projen-modules 3.1.0 → 3.2.0

package/.jsii

@@ -99,7 +99,7 @@
   },
   "name": "projen-modules",
   "readme": {
-    "markdown": "# projen-modules\n\nA collection of custom projen modules, that can be used to bootstrap and maintain consistent project configuration, tooling, dependencies, and builds.\n\n## Getting Started\n\n```sh\nyarn install\nnpx projen build\n```\n\nThis will:\n* Install the dependencies\n* Apply any projen changes\n* Run tests\n* Package project locally\n\nAny files changed by projen should be committed to git.\n\nRunning the tests like this will update any snapshot files, this should be reviewed and committed to git.\n\n## Testing\n\nTypes of testing:\n* Snapshot - projen project outputs are stored as a snapshot in the corresponding `__snapshots__` directory. When the project changes then it is expected that these snapshots change too and should be reviewed committed alongside the project.\n* Unit tests - these assert on specific functionality of the project and should be written for any new functionality added.\n\n\n## GitHub Configuration\n\nAll pull requests are merged by the [Mergify](https://mergify.com) merge queue, configured in `.mergify.yml`. Once a pull request's checks pass, Mergify queues it, brings it up to date with the default branch, waits for the checks again and squash merges it. Draft pull requests and those labelled `do-not-merge` are not merged.\n\nThe repository must be configured as below so that nothing can be merged without going through the queue.\n\n### Mergify\n\nInstall the [Mergify GitHub App](https://github.com/apps/mergify) and give it access to this repository.\n\n### Pull request settings\n\nIn **Settings → General → Pull Requests**:\n* Allow squash merging only (untick merge commits and rebase merging), matching the queue's merge method.\n* Untick **Allow auto-merge**, because GitHub's own auto-merge merges outside the queue.\n* Tick **Automatically delete head branches**.\n\n### Branch ruleset\n\nIn **Settings → Rules → Rulesets**, create a branch ruleset with enforcement **Active** that targets the default branch, and set:\n* **Bypass list**: the **Mergify** app only, in **Exempt** mode. Do not add admins or other roles, as anyone on this list can merge without the queue.\n* **Restrict updates**: only bypass actors can update the branch, so pull requests cannot be merged from the GitHub UI or CLI and commits cannot be pushed directly.\n* **Restrict deletions** and **Block force pushes**.\n* **Require a pull request before merging**, with 0 required approvals.\n* **Require status checks to pass**, listing the checks that `.mergify.yml` waits for: `build`, `package-js`, `package-python`. Leave **Require branches to be up to date before merging** unticked, as the queue already updates and retests each pull request.\n\nDo not enable GitHub's own **Require merge queue** rule, as it competes with Mergify.\n\nIf the queue is unavailable and a change has to be merged, add yourself to the bypass list temporarily and remove yourself afterwards.\n\n## Creating a New Project\n\n\n```\nnpx projen new {project} --from projen-modules\n```\n\nSome projects may have required fields that need to be specified as part of this command, review any errors for details what needs to be specified.\n\n### Project Types\n\n| Project type                                   | Description                |\n| ---------------------------------------------- | -------------------------- |\n| [cdk-typescript-app](API.md#cdktypescriptapp-) | A typescript CDK app |\n| [npm-package](API.md#npmpackage-)              | A typescript npm package   |\n| [python-package](API.md#pythonpackage-)        | A python package           |\n| [jsii-package](API.md#jsiiproject-)            | A typescript JSII package  |\n\n## Project Structure\n\nAll source is located in `src` and is grouped by:\n* `components` - these are common building blocks that can be used by projects to implement specific project functionality.\n* `projects` - these are projects that can be built from this project (see #something)\n* `utils` - these are helper functions that are often reused\n\n`test` contains tests, and mirrors the `src` directory structure. Within here there are `__snapshots__` which contain snapshots of project tests (see #section)."
+    "markdown": "# projen-modules\n\nA collection of custom projen modules, that can be used to bootstrap and maintain consistent project configuration, tooling, dependencies, and builds.\n\n## Getting Started\n\n```sh\nyarn install\nnpx projen build\n```\n\nThis will:\n* Install the dependencies\n* Apply any projen changes\n* Run tests\n* Package project locally\n\nAny files changed by projen should be committed to git.\n\nRunning the tests like this will update any snapshot files, this should be reviewed and committed to git.\n\n## Testing\n\nTypes of testing:\n* Snapshot - projen project outputs are stored as a snapshot in the corresponding `__snapshots__` directory. When the project changes then it is expected that these snapshots change too and should be reviewed committed alongside the project.\n* Unit tests - these assert on specific functionality of the project and should be written for any new functionality added.\n\n\n## GitHub Configuration\n\nAll pull requests are merged by the [Mergify](https://mergify.com) merge queue, configured in `.mergify.yml`. Once a pull request's checks pass, Mergify queues it, brings it up to date with the default branch, waits for the checks again and squash merges it. Draft pull requests and those labelled `do-not-merge` are not merged.\n\nThe repository must be configured as below so that nothing can be merged without going through the queue.\n\n### Mergify\n\nInstall the [Mergify GitHub App](https://github.com/apps/mergify) and give it access to this repository.\n\n### Pull request settings\n\nIn **Settings → General → Pull Requests**:\n* Allow squash merging only (untick merge commits and rebase merging), matching the queue's merge method.\n* Untick **Allow auto-merge**, because GitHub's own auto-merge merges outside the queue.\n* Tick **Automatically delete head branches**.\n\n### Code scanning\n\nCodeQL runs from `.github/workflows/codeql.yml`, which is managed by projen. In **Settings → Advanced Security**, leave CodeQL **Default setup** off, because it cannot run alongside this workflow. Under **Protection rules**, keep the **Check run failure threshold** at **High or higher** for security alerts and **Errors** for other alerts, as this decides whether the `CodeQL` check fails. Private repositories also need GitHub Code Security enabled there for code scanning results to be uploaded.\n\n### Branch ruleset\n\nIn **Settings → Rules → Rulesets**, create a branch ruleset with enforcement **Active** that targets the default branch, and set:\n* **Bypass list**: the **Mergify** app only, in **Exempt** mode. Do not add admins or other roles, as anyone on this list can merge without the queue.\n* **Restrict updates**: only bypass actors can update the branch, so pull requests cannot be merged from the GitHub UI or CLI and commits cannot be pushed directly.\n* **Restrict deletions** and **Block force pushes**.\n* **Require a pull request before merging**, with 0 required approvals.\n* **Require status checks to pass**, listing the checks that `.mergify.yml` waits for: `build`, `package-js`, `package-python`. Leave **Require branches to be up to date before merging** unticked, as the queue already updates and retests each pull request.\n* **Require code scanning results**, with the tool **CodeQL**, security alerts set to **High or higher** and alerts set to **Errors**. Mergify is exempt from this rule, so `.mergify.yml` also waits for the `CodeQL` check instead.\n\nDo not enable GitHub's own **Require merge queue** rule, as it competes with Mergify.\n\nIf the queue is unavailable and a change has to be merged, add yourself to the bypass list temporarily and remove yourself afterwards.\n\n## Creating a New Project\n\n\n```\nnpx projen new {project} --from projen-modules\n```\n\nSome projects may have required fields that need to be specified as part of this command, review any errors for details what needs to be specified.\n\n### Project Types\n\n| Project type                                   | Description                |\n| ---------------------------------------------- | -------------------------- |\n| [cdk-typescript-app](API.md#cdktypescriptapp-) | A typescript CDK app |\n| [npm-package](API.md#npmpackage-)              | A typescript npm package   |\n| [python-package](API.md#pythonpackage-)        | A python package           |\n| [jsii-package](API.md#jsiiproject-)            | A typescript JSII package  |\n\n## Project Structure\n\nAll source is located in `src` and is grouped by:\n* `components` - these are common building blocks that can be used by projects to implement specific project functionality.\n* `projects` - these are projects that can be built from this project (see #something)\n* `utils` - these are helper functions that are often reused\n\n`test` contains tests, and mirrors the `src` directory structure. Within here there are `__snapshots__` which contain snapshots of project tests (see #section)."
   },
   "repository": {
     "type": "git",
@@ -133,7 +133,7 @@
         },
         "locationInModule": {
           "filename": "src/projects/cdk-ts/index.ts",
-          "line": 35
+          "line": 36
         },
         "parameters": [
           {
@@ -147,7 +147,7 @@
       "kind": "class",
       "locationInModule": {
         "filename": "src/projects/cdk-ts/index.ts",
-        "line": 32
+        "line": 33
       },
       "name": "CdkTypeScriptApp",
       "properties": [
@@ -157,7 +157,7 @@
           },
           "locationInModule": {
             "filename": "src/projects/cdk-ts/index.ts",
-            "line": 33
+            "line": 34
           },
           "name": "readme",
           "type": {
@@ -208,7 +208,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/projects/cdk-ts/cdk-typescript-app-options.ts",
-            "line": 1270
+            "line": 1275
           },
           "name": "codeOwners",
           "type": {
@@ -923,6 +923,24 @@
             "primitive": "string"
           }
         },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "true",
+            "stability": "stable",
+            "summary": "Scan the code with CodeQL on pull requests, pushes to the default branch and weekly."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/projects/cdk-ts/cdk-typescript-app-options.ts",
+            "line": 1271
+          },
+          "name": "codeql",
+          "optional": true,
+          "type": {
+            "primitive": "boolean"
+          }
+        },
         {
           "abstract": true,
           "docs": {
@@ -3560,7 +3578,7 @@
         },
         "locationInModule": {
           "filename": "src/projects/jsii/index.ts",
-          "line": 33
+          "line": 34
         },
         "parameters": [
           {
@@ -3574,7 +3592,7 @@
       "kind": "class",
       "locationInModule": {
         "filename": "src/projects/jsii/index.ts",
-        "line": 30
+        "line": 31
       },
       "name": "JsiiProject",
       "properties": [
@@ -3584,7 +3602,7 @@
           },
           "locationInModule": {
             "filename": "src/projects/jsii/index.ts",
-            "line": 31
+            "line": 32
           },
           "name": "readme",
           "type": {
@@ -3652,7 +3670,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/projects/jsii/jsii-project-options.ts",
-            "line": 1239
+            "line": 1244
           },
           "name": "codeOwners",
           "type": {
@@ -4275,6 +4293,24 @@
             "primitive": "string"
           }
         },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "true",
+            "stability": "stable",
+            "summary": "Scan the code with CodeQL on pull requests, pushes to the default branch and weekly."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/projects/jsii/jsii-project-options.ts",
+            "line": 1240
+          },
+          "name": "codeql",
+          "optional": true,
+          "type": {
+            "primitive": "boolean"
+          }
+        },
         {
           "abstract": true,
           "docs": {
@@ -9853,7 +9889,7 @@
         },
         "locationInModule": {
           "filename": "src/projects/python/index.ts",
-          "line": 32
+          "line": 33
         },
         "parameters": [
           {
@@ -9867,7 +9903,7 @@
       "kind": "class",
       "locationInModule": {
         "filename": "src/projects/python/index.ts",
-        "line": 28
+        "line": 29
       },
       "name": "PythonPackage",
       "properties": [
@@ -9878,7 +9914,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/projects/python/index.ts",
-            "line": 29
+            "line": 30
           },
           "name": "autoMerge",
           "optional": true,
@@ -9892,7 +9928,7 @@
           },
           "locationInModule": {
             "filename": "src/projects/python/index.ts",
-            "line": 30
+            "line": 31
           },
           "name": "readme",
           "type": {
@@ -9960,7 +9996,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/projects/python/python-package-options.ts",
-            "line": 386
+            "line": 391
           },
           "name": "codeOwners",
           "type": {
@@ -10126,6 +10162,24 @@
             "primitive": "boolean"
           }
         },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "true",
+            "stability": "stable",
+            "summary": "Scan the code with CodeQL on pull requests, pushes to the default branch and weekly."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/projects/python/python-package-options.ts",
+            "line": 387
+          },
+          "name": "codeql",
+          "optional": true,
+          "type": {
+            "primitive": "boolean"
+          }
+        },
         {
           "abstract": true,
           "docs": {
@@ -10702,7 +10756,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/projects/python/python-package-options.ts",
-            "line": 391
+            "line": 396
           },
           "name": "pullRequestTemplate",
           "optional": true,
@@ -10720,7 +10774,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/projects/python/python-package-options.ts",
-            "line": 396
+            "line": 401
           },
           "name": "pullRequestTemplateContents",
           "optional": true,
@@ -11285,6 +11339,6 @@
       "symbolId": "src/components/readme/elements/section:Section"
     }
   },
-  "version": "3.1.0",
-  "fingerprint": "QRAZPdWOgra6RAjf+WrBBiHieOC0QZ/06OMOjPkDBtw="
+  "version": "3.2.0",
+  "fingerprint": "SqSTEbuSGXMK69aCHL2ZKsfp/IqCWwE3Sv+ocdd9j74="
 }

package/API.md

@@ -5684,6 +5684,7 @@ const cdkTypeScriptAppOptions: CdkTypeScriptAppOptions = { ... }
 | <code><a href="#projen-modules.CdkTypeScriptAppOptions.property.codeArtifactOptions">codeArtifactOptions</a></code> | <code>projen.javascript.CodeArtifactOptions</code> | Options for npm packages using AWS CodeArtifact. |
 | <code><a href="#projen-modules.CdkTypeScriptAppOptions.property.codeCov">codeCov</a></code> | <code>boolean</code> | Define a GitHub workflow step for sending code coverage metrics to https://codecov.io/. Uses codecov/codecov-action. By default, OIDC auth is used. Alternatively a token can be provided via `codeCovTokenSecret`. |
 | <code><a href="#projen-modules.CdkTypeScriptAppOptions.property.codeCovTokenSecret">codeCovTokenSecret</a></code> | <code>string</code> | Define the secret name for a specified https://codecov.io/ token. |
+| <code><a href="#projen-modules.CdkTypeScriptAppOptions.property.codeql">codeql</a></code> | <code>boolean</code> | Scan the code with CodeQL on pull requests, pushes to the default branch and weekly. |
 | <code><a href="#projen-modules.CdkTypeScriptAppOptions.property.commitGenerated">commitGenerated</a></code> | <code>boolean</code> | Whether to commit the managed files by default. |
 | <code><a href="#projen-modules.CdkTypeScriptAppOptions.property.config">config</a></code> | <code>{[ key: string ]: any}</code> | Configuration values available to package scripts at runtime. |
 | <code><a href="#projen-modules.CdkTypeScriptAppOptions.property.constructsVersion">constructsVersion</a></code> | <code>string</code> | Minimum version of the `constructs` library to depend on. |
@@ -6406,6 +6407,19 @@ Define the secret name for a specified https://codecov.io/ token.
 
 ---
 
+##### `codeql`<sup>Optional</sup> <a name="codeql" id="projen-modules.CdkTypeScriptAppOptions.property.codeql"></a>
+
+```typescript
+public readonly codeql: boolean;
+```
+
+- *Type:* boolean
+- *Default:* true
+
+Scan the code with CodeQL on pull requests, pushes to the default branch and weekly.
+
+---
+
 ##### `commitGenerated`<sup>Optional</sup> <a name="commitGenerated" id="projen-modules.CdkTypeScriptAppOptions.property.commitGenerated"></a>
 
 ```typescript
@@ -8396,6 +8410,7 @@ const jsiiProjectOptions: JsiiProjectOptions = { ... }
 | <code><a href="#projen-modules.JsiiProjectOptions.property.codeArtifactOptions">codeArtifactOptions</a></code> | <code>projen.javascript.CodeArtifactOptions</code> | Options for npm packages using AWS CodeArtifact. |
 | <code><a href="#projen-modules.JsiiProjectOptions.property.codeCov">codeCov</a></code> | <code>boolean</code> | Define a GitHub workflow step for sending code coverage metrics to https://codecov.io/. Uses codecov/codecov-action. By default, OIDC auth is used. Alternatively a token can be provided via `codeCovTokenSecret`. |
 | <code><a href="#projen-modules.JsiiProjectOptions.property.codeCovTokenSecret">codeCovTokenSecret</a></code> | <code>string</code> | Define the secret name for a specified https://codecov.io/ token. |
+| <code><a href="#projen-modules.JsiiProjectOptions.property.codeql">codeql</a></code> | <code>boolean</code> | Scan the code with CodeQL on pull requests, pushes to the default branch and weekly. |
 | <code><a href="#projen-modules.JsiiProjectOptions.property.commitGenerated">commitGenerated</a></code> | <code>boolean</code> | Whether to commit the managed files by default. |
 | <code><a href="#projen-modules.JsiiProjectOptions.property.compat">compat</a></code> | <code>boolean</code> | Automatically run API compatibility test against the latest version published to npm after compilation. |
 | <code><a href="#projen-modules.JsiiProjectOptions.property.compatIgnore">compatIgnore</a></code> | <code>string</code> | Name of the ignore file for API compatibility tests. |
@@ -9051,6 +9066,19 @@ Define the secret name for a specified https://codecov.io/ token.
 
 ---
 
+##### `codeql`<sup>Optional</sup> <a name="codeql" id="projen-modules.JsiiProjectOptions.property.codeql"></a>
+
+```typescript
+public readonly codeql: boolean;
+```
+
+- *Type:* boolean
+- *Default:* true
+
+Scan the code with CodeQL on pull requests, pushes to the default branch and weekly.
+
+---
+
 ##### `commitGenerated`<sup>Optional</sup> <a name="commitGenerated" id="projen-modules.JsiiProjectOptions.property.commitGenerated"></a>
 
 ```typescript
@@ -13439,6 +13467,7 @@ const pythonPackageOptions: PythonPackageOptions = { ... }
 | <code><a href="#projen-modules.PythonPackageOptions.property.autoMergeOptions">autoMergeOptions</a></code> | <code>projen.github.AutoMergeOptions</code> | Configure options for automatic merging on GitHub. |
 | <code><a href="#projen-modules.PythonPackageOptions.property.classifiers">classifiers</a></code> | <code>string[]</code> | A list of PyPI trove classifiers that describe the project. |
 | <code><a href="#projen-modules.PythonPackageOptions.property.clobber">clobber</a></code> | <code>boolean</code> | Add a `clobber` task which resets the repo to origin. |
+| <code><a href="#projen-modules.PythonPackageOptions.property.codeql">codeql</a></code> | <code>boolean</code> | Scan the code with CodeQL on pull requests, pushes to the default branch and weekly. |
 | <code><a href="#projen-modules.PythonPackageOptions.property.commitGenerated">commitGenerated</a></code> | <code>boolean</code> | Whether to commit the managed files by default. |
 | <code><a href="#projen-modules.PythonPackageOptions.property.deps">deps</a></code> | <code>string[]</code> | List of runtime dependencies for this project. Dependencies use the format: `<module>@<semver>`. |
 | <code><a href="#projen-modules.PythonPackageOptions.property.description">description</a></code> | <code>string</code> | A short description of the package. |
@@ -13640,6 +13669,19 @@ Add a `clobber` task which resets the repo to origin.
 
 ---
 
+##### `codeql`<sup>Optional</sup> <a name="codeql" id="projen-modules.PythonPackageOptions.property.codeql"></a>
+
+```typescript
+public readonly codeql: boolean;
+```
+
+- *Type:* boolean
+- *Default:* true
+
+Scan the code with CodeQL on pull requests, pushes to the default branch and weekly.
+
+---
+
 ##### `commitGenerated`<sup>Optional</sup> <a name="commitGenerated" id="projen-modules.PythonPackageOptions.property.commitGenerated"></a>
 
 ```typescript

package/README.md

@@ -43,6 +43,10 @@ In **Settings → General → Pull Requests**:
 * Untick **Allow auto-merge**, because GitHub's own auto-merge merges outside the queue.
 * Tick **Automatically delete head branches**.
 
+### Code scanning
+
+CodeQL runs from `.github/workflows/codeql.yml`, which is managed by projen. In **Settings → Advanced Security**, leave CodeQL **Default setup** off, because it cannot run alongside this workflow. Under **Protection rules**, keep the **Check run failure threshold** at **High or higher** for security alerts and **Errors** for other alerts, as this decides whether the `CodeQL` check fails. Private repositories also need GitHub Code Security enabled there for code scanning results to be uploaded.
+
 ### Branch ruleset
 
 In **Settings → Rules → Rulesets**, create a branch ruleset with enforcement **Active** that targets the default branch, and set:
@@ -51,6 +55,7 @@ In **Settings → Rules → Rulesets**, create a branch ruleset with enforcement
 * **Restrict deletions** and **Block force pushes**.
 * **Require a pull request before merging**, with 0 required approvals.
 * **Require status checks to pass**, listing the checks that `.mergify.yml` waits for: `build`, `package-js`, `package-python`. Leave **Require branches to be up to date before merging** unticked, as the queue already updates and retests each pull request.
+* **Require code scanning results**, with the tool **CodeQL**, security alerts set to **High or higher** and alerts set to **Errors**. Mergify is exempt from this rule, so `.mergify.yml` also waits for the `CodeQL` check instead.
 
 Do not enable GitHub's own **Require merge queue** rule, as it competes with Mergify.
 

package/lib/components/github/codeql.d.ts

@@ -0,0 +1,25 @@
+import { Component, github } from 'projen';
+export interface CodeQlOptions {
+    /**
+     * Branches whose pushes, and the pull requests targeting them, are scanned
+     *
+     * @default ['main']
+     */
+    readonly branches?: Array<string>;
+    /**
+     * CodeQL languages to analyse, all of which must not need a build
+     *
+     * @see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning#changing-the-languages-that-are-analyzed
+     */
+    readonly languages: Array<string>;
+}
+/**
+ * CodeQL code scanning, as a GitHub advanced setup workflow
+ */
+export declare class CodeQl extends Component {
+    /**
+     * Name of the check run that reports the code scanning results on pull requests
+     */
+    static readonly CHECK_NAME = "CodeQL";
+    constructor(gitHub: github.GitHub, options: CodeQlOptions);
+}

package/lib/components/github/codeql.js

@@ -0,0 +1,64 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CodeQl = void 0;
+const projen_1 = require("projen");
+const workflows_model_1 = require("projen/lib/github/workflows-model");
+/**
+ * CodeQL code scanning, as a GitHub advanced setup workflow
+ */
+class CodeQl extends projen_1.Component {
+    /**
+     * Name of the check run that reports the code scanning results on pull requests
+     */
+    static CHECK_NAME = 'CodeQL';
+    constructor(gitHub, options) {
+        super(gitHub.project);
+        const branches = options.branches ?? ['main'];
+        const workflow = gitHub.addWorkflow('codeql');
+        workflow.on({
+            push: { branches },
+            pullRequest: { branches },
+            schedule: [{ cron: '44 12 * * 1' }],
+        });
+        workflow.addJobs({
+            analyze: {
+                name: 'Analyze (${{ matrix.language }})',
+                runsOn: ['ubuntu-latest'],
+                permissions: {
+                    actions: workflows_model_1.JobPermission.READ,
+                    contents: workflows_model_1.JobPermission.READ,
+                    packages: workflows_model_1.JobPermission.READ,
+                    securityEvents: workflows_model_1.JobPermission.WRITE,
+                },
+                strategy: {
+                    failFast: false,
+                    matrix: {
+                        domain: {
+                            language: options.languages,
+                        },
+                    },
+                },
+                steps: [
+                    projen_1.github.WorkflowSteps.checkout(),
+                    {
+                        name: 'Initialize CodeQL',
+                        uses: 'github/codeql-action/init@v4',
+                        with: {
+                            'languages': '${{ matrix.language }}',
+                            'build-mode': 'none',
+                        },
+                    },
+                    {
+                        name: 'Perform CodeQL Analysis',
+                        uses: 'github/codeql-action/analyze@v4',
+                        with: {
+                            category: '/language:${{ matrix.language }}',
+                        },
+                    },
+                ],
+            },
+        });
+    }
+}
+exports.CodeQl = CodeQl;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY29kZXFsLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vc3JjL2NvbXBvbmVudHMvZ2l0aHViL2NvZGVxbC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7QUFBQSxtQ0FBMkM7QUFDM0MsdUVBQWtFO0FBaUJsRTs7R0FFRztBQUNILE1BQWEsTUFBTyxTQUFRLGtCQUFTO0lBQ25DOztPQUVHO0lBQ0gsTUFBTSxDQUFVLFVBQVUsR0FBRyxRQUFRLENBQUM7SUFFdEMsWUFBWSxNQUFxQixFQUFFLE9BQXNCO1FBQ3ZELEtBQUssQ0FBQyxNQUFNLENBQUMsT0FBTyxDQUFDLENBQUM7UUFFdEIsTUFBTSxRQUFRLEdBQUcsT0FBTyxDQUFDLFFBQVEsSUFBSSxDQUFDLE1BQU0sQ0FBQyxDQUFDO1FBQzlDLE1BQU0sUUFBUSxHQUFHLE1BQU0sQ0FBQyxXQUFXLENBQUMsUUFBUSxDQUFDLENBQUM7UUFDOUMsUUFBUSxDQUFDLEVBQUUsQ0FBQztZQUNWLElBQUksRUFBRSxFQUFFLFFBQVEsRUFBRTtZQUNsQixXQUFXLEVBQUUsRUFBRSxRQUFRLEVBQUU7WUFDekIsUUFBUSxFQUFFLENBQUMsRUFBRSxJQUFJLEVBQUUsYUFBYSxFQUFFLENBQUM7U0FDcEMsQ0FBQyxDQUFDO1FBQ0gsUUFBUSxDQUFDLE9BQU8sQ0FBQztZQUNmLE9BQU8sRUFBRTtnQkFDUCxJQUFJLEVBQUUsa0NBQWtDO2dCQUN4QyxNQUFNLEVBQUUsQ0FBQyxlQUFlLENBQUM7Z0JBQ3pCLFdBQVcsRUFBRTtvQkFDWCxPQUFPLEVBQUUsK0JBQWEsQ0FBQyxJQUFJO29CQUMzQixRQUFRLEVBQUUsK0JBQWEsQ0FBQyxJQUFJO29CQUM1QixRQUFRLEVBQUUsK0JBQWEsQ0FBQyxJQUFJO29CQUM1QixjQUFjLEVBQUUsK0JBQWEsQ0FBQyxLQUFLO2lCQUNwQztnQkFDRCxRQUFRLEVBQUU7b0JBQ1IsUUFBUSxFQUFFLEtBQUs7b0JBQ2YsTUFBTSxFQUFFO3dCQUNOLE1BQU0sRUFBRTs0QkFDTixRQUFRLEVBQUUsT0FBTyxDQUFDLFNBQVM7eUJBQzVCO3FCQUNGO2lCQUNGO2dCQUNELEtBQUssRUFBRTtvQkFDTCxlQUFNLENBQUMsYUFBYSxDQUFDLFFBQVEsRUFBRTtvQkFDL0I7d0JBQ0UsSUFBSSxFQUFFLG1CQUFtQjt3QkFDekIsSUFBSSxFQUFFLDhCQUE4Qjt3QkFDcEMsSUFBSSxFQUFFOzRCQUNKLFdBQVcsRUFBRSx3QkFBd0I7NEJBQ3JDLFlBQVksRUFBRSxNQUFNO3lCQUNyQjtxQkFDRjtvQkFDRDt3QkFDRSxJQUFJLEVBQUUseUJBQXlCO3dCQUMvQixJQUFJLEVBQUUsaUNBQWlDO3dCQUN2QyxJQUFJLEVBQUU7NEJBQ0osUUFBUSxFQUFFLGtDQUFrQzt5QkFDN0M7cUJBQ0Y7aUJBQ0Y7YUFDRjtTQUNGLENBQUMsQ0FBQztJQUNMLENBQUM7O0FBdERILHdCQXVEQyIsInNvdXJjZXNDb250ZW50IjpbImltcG9ydCB7IENvbXBvbmVudCwgZ2l0aHViIH0gZnJvbSAncHJvamVuJztcbmltcG9ydCB7IEpvYlBlcm1pc3Npb24gfSBmcm9tICdwcm9qZW4vbGliL2dpdGh1Yi93b3JrZmxvd3MtbW9kZWwnO1xuXG5leHBvcnQgaW50ZXJmYWNlIENvZGVRbE9wdGlvbnMge1xuICAvKipcbiAgICogQnJhbmNoZXMgd2hvc2UgcHVzaGVzLCBhbmQgdGhlIHB1bGwgcmVxdWVzdHMgdGFyZ2V0aW5nIHRoZW0sIGFyZSBzY2FubmVkXG4gICAqXG4gICAqIEBkZWZhdWx0IFsnbWFpbiddXG4gICAqL1xuICByZWFkb25seSBicmFuY2hlcz86IEFycmF5PHN0cmluZz47XG4gIC8qKlxuICAgKiBDb2RlUUwgbGFuZ3VhZ2VzIHRvIGFuYWx5c2UsIGFsbCBvZiB3aGljaCBtdXN0IG5vdCBuZWVkIGEgYnVpbGRcbiAgICpcbiAgICogQHNlZSBodHRwczovL2RvY3MuZ2l0aHViLmNvbS9lbi9jb2RlLXNlY3VyaXR5L2NvZGUtc2Nhbm5pbmcvY3JlYXRpbmctYW4tYWR2YW5jZWQtc2V0dXAtZm9yLWNvZGUtc2Nhbm5pbmcvY3VzdG9taXppbmcteW91ci1hZHZhbmNlZC1zZXR1cC1mb3ItY29kZS1zY2FubmluZyNjaGFuZ2luZy10aGUtbGFuZ3VhZ2VzLXRoYXQtYXJlLWFuYWx5emVkXG4gICAqL1xuICByZWFkb25seSBsYW5ndWFnZXM6IEFycmF5PHN0cmluZz47XG59XG5cbi8qKlxuICogQ29kZVFMIGNvZGUgc2Nhbm5pbmcsIGFzIGEgR2l0SHViIGFkdmFuY2VkIHNldHVwIHdvcmtmbG93XG4gKi9cbmV4cG9ydCBjbGFzcyBDb2RlUWwgZXh0ZW5kcyBDb21wb25lbnQge1xuICAvKipcbiAgICogTmFtZSBvZiB0aGUgY2hlY2sgcnVuIHRoYXQgcmVwb3J0cyB0aGUgY29kZSBzY2FubmluZyByZXN1bHRzIG9uIHB1bGwgcmVxdWVzdHNcbiAgICovXG4gIHN0YXRpYyByZWFkb25seSBDSEVDS19OQU1FID0gJ0NvZGVRTCc7XG5cbiAgY29uc3RydWN0b3IoZ2l0SHViOiBnaXRodWIuR2l0SHViLCBvcHRpb25zOiBDb2RlUWxPcHRpb25zKSB7XG4gICAgc3VwZXIoZ2l0SHViLnByb2plY3QpO1xuXG4gICAgY29uc3QgYnJhbmNoZXMgPSBvcHRpb25zLmJyYW5jaGVzID8/IFsnbWFpbiddO1xuICAgIGNvbnN0IHdvcmtmbG93ID0gZ2l0SHViLmFkZFdvcmtmbG93KCdjb2RlcWwnKTtcbiAgICB3b3JrZmxvdy5vbih7XG4gICAgICBwdXNoOiB7IGJyYW5jaGVzIH0sXG4gICAgICBwdWxsUmVxdWVzdDogeyBicmFuY2hlcyB9LFxuICAgICAgc2NoZWR1bGU6IFt7IGNyb246ICc0NCAxMiAqICogMScgfV0sXG4gICAgfSk7XG4gICAgd29ya2Zsb3cuYWRkSm9icyh7XG4gICAgICBhbmFseXplOiB7XG4gICAgICAgIG5hbWU6ICdBbmFseXplICgke3sgbWF0cml4Lmxhbmd1YWdlIH19KScsXG4gICAgICAgIHJ1bnNPbjogWyd1YnVudHUtbGF0ZXN0J10sXG4gICAgICAgIHBlcm1pc3Npb25zOiB7XG4gICAgICAgICAgYWN0aW9uczogSm9iUGVybWlzc2lvbi5SRUFELFxuICAgICAgICAgIGNvbnRlbnRzOiBKb2JQZXJtaXNzaW9uLlJFQUQsXG4gICAgICAgICAgcGFja2FnZXM6IEpvYlBlcm1pc3Npb24uUkVBRCxcbiAgICAgICAgICBzZWN1cml0eUV2ZW50czogSm9iUGVybWlzc2lvbi5XUklURSxcbiAgICAgICAgfSxcbiAgICAgICAgc3RyYXRlZ3k6IHtcbiAgICAgICAgICBmYWlsRmFzdDogZmFsc2UsXG4gICAgICAgICAgbWF0cml4OiB7XG4gICAgICAgICAgICBkb21haW46IHtcbiAgICAgICAgICAgICAgbGFuZ3VhZ2U6IG9wdGlvbnMubGFuZ3VhZ2VzLFxuICAgICAgICAgICAgfSxcbiAgICAgICAgICB9LFxuICAgICAgICB9LFxuICAgICAgICBzdGVwczogW1xuICAgICAgICAgIGdpdGh1Yi5Xb3JrZmxvd1N0ZXBzLmNoZWNrb3V0KCksXG4gICAgICAgICAge1xuICAgICAgICAgICAgbmFtZTogJ0luaXRpYWxpemUgQ29kZVFMJyxcbiAgICAgICAgICAgIHVzZXM6ICdnaXRodWIvY29kZXFsLWFjdGlvbi9pbml0QHY0JyxcbiAgICAgICAgICAgIHdpdGg6IHtcbiAgICAgICAgICAgICAgJ2xhbmd1YWdlcyc6ICcke3sgbWF0cml4Lmxhbmd1YWdlIH19JyxcbiAgICAgICAgICAgICAgJ2J1aWxkLW1vZGUnOiAnbm9uZScsXG4gICAgICAgICAgICB9LFxuICAgICAgICAgIH0sXG4gICAgICAgICAge1xuICAgICAgICAgICAgbmFtZTogJ1BlcmZvcm0gQ29kZVFMIEFuYWx5c2lzJyxcbiAgICAgICAgICAgIHVzZXM6ICdnaXRodWIvY29kZXFsLWFjdGlvbi9hbmFseXplQHY0JyxcbiAgICAgICAgICAgIHdpdGg6IHtcbiAgICAgICAgICAgICAgY2F0ZWdvcnk6ICcvbGFuZ3VhZ2U6JHt7IG1hdHJpeC5sYW5ndWFnZSB9fScsXG4gICAgICAgICAgICB9LFxuICAgICAgICAgIH0sXG4gICAgICAgIF0sXG4gICAgICB9LFxuICAgIH0pO1xuICB9XG59XG4iXX0=

package/lib/components/github/mergify.js

@@ -1,7 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.configureMergify = configureMergify;
-function githubConfigurationSection(requiredChecks, approvedReviews) {
+const codeql_1 = require("./codeql");
+function githubConfigurationSection(requiredChecks, approvedReviews, codeScanning) {
     const statusChecks = requiredChecks.length
         ? 'the checks that `.mergify.yml` waits for: `' +
             requiredChecks.join('`, `') +
@@ -16,6 +17,17 @@ function githubConfigurationSection(requiredChecks, approvedReviews) {
 
 A repository with a single maintainer, who cannot approve their own pull requests, should set \`autoMergeOptions: { approvedReviews: 0 }\` in \`.projenrc.ts\` and set the ruleset's required approvals to 0. Pull requests are then merged as soon as their checks pass.`
         : '';
+    const codeScanningSettings = codeScanning
+        ? `
+
+### Code scanning
+
+CodeQL runs from \`.github/workflows/codeql.yml\`, which is managed by projen. In **Settings → Advanced Security**, leave CodeQL **Default setup** off, because it cannot run alongside this workflow. Under **Protection rules**, keep the **Check run failure threshold** at **High or higher** for security alerts and **Errors** for other alerts, as this decides whether the \`${codeql_1.CodeQl.CHECK_NAME}\` check fails. Private repositories also need GitHub Code Security enabled there for code scanning results to be uploaded.`
+        : '';
+    const codeScanningRule = codeScanning
+        ? `
+* **Require code scanning results**, with the tool **CodeQL**, security alerts set to **High or higher** and alerts set to **Errors**. Mergify is exempt from this rule, so \`.mergify.yml\` also waits for the \`${codeql_1.CodeQl.CHECK_NAME}\` check instead.`
+        : '';
     return `All pull requests are merged by the [Mergify](https://mergify.com) merge queue, configured in \`.mergify.yml\`. ${queued}, Mergify queues it, brings it up to date with the default branch, waits for the checks again and squash merges it. Draft pull requests and those labelled \`do-not-merge\` are not merged.
 
 The repository must be configured as below so that nothing can be merged without going through the queue.
@@ -29,7 +41,7 @@ Install the [Mergify GitHub App](https://github.com/apps/mergify) and give it ac
 In **Settings → General → Pull Requests**:
 * Allow squash merging only (untick merge commits and rebase merging), matching the queue's merge method.
 * Untick **Allow auto-merge**, because GitHub's own auto-merge merges outside the queue.
-* Tick **Automatically delete head branches**.
+* Tick **Automatically delete head branches**.${codeScanningSettings}
 
 ### Branch ruleset
 
@@ -38,7 +50,7 @@ In **Settings → Rules → Rulesets**, create a branch ruleset with enforcement
 * **Restrict updates**: only bypass actors can update the branch, so pull requests cannot be merged from the GitHub UI or CLI and commits cannot be pushed directly.
 * **Restrict deletions** and **Block force pushes**.
 * **Require a pull request before merging**, with ${approvals}.
-* **Require status checks to pass**, listing ${statusChecks}. Leave **Require branches to be up to date before merging** unticked, as the queue already updates and retests each pull request.
+* **Require status checks to pass**, listing ${statusChecks}. Leave **Require branches to be up to date before merging** unticked, as the queue already updates and retests each pull request.${codeScanningRule}
 
 Do not enable GitHub's own **Require merge queue** rule, as it competes with Mergify.
 
@@ -51,6 +63,11 @@ function configureMergify(project, options = {}) {
     }
     const buildJobIds = project.buildWorkflow?.buildJobIds ?? [];
     project.autoMerge?.addConditions('-draft');
+    // Mergify is exempt from the ruleset's code scanning rule, so the queue enforces it instead
+    const codeScanning = project.components.some((c) => c instanceof codeql_1.CodeQl);
+    if (codeScanning) {
+        project.autoMerge?.addConditions(`status-success=${codeql_1.CodeQl.CHECK_NAME}`);
+    }
     mergify.addRule({
         name: 'Automatic approval for projen upgrade pull requests',
         conditions: [
@@ -74,6 +91,6 @@ function configureMergify(project, options = {}) {
         },
     });
     project.tryFindObjectFile('.mergify.yml')?.addOverride('merge_protections_settings.reporting_method', options.reportingMethod ?? 'deployments');
-    project.readme?.addSection('GitHub Configuration', githubConfigurationSection(buildJobIds, options.approvedReviews ?? 1));
+    project.readme?.addSection('GitHub Configuration', githubConfigurationSection(buildJobIds, options.approvedReviews ?? 1, codeScanning));
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibWVyZ2lmeS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uL3NyYy9jb21wb25lbnRzL2dpdGh1Yi9tZXJnaWZ5LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7O0FBOEVBLDRDQThDQztBQTdGRCxTQUFTLDBCQUEwQixDQUNqQyxjQUE2QixFQUM3QixlQUF1QjtJQUV2QixNQUFNLFlBQVksR0FBRyxjQUFjLENBQUMsTUFBTTtRQUN4QyxDQUFDLENBQUMsNkNBQTZDO1lBQzdDLGNBQWMsQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDO1lBQzNCLEdBQUc7UUFDTCxDQUFDLENBQUMsd0dBQXdHLENBQUM7SUFDN0csTUFBTSxTQUFTLEdBQUcsZUFBZSxLQUFLLENBQUMsQ0FBQyxDQUFDLENBQUMscUJBQXFCLENBQUMsQ0FBQyxDQUFDLEdBQUcsZUFBZSxxQkFBcUIsQ0FBQztJQUMxRyxNQUFNLE1BQU0sR0FBRyxlQUFlO1FBQzVCLENBQUMsQ0FBQyxxREFBcUQ7UUFDdkQsQ0FBQyxDQUFDLG9DQUFvQyxDQUFDO0lBQ3pDLE1BQU0sY0FBYyxHQUFHLGVBQWU7UUFDcEMsQ0FBQyxDQUFDOzswUUFFb1E7UUFDdFEsQ0FBQyxDQUFDLEVBQUUsQ0FBQztJQUNQLE9BQU8sbUhBQW1ILE1BQU07Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7OztvREFxQjlFLFNBQVM7K0NBQ2QsWUFBWTs7Ozt3SUFJNkUsY0FBYyxFQUFFLENBQUM7QUFDekosQ0FBQztBQUVELFNBQWdCLGdCQUFnQixDQUM5QixPQUF1QixFQUN2QixVQUEwQixFQUFFO0lBRTVCLE1BQU0sT0FBTyxHQUFHLE9BQU8sQ0FBQyxNQUFNLEVBQUUsT0FBTyxDQUFDO0lBQ3hDLElBQUksQ0FBQyxPQUFPLEVBQUUsQ0FBQztRQUNiLE9BQU87SUFDVCxDQUFDO0lBRUQsTUFBTSxXQUFXLEdBQUcsT0FBTyxDQUFDLGFBQWEsRUFBRSxXQUFXLElBQUksRUFBRSxDQUFDO0lBRTdELE9BQU8sQ0FBQyxTQUFTLEVBQUUsYUFBYSxDQUFDLFFBQVEsQ0FBQyxDQUFDO0lBRTNDLE9BQU8sQ0FBQyxPQUFPLENBQUM7UUFDZCxJQUFJLEVBQUUscURBQXFEO1FBQzNELFVBQVUsRUFBRTtZQUNWLFVBQVUsT0FBTyxDQUFDLGFBQWEsSUFBSSxtQkFBbUIsRUFBRTtZQUN4RCxHQUFHLFdBQVcsQ0FBQyxHQUFHLENBQUMsQ0FBQyxFQUFFLEVBQUUsRUFBRSxDQUFDLGtCQUFrQixFQUFFLEVBQUUsQ0FBQztTQUNuRDtRQUNELE9BQU8sRUFBRTtZQUNQLE1BQU0sRUFBRTtnQkFDTixJQUFJLEVBQUUsU0FBUztnQkFDZixPQUFPLEVBQUUsd0NBQXdDO2FBQ2xEO1NBQ0Y7S0FDRixDQUFDLENBQUM7SUFFSCxPQUFPLENBQUMsT0FBTyxDQUFDO1FBQ2QsSUFBSSxFQUFFLDRCQUE0QjtRQUNsQyxVQUFVLEVBQUUsQ0FBQyxvQkFBb0IsQ0FBQztRQUNsQyxPQUFPLEVBQUU7WUFDUCxNQUFNLEVBQUU7Z0JBQ04sU0FBUyxFQUFFLE9BQU8sQ0FBQyxXQUFXLElBQUksQ0FBQyxjQUFjLENBQUM7YUFDbkQ7U0FDRjtLQUNGLENBQUMsQ0FBQztJQUVILE9BQU8sQ0FBQyxpQkFBaUIsQ0FBQyxjQUFjLENBQUMsRUFBRSxXQUFXLENBQ3BELDZDQUE2QyxFQUM3QyxPQUFPLENBQUMsZUFBZSxJQUFJLGFBQWEsQ0FDekMsQ0FBQztJQUVGLE9BQU8sQ0FBQyxNQUFNLEVBQUUsVUFBVSxDQUN4QixzQkFBc0IsRUFDdEIsMEJBQTBCLENBQUMsV0FBVyxFQUFFLE9BQU8sQ0FBQyxlQUFlLElBQUksQ0FBQyxDQUFDLENBQ3RFLENBQUM7QUFDSixDQUFDIiwic291cmNlc0NvbnRlbnQiOlsiaW1wb3J0IHsgZ2l0aHViLCBQcm9qZWN0IH0gZnJvbSAncHJvamVuJztcbmltcG9ydCB7IFJlYWRtZSB9IGZyb20gJy4uL3JlYWRtZSc7XG5cbmV4cG9ydCBpbnRlcmZhY2UgTWVyZ2lmeU9wdGlvbnMge1xuICAvKipcbiAgICogTnVtYmVyIG9mIGFwcHJvdmluZyByZXZpZXdzIHRoZSBtZXJnZSBxdWV1ZSB3YWl0cyBmb3IsIHdoaWNoIHNob3VsZCBtYXRjaFxuICAgKiBgYXV0b01lcmdlT3B0aW9ucy5hcHByb3ZlZFJldmlld3NgLiBVc2UgMCBmb3IgYSByZXBvc2l0b3J5IHdpdGggYSBzaW5nbGVcbiAgICogbWFpbnRhaW5lciwgd2hvIGNhbm5vdCBhcHByb3ZlIHRoZWlyIG93biBwdWxsIHJlcXVlc3RzLlxuICAgKlxuICAgKiBAZGVmYXVsdCAxXG4gICAqL1xuICByZWFkb25seSBhcHByb3ZlZFJldmlld3M/OiBudW1iZXI7XG4gIHJlYWRvbmx5IGFzc2lnblVzZXJzPzogQXJyYXk8c3RyaW5nPjtcbiAgcmVhZG9ubHkgcmVwb3J0aW5nTWV0aG9kPzogc3RyaW5nO1xuICAvKipcbiAgICogQXV0aG9yIG9mIHRoZSBwcm9qZW4gdXBncmFkZSBwdWxsIHJlcXVlc3RzIHRoYXQgYXJlIGF1dG9tYXRpY2FsbHkgYXBwcm92ZWRcbiAgICpcbiAgICogQGRlZmF1bHQgJ2VuZG9yLXByb2plbltib3RdJ1xuICAgKi9cbiAgcmVhZG9ubHkgdXBncmFkZUF1dGhvcj86IHN0cmluZztcbn1cblxudHlwZSBNZXJnaWZ5UHJvamVjdCA9IFByb2plY3QgJiB7XG4gIHJlYWRvbmx5IGF1dG9NZXJnZT86IGdpdGh1Yi5BdXRvTWVyZ2U7XG4gIHJlYWRvbmx5IGdpdGh1Yj86IGdpdGh1Yi5HaXRIdWI7XG4gIHJlYWRvbmx5IGJ1aWxkV29ya2Zsb3c/OiB7XG4gICAgcmVhZG9ubHkgYnVpbGRKb2JJZHM/OiBBcnJheTxzdHJpbmc+O1xuICB9O1xuICByZWFkb25seSByZWFkbWU/OiBSZWFkbWU7XG59O1xuXG5mdW5jdGlvbiBnaXRodWJDb25maWd1cmF0aW9uU2VjdGlvbihcbiAgcmVxdWlyZWRDaGVja3M6IEFycmF5PHN0cmluZz4sXG4gIGFwcHJvdmVkUmV2aWV3czogbnVtYmVyLFxuKTogc3RyaW5nIHtcbiAgY29uc3Qgc3RhdHVzQ2hlY2tzID0gcmVxdWlyZWRDaGVja3MubGVuZ3RoXG4gICAgPyAndGhlIGNoZWNrcyB0aGF0IGAubWVyZ2lmeS55bWxgIHdhaXRzIGZvcjogYCcgK1xuICAgICAgcmVxdWlyZWRDaGVja3Muam9pbignYCwgYCcpICtcbiAgICAgICdgJ1xuICAgIDogJ2FueSBDSSBjaGVja3MgYWRkZWQgdG8gdGhlIHByb2plY3QgKG5vbmUgYXJlIGNvbmZpZ3VyZWQgeWV0KSwga2VlcGluZyB0aGVtIGluIHN5bmMgd2l0aCBgLm1lcmdpZnkueW1sYCc7XG4gIGNvbnN0IGFwcHJvdmFscyA9IGFwcHJvdmVkUmV2aWV3cyA9PT0gMSA/ICcxIHJlcXVpcmVkIGFwcHJvdmFsJyA6IGAke2FwcHJvdmVkUmV2aWV3c30gcmVxdWlyZWQgYXBwcm92YWxzYDtcbiAgY29uc3QgcXVldWVkID0gYXBwcm92ZWRSZXZpZXdzXG4gICAgPyAnT25jZSBhIHB1bGwgcmVxdWVzdCBpcyBhcHByb3ZlZCBhbmQgaXRzIGNoZWNrcyBwYXNzJ1xuICAgIDogJ09uY2UgYSBwdWxsIHJlcXVlc3RcXCdzIGNoZWNrcyBwYXNzJztcbiAgY29uc3Qgc29sZU1haW50YWluZXIgPSBhcHByb3ZlZFJldmlld3NcbiAgICA/IGBcblxuQSByZXBvc2l0b3J5IHdpdGggYSBzaW5nbGUgbWFpbnRhaW5lciwgd2hvIGNhbm5vdCBhcHByb3ZlIHRoZWlyIG93biBwdWxsIHJlcXVlc3RzLCBzaG91bGQgc2V0IFxcYGF1dG9NZXJnZU9wdGlvbnM6IHsgYXBwcm92ZWRSZXZpZXdzOiAwIH1cXGAgaW4gXFxgLnByb2plbnJjLnRzXFxgIGFuZCBzZXQgdGhlIHJ1bGVzZXQncyByZXF1aXJlZCBhcHByb3ZhbHMgdG8gMC4gUHVsbCByZXF1ZXN0cyBhcmUgdGhlbiBtZXJnZWQgYXMgc29vbiBhcyB0aGVpciBjaGVja3MgcGFzcy5gXG4gICAgOiAnJztcbiAgcmV0dXJuIGBBbGwgcHVsbCByZXF1ZXN0cyBhcmUgbWVyZ2VkIGJ5IHRoZSBbTWVyZ2lmeV0oaHR0cHM6Ly9tZXJnaWZ5LmNvbSkgbWVyZ2UgcXVldWUsIGNvbmZpZ3VyZWQgaW4gXFxgLm1lcmdpZnkueW1sXFxgLiAke3F1ZXVlZH0sIE1lcmdpZnkgcXVldWVzIGl0LCBicmluZ3MgaXQgdXAgdG8gZGF0ZSB3aXRoIHRoZSBkZWZhdWx0IGJyYW5jaCwgd2FpdHMgZm9yIHRoZSBjaGVja3MgYWdhaW4gYW5kIHNxdWFzaCBtZXJnZXMgaXQuIERyYWZ0IHB1bGwgcmVxdWVzdHMgYW5kIHRob3NlIGxhYmVsbGVkIFxcYGRvLW5vdC1tZXJnZVxcYCBhcmUgbm90IG1lcmdlZC5cblxuVGhlIHJlcG9zaXRvcnkgbXVzdCBiZSBjb25maWd1cmVkIGFzIGJlbG93IHNvIHRoYXQgbm90aGluZyBjYW4gYmUgbWVyZ2VkIHdpdGhvdXQgZ29pbmcgdGhyb3VnaCB0aGUgcXVldWUuXG5cbiMjIyBNZXJnaWZ5XG5cbkluc3RhbGwgdGhlIFtNZXJnaWZ5IEdpdEh1YiBBcHBdKGh0dHBzOi8vZ2l0aHViLmNvbS9hcHBzL21lcmdpZnkpIGFuZCBnaXZlIGl0IGFjY2VzcyB0byB0aGlzIHJlcG9zaXRvcnkuXG5cbiMjIyBQdWxsIHJlcXVlc3Qgc2V0dGluZ3NcblxuSW4gKipTZXR0aW5ncyDihpIgR2VuZXJhbCDihpIgUHVsbCBSZXF1ZXN0cyoqOlxuKiBBbGxvdyBzcXVhc2ggbWVyZ2luZyBvbmx5ICh1bnRpY2sgbWVyZ2UgY29tbWl0cyBhbmQgcmViYXNlIG1lcmdpbmcpLCBtYXRjaGluZyB0aGUgcXVldWUncyBtZXJnZSBtZXRob2QuXG4qIFVudGljayAqKkFsbG93IGF1dG8tbWVyZ2UqKiwgYmVjYXVzZSBHaXRIdWIncyBvd24gYXV0by1tZXJnZSBtZXJnZXMgb3V0c2lkZSB0aGUgcXVldWUuXG4qIFRpY2sgKipBdXRvbWF0aWNhbGx5IGRlbGV0ZSBoZWFkIGJyYW5jaGVzKiouXG5cbiMjIyBCcmFuY2ggcnVsZXNldFxuXG5JbiAqKlNldHRpbmdzIOKGkiBSdWxlcyDihpIgUnVsZXNldHMqKiwgY3JlYXRlIGEgYnJhbmNoIHJ1bGVzZXQgd2l0aCBlbmZvcmNlbWVudCAqKkFjdGl2ZSoqIHRoYXQgdGFyZ2V0cyB0aGUgZGVmYXVsdCBicmFuY2gsIGFuZCBzZXQ6XG4qICoqQnlwYXNzIGxpc3QqKjogdGhlICoqTWVyZ2lmeSoqIGFwcCBvbmx5LCBpbiAqKkV4ZW1wdCoqIG1vZGUuIERvIG5vdCBhZGQgYWRtaW5zIG9yIG90aGVyIHJvbGVzLCBhcyBhbnlvbmUgb24gdGhpcyBsaXN0IGNhbiBtZXJnZSB3aXRob3V0IHRoZSBxdWV1ZS5cbiogKipSZXN0cmljdCB1cGRhdGVzKio6IG9ubHkgYnlwYXNzIGFjdG9ycyBjYW4gdXBkYXRlIHRoZSBicmFuY2gsIHNvIHB1bGwgcmVxdWVzdHMgY2Fubm90IGJlIG1lcmdlZCBmcm9tIHRoZSBHaXRIdWIgVUkgb3IgQ0xJIGFuZCBjb21taXRzIGNhbm5vdCBiZSBwdXNoZWQgZGlyZWN0bHkuXG4qICoqUmVzdHJpY3QgZGVsZXRpb25zKiogYW5kICoqQmxvY2sgZm9yY2UgcHVzaGVzKiouXG4qICoqUmVxdWlyZSBhIHB1bGwgcmVxdWVzdCBiZWZvcmUgbWVyZ2luZyoqLCB3aXRoICR7YXBwcm92YWxzfS5cbiogKipSZXF1aXJlIHN0YXR1cyBjaGVja3MgdG8gcGFzcyoqLCBsaXN0aW5nICR7c3RhdHVzQ2hlY2tzfS4gTGVhdmUgKipSZXF1aXJlIGJyYW5jaGVzIHRvIGJlIHVwIHRvIGRhdGUgYmVmb3JlIG1lcmdpbmcqKiB1bnRpY2tlZCwgYXMgdGhlIHF1ZXVlIGFscmVhZHkgdXBkYXRlcyBhbmQgcmV0ZXN0cyBlYWNoIHB1bGwgcmVxdWVzdC5cblxuRG8gbm90IGVuYWJsZSBHaXRIdWIncyBvd24gKipSZXF1aXJlIG1lcmdlIHF1ZXVlKiogcnVsZSwgYXMgaXQgY29tcGV0ZXMgd2l0aCBNZXJnaWZ5LlxuXG5JZiB0aGUgcXVldWUgaXMgdW5hdmFpbGFibGUgYW5kIGEgY2hhbmdlIGhhcyB0byBiZSBtZXJnZWQsIGFkZCB5b3Vyc2VsZiB0byB0aGUgYnlwYXNzIGxpc3QgdGVtcG9yYXJpbHkgYW5kIHJlbW92ZSB5b3Vyc2VsZiBhZnRlcndhcmRzLiR7c29sZU1haW50YWluZXJ9YDtcbn1cblxuZXhwb3J0IGZ1bmN0aW9uIGNvbmZpZ3VyZU1lcmdpZnkoXG4gIHByb2plY3Q6IE1lcmdpZnlQcm9qZWN0LFxuICBvcHRpb25zOiBNZXJnaWZ5T3B0aW9ucyA9IHt9LFxuKSB7XG4gIGNvbnN0IG1lcmdpZnkgPSBwcm9qZWN0LmdpdGh1Yj8ubWVyZ2lmeTtcbiAgaWYgKCFtZXJnaWZ5KSB7XG4gICAgcmV0dXJuO1xuICB9XG5cbiAgY29uc3QgYnVpbGRKb2JJZHMgPSBwcm9qZWN0LmJ1aWxkV29ya2Zsb3c/LmJ1aWxkSm9iSWRzID8/IFtdO1xuXG4gIHByb2plY3QuYXV0b01lcmdlPy5hZGRDb25kaXRpb25zKCctZHJhZnQnKTtcblxuICBtZXJnaWZ5LmFkZFJ1bGUoe1xuICAgIG5hbWU6ICdBdXRvbWF0aWMgYXBwcm92YWwgZm9yIHByb2plbiB1cGdyYWRlIHB1bGwgcmVxdWVzdHMnLFxuICAgIGNvbmRpdGlvbnM6IFtcbiAgICAgIGBhdXRob3I9JHtvcHRpb25zLnVwZ3JhZGVBdXRob3IgPz8gJ2VuZG9yLXByb2plbltib3RdJ31gLFxuICAgICAgLi4uYnVpbGRKb2JJZHMubWFwKChpZCkgPT4gYHN0YXR1cy1zdWNjZXNzPSR7aWR9YCksXG4gICAgXSxcbiAgICBhY3Rpb25zOiB7XG4gICAgICByZXZpZXc6IHtcbiAgICAgICAgdHlwZTogJ0FQUFJPVkUnLFxuICAgICAgICBtZXNzYWdlOiAnQXV0b21hdGljYWxseSBhcHByb3ZpbmcgcHJvamVuIHVwZ3JhZGUnLFxuICAgICAgfSxcbiAgICB9LFxuICB9KTtcblxuICBtZXJnaWZ5LmFkZFJ1bGUoe1xuICAgIG5hbWU6ICdBc3NpZ24gUFIgd2hlbiBjaGVjayBmYWlscycsXG4gICAgY29uZGl0aW9uczogWycjY2hlY2stZmFpbHVyZSA+IDAnXSxcbiAgICBhY3Rpb25zOiB7XG4gICAgICBhc3NpZ246IHtcbiAgICAgICAgYWRkX3VzZXJzOiBvcHRpb25zLmFzc2lnblVzZXJzID8/IFsnZGF2ZXNoZXBoZXJkJ10sXG4gICAgICB9LFxuICAgIH0sXG4gIH0pO1xuXG4gIHByb2plY3QudHJ5RmluZE9iamVjdEZpbGUoJy5tZXJnaWZ5LnltbCcpPy5hZGRPdmVycmlkZShcbiAgICAnbWVyZ2VfcHJvdGVjdGlvbnNfc2V0dGluZ3MucmVwb3J0aW5nX21ldGhvZCcsXG4gICAgb3B0aW9ucy5yZXBvcnRpbmdNZXRob2QgPz8gJ2RlcGxveW1lbnRzJyxcbiAgKTtcblxuICBwcm9qZWN0LnJlYWRtZT8uYWRkU2VjdGlvbihcbiAgICAnR2l0SHViIENvbmZpZ3VyYXRpb24nLFxuICAgIGdpdGh1YkNvbmZpZ3VyYXRpb25TZWN0aW9uKGJ1aWxkSm9iSWRzLCBvcHRpb25zLmFwcHJvdmVkUmV2aWV3cyA/PyAxKSxcbiAgKTtcbn1cbiJdfQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibWVyZ2lmeS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uL3NyYy9jb21wb25lbnRzL2dpdGh1Yi9tZXJnaWZ5LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7O0FBMkZBLDRDQXdEQztBQWxKRCxxQ0FBa0M7QUErQmxDLFNBQVMsMEJBQTBCLENBQ2pDLGNBQTZCLEVBQzdCLGVBQXVCLEVBQ3ZCLFlBQXFCO0lBRXJCLE1BQU0sWUFBWSxHQUFHLGNBQWMsQ0FBQyxNQUFNO1FBQ3hDLENBQUMsQ0FBQyw2Q0FBNkM7WUFDN0MsY0FBYyxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUM7WUFDM0IsR0FBRztRQUNMLENBQUMsQ0FBQyx3R0FBd0csQ0FBQztJQUM3RyxNQUFNLFNBQVMsR0FBRyxlQUFlLEtBQUssQ0FBQyxDQUFDLENBQUMsQ0FBQyxxQkFBcUIsQ0FBQyxDQUFDLENBQUMsR0FBRyxlQUFlLHFCQUFxQixDQUFDO0lBQzFHLE1BQU0sTUFBTSxHQUFHLGVBQWU7UUFDNUIsQ0FBQyxDQUFDLHFEQUFxRDtRQUN2RCxDQUFDLENBQUMsb0NBQW9DLENBQUM7SUFDekMsTUFBTSxjQUFjLEdBQUcsZUFBZTtRQUNwQyxDQUFDLENBQUM7OzBRQUVvUTtRQUN0USxDQUFDLENBQUMsRUFBRSxDQUFDO0lBQ1AsTUFBTSxvQkFBb0IsR0FBRyxZQUFZO1FBQ3ZDLENBQUMsQ0FBQzs7Ozt1WEFJaVgsZUFBTSxDQUFDLFVBQVUsNkhBQTZIO1FBQ2pnQixDQUFDLENBQUMsRUFBRSxDQUFDO0lBQ1AsTUFBTSxnQkFBZ0IsR0FBRyxZQUFZO1FBQ25DLENBQUMsQ0FBQztvTkFDOE0sZUFBTSxDQUFDLFVBQVUsbUJBQW1CO1FBQ3BQLENBQUMsQ0FBQyxFQUFFLENBQUM7SUFDUCxPQUFPLG1IQUFtSCxNQUFNOzs7Ozs7Ozs7Ozs7O2dEQWFsRixvQkFBb0I7Ozs7Ozs7O29EQVFoQixTQUFTOytDQUNkLFlBQVkscUlBQXFJLGdCQUFnQjs7Ozt3SUFJeEUsY0FBYyxFQUFFLENBQUM7QUFDekosQ0FBQztBQUVELFNBQWdCLGdCQUFnQixDQUM5QixPQUF1QixFQUN2QixVQUEwQixFQUFFO0lBRTVCLE1BQU0sT0FBTyxHQUFHLE9BQU8sQ0FBQyxNQUFNLEVBQUUsT0FBTyxDQUFDO0lBQ3hDLElBQUksQ0FBQyxPQUFPLEVBQUUsQ0FBQztRQUNiLE9BQU87SUFDVCxDQUFDO0lBRUQsTUFBTSxXQUFXLEdBQUcsT0FBTyxDQUFDLGFBQWEsRUFBRSxXQUFXLElBQUksRUFBRSxDQUFDO0lBRTdELE9BQU8sQ0FBQyxTQUFTLEVBQUUsYUFBYSxDQUFDLFFBQVEsQ0FBQyxDQUFDO0lBRTNDLDRGQUE0RjtJQUM1RixNQUFNLFlBQVksR0FBRyxPQUFPLENBQUMsVUFBVSxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUMsRUFBRSxFQUFFLENBQUMsQ0FBQyxZQUFZLGVBQU0sQ0FBQyxDQUFDO0lBQ3pFLElBQUksWUFBWSxFQUFFLENBQUM7UUFDakIsT0FBTyxDQUFDLFNBQVMsRUFBRSxhQUFhLENBQUMsa0JBQWtCLGVBQU0sQ0FBQyxVQUFVLEVBQUUsQ0FBQyxDQUFDO0lBQzFFLENBQUM7SUFFRCxPQUFPLENBQUMsT0FBTyxDQUFDO1FBQ2QsSUFBSSxFQUFFLHFEQUFxRDtRQUMzRCxVQUFVLEVBQUU7WUFDVixVQUFVLE9BQU8sQ0FBQyxhQUFhLElBQUksbUJBQW1CLEVBQUU7WUFDeEQsR0FBRyxXQUFXLENBQUMsR0FBRyxDQUFDLENBQUMsRUFBRSxFQUFFLEVBQUUsQ0FBQyxrQkFBa0IsRUFBRSxFQUFFLENBQUM7U0FDbkQ7UUFDRCxPQUFPLEVBQUU7WUFDUCxNQUFNLEVBQUU7Z0JBQ04sSUFBSSxFQUFFLFNBQVM7Z0JBQ2YsT0FBTyxFQUFFLHdDQUF3QzthQUNsRDtTQUNGO0tBQ0YsQ0FBQyxDQUFDO0lBRUgsT0FBTyxDQUFDLE9BQU8sQ0FBQztRQUNkLElBQUksRUFBRSw0QkFBNEI7UUFDbEMsVUFBVSxFQUFFLENBQUMsb0JBQW9CLENBQUM7UUFDbEMsT0FBTyxFQUFFO1lBQ1AsTUFBTSxFQUFFO2dCQUNOLFNBQVMsRUFBRSxPQUFPLENBQUMsV0FBVyxJQUFJLENBQUMsY0FBYyxDQUFDO2FBQ25EO1NBQ0Y7S0FDRixDQUFDLENBQUM7SUFFSCxPQUFPLENBQUMsaUJBQWlCLENBQUMsY0FBYyxDQUFDLEVBQUUsV0FBVyxDQUNwRCw2Q0FBNkMsRUFDN0MsT0FBTyxDQUFDLGVBQWUsSUFBSSxhQUFhLENBQ3pDLENBQUM7SUFFRixPQUFPLENBQUMsTUFBTSxFQUFFLFVBQVUsQ0FDeEIsc0JBQXNCLEVBQ3RCLDBCQUEwQixDQUN4QixXQUFXLEVBQ1gsT0FBTyxDQUFDLGVBQWUsSUFBSSxDQUFDLEVBQzVCLFlBQVksQ0FDYixDQUNGLENBQUM7QUFDSixDQUFDIiwic291cmNlc0NvbnRlbnQiOlsiaW1wb3J0IHsgZ2l0aHViLCBQcm9qZWN0IH0gZnJvbSAncHJvamVuJztcbmltcG9ydCB7IENvZGVRbCB9IGZyb20gJy4vY29kZXFsJztcbmltcG9ydCB7IFJlYWRtZSB9IGZyb20gJy4uL3JlYWRtZSc7XG5cbmV4cG9ydCBpbnRlcmZhY2UgTWVyZ2lmeU9wdGlvbnMge1xuICAvKipcbiAgICogTnVtYmVyIG9mIGFwcHJvdmluZyByZXZpZXdzIHRoZSBtZXJnZSBxdWV1ZSB3YWl0cyBmb3IsIHdoaWNoIHNob3VsZCBtYXRjaFxuICAgKiBgYXV0b01lcmdlT3B0aW9ucy5hcHByb3ZlZFJldmlld3NgLiBVc2UgMCBmb3IgYSByZXBvc2l0b3J5IHdpdGggYSBzaW5nbGVcbiAgICogbWFpbnRhaW5lciwgd2hvIGNhbm5vdCBhcHByb3ZlIHRoZWlyIG93biBwdWxsIHJlcXVlc3RzLlxuICAgKlxuICAgKiBAZGVmYXVsdCAxXG4gICAqL1xuICByZWFkb25seSBhcHByb3ZlZFJldmlld3M/OiBudW1iZXI7XG4gIHJlYWRvbmx5IGFzc2lnblVzZXJzPzogQXJyYXk8c3RyaW5nPjtcbiAgcmVhZG9ubHkgcmVwb3J0aW5nTWV0aG9kPzogc3RyaW5nO1xuICAvKipcbiAgICogQXV0aG9yIG9mIHRoZSBwcm9qZW4gdXBncmFkZSBwdWxsIHJlcXVlc3RzIHRoYXQgYXJlIGF1dG9tYXRpY2FsbHkgYXBwcm92ZWRcbiAgICpcbiAgICogQGRlZmF1bHQgJ2VuZG9yLXByb2plbltib3RdJ1xuICAgKi9cbiAgcmVhZG9ubHkgdXBncmFkZUF1dGhvcj86IHN0cmluZztcbn1cblxudHlwZSBNZXJnaWZ5UHJvamVjdCA9IFByb2plY3QgJiB7XG4gIHJlYWRvbmx5IGF1dG9NZXJnZT86IGdpdGh1Yi5BdXRvTWVyZ2U7XG4gIHJlYWRvbmx5IGdpdGh1Yj86IGdpdGh1Yi5HaXRIdWI7XG4gIHJlYWRvbmx5IGJ1aWxkV29ya2Zsb3c/OiB7XG4gICAgcmVhZG9ubHkgYnVpbGRKb2JJZHM/OiBBcnJheTxzdHJpbmc+O1xuICB9O1xuICByZWFkb25seSByZWFkbWU/OiBSZWFkbWU7XG59O1xuXG5mdW5jdGlvbiBnaXRodWJDb25maWd1cmF0aW9uU2VjdGlvbihcbiAgcmVxdWlyZWRDaGVja3M6IEFycmF5PHN0cmluZz4sXG4gIGFwcHJvdmVkUmV2aWV3czogbnVtYmVyLFxuICBjb2RlU2Nhbm5pbmc6IGJvb2xlYW4sXG4pOiBzdHJpbmcge1xuICBjb25zdCBzdGF0dXNDaGVja3MgPSByZXF1aXJlZENoZWNrcy5sZW5ndGhcbiAgICA/ICd0aGUgY2hlY2tzIHRoYXQgYC5tZXJnaWZ5LnltbGAgd2FpdHMgZm9yOiBgJyArXG4gICAgICByZXF1aXJlZENoZWNrcy5qb2luKCdgLCBgJykgK1xuICAgICAgJ2AnXG4gICAgOiAnYW55IENJIGNoZWNrcyBhZGRlZCB0byB0aGUgcHJvamVjdCAobm9uZSBhcmUgY29uZmlndXJlZCB5ZXQpLCBrZWVwaW5nIHRoZW0gaW4gc3luYyB3aXRoIGAubWVyZ2lmeS55bWxgJztcbiAgY29uc3QgYXBwcm92YWxzID0gYXBwcm92ZWRSZXZpZXdzID09PSAxID8gJzEgcmVxdWlyZWQgYXBwcm92YWwnIDogYCR7YXBwcm92ZWRSZXZpZXdzfSByZXF1aXJlZCBhcHByb3ZhbHNgO1xuICBjb25zdCBxdWV1ZWQgPSBhcHByb3ZlZFJldmlld3NcbiAgICA/ICdPbmNlIGEgcHVsbCByZXF1ZXN0IGlzIGFwcHJvdmVkIGFuZCBpdHMgY2hlY2tzIHBhc3MnXG4gICAgOiAnT25jZSBhIHB1bGwgcmVxdWVzdFxcJ3MgY2hlY2tzIHBhc3MnO1xuICBjb25zdCBzb2xlTWFpbnRhaW5lciA9IGFwcHJvdmVkUmV2aWV3c1xuICAgID8gYFxuXG5BIHJlcG9zaXRvcnkgd2l0aCBhIHNpbmdsZSBtYWludGFpbmVyLCB3aG8gY2Fubm90IGFwcHJvdmUgdGhlaXIgb3duIHB1bGwgcmVxdWVzdHMsIHNob3VsZCBzZXQgXFxgYXV0b01lcmdlT3B0aW9uczogeyBhcHByb3ZlZFJldmlld3M6IDAgfVxcYCBpbiBcXGAucHJvamVucmMudHNcXGAgYW5kIHNldCB0aGUgcnVsZXNldCdzIHJlcXVpcmVkIGFwcHJvdmFscyB0byAwLiBQdWxsIHJlcXVlc3RzIGFyZSB0aGVuIG1lcmdlZCBhcyBzb29uIGFzIHRoZWlyIGNoZWNrcyBwYXNzLmBcbiAgICA6ICcnO1xuICBjb25zdCBjb2RlU2Nhbm5pbmdTZXR0aW5ncyA9IGNvZGVTY2FubmluZ1xuICAgID8gYFxuXG4jIyMgQ29kZSBzY2FubmluZ1xuXG5Db2RlUUwgcnVucyBmcm9tIFxcYC5naXRodWIvd29ya2Zsb3dzL2NvZGVxbC55bWxcXGAsIHdoaWNoIGlzIG1hbmFnZWQgYnkgcHJvamVuLiBJbiAqKlNldHRpbmdzIOKGkiBBZHZhbmNlZCBTZWN1cml0eSoqLCBsZWF2ZSBDb2RlUUwgKipEZWZhdWx0IHNldHVwKiogb2ZmLCBiZWNhdXNlIGl0IGNhbm5vdCBydW4gYWxvbmdzaWRlIHRoaXMgd29ya2Zsb3cuIFVuZGVyICoqUHJvdGVjdGlvbiBydWxlcyoqLCBrZWVwIHRoZSAqKkNoZWNrIHJ1biBmYWlsdXJlIHRocmVzaG9sZCoqIGF0ICoqSGlnaCBvciBoaWdoZXIqKiBmb3Igc2VjdXJpdHkgYWxlcnRzIGFuZCAqKkVycm9ycyoqIGZvciBvdGhlciBhbGVydHMsIGFzIHRoaXMgZGVjaWRlcyB3aGV0aGVyIHRoZSBcXGAke0NvZGVRbC5DSEVDS19OQU1FfVxcYCBjaGVjayBmYWlscy4gUHJpdmF0ZSByZXBvc2l0b3JpZXMgYWxzbyBuZWVkIEdpdEh1YiBDb2RlIFNlY3VyaXR5IGVuYWJsZWQgdGhlcmUgZm9yIGNvZGUgc2Nhbm5pbmcgcmVzdWx0cyB0byBiZSB1cGxvYWRlZC5gXG4gICAgOiAnJztcbiAgY29uc3QgY29kZVNjYW5uaW5nUnVsZSA9IGNvZGVTY2FubmluZ1xuICAgID8gYFxuKiAqKlJlcXVpcmUgY29kZSBzY2FubmluZyByZXN1bHRzKiosIHdpdGggdGhlIHRvb2wgKipDb2RlUUwqKiwgc2VjdXJpdHkgYWxlcnRzIHNldCB0byAqKkhpZ2ggb3IgaGlnaGVyKiogYW5kIGFsZXJ0cyBzZXQgdG8gKipFcnJvcnMqKi4gTWVyZ2lmeSBpcyBleGVtcHQgZnJvbSB0aGlzIHJ1bGUsIHNvIFxcYC5tZXJnaWZ5LnltbFxcYCBhbHNvIHdhaXRzIGZvciB0aGUgXFxgJHtDb2RlUWwuQ0hFQ0tfTkFNRX1cXGAgY2hlY2sgaW5zdGVhZC5gXG4gICAgOiAnJztcbiAgcmV0dXJuIGBBbGwgcHVsbCByZXF1ZXN0cyBhcmUgbWVyZ2VkIGJ5IHRoZSBbTWVyZ2lmeV0oaHR0cHM6Ly9tZXJnaWZ5LmNvbSkgbWVyZ2UgcXVldWUsIGNvbmZpZ3VyZWQgaW4gXFxgLm1lcmdpZnkueW1sXFxgLiAke3F1ZXVlZH0sIE1lcmdpZnkgcXVldWVzIGl0LCBicmluZ3MgaXQgdXAgdG8gZGF0ZSB3aXRoIHRoZSBkZWZhdWx0IGJyYW5jaCwgd2FpdHMgZm9yIHRoZSBjaGVja3MgYWdhaW4gYW5kIHNxdWFzaCBtZXJnZXMgaXQuIERyYWZ0IHB1bGwgcmVxdWVzdHMgYW5kIHRob3NlIGxhYmVsbGVkIFxcYGRvLW5vdC1tZXJnZVxcYCBhcmUgbm90IG1lcmdlZC5cblxuVGhlIHJlcG9zaXRvcnkgbXVzdCBiZSBjb25maWd1cmVkIGFzIGJlbG93IHNvIHRoYXQgbm90aGluZyBjYW4gYmUgbWVyZ2VkIHdpdGhvdXQgZ29pbmcgdGhyb3VnaCB0aGUgcXVldWUuXG5cbiMjIyBNZXJnaWZ5XG5cbkluc3RhbGwgdGhlIFtNZXJnaWZ5IEdpdEh1YiBBcHBdKGh0dHBzOi8vZ2l0aHViLmNvbS9hcHBzL21lcmdpZnkpIGFuZCBnaXZlIGl0IGFjY2VzcyB0byB0aGlzIHJlcG9zaXRvcnkuXG5cbiMjIyBQdWxsIHJlcXVlc3Qgc2V0dGluZ3NcblxuSW4gKipTZXR0aW5ncyDihpIgR2VuZXJhbCDihpIgUHVsbCBSZXF1ZXN0cyoqOlxuKiBBbGxvdyBzcXVhc2ggbWVyZ2luZyBvbmx5ICh1bnRpY2sgbWVyZ2UgY29tbWl0cyBhbmQgcmViYXNlIG1lcmdpbmcpLCBtYXRjaGluZyB0aGUgcXVldWUncyBtZXJnZSBtZXRob2QuXG4qIFVudGljayAqKkFsbG93IGF1dG8tbWVyZ2UqKiwgYmVjYXVzZSBHaXRIdWIncyBvd24gYXV0by1tZXJnZSBtZXJnZXMgb3V0c2lkZSB0aGUgcXVldWUuXG4qIFRpY2sgKipBdXRvbWF0aWNhbGx5IGRlbGV0ZSBoZWFkIGJyYW5jaGVzKiouJHtjb2RlU2Nhbm5pbmdTZXR0aW5nc31cblxuIyMjIEJyYW5jaCBydWxlc2V0XG5cbkluICoqU2V0dGluZ3Mg4oaSIFJ1bGVzIOKGkiBSdWxlc2V0cyoqLCBjcmVhdGUgYSBicmFuY2ggcnVsZXNldCB3aXRoIGVuZm9yY2VtZW50ICoqQWN0aXZlKiogdGhhdCB0YXJnZXRzIHRoZSBkZWZhdWx0IGJyYW5jaCwgYW5kIHNldDpcbiogKipCeXBhc3MgbGlzdCoqOiB0aGUgKipNZXJnaWZ5KiogYXBwIG9ubHksIGluICoqRXhlbXB0KiogbW9kZS4gRG8gbm90IGFkZCBhZG1pbnMgb3Igb3RoZXIgcm9sZXMsIGFzIGFueW9uZSBvbiB0aGlzIGxpc3QgY2FuIG1lcmdlIHdpdGhvdXQgdGhlIHF1ZXVlLlxuKiAqKlJlc3RyaWN0IHVwZGF0ZXMqKjogb25seSBieXBhc3MgYWN0b3JzIGNhbiB1cGRhdGUgdGhlIGJyYW5jaCwgc28gcHVsbCByZXF1ZXN0cyBjYW5ub3QgYmUgbWVyZ2VkIGZyb20gdGhlIEdpdEh1YiBVSSBvciBDTEkgYW5kIGNvbW1pdHMgY2Fubm90IGJlIHB1c2hlZCBkaXJlY3RseS5cbiogKipSZXN0cmljdCBkZWxldGlvbnMqKiBhbmQgKipCbG9jayBmb3JjZSBwdXNoZXMqKi5cbiogKipSZXF1aXJlIGEgcHVsbCByZXF1ZXN0IGJlZm9yZSBtZXJnaW5nKiosIHdpdGggJHthcHByb3ZhbHN9LlxuKiAqKlJlcXVpcmUgc3RhdHVzIGNoZWNrcyB0byBwYXNzKiosIGxpc3RpbmcgJHtzdGF0dXNDaGVja3N9LiBMZWF2ZSAqKlJlcXVpcmUgYnJhbmNoZXMgdG8gYmUgdXAgdG8gZGF0ZSBiZWZvcmUgbWVyZ2luZyoqIHVudGlja2VkLCBhcyB0aGUgcXVldWUgYWxyZWFkeSB1cGRhdGVzIGFuZCByZXRlc3RzIGVhY2ggcHVsbCByZXF1ZXN0LiR7Y29kZVNjYW5uaW5nUnVsZX1cblxuRG8gbm90IGVuYWJsZSBHaXRIdWIncyBvd24gKipSZXF1aXJlIG1lcmdlIHF1ZXVlKiogcnVsZSwgYXMgaXQgY29tcGV0ZXMgd2l0aCBNZXJnaWZ5LlxuXG5JZiB0aGUgcXVldWUgaXMgdW5hdmFpbGFibGUgYW5kIGEgY2hhbmdlIGhhcyB0byBiZSBtZXJnZWQsIGFkZCB5b3Vyc2VsZiB0byB0aGUgYnlwYXNzIGxpc3QgdGVtcG9yYXJpbHkgYW5kIHJlbW92ZSB5b3Vyc2VsZiBhZnRlcndhcmRzLiR7c29sZU1haW50YWluZXJ9YDtcbn1cblxuZXhwb3J0IGZ1bmN0aW9uIGNvbmZpZ3VyZU1lcmdpZnkoXG4gIHByb2plY3Q6IE1lcmdpZnlQcm9qZWN0LFxuICBvcHRpb25zOiBNZXJnaWZ5T3B0aW9ucyA9IHt9LFxuKSB7XG4gIGNvbnN0IG1lcmdpZnkgPSBwcm9qZWN0LmdpdGh1Yj8ubWVyZ2lmeTtcbiAgaWYgKCFtZXJnaWZ5KSB7XG4gICAgcmV0dXJuO1xuICB9XG5cbiAgY29uc3QgYnVpbGRKb2JJZHMgPSBwcm9qZWN0LmJ1aWxkV29ya2Zsb3c/LmJ1aWxkSm9iSWRzID8/IFtdO1xuXG4gIHByb2plY3QuYXV0b01lcmdlPy5hZGRDb25kaXRpb25zKCctZHJhZnQnKTtcblxuICAvLyBNZXJnaWZ5IGlzIGV4ZW1wdCBmcm9tIHRoZSBydWxlc2V0J3MgY29kZSBzY2FubmluZyBydWxlLCBzbyB0aGUgcXVldWUgZW5mb3JjZXMgaXQgaW5zdGVhZFxuICBjb25zdCBjb2RlU2Nhbm5pbmcgPSBwcm9qZWN0LmNvbXBvbmVudHMuc29tZSgoYykgPT4gYyBpbnN0YW5jZW9mIENvZGVRbCk7XG4gIGlmIChjb2RlU2Nhbm5pbmcpIHtcbiAgICBwcm9qZWN0LmF1dG9NZXJnZT8uYWRkQ29uZGl0aW9ucyhgc3RhdHVzLXN1Y2Nlc3M9JHtDb2RlUWwuQ0hFQ0tfTkFNRX1gKTtcbiAgfVxuXG4gIG1lcmdpZnkuYWRkUnVsZSh7XG4gICAgbmFtZTogJ0F1dG9tYXRpYyBhcHByb3ZhbCBmb3IgcHJvamVuIHVwZ3JhZGUgcHVsbCByZXF1ZXN0cycsXG4gICAgY29uZGl0aW9uczogW1xuICAgICAgYGF1dGhvcj0ke29wdGlvbnMudXBncmFkZUF1dGhvciA/PyAnZW5kb3ItcHJvamVuW2JvdF0nfWAsXG4gICAgICAuLi5idWlsZEpvYklkcy5tYXAoKGlkKSA9PiBgc3RhdHVzLXN1Y2Nlc3M9JHtpZH1gKSxcbiAgICBdLFxuICAgIGFjdGlvbnM6IHtcbiAgICAgIHJldmlldzoge1xuICAgICAgICB0eXBlOiAnQVBQUk9WRScsXG4gICAgICAgIG1lc3NhZ2U6ICdBdXRvbWF0aWNhbGx5IGFwcHJvdmluZyBwcm9qZW4gdXBncmFkZScsXG4gICAgICB9LFxuICAgIH0sXG4gIH0pO1xuXG4gIG1lcmdpZnkuYWRkUnVsZSh7XG4gICAgbmFtZTogJ0Fzc2lnbiBQUiB3aGVuIGNoZWNrIGZhaWxzJyxcbiAgICBjb25kaXRpb25zOiBbJyNjaGVjay1mYWlsdXJlID4gMCddLFxuICAgIGFjdGlvbnM6IHtcbiAgICAgIGFzc2lnbjoge1xuICAgICAgICBhZGRfdXNlcnM6IG9wdGlvbnMuYXNzaWduVXNlcnMgPz8gWydkYXZlc2hlcGhlcmQnXSxcbiAgICAgIH0sXG4gICAgfSxcbiAgfSk7XG5cbiAgcHJvamVjdC50cnlGaW5kT2JqZWN0RmlsZSgnLm1lcmdpZnkueW1sJyk/LmFkZE92ZXJyaWRlKFxuICAgICdtZXJnZV9wcm90ZWN0aW9uc19zZXR0aW5ncy5yZXBvcnRpbmdfbWV0aG9kJyxcbiAgICBvcHRpb25zLnJlcG9ydGluZ01ldGhvZCA/PyAnZGVwbG95bWVudHMnLFxuICApO1xuXG4gIHByb2plY3QucmVhZG1lPy5hZGRTZWN0aW9uKFxuICAgICdHaXRIdWIgQ29uZmlndXJhdGlvbicsXG4gICAgZ2l0aHViQ29uZmlndXJhdGlvblNlY3Rpb24oXG4gICAgICBidWlsZEpvYklkcyxcbiAgICAgIG9wdGlvbnMuYXBwcm92ZWRSZXZpZXdzID8/IDEsXG4gICAgICBjb2RlU2Nhbm5pbmcsXG4gICAgKSxcbiAgKTtcbn1cbiJdfQ==

package/lib/components/readme/elements/section.js

@@ -3,7 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.Section = void 0;
 const JSII_RTTI_SYMBOL_1 = Symbol.for("jsii.rtti");
 class Section {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "projen-modules.Section", version: "3.1.0" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "projen-modules.Section", version: "3.2.0" };
     options;
     constructor(options) {
         this.options = options;

package/lib/components/readme/index.js

@@ -5,7 +5,7 @@ const JSII_RTTI_SYMBOL_1 = Symbol.for("jsii.rtti");
 const projen_1 = require("projen");
 const section_1 = require("./elements/section");
 class Readme extends projen_1.FileBase {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "projen-modules.Readme", version: "3.1.0" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "projen-modules.Readme", version: "3.2.0" };
     description;
     sections = [];
     constructor(project, options = {}) {

package/lib/projects/cdk-ts/cdk-typescript-app-options.d.ts

@@ -1262,6 +1262,11 @@ export interface CdkTypeScriptAppOptions {
      * @featured true
      */
     readonly name: string;
+    /**
+     * Scan the code with CodeQL on pull requests, pushes to the default branch and weekly.
+     * @default true
+     */
+    readonly codeql?: boolean;
     /**
      * List of teams used to generate the CODEOWNERS file
      */