projen-modules 3.2.1 → 3.2.3

package/.jsii

@@ -99,7 +99,7 @@
   },
   "name": "projen-modules",
   "readme": {
-    "markdown": "# projen-modules\n\nA collection of custom projen modules, that can be used to bootstrap and maintain consistent project configuration, tooling, dependencies, and builds.\n\n## Getting Started\n\n```sh\nyarn install\nnpx projen build\n```\n\nThis will:\n* Install the dependencies\n* Apply any projen changes\n* Run tests\n* Package project locally\n\nAny files changed by projen should be committed to git.\n\nRunning the tests like this will update any snapshot files, this should be reviewed and committed to git.\n\n## Testing\n\nTypes of testing:\n* Snapshot - projen project outputs are stored as a snapshot in the corresponding `__snapshots__` directory. When the project changes then it is expected that these snapshots change too and should be reviewed committed alongside the project.\n* Unit tests - these assert on specific functionality of the project and should be written for any new functionality added.\n\n\n## GitHub Configuration\n\nAll pull requests are merged by the [Mergify](https://mergify.com) merge queue, configured in `.mergify.yml`. Once a pull request's checks pass, Mergify queues it, brings it up to date with the default branch, waits for the checks again and squash merges it. Draft pull requests and those labelled `do-not-merge` are not merged.\n\nThe repository must be configured as below so that nothing can be merged without going through the queue.\n\n### Mergify\n\nInstall the [Mergify GitHub App](https://github.com/apps/mergify) and give it access to this repository.\n\n### Pull request settings\n\nIn **Settings → General → Pull Requests**:\n* Allow squash merging only (untick merge commits and rebase merging), matching the queue's merge method.\n* Untick **Allow auto-merge**, because GitHub's own auto-merge merges outside the queue.\n* Tick **Automatically delete head branches**.\n\n### Code scanning\n\nCodeQL runs from `.github/workflows/codeql.yml`, which is managed by projen. In **Settings → Advanced Security**, leave CodeQL **Default setup** off, because it cannot run alongside this workflow. Under **Protection rules**, keep the **Check run failure threshold** at **High or higher** for security alerts and **Errors** for other alerts, as this decides whether the `CodeQL` check fails. Private repositories also need GitHub Code Security enabled there for code scanning results to be uploaded.\n\n### Branch ruleset\n\nIn **Settings → Rules → Rulesets**, create a branch ruleset with enforcement **Active** that targets the default branch, and set:\n* **Bypass list**: the **Mergify** app only, in **Exempt** mode. Do not add admins or other roles, as anyone on this list can merge without the queue.\n* **Restrict updates**: only bypass actors can update the branch, so pull requests cannot be merged from the GitHub UI or CLI and commits cannot be pushed directly.\n* **Restrict deletions** and **Block force pushes**.\n* **Require a pull request before merging**, with 0 required approvals.\n* **Require status checks to pass**, listing the checks that `.mergify.yml` waits for: `build`, `package-js`, `package-python`. Leave **Require branches to be up to date before merging** unticked, as the queue already updates and retests each pull request.\n* **Require code scanning results**, with the tool **CodeQL**, security alerts set to **High or higher** and alerts set to **Errors**. Mergify is exempt from this rule, so `.mergify.yml` also waits for the `CodeQL` check instead.\n\nDo not enable GitHub's own **Require merge queue** rule, as it competes with Mergify.\n\nIf the queue is unavailable and a change has to be merged, add yourself to the bypass list temporarily and remove yourself afterwards.\n\n## Creating a New Project\n\n\n```\nnpx projen new {project} --from projen-modules\n```\n\nSome projects may have required fields that need to be specified as part of this command, review any errors for details what needs to be specified.\n\n### Project Types\n\n| Project type                                   | Description                |\n| ---------------------------------------------- | -------------------------- |\n| [cdk-typescript-app](API.md#cdktypescriptapp-) | A typescript CDK app |\n| [npm-package](API.md#npmpackage-)              | A typescript npm package   |\n| [python-package](API.md#pythonpackage-)        | A python package           |\n| [jsii-package](API.md#jsiiproject-)            | A typescript JSII package  |\n\n## Project Structure\n\nAll source is located in `src` and is grouped by:\n* `components` - these are common building blocks that can be used by projects to implement specific project functionality.\n* `projects` - these are projects that can be built from this project (see #something)\n* `utils` - these are helper functions that are often reused\n\n`test` contains tests, and mirrors the `src` directory structure. Within here there are `__snapshots__` which contain snapshots of project tests (see #section)."
+    "markdown": "# projen-modules\n\nA collection of custom projen modules, that can be used to bootstrap and maintain consistent project configuration, tooling, dependencies, and builds.\n\n## Getting Started\n\n```sh\nyarn install\nnpx projen build\n```\n\nThis will:\n* Install the dependencies\n* Apply any projen changes\n* Run tests\n* Package project locally\n\nAny files changed by projen should be committed to git.\n\nRunning the tests like this will update any snapshot files, this should be reviewed and committed to git.\n\n## Testing\n\nTypes of testing:\n* Snapshot - projen project outputs are stored as a snapshot in the corresponding `__snapshots__` directory. When the project changes then it is expected that these snapshots change too and should be reviewed committed alongside the project.\n* Unit tests - these assert on specific functionality of the project and should be written for any new functionality added.\n\n\n## GitHub Configuration\n\nAll pull requests are merged by the [Mergify](https://mergify.com) merge queue, configured in `.mergify.yml`. Once a pull request is approved, or is opened by `daveshepherd`, and its checks pass, Mergify queues it, brings it up to date with the default branch, waits for the checks again and squash merges it. Draft pull requests and those labelled `do-not-merge` are not merged.\n\nThe repository must be configured as below so that nothing can be merged without going through the queue.\n\n### Mergify\n\nInstall the [Mergify GitHub App](https://github.com/apps/mergify) and give it access to this repository.\n\n### Pull request settings\n\nIn **Settings → General → Pull Requests**:\n* Allow squash merging only (untick merge commits and rebase merging), matching the queue's merge method.\n* Untick **Allow auto-merge**, because GitHub's own auto-merge merges outside the queue.\n* Tick **Automatically delete head branches**.\n\n### Actions settings\n\nIn **Settings → Actions → General**, set **Approval for running fork pull request workflows from contributors** to **Require approval for all external contributors**. A pull request from a fork runs its own copy of the workflows, so it can change how the required checks pass.\n\n### Code scanning\n\nCodeQL runs from `.github/workflows/codeql.yml`, which is managed by projen. In **Settings → Advanced Security**, leave CodeQL **Default setup** off, because it cannot run alongside this workflow. Under **Protection rules**, keep the **Check run failure threshold** at **High or higher** for security alerts and **Errors** for other alerts, as this decides whether the `CodeQL` check fails. Private repositories also need GitHub Code Security enabled there for code scanning results to be uploaded.\n\n### Branch ruleset\n\nIn **Settings → Rules → Rulesets**, create a branch ruleset with enforcement **Active** that targets the default branch, and set:\n* **Bypass list**: the **Mergify** app only, in **Exempt** mode. Do not add admins or other roles, as anyone on this list can merge without the queue.\n* **Restrict updates**: only bypass actors can update the branch, so pull requests cannot be merged from the GitHub UI or CLI and commits cannot be pushed directly.\n* **Restrict deletions** and **Block force pushes**.\n* **Require a pull request before merging**, with 0 required approvals, because Mergify requires approvals itself for authors other than `daveshepherd` and is exempt from this rule. Tick **Dismiss stale pull request approvals when new commits are pushed**, so that commits pushed after an approval need approving again before the queue merges them.\n* **Require status checks to pass**, listing the checks that `.mergify.yml` waits for: `build`, `package-js`, `package-python`. Leave **Require branches to be up to date before merging** unticked, as the queue already updates and retests each pull request.\n* **Require code scanning results**, with the tool **CodeQL**, security alerts set to **High or higher** and alerts set to **Errors**. Mergify is exempt from this rule, so `.mergify.yml` also waits for the `CodeQL` check instead.\n\nDo not enable GitHub's own **Require merge queue** rule, as it competes with Mergify.\n\nIf the queue is unavailable and a change has to be merged, add yourself to the bypass list temporarily and remove yourself afterwards.\n\n## Creating a New Project\n\n\n```\nnpx projen new {project} --from projen-modules\n```\n\nSome projects may have required fields that need to be specified as part of this command, review any errors for details what needs to be specified.\n\n### Project Types\n\n| Project type                                   | Description                |\n| ---------------------------------------------- | -------------------------- |\n| [cdk-typescript-app](API.md#cdktypescriptapp-) | A typescript CDK app |\n| [npm-package](API.md#npmpackage-)              | A typescript npm package   |\n| [python-package](API.md#pythonpackage-)        | A python package           |\n| [jsii-package](API.md#jsiiproject-)            | A typescript JSII package  |\n\n## Project Structure\n\nAll source is located in `src` and is grouped by:\n* `components` - these are common building blocks that can be used by projects to implement specific project functionality.\n* `projects` - these are projects that can be built from this project (see #something)\n* `utils` - these are helper functions that are often reused\n\n`test` contains tests, and mirrors the `src` directory structure. Within here there are `__snapshots__` which contain snapshots of project tests (see #section)."
   },
   "repository": {
     "type": "git",
@@ -133,7 +133,7 @@
         },
         "locationInModule": {
           "filename": "src/projects/cdk-ts/index.ts",
-          "line": 36
+          "line": 39
         },
         "parameters": [
           {
@@ -147,7 +147,7 @@
       "kind": "class",
       "locationInModule": {
         "filename": "src/projects/cdk-ts/index.ts",
-        "line": 33
+        "line": 36
       },
       "name": "CdkTypeScriptApp",
       "properties": [
@@ -157,7 +157,7 @@
           },
           "locationInModule": {
             "filename": "src/projects/cdk-ts/index.ts",
-            "line": 34
+            "line": 37
           },
           "name": "readme",
           "type": {
@@ -208,7 +208,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/projects/cdk-ts/cdk-typescript-app-options.ts",
-            "line": 1275
+            "line": 1280
           },
           "name": "codeOwners",
           "type": {
@@ -933,7 +933,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/projects/cdk-ts/cdk-typescript-app-options.ts",
-            "line": 1271
+            "line": 1276
           },
           "name": "codeql",
           "optional": true,
@@ -3151,6 +3151,29 @@
             "primitive": "string"
           }
         },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "[]",
+            "stability": "stable",
+            "summary": "Authors whose pull requests the merge queue merges without an approval, such as the single maintainer of a repository, who cannot approve their own pull requests."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/projects/cdk-ts/cdk-typescript-app-options.ts",
+            "line": 1271
+          },
+          "name": "trustedAuthors",
+          "optional": true,
+          "type": {
+            "collection": {
+              "elementtype": {
+                "primitive": "string"
+              },
+              "kind": "array"
+            }
+          }
+        },
         {
           "abstract": true,
           "docs": {
@@ -3578,7 +3601,7 @@
         },
         "locationInModule": {
           "filename": "src/projects/jsii/index.ts",
-          "line": 34
+          "line": 37
         },
         "parameters": [
           {
@@ -3592,7 +3615,7 @@
       "kind": "class",
       "locationInModule": {
         "filename": "src/projects/jsii/index.ts",
-        "line": 31
+        "line": 34
       },
       "name": "JsiiProject",
       "properties": [
@@ -3602,7 +3625,7 @@
           },
           "locationInModule": {
             "filename": "src/projects/jsii/index.ts",
-            "line": 32
+            "line": 35
           },
           "name": "readme",
           "type": {
@@ -3670,7 +3693,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/projects/jsii/jsii-project-options.ts",
-            "line": 1244
+            "line": 1249
           },
           "name": "codeOwners",
           "type": {
@@ -4303,7 +4326,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/projects/jsii/jsii-project-options.ts",
-            "line": 1240
+            "line": 1245
           },
           "name": "codeql",
           "optional": true,
@@ -6525,6 +6548,29 @@
             "primitive": "string"
           }
         },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "[]",
+            "stability": "stable",
+            "summary": "Authors whose pull requests the merge queue merges without an approval, such as the single maintainer of a repository, who cannot approve their own pull requests."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/projects/jsii/jsii-project-options.ts",
+            "line": 1240
+          },
+          "name": "trustedAuthors",
+          "optional": true,
+          "type": {
+            "collection": {
+              "elementtype": {
+                "primitive": "string"
+              },
+              "kind": "array"
+            }
+          }
+        },
         {
           "abstract": true,
           "docs": {
@@ -6881,7 +6927,7 @@
         },
         "locationInModule": {
           "filename": "src/projects/npm/index.ts",
-          "line": 36
+          "line": 39
         },
         "parameters": [
           {
@@ -6895,7 +6941,7 @@
       "kind": "class",
       "locationInModule": {
         "filename": "src/projects/npm/index.ts",
-        "line": 33
+        "line": 36
       },
       "name": "NpmPackage",
       "properties": [
@@ -6905,7 +6951,7 @@
           },
           "locationInModule": {
             "filename": "src/projects/npm/index.ts",
-            "line": 34
+            "line": 37
           },
           "name": "readme",
           "type": {
@@ -6939,7 +6985,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/projects/npm/npm-package-options.ts",
-            "line": 1135
+            "line": 1140
           },
           "name": "codeOwners",
           "type": {
@@ -9552,6 +9598,29 @@
             "primitive": "string"
           }
         },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "[]",
+            "stability": "stable",
+            "summary": "Authors whose pull requests the merge queue merges without an approval, such as the single maintainer of a repository, who cannot approve their own pull requests."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/projects/npm/npm-package-options.ts",
+            "line": 1136
+          },
+          "name": "trustedAuthors",
+          "optional": true,
+          "type": {
+            "collection": {
+              "elementtype": {
+                "primitive": "string"
+              },
+              "kind": "array"
+            }
+          }
+        },
         {
           "abstract": true,
           "docs": {
@@ -9889,7 +9958,7 @@
         },
         "locationInModule": {
           "filename": "src/projects/python/index.ts",
-          "line": 33
+          "line": 36
         },
         "parameters": [
           {
@@ -9903,7 +9972,7 @@
       "kind": "class",
       "locationInModule": {
         "filename": "src/projects/python/index.ts",
-        "line": 29
+        "line": 32
       },
       "name": "PythonPackage",
       "properties": [
@@ -9914,7 +9983,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/projects/python/index.ts",
-            "line": 30
+            "line": 33
           },
           "name": "autoMerge",
           "optional": true,
@@ -9928,7 +9997,7 @@
           },
           "locationInModule": {
             "filename": "src/projects/python/index.ts",
-            "line": 31
+            "line": 34
           },
           "name": "readme",
           "type": {
@@ -9996,7 +10065,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/projects/python/python-package-options.ts",
-            "line": 391
+            "line": 396
           },
           "name": "codeOwners",
           "type": {
@@ -10172,7 +10241,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/projects/python/python-package-options.ts",
-            "line": 387
+            "line": 392
           },
           "name": "codeql",
           "optional": true,
@@ -10756,7 +10825,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/projects/python/python-package-options.ts",
-            "line": 396
+            "line": 401
           },
           "name": "pullRequestTemplate",
           "optional": true,
@@ -10774,7 +10843,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/projects/python/python-package-options.ts",
-            "line": 401
+            "line": 406
           },
           "name": "pullRequestTemplateContents",
           "optional": true,
@@ -11015,6 +11084,29 @@
             "fqn": "projen.github.StaleOptions"
           }
         },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "[]",
+            "stability": "stable",
+            "summary": "Authors whose pull requests the merge queue merges without an approval, such as the single maintainer of a repository, who cannot approve their own pull requests."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/projects/python/python-package-options.ts",
+            "line": 387
+          },
+          "name": "trustedAuthors",
+          "optional": true,
+          "type": {
+            "collection": {
+              "elementtype": {
+                "primitive": "string"
+              },
+              "kind": "array"
+            }
+          }
+        },
         {
           "abstract": true,
           "docs": {
@@ -11339,6 +11431,6 @@
       "symbolId": "src/components/readme/elements/section:Section"
     }
   },
-  "version": "3.2.1",
-  "fingerprint": "xYrTNM/TuzOK3VXmUrrhK8DdjQDExtvzEK87kM2c5zQ="
+  "version": "3.2.3",
+  "fingerprint": "LuGnubIoL1IhFnfdvVXi34r6KOCve17MM+TvfhK6+ss="
 }

package/API.md

@@ -5802,6 +5802,7 @@ const cdkTypeScriptAppOptions: CdkTypeScriptAppOptions = { ... }
 | <code><a href="#projen-modules.CdkTypeScriptAppOptions.property.stale">stale</a></code> | <code>boolean</code> | Auto-close of stale issues and pull request. |
 | <code><a href="#projen-modules.CdkTypeScriptAppOptions.property.staleOptions">staleOptions</a></code> | <code>projen.github.StaleOptions</code> | Auto-close stale issues and pull requests. |
 | <code><a href="#projen-modules.CdkTypeScriptAppOptions.property.testdir">testdir</a></code> | <code>string</code> | Jest tests directory. |
+| <code><a href="#projen-modules.CdkTypeScriptAppOptions.property.trustedAuthors">trustedAuthors</a></code> | <code>string[]</code> | Authors whose pull requests the merge queue merges without an approval, such as the single maintainer of a repository, who cannot approve their own pull requests. |
 | <code><a href="#projen-modules.CdkTypeScriptAppOptions.property.tsconfig">tsconfig</a></code> | <code>projen.javascript.TypescriptConfigOptions</code> | Custom TSConfig. |
 | <code><a href="#projen-modules.CdkTypeScriptAppOptions.property.tsconfigDev">tsconfigDev</a></code> | <code>projen.javascript.TypescriptConfigOptions</code> | Custom tsconfig options for the development tsconfig.json file (used for testing). |
 | <code><a href="#projen-modules.CdkTypeScriptAppOptions.property.tsconfigDevFile">tsconfigDevFile</a></code> | <code>string</code> | The name (and path) of the development tsconfig file. |
@@ -8107,6 +8108,19 @@ compile the code in-memory.
 
 ---
 
+##### `trustedAuthors`<sup>Optional</sup> <a name="trustedAuthors" id="projen-modules.CdkTypeScriptAppOptions.property.trustedAuthors"></a>
+
+```typescript
+public readonly trustedAuthors: string[];
+```
+
+- *Type:* string[]
+- *Default:* []
+
+Authors whose pull requests the merge queue merges without an approval, such as the single maintainer of a repository, who cannot approve their own pull requests.
+
+---
+
 ##### `tsconfig`<sup>Optional</sup> <a name="tsconfig" id="projen-modules.CdkTypeScriptAppOptions.property.tsconfig"></a>
 
 ```typescript
@@ -8528,6 +8542,7 @@ const jsiiProjectOptions: JsiiProjectOptions = { ... }
 | <code><a href="#projen-modules.JsiiProjectOptions.property.stale">stale</a></code> | <code>boolean</code> | Auto-close of stale issues and pull request. |
 | <code><a href="#projen-modules.JsiiProjectOptions.property.staleOptions">staleOptions</a></code> | <code>projen.github.StaleOptions</code> | Auto-close stale issues and pull requests. |
 | <code><a href="#projen-modules.JsiiProjectOptions.property.testdir">testdir</a></code> | <code>string</code> | Jest tests directory. |
+| <code><a href="#projen-modules.JsiiProjectOptions.property.trustedAuthors">trustedAuthors</a></code> | <code>string[]</code> | Authors whose pull requests the merge queue merges without an approval, such as the single maintainer of a repository, who cannot approve their own pull requests. |
 | <code><a href="#projen-modules.JsiiProjectOptions.property.tsconfig">tsconfig</a></code> | <code>projen.javascript.TypescriptConfigOptions</code> | Custom TSConfig. |
 | <code><a href="#projen-modules.JsiiProjectOptions.property.tsconfigDev">tsconfigDev</a></code> | <code>projen.javascript.TypescriptConfigOptions</code> | Custom tsconfig options for the development tsconfig.json file (used for testing). |
 | <code><a href="#projen-modules.JsiiProjectOptions.property.tsconfigDevFile">tsconfigDevFile</a></code> | <code>string</code> | The name (and path) of the development tsconfig file. |
@@ -10777,6 +10792,19 @@ compile the code in-memory.
 
 ---
 
+##### `trustedAuthors`<sup>Optional</sup> <a name="trustedAuthors" id="projen-modules.JsiiProjectOptions.property.trustedAuthors"></a>
+
+```typescript
+public readonly trustedAuthors: string[];
+```
+
+- *Type:* string[]
+- *Default:* []
+
+Authors whose pull requests the merge queue merges without an approval, such as the single maintainer of a repository, who cannot approve their own pull requests.
+
+---
+
 ##### `tsconfig`<sup>Optional</sup> <a name="tsconfig" id="projen-modules.JsiiProjectOptions.property.tsconfig"></a>
 
 ```typescript
@@ -11173,6 +11201,7 @@ const npmPackageOptions: NpmPackageOptions = { ... }
 | <code><a href="#projen-modules.NpmPackageOptions.property.stale">stale</a></code> | <code>boolean</code> | Auto-close of stale issues and pull request. |
 | <code><a href="#projen-modules.NpmPackageOptions.property.staleOptions">staleOptions</a></code> | <code>projen.github.StaleOptions</code> | Auto-close stale issues and pull requests. |
 | <code><a href="#projen-modules.NpmPackageOptions.property.testdir">testdir</a></code> | <code>string</code> | Jest tests directory. |
+| <code><a href="#projen-modules.NpmPackageOptions.property.trustedAuthors">trustedAuthors</a></code> | <code>string[]</code> | Authors whose pull requests the merge queue merges without an approval, such as the single maintainer of a repository, who cannot approve their own pull requests. |
 | <code><a href="#projen-modules.NpmPackageOptions.property.tsconfig">tsconfig</a></code> | <code>projen.javascript.TypescriptConfigOptions</code> | Custom TSConfig. |
 | <code><a href="#projen-modules.NpmPackageOptions.property.tsconfigDev">tsconfigDev</a></code> | <code>projen.javascript.TypescriptConfigOptions</code> | Custom tsconfig options for the development tsconfig.json file (used for testing). |
 | <code><a href="#projen-modules.NpmPackageOptions.property.tsconfigDevFile">tsconfigDevFile</a></code> | <code>string</code> | The name (and path) of the development tsconfig file. |
@@ -13215,6 +13244,19 @@ compile the code in-memory.
 
 ---
 
+##### `trustedAuthors`<sup>Optional</sup> <a name="trustedAuthors" id="projen-modules.NpmPackageOptions.property.trustedAuthors"></a>
+
+```typescript
+public readonly trustedAuthors: string[];
+```
+
+- *Type:* string[]
+- *Default:* []
+
+Authors whose pull requests the merge queue merges without an approval, such as the single maintainer of a repository, who cannot approve their own pull requests.
+
+---
+
 ##### `tsconfig`<sup>Optional</sup> <a name="tsconfig" id="projen-modules.NpmPackageOptions.property.tsconfig"></a>
 
 ```typescript
@@ -13512,6 +13554,7 @@ const pythonPackageOptions: PythonPackageOptions = { ... }
 | <code><a href="#projen-modules.PythonPackageOptions.property.setuptools">setuptools</a></code> | <code>boolean</code> | Use setuptools with a setup.py script for packaging and publishing. |
 | <code><a href="#projen-modules.PythonPackageOptions.property.stale">stale</a></code> | <code>boolean</code> | Auto-close of stale issues and pull request. |
 | <code><a href="#projen-modules.PythonPackageOptions.property.staleOptions">staleOptions</a></code> | <code>projen.github.StaleOptions</code> | Auto-close stale issues and pull requests. |
+| <code><a href="#projen-modules.PythonPackageOptions.property.trustedAuthors">trustedAuthors</a></code> | <code>string[]</code> | Authors whose pull requests the merge queue merges without an approval, such as the single maintainer of a repository, who cannot approve their own pull requests. |
 | <code><a href="#projen-modules.PythonPackageOptions.property.uv">uv</a></code> | <code>boolean</code> | Use uv to manage your project dependencies, virtual environment, and (optional) packaging/publishing. |
 | <code><a href="#projen-modules.PythonPackageOptions.property.uvOptions">uvOptions</a></code> | <code>projen.python.UvOptions</code> | Additional options to set for uv if using uv. |
 | <code><a href="#projen-modules.PythonPackageOptions.property.venv">venv</a></code> | <code>boolean</code> | Use venv to manage a virtual environment for installing dependencies inside. |
@@ -14278,6 +14321,19 @@ To disable set `stale` to `false`.
 
 ---
 
+##### `trustedAuthors`<sup>Optional</sup> <a name="trustedAuthors" id="projen-modules.PythonPackageOptions.property.trustedAuthors"></a>
+
+```typescript
+public readonly trustedAuthors: string[];
+```
+
+- *Type:* string[]
+- *Default:* []
+
+Authors whose pull requests the merge queue merges without an approval, such as the single maintainer of a repository, who cannot approve their own pull requests.
+
+---
+
 ##### `uv`<sup>Optional</sup> <a name="uv" id="projen-modules.PythonPackageOptions.property.uv"></a>
 
 ```typescript

package/README.md

@@ -28,7 +28,7 @@ Types of testing:
 
 ## GitHub Configuration
 
-All pull requests are merged by the [Mergify](https://mergify.com) merge queue, configured in `.mergify.yml`. Once a pull request's checks pass, Mergify queues it, brings it up to date with the default branch, waits for the checks again and squash merges it. Draft pull requests and those labelled `do-not-merge` are not merged.
+All pull requests are merged by the [Mergify](https://mergify.com) merge queue, configured in `.mergify.yml`. Once a pull request is approved, or is opened by `daveshepherd`, and its checks pass, Mergify queues it, brings it up to date with the default branch, waits for the checks again and squash merges it. Draft pull requests and those labelled `do-not-merge` are not merged.
 
 The repository must be configured as below so that nothing can be merged without going through the queue.
 
@@ -43,6 +43,10 @@ In **Settings → General → Pull Requests**:
 * Untick **Allow auto-merge**, because GitHub's own auto-merge merges outside the queue.
 * Tick **Automatically delete head branches**.
 
+### Actions settings
+
+In **Settings → Actions → General**, set **Approval for running fork pull request workflows from contributors** to **Require approval for all external contributors**. A pull request from a fork runs its own copy of the workflows, so it can change how the required checks pass.
+
 ### Code scanning
 
 CodeQL runs from `.github/workflows/codeql.yml`, which is managed by projen. In **Settings → Advanced Security**, leave CodeQL **Default setup** off, because it cannot run alongside this workflow. Under **Protection rules**, keep the **Check run failure threshold** at **High or higher** for security alerts and **Errors** for other alerts, as this decides whether the `CodeQL` check fails. Private repositories also need GitHub Code Security enabled there for code scanning results to be uploaded.
@@ -53,7 +57,7 @@ In **Settings → Rules → Rulesets**, create a branch ruleset with enforcement
 * **Bypass list**: the **Mergify** app only, in **Exempt** mode. Do not add admins or other roles, as anyone on this list can merge without the queue.
 * **Restrict updates**: only bypass actors can update the branch, so pull requests cannot be merged from the GitHub UI or CLI and commits cannot be pushed directly.
 * **Restrict deletions** and **Block force pushes**.
-* **Require a pull request before merging**, with 0 required approvals.
+* **Require a pull request before merging**, with 0 required approvals, because Mergify requires approvals itself for authors other than `daveshepherd` and is exempt from this rule. Tick **Dismiss stale pull request approvals when new commits are pushed**, so that commits pushed after an approval need approving again before the queue merges them.
 * **Require status checks to pass**, listing the checks that `.mergify.yml` waits for: `build`, `package-js`, `package-python`. Leave **Require branches to be up to date before merging** unticked, as the queue already updates and retests each pull request.
 * **Require code scanning results**, with the tool **CodeQL**, security alerts set to **High or higher** and alerts set to **Errors**. Mergify is exempt from this rule, so `.mergify.yml` also waits for the `CodeQL` check instead.
 

package/lib/components/github/mergify.d.ts

@@ -3,14 +3,21 @@ import { Readme } from '../readme';
 export interface MergifyOptions {
     /**
      * Number of approving reviews the merge queue waits for, which should match
-     * `autoMergeOptions.approvedReviews`. Use 0 for a repository with a single
-     * maintainer, who cannot approve their own pull requests.
+     * `autoMergeOptions.approvedReviews`
      *
      * @default 1
      */
     readonly approvedReviews?: number;
     readonly assignUsers?: Array<string>;
     readonly reportingMethod?: string;
+    /**
+     * Authors whose pull requests the merge queue merges without an approval, such
+     * as the single maintainer of a repository, who cannot approve their own pull
+     * requests. Pull requests from anyone else still need `approvedReviews`.
+     *
+     * @default []
+     */
+    readonly trustedAuthors?: Array<string>;
     /**
      * Author of the projen upgrade pull requests that are automatically approved
      *
@@ -26,5 +33,13 @@ type MergifyProject = Project & {
     };
     readonly readme?: Readme;
 };
+/**
+ * Options for projen's auto merge, which requires its approvals from every
+ * author, so with trusted authors `configureMergify` requires them instead
+ */
+export declare function autoMergeOptions(options: {
+    readonly autoMergeOptions?: github.AutoMergeOptions;
+    readonly trustedAuthors?: Array<string>;
+}): github.AutoMergeOptions | undefined;
 export declare function configureMergify(project: MergifyProject, options?: MergifyOptions): void;
 export {};