cdklabs-projen-project-types 0.6.20 → 0.6.21

package/.jsii

@@ -3877,6 +3877,25 @@
             "primitive": "boolean"
           }
         },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "- Use the job defaults and automatically inferred permissions.",
+            "remarks": "Defined scopes override the job defaults and automatically inferred permissions,\nincluding CodeArtifact and Codecov OIDC. Undefined scopes keep their defaults.\nUse `JobPermission.NONE` to explicitly remove a permission.\n\n`buildWorkflowOptions.permissions` replaces this entire set, including automatic\npermissions. `depsUpgradeOptions.workflowOptions.permissions` overrides individual\nscopes. Applies to all release branches, but not to separate package, publishing,\nself-mutation or pull request creation jobs, or unrelated workflows.",
+            "stability": "stable",
+            "summary": "Permissions for the main build, release and dependency upgrade jobs."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/cdk-construct-library-options.ts",
+            "line": 1184
+          },
+          "name": "workflowPermissions",
+          "optional": true,
+          "type": {
+            "fqn": "projen.github.workflows.JobPermissions"
+          }
+        },
         {
           "abstract": true,
           "docs": {
@@ -3888,7 +3907,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/cdk-construct-library-options.ts",
-            "line": 1177
+            "line": 1190
           },
           "name": "workflowRunsOn",
           "optional": true,
@@ -3911,7 +3930,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/cdk-construct-library-options.ts",
-            "line": 1182
+            "line": 1195
           },
           "name": "workflowRunsOnGroup",
           "optional": true,
@@ -3929,7 +3948,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/cdk-construct-library-options.ts",
-            "line": 1187
+            "line": 1200
           },
           "name": "yarnBerryOptions",
           "optional": true,
@@ -7294,6 +7313,25 @@
             "primitive": "boolean"
           }
         },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "- Use the job defaults and automatically inferred permissions.",
+            "remarks": "Defined scopes override the job defaults and automatically inferred permissions,\nincluding CodeArtifact and Codecov OIDC. Undefined scopes keep their defaults.\nUse `JobPermission.NONE` to explicitly remove a permission.\n\n`buildWorkflowOptions.permissions` replaces this entire set, including automatic\npermissions. `depsUpgradeOptions.workflowOptions.permissions` overrides individual\nscopes. Applies to all release branches, but not to separate package, publishing,\nself-mutation or pull request creation jobs, or unrelated workflows.",
+            "stability": "stable",
+            "summary": "Permissions for the main build, release and dependency upgrade jobs."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/cdk-jsii-options.ts",
+            "line": 1112
+          },
+          "name": "workflowPermissions",
+          "optional": true,
+          "type": {
+            "fqn": "projen.github.workflows.JobPermissions"
+          }
+        },
         {
           "abstract": true,
           "docs": {
@@ -7305,7 +7343,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/cdk-jsii-options.ts",
-            "line": 1105
+            "line": 1118
           },
           "name": "workflowRunsOn",
           "optional": true,
@@ -7328,7 +7366,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/cdk-jsii-options.ts",
-            "line": 1110
+            "line": 1123
           },
           "name": "workflowRunsOnGroup",
           "optional": true,
@@ -7346,7 +7384,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/cdk-jsii-options.ts",
-            "line": 1115
+            "line": 1128
           },
           "name": "yarnBerryOptions",
           "optional": true,
@@ -11701,6 +11739,25 @@
             "primitive": "boolean"
           }
         },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "- Use the job defaults and automatically inferred permissions.",
+            "remarks": "Defined scopes override the job defaults and automatically inferred permissions,\nincluding CodeArtifact and Codecov OIDC. Undefined scopes keep their defaults.\nUse `JobPermission.NONE` to explicitly remove a permission.\n\n`buildWorkflowOptions.permissions` replaces this entire set, including automatic\npermissions. `depsUpgradeOptions.workflowOptions.permissions` overrides individual\nscopes. Applies to all release branches, but not to separate package, publishing,\nself-mutation or pull request creation jobs, or unrelated workflows.",
+            "stability": "stable",
+            "summary": "Permissions for the main build, release and dependency upgrade jobs."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/yarn/monorepo-options.ts",
+            "line": 995
+          },
+          "name": "workflowPermissions",
+          "optional": true,
+          "type": {
+            "fqn": "projen.github.workflows.JobPermissions"
+          }
+        },
         {
           "abstract": true,
           "docs": {
@@ -11712,7 +11769,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/yarn/monorepo-options.ts",
-            "line": 988
+            "line": 1001
           },
           "name": "workflowRunsOn",
           "optional": true,
@@ -11735,7 +11792,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/yarn/monorepo-options.ts",
-            "line": 993
+            "line": 1006
           },
           "name": "workflowRunsOnGroup",
           "optional": true,
@@ -11754,7 +11811,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/yarn/monorepo-options.ts",
-            "line": 1001
+            "line": 1014
           },
           "name": "yarnBerry",
           "optional": true,
@@ -11772,7 +11829,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/yarn/monorepo-options.ts",
-            "line": 1006
+            "line": 1019
           },
           "name": "yarnBerryOptions",
           "optional": true,
@@ -15553,6 +15610,25 @@
             "primitive": "boolean"
           }
         },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "- Use the job defaults and automatically inferred permissions.",
+            "remarks": "Defined scopes override the job defaults and automatically inferred permissions,\nincluding CodeArtifact and Codecov OIDC. Undefined scopes keep their defaults.\nUse `JobPermission.NONE` to explicitly remove a permission.\n\n`buildWorkflowOptions.permissions` replaces this entire set, including automatic\npermissions. `depsUpgradeOptions.workflowOptions.permissions` overrides individual\nscopes. Applies to all release branches, but not to separate package, publishing,\nself-mutation or pull request creation jobs, or unrelated workflows.",
+            "stability": "stable",
+            "summary": "Permissions for the main build, release and dependency upgrade jobs."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/yarn/typescript-workspace-options.ts",
+            "line": 966
+          },
+          "name": "workflowPermissions",
+          "optional": true,
+          "type": {
+            "fqn": "projen.github.workflows.JobPermissions"
+          }
+        },
         {
           "abstract": true,
           "docs": {
@@ -15564,7 +15640,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/yarn/typescript-workspace-options.ts",
-            "line": 959
+            "line": 972
           },
           "name": "workflowRunsOn",
           "optional": true,
@@ -15587,7 +15663,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/yarn/typescript-workspace-options.ts",
-            "line": 964
+            "line": 977
           },
           "name": "workflowRunsOnGroup",
           "optional": true,
@@ -15605,7 +15681,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/yarn/typescript-workspace-options.ts",
-            "line": 969
+            "line": 982
           },
           "name": "workspaceScope",
           "optional": true,
@@ -15623,7 +15699,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/yarn/typescript-workspace-options.ts",
-            "line": 974
+            "line": 987
           },
           "name": "yarnBerryOptions",
           "optional": true,
@@ -16196,6 +16272,6 @@
   "usedFeatures": [
     "class-covariant-overrides"
   ],
-  "version": "0.6.20",
-  "fingerprint": "N6+H765X7EiGgl95NuqnFyp9GNCLJ1LeXE0yLPfEh04="
+  "version": "0.6.21",
+  "fingerprint": "kehp+hBsvaWlDHPz1CyI36LdICsnj4iN7M7D07u3+9A="
 }

package/API.md

@@ -14471,6 +14471,7 @@ const cdkConstructLibraryOptions: CdkConstructLibraryOptions = { ... }
 | <code><a href="#cdklabs-projen-project-types.CdkConstructLibraryOptions.property.workflowGitIdentity">workflowGitIdentity</a></code> | <code>projen.github.GitIdentity</code> | The git identity to use in workflows. |
 | <code><a href="#cdklabs-projen-project-types.CdkConstructLibraryOptions.property.workflowNodeVersion">workflowNodeVersion</a></code> | <code>string</code> | The node version to use in GitHub workflows. |
 | <code><a href="#cdklabs-projen-project-types.CdkConstructLibraryOptions.property.workflowPackageCache">workflowPackageCache</a></code> | <code>boolean</code> | Enable Node.js package cache in GitHub workflows. |
+| <code><a href="#cdklabs-projen-project-types.CdkConstructLibraryOptions.property.workflowPermissions">workflowPermissions</a></code> | <code>projen.github.workflows.JobPermissions</code> | Permissions for the main build, release and dependency upgrade jobs. |
 | <code><a href="#cdklabs-projen-project-types.CdkConstructLibraryOptions.property.workflowRunsOn">workflowRunsOn</a></code> | <code>string[]</code> | Github Runner selection labels. |
 | <code><a href="#cdklabs-projen-project-types.CdkConstructLibraryOptions.property.workflowRunsOnGroup">workflowRunsOnGroup</a></code> | <code>projen.GroupRunnerOptions</code> | Github Runner Group selection options. |
 | <code><a href="#cdklabs-projen-project-types.CdkConstructLibraryOptions.property.yarnBerryOptions">yarnBerryOptions</a></code> | <code>projen.javascript.YarnBerryOptions</code> | Options for Yarn Berry. |
@@ -17198,6 +17199,28 @@ Enable Node.js package cache in GitHub workflows.
 
 ---
 
+##### `workflowPermissions`<sup>Optional</sup> <a name="workflowPermissions" id="cdklabs-projen-project-types.CdkConstructLibraryOptions.property.workflowPermissions"></a>
+
+```typescript
+public readonly workflowPermissions: JobPermissions;
+```
+
+- *Type:* projen.github.workflows.JobPermissions
+- *Default:* Use the job defaults and automatically inferred permissions.
+
+Permissions for the main build, release and dependency upgrade jobs.
+
+Defined scopes override the job defaults and automatically inferred permissions,
+including CodeArtifact and Codecov OIDC. Undefined scopes keep their defaults.
+Use `JobPermission.NONE` to explicitly remove a permission.
+
+`buildWorkflowOptions.permissions` replaces this entire set, including automatic
+permissions. `depsUpgradeOptions.workflowOptions.permissions` overrides individual
+scopes. Applies to all release branches, but not to separate package, publishing,
+self-mutation or pull request creation jobs, or unrelated workflows.
+
+---
+
 ##### ~~`workflowRunsOn`~~<sup>Optional</sup> <a name="workflowRunsOn" id="cdklabs-projen-project-types.CdkConstructLibraryOptions.property.workflowRunsOn"></a>
 
 - *Deprecated:* use `githubOptions.workflowRunsOn` on the project, or `runsOn` on `ReleaseOptions`
@@ -17432,6 +17455,7 @@ const cdkJsiiProjectOptions: CdkJsiiProjectOptions = { ... }
 | <code><a href="#cdklabs-projen-project-types.CdkJsiiProjectOptions.property.workflowGitIdentity">workflowGitIdentity</a></code> | <code>projen.github.GitIdentity</code> | The git identity to use in workflows. |
 | <code><a href="#cdklabs-projen-project-types.CdkJsiiProjectOptions.property.workflowNodeVersion">workflowNodeVersion</a></code> | <code>string</code> | The node version used in GitHub Actions workflows. |
 | <code><a href="#cdklabs-projen-project-types.CdkJsiiProjectOptions.property.workflowPackageCache">workflowPackageCache</a></code> | <code>boolean</code> | Enable Node.js package cache in GitHub workflows. |
+| <code><a href="#cdklabs-projen-project-types.CdkJsiiProjectOptions.property.workflowPermissions">workflowPermissions</a></code> | <code>projen.github.workflows.JobPermissions</code> | Permissions for the main build, release and dependency upgrade jobs. |
 | <code><a href="#cdklabs-projen-project-types.CdkJsiiProjectOptions.property.workflowRunsOn">workflowRunsOn</a></code> | <code>string[]</code> | Github Runner selection labels. |
 | <code><a href="#cdklabs-projen-project-types.CdkJsiiProjectOptions.property.workflowRunsOnGroup">workflowRunsOnGroup</a></code> | <code>projen.GroupRunnerOptions</code> | Github Runner Group selection options. |
 | <code><a href="#cdklabs-projen-project-types.CdkJsiiProjectOptions.property.yarnBerryOptions">yarnBerryOptions</a></code> | <code>projen.javascript.YarnBerryOptions</code> | Options for Yarn Berry. |
@@ -19985,6 +20009,28 @@ Enable Node.js package cache in GitHub workflows.
 
 ---
 
+##### `workflowPermissions`<sup>Optional</sup> <a name="workflowPermissions" id="cdklabs-projen-project-types.CdkJsiiProjectOptions.property.workflowPermissions"></a>
+
+```typescript
+public readonly workflowPermissions: JobPermissions;
+```
+
+- *Type:* projen.github.workflows.JobPermissions
+- *Default:* Use the job defaults and automatically inferred permissions.
+
+Permissions for the main build, release and dependency upgrade jobs.
+
+Defined scopes override the job defaults and automatically inferred permissions,
+including CodeArtifact and Codecov OIDC. Undefined scopes keep their defaults.
+Use `JobPermission.NONE` to explicitly remove a permission.
+
+`buildWorkflowOptions.permissions` replaces this entire set, including automatic
+permissions. `depsUpgradeOptions.workflowOptions.permissions` overrides individual
+scopes. Applies to all release branches, but not to separate package, publishing,
+self-mutation or pull request creation jobs, or unrelated workflows.
+
+---
+
 ##### ~~`workflowRunsOn`~~<sup>Optional</sup> <a name="workflowRunsOn" id="cdklabs-projen-project-types.CdkJsiiProjectOptions.property.workflowRunsOn"></a>
 
 - *Deprecated:* use `githubOptions.workflowRunsOn` on the project, or `runsOn` on `ReleaseOptions`
@@ -20230,6 +20276,7 @@ const cdklabsConstructLibraryOptions: CdklabsConstructLibraryOptions = { ... }
 | <code><a href="#cdklabs-projen-project-types.CdklabsConstructLibraryOptions.property.workflowGitIdentity">workflowGitIdentity</a></code> | <code>projen.github.GitIdentity</code> | The git identity to use in workflows. |
 | <code><a href="#cdklabs-projen-project-types.CdklabsConstructLibraryOptions.property.workflowNodeVersion">workflowNodeVersion</a></code> | <code>string</code> | The node version to use in GitHub workflows. |
 | <code><a href="#cdklabs-projen-project-types.CdklabsConstructLibraryOptions.property.workflowPackageCache">workflowPackageCache</a></code> | <code>boolean</code> | Enable Node.js package cache in GitHub workflows. |
+| <code><a href="#cdklabs-projen-project-types.CdklabsConstructLibraryOptions.property.workflowPermissions">workflowPermissions</a></code> | <code>projen.github.workflows.JobPermissions</code> | Permissions for the main build, release and dependency upgrade jobs. |
 | <code><a href="#cdklabs-projen-project-types.CdklabsConstructLibraryOptions.property.workflowRunsOn">workflowRunsOn</a></code> | <code>string[]</code> | Github Runner selection labels. |
 | <code><a href="#cdklabs-projen-project-types.CdklabsConstructLibraryOptions.property.workflowRunsOnGroup">workflowRunsOnGroup</a></code> | <code>projen.GroupRunnerOptions</code> | Github Runner Group selection options. |
 | <code><a href="#cdklabs-projen-project-types.CdklabsConstructLibraryOptions.property.yarnBerryOptions">yarnBerryOptions</a></code> | <code>projen.javascript.YarnBerryOptions</code> | Options for Yarn Berry. |
@@ -22959,6 +23006,28 @@ Enable Node.js package cache in GitHub workflows.
 
 ---
 
+##### `workflowPermissions`<sup>Optional</sup> <a name="workflowPermissions" id="cdklabs-projen-project-types.CdklabsConstructLibraryOptions.property.workflowPermissions"></a>
+
+```typescript
+public readonly workflowPermissions: JobPermissions;
+```
+
+- *Type:* projen.github.workflows.JobPermissions
+- *Default:* Use the job defaults and automatically inferred permissions.
+
+Permissions for the main build, release and dependency upgrade jobs.
+
+Defined scopes override the job defaults and automatically inferred permissions,
+including CodeArtifact and Codecov OIDC. Undefined scopes keep their defaults.
+Use `JobPermission.NONE` to explicitly remove a permission.
+
+`buildWorkflowOptions.permissions` replaces this entire set, including automatic
+permissions. `depsUpgradeOptions.workflowOptions.permissions` overrides individual
+scopes. Applies to all release branches, but not to separate package, publishing,
+self-mutation or pull request creation jobs, or unrelated workflows.
+
+---
+
 ##### ~~`workflowRunsOn`~~<sup>Optional</sup> <a name="workflowRunsOn" id="cdklabs-projen-project-types.CdklabsConstructLibraryOptions.property.workflowRunsOn"></a>
 
 - *Deprecated:* use `githubOptions.workflowRunsOn` on the project, or `runsOn` on `ReleaseOptions`
@@ -23230,6 +23299,7 @@ const cdklabsJsiiProjectOptions: CdklabsJsiiProjectOptions = { ... }
 | <code><a href="#cdklabs-projen-project-types.CdklabsJsiiProjectOptions.property.workflowGitIdentity">workflowGitIdentity</a></code> | <code>projen.github.GitIdentity</code> | The git identity to use in workflows. |
 | <code><a href="#cdklabs-projen-project-types.CdklabsJsiiProjectOptions.property.workflowNodeVersion">workflowNodeVersion</a></code> | <code>string</code> | The node version used in GitHub Actions workflows. |
 | <code><a href="#cdklabs-projen-project-types.CdklabsJsiiProjectOptions.property.workflowPackageCache">workflowPackageCache</a></code> | <code>boolean</code> | Enable Node.js package cache in GitHub workflows. |
+| <code><a href="#cdklabs-projen-project-types.CdklabsJsiiProjectOptions.property.workflowPermissions">workflowPermissions</a></code> | <code>projen.github.workflows.JobPermissions</code> | Permissions for the main build, release and dependency upgrade jobs. |
 | <code><a href="#cdklabs-projen-project-types.CdklabsJsiiProjectOptions.property.workflowRunsOn">workflowRunsOn</a></code> | <code>string[]</code> | Github Runner selection labels. |
 | <code><a href="#cdklabs-projen-project-types.CdklabsJsiiProjectOptions.property.workflowRunsOnGroup">workflowRunsOnGroup</a></code> | <code>projen.GroupRunnerOptions</code> | Github Runner Group selection options. |
 | <code><a href="#cdklabs-projen-project-types.CdklabsJsiiProjectOptions.property.yarnBerryOptions">yarnBerryOptions</a></code> | <code>projen.javascript.YarnBerryOptions</code> | Options for Yarn Berry. |
@@ -25785,6 +25855,28 @@ Enable Node.js package cache in GitHub workflows.
 
 ---
 
+##### `workflowPermissions`<sup>Optional</sup> <a name="workflowPermissions" id="cdklabs-projen-project-types.CdklabsJsiiProjectOptions.property.workflowPermissions"></a>
+
+```typescript
+public readonly workflowPermissions: JobPermissions;
+```
+
+- *Type:* projen.github.workflows.JobPermissions
+- *Default:* Use the job defaults and automatically inferred permissions.
+
+Permissions for the main build, release and dependency upgrade jobs.
+
+Defined scopes override the job defaults and automatically inferred permissions,
+including CodeArtifact and Codecov OIDC. Undefined scopes keep their defaults.
+Use `JobPermission.NONE` to explicitly remove a permission.
+
+`buildWorkflowOptions.permissions` replaces this entire set, including automatic
+permissions. `depsUpgradeOptions.workflowOptions.permissions` overrides individual
+scopes. Applies to all release branches, but not to separate package, publishing,
+self-mutation or pull request creation jobs, or unrelated workflows.
+
+---
+
 ##### ~~`workflowRunsOn`~~<sup>Optional</sup> <a name="workflowRunsOn" id="cdklabs-projen-project-types.CdklabsJsiiProjectOptions.property.workflowRunsOn"></a>
 
 - *Deprecated:* use `githubOptions.workflowRunsOn` on the project, or `runsOn` on `ReleaseOptions`
@@ -26038,6 +26130,7 @@ const cdkLabsMonorepoOptions: yarn.CdkLabsMonorepoOptions = { ... }
 | <code><a href="#cdklabs-projen-project-types.yarn.CdkLabsMonorepoOptions.property.workflowGitIdentity">workflowGitIdentity</a></code> | <code>projen.github.GitIdentity</code> | The git identity to use in workflows. |
 | <code><a href="#cdklabs-projen-project-types.yarn.CdkLabsMonorepoOptions.property.workflowNodeVersion">workflowNodeVersion</a></code> | <code>string</code> | The node version to use in GitHub workflows. |
 | <code><a href="#cdklabs-projen-project-types.yarn.CdkLabsMonorepoOptions.property.workflowPackageCache">workflowPackageCache</a></code> | <code>boolean</code> | Enable Node.js package cache in GitHub workflows. |
+| <code><a href="#cdklabs-projen-project-types.yarn.CdkLabsMonorepoOptions.property.workflowPermissions">workflowPermissions</a></code> | <code>projen.github.workflows.JobPermissions</code> | Permissions for the main build, release and dependency upgrade jobs. |
 | <code><a href="#cdklabs-projen-project-types.yarn.CdkLabsMonorepoOptions.property.workflowRunsOn">workflowRunsOn</a></code> | <code>string[]</code> | Github Runner selection labels. |
 | <code><a href="#cdklabs-projen-project-types.yarn.CdkLabsMonorepoOptions.property.workflowRunsOnGroup">workflowRunsOnGroup</a></code> | <code>projen.GroupRunnerOptions</code> | Github Runner Group selection options. |
 | <code><a href="#cdklabs-projen-project-types.yarn.CdkLabsMonorepoOptions.property.yarnBerry">yarnBerry</a></code> | <code>boolean</code> | Use Yarn Berry as the package manager. |
@@ -28311,6 +28404,28 @@ Enable Node.js package cache in GitHub workflows.
 
 ---
 
+##### `workflowPermissions`<sup>Optional</sup> <a name="workflowPermissions" id="cdklabs-projen-project-types.yarn.CdkLabsMonorepoOptions.property.workflowPermissions"></a>
+
+```typescript
+public readonly workflowPermissions: JobPermissions;
+```
+
+- *Type:* projen.github.workflows.JobPermissions
+- *Default:* Use the job defaults and automatically inferred permissions.
+
+Permissions for the main build, release and dependency upgrade jobs.
+
+Defined scopes override the job defaults and automatically inferred permissions,
+including CodeArtifact and Codecov OIDC. Undefined scopes keep their defaults.
+Use `JobPermission.NONE` to explicitly remove a permission.
+
+`buildWorkflowOptions.permissions` replaces this entire set, including automatic
+permissions. `depsUpgradeOptions.workflowOptions.permissions` overrides individual
+scopes. Applies to all release branches, but not to separate package, publishing,
+self-mutation or pull request creation jobs, or unrelated workflows.
+
+---
+
 ##### ~~`workflowRunsOn`~~<sup>Optional</sup> <a name="workflowRunsOn" id="cdklabs-projen-project-types.yarn.CdkLabsMonorepoOptions.property.workflowRunsOn"></a>
 
 - *Deprecated:* use `githubOptions.workflowRunsOn` on the project, or `runsOn` on `ReleaseOptions`
@@ -28578,6 +28693,7 @@ const cdklabsTypeScriptProjectOptions: CdklabsTypeScriptProjectOptions = { ... }
 | <code><a href="#cdklabs-projen-project-types.CdklabsTypeScriptProjectOptions.property.workflowGitIdentity">workflowGitIdentity</a></code> | <code>projen.github.GitIdentity</code> | The git identity to use in workflows. |
 | <code><a href="#cdklabs-projen-project-types.CdklabsTypeScriptProjectOptions.property.workflowNodeVersion">workflowNodeVersion</a></code> | <code>string</code> | The node version used in GitHub Actions workflows. |
 | <code><a href="#cdklabs-projen-project-types.CdklabsTypeScriptProjectOptions.property.workflowPackageCache">workflowPackageCache</a></code> | <code>boolean</code> | Enable Node.js package cache in GitHub workflows. |
+| <code><a href="#cdklabs-projen-project-types.CdklabsTypeScriptProjectOptions.property.workflowPermissions">workflowPermissions</a></code> | <code>projen.github.workflows.JobPermissions</code> | Permissions for the main build, release and dependency upgrade jobs. |
 | <code><a href="#cdklabs-projen-project-types.CdklabsTypeScriptProjectOptions.property.disableTsconfig">disableTsconfig</a></code> | <code>boolean</code> | Do not generate a `tsconfig.json` file (used by jsii projects since tsconfig.json is generated by the jsii compiler). |
 | <code><a href="#cdklabs-projen-project-types.CdklabsTypeScriptProjectOptions.property.disableTsconfigDev">disableTsconfigDev</a></code> | <code>boolean</code> | Do not generate a development tsconfig file. |
 | <code><a href="#cdklabs-projen-project-types.CdklabsTypeScriptProjectOptions.property.docgen">docgen</a></code> | <code>boolean</code> | Docgen by Typedoc. |
@@ -30636,6 +30752,28 @@ Enable Node.js package cache in GitHub workflows.
 
 ---
 
+##### `workflowPermissions`<sup>Optional</sup> <a name="workflowPermissions" id="cdklabs-projen-project-types.CdklabsTypeScriptProjectOptions.property.workflowPermissions"></a>
+
+```typescript
+public readonly workflowPermissions: JobPermissions;
+```
+
+- *Type:* projen.github.workflows.JobPermissions
+- *Default:* Use the job defaults and automatically inferred permissions.
+
+Permissions for the main build, release and dependency upgrade jobs.
+
+Defined scopes override the job defaults and automatically inferred permissions,
+including CodeArtifact and Codecov OIDC. Undefined scopes keep their defaults.
+Use `JobPermission.NONE` to explicitly remove a permission.
+
+`buildWorkflowOptions.permissions` replaces this entire set, including automatic
+permissions. `depsUpgradeOptions.workflowOptions.permissions` overrides individual
+scopes. Applies to all release branches, but not to separate package, publishing,
+self-mutation or pull request creation jobs, or unrelated workflows.
+
+---
+
 ##### `disableTsconfig`<sup>Optional</sup> <a name="disableTsconfig" id="cdklabs-projen-project-types.CdklabsTypeScriptProjectOptions.property.disableTsconfig"></a>
 
 ```typescript
@@ -31176,6 +31314,7 @@ const cdkTypeScriptProjectOptions: CdkTypeScriptProjectOptions = { ... }
 | <code><a href="#cdklabs-projen-project-types.CdkTypeScriptProjectOptions.property.workflowGitIdentity">workflowGitIdentity</a></code> | <code>projen.github.GitIdentity</code> | The git identity to use in workflows. |
 | <code><a href="#cdklabs-projen-project-types.CdkTypeScriptProjectOptions.property.workflowNodeVersion">workflowNodeVersion</a></code> | <code>string</code> | The node version used in GitHub Actions workflows. |
 | <code><a href="#cdklabs-projen-project-types.CdkTypeScriptProjectOptions.property.workflowPackageCache">workflowPackageCache</a></code> | <code>boolean</code> | Enable Node.js package cache in GitHub workflows. |
+| <code><a href="#cdklabs-projen-project-types.CdkTypeScriptProjectOptions.property.workflowPermissions">workflowPermissions</a></code> | <code>projen.github.workflows.JobPermissions</code> | Permissions for the main build, release and dependency upgrade jobs. |
 | <code><a href="#cdklabs-projen-project-types.CdkTypeScriptProjectOptions.property.disableTsconfig">disableTsconfig</a></code> | <code>boolean</code> | Do not generate a `tsconfig.json` file (used by jsii projects since tsconfig.json is generated by the jsii compiler). |
 | <code><a href="#cdklabs-projen-project-types.CdkTypeScriptProjectOptions.property.disableTsconfigDev">disableTsconfigDev</a></code> | <code>boolean</code> | Do not generate a development tsconfig file. |
 | <code><a href="#cdklabs-projen-project-types.CdkTypeScriptProjectOptions.property.docgen">docgen</a></code> | <code>boolean</code> | Docgen by Typedoc. |
@@ -33234,6 +33373,28 @@ Enable Node.js package cache in GitHub workflows.
 
 ---
 
+##### `workflowPermissions`<sup>Optional</sup> <a name="workflowPermissions" id="cdklabs-projen-project-types.CdkTypeScriptProjectOptions.property.workflowPermissions"></a>
+
+```typescript
+public readonly workflowPermissions: JobPermissions;
+```
+
+- *Type:* projen.github.workflows.JobPermissions
+- *Default:* Use the job defaults and automatically inferred permissions.
+
+Permissions for the main build, release and dependency upgrade jobs.
+
+Defined scopes override the job defaults and automatically inferred permissions,
+including CodeArtifact and Codecov OIDC. Undefined scopes keep their defaults.
+Use `JobPermission.NONE` to explicitly remove a permission.
+
+`buildWorkflowOptions.permissions` replaces this entire set, including automatic
+permissions. `depsUpgradeOptions.workflowOptions.permissions` overrides individual
+scopes. Applies to all release branches, but not to separate package, publishing,
+self-mutation or pull request creation jobs, or unrelated workflows.
+
+---
+
 ##### `disableTsconfig`<sup>Optional</sup> <a name="disableTsconfig" id="cdklabs-projen-project-types.CdkTypeScriptProjectOptions.property.disableTsconfig"></a>
 
 ```typescript
@@ -34186,6 +34347,7 @@ const monorepoOptions: yarn.MonorepoOptions = { ... }
 | <code><a href="#cdklabs-projen-project-types.yarn.MonorepoOptions.property.workflowGitIdentity">workflowGitIdentity</a></code> | <code>projen.github.GitIdentity</code> | The git identity to use in workflows. |
 | <code><a href="#cdklabs-projen-project-types.yarn.MonorepoOptions.property.workflowNodeVersion">workflowNodeVersion</a></code> | <code>string</code> | The node version to use in GitHub workflows. |
 | <code><a href="#cdklabs-projen-project-types.yarn.MonorepoOptions.property.workflowPackageCache">workflowPackageCache</a></code> | <code>boolean</code> | Enable Node.js package cache in GitHub workflows. |
+| <code><a href="#cdklabs-projen-project-types.yarn.MonorepoOptions.property.workflowPermissions">workflowPermissions</a></code> | <code>projen.github.workflows.JobPermissions</code> | Permissions for the main build, release and dependency upgrade jobs. |
 | <code><a href="#cdklabs-projen-project-types.yarn.MonorepoOptions.property.workflowRunsOn">workflowRunsOn</a></code> | <code>string[]</code> | Github Runner selection labels. |
 | <code><a href="#cdklabs-projen-project-types.yarn.MonorepoOptions.property.workflowRunsOnGroup">workflowRunsOnGroup</a></code> | <code>projen.GroupRunnerOptions</code> | Github Runner Group selection options. |
 | <code><a href="#cdklabs-projen-project-types.yarn.MonorepoOptions.property.yarnBerry">yarnBerry</a></code> | <code>boolean</code> | Use Yarn Berry as the package manager. |
@@ -36459,6 +36621,28 @@ Enable Node.js package cache in GitHub workflows.
 
 ---
 
+##### `workflowPermissions`<sup>Optional</sup> <a name="workflowPermissions" id="cdklabs-projen-project-types.yarn.MonorepoOptions.property.workflowPermissions"></a>
+
+```typescript
+public readonly workflowPermissions: JobPermissions;
+```
+
+- *Type:* projen.github.workflows.JobPermissions
+- *Default:* Use the job defaults and automatically inferred permissions.
+
+Permissions for the main build, release and dependency upgrade jobs.
+
+Defined scopes override the job defaults and automatically inferred permissions,
+including CodeArtifact and Codecov OIDC. Undefined scopes keep their defaults.
+Use `JobPermission.NONE` to explicitly remove a permission.
+
+`buildWorkflowOptions.permissions` replaces this entire set, including automatic
+permissions. `depsUpgradeOptions.workflowOptions.permissions` overrides individual
+scopes. Applies to all release branches, but not to separate package, publishing,
+self-mutation or pull request creation jobs, or unrelated workflows.
+
+---
+
 ##### ~~`workflowRunsOn`~~<sup>Optional</sup> <a name="workflowRunsOn" id="cdklabs-projen-project-types.yarn.MonorepoOptions.property.workflowRunsOn"></a>
 
 - *Deprecated:* use `githubOptions.workflowRunsOn` on the project, or `runsOn` on `ReleaseOptions`
@@ -37170,6 +37354,7 @@ const typeScriptWorkspaceOptions: yarn.TypeScriptWorkspaceOptions = { ... }
 | <code><a href="#cdklabs-projen-project-types.yarn.TypeScriptWorkspaceOptions.property.workflowGitIdentity">workflowGitIdentity</a></code> | <code>projen.github.GitIdentity</code> | The git identity to use in workflows. |
 | <code><a href="#cdklabs-projen-project-types.yarn.TypeScriptWorkspaceOptions.property.workflowNodeVersion">workflowNodeVersion</a></code> | <code>string</code> | The node version to use in GitHub workflows. |
 | <code><a href="#cdklabs-projen-project-types.yarn.TypeScriptWorkspaceOptions.property.workflowPackageCache">workflowPackageCache</a></code> | <code>boolean</code> | Enable Node.js package cache in GitHub workflows. |
+| <code><a href="#cdklabs-projen-project-types.yarn.TypeScriptWorkspaceOptions.property.workflowPermissions">workflowPermissions</a></code> | <code>projen.github.workflows.JobPermissions</code> | Permissions for the main build, release and dependency upgrade jobs. |
 | <code><a href="#cdklabs-projen-project-types.yarn.TypeScriptWorkspaceOptions.property.workflowRunsOn">workflowRunsOn</a></code> | <code>string[]</code> | Github Runner selection labels. |
 | <code><a href="#cdklabs-projen-project-types.yarn.TypeScriptWorkspaceOptions.property.workflowRunsOnGroup">workflowRunsOnGroup</a></code> | <code>projen.GroupRunnerOptions</code> | Github Runner Group selection options. |
 | <code><a href="#cdklabs-projen-project-types.yarn.TypeScriptWorkspaceOptions.property.workspaceScope">workspaceScope</a></code> | <code>string</code> | The workspace scope the package is located in. |
@@ -39371,6 +39556,28 @@ Enable Node.js package cache in GitHub workflows.
 
 ---
 
+##### `workflowPermissions`<sup>Optional</sup> <a name="workflowPermissions" id="cdklabs-projen-project-types.yarn.TypeScriptWorkspaceOptions.property.workflowPermissions"></a>
+
+```typescript
+public readonly workflowPermissions: JobPermissions;
+```
+
+- *Type:* projen.github.workflows.JobPermissions
+- *Default:* Use the job defaults and automatically inferred permissions.
+
+Permissions for the main build, release and dependency upgrade jobs.
+
+Defined scopes override the job defaults and automatically inferred permissions,
+including CodeArtifact and Codecov OIDC. Undefined scopes keep their defaults.
+Use `JobPermission.NONE` to explicitly remove a permission.
+
+`buildWorkflowOptions.permissions` replaces this entire set, including automatic
+permissions. `depsUpgradeOptions.workflowOptions.permissions` overrides individual
+scopes. Applies to all release branches, but not to separate package, publishing,
+self-mutation or pull request creation jobs, or unrelated workflows.
+
+---
+
 ##### ~~`workflowRunsOn`~~<sup>Optional</sup> <a name="workflowRunsOn" id="cdklabs-projen-project-types.yarn.TypeScriptWorkspaceOptions.property.workflowRunsOn"></a>
 
 - *Deprecated:* use `githubOptions.workflowRunsOn` on the project, or `runsOn` on `ReleaseOptions`

package/lib/cdk-construct-library-options.d.ts

@@ -1167,6 +1167,19 @@ export interface CdkConstructLibraryOptions {
      * @default false
      */
     readonly workflowPackageCache?: boolean;
+    /**
+     * Permissions for the main build, release and dependency upgrade jobs.
+     * Defined scopes override the job defaults and automatically inferred permissions,
+     * including CodeArtifact and Codecov OIDC. Undefined scopes keep their defaults.
+     * Use `JobPermission.NONE` to explicitly remove a permission.
+     *
+     * `buildWorkflowOptions.permissions` replaces this entire set, including automatic
+     * permissions. `depsUpgradeOptions.workflowOptions.permissions` overrides individual
+     * scopes. Applies to all release branches, but not to separate package, publishing,
+     * self-mutation or pull request creation jobs, or unrelated workflows.
+     * @default - Use the job defaults and automatically inferred permissions.
+     */
+    readonly workflowPermissions?: github.workflows.JobPermissions;
     /**
      * Github Runner selection labels.
      * @default ["ubuntu-latest"]