aws-cdk-github-oidc 4.2.3 → 4.2.5

package/.jsii

@@ -8522,7 +8522,7 @@
   },
   "name": "aws-cdk-github-oidc",
   "readme": {
-    "markdown": "> [!IMPORTANT]\n> Migrating **to `v4`**? See [Migration Guide](#migration-guide) at the end of this README.\n\n\n# AWS CDK Github OpenID Connect\n\n![cdk-support](https://img.shields.io/badge/cdk-%20typescript%20|%20python%20-informational \"TypeScript | Python\")\n[![release](https://github.com/aripalo/aws-cdk-github-oidc/actions/workflows/release.yml/badge.svg)](https://github.com/aripalo/aws-cdk-github-oidc/actions/workflows/release.yml)\n[![codecov](https://codecov.io/gh/aripalo/aws-cdk-github-oidc/branch/main/graph/badge.svg?token=5X44RM6J17)](https://codecov.io/gh/aripalo/aws-cdk-github-oidc)\n\n---\n\nAWS [CDK](https://aws.amazon.com/cdk/) constructs that define:\n\n- Github Actions as OpenID Connect Identity Provider into AWS IAM\n- IAM Roles that can be assumed by Github Actions workflows\n\nThese constructs allows you to harden your AWS deployment security by removing the need to create long-term access keys for Github Actions and instead use OpenID Connect to Authenticate your Github Action workflow with AWS IAM.\n\n## Background information\n\n![github-aws-oidc](/assets/github-aws-oidc.svg \"Github OIDC with AWS\")\n\n- [GitHub Actions: Secure cloud deployments with OpenID Connect](https://github.blog/changelog/2021-10-27-github-actions-secure-cloud-deployments-with-openid-connect/) on Github Changelog Blog.\n- [Security hardening your deployments](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments) on Github Docs.\n- [Assuming a role with `aws-actions/configure-aws-credentials`](https://github.com/aws-actions/configure-aws-credentials#assuming-a-role).\n- Shout-out to [Richard H. Boyd](https://twitter.com/rchrdbyd) for helping me to debug Github OIDC setup with AWS IAM and his [Deploying to AWS with Github Actions](https://www.githubuniverse.com/2021/session/692586/deploying-to-aws-with-github-actions)-talk.\n- Shout-out to [Aidan W Steele](https://twitter.com/__steele) and his blog post [AWS federation comes to GitHub Actions](https://awsteele.com/blog/2021/09/15/aws-federation-comes-to-github-actions.html) for being the original inspiration for this.\n\n<br/>\n\n## Getting started\n\n```shell\npnpm add -D aws-cdk-github-oidc\n```\n\n<br/>\n\n### OpenID Connect Identity Provider trust for AWS IAM\n\nTo create a new Github OIDC provider configuration into AWS IAM:\n\n```ts\nimport { GithubActionsIdentityProvider } from \"aws-cdk-github-oidc\";\n\nconst provider = new GithubActionsIdentityProvider(scope, \"GithubProvider\");\n```\n\nIn the background this creates an OIDC provider trust configuration into AWS IAM with an [issuer URL of `https://token.actions.githubusercontent.com`](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-amazon-web-services#adding-the-identity-provider-to-aws) and audiences (client IDs) configured as `['sts.amazonaws.com']` (which matches the [`aws-actions/configure-aws-credentials`](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-amazon-web-services#adding-the-identity-provider-to-aws) implementation).\n\n<br/>\n\n### Retrieving a reference to an existing Github OIDC provider configuration\n\nRemember, **there can be only one (Github OIDC provider per AWS Account)**, so to retrieve a reference to existing Github OIDC provider use `fromAccount` static method:\n\n```ts\nimport { GithubActionsIdentityProvider } from \"aws-cdk-github-oidc\";\n\nconst provider = GithubActionsIdentityProvider.fromAccount(\n  scope,\n  \"GithubProvider\"\n);\n```\n\n<br/>\n\n### Defining a role for Github Actions workflow to assume\n\n```ts\nimport { GithubActionsRole } from \"aws-cdk-github-oidc\";\n\nconst uploadRole = new GithubActionsRole(scope, \"UploadRole\", {\n  provider: provider, // reference into the OIDC provider\n  owner: \"octo-org\", // your repository owner (organization or user) name\n  repo: \"octo-repo\", // your repository name (without the owner name)\n  filter: \"ref:refs/tags/v*\", // JWT sub suffix filter, defaults to '*'\n});\n\n// use it like any other role, for example grant S3 bucket write access:\nmyBucket.grantWrite(uploadRole);\n```\n\nYou may pass in any `iam.RoleProps` into the construct's props, except `assumedBy` which will be defined by this construct (CDK will fail if you do):\n\n```ts\nconst deployRole = new GithubActionsRole(scope, \"DeployRole\", {\n  provider: provider,\n  owner: \"octo-org\",\n  repo: \"octo-repo\",\n  roleName: \"MyDeployRole\",\n  description: \"This role deploys stuff to AWS\",\n  maxSessionDuration: cdk.Duration.hours(2),\n});\n\n// You may also use various \"add*\" policy methods!\n// \"AdministratorAccess\" not really a good idea, just for an example here:\ndeployRole.addManagedPolicy(\n  iam.ManagedPolicy.fromAwsManagedPolicyName(\"AdministratorAccess\")\n);\n```\n\n<br/>\n\n#### Subject Filter\n\nBy default the value of `filter` property will be `'*'` which means any workflow (from given repository) from any branch, tag, environment or pull request can assume this role. To further stricten the OIDC trust policy on the role, you may adjust the subject filter as seen on the [examples in Github Docs](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect#configuring-the-oidc-trust-with-the-cloud); For example:\n\n| `filter` value                 | Descrition                               |\n| :----------------------------- | :--------------------------------------- |\n| `'ref:refs/tags/v*'`           | Allow only tags with prefix of `v`       |\n| `'ref:refs/heads/demo-branch'` | Allow only from branch `demo-branch`     |\n| `'pull_request'`               | Allow only from pull request             |\n| `'environment:Production'`     | Allow only from `Production` environment |\n\n<br/>\n\n### Github Actions Workflow\n\nTo actually utilize this in your Github Actions workflow, use [aws-actions/configure-aws-credentials](https://github.com/aws-actions/configure-aws-credentials) to [assume a role](https://github.com/aws-actions/configure-aws-credentials#assuming-a-role).\n\n```yaml\njobs:\n  whoami:\n    name: Who Am I\n    runs-on: ubuntu-latest\n    permissions:\n      id-token: write # needed to interact with GitHub's OIDC Token endpoint.\n    steps:\n      - name: Configure AWS credentials\n        uses: aws-actions/configure-aws-credentials@d979d5b3a71173a29b74b5b88418bfda9437d885 # v6.1.1\n        with:\n          role-to-assume: arn:aws:iam::123456789012:role/MyUploadRole\n          #role-session-name: MySessionName # Optional\n          aws-region: us-east-1\n      - name: Get Caller Identity\n        run: |\n          aws sts get-caller-identity\n```\n\n<br/>\n\n\n## Migration Guide\n\n- [v2→v3](#v2v3)\n- [v3→v4](#v3v4)\n\n### v2→v3\n\n1. Install AWS CDK version [`v2.237.0`](https://github.com/aws/aws-cdk/releases/tag/v2.237.0) or newer required (due to support of [OIDC provider removal policy support](https://github.com/aws/aws-cdk/commit/09383cbad28336441f0fb405c9d8a190135620dc)):\n\n    ```sh\n    pnpm add -D aws-cdk-lib@^2.237.0\n    ```\n\n2. Install `v3.1.0` (or newer v3 release) of this library:\n\n    ```sh\n    pnpm add -D aws-cdk-github-oidc@^3.1\n    ```\n\n3. No additional steps required, as the v3 major version does not introduce any breaking changes (just a lot of internal tooling changes).\n\n### v3→v4\n\n> [!CAUTION]\n> The following steps describe a _**no-downtime** migration path_.\n> It is the recommended approach, but somewhat _involved_: Hence some users may decide to use \"destroy + redeploy\" strategy instead, which causes downtime to authenticating from GitHub Actions to AWS using OIDC.\n\n1. Ensure you are running `v3.1.0` (or newer v3 release) of this library, see [v2→v3](#v2v3).\n\n2. Configure `RETAIN` removal policy for the provider:\n\n    ```diff\n    const provider = new GithubActionsIdentityProvider(this, \"GithubProvider\", {\n    +  removalPolicy: cdk.RemovalPolicy.RETAIN,\n    });\n    ```\n\n3. Run `pnpm exec cdk diff`, which will show an output similar to:\n\n    ```sh\n    Resources\n    [~] Custom::AWSCDKOpenIdConnectProvider GithubProvider/Resource GithubProvider1CDE27EB\n    ├─ [~] DeletionPolicy\n    │   ├─ [-] Delete\n    │   └─ [+] Retain\n    └─ [~] UpdateReplacePolicy\n        ├─ [-] Delete\n        └─ [+] Retain\n    ```\n\n\n4. Deploy the changes `pnpm exec cdk deploy`\n\n5. Once the `RETAIN` removal policy has been successfully deployed, upgrade this library to `v4.2` (or newer v4 release):\n\n    ```sh\n    pnpm add -D aws-cdk-github-oidc@^4.2\n    ```\n\n6. Temporarily change from provider initializion to provider lookup:\n\n    ```diff\n    - const provider = new GithubActionsIdentityProvider(this, \"GithubProvider\", {\n    -  removalPolicy: cdk.RemovalPolicy.RETAIN,\n    - });\n    + const provider = GithubActionsIdentityProvider.fromAccount(this, \"GithubProviderReference\"); // NOTICE the different construct ID\n    ```\n    ⚠️ **Notice the different construct ID** (in the example `GithubProviderReference` instead of ~~`GithubProvider`~~). This is required so that the CDK treats the GitHub OIDC provider lookup as a different \"thing\" and does not try to change the type of existing construct.\n\n7. Check `pnpm exec cdk diff` which should look similar to:\n    ```sh\n    Resources\n    [-] Custom::AWSCDKOpenIdConnectProvider GithubProvider/Resource GithubProvider1CDE27EB orphan\n    [-] AWS::IAM::Role Custom::AWSCDKOpenIdConnectProviderCustomResourceProvider/Role CustomAWSCDKOpenIdConnectProviderCustomResourceProviderRole517FED65 destroy\n    [-] AWS::Lambda::Function Custom::AWSCDKOpenIdConnectProviderCustomResourceProvider/Handler CustomAWSCDKOpenIdConnectProviderCustomResourceProviderHandlerF2C543E0 destroy\n    ```\n\n8. Deploy the changes with `pnpm exec cdk deploy`\n\n9. Once the deployment has succeeded, remove the provider lookup and replace it with the original provider initialization:\n\n    ```diff\n    - const provider = GithubActionsIdentityProvider.fromAccount(this, \"GithubProviderReference\");\n    + const provider = new GithubActionsIdentityProvider(this, \"GithubProvider\", {\n    +  removalPolicy: cdk.RemovalPolicy.RETAIN,\n    + });\n    ```\n\n10. Copy the ARN of the existing OIDC provider, it will be in the format of:\n\n    ```\n    arn:aws:iam::123456789012:oidc-provider/token.actions.githubusercontent.com # REPLACE with your account ID\n    ```\n\n11. Use [cdk import](https://docs.aws.amazon.com/cdk/v2/guide/ref-cli-cmd-import.html):\n\n    ```sh\n    pnpm exec cdk import <YOUR_STACK_NAME>\n    ```\n\n    ... and when asked, input the provider ARN you copied in step 10:\n    ```sh\n    <YOUR_STACK_NAME>/GithubProvider/Resource (AWS::IAM::OIDCProvider): enter Arn (empty to skip)\n    ```\n\n12. You should be done now, but you may want to **perform manual verification** in addition to [drift detection](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/detect-drift-stack.html) and/or `cdk diff``\u001b to verify.\n\n\n\n"
+    "markdown": "> [!IMPORTANT]\n> Migrating **to `v4`**? See [Migration Guide](#migration-guide) at the end of this README.\n\n\n# AWS CDK Github OpenID Connect\n\n![cdk-support](https://img.shields.io/badge/cdk-%20typescript%20|%20python%20-informational \"TypeScript | Python\")\n[![release](https://github.com/aripalo/aws-cdk-github-oidc/actions/workflows/release.yml/badge.svg)](https://github.com/aripalo/aws-cdk-github-oidc/actions/workflows/release.yml)\n[![codecov](https://codecov.io/gh/aripalo/aws-cdk-github-oidc/branch/main/graph/badge.svg?token=5X44RM6J17)](https://codecov.io/gh/aripalo/aws-cdk-github-oidc)\n\n---\n\nAWS [CDK](https://aws.amazon.com/cdk/) constructs that define:\n\n- Github Actions as OpenID Connect Identity Provider into AWS IAM\n- IAM Roles that can be assumed by Github Actions workflows\n\nThese constructs allows you to harden your AWS deployment security by removing the need to create long-term access keys for Github Actions and instead use OpenID Connect to Authenticate your Github Action workflow with AWS IAM.\n\n## Background information\n\n![github-aws-oidc](/assets/github-aws-oidc.svg \"Github OIDC with AWS\")\n\n- [GitHub Actions: Secure cloud deployments with OpenID Connect](https://github.blog/changelog/2021-10-27-github-actions-secure-cloud-deployments-with-openid-connect/) on Github Changelog Blog.\n- [Security hardening your deployments](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments) on Github Docs.\n- [Assuming a role with `aws-actions/configure-aws-credentials`](https://github.com/aws-actions/configure-aws-credentials#assuming-a-role).\n- Shout-out to [Richard H. Boyd](https://twitter.com/rchrdbyd) for helping me to debug Github OIDC setup with AWS IAM and his [Deploying to AWS with Github Actions](https://www.githubuniverse.com/2021/session/692586/deploying-to-aws-with-github-actions)-talk.\n- Shout-out to [Aidan W Steele](https://twitter.com/__steele) and his blog post [AWS federation comes to GitHub Actions](https://awsteele.com/blog/2021/09/15/aws-federation-comes-to-github-actions.html) for being the original inspiration for this.\n\n<br/>\n\n## Getting started\n\n```shell\npnpm add -D aws-cdk-github-oidc\n```\n\n<br/>\n\n### OpenID Connect Identity Provider trust for AWS IAM\n\nTo create a new Github OIDC provider configuration into AWS IAM:\n\n```ts\nimport { GithubActionsIdentityProvider } from \"aws-cdk-github-oidc\";\n\nconst provider = new GithubActionsIdentityProvider(scope, \"GithubProvider\");\n```\n\nIn the background this creates an OIDC provider trust configuration into AWS IAM with an [issuer URL of `https://token.actions.githubusercontent.com`](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-amazon-web-services#adding-the-identity-provider-to-aws) and audiences (client IDs) configured as `['sts.amazonaws.com']` (which matches the [`aws-actions/configure-aws-credentials`](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-amazon-web-services#adding-the-identity-provider-to-aws) implementation).\n\n<br/>\n\n### Retrieving a reference to an existing Github OIDC provider configuration\n\nRemember, **there can be only one (Github OIDC provider per AWS Account)**, so to retrieve a reference to existing Github OIDC provider use `fromAccount` static method:\n\n```ts\nimport { GithubActionsIdentityProvider } from \"aws-cdk-github-oidc\";\n\nconst provider = GithubActionsIdentityProvider.fromAccount(\n  scope,\n  \"GithubProvider\"\n);\n```\n\n<br/>\n\n### Defining a role for Github Actions workflow to assume\n\n```ts\nimport { GithubActionsRole } from \"aws-cdk-github-oidc\";\n\nconst uploadRole = new GithubActionsRole(scope, \"UploadRole\", {\n  provider: provider, // reference into the OIDC provider\n  owner: \"octo-org\", // your repository owner (organization or user) name\n  repo: \"octo-repo\", // your repository name (without the owner name)\n  filter: \"ref:refs/tags/v*\", // JWT sub suffix filter, defaults to '*'\n});\n\n// use it like any other role, for example grant S3 bucket write access:\nmyBucket.grantWrite(uploadRole);\n```\n\nYou may pass in any `iam.RoleProps` into the construct's props, except `assumedBy` which will be defined by this construct (CDK will fail if you do):\n\n```ts\nconst deployRole = new GithubActionsRole(scope, \"DeployRole\", {\n  provider: provider,\n  owner: \"octo-org\",\n  repo: \"octo-repo\",\n  roleName: \"MyDeployRole\",\n  description: \"This role deploys stuff to AWS\",\n  maxSessionDuration: cdk.Duration.hours(2),\n});\n\n// You may also use various \"add*\" policy methods!\n// \"AdministratorAccess\" not really a good idea, just for an example here:\ndeployRole.addManagedPolicy(\n  iam.ManagedPolicy.fromAwsManagedPolicyName(\"AdministratorAccess\")\n);\n```\n\n<br/>\n\n#### Subject Filter\n\nBy default the value of `filter` property will be `'*'` which means any workflow (from given repository) from any branch, tag, environment or pull request can assume this role. To further stricten the OIDC trust policy on the role, you may adjust the subject filter as seen on the [examples in Github Docs](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect#configuring-the-oidc-trust-with-the-cloud); For example:\n\n| `filter` value                 | Descrition                               |\n| :----------------------------- | :--------------------------------------- |\n| `'ref:refs/tags/v*'`           | Allow only tags with prefix of `v`       |\n| `'ref:refs/heads/demo-branch'` | Allow only from branch `demo-branch`     |\n| `'pull_request'`               | Allow only from pull request             |\n| `'environment:Production'`     | Allow only from `Production` environment |\n\n<br/>\n\n### Github Actions Workflow\n\nTo actually utilize this in your Github Actions workflow, use [aws-actions/configure-aws-credentials](https://github.com/aws-actions/configure-aws-credentials) to [assume a role](https://github.com/aws-actions/configure-aws-credentials#assuming-a-role).\n\n```yaml\njobs:\n  whoami:\n    name: Who Am I\n    runs-on: ubuntu-latest\n    permissions:\n      id-token: write # needed to interact with GitHub's OIDC Token endpoint.\n    steps:\n      - name: Configure AWS credentials\n        uses: aws-actions/configure-aws-credentials@d979d5b3a71173a29b74b5b88418bfda9437d885 # v6.1.1\n        with:\n          role-to-assume: arn:aws:iam::123456789012:role/MyUploadRole\n          #role-session-name: MySessionName # Optional\n          aws-region: us-east-1\n      - name: Get Caller Identity\n        run: |\n          aws sts get-caller-identity\n```\n\n<br/>\n\n\n## Migration Guide\n\n- [v2→v3](#v2v3)\n- [v3→v4](#v3v4)\n\n### v2→v3\n\n1. Install AWS CDK version [`v2.237.0`](https://github.com/aws/aws-cdk/releases/tag/v2.237.0) or newer required (due to support of [OIDC provider removal policy](https://github.com/aws/aws-cdk/commit/09383cbad28336441f0fb405c9d8a190135620dc)):\n\n    ```sh\n    pnpm add -D aws-cdk-lib@^2.237.0\n    ```\n\n2. Install `v3.1.0` (or newer v3 release) of this library:\n\n    ```sh\n    pnpm add -D aws-cdk-github-oidc@^3.1\n    ```\n\n3. No additional steps required, as the v3 major version does not introduce any breaking changes (just a lot of internal tooling changes).\n\n### v3→v4\n\n> [!CAUTION]\n> The following steps describe a _**no-downtime** migration path_.\n> It is the recommended approach, but somewhat _involved_: Hence some users may decide to use \"destroy + redeploy\" strategy instead, which causes downtime to authenticating from GitHub Actions to AWS using OIDC.\n\n1. Ensure you are running `v3.1.0` (or newer v3 release) of this library, see [v2→v3](#v2v3).\n\n2. Configure `RETAIN` removal policy for the provider:\n\n    ```diff\n    const provider = new GithubActionsIdentityProvider(this, \"GithubProvider\", {\n    +  removalPolicy: cdk.RemovalPolicy.RETAIN,\n    });\n    ```\n\n3. Run `pnpm exec cdk diff`, which will show an output similar to:\n\n    ```sh\n    Resources\n    [~] Custom::AWSCDKOpenIdConnectProvider GithubProvider/Resource GithubProvider1CDE27EB\n    ├─ [~] DeletionPolicy\n    │   ├─ [-] Delete\n    │   └─ [+] Retain\n    └─ [~] UpdateReplacePolicy\n        ├─ [-] Delete\n        └─ [+] Retain\n    ```\n\n\n4. Deploy the changes `pnpm exec cdk deploy`\n\n5. Once the `RETAIN` removal policy has been successfully deployed, upgrade this library to `v4.2` (or newer v4 release):\n\n    ```sh\n    pnpm add -D aws-cdk-github-oidc@^4.2\n    ```\n\n6. Temporarily change from provider initializion to provider lookup:\n\n    ```diff\n    - const provider = new GithubActionsIdentityProvider(this, \"GithubProvider\", {\n    -  removalPolicy: cdk.RemovalPolicy.RETAIN,\n    - });\n    + const provider = GithubActionsIdentityProvider.fromAccount(this, \"GithubProviderReference\"); // NOTICE the different construct ID\n    ```\n    ⚠️ **Notice the different construct ID** (in the example `GithubProviderReference` instead of ~~`GithubProvider`~~). This is required so that the CDK treats the GitHub OIDC provider lookup as a different \"thing\" and does not try to change the type of existing construct.\n\n7. Check `pnpm exec cdk diff` which should look similar to:\n    ```sh\n    Resources\n    [-] Custom::AWSCDKOpenIdConnectProvider GithubProvider/Resource GithubProvider1CDE27EB orphan\n    [-] AWS::IAM::Role Custom::AWSCDKOpenIdConnectProviderCustomResourceProvider/Role CustomAWSCDKOpenIdConnectProviderCustomResourceProviderRole517FED65 destroy\n    [-] AWS::Lambda::Function Custom::AWSCDKOpenIdConnectProviderCustomResourceProvider/Handler CustomAWSCDKOpenIdConnectProviderCustomResourceProviderHandlerF2C543E0 destroy\n    ```\n\n8. Deploy the changes with `pnpm exec cdk deploy`\n\n9. Once the deployment has succeeded, remove the provider lookup and replace it with the original provider initialization:\n\n    ```diff\n    - const provider = GithubActionsIdentityProvider.fromAccount(this, \"GithubProviderReference\");\n    + const provider = new GithubActionsIdentityProvider(this, \"GithubProvider\", {\n    +  removalPolicy: cdk.RemovalPolicy.RETAIN,\n    + });\n    ```\n\n10. Copy the ARN of the existing OIDC provider, it will be in the format of:\n\n    ```\n    arn:aws:iam::123456789012:oidc-provider/token.actions.githubusercontent.com # REPLACE with your account ID\n    ```\n\n11. Use [cdk import](https://docs.aws.amazon.com/cdk/v2/guide/ref-cli-cmd-import.html):\n\n    ```sh\n    pnpm exec cdk import <YOUR_STACK_NAME>\n    ```\n\n    ... and when asked, input the provider ARN you copied in step 10:\n    ```sh\n    <YOUR_STACK_NAME>/GithubProvider/Resource (AWS::IAM::OIDCProvider): enter Arn (empty to skip)\n    ```\n\n12. You should be done now, but you may want to **perform manual verification** in addition to [drift detection](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/detect-drift-stack.html) and/or `cdk diff``\u001b to verify.\n\n\n\n"
   },
   "repository": {
     "type": "git",
@@ -9075,6 +9075,6 @@
       "symbolId": "src/iam-role-props:RoleProps"
     }
   },
-  "version": "4.2.3",
-  "fingerprint": "2wBSfbl4NjZPbtA4CvGLHgrlwl8k16XH/jfq1QzleJo="
+  "version": "4.2.5",
+  "fingerprint": "LTZU9YOlnf1mcr4UKY3KF3J2SeSq64fZPLauWde6gMI="
 }

package/README.md

@@ -149,7 +149,7 @@ jobs:
 
 ### v2→v3
 
-1. Install AWS CDK version [`v2.237.0`](https://github.com/aws/aws-cdk/releases/tag/v2.237.0) or newer required (due to support of [OIDC provider removal policy support](https://github.com/aws/aws-cdk/commit/09383cbad28336441f0fb405c9d8a190135620dc)):
+1. Install AWS CDK version [`v2.237.0`](https://github.com/aws/aws-cdk/releases/tag/v2.237.0) or newer required (due to support of [OIDC provider removal policy](https://github.com/aws/aws-cdk/commit/09383cbad28336441f0fb405c9d8a190135620dc)):
     
     ```sh
     pnpm add -D aws-cdk-lib@^2.237.0

package/lib/provider.js

@@ -55,6 +55,6 @@ class GithubActionsIdentityProvider extends iam.OidcProviderNative {
 }
 exports.GithubActionsIdentityProvider = GithubActionsIdentityProvider;
 _a = JSII_RTTI_SYMBOL_1;
-GithubActionsIdentityProvider[_a] = { fqn: "aws-cdk-github-oidc.GithubActionsIdentityProvider", version: "4.2.3" };
+GithubActionsIdentityProvider[_a] = { fqn: "aws-cdk-github-oidc.GithubActionsIdentityProvider", version: "4.2.5" };
 GithubActionsIdentityProvider.issuer = "token.actions.githubusercontent.com";
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicHJvdmlkZXIuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi9zcmMvcHJvdmlkZXIudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7QUFBQSxtQ0FBbUM7QUFDbkMsMkNBQTJDO0FBaUIzQzs7Ozs7Ozs7O0dBU0c7QUFDSCxNQUFhLDZCQUNYLFNBQVEsR0FBRyxDQUFDLGtCQUFrQjtJQUs5Qjs7Ozs7Ozs7Ozs7O09BWUc7SUFDSSxNQUFNLENBQUMsV0FBVyxDQUN2QixLQUFnQixFQUNoQixFQUFVO1FBRVYsTUFBTSxTQUFTLEdBQUcsR0FBRyxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUMsS0FBSyxDQUFDLENBQUMsT0FBTyxDQUFDO1FBQzlDLE1BQU0sV0FBVyxHQUFHLGdCQUFnQixTQUFTLGtCQUFrQiw2QkFBNkIsQ0FBQyxNQUFNLEVBQUUsQ0FBQztRQUN0RyxPQUFPLEdBQUcsQ0FBQyxrQkFBa0IsQ0FBQyxtQkFBbUIsQ0FBQyxLQUFLLEVBQUUsRUFBRSxFQUFFLFdBQVcsQ0FBQyxDQUFDO0lBQzVFLENBQUM7SUFFRDs7Ozs7Ozs7OztPQVVHO0lBQ0gsWUFDRSxLQUFnQixFQUNoQixFQUFVLEVBQ1YsS0FBMEM7UUFFMUMsS0FBSyxDQUFDLEtBQUssRUFBRSxFQUFFLEVBQUU7WUFDZixHQUFHLEtBQUs7WUFDUixHQUFHLEVBQUUsV0FBVyw2QkFBNkIsQ0FBQyxNQUFNLEVBQUU7WUFDdEQsU0FBUyxFQUFFLENBQUMsbUJBQW1CLENBQUM7U0FDakMsQ0FBQyxDQUFDO0lBQ0wsQ0FBQzs7QUFqREgsc0VBa0RDOzs7QUE5Q3dCLG9DQUFNLEdBQVcscUNBQXFDLENBQUMiLCJzb3VyY2VzQ29udGVudCI6WyJpbXBvcnQgKiBhcyBjZGsgZnJvbSBcImF3cy1jZGstbGliXCI7XG5pbXBvcnQgKiBhcyBpYW0gZnJvbSBcImF3cy1jZGstbGliL2F3cy1pYW1cIjtcbmltcG9ydCB7IENvbnN0cnVjdCB9IGZyb20gXCJjb25zdHJ1Y3RzXCI7XG5cbmV4cG9ydCBpbnRlcmZhY2UgR2l0aHViQWN0aW9uc0lkZW50aXR5UHJvdmlkZXJQcm9wcyB7XG4gIC8qKlxuICAgKiBUaGUgcmVtb3ZhbCBwb2xpY3kgZm9yIHRoZSBwcm92aWRlci5cbiAgICpcbiAgICogQGRlZmF1bHQgY2RrLlJlbW92YWxQb2xpY3kuREVTVFJPWVxuICAgKi9cbiAgcmVhZG9ubHkgcmVtb3ZhbFBvbGljeT86IGNkay5SZW1vdmFsUG9saWN5O1xufVxuXG4vKipcbiAqIERlc2NyaWJlcyBhIEdpdGh1YiBPcGVuSUQgQ29ubmVjdCBJZGVudGl0eSBQcm92aWRlciBmb3IgQVdTIElBTS5cbiAqL1xuZXhwb3J0IGludGVyZmFjZSBJR2l0aHViQWN0aW9uc0lkZW50aXR5UHJvdmlkZXIgZXh0ZW5kcyBpYW0uSU9pZGNQcm92aWRlciB7fVxuXG4vKipcbiAqIEdpdGh1YiBBY3Rpb25zIGFzIE9wZW5JRCBDb25uZWN0IElkZW50aXR5IFByb3ZpZGVyIGZvciBBV1MgSUFNLlxuICogVGhlcmUgY2FuIGJlIG9ubHkgb25lIChwZXIgQVdTIEFjY291bnQpLlxuICpcbiAqIFVzZSBgZnJvbUFjY291bnRgIHRvIHJldHJpZXZlIGEgcmVmZXJlbmNlIHRvIGV4aXN0aW5nIEdpdGh1YiBPSURDIHByb3ZpZGVyLlxuICpcbiAqIFVzZXMgdGhlIG5hdGl2ZSBDbG91ZEZvcm1hdGlvbiByZXNvdXJjZSBBV1M6OklBTTo6T0lEQ1Byb3ZpZGVyIChubyBMYW1iZGEgZnVuY3Rpb25zKS5cbiAqXG4gKiBAc2VlIGh0dHBzOi8vZG9jcy5naXRodWIuY29tL2VuL2FjdGlvbnMvZGVwbG95bWVudC9zZWN1cml0eS1oYXJkZW5pbmcteW91ci1kZXBsb3ltZW50cy9jb25maWd1cmluZy1vcGVuaWQtY29ubmVjdC1pbi1hbWF6b24td2ViLXNlcnZpY2VzXG4gKi9cbmV4cG9ydCBjbGFzcyBHaXRodWJBY3Rpb25zSWRlbnRpdHlQcm92aWRlclxuICBleHRlbmRzIGlhbS5PaWRjUHJvdmlkZXJOYXRpdmVcbiAgaW1wbGVtZW50cyBJR2l0aHViQWN0aW9uc0lkZW50aXR5UHJvdmlkZXJcbntcbiAgcHVibGljIHN0YXRpYyByZWFkb25seSBpc3N1ZXI6IHN0cmluZyA9IFwidG9rZW4uYWN0aW9ucy5naXRodWJ1c2VyY29udGVudC5jb21cIjtcblxuICAvKipcbiAgICogUmV0cmlldmUgYSByZWZlcmVuY2UgdG8gZXhpc3RpbmcgR2l0aHViIE9JREMgcHJvdmlkZXIgaW4geW91ciBBV1MgYWNjb3VudC5cbiAgICogQW4gQVdTIGFjY291bnQgY2FuIG9ubHkgaGF2ZSBzaW5nbGUgR2l0aHViIE9JREMgcHJvdmlkZXIgY29uZmlndXJlZCBpbnRvIGl0LFxuICAgKiBzbyBpbnRlcm5hbGx5IHRoZSByZWZlcmVuY2UgaXMgbWFkZSBieSBjb25zdHJ1Y3RpbmcgdGhlIEFSTiBmcm9tIEFXU1xuICAgKiBBY2NvdW50IElEICYgR2l0aHViIGlzc3VlciBVUkwuXG4gICAqXG4gICAqIEBwYXJhbSBzY29wZSBDREsgU3RhY2sgb3IgQ29uc3RydWN0IHRvIHdoaWNoIHRoZSBwcm92aWRlciBpcyBhc3NpZ25lZCB0b1xuICAgKiBAcGFyYW0gaWQgQ0RLIENvbnN0cnVjdCBJRCBnaXZlbiB0byB0aGUgY29uc3RydWN0XG4gICAqIEByZXR1cm5zIGEgQ0RLIENvbnN0cnVjdCByZXByZXNlbnRpbmcgdGhlIEdpdGh1YiBPSURDIHByb3ZpZGVyXG4gICAqXG4gICAqIEBleGFtcGxlXG4gICAqIEdpdGh1YkFjdGlvbnNJZGVudGl0eVByb3ZpZGVyLmZyb21BY2NvdW50KHNjb3BlLCBcIkdpdGh1YlByb3ZpZGVyXCIpO1xuICAgKi9cbiAgcHVibGljIHN0YXRpYyBmcm9tQWNjb3VudChcbiAgICBzY29wZTogQ29uc3RydWN0LFxuICAgIGlkOiBzdHJpbmcsXG4gICk6IElHaXRodWJBY3Rpb25zSWRlbnRpdHlQcm92aWRlciB7XG4gICAgY29uc3QgYWNjb3VudElkID0gY2RrLlN0YWNrLm9mKHNjb3BlKS5hY2NvdW50O1xuICAgIGNvbnN0IHByb3ZpZGVyQXJuID0gYGFybjphd3M6aWFtOjoke2FjY291bnRJZH06b2lkYy1wcm92aWRlci8ke0dpdGh1YkFjdGlvbnNJZGVudGl0eVByb3ZpZGVyLmlzc3Vlcn1gO1xuICAgIHJldHVybiBpYW0uT2lkY1Byb3ZpZGVyTmF0aXZlLmZyb21PaWRjUHJvdmlkZXJBcm4oc2NvcGUsIGlkLCBwcm92aWRlckFybik7XG4gIH1cblxuICAvKipcbiAgICogRGVmaW5lIGEgbmV3IEdpdGh1YiBPcGVuSUQgQ29ubmVjdCBJZGVudGl0eSBQcm92aWRlciBmb3IgQVdTIElBTS5cbiAgICogVGhlcmUgY2FuIGJlIG9ubHkgb25lIChwZXIgQVdTIEFjY291bnQpLlxuICAgKlxuICAgKiBAcGFyYW0gc2NvcGUgQ0RLIFN0YWNrIG9yIENvbnN0cnVjdCB0byB3aGljaCB0aGUgcHJvdmlkZXIgaXMgYXNzaWduZWQgdG9cbiAgICogQHBhcmFtIGlkIENESyBDb25zdHJ1Y3QgSUQgZ2l2ZW4gdG8gdGhlIGNvbnN0cnVjdFxuICAgKiBAcGFyYW0gcHJvcHMgb3B0aW9uYWwgcHJvcGVydGllcyBmb3IgdGhlIHByb3ZpZGVyXG4gICAqXG4gICAqIEBleGFtcGxlXG4gICAqIG5ldyBHaXRodWJBY3Rpb25zSWRlbnRpdHlQcm92aWRlcihzY29wZSwgXCJHaXRodWJQcm92aWRlclwiKTtcbiAgICovXG4gIGNvbnN0cnVjdG9yKFxuICAgIHNjb3BlOiBDb25zdHJ1Y3QsXG4gICAgaWQ6IHN0cmluZyxcbiAgICBwcm9wcz86IEdpdGh1YkFjdGlvbnNJZGVudGl0eVByb3ZpZGVyUHJvcHMsXG4gICkge1xuICAgIHN1cGVyKHNjb3BlLCBpZCwge1xuICAgICAgLi4ucHJvcHMsXG4gICAgICB1cmw6IGBodHRwczovLyR7R2l0aHViQWN0aW9uc0lkZW50aXR5UHJvdmlkZXIuaXNzdWVyfWAsXG4gICAgICBjbGllbnRJZHM6IFtcInN0cy5hbWF6b25hd3MuY29tXCJdLFxuICAgIH0pO1xuICB9XG59XG4iXX0=

package/lib/role.js

@@ -101,5 +101,5 @@ class GithubActionsRole extends iam.Role {
 }
 exports.GithubActionsRole = GithubActionsRole;
 _a = JSII_RTTI_SYMBOL_1;
-GithubActionsRole[_a] = { fqn: "aws-cdk-github-oidc.GithubActionsRole", version: "4.2.3" };
+GithubActionsRole[_a] = { fqn: "aws-cdk-github-oidc.GithubActionsRole", version: "4.2.5" };
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicm9sZS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3NyYy9yb2xlLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7Ozs7O0FBQUEsbUNBQW1DO0FBQ25DLDJDQUEyQztBQUczQyxpREFBaUQ7QUFDakQseUNBR29CO0FBb0VwQjs7Ozs7Ozs7Ozs7Ozs7Ozs7R0FpQkc7QUFDSCxNQUFhLGlCQUFrQixTQUFRLEdBQUcsQ0FBQyxJQUFJO0lBQzdDOzs7O09BSUc7SUFDSyxNQUFNLENBQUMsZ0JBQWdCLENBQzdCLEtBQTZCO1FBRTdCLE1BQU0sWUFBWSxHQUFRLEtBQUssQ0FBQztRQUNoQyxPQUFPLFlBQVksQ0FBQyxRQUFRLENBQUM7UUFDN0IsT0FBTyxZQUFZLENBQUMsS0FBSyxDQUFDO1FBQzFCLE9BQU8sWUFBWSxDQUFDLElBQUksQ0FBQztRQUN6QixPQUFPLFlBQVksQ0FBQyxNQUFNLENBQUM7UUFDM0IsT0FBTyxZQUFZLENBQUM7SUFDdEIsQ0FBQztJQUVELDhEQUE4RDtJQUN0RCxNQUFNLENBQUMsYUFBYSxDQUFDLEtBQWdCLEVBQUUsS0FBYTtRQUMxRCxJQUFJLHNCQUFtQixDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsS0FBSyxJQUFJLEVBQUUsQ0FBQztZQUM3QyxHQUFHLENBQUMsV0FBVyxDQUFDLEVBQUUsQ0FBQyxLQUFLLENBQUMsQ0FBQyxRQUFRLENBQ2hDLG9DQUFvQyxLQUFLLDBLQUEwSyxDQUNwTixDQUFDO1FBQ0osQ0FBQztJQUNILENBQUM7SUFFRCw0REFBNEQ7SUFDcEQsTUFBTSxDQUFDLFlBQVksQ0FBQyxLQUFnQixFQUFFLElBQVk7UUFDeEQsSUFBSSxJQUFJLEtBQUssRUFBRSxFQUFFLENBQUM7WUFDaEIsR0FBRyxDQUFDLFdBQVcsQ0FBQyxFQUFFLENBQUMsS0FBSyxDQUFDLENBQUMsUUFBUSxDQUNoQyxtQ0FBbUMsSUFBSSw2QkFBNkIsQ0FDckUsQ0FBQztRQUNKLENBQUM7SUFDSCxDQUFDO0lBRUQsb0RBQW9EO0lBQzVDLE1BQU0sQ0FBQyxhQUFhLENBQUMsS0FBMEI7UUFDckQsTUFBTSxFQUFFLEtBQUssRUFBRSxJQUFJLEVBQUUsTUFBTSxHQUFHLEdBQUcsRUFBRSxHQUFHLEtBQUssQ0FBQztRQUM1QyxPQUFPLFFBQVEsS0FBSyxJQUFJLElBQUksSUFBSSxNQUFNLEVBQUUsQ0FBQztJQUMzQyxDQUFDO0lBRUQ7Ozs7Ozs7Ozs7Ozs7Ozs7O09BaUJHO0lBQ0gsWUFBWSxLQUFnQixFQUFFLEVBQVUsRUFBRSxLQUE2QjtRQUNyRSxNQUFNLEVBQUUsUUFBUSxFQUFFLEtBQUssRUFBRSxJQUFJLEVBQUUsR0FBRyxLQUFLLENBQUM7UUFFeEMsc0JBQXNCO1FBQ3RCLGlCQUFpQixDQUFDLGFBQWEsQ0FBQyxLQUFLLEVBQUUsS0FBSyxDQUFDLENBQUM7UUFDOUMsaUJBQWlCLENBQUMsWUFBWSxDQUFDLEtBQUssRUFBRSxJQUFJLENBQUMsQ0FBQztRQUU1QyxpQkFBaUI7UUFDakIsTUFBTSxPQUFPLEdBQUcsaUJBQWlCLENBQUMsYUFBYSxDQUFDLEtBQUssQ0FBQyxDQUFDO1FBQ3ZELE1BQU0sU0FBUyxHQUFHLGlCQUFpQixDQUFDLGdCQUFnQixDQUFDLEtBQUssQ0FBQyxDQUFDO1FBRTVELCtCQUErQjtRQUMvQixLQUFLLENBQUMsS0FBSyxFQUFFLEVBQUUsRUFBRTtZQUNmLEdBQUcsU0FBUztZQUNaLFNBQVMsRUFBRSxJQUFJLEdBQUcsQ0FBQyxvQkFBb0IsQ0FBQyxRQUFRLENBQUMsZUFBZSxFQUFFO2dCQUNoRSxVQUFVLEVBQUU7b0JBQ1Ysb0RBQW9EO29CQUNwRCxDQUFDLEdBQUcsd0NBQTZCLENBQUMsTUFBTSxNQUFNLENBQUMsRUFBRSxPQUFPO2lCQUN6RDtnQkFDRCxZQUFZLEVBQUU7b0JBQ1osdUVBQXVFO29CQUN2RSwwS0FBMEs7b0JBQzFLLENBQUMsR0FBRyx3Q0FBNkIsQ0FBQyxNQUFNLE1BQU0sQ0FBQyxFQUFFLG1CQUFtQjtpQkFDckU7YUFDRixDQUFDO1NBQ0gsQ0FBQyxDQUFDO0lBQ0wsQ0FBQzs7QUFyRkgsOENBc0ZDIiwic291cmNlc0NvbnRlbnQiOlsiaW1wb3J0ICogYXMgY2RrIGZyb20gXCJhd3MtY2RrLWxpYlwiO1xuaW1wb3J0ICogYXMgaWFtIGZyb20gXCJhd3MtY2RrLWxpYi9hd3MtaWFtXCI7XG5pbXBvcnQgeyBDb25zdHJ1Y3QgfSBmcm9tIFwiY29uc3RydWN0c1wiO1xuaW1wb3J0IHsgUm9sZVByb3BzIH0gZnJvbSBcIi4vaWFtLXJvbGUtcHJvcHNcIjtcbmltcG9ydCBnaXRodWJVc2VybmFtZVJlZ2V4IGZyb20gXCIuL293bmVyLXJlZ2V4cFwiO1xuaW1wb3J0IHtcbiAgR2l0aHViQWN0aW9uc0lkZW50aXR5UHJvdmlkZXIsXG4gIElHaXRodWJBY3Rpb25zSWRlbnRpdHlQcm92aWRlcixcbn0gZnJvbSBcIi4vcHJvdmlkZXJcIjtcblxuLyoqXG4gKiBHaXRodWIgcmVsYXRlZCBjb25maWd1cmF0aW9uIHRoYXQgZm9ybXMgdGhlIHRydXN0IHBvbGljeSBmb3IgdGhpcyBJQU0gUm9sZS5cbiAqL1xuZXhwb3J0IGludGVyZmFjZSBHaXRodWJDb25maWd1cmF0aW9uIHtcbiAgLyoqXG4gICAqIFJlZmVyZW5jZSB0byBHaXRodWIgT3BlbklEIENvbm5lY3QgUHJvdmlkZXIgY29uZmlndXJlZCBpbiBBV1MgSUFNLlxuICAgKlxuICAgKiBFaXRoZXIgcGFzcyBhbiBjb25zdHJ1Y3QgZGVmaW5lZCBieSBgbmV3IEdpdGh1YkFjdGlvbnNJZGVudGl0eVByb3ZpZGVyYFxuICAgKiBvciBhIHJldHJpZXZlZCByZWZlcmVuY2UgZnJvbSBgR2l0aHViQWN0aW9uc0lkZW50aXR5UHJvdmlkZXIuZnJvbUFjY291bnRgLlxuICAgKiBUaGVyZSBjYW4gYmUgb25seSBvbmUgKHBlciBBV1MgQWNjb3VudCkuXG4gICAqL1xuICByZWFkb25seSBwcm92aWRlcjogSUdpdGh1YkFjdGlvbnNJZGVudGl0eVByb3ZpZGVyO1xuXG4gIC8qKlxuICAgKiBSZXBvc2l0b3J5IG93bmVyIChvcmdhbml6YXRpb24gb3IgdXNlcm5hbWUpLlxuICAgKlxuICAgKiBAZXhhbXBsZVxuICAgKiAnb2N0by1vcmcnXG4gICAqL1xuICByZWFkb25seSBvd25lcjogc3RyaW5nO1xuXG4gIC8qKlxuICAgKiBSZXBvc2l0b3J5IG5hbWUgKHNsdWcpIHdpdGhvdXQgdGhlIG93bmVyLlxuICAgKlxuICAgKiBAZXhhbXBsZVxuICAgKiAnb2N0by1yZXBvJ1xuICAgKi9cbiAgcmVhZG9ubHkgcmVwbzogc3RyaW5nO1xuXG4gIC8qKlxuICAgKiBTdWJqZWN0IGNvbmRpdGlvbiBmaWx0ZXIsIGFwcGVuZGVkIGFmdGVyIGByZXBvOiR7b3duZXJ9LyR7cmVwb306YCBzdHJpbmcgaW4gSUFNIFJvbGUgdHJ1c3QgcmVsYXRpb25zaGlwLlxuICAgKlxuICAgKiBAZGVmYXVsdFxuICAgKiAnKidcbiAgICpcbiAgICogWW91IG1heSB1c2UgdGhpcyB2YWx1ZSB0byBvbmx5IGFsbG93IEdpdGh1YiB0byBhc3N1bWUgdGhlIHJvbGUgb24gc3BlY2lmaWMgYnJhbmNoZXMsIHRhZ3MsIGVudmlyb25tZW50cywgcHVsbCByZXF1ZXN0cyBldGMuXG4gICAqIEBleGFtcGxlXG4gICAqICdyZWY6cmVmcy90YWdzL3YqJ1xuICAgKiAncmVmOnJlZnMvaGVhZHMvZGVtby1icmFuY2gnXG4gICAqICdwdWxsX3JlcXVlc3QnXG4gICAqICdlbnZpcm9ubWVudDpQcm9kdWN0aW9uJ1xuICAgKlxuICAgKiBAc2VlIGh0dHBzOi8vZG9jcy5naXRodWIuY29tL2VuL2FjdGlvbnMvZGVwbG95bWVudC9zZWN1cml0eS1oYXJkZW5pbmcteW91ci1kZXBsb3ltZW50cy9hYm91dC1zZWN1cml0eS1oYXJkZW5pbmctd2l0aC1vcGVuaWQtY29ubmVjdCNleGFtcGxlc1xuICAgKi9cbiAgcmVhZG9ubHkgZmlsdGVyPzogc3RyaW5nO1xufVxuXG4vKipcbiAqIFByb3BzIHRoYXQgZGVmaW5lIHRoZSBJQU0gUm9sZSB0aGF0IGNhbiBiZSBhc3N1bWVkIGJ5IEdpdGh1YiBBY3Rpb25zIHdvcmtmbG93XG4gKiB2aWEgR2l0aHViIE9wZW5JRCBDb25uZWN0IElkZW50aXR5IFByb3ZpZGVyLlxuICpcbiAqIEJlc2lkZXMgYEdpdGh1YkNvbmZpZ3VyYXRpb25gLCB5b3UgbWF5IHBhc3MgaW4gYW55IGBpYW0uUm9sZVByb3BzYCBleGNlcHQgYGFzc3VtZWRCeWBcbiAqIHdoaWNoIHdpbGwgYmUgZGVmaW5lZCBieSB0aGlzIGNvbnN0cnVjdCAoQ0RLIHdpbGwgZmFpbCBpZiB5b3UgZG8pLlxuICpcbiAqIEBleGFtcGxlXG4gKiB7XG4gKiAgIHByb3ZpZGVyOiBHaXRodWJBY3Rpb25zSWRlbnRpdHlQcm92aWRlci5mcm9tQWNjb3VudChzY29wZSwgXCJHaXRodWJQcm92aWRlclwiKSxcbiAqICAgb3duZXI6ICdvY3RvLW9yZycsXG4gKiAgIHJlcG86ICdvY3RvLXJlcG8nLFxuICogICBmaWx0ZXI6ICdyZWY6cmVmcy90YWdzL3YqJyxcbiAqICAgcm9sZU5hbWU6ICdNeURlcGxveVJvbGUnLFxuICogfVxuICovXG5leHBvcnQgaW50ZXJmYWNlIEdpdGh1YkFjdGlvbnNSb2xlUHJvcHNcbiAgZXh0ZW5kcyBHaXRodWJDb25maWd1cmF0aW9uLCBSb2xlUHJvcHMge31cblxuLyoqXG4gKiBEZWZpbmUgYW4gSUFNIFJvbGUgdGhhdCBjYW4gYmUgYXNzdW1lZCBieSBHaXRodWIgQWN0aW9ucyB3b3JrZmxvd1xuICogdmlhIEdpdGh1YiBPcGVuSUQgQ29ubmVjdCBJZGVudGl0eSBQcm92aWRlci5cbiAqXG4gKiBCZXNpZGVzIGBHaXRodWJDb25maWd1cmF0aW9uYCwgeW91IG1heSBwYXNzIGluIGFueSBgaWFtLlJvbGVQcm9wc2AgZXhjZXB0IGBhc3N1bWVkQnlgXG4gKiB3aGljaCB3aWxsIGJlIGRlZmluZWQgYnkgdGhpcyBjb25zdHJ1Y3QgKENESyB3aWxsIGZhaWwgaWYgeW91IGRvKS5cbiAqXG4gKiBAZXhhbXBsZVxuICogY29uc3QgdXBsb2FkUm9sZSA9IG5ldyBHaXRodWJBY3Rpb25zUm9sZShzY29wZSwgXCJVcGxvYWRSb2xlXCIsIHtcbiAqICAgcHJvdmlkZXI6IEdpdGh1YkFjdGlvbnNJZGVudGl0eVByb3ZpZGVyLmZyb21BY2NvdW50KHNjb3BlLCBcIkdpdGh1YlByb3ZpZGVyXCIpLFxuICogICBvd25lcjogJ29jdG8tb3JnJyxcbiAqICAgcmVwbzogJ29jdG8tcmVwbycsXG4gKiAgIGZpbHRlcjogJ3JlZjpyZWZzL3RhZ3MvdionLFxuICogICByb2xlTmFtZTogJ015VXBsb2FkUm9sZScsXG4gKiB9KTtcbiAqXG4gKiBteUJ1Y2tldC5ncmFudFdyaXRlKHVwbG9hZFJvbGUpO1xuICovXG5leHBvcnQgY2xhc3MgR2l0aHViQWN0aW9uc1JvbGUgZXh0ZW5kcyBpYW0uUm9sZSB7XG4gIC8qKlxuICAgKiBFeHRyYWN0cyBwcm9wcyBnaXZlbiBmb3IgdGhlIGNyZWF0ZWQgSUFNIFJvbGUgQ29uc3RydWN0LlxuICAgKiBAcGFyYW0gcHJvcHMgZm9yIHRoZSBHaXRodWJBY3Rpb25zUm9sZVxuICAgKiBAcmV0dXJucyBmb3IgdGhlIElBTSBSb2xlXG4gICAqL1xuICBwcml2YXRlIHN0YXRpYyBleHRyYWN0Um9sZVByb3BzKFxuICAgIHByb3BzOiBHaXRodWJBY3Rpb25zUm9sZVByb3BzLFxuICApOiBpYW0uUm9sZVByb3BzIHtcbiAgICBjb25zdCBleHRyYWN0UHJvcHMgPSA8YW55PnByb3BzO1xuICAgIGRlbGV0ZSBleHRyYWN0UHJvcHMucHJvdmlkZXI7XG4gICAgZGVsZXRlIGV4dHJhY3RQcm9wcy5vd25lcjtcbiAgICBkZWxldGUgZXh0cmFjdFByb3BzLnJlcG87XG4gICAgZGVsZXRlIGV4dHJhY3RQcm9wcy5maWx0ZXI7XG4gICAgcmV0dXJuIGV4dHJhY3RQcm9wcztcbiAgfVxuXG4gIC8qKiBWYWxpZGF0ZXMgdGhlIEdpdGh1YiBvd25lciAob3JnYW5pemF0aW9uIG9yIHVzZXIpIG5hbWUuICovXG4gIHByaXZhdGUgc3RhdGljIHZhbGlkYXRlT3duZXIoc2NvcGU6IENvbnN0cnVjdCwgb3duZXI6IHN0cmluZyk6IHZvaWQge1xuICAgIGlmIChnaXRodWJVc2VybmFtZVJlZ2V4LnRlc3Qob3duZXIpICE9PSB0cnVlKSB7XG4gICAgICBjZGsuQW5ub3RhdGlvbnMub2Yoc2NvcGUpLmFkZEVycm9yKFxuICAgICAgICBgSW52YWxpZCBHaXRodWIgUmVwb3NpdG9yeSBPd25lciBcIiR7b3duZXJ9XCIuIE11c3Qgb25seSBjb250YWluIGFscGhhbnVtZXJpYyBjaGFyYWN0ZXJzIG9yIGh5cGhlbnMsIGNhbm5vdCBoYXZlIG11bHRpcGxlIGNvbnNlY3V0aXZlIGh5cGhlbnMsIGNhbm5vdCBiZWdpbiBvciBlbmQgd2l0aCBhIGh5cGVuIGFuZCBtYXhpbXVtIGxlbmdodCBpcyAzOSBjaGFyYWN0ZXJzLmAsXG4gICAgICApO1xuICAgIH1cbiAgfVxuXG4gIC8qKiBWYWxpZGF0ZXMgdGhlIEdpdGh1YiByZXBvc2l0b3J5IG5hbWUgKHdpdGhvdXQgb3duZXIpLiAqL1xuICBwcml2YXRlIHN0YXRpYyB2YWxpZGF0ZVJlcG8oc2NvcGU6IENvbnN0cnVjdCwgcmVwbzogc3RyaW5nKTogdm9pZCB7XG4gICAgaWYgKHJlcG8gPT09IFwiXCIpIHtcbiAgICAgIGNkay5Bbm5vdGF0aW9ucy5vZihzY29wZSkuYWRkRXJyb3IoXG4gICAgICAgIGBJbnZhbGlkIEdpdGh1YiBSZXBvc2l0b3J5IE5hbWUgXCIke3JlcG99XCIuIE1heSBub3QgYmUgZW1wdHkgc3RyaW5nLmAsXG4gICAgICApO1xuICAgIH1cbiAgfVxuXG4gIC8qKiBGb3JtYXRzIHRoZSBgc3ViYCB2YWx1ZSB1c2VkIGluIHRydXN0IHBvbGljeS4gKi9cbiAgcHJpdmF0ZSBzdGF0aWMgZm9ybWF0U3ViamVjdChwcm9wczogR2l0aHViQ29uZmlndXJhdGlvbik6IHN0cmluZyB7XG4gICAgY29uc3QgeyBvd25lciwgcmVwbywgZmlsdGVyID0gXCIqXCIgfSA9IHByb3BzO1xuICAgIHJldHVybiBgcmVwbzoke293bmVyfS8ke3JlcG99OiR7ZmlsdGVyfWA7XG4gIH1cblxuICAvKipcbiAgICogRGVmaW5lIGFuIElBTSBSb2xlIHRoYXQgY2FuIGJlIGFzc3VtZWQgYnkgR2l0aHViIEFjdGlvbnMgd29ya2Zsb3dcbiAgICogdmlhIEdpdGh1YiBPcGVuSUQgQ29ubmVjdCBJZGVudGl0eSBQcm92aWRlci5cbiAgICpcbiAgICogQmVzaWRlcyBgR2l0aHViQ29uZmlndXJhdGlvbmAsIHlvdSBtYXkgcGFzcyBpbiBhbnkgYGlhbS5Sb2xlUHJvcHNgIGV4Y2VwdCBgYXNzdW1lZEJ5YFxuICAgKiB3aGljaCB3aWxsIGJlIGRlZmluZWQgYnkgdGhpcyBjb25zdHJ1Y3QgKENESyB3aWxsIGZhaWwgaWYgeW91IGRvKS5cbiAgICpcbiAgICogQGV4YW1wbGVcbiAgICogY29uc3QgdXBsb2FkUm9sZSA9IG5ldyBHaXRodWJBY3Rpb25zUm9sZShzY29wZSwgXCJVcGxvYWRSb2xlXCIsIHtcbiAgICogICBwcm92aWRlcjogR2l0aHViQWN0aW9uc0lkZW50aXR5UHJvdmlkZXIuZnJvbUFjY291bnQoc2NvcGUsIFwiR2l0aHViUHJvdmlkZXJcIiksXG4gICAqICAgb3duZXI6ICdvY3RvLW9yZycsXG4gICAqICAgcmVwbzogJ29jdG8tcmVwbycsXG4gICAqICAgZmlsdGVyOiAncmVmOnJlZnMvdGFncy92KicsXG4gICAqICAgcm9sZU5hbWU6ICdNeVVwbG9hZFJvbGUnLFxuICAgKiB9KTtcbiAgICpcbiAgICogbXlCdWNrZXQuZ3JhbnRXcml0ZSh1cGxvYWRSb2xlKTtcbiAgICovXG4gIGNvbnN0cnVjdG9yKHNjb3BlOiBDb25zdHJ1Y3QsIGlkOiBzdHJpbmcsIHByb3BzOiBHaXRodWJBY3Rpb25zUm9sZVByb3BzKSB7XG4gICAgY29uc3QgeyBwcm92aWRlciwgb3duZXIsIHJlcG8gfSA9IHByb3BzO1xuXG4gICAgLy8gUGVyZm9ybSB2YWxpZGF0aW9uc1xuICAgIEdpdGh1YkFjdGlvbnNSb2xlLnZhbGlkYXRlT3duZXIoc2NvcGUsIG93bmVyKTtcbiAgICBHaXRodWJBY3Rpb25zUm9sZS52YWxpZGF0ZVJlcG8oc2NvcGUsIHJlcG8pO1xuXG4gICAgLy8gUHJlcGFyZSB2YWx1ZXNcbiAgICBjb25zdCBzdWJqZWN0ID0gR2l0aHViQWN0aW9uc1JvbGUuZm9ybWF0U3ViamVjdChwcm9wcyk7XG4gICAgY29uc3Qgcm9sZVByb3BzID0gR2l0aHViQWN0aW9uc1JvbGUuZXh0cmFjdFJvbGVQcm9wcyhwcm9wcyk7XG5cbiAgICAvLyBUaGUgYWN0dWFsIElBTSBSb2xlIGNyZWF0aW9uXG4gICAgc3VwZXIoc2NvcGUsIGlkLCB7XG4gICAgICAuLi5yb2xlUHJvcHMsXG4gICAgICBhc3N1bWVkQnk6IG5ldyBpYW0uV2ViSWRlbnRpdHlQcmluY2lwYWwocHJvdmlkZXIub2lkY1Byb3ZpZGVyQXJuLCB7XG4gICAgICAgIFN0cmluZ0xpa2U6IHtcbiAgICAgICAgICAvLyBPbmx5IGFsbG93IHNwZWNpZmllZCBzdWJqZWN0cyB0byBhc3N1bWUgdGhpcyByb2xlXG4gICAgICAgICAgW2Ake0dpdGh1YkFjdGlvbnNJZGVudGl0eVByb3ZpZGVyLmlzc3Vlcn06c3ViYF06IHN1YmplY3QsXG4gICAgICAgIH0sXG4gICAgICAgIFN0cmluZ0VxdWFsczoge1xuICAgICAgICAgIC8vIEF1ZGllbmNlIGlzIGFsd2F5cyBzdHMuYW1hem9uYXdzLmNvbSB3aXRoIEFXUyBvZmZpY2lhbCBHaXRodWIgQWN0aW9uXG4gICAgICAgICAgLy8gaHR0cHM6Ly9kb2NzLmdpdGh1Yi5jb20vZW4vYWN0aW9ucy9kZXBsb3ltZW50L3NlY3VyaXR5LWhhcmRlbmluZy15b3VyLWRlcGxveW1lbnRzL2NvbmZpZ3VyaW5nLW9wZW5pZC1jb25uZWN0LWluLWFtYXpvbi13ZWItc2VydmljZXMjYWRkaW5nLXRoZS1pZGVudGl0eS1wcm92aWRlci10by1hd3NcbiAgICAgICAgICBbYCR7R2l0aHViQWN0aW9uc0lkZW50aXR5UHJvdmlkZXIuaXNzdWVyfTphdWRgXTogXCJzdHMuYW1hem9uYXdzLmNvbVwiLFxuICAgICAgICB9LFxuICAgICAgfSksXG4gICAgfSk7XG4gIH1cbn1cbiJdfQ==

package/migration-test/README.md

@@ -0,0 +1,77 @@
+# Migration Test Harness
+
+This folder contains an isolated CDK app that exercises a real migration flow for `aws-cdk-github-oidc`:
+
+1. `aws-cdk-github-oidc@^2` with `aws-cdk-lib@2.220.0`
+2. `aws-cdk-github-oidc@^3.1` with exact `aws-cdk-lib@2.237.0`
+3. `aws-cdk-github-oidc@^4.2` with `aws-cdk-lib@^2.237.0`
+
+All CDK commands are executed with `pnpm exec cdk ...`.
+`pnpm-workspace.yaml` in this folder mirrors the root workspace policy values.
+
+## Stack behavior by phase
+
+The app reads `MIGRATION_PHASE` and switches provider implementation:
+
+- `v2`: `new GithubActionsIdentityProvider(this, "GithubProvider")`
+- `v3-retain`: same as `v2`, but with `removalPolicy: cdk.RemovalPolicy.RETAIN`
+- `v4-lookup`: `GithubActionsIdentityProvider.fromAccount(this, "GithubProviderReference")`
+- `v4-import`: switch back to `new GithubActionsIdentityProvider(this, "GithubProvider", { removalPolicy: RETAIN })`
+
+## Setup
+
+From this directory:
+
+```sh
+corepack use pnpm@10.19.0
+pnpm install
+```
+
+## Run full migration flow
+
+```sh
+pnpm run test-migration
+```
+
+Run with automatic teardown (no prompt at the end):
+
+```sh
+bash ./scripts/run-migration.sh --teardown
+```
+
+Optional environment variable:
+
+- `MIGRATION_STACK_NAME` (default: `AwsCdkGithubOidcMigrationTest`)
+
+## What the script does
+
+`scripts/run-migration.sh` performs the full sequence with deploy boundaries:
+
+1. Install v2 + `aws-cdk-lib@2.220.0`, deploy `MIGRATION_PHASE=v2`
+2. Upgrade to v3.1 + `aws-cdk-lib@2.237.0`, diff and deploy `MIGRATION_PHASE=v3-retain`
+3. Upgrade to v4.2 + `aws-cdk-lib@^2.237.0`, diff and deploy `MIGRATION_PHASE=v4-lookup`
+4. Set `MIGRATION_PHASE=v4-import`, dynamically fetch account id via:
+   - `aws sts get-caller-identity --query "Account" --output text`
+5. Generate `./.tmp/resource-mapping.json` (not committed) and run:
+   - `pnpm exec cdk import <STACK_NAME> --resource-mapping ./.tmp/resource-mapping.json`
+6. Run `pnpm exec cdk diff` for verification
+
+After step 6, the script asks whether to delete the test stack.
+- Reply `y` or `yes` to destroy it.
+- Reply `n` to keep it deployed.
+- Use `--teardown` (or `--teardown=true`) to destroy without prompting.
+
+## Resource mapping
+
+No AWS account IDs are stored in source control.
+
+- Template file: `config/resource-mapping.template.json`
+- Runtime file: `./.tmp/resource-mapping.json`
+
+The generated ARN format is:
+
+`arn:aws:iam::<ACCOUNT_ID>:oidc-provider/token.actions.githubusercontent.com`
+
+## Reference
+
+- [AWS CDK `cdk import` docs](https://docs.aws.amazon.com/cdk/v2/guide/ref-cli-cmd-import.html)

package/migration-test/bin/app.ts

@@ -0,0 +1,8 @@
+import * as cdk from "aws-cdk-lib";
+import { MigrationTestStack } from "../lib/migration-test-stack";
+
+const app = new cdk.App();
+const stackName =
+  process.env.MIGRATION_STACK_NAME ?? "AwsCdkGithubOidcMigrationTest";
+
+new MigrationTestStack(app, stackName);

package/migration-test/cdk.json

@@ -0,0 +1,6 @@
+{
+  "app": "pnpm exec tsx bin/app.ts",
+  "context": {
+    "@aws-cdk/core:newStyleStackSynthesis": true
+  }
+}

package/migration-test/config/resource-mapping.template.json

@@ -0,0 +1,5 @@
+{
+  "GithubProvider1CDE27EB": {
+    "Arn": "arn:aws:iam::__ACCOUNT_ID__:oidc-provider/token.actions.githubusercontent.com"
+  }
+}

package/migration-test/lib/migration-test-stack.ts

@@ -0,0 +1,77 @@
+import * as cdk from "aws-cdk-lib";
+import * as iam from "aws-cdk-lib/aws-iam";
+import {
+  GithubActionsIdentityProvider,
+  GithubActionsRole,
+  IGithubActionsIdentityProvider,
+} from "aws-cdk-github-oidc";
+import { Construct } from "constructs";
+
+type MigrationPhase = "v2" | "v3-retain" | "v4-lookup" | "v4-import";
+
+function isMigrationPhase(value: string): value is MigrationPhase {
+  return (
+    value === "v2" ||
+    value === "v3-retain" ||
+    value === "v4-lookup" ||
+    value === "v4-import"
+  );
+}
+
+function resolvePhase(): MigrationPhase {
+  const phase = process.env.MIGRATION_PHASE ?? "v2";
+  if (isMigrationPhase(phase)) {
+    return phase;
+  }
+  throw new Error(
+    `Invalid MIGRATION_PHASE="${phase}". Valid values: v2, v3-retain, v4-lookup, v4-import.`,
+  );
+}
+
+function createProvider(
+  scope: Construct,
+  phase: MigrationPhase,
+): IGithubActionsIdentityProvider {
+  if (phase === "v4-lookup") {
+    return GithubActionsIdentityProvider.fromAccount(
+      scope,
+      "GithubProviderReference",
+    );
+  }
+
+  const shouldRetain = phase === "v3-retain" || phase === "v4-import";
+  const ProviderCtor = GithubActionsIdentityProvider as unknown as new (
+    scope: Construct,
+    id: string,
+    props?: { removalPolicy?: cdk.RemovalPolicy },
+  ) => IGithubActionsIdentityProvider;
+  return new ProviderCtor(scope, "GithubProvider", {
+    removalPolicy: shouldRetain ? cdk.RemovalPolicy.RETAIN : undefined,
+  });
+}
+
+export class MigrationTestStack extends cdk.Stack {
+  constructor(scope: Construct, id: string, props?: cdk.StackProps) {
+    super(scope, id, props);
+
+    const phase = resolvePhase();
+    const provider = createProvider(this, phase);
+
+    new GithubActionsRole(this, "GithubActionsRole", {
+      provider,
+      owner: "octo-org",
+      repo: "octo-repo",
+      filter: "ref:refs/heads/main",
+      roleName: "migration-test-github-actions-role",
+      description: "Role for validating aws-cdk-github-oidc migration flow",
+      managedPolicies: [
+        iam.ManagedPolicy.fromAwsManagedPolicyName("ReadOnlyAccess"),
+      ],
+    });
+
+    new cdk.CfnOutput(this, "MigrationPhase", { value: phase });
+    new cdk.CfnOutput(this, "ProviderArn", {
+      value: `arn:${cdk.Aws.PARTITION}:iam::${cdk.Aws.ACCOUNT_ID}:oidc-provider/${GithubActionsIdentityProvider.issuer}`,
+    });
+  }
+}

package/migration-test/package.json

@@ -0,0 +1,24 @@
+{
+  "name": "migration-test",
+  "private": true,
+  "packageManager": "pnpm@10.19.0",
+  "scripts": {
+    "build": "tsc --noEmit",
+    "cdk": "pnpm exec cdk",
+    "synth": "pnpm exec cdk synth",
+    "diff": "pnpm exec cdk diff",
+    "deploy": "pnpm exec cdk deploy --require-approval never",
+    "test-migration": "bash ./scripts/run-migration.sh"
+  },
+  "dependencies": {
+    "aws-cdk-github-oidc": "^2.4.1",
+    "aws-cdk-lib": "2.220.0",
+    "constructs": "^10.3.0"
+  },
+  "devDependencies": {
+    "@types/node": "^20",
+    "aws-cdk": "^2",
+    "tsx": "^4",
+    "typescript": "^5"
+  }
+}

package/migration-test/pnpm-lock.yaml

@@ -0,0 +1,423 @@
+lockfileVersion: '9.0'
+
+settings:
+  autoInstallPeers: true
+  excludeLinksFromLockfile: false
+
+importers:
+
+  .:
+    dependencies:
+      aws-cdk-github-oidc:
+        specifier: ^2.4.1
+        version: 2.4.1(aws-cdk-lib@2.220.0(constructs@10.6.0))(constructs@10.6.0)
+      aws-cdk-lib:
+        specifier: 2.220.0
+        version: 2.220.0(constructs@10.6.0)
+      constructs:
+        specifier: ^10.3.0
+        version: 10.6.0
+    devDependencies:
+      '@types/node':
+        specifier: ^20
+        version: 20.19.40
+      aws-cdk:
+        specifier: ^2
+        version: 2.1121.0
+      tsx:
+        specifier: ^4
+        version: 4.21.0
+      typescript:
+        specifier: ^5
+        version: 5.9.3
+
+packages:
+
+  '@aws-cdk/asset-awscli-v1@2.2.242':
+    resolution: {integrity: sha512-4c1bAy2ISzcdKXYS1k4HYZsNrgiwbiDzj36ybwFVxEWZXVAP0dimQTCaB9fxu7sWzEjw3d+eaw6Fon+QTfTIpQ==}
+
+  '@aws-cdk/asset-node-proxy-agent-v6@2.1.1':
+    resolution: {integrity: sha512-We4bmHaowOPHr+IQR4/FyTGjRfjgBj4ICMjtqmJeBDWad3Q/6St12NT07leNtyuukv2qMhtSZJQorD8KpKTwRA==}
+
+  '@aws-cdk/cloud-assembly-schema@48.20.0':
+    resolution: {integrity: sha512-+eeiav9LY4wbF/EFuCt/vfvi/Zoxo8bf94PW5clbMraChEliq83w4TbRVy0jB9jE0v1ooFTtIjSQkowSPkfISg==}
+    engines: {node: '>= 18.0.0'}
+    bundledDependencies:
+      - jsonschema
+      - semver
+
+  '@esbuild/aix-ppc64@0.27.7':
+    resolution: {integrity: sha512-EKX3Qwmhz1eMdEJokhALr0YiD0lhQNwDqkPYyPhiSwKrh7/4KRjQc04sZ8db+5DVVnZ1LmbNDI1uAMPEUBnQPg==}
+    engines: {node: '>=18'}
+    cpu: [ppc64]
+    os: [aix]
+
+  '@esbuild/android-arm64@0.27.7':
+    resolution: {integrity: sha512-62dPZHpIXzvChfvfLJow3q5dDtiNMkwiRzPylSCfriLvZeq0a1bWChrGx/BbUbPwOrsWKMn8idSllklzBy+dgQ==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [android]
+
+  '@esbuild/android-arm@0.27.7':
+    resolution: {integrity: sha512-jbPXvB4Yj2yBV7HUfE2KHe4GJX51QplCN1pGbYjvsyCZbQmies29EoJbkEc+vYuU5o45AfQn37vZlyXy4YJ8RQ==}
+    engines: {node: '>=18'}
+    cpu: [arm]
+    os: [android]
+
+  '@esbuild/android-x64@0.27.7':
+    resolution: {integrity: sha512-x5VpMODneVDb70PYV2VQOmIUUiBtY3D3mPBG8NxVk5CogneYhkR7MmM3yR/uMdITLrC1ml/NV1rj4bMJuy9MCg==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [android]
+
+  '@esbuild/darwin-arm64@0.27.7':
+    resolution: {integrity: sha512-5lckdqeuBPlKUwvoCXIgI2D9/ABmPq3Rdp7IfL70393YgaASt7tbju3Ac+ePVi3KDH6N2RqePfHnXkaDtY9fkw==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [darwin]
+
+  '@esbuild/darwin-x64@0.27.7':
+    resolution: {integrity: sha512-rYnXrKcXuT7Z+WL5K980jVFdvVKhCHhUwid+dDYQpH+qu+TefcomiMAJpIiC2EM3Rjtq0sO3StMV/+3w3MyyqQ==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [darwin]
+
+  '@esbuild/freebsd-arm64@0.27.7':
+    resolution: {integrity: sha512-B48PqeCsEgOtzME2GbNM2roU29AMTuOIN91dsMO30t+Ydis3z/3Ngoj5hhnsOSSwNzS+6JppqWsuhTp6E82l2w==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [freebsd]
+
+  '@esbuild/freebsd-x64@0.27.7':
+    resolution: {integrity: sha512-jOBDK5XEjA4m5IJK3bpAQF9/Lelu/Z9ZcdhTRLf4cajlB+8VEhFFRjWgfy3M1O4rO2GQ/b2dLwCUGpiF/eATNQ==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [freebsd]
+
+  '@esbuild/linux-arm64@0.27.7':
+    resolution: {integrity: sha512-RZPHBoxXuNnPQO9rvjh5jdkRmVizktkT7TCDkDmQ0W2SwHInKCAV95GRuvdSvA7w4VMwfCjUiPwDi0ZO6Nfe9A==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [linux]
+
+  '@esbuild/linux-arm@0.27.7':
+    resolution: {integrity: sha512-RkT/YXYBTSULo3+af8Ib0ykH8u2MBh57o7q/DAs3lTJlyVQkgQvlrPTnjIzzRPQyavxtPtfg0EopvDyIt0j1rA==}
+    engines: {node: '>=18'}
+    cpu: [arm]
+    os: [linux]
+
+  '@esbuild/linux-ia32@0.27.7':
+    resolution: {integrity: sha512-GA48aKNkyQDbd3KtkplYWT102C5sn/EZTY4XROkxONgruHPU72l+gW+FfF8tf2cFjeHaRbWpOYa/uRBz/Xq1Pg==}
+    engines: {node: '>=18'}
+    cpu: [ia32]
+    os: [linux]
+
+  '@esbuild/linux-loong64@0.27.7':
+    resolution: {integrity: sha512-a4POruNM2oWsD4WKvBSEKGIiWQF8fZOAsycHOt6JBpZ+JN2n2JH9WAv56SOyu9X5IqAjqSIPTaJkqN8F7XOQ5Q==}
+    engines: {node: '>=18'}
+    cpu: [loong64]
+    os: [linux]
+
+  '@esbuild/linux-mips64el@0.27.7':
+    resolution: {integrity: sha512-KabT5I6StirGfIz0FMgl1I+R1H73Gp0ofL9A3nG3i/cYFJzKHhouBV5VWK1CSgKvVaG4q1RNpCTR2LuTVB3fIw==}
+    engines: {node: '>=18'}
+    cpu: [mips64el]
+    os: [linux]
+
+  '@esbuild/linux-ppc64@0.27.7':
+    resolution: {integrity: sha512-gRsL4x6wsGHGRqhtI+ifpN/vpOFTQtnbsupUF5R5YTAg+y/lKelYR1hXbnBdzDjGbMYjVJLJTd2OFmMewAgwlQ==}
+    engines: {node: '>=18'}
+    cpu: [ppc64]
+    os: [linux]
+
+  '@esbuild/linux-riscv64@0.27.7':
+    resolution: {integrity: sha512-hL25LbxO1QOngGzu2U5xeXtxXcW+/GvMN3ejANqXkxZ/opySAZMrc+9LY/WyjAan41unrR3YrmtTsUpwT66InQ==}
+    engines: {node: '>=18'}
+    cpu: [riscv64]
+    os: [linux]
+
+  '@esbuild/linux-s390x@0.27.7':
+    resolution: {integrity: sha512-2k8go8Ycu1Kb46vEelhu1vqEP+UeRVj2zY1pSuPdgvbd5ykAw82Lrro28vXUrRmzEsUV0NzCf54yARIK8r0fdw==}
+    engines: {node: '>=18'}
+    cpu: [s390x]
+    os: [linux]
+
+  '@esbuild/linux-x64@0.27.7':
+    resolution: {integrity: sha512-hzznmADPt+OmsYzw1EE33ccA+HPdIqiCRq7cQeL1Jlq2gb1+OyWBkMCrYGBJ+sxVzve2ZJEVeePbLM2iEIZSxA==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [linux]
+
+  '@esbuild/netbsd-arm64@0.27.7':
+    resolution: {integrity: sha512-b6pqtrQdigZBwZxAn1UpazEisvwaIDvdbMbmrly7cDTMFnw/+3lVxxCTGOrkPVnsYIosJJXAsILG9XcQS+Yu6w==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [netbsd]
+
+  '@esbuild/netbsd-x64@0.27.7':
+    resolution: {integrity: sha512-OfatkLojr6U+WN5EDYuoQhtM+1xco+/6FSzJJnuWiUw5eVcicbyK3dq5EeV/QHT1uy6GoDhGbFpprUiHUYggrw==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [netbsd]
+
+  '@esbuild/openbsd-arm64@0.27.7':
+    resolution: {integrity: sha512-AFuojMQTxAz75Fo8idVcqoQWEHIXFRbOc1TrVcFSgCZtQfSdc1RXgB3tjOn/krRHENUB4j00bfGjyl2mJrU37A==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [openbsd]
+
+  '@esbuild/openbsd-x64@0.27.7':
+    resolution: {integrity: sha512-+A1NJmfM8WNDv5CLVQYJ5PshuRm/4cI6WMZRg1by1GwPIQPCTs1GLEUHwiiQGT5zDdyLiRM/l1G0Pv54gvtKIg==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [openbsd]
+
+  '@esbuild/openharmony-arm64@0.27.7':
+    resolution: {integrity: sha512-+KrvYb/C8zA9CU/g0sR6w2RBw7IGc5J2BPnc3dYc5VJxHCSF1yNMxTV5LQ7GuKteQXZtspjFbiuW5/dOj7H4Yw==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [openharmony]
+
+  '@esbuild/sunos-x64@0.27.7':
+    resolution: {integrity: sha512-ikktIhFBzQNt/QDyOL580ti9+5mL/YZeUPKU2ivGtGjdTYoqz6jObj6nOMfhASpS4GU4Q/Clh1QtxWAvcYKamA==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [sunos]
+
+  '@esbuild/win32-arm64@0.27.7':
+    resolution: {integrity: sha512-7yRhbHvPqSpRUV7Q20VuDwbjW5kIMwTHpptuUzV+AA46kiPze5Z7qgt6CLCK3pWFrHeNfDd1VKgyP4O+ng17CA==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [win32]
+
+  '@esbuild/win32-ia32@0.27.7':
+    resolution: {integrity: sha512-SmwKXe6VHIyZYbBLJrhOoCJRB/Z1tckzmgTLfFYOfpMAx63BJEaL9ExI8x7v0oAO3Zh6D/Oi1gVxEYr5oUCFhw==}
+    engines: {node: '>=18'}
+    cpu: [ia32]
+    os: [win32]
+
+  '@esbuild/win32-x64@0.27.7':
+    resolution: {integrity: sha512-56hiAJPhwQ1R4i+21FVF7V8kSD5zZTdHcVuRFMW0hn753vVfQN8xlx4uOPT4xoGH0Z/oVATuR82AiqSTDIpaHg==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [win32]
+
+  '@types/node@20.19.40':
+    resolution: {integrity: sha512-xxx6M2IpSTnnKcR0cMvIiohkiCx20/oRPtWGbenFygKCGl3zqUzdNjQ/1V4solq1LU+dgv0nQzeGOuqkqZGg0Q==}
+
+  aws-cdk-github-oidc@2.4.1:
+    resolution: {integrity: sha512-zKQYPGyf5f6APG76OpOxW6P7KGY/fC6VhN1ZullxySSu6RroUH9VtVl+cJ8hYes5XvEE/ZDpx2h2fPtNwZrcVQ==}
+    engines: {node: '>= 16.20.0'}
+    peerDependencies:
+      aws-cdk-lib: ^2.89.0
+      constructs: ^10.0.0
+
+  aws-cdk-lib@2.220.0:
+    resolution: {integrity: sha512-mOEyPP1ymWiLnSE0xFxWjG00E1DQ5wtbcgKUmtGjxyNdoG/Qret1nDLqE43YGZEbwca43WO/a2LDuSL6+hN7Lg==}
+    engines: {node: '>= 18.0.0'}
+    peerDependencies:
+      constructs: ^10.0.0
+    bundledDependencies:
+      - '@balena/dockerignore'
+      - case
+      - fs-extra
+      - ignore
+      - jsonschema
+      - minimatch
+      - punycode
+      - semver
+      - table
+      - yaml
+      - mime-types
+
+  aws-cdk@2.1121.0:
+    resolution: {integrity: sha512-cG7CHt/SytYTfwrK+BUNQpqmS1dwhjt8z6ExKL6GK4n+8/6ZCwFzxlZWA/jUd2+Y9xPc+Q8cLKfMqGmgxEXbkg==}
+    engines: {node: '>= 18.0.0'}
+    hasBin: true
+
+  constructs@10.6.0:
+    resolution: {integrity: sha512-TxHOnBO5zMo/G76ykzGF/wMpEHu257TbWiIxP9K0Yv/+t70UzgBQiTqjkAsWOPC6jW91DzJI0+ehQV6xDRNBuQ==}
+
+  esbuild@0.27.7:
+    resolution: {integrity: sha512-IxpibTjyVnmrIQo5aqNpCgoACA/dTKLTlhMHihVHhdkxKyPO1uBBthumT0rdHmcsk9uMonIWS0m4FljWzILh3w==}
+    engines: {node: '>=18'}
+    hasBin: true
+
+  fsevents@2.3.3:
+    resolution: {integrity: sha512-5xoDfX+fL7faATnagmWPpbFtwh/R77WmMMqqHGS65C3vvB0YHrgF+B1YmZ3441tMj5n63k0212XNoJwzlhffQw==}
+    engines: {node: ^8.16.0 || ^10.6.0 || >=11.0.0}
+    os: [darwin]
+
+  get-tsconfig@4.14.0:
+    resolution: {integrity: sha512-yTb+8DXzDREzgvYmh6s9vHsSVCHeC0G3PI5bEXNBHtmshPnO+S5O7qgLEOn0I5QvMy6kpZN8K1NKGyilLb93wA==}
+
+  resolve-pkg-maps@1.0.0:
+    resolution: {integrity: sha512-seS2Tj26TBVOC2NIc2rOe2y2ZO7efxITtLZcGSOnHHNOQ7CkiUBfw0Iw2ck6xkIhPwLhKNLS8BO+hEpngQlqzw==}
+
+  tsx@4.21.0:
+    resolution: {integrity: sha512-5C1sg4USs1lfG0GFb2RLXsdpXqBSEhAaA/0kPL01wxzpMqLILNxIxIOKiILz+cdg/pLnOUxFYOR5yhHU666wbw==}
+    engines: {node: '>=18.0.0'}
+    hasBin: true
+
+  typescript@5.9.3:
+    resolution: {integrity: sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==}
+    engines: {node: '>=14.17'}
+    hasBin: true
+
+  undici-types@6.21.0:
+    resolution: {integrity: sha512-iwDZqg0QAGrg9Rav5H4n0M64c3mkR59cJ6wQp+7C4nI0gsmExaedaYLNO44eT4AtBBwjbTiGPMlt2Md0T9H9JQ==}
+
+snapshots:
+
+  '@aws-cdk/asset-awscli-v1@2.2.242': {}
+
+  '@aws-cdk/asset-node-proxy-agent-v6@2.1.1': {}
+
+  '@aws-cdk/cloud-assembly-schema@48.20.0': {}
+
+  '@esbuild/aix-ppc64@0.27.7':
+    optional: true
+
+  '@esbuild/android-arm64@0.27.7':
+    optional: true
+
+  '@esbuild/android-arm@0.27.7':
+    optional: true
+
+  '@esbuild/android-x64@0.27.7':
+    optional: true
+
+  '@esbuild/darwin-arm64@0.27.7':
+    optional: true
+
+  '@esbuild/darwin-x64@0.27.7':
+    optional: true
+
+  '@esbuild/freebsd-arm64@0.27.7':
+    optional: true
+
+  '@esbuild/freebsd-x64@0.27.7':
+    optional: true
+
+  '@esbuild/linux-arm64@0.27.7':
+    optional: true
+
+  '@esbuild/linux-arm@0.27.7':
+    optional: true
+
+  '@esbuild/linux-ia32@0.27.7':
+    optional: true
+
+  '@esbuild/linux-loong64@0.27.7':
+    optional: true
+
+  '@esbuild/linux-mips64el@0.27.7':
+    optional: true
+
+  '@esbuild/linux-ppc64@0.27.7':
+    optional: true
+
+  '@esbuild/linux-riscv64@0.27.7':
+    optional: true
+
+  '@esbuild/linux-s390x@0.27.7':
+    optional: true
+
+  '@esbuild/linux-x64@0.27.7':
+    optional: true
+
+  '@esbuild/netbsd-arm64@0.27.7':
+    optional: true
+
+  '@esbuild/netbsd-x64@0.27.7':
+    optional: true
+
+  '@esbuild/openbsd-arm64@0.27.7':
+    optional: true
+
+  '@esbuild/openbsd-x64@0.27.7':
+    optional: true
+
+  '@esbuild/openharmony-arm64@0.27.7':
+    optional: true
+
+  '@esbuild/sunos-x64@0.27.7':
+    optional: true
+
+  '@esbuild/win32-arm64@0.27.7':
+    optional: true
+
+  '@esbuild/win32-ia32@0.27.7':
+    optional: true
+
+  '@esbuild/win32-x64@0.27.7':
+    optional: true
+
+  '@types/node@20.19.40':
+    dependencies:
+      undici-types: 6.21.0
+
+  aws-cdk-github-oidc@2.4.1(aws-cdk-lib@2.220.0(constructs@10.6.0))(constructs@10.6.0):
+    dependencies:
+      aws-cdk-lib: 2.220.0(constructs@10.6.0)
+      constructs: 10.6.0
+
+  aws-cdk-lib@2.220.0(constructs@10.6.0):
+    dependencies:
+      '@aws-cdk/asset-awscli-v1': 2.2.242
+      '@aws-cdk/asset-node-proxy-agent-v6': 2.1.1
+      '@aws-cdk/cloud-assembly-schema': 48.20.0
+      constructs: 10.6.0
+
+  aws-cdk@2.1121.0: {}
+
+  constructs@10.6.0: {}
+
+  esbuild@0.27.7:
+    optionalDependencies:
+      '@esbuild/aix-ppc64': 0.27.7
+      '@esbuild/android-arm': 0.27.7
+      '@esbuild/android-arm64': 0.27.7
+      '@esbuild/android-x64': 0.27.7
+      '@esbuild/darwin-arm64': 0.27.7
+      '@esbuild/darwin-x64': 0.27.7
+      '@esbuild/freebsd-arm64': 0.27.7
+      '@esbuild/freebsd-x64': 0.27.7
+      '@esbuild/linux-arm': 0.27.7
+      '@esbuild/linux-arm64': 0.27.7
+      '@esbuild/linux-ia32': 0.27.7
+      '@esbuild/linux-loong64': 0.27.7
+      '@esbuild/linux-mips64el': 0.27.7
+      '@esbuild/linux-ppc64': 0.27.7
+      '@esbuild/linux-riscv64': 0.27.7
+      '@esbuild/linux-s390x': 0.27.7
+      '@esbuild/linux-x64': 0.27.7
+      '@esbuild/netbsd-arm64': 0.27.7
+      '@esbuild/netbsd-x64': 0.27.7
+      '@esbuild/openbsd-arm64': 0.27.7
+      '@esbuild/openbsd-x64': 0.27.7
+      '@esbuild/openharmony-arm64': 0.27.7
+      '@esbuild/sunos-x64': 0.27.7
+      '@esbuild/win32-arm64': 0.27.7
+      '@esbuild/win32-ia32': 0.27.7
+      '@esbuild/win32-x64': 0.27.7
+
+  fsevents@2.3.3:
+    optional: true
+
+  get-tsconfig@4.14.0:
+    dependencies:
+      resolve-pkg-maps: 1.0.0
+
+  resolve-pkg-maps@1.0.0: {}
+
+  tsx@4.21.0:
+    dependencies:
+      esbuild: 0.27.7
+      get-tsconfig: 4.14.0
+    optionalDependencies:
+      fsevents: 2.3.3
+
+  typescript@5.9.3: {}
+
+  undici-types@6.21.0: {}

package/migration-test/pnpm-workspace.yaml

@@ -0,0 +1,21 @@
+# Copied from repository root pnpm-workspace.yaml to keep identical pnpm policies
+# while keeping migration-test dependency changes isolated.
+
+minimumReleaseAge: 4320
+minimumReleaseAgeExclude:
+  - "@alma-cdk/construct-library"
+  - "aws-cdk-github-oidc"
+trustPolicy: no-downgrade
+trustPolicyIgnoreAfter: 20160
+trustPolicyExclude:
+  - jsii@5.9.33
+  - jsii@5.9.35
+nodeLinker: hoisted
+resolutionMode: highest
+strictDepBuilds: true
+onlyBuiltDependencies:
+  - unrs-resolver
+  - lefthook
+  - esbuild
+blockExoticSubdeps: true
+overrides: {}

package/migration-test/scripts/run-migration.sh

@@ -0,0 +1,179 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PROJECT_DIR="$(cd "${SCRIPT_DIR}/.." && pwd)"
+cd "${PROJECT_DIR}"
+
+AUTO_TEARDOWN="false"
+
+usage() {
+  cat <<EOF
+Usage: ./scripts/run-migration.sh [--teardown[=true|false]]
+
+Options:
+  --teardown            Perform teardown automatically without asking.
+  --teardown=true       Same as --teardown.
+  --teardown=false      Skip automatic teardown and ask at the end.
+  -h, --help            Show this help message.
+EOF
+}
+
+while (($# > 0)); do
+  case "$1" in
+    --teardown)
+      if (($# > 1)) && [[ "$2" =~ ^(true|false)$ ]]; then
+        AUTO_TEARDOWN="$2"
+        shift 2
+      else
+        AUTO_TEARDOWN="true"
+        shift
+      fi
+      ;;
+    --teardown=*)
+      AUTO_TEARDOWN="${1#*=}"
+      if [[ "${AUTO_TEARDOWN}" != "true" && "${AUTO_TEARDOWN}" != "false" ]]; then
+        echo "Invalid value for --teardown: ${AUTO_TEARDOWN} (expected true|false)" >&2
+        exit 1
+      fi
+      shift
+      ;;
+    -h | --help)
+      usage
+      exit 0
+      ;;
+    *)
+      echo "Unknown argument: $1" >&2
+      usage >&2
+      exit 1
+      ;;
+  esac
+done
+
+STACK_NAME="${MIGRATION_STACK_NAME:-AwsCdkGithubOidcMigrationTest}"
+TMP_DIR="${PROJECT_DIR}/.tmp"
+RESOURCE_MAPPING_PATH="${TMP_DIR}/resource-mapping.json"
+OIDC_ISSUER="token.actions.githubusercontent.com"
+ACCOUNT_ID="$(aws sts get-caller-identity --query "Account" --output text)"
+CALLER_ARN="$(aws sts get-caller-identity --query "Arn" --output text)"
+AWS_PARTITION="$(echo "${CALLER_ARN}" | cut -d: -f2)"
+OIDC_PROVIDER_ARN="arn:${AWS_PARTITION}:iam::${ACCOUNT_ID}:oidc-provider/${OIDC_ISSUER}"
+
+cleanup_tmp_artifacts() {
+  rm -f "${RESOURCE_MAPPING_PATH}"
+}
+
+trap cleanup_tmp_artifacts EXIT
+
+verify_stack_status() {
+  local context="$1"
+  shift
+  local status
+  status="$(aws cloudformation describe-stacks --stack-name "${STACK_NAME}" --query "Stacks[0].StackStatus" --output text)"
+
+  for expected in "$@"; do
+    if [[ "${status}" == "${expected}" ]]; then
+      echo "Verified stack status after ${context}: ${status}"
+      return 0
+    fi
+  done
+
+  echo "Unexpected stack status after ${context}: ${status}" >&2
+  echo "Expected one of: $*" >&2
+  exit 1
+}
+
+verify_oidc_provider_present() {
+  local context="$1"
+  local listed_arn
+  listed_arn="$(
+    aws iam list-open-id-connect-providers \
+      --query "OpenIDConnectProviderList[?Arn=='${OIDC_PROVIDER_ARN}'].Arn | [0]" \
+      --output text
+  )"
+
+  if [[ "${listed_arn}" != "${OIDC_PROVIDER_ARN}" ]]; then
+    echo "OIDC provider not found after ${context}: ${OIDC_PROVIDER_ARN}" >&2
+    exit 1
+  fi
+
+  local provider_url
+  provider_url="$(
+    aws iam get-open-id-connect-provider \
+      --open-id-connect-provider-arn "${OIDC_PROVIDER_ARN}" \
+      --query "Url" \
+      --output text
+  )"
+
+  if [[ "${provider_url}" != "${OIDC_ISSUER}" ]]; then
+    echo "OIDC provider URL mismatch after ${context}: expected ${OIDC_ISSUER}, got ${provider_url}" >&2
+    exit 1
+  fi
+
+  echo "Verified OIDC provider after ${context}: ${OIDC_PROVIDER_ARN}"
+}
+
+teardown_stack() {
+  echo "==> Teardown: Destroying stack ${STACK_NAME}"
+  MIGRATION_PHASE=v4-import MIGRATION_STACK_NAME="${STACK_NAME}" pnpm exec cdk destroy "${STACK_NAME}" --force
+}
+
+echo "Using stack: ${STACK_NAME}"
+echo "Working directory: ${PROJECT_DIR}"
+echo "Using account: ${ACCOUNT_ID}"
+echo "Using OIDC provider ARN: ${OIDC_PROVIDER_ARN}"
+echo "Auto teardown: ${AUTO_TEARDOWN}"
+
+mkdir -p "${TMP_DIR}"
+
+echo "==> Phase 1: Install v2 + aws-cdk-lib@2.220.0"
+pnpm add aws-cdk-github-oidc@^2 aws-cdk-lib@2.220.0
+MIGRATION_PHASE=v2 MIGRATION_STACK_NAME="${STACK_NAME}" pnpm exec cdk deploy "${STACK_NAME}" --require-approval never
+verify_stack_status "phase 1 deploy" CREATE_COMPLETE UPDATE_COMPLETE
+verify_oidc_provider_present "phase 1 deploy"
+
+echo "==> Phase 2: Upgrade to v3.1 + aws-cdk-lib@2.237.0 with RETAIN"
+pnpm add aws-cdk-github-oidc@^3.1 aws-cdk-lib@2.237.0
+MIGRATION_PHASE=v3-retain MIGRATION_STACK_NAME="${STACK_NAME}" pnpm exec cdk diff "${STACK_NAME}"
+MIGRATION_PHASE=v3-retain MIGRATION_STACK_NAME="${STACK_NAME}" pnpm exec cdk deploy "${STACK_NAME}" --require-approval never
+verify_stack_status "phase 2 deploy" CREATE_COMPLETE UPDATE_COMPLETE
+verify_oidc_provider_present "phase 2 deploy"
+
+echo "==> Phase 3: Upgrade to v4.2 + aws-cdk-lib@^2.237.0 and lookup provider"
+pnpm add aws-cdk-github-oidc@^4.2 aws-cdk-lib@^2.237.0
+MIGRATION_PHASE=v4-lookup MIGRATION_STACK_NAME="${STACK_NAME}" pnpm exec cdk diff "${STACK_NAME}"
+MIGRATION_PHASE=v4-lookup MIGRATION_STACK_NAME="${STACK_NAME}" pnpm exec cdk deploy "${STACK_NAME}" --require-approval never
+verify_stack_status "phase 3 deploy" CREATE_COMPLETE UPDATE_COMPLETE
+verify_oidc_provider_present "phase 3 deploy"
+
+echo "==> Phase 4: Switch back to managed provider and import"
+cat > "${RESOURCE_MAPPING_PATH}" <<EOF
+{
+  "GithubProvider1CDE27EB": {
+    "Arn": "${OIDC_PROVIDER_ARN}"
+  }
+}
+EOF
+
+echo "Running non-interactive import..."
+printf "y\ny\n" | MIGRATION_PHASE=v4-import MIGRATION_STACK_NAME="${STACK_NAME}" pnpm exec cdk import "${STACK_NAME}" --resource-mapping "${RESOURCE_MAPPING_PATH}" --force --execute true --require-approval never
+verify_stack_status "phase 4 import" IMPORT_COMPLETE
+verify_oidc_provider_present "phase 4 import"
+
+echo "==> Phase 5: Post-import verification"
+MIGRATION_PHASE=v4-import MIGRATION_STACK_NAME="${STACK_NAME}" pnpm exec cdk diff "${STACK_NAME}"
+verify_oidc_provider_present "phase 5 post-import diff"
+
+echo "Migration test flow completed successfully."
+
+if [[ "${AUTO_TEARDOWN}" == "true" ]]; then
+  teardown_stack
+else
+  read -r -p "Teardown test stack now? (y/n) " teardown_answer
+  teardown_answer="$(printf '%s' "${teardown_answer}" | tr '[:upper:]' '[:lower:]')"
+  if [[ "${teardown_answer}" == "y" || "${teardown_answer}" == "yes" ]]; then
+    teardown_stack
+  else
+    echo "Skipping teardown. Stack remains deployed: ${STACK_NAME}"
+  fi
+fi

package/package.json

@@ -65,7 +65,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "version": "4.2.3",
+  "version": "4.2.5",
   "jest": {
     "coverageProvider": "v8",
     "testMatch": [