiBAZXhhbXBsZVxuICAgKiBuZXcgR2l0aHViQWN0aW9uc0lkZW50aXR5UHJvdmlkZXIoc2NvcGUsIFwiR2l0aHViUHJvdmlkZXJcIik7XG4gICAqL1xuICBjb25zdHJ1Y3RvcihzY29wZTogQ29uc3RydWN0LCBpZDogc3RyaW5nKSB7XG4gICAgc3VwZXIoc2NvcGUsIGlkLCB7XG4gICAgICB1cmw6IGBodHRwczovLyR7R2l0aHViQWN0aW9uc0lkZW50aXR5UHJvdmlkZXIuaXNzdWVyfWAsXG4gICAgICBjbGllbnRJZHM6IFtcInN0cy5hbWF6b25hd3MuY29tXCJdLFxuICAgIH0pO1xuICB9XG59XG4iXX0=

package/lib/role.js

@@ -101,5 +101,5 @@ class GithubActionsRole extends iam.Role {
 }
 exports.GithubActionsRole = GithubActionsRole;
 _a = JSII_RTTI_SYMBOL_1;
-GithubActionsRole[_a] = { fqn: "aws-cdk-github-oidc.GithubActionsRole", version: "4.0.0" };
+GithubActionsRole[_a] = { fqn: "aws-cdk-github-oidc.GithubActionsRole", version: "4.1.0" };
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicm9sZS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3NyYy9yb2xlLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7Ozs7O0FBQUEsbUNBQW1DO0FBQ25DLDJDQUEyQztBQUczQyxpREFBaUQ7QUFDakQseUNBR29CO0FBb0VwQjs7Ozs7Ozs7Ozs7Ozs7Ozs7R0FpQkc7QUFDSCxNQUFhLGlCQUFrQixTQUFRLEdBQUcsQ0FBQyxJQUFJO0lBQzdDOzs7O09BSUc7SUFDSyxNQUFNLENBQUMsZ0JBQWdCLENBQzdCLEtBQTZCO1FBRTdCLE1BQU0sWUFBWSxHQUFRLEtBQUssQ0FBQztRQUNoQyxPQUFPLFlBQVksQ0FBQyxRQUFRLENBQUM7UUFDN0IsT0FBTyxZQUFZLENBQUMsS0FBSyxDQUFDO1FBQzFCLE9BQU8sWUFBWSxDQUFDLElBQUksQ0FBQztRQUN6QixPQUFPLFlBQVksQ0FBQyxNQUFNLENBQUM7UUFDM0IsT0FBTyxZQUFZLENBQUM7SUFDdEIsQ0FBQztJQUVELDhEQUE4RDtJQUN0RCxNQUFNLENBQUMsYUFBYSxDQUFDLEtBQWdCLEVBQUUsS0FBYTtRQUMxRCxJQUFJLHNCQUFtQixDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsS0FBSyxJQUFJLEVBQUUsQ0FBQztZQUM3QyxHQUFHLENBQUMsV0FBVyxDQUFDLEVBQUUsQ0FBQyxLQUFLLENBQUMsQ0FBQyxRQUFRLENBQ2hDLG9DQUFvQyxLQUFLLDBLQUEwSyxDQUNwTixDQUFDO1FBQ0osQ0FBQztJQUNILENBQUM7SUFFRCw0REFBNEQ7SUFDcEQsTUFBTSxDQUFDLFlBQVksQ0FBQyxLQUFnQixFQUFFLElBQVk7UUFDeEQsSUFBSSxJQUFJLEtBQUssRUFBRSxFQUFFLENBQUM7WUFDaEIsR0FBRyxDQUFDLFdBQVcsQ0FBQyxFQUFFLENBQUMsS0FBSyxDQUFDLENBQUMsUUFBUSxDQUNoQyxtQ0FBbUMsSUFBSSw2QkFBNkIsQ0FDckUsQ0FBQztRQUNKLENBQUM7SUFDSCxDQUFDO0lBRUQsb0RBQW9EO0lBQzVDLE1BQU0sQ0FBQyxhQUFhLENBQUMsS0FBMEI7UUFDckQsTUFBTSxFQUFFLEtBQUssRUFBRSxJQUFJLEVBQUUsTUFBTSxHQUFHLEdBQUcsRUFBRSxHQUFHLEtBQUssQ0FBQztRQUM1QyxPQUFPLFFBQVEsS0FBSyxJQUFJLElBQUksSUFBSSxNQUFNLEVBQUUsQ0FBQztJQUMzQyxDQUFDO0lBRUQ7Ozs7Ozs7Ozs7Ozs7Ozs7O09BaUJHO0lBQ0gsWUFBWSxLQUFnQixFQUFFLEVBQVUsRUFBRSxLQUE2QjtRQUNyRSxNQUFNLEVBQUUsUUFBUSxFQUFFLEtBQUssRUFBRSxJQUFJLEVBQUUsR0FBRyxLQUFLLENBQUM7UUFFeEMsc0JBQXNCO1FBQ3RCLGlCQUFpQixDQUFDLGFBQWEsQ0FBQyxLQUFLLEVBQUUsS0FBSyxDQUFDLENBQUM7UUFDOUMsaUJBQWlCLENBQUMsWUFBWSxDQUFDLEtBQUssRUFBRSxJQUFJLENBQUMsQ0FBQztRQUU1QyxpQkFBaUI7UUFDakIsTUFBTSxPQUFPLEdBQUcsaUJBQWlCLENBQUMsYUFBYSxDQUFDLEtBQUssQ0FBQyxDQUFDO1FBQ3ZELE1BQU0sU0FBUyxHQUFHLGlCQUFpQixDQUFDLGdCQUFnQixDQUFDLEtBQUssQ0FBQyxDQUFDO1FBRTVELCtCQUErQjtRQUMvQixLQUFLLENBQUMsS0FBSyxFQUFFLEVBQUUsRUFBRTtZQUNmLEdBQUcsU0FBUztZQUNaLFNBQVMsRUFBRSxJQUFJLEdBQUcsQ0FBQyxvQkFBb0IsQ0FBQyxRQUFRLENBQUMsZUFBZSxFQUFFO2dCQUNoRSxVQUFVLEVBQUU7b0JBQ1Ysb0RBQW9EO29CQUNwRCxDQUFDLEdBQUcsd0NBQTZCLENBQUMsTUFBTSxNQUFNLENBQUMsRUFBRSxPQUFPO2lCQUN6RDtnQkFDRCxZQUFZLEVBQUU7b0JBQ1osdUVBQXVFO29CQUN2RSwwS0FBMEs7b0JBQzFLLENBQUMsR0FBRyx3Q0FBNkIsQ0FBQyxNQUFNLE1BQU0sQ0FBQyxFQUFFLG1CQUFtQjtpQkFDckU7YUFDRixDQUFDO1NBQ0gsQ0FBQyxDQUFDO0lBQ0wsQ0FBQzs7QUFyRkgsOENBc0ZDIiwic291cmNlc0NvbnRlbnQiOlsiaW1wb3J0ICogYXMgY2RrIGZyb20gXCJhd3MtY2RrLWxpYlwiO1xuaW1wb3J0ICogYXMgaWFtIGZyb20gXCJhd3MtY2RrLWxpYi9hd3MtaWFtXCI7XG5pbXBvcnQgeyBDb25zdHJ1Y3QgfSBmcm9tIFwiY29uc3RydWN0c1wiO1xuaW1wb3J0IHsgUm9sZVByb3BzIH0gZnJvbSBcIi4vaWFtLXJvbGUtcHJvcHNcIjtcbmltcG9ydCBnaXRodWJVc2VybmFtZVJlZ2V4IGZyb20gXCIuL293bmVyLXJlZ2V4cFwiO1xuaW1wb3J0IHtcbiAgR2l0aHViQWN0aW9uc0lkZW50aXR5UHJvdmlkZXIsXG4gIElHaXRodWJBY3Rpb25zSWRlbnRpdHlQcm92aWRlcixcbn0gZnJvbSBcIi4vcHJvdmlkZXJcIjtcblxuLyoqXG4gKiBHaXRodWIgcmVsYXRlZCBjb25maWd1cmF0aW9uIHRoYXQgZm9ybXMgdGhlIHRydXN0IHBvbGljeSBmb3IgdGhpcyBJQU0gUm9sZS5cbiAqL1xuZXhwb3J0IGludGVyZmFjZSBHaXRodWJDb25maWd1cmF0aW9uIHtcbiAgLyoqXG4gICAqIFJlZmVyZW5jZSB0byBHaXRodWIgT3BlbklEIENvbm5lY3QgUHJvdmlkZXIgY29uZmlndXJlZCBpbiBBV1MgSUFNLlxuICAgKlxuICAgKiBFaXRoZXIgcGFzcyBhbiBjb25zdHJ1Y3QgZGVmaW5lZCBieSBgbmV3IEdpdGh1YkFjdGlvbnNJZGVudGl0eVByb3ZpZGVyYFxuICAgKiBvciBhIHJldHJpZXZlZCByZWZlcmVuY2UgZnJvbSBgR2l0aHViQWN0aW9uc0lkZW50aXR5UHJvdmlkZXIuZnJvbUFjY291bnRgLlxuICAgKiBUaGVyZSBjYW4gYmUgb25seSBvbmUgKHBlciBBV1MgQWNjb3VudCkuXG4gICAqL1xuICByZWFkb25seSBwcm92aWRlcjogSUdpdGh1YkFjdGlvbnNJZGVudGl0eVByb3ZpZGVyO1xuXG4gIC8qKlxuICAgKiBSZXBvc2l0b3J5IG93bmVyIChvcmdhbml6YXRpb24gb3IgdXNlcm5hbWUpLlxuICAgKlxuICAgKiBAZXhhbXBsZVxuICAgKiAnb2N0by1vcmcnXG4gICAqL1xuICByZWFkb25seSBvd25lcjogc3RyaW5nO1xuXG4gIC8qKlxuICAgKiBSZXBvc2l0b3J5IG5hbWUgKHNsdWcpIHdpdGhvdXQgdGhlIG93bmVyLlxuICAgKlxuICAgKiBAZXhhbXBsZVxuICAgKiAnb2N0by1yZXBvJ1xuICAgKi9cbiAgcmVhZG9ubHkgcmVwbzogc3RyaW5nO1xuXG4gIC8qKlxuICAgKiBTdWJqZWN0IGNvbmRpdGlvbiBmaWx0ZXIsIGFwcGVuZGVkIGFmdGVyIGByZXBvOiR7b3duZXJ9LyR7cmVwb306YCBzdHJpbmcgaW4gSUFNIFJvbGUgdHJ1c3QgcmVsYXRpb25zaGlwLlxuICAgKlxuICAgKiBAZGVmYXVsdFxuICAgKiAnKidcbiAgICpcbiAgICogWW91IG1heSB1c2UgdGhpcyB2YWx1ZSB0byBvbmx5IGFsbG93IEdpdGh1YiB0byBhc3N1bWUgdGhlIHJvbGUgb24gc3BlY2lmaWMgYnJhbmNoZXMsIHRhZ3MsIGVudmlyb25tZW50cywgcHVsbCByZXF1ZXN0cyBldGMuXG4gICAqIEBleGFtcGxlXG4gICAqICdyZWY6cmVmcy90YWdzL3YqJ1xuICAgKiAncmVmOnJlZnMvaGVhZHMvZGVtby1icmFuY2gnXG4gICAqICdwdWxsX3JlcXVlc3QnXG4gICAqICdlbnZpcm9ubWVudDpQcm9kdWN0aW9uJ1xuICAgKlxuICAgKiBAc2VlIGh0dHBzOi8vZG9jcy5naXRodWIuY29tL2VuL2FjdGlvbnMvZGVwbG95bWVudC9zZWN1cml0eS1oYXJkZW5pbmcteW91ci1kZXBsb3ltZW50cy9hYm91dC1zZWN1cml0eS1oYXJkZW5pbmctd2l0aC1vcGVuaWQtY29ubmVjdCNleGFtcGxlc1xuICAgKi9cbiAgcmVhZG9ubHkgZmlsdGVyPzogc3RyaW5nO1xufVxuXG4vKipcbiAqIFByb3BzIHRoYXQgZGVmaW5lIHRoZSBJQU0gUm9sZSB0aGF0IGNhbiBiZSBhc3N1bWVkIGJ5IEdpdGh1YiBBY3Rpb25zIHdvcmtmbG93XG4gKiB2aWEgR2l0aHViIE9wZW5JRCBDb25uZWN0IElkZW50aXR5IFByb3ZpZGVyLlxuICpcbiAqIEJlc2lkZXMgYEdpdGh1YkNvbmZpZ3VyYXRpb25gLCB5b3UgbWF5IHBhc3MgaW4gYW55IGBpYW0uUm9sZVByb3BzYCBleGNlcHQgYGFzc3VtZWRCeWBcbiAqIHdoaWNoIHdpbGwgYmUgZGVmaW5lZCBieSB0aGlzIGNvbnN0cnVjdCAoQ0RLIHdpbGwgZmFpbCBpZiB5b3UgZG8pLlxuICpcbiAqIEBleGFtcGxlXG4gKiB7XG4gKiAgIHByb3ZpZGVyOiBHaXRodWJBY3Rpb25zSWRlbnRpdHlQcm92aWRlci5mcm9tQWNjb3VudChzY29wZSwgXCJHaXRodWJQcm92aWRlclwiKSxcbiAqICAgb3duZXI6ICdvY3RvLW9yZycsXG4gKiAgIHJlcG86ICdvY3RvLXJlcG8nLFxuICogICBmaWx0ZXI6ICdyZWY6cmVmcy90YWdzL3YqJyxcbiAqICAgcm9sZU5hbWU6ICdNeURlcGxveVJvbGUnLFxuICogfVxuICovXG5leHBvcnQgaW50ZXJmYWNlIEdpdGh1YkFjdGlvbnNSb2xlUHJvcHNcbiAgZXh0ZW5kcyBHaXRodWJDb25maWd1cmF0aW9uLCBSb2xlUHJvcHMge31cblxuLyoqXG4gKiBEZWZpbmUgYW4gSUFNIFJvbGUgdGhhdCBjYW4gYmUgYXNzdW1lZCBieSBHaXRodWIgQWN0aW9ucyB3b3JrZmxvd1xuICogdmlhIEdpdGh1YiBPcGVuSUQgQ29ubmVjdCBJZGVudGl0eSBQcm92aWRlci5cbiAqXG4gKiBCZXNpZGVzIGBHaXRodWJDb25maWd1cmF0aW9uYCwgeW91IG1heSBwYXNzIGluIGFueSBgaWFtLlJvbGVQcm9wc2AgZXhjZXB0IGBhc3N1bWVkQnlgXG4gKiB3aGljaCB3aWxsIGJlIGRlZmluZWQgYnkgdGhpcyBjb25zdHJ1Y3QgKENESyB3aWxsIGZhaWwgaWYgeW91IGRvKS5cbiAqXG4gKiBAZXhhbXBsZVxuICogY29uc3QgdXBsb2FkUm9sZSA9IG5ldyBHaXRodWJBY3Rpb25zUm9sZShzY29wZSwgXCJVcGxvYWRSb2xlXCIsIHtcbiAqICAgcHJvdmlkZXI6IEdpdGh1YkFjdGlvbnNJZGVudGl0eVByb3ZpZGVyLmZyb21BY2NvdW50KHNjb3BlLCBcIkdpdGh1YlByb3ZpZGVyXCIpLFxuICogICBvd25lcjogJ29jdG8tb3JnJyxcbiAqICAgcmVwbzogJ29jdG8tcmVwbycsXG4gKiAgIGZpbHRlcjogJ3JlZjpyZWZzL3RhZ3MvdionLFxuICogICByb2xlTmFtZTogJ015VXBsb2FkUm9sZScsXG4gKiB9KTtcbiAqXG4gKiBteUJ1Y2tldC5ncmFudFdyaXRlKHVwbG9hZFJvbGUpO1xuICovXG5leHBvcnQgY2xhc3MgR2l0aHViQWN0aW9uc1JvbGUgZXh0ZW5kcyBpYW0uUm9sZSB7XG4gIC8qKlxuICAgKiBFeHRyYWN0cyBwcm9wcyBnaXZlbiBmb3IgdGhlIGNyZWF0ZWQgSUFNIFJvbGUgQ29uc3RydWN0LlxuICAgKiBAcGFyYW0gcHJvcHMgZm9yIHRoZSBHaXRodWJBY3Rpb25zUm9sZVxuICAgKiBAcmV0dXJucyBmb3IgdGhlIElBTSBSb2xlXG4gICAqL1xuICBwcml2YXRlIHN0YXRpYyBleHRyYWN0Um9sZVByb3BzKFxuICAgIHByb3BzOiBHaXRodWJBY3Rpb25zUm9sZVByb3BzLFxuICApOiBpYW0uUm9sZVByb3BzIHtcbiAgICBjb25zdCBleHRyYWN0UHJvcHMgPSA8YW55PnByb3BzO1xuICAgIGRlbGV0ZSBleHRyYWN0UHJvcHMucHJvdmlkZXI7XG4gICAgZGVsZXRlIGV4dHJhY3RQcm9wcy5vd25lcjtcbiAgICBkZWxldGUgZXh0cmFjdFByb3BzLnJlcG87XG4gICAgZGVsZXRlIGV4dHJhY3RQcm9wcy5maWx0ZXI7XG4gICAgcmV0dXJuIGV4dHJhY3RQcm9wcztcbiAgfVxuXG4gIC8qKiBWYWxpZGF0ZXMgdGhlIEdpdGh1YiBvd25lciAob3JnYW5pemF0aW9uIG9yIHVzZXIpIG5hbWUuICovXG4gIHByaXZhdGUgc3RhdGljIHZhbGlkYXRlT3duZXIoc2NvcGU6IENvbnN0cnVjdCwgb3duZXI6IHN0cmluZyk6IHZvaWQge1xuICAgIGlmIChnaXRodWJVc2VybmFtZVJlZ2V4LnRlc3Qob3duZXIpICE9PSB0cnVlKSB7XG4gICAgICBjZGsuQW5ub3RhdGlvbnMub2Yoc2NvcGUpLmFkZEVycm9yKFxuICAgICAgICBgSW52YWxpZCBHaXRodWIgUmVwb3NpdG9yeSBPd25lciBcIiR7b3duZXJ9XCIuIE11c3Qgb25seSBjb250YWluIGFscGhhbnVtZXJpYyBjaGFyYWN0ZXJzIG9yIGh5cGhlbnMsIGNhbm5vdCBoYXZlIG11bHRpcGxlIGNvbnNlY3V0aXZlIGh5cGhlbnMsIGNhbm5vdCBiZWdpbiBvciBlbmQgd2l0aCBhIGh5cGVuIGFuZCBtYXhpbXVtIGxlbmdodCBpcyAzOSBjaGFyYWN0ZXJzLmAsXG4gICAgICApO1xuICAgIH1cbiAgfVxuXG4gIC8qKiBWYWxpZGF0ZXMgdGhlIEdpdGh1YiByZXBvc2l0b3J5IG5hbWUgKHdpdGhvdXQgb3duZXIpLiAqL1xuICBwcml2YXRlIHN0YXRpYyB2YWxpZGF0ZVJlcG8oc2NvcGU6IENvbnN0cnVjdCwgcmVwbzogc3RyaW5nKTogdm9pZCB7XG4gICAgaWYgKHJlcG8gPT09IFwiXCIpIHtcbiAgICAgIGNkay5Bbm5vdGF0aW9ucy5vZihzY29wZSkuYWRkRXJyb3IoXG4gICAgICAgIGBJbnZhbGlkIEdpdGh1YiBSZXBvc2l0b3J5IE5hbWUgXCIke3JlcG99XCIuIE1heSBub3QgYmUgZW1wdHkgc3RyaW5nLmAsXG4gICAgICApO1xuICAgIH1cbiAgfVxuXG4gIC8qKiBGb3JtYXRzIHRoZSBgc3ViYCB2YWx1ZSB1c2VkIGluIHRydXN0IHBvbGljeS4gKi9cbiAgcHJpdmF0ZSBzdGF0aWMgZm9ybWF0U3ViamVjdChwcm9wczogR2l0aHViQ29uZmlndXJhdGlvbik6IHN0cmluZyB7XG4gICAgY29uc3QgeyBvd25lciwgcmVwbywgZmlsdGVyID0gXCIqXCIgfSA9IHByb3BzO1xuICAgIHJldHVybiBgcmVwbzoke293bmVyfS8ke3JlcG99OiR7ZmlsdGVyfWA7XG4gIH1cblxuICAvKipcbiAgICogRGVmaW5lIGFuIElBTSBSb2xlIHRoYXQgY2FuIGJlIGFzc3VtZWQgYnkgR2l0aHViIEFjdGlvbnMgd29ya2Zsb3dcbiAgICogdmlhIEdpdGh1YiBPcGVuSUQgQ29ubmVjdCBJZGVudGl0eSBQcm92aWRlci5cbiAgICpcbiAgICogQmVzaWRlcyBgR2l0aHViQ29uZmlndXJhdGlvbmAsIHlvdSBtYXkgcGFzcyBpbiBhbnkgYGlhbS5Sb2xlUHJvcHNgIGV4Y2VwdCBgYXNzdW1lZEJ5YFxuICAgKiB3aGljaCB3aWxsIGJlIGRlZmluZWQgYnkgdGhpcyBjb25zdHJ1Y3QgKENESyB3aWxsIGZhaWwgaWYgeW91IGRvKS5cbiAgICpcbiAgICogQGV4YW1wbGVcbiAgICogY29uc3QgdXBsb2FkUm9sZSA9IG5ldyBHaXRodWJBY3Rpb25zUm9sZShzY29wZSwgXCJVcGxvYWRSb2xlXCIsIHtcbiAgICogICBwcm92aWRlcjogR2l0aHViQWN0aW9uc0lkZW50aXR5UHJvdmlkZXIuZnJvbUFjY291bnQoc2NvcGUsIFwiR2l0aHViUHJvdmlkZXJcIiksXG4gICAqICAgb3duZXI6ICdvY3RvLW9yZycsXG4gICAqICAgcmVwbzogJ29jdG8tcmVwbycsXG4gICAqICAgZmlsdGVyOiAncmVmOnJlZnMvdGFncy92KicsXG4gICAqICAgcm9sZU5hbWU6ICdNeVVwbG9hZFJvbGUnLFxuICAgKiB9KTtcbiAgICpcbiAgICogbXlCdWNrZXQuZ3JhbnRXcml0ZSh1cGxvYWRSb2xlKTtcbiAgICovXG4gIGNvbnN0cnVjdG9yKHNjb3BlOiBDb25zdHJ1Y3QsIGlkOiBzdHJpbmcsIHByb3BzOiBHaXRodWJBY3Rpb25zUm9sZVByb3BzKSB7XG4gICAgY29uc3QgeyBwcm92aWRlciwgb3duZXIsIHJlcG8gfSA9IHByb3BzO1xuXG4gICAgLy8gUGVyZm9ybSB2YWxpZGF0aW9uc1xuICAgIEdpdGh1YkFjdGlvbnNSb2xlLnZhbGlkYXRlT3duZXIoc2NvcGUsIG93bmVyKTtcbiAgICBHaXRodWJBY3Rpb25zUm9sZS52YWxpZGF0ZVJlcG8oc2NvcGUsIHJlcG8pO1xuXG4gICAgLy8gUHJlcGFyZSB2YWx1ZXNcbiAgICBjb25zdCBzdWJqZWN0ID0gR2l0aHViQWN0aW9uc1JvbGUuZm9ybWF0U3ViamVjdChwcm9wcyk7XG4gICAgY29uc3Qgcm9sZVByb3BzID0gR2l0aHViQWN0aW9uc1JvbGUuZXh0cmFjdFJvbGVQcm9wcyhwcm9wcyk7XG5cbiAgICAvLyBUaGUgYWN0dWFsIElBTSBSb2xlIGNyZWF0aW9uXG4gICAgc3VwZXIoc2NvcGUsIGlkLCB7XG4gICAgICAuLi5yb2xlUHJvcHMsXG4gICAgICBhc3N1bWVkQnk6IG5ldyBpYW0uV2ViSWRlbnRpdHlQcmluY2lwYWwocHJvdmlkZXIub2lkY1Byb3ZpZGVyQXJuLCB7XG4gICAgICAgIFN0cmluZ0xpa2U6IHtcbiAgICAgICAgICAvLyBPbmx5IGFsbG93IHNwZWNpZmllZCBzdWJqZWN0cyB0byBhc3N1bWUgdGhpcyByb2xlXG4gICAgICAgICAgW2Ake0dpdGh1YkFjdGlvbnNJZGVudGl0eVByb3ZpZGVyLmlzc3Vlcn06c3ViYF06IHN1YmplY3QsXG4gICAgICAgIH0sXG4gICAgICAgIFN0cmluZ0VxdWFsczoge1xuICAgICAgICAgIC8vIEF1ZGllbmNlIGlzIGFsd2F5cyBzdHMuYW1hem9uYXdzLmNvbSB3aXRoIEFXUyBvZmZpY2lhbCBHaXRodWIgQWN0aW9uXG4gICAgICAgICAgLy8gaHR0cHM6Ly9kb2NzLmdpdGh1Yi5jb20vZW4vYWN0aW9ucy9kZXBsb3ltZW50L3NlY3VyaXR5LWhhcmRlbmluZy15b3VyLWRlcGxveW1lbnRzL2NvbmZpZ3VyaW5nLW9wZW5pZC1jb25uZWN0LWluLWFtYXpvbi13ZWItc2VydmljZXMjYWRkaW5nLXRoZS1pZGVudGl0eS1wcm92aWRlci10by1hd3NcbiAgICAgICAgICBbYCR7R2l0aHViQWN0aW9uc0lkZW50aXR5UHJvdmlkZXIuaXNzdWVyfTphdWRgXTogXCJzdHMuYW1hem9uYXdzLmNvbVwiLFxuICAgICAgICB9LFxuICAgICAgfSksXG4gICAgfSk7XG4gIH1cbn1cbiJdfQ==

package/package.json

@@ -12,6 +12,9 @@
   },
   "devDependencies": {
     "@alma-cdk/construct-library": "0.0.20",
+    "@aws-cdk/cloud-assembly-schema": "^48.20.0",
+    "@aws-cdk/integ-runner": "2.197.4",
+    "@aws-cdk/integ-tests-alpha": "2.220.0-alpha.0",
     "@types/jest": "^30",
     "@types/node": "^20",
     "@typescript-eslint/eslint-plugin": "^8",
@@ -31,6 +34,7 @@
     "jsii-docgen": "^10.5.0",
     "jsii-pacmak": "^1.86.1",
     "jsii-rosetta": "~5.9.0",
+    "lefthook": "2.1.4",
     "prettier": "^3.8.1",
     "projen": "^0.99.27",
     "ts-jest": "^29",
@@ -60,7 +64,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "version": "4.0.0",
+  "version": "4.1.0",
   "jest": {
     "coverageProvider": "v8",
     "testMatch": [
@@ -151,6 +155,9 @@
     "unbump": "pnpm exec projen unbump",
     "upgrade": "pnpm exec projen upgrade",
     "watch": "pnpm exec projen watch",
-    "projen": "pnpm exec projen"
+    "projen": "pnpm exec projen",
+    "integ:test": "node ./run-integ-tests.mjs",
+    "gitleaks:history": "docker run --rm -v \"$PWD:/repo\" -w /repo ghcr.io/gitleaks/gitleaks:latest git --verbose --config /repo/.gitleaks.toml",
+    "gitleaks:dir": "docker run --rm -v \"$PWD:/repo\" -w /repo ghcr.io/gitleaks/gitleaks:latest dir --verbose --config /repo/.gitleaks.toml"
   }
 }

package/pnpm-workspace.yaml

@@ -13,5 +13,6 @@ resolutionMode: highest
 strictDepBuilds: true
 onlyBuiltDependencies:
   - unrs-resolver
+  - lefthook
 blockExoticSubdeps: true
 overrides: {}

package/run-integ-tests.mjs

@@ -0,0 +1,60 @@
+import { spawnSync } from "node:child_process";
+
+const defaultRegion = "us-east-1";
+
+const forwardedArgs = process.argv.slice(2).filter((arg) => {
+  if (arg === "--") {
+    return false;
+  }
+  return true;
+});
+
+function resolveDefaultAccount() {
+  if (process.env.CDK_DEFAULT_ACCOUNT) {
+    return process.env.CDK_DEFAULT_ACCOUNT;
+  }
+
+  const result = spawnSync(
+    "aws",
+    ["sts", "get-caller-identity", "--query", "Account", "--output", "text"],
+    {
+      encoding: "utf8",
+      env: process.env,
+    },
+  );
+
+  if (result.status !== 0) {
+    return undefined;
+  }
+
+  return result.stdout.trim() || undefined;
+}
+
+const defaultAccount = resolveDefaultAccount();
+
+const result = spawnSync(
+  "pnpm",
+  [
+    "exec",
+    "integ-runner",
+    "--update-on-failed",
+    "--directory",
+    "test",
+    "--test-regex",
+    "integ\\.[^/]+\\.(js|ts)$",
+    "--parallel-regions",
+    defaultRegion,
+    "--app",
+    "pnpm exec ts-node --project tsconfig.dev.json {filePath}",
+    ...forwardedArgs,
+  ],
+  {
+    stdio: "inherit",
+    env: {
+      ...process.env,
+      ...(defaultAccount ? { CDK_DEFAULT_ACCOUNT: defaultAccount } : {}),
+    },
+  },
+);
+
+process.exit(result.status ?? 1);