cdk-rds-sql 9.1.0 → 9.1.1

package/.jsii

@@ -11289,6 +11289,6 @@
       "symbolId": "src/sql:SqlProps"
     }
   },
-  "version": "9.1.0",
-  "fingerprint": "OkYYbqoqEMmAS3UeELvqwNawjTxsCwW40LiuBwYsIRY="
+  "version": "9.1.1",
+  "fingerprint": "2JVR5sakEHON6uTnca6xJrBAe9ezH/4hFD1HtuE7yxg="
 }

package/AGENTS.md

@@ -105,6 +105,72 @@ Projen tasks:
 4. `biome`: Runs formatting and linting
 5. `typecheck`: Runs typecheck
 
+## GitHub Actions checks
+
+`hk.pkl` lints workflows, Dependabot config, and composite actions with
+jactionlint. `mise.toml` pins `jactionlint` 2.3.0 and the `shellcheck` 0.11.0
+that jactionlint shells out to. Run that pin through mise. A `jactionlint`
+already on `PATH` can be another version.
+
+The hk step is `jactionlint --baseline --sarif-hide-baselined --format sarif`.
+`.github/jactionlint.yaml` sets `baseline: auto`, so findings recorded in
+`.github/jactionlint-baseline.json` are accepted and any other finding fails.
+`mise run check` includes the step. To run only it:
+
+```bash
+mise exec -- hk check --all --step jactionlint
+```
+
+### Refreshing the jactionlint baseline
+
+The baseline matches by fingerprint and context hash, which include the finding
+text. After a projen upgrade, a Dependabot action bump, or another
+generated-workflow change, an already accepted finding can fail again because
+the old entry still names the previous text. The old entry then matches
+nothing. Changing `actions/setup-node@v7.0.0` to `v7.0.1` in
+`.github/workflows/build.yml` does this for the three baselined `unpinned-uses`
+findings in that file.
+
+Re-baseline only for that drift, and only after confirming each new finding is
+that stale-baseline effect and not a real regression. Commit the refreshed
+`.github/jactionlint-baseline.json` in the same commit or pull request as the
+workflow change. Do not refresh the baseline to hide a finding you introduced,
+and do not edit the JSON by hand.
+
+1. List findings the baseline does not hide, and compare them with the workflow
+   diff. Expected drift is the same rule on the same step, with the message now
+   naming the new generated text:
+
+   ```bash
+   mise exec -- jactionlint --baseline
+   ```
+
+2. List entries that no longer match anything. They are reported as
+   `unused-baseline-entry`:
+
+   ```bash
+   mise exec -- jactionlint --baseline-check
+   ```
+
+3. Rewrite the baseline. Do not pass workflow paths, and do not combine this
+   with `--baseline`. File arguments keep every other file's entries.
+   `--baseline-write` records every current finding and exits 0 even when new
+   findings exist, so review the baseline diff before committing:
+
+   ```bash
+   mise exec -- jactionlint --baseline-write
+   ```
+
+4. Confirm the hk step is clean:
+
+   ```bash
+   mise exec -- hk check --all --step jactionlint
+   ```
+
+`.github/jactionlint.yaml` mentions the same `--baseline-write` flag. Use the
+mise form so the `mise.toml` pin is the binary that runs. Install tools with
+`mise install` if `mise exec` cannot find `jactionlint`.
+
 ## SSL/TLS Configuration
 
 - SSL is enabled by default

package/CLAUDE.md

@@ -105,6 +105,72 @@ Projen tasks:
 4. `biome`: Runs formatting and linting
 5. `typecheck`: Runs typecheck
 
+## GitHub Actions checks
+
+`hk.pkl` lints workflows, Dependabot config, and composite actions with
+jactionlint. `mise.toml` pins `jactionlint` 2.3.0 and the `shellcheck` 0.11.0
+that jactionlint shells out to. Run that pin through mise. A `jactionlint`
+already on `PATH` can be another version.
+
+The hk step is `jactionlint --baseline --sarif-hide-baselined --format sarif`.
+`.github/jactionlint.yaml` sets `baseline: auto`, so findings recorded in
+`.github/jactionlint-baseline.json` are accepted and any other finding fails.
+`mise run check` includes the step. To run only it:
+
+```bash
+mise exec -- hk check --all --step jactionlint
+```
+
+### Refreshing the jactionlint baseline
+
+The baseline matches by fingerprint and context hash, which include the finding
+text. After a projen upgrade, a Dependabot action bump, or another
+generated-workflow change, an already accepted finding can fail again because
+the old entry still names the previous text. The old entry then matches
+nothing. Changing `actions/setup-node@v7.0.0` to `v7.0.1` in
+`.github/workflows/build.yml` does this for the three baselined `unpinned-uses`
+findings in that file.
+
+Re-baseline only for that drift, and only after confirming each new finding is
+that stale-baseline effect and not a real regression. Commit the refreshed
+`.github/jactionlint-baseline.json` in the same commit or pull request as the
+workflow change. Do not refresh the baseline to hide a finding you introduced,
+and do not edit the JSON by hand.
+
+1. List findings the baseline does not hide, and compare them with the workflow
+   diff. Expected drift is the same rule on the same step, with the message now
+   naming the new generated text:
+
+   ```bash
+   mise exec -- jactionlint --baseline
+   ```
+
+2. List entries that no longer match anything. They are reported as
+   `unused-baseline-entry`:
+
+   ```bash
+   mise exec -- jactionlint --baseline-check
+   ```
+
+3. Rewrite the baseline. Do not pass workflow paths, and do not combine this
+   with `--baseline`. File arguments keep every other file's entries.
+   `--baseline-write` records every current finding and exits 0 even when new
+   findings exist, so review the baseline diff before committing:
+
+   ```bash
+   mise exec -- jactionlint --baseline-write
+   ```
+
+4. Confirm the hk step is clean:
+
+   ```bash
+   mise exec -- hk check --all --step jactionlint
+   ```
+
+`.github/jactionlint.yaml` mentions the same `--baseline-write` flag. Use the
+mise form so the `mise.toml` pin is the binary that runs. Install tools with
+`mise install` if `mise exec` cannot find `jactionlint`.
+
 ## SSL/TLS Configuration
 
 - SSL is enabled by default

package/lib/database.js

@@ -14,7 +14,7 @@ class ImportedDatabase extends constructs_1.Construct {
     }
 }
 class Database extends aws_cdk_lib_1.CustomResource {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "cdk-rds-sql.Database", version: "9.1.0" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "cdk-rds-sql.Database", version: "9.1.1" };
     /**
      * Return a Database based upon name only. Use for importing existing databases.
      */

package/lib/iam-grant.js

@@ -6,7 +6,7 @@ const aws_cdk_lib_1 = require("aws-cdk-lib");
 const enum_1 = require("./enum");
 const provider_1 = require("./provider");
 class IamGrant extends aws_cdk_lib_1.CustomResource {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "cdk-rds-sql.IamGrant", version: "9.1.0" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "cdk-rds-sql.IamGrant", version: "9.1.1" };
     constructor(scope, id, props) {
         // IAM grants are only supported on DSQL
         if (props.provider.engine !== provider_1.DatabaseEngine.DSQL) {

package/lib/provider.js

@@ -60,7 +60,7 @@ var DatabaseEngine;
     DatabaseEngine["DSQL"] = "dsql";
 })(DatabaseEngine || (exports.DatabaseEngine = DatabaseEngine = {}));
 class Provider extends constructs_1.Construct {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "cdk-rds-sql.Provider", version: "9.1.0" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "cdk-rds-sql.Provider", version: "9.1.1" };
     /**
      * Import an existing provider Lambda function
      */

package/lib/role.js

@@ -83,7 +83,7 @@ class Parameters extends constructs_1.Construct {
     }
 }
 class Role extends constructs_1.Construct {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "cdk-rds-sql.Role", version: "9.1.0" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "cdk-rds-sql.Role", version: "9.1.1" };
     /**
      * The role name.
      */

package/lib/schema.js

@@ -5,7 +5,7 @@ const JSII_RTTI_SYMBOL_1 = Symbol.for("jsii.rtti");
 const aws_cdk_lib_1 = require("aws-cdk-lib");
 const enum_1 = require("./enum");
 class Schema extends aws_cdk_lib_1.CustomResource {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "cdk-rds-sql.Schema", version: "9.1.0" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "cdk-rds-sql.Schema", version: "9.1.1" };
     schemaName;
     constructor(scope, id, props) {
         super(scope, id, {

package/lib/sql.js

@@ -5,7 +5,7 @@ const JSII_RTTI_SYMBOL_1 = Symbol.for("jsii.rtti");
 const aws_cdk_lib_1 = require("aws-cdk-lib");
 const enum_1 = require("./enum");
 class Sql extends aws_cdk_lib_1.CustomResource {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "cdk-rds-sql.Sql", version: "9.1.0" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "cdk-rds-sql.Sql", version: "9.1.1" };
     constructor(scope, id, props) {
         super(scope, id, {
             serviceToken: props.provider.serviceToken,

package/package.json

@@ -75,7 +75,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "version": "9.1.0",
+  "version": "9.1.1",
   "jest": {
     "coverageProvider": "v8",
     "testMatch": [