projen-pipelines 0.2.13 → 0.2.14

package/.jsii

@@ -8,6 +8,7 @@
     ]
   },
   "bin": {
+    "detect-drift": "lib/drift/detect-drift.js",
     "pipelines-release": "lib/release.js"
   },
   "bundled": {
@@ -105,7 +106,7 @@
   },
   "name": "projen-pipelines",
   "readme": {
-    "markdown": "# Projen Pipelines\n\n[![npm version](https://badge.fury.io/js/projen-pipelines.svg)](https://www.npmjs.com/package/projen-pipelines)\n\nProjen Pipelines is an open-source project that automates the generation of CI/CD pipelines using Projen,\na project configuration tool created by the inventor of AWS CDK.\nIt provides high-level abstractions for defining continuous delivery (CD) pipelines for applications,\nspecifically designed to work with the projen project configuration engine.\n\n### Key Features\n\n* Automates code generation for CI/CD pipelines\n* Supports multiple CI/CD platforms (currently GitHub Actions and GitLab CI, with more in development)\n* Provides baked-in proven defaults for pipeline configurations\n* Enables compliance-as-code integration\n* Allows easy switching between different CI/CD platforms without rewriting pipeline configurations\n* Handles complex deployment scenarios with less code\n* Manages AWS infrastructure more efficiently and straightforwardly\n* Automatic versioning with flexible strategies and multiple output targets\n\n### Benefits\n\n* Reduces repetitive work in writing and maintaining pipeline configurations\n* Ensures consistency across projects by using proven defaults\n* Simplifies compliance management by integrating it directly into pipeline definitions\n* Facilitates platform migrations (e.g., from GitHub to GitLab) by abstracting pipeline definitions\n* Provides automatic version tracking and exposure through CloudFormation and SSM Parameter Store\n\n## Beyond AWS CDK: A Vision for Universal CI/CD Pipeline Generation\n\nWhile Projen Pipelines currently focuses on AWS CDK applications, our vision extends far beyond this initial scope.\nWe aim to evolve into a universal CI/CD pipeline generator capable of supporting a wide variety of application types and deployment targets.\n\n### Future Direction:\n\n1. Diverse Application Support: We plan to expand our capabilities to generate pipelines for various application types, including but not limited to:\n  * Traditional web applications\n  * Terraform / OpenTOFU projects\n  * Winglang applications\n1. Multi-Cloud Deployment: While we started with AWS, we aim to support deployments to other major cloud providers like Azure, Google Cloud Platform, and others.\n1. On-Premises and Hybrid Scenarios: We recognize the importance of on-premises and hybrid cloud setups and plan to cater to these deployment models.\n1. Framework Agnostic: Our goal is to make Projen Pipelines adaptable to work with various development frameworks and tools, not just those related to AWS or cloud deployments.\n1. Extensibility: We're designing the system to be easily extensible, allowing the community to contribute modules for new application types, deployment targets, or CI/CD platforms.\n\nBy broadening our scope, we aim to create a tool that can standardize and simplify CI/CD pipeline creation across the entire spectrum of modern application development and deployment scenarios.\nWe invite the community to join us in this journey, contributing ideas, use cases, and code to help realize this vision.\n\n## How Projen Pipelines work\n![High level Projen Pipelines Overview](documentation/overview.png)\n\nUnder the hood, after you define the pipeline and select the target engine you want to work on, we use code generation methods to create the required CI/CD pipeline in your project.\n\nWe are considering allowing the selection of multiple engines going forward - please let us know if this is a feature you would use!\n\n## Getting Started\n\n### Installation\n\nTo install the package, add the package `projen-pipelines` to your projects devDeps in your projen configuration file.\n\nAfter installing the package, you can import and use the constructs to define your CDK Pipelines.\n\nYou will also have to setup an IAM role that can be used by GitHub Actions. For example, create a role named `GithubDeploymentRole` in your deployment account (`123456789012`) with a policy like this to assume the CDK roles of the pipeline stages (AWS account IDs `123456789013` and `123456789014`):\n```json\n{\n    \"Version\": \"2012-10-17\",\n    \"Statement\": [\n        {\n            \"Sid\": \"Statement1\",\n            \"Effect\": \"Allow\",\n            \"Action\": \"sts:AssumeRole\",\n            \"Resource\": [\n                \"arn:aws:iam::123456789013:role/cdk-*-123456789013-*\",\n                \"arn:aws:iam::123456789014:role/cdk-*-123456789014-*\"\n            ]\n        }\n    ]\n}\n```\n\nAdd a trust policy to this role as described in this tutorial: [Configuring OpenID Connect in Amazon Web Services](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-amazon-web-services)\n\n### Usage with AWS CDK\n\nYou can start using the constructs provided by Projen Pipelines in your AWS CDK applications. Here's a brief example:\n\n```typescript\nimport { awscdk } from 'projen';\nimport { GithubCDKPipeline } from 'projen-pipelines';\n\n// Define your AWS CDK TypeScript App\nconst app = new awscdk.AwsCdkTypeScriptApp({\n  cdkVersion: '2.150.0',\n  name: 'my-awesome-app',\n  defaultReleaseBranch: 'main',\n  devDeps: [\n    'projen-pipelines',\n  ],\n});\n\n// Create the pipeline\nnew GithubCDKPipeline(app, {\n  stackPrefix: 'MyApp',\n  iamRoleArns: {\n    default: 'arn:aws:iam::123456789012:role/GithubDeploymentRole',\n  },\n  pkgNamespace: '@company-assemblies',\n  useGithubPackagesForAssembly: true,\n  stages: [\n    {\n      name: 'dev',\n      env: { account: '123456789013', region: 'eu-central-1' },\n    }, {\n      name: 'prod',\n      manualApproval: true,\n      env: { account: '123456789014', region: 'eu-central-1' },\n    }],\n});\n```\n\nAfter running projen (`npx projen`) a new file called `src/app.ts` will be created and contain a specialized CDK App class for your project.\n\nYou can then use this in your `main.ts` to configure your deployment.\n\n```typescript\nimport { PipelineApp } from './app';\nimport { BackendStack } from './stack';\n\nconst app = new PipelineApp({\n  provideDevStack: (scope, id, props) => {\n    return new BackendStack(scope, id, {\n      ...props,\n      apiHostname: 'api-dev',\n      myConfigSetting: 'value-for-dev',\n    });\n  },\n  provideProdStack: (scope, id, props) => {\n    return new BackendStack(scope, id, {\n      ...props,\n      apiHostname: 'api',\n      myConfigSetting: 'value-for-prod',\n    });\n  },\n  providePersonalStack: (scope, id, props) => {\n    return new BackendStack(scope, id, {\n      ...props,\n      apiHostname: `api-${props.stageName}`,\n      myConfigSetting: 'value-for-personal-stage',\n    });\n  },\n});\n\napp.synth();\n```\n\n### Setting Up Trust Relationships Between Accounts\n\nWhen planning to manage multiple staging environments, you will need to establish trust relationships. This process centralizes deployment control, improving operational efficiency and security by consolidating deployment management through a singular, monitored channel. Here is a simplified diagram for the setup:\n\n![Trust relationship](documentation/trust.svg)\n\n#### Step 1: Bootstrapping Each Account\n\nBootstrapping initializes the AWS CDK environment in each account. It prepares the account to work with AWS CDK apps deployed from other accounts. Use the `cdk bootstrap` command for this purpose. Replace `<deployment_account_id>` with the actual AWS account ID of your deployment account.\n\nYou can use the [CloudShell](https://aws.amazon.com/cloudshell/) to bootstrap each staging account:\n\n```bash\ncdk bootstrap --trust <deployment_account_id> --cloudformation-execution-policies \"arn:aws:iam::aws:policy/AdministratorAccess\"\n```\n\n**Note:**\n\nWhile `AdministratorAccess` grants full access to all AWS services and resources, it's not recommended for production environments due to security risks. Instead, create custom IAM policies that grant only the necessary permissions required for deployment operations.\n\n### Deployment\n\nThe `<Engine>CDKPipeline` class creates and adds several tasks to the projen project that then can be used in your pipeline to deploy your application to AWS.\n\nHere's a brief description of each one:\n\n1. **deploy:personal** - This task deploys the application's personal stage, which is a distinct, isolated deployment of the application. The personal stage is intended for personal use, such as testing and development.\n\n2. **watch:personal** - This task deploys the personal stage of the application in watch mode. In this mode, the AWS CDK monitors your application source files for changes, automatically re-synthesizing and deploying when it detects any changes.\n\n3. **diff:personal** - This task compares the deployed personal stage with the current state of the application code. It's used to understand what changes would be made if the application were deployed.\n\n4. **destroy:personal** - This task destroys the resources created for the personal stage of the application.\n\n5. **deploy:feature** - This task deploys the application's feature stage. The feature stage is used for new features testing before these are merged into the main branch.\n\n6. **diff:feature** - This task is similar to `diff:personal`, but for the feature stage.\n\n7. **destroy:feature** - This task destroys the resources created for the feature stage of the application.\n\n8. **deploy:<stageName>** - This task deploys a specific stage of the application (like 'dev' or 'prod').\n\n9. **diff:<stageName>** - This task compares the specified application stage with the current state of the application code.\n\n10. **publish:assets** - This task publishes the CDK assets to all accounts. This is useful when the CDK application uses assets like Docker images or files from the S3 bucket.\n\n11. **bump** - This task bumps the version based on the latest git tag and pushes the updated tag to the git repository.\n\n12. **release:push-assembly** - This task creates a manifest, bumps the version without creating a git tag, and publishes the cloud assembly to your registry.\n\nRemember that these tasks are created and managed automatically by the `CDKPipeline` class. You can run these tasks using the `npx projen TASK_NAME` command.\n\n## Versioning\n\nProjen Pipelines includes a comprehensive versioning system that automatically tracks and exposes deployment versions through various AWS services. This feature enables deployment traceability, automated rollback decisions, and comprehensive audit trails.\n\n### Basic Versioning Configuration\n\nTo enable versioning in your pipeline, add the `versioning` configuration:\n\n```typescript\nimport { awscdk } from 'projen';\nimport { GithubCDKPipeline, VersioningStrategy, VersioningOutputs } from 'projen-pipelines';\n\nconst app = new awscdk.AwsCdkTypeScriptApp({\n  // ... other config\n});\n\nnew GithubCDKPipeline(app, {\n  // ... other pipeline config\n\n  versioning: {\n    enabled: true,\n    strategy: VersioningStrategy.commitCount(),\n    outputs: VersioningOutputs.standard()\n  }\n});\n```\n\n### Versioning Strategies\n\nProjen Pipelines provides several built-in versioning strategies:\n\n#### Git Tag Strategy\nUses git tags as the version source, with optional prefix stripping:\n\n```typescript\n// Basic git tag strategy\nconst strategy = VersioningStrategy.gitTag();\n\n// With custom configuration\nconst strategy = VersioningStrategy.gitTag({\n  stripPrefix: 'v',           // Strip 'v' from tags (v1.2.3 → 1.2.3)\n  annotatedOnly: true,        // Only use annotated tags\n  includeSinceTag: true       // Include commits since tag\n});\n```\n\n#### Package.json Strategy\nUses the version from your package.json file:\n\n```typescript\n// Basic package.json strategy\nconst strategy = VersioningStrategy.packageJson();\n\n// With custom configuration\nconst strategy = VersioningStrategy.packageJson({\n  path: './package.json',\n  includePrerelease: true,\n  appendCommitInfo: true\n});\n```\n\n#### Commit Count Strategy\nUses the number of commits as the version:\n\n```typescript\n// Basic commit count strategy\nconst strategy = VersioningStrategy.commitCount();\n\n// With custom configuration\nconst strategy = VersioningStrategy.commitCount({\n  countFrom: 'all',           // 'all' | 'since-tag'\n  includeBranch: true,        // Include branch name\n  padding: 5                  // Zero-pad count (00001)\n});\n```\n\n#### Build Number Strategy\nCreates a version from build metadata:\n\n```typescript\n// Basic build number strategy\nconst strategy = VersioningStrategy.buildNumber();\n\n// With custom configuration\nconst strategy = VersioningStrategy.buildNumber({\n  prefix: 'release',\n  commitCount: { countFrom: 'all', padding: 5 }\n});\n// Output: release-01234-3a4b5c6d\n```\n\n#### Custom Composite Strategy\nCreate your own version format using template variables:\n\n```typescript\nconst strategy = VersioningStrategy.create(\n  '{git-tag}+{commit-count}-{commit-hash:8}',\n  {\n    gitTag: { stripPrefix: 'v' },\n    commitCount: { countFrom: 'since-tag' }\n  }\n);\n// Output: 1.2.3+45-3a4b5c6d\n```\n\n### Version Output Configurations\n\nControl how and where version information is exposed:\n\n#### CloudFormation Outputs\nExport version information as CloudFormation stack outputs:\n\n```typescript\n// Basic CloudFormation output\nconst outputs = VersioningOutputs.cloudFormationOnly();\n\n// With custom configuration\nconst outputs = VersioningOutputs.cloudFormationOnly({\n  exportName: 'MyApp-{stage}-Version'\n});\n```\n\n#### SSM Parameter Store\nStore version information in AWS Systems Manager Parameter Store:\n\n```typescript\n// Basic parameter store\nconst outputs = VersioningOutputs.parameterStoreOnly('/myapp/{stage}/version');\n\n// Hierarchical parameters\nconst outputs = VersioningOutputs.hierarchicalParameters('/myapp/{stage}/version', {\n  includeCloudFormation: true\n});\n```\n\nThis creates parameters like:\n- `/myapp/prod/version` → Full version JSON\n- `/myapp/prod/version/commit` → Commit hash\n- `/myapp/prod/version/tag` → Git tag\n- `/myapp/prod/version/count` → Commit count\n\n#### Standard Configuration\nThe recommended configuration that uses CloudFormation outputs with optional Parameter Store:\n\n```typescript\nconst outputs = VersioningOutputs.standard({\n  parameterName: '/myapp/{stage}/version',\n});\n```\n\n### Output Formats\n\nVersion information can be output in two formats:\n\n**Plain Format:** Simple string values in CloudFormation\n```yaml\nOutputs:\n  AppVersion:\n    Value: \"1.2.3+45-3a4b5c6d\"\n    Description: \"Application version\"\n  AppCommitHash:\n    Value: \"3a4b5c6def1234567890\"\n    Description: \"Git commit hash\"\n```\n\n**Structured Format:** JSON object with comprehensive metadata in SSM\n```json\n{\n  \"version\": \"1.2.3\",\n  \"commitHash\": \"3a4b5c6def1234567890\",\n  \"commitCount\": 1234,\n  \"commitsSinceTag\": 45,\n  \"branch\": \"main\",\n  \"tag\": \"v1.2.3\",\n  \"deployedAt\": \"2024-01-15T10:30:00Z\",\n  \"deployedBy\": \"github-actions\",\n  \"buildNumber\": \"456\",\n  \"environment\": \"production\"\n}\n```\n\n### Stage-Specific Overrides\n\nConfigure different versioning strategies for different stages:\n\n```typescript\nnew GithubCDKPipeline(app, {\n  versioning: {\n    enabled: true,\n    strategy: VersioningStrategy.gitTag(),\n    outputs: VersioningOutputs.standard(),\n    stageOverrides: {\n      dev: {\n        strategy: VersioningStrategy.commitCount(),\n        outputs: VersioningOutputs.minimal()\n      },\n      prod: {\n        validation: {\n          requireTag: true,\n          tagPattern: /^v\\d+\\.\\d+\\.\\d+$/\n        }\n      }\n    }\n  }\n});\n```\n\n### Template Variables\n\nAll strategies support these template variables:\n- `{git-tag}` - Git tag (with optional prefix stripping)\n- `{package-version}` - Version from package.json\n- `{commit-count}` - Number of commits\n- `{commit-hash}` - Full commit hash\n- `{commit-hash:8}` - Short commit hash (8 characters)\n- `{branch}` - Git branch name\n- `{build-number}` - CI/CD build number\n\n### Benefits of Versioning\n\n1. **Deployment Traceability**: Always know exactly which code version is deployed\n2. **Automated Rollback**: Use version information for automated rollback decisions\n3. **Audit Trail**: Comprehensive deployment history with metadata\n4. **Multi-Stage Support**: Different versioning strategies per environment\n5. **Zero Configuration**: Works out-of-the-box with sensible defaults\n6. **CI/CD Integration**: Automatically detects version info from CI/CD environments\n\n### Feature Branch Deployments\n\nProjen Pipelines supports automated feature branch deployments for GitHub Actions. This allows you to deploy and test your changes in isolated environments before merging to the main branch. Gitlab support is currently missing.\n\n#### Configuration\n\nTo enable feature branch deployments, add the `featureStages` configuration to your pipeline:\n\n```typescript\nnew GithubCDKPipeline(app, {\n  stackPrefix: 'MyApp',\n  iamRoleArns: {\n    default: 'arn:aws:iam::123456789012:role/GithubDeploymentRole',\n  },\n  featureStages: {\n    env: { account: '123456789013', region: 'eu-central-1' },\n  },\n  stages: [\n    // ... your regular stages\n  ],\n});\n```\n\n#### How It Works\n\nWhen feature stages are configured, two GitHub workflows are created:\n\n1. **deploy-feature** - Automatically deploys your feature branch when a pull request is labeled with `feature-deployment`\n2. **destroy-feature** - Automatically destroys the feature deployment when:\n   - The pull request is closed\n   - The `feature-deployment` label is removed from the pull request\n\n#### Using Feature Deployments\n\n1. Create a pull request with your changes\n2. Add the `feature-deployment` label to trigger deployment\n3. The feature environment will be deployed with a stack name including your branch name\n4. Remove the label or close the PR to destroy the feature environment\n\nThe feature deployment uses the `--force` flag when destroying to ensure cleanup without manual confirmation.\n\n## Current Status\n\nProjen-Pipelines is currently in version 0.x, awaiting Projen's 1.0 release. Despite its pre-1.0 status, it's being used in several production environments.\n\n## Contributing\n\n### By raising feature requests or issues\n\nUse the Github integrated \"[Issues](https://github.com/taimos/projen-pipelines/issues/new)\" view to create an item that you would love to have added to our open source project.\n\n***No request is too big or too small*** - get your thoughts created and we'll get back to you if we have questions!\n\n### By committing code\n\nWe welcome all contributions to Projen Pipelines! Here's how you can get started:\n\n1. **Fork the Repository**: Click the 'Fork' button at the top right of this page to duplicate this repository in your GitHub account.\n\n2. **Clone your Fork**: Clone the forked repository to your local machine.\n\n```bash\ngit clone https://github.com/<your_username>/projen-pipelines.git\n```\n\n3. **Create a Branch**: To keep your work organized, create a branch for your contribution.\n\n```bash\ngit checkout -b my-branch\n```\n\n4. **Make your Changes**: Make your changes, additions, or fixes to the codebase. Remember to follow the existing code style.\n\n5. **Test your Changes**: Before committing your changes, make sure to test them to ensure they work as expected and do not introduce bugs.\n\n6. **Commit your Changes**: Commit your changes with a descriptive commit message using conventional commit messages.\n\n```bash\ngit commit -m \"feat: Your descriptive commit message\"\n```\n\n7. **Push to your Fork**: Push your commits to the branch in your forked repository.\n\n```bash\ngit push -u origin my-branch\n```\n\n8. **Submit a Pull Request**: Once your changes are ready to be reviewed, create a pull request from your forked repository's branch into the `main` branch of this repository.\n\nYour pull request will be reviewed and hopefully merged quickly. Thanks for contributing!\n\n### How to test changes?\nThe best way currently is to test things locally or - if you have a working stall of all supported CI/CD tools - manually test the functionalities there in diferent projects.\n\n_For local testing:_\nUsing `yalc push` you can install the project locally to your local yalc package manager. You can also use `npm run local-push` instead of this.\n\nWith `yalc add projen-pipelines` you can then use it in a local project.\n\n\n## Future Plans\n\n* Move the project to the Open Construct Foundation for broader community involvement\n* Continue expanding support for different CI/CD platforms and project types\n\nJoin us in elevating CI/CD pipeline discussions from implementation details to fundamental building blocks, and help create a more efficient, standardized approach to pipeline development!\n\n## Known issues\n\n### Environment variable not recognized during `npx projen`\n\nWhen attempting to run `npx projen`, users may encounter an error related to environment variable substitution within configuration files. Specifically, the `${GITHUB_TOKEN}` placeholder fails to be replaced.\n\n#### Solution\n\nTo resolve this issue, prefix the `npx projen` command with the `GITHUB_TOKEN=` environment variable:\n\n```bash\nGITHUB_TOKEN= npx projen\n```\n"
+    "markdown": "# Projen Pipelines\n\n[![npm version](https://badge.fury.io/js/projen-pipelines.svg)](https://www.npmjs.com/package/projen-pipelines)\n\nProjen Pipelines is an open-source project that automates the generation of CI/CD pipelines using Projen,\na project configuration tool created by the inventor of AWS CDK.\nIt provides high-level abstractions for defining continuous delivery (CD) pipelines for applications,\nspecifically designed to work with the projen project configuration engine.\n\n### Key Features\n\n* Automates code generation for CI/CD pipelines\n* Supports multiple CI/CD platforms (currently GitHub Actions and GitLab CI, with more in development)\n* Provides baked-in proven defaults for pipeline configurations\n* Enables compliance-as-code integration\n* Allows easy switching between different CI/CD platforms without rewriting pipeline configurations\n* Handles complex deployment scenarios with less code\n* Manages AWS infrastructure more efficiently and straightforwardly\n* Automated drift detection for CloudFormation/CDK stacks with scheduled checks and issue creation\n* Automatic versioning with flexible strategies and multiple output targets\n\n### Benefits\n\n* Reduces repetitive work in writing and maintaining pipeline configurations\n* Ensures consistency across projects by using proven defaults\n* Simplifies compliance management by integrating it directly into pipeline definitions\n* Facilitates platform migrations (e.g., from GitHub to GitLab) by abstracting pipeline definitions\n* Provides automatic version tracking and exposure through CloudFormation and SSM Parameter Store\n\n## Beyond AWS CDK: A Vision for Universal CI/CD Pipeline Generation\n\nWhile Projen Pipelines currently focuses on AWS CDK applications, our vision extends far beyond this initial scope.\nWe aim to evolve into a universal CI/CD pipeline generator capable of supporting a wide variety of application types and deployment targets.\n\n### Future Direction:\n\n1. Diverse Application Support: We plan to expand our capabilities to generate pipelines for various application types, including but not limited to:\n  * Traditional web applications\n  * Terraform / OpenTOFU projects\n  * Winglang applications\n1. Multi-Cloud Deployment: While we started with AWS, we aim to support deployments to other major cloud providers like Azure, Google Cloud Platform, and others.\n1. On-Premises and Hybrid Scenarios: We recognize the importance of on-premises and hybrid cloud setups and plan to cater to these deployment models.\n1. Framework Agnostic: Our goal is to make Projen Pipelines adaptable to work with various development frameworks and tools, not just those related to AWS or cloud deployments.\n1. Extensibility: We're designing the system to be easily extensible, allowing the community to contribute modules for new application types, deployment targets, or CI/CD platforms.\n\nBy broadening our scope, we aim to create a tool that can standardize and simplify CI/CD pipeline creation across the entire spectrum of modern application development and deployment scenarios.\nWe invite the community to join us in this journey, contributing ideas, use cases, and code to help realize this vision.\n\n## How Projen Pipelines work\n![High level Projen Pipelines Overview](documentation/overview.png)\n\nUnder the hood, after you define the pipeline and select the target engine you want to work on, we use code generation methods to create the required CI/CD pipeline in your project.\n\nWe are considering allowing the selection of multiple engines going forward - please let us know if this is a feature you would use!\n\n## Getting Started\n\n### Installation\n\nTo install the package, add the package `projen-pipelines` to your projects devDeps in your projen configuration file.\n\nAfter installing the package, you can import and use the constructs to define your CDK Pipelines.\n\nYou will also have to setup an IAM role that can be used by GitHub Actions. For example, create a role named `GithubDeploymentRole` in your deployment account (`123456789012`) with a policy like this to assume the CDK roles of the pipeline stages (AWS account IDs `123456789013` and `123456789014`):\n```json\n{\n    \"Version\": \"2012-10-17\",\n    \"Statement\": [\n        {\n            \"Sid\": \"Statement1\",\n            \"Effect\": \"Allow\",\n            \"Action\": \"sts:AssumeRole\",\n            \"Resource\": [\n                \"arn:aws:iam::123456789013:role/cdk-*-123456789013-*\",\n                \"arn:aws:iam::123456789014:role/cdk-*-123456789014-*\"\n            ]\n        }\n    ]\n}\n```\n\nAdd a trust policy to this role as described in this tutorial: [Configuring OpenID Connect in Amazon Web Services](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-amazon-web-services)\n\n### Usage with AWS CDK\n\nYou can start using the constructs provided by Projen Pipelines in your AWS CDK applications. Here's a brief example:\n\n```typescript\nimport { awscdk } from 'projen';\nimport { GithubCDKPipeline } from 'projen-pipelines';\n\n// Define your AWS CDK TypeScript App\nconst app = new awscdk.AwsCdkTypeScriptApp({\n  cdkVersion: '2.150.0',\n  name: 'my-awesome-app',\n  defaultReleaseBranch: 'main',\n  devDeps: [\n    'projen-pipelines',\n  ],\n});\n\n// Create the pipeline\nnew GithubCDKPipeline(app, {\n  stackPrefix: 'MyApp',\n  iamRoleArns: {\n    default: 'arn:aws:iam::123456789012:role/GithubDeploymentRole',\n  },\n  pkgNamespace: '@company-assemblies',\n  useGithubPackagesForAssembly: true,\n  stages: [\n    {\n      name: 'dev',\n      env: { account: '123456789013', region: 'eu-central-1' },\n    }, {\n      name: 'prod',\n      manualApproval: true,\n      env: { account: '123456789014', region: 'eu-central-1' },\n    }],\n});\n```\n\nAfter running projen (`npx projen`) a new file called `src/app.ts` will be created and contain a specialized CDK App class for your project.\n\nYou can then use this in your `main.ts` to configure your deployment.\n\n```typescript\nimport { PipelineApp } from './app';\nimport { BackendStack } from './stack';\n\nconst app = new PipelineApp({\n  provideDevStack: (scope, id, props) => {\n    return new BackendStack(scope, id, {\n      ...props,\n      apiHostname: 'api-dev',\n      myConfigSetting: 'value-for-dev',\n    });\n  },\n  provideProdStack: (scope, id, props) => {\n    return new BackendStack(scope, id, {\n      ...props,\n      apiHostname: 'api',\n      myConfigSetting: 'value-for-prod',\n    });\n  },\n  providePersonalStack: (scope, id, props) => {\n    return new BackendStack(scope, id, {\n      ...props,\n      apiHostname: `api-${props.stageName}`,\n      myConfigSetting: 'value-for-personal-stage',\n    });\n  },\n});\n\napp.synth();\n```\n\n### Drift Detection\n\nProjen Pipelines includes built-in support for automated drift detection of your CloudFormation/CDK stacks. This feature helps you identify when your deployed infrastructure has diverged from your code definitions.\n\n```typescript\nimport { GitHubDriftDetectionWorkflow } from 'projen-pipelines';\n\nnew GitHubDriftDetectionWorkflow(app, {\n  schedule: '0 0 * * *', // Daily at midnight\n  createIssues: true, // Automatically create GitHub issues\n  stages: [\n    {\n      name: 'production',\n      region: 'us-east-1',\n      roleArn: 'arn:aws:iam::123456789012:role/DriftDetectionRole',\n      failOnDrift: true,\n    },\n  ],\n});\n```\n\nSee the [drift detection documentation](docs/drift-detection.md) for detailed configuration options and examples.\n\n### Setting Up Trust Relationships Between Accounts\n\nWhen planning to manage multiple staging environments, you will need to establish trust relationships. This process centralizes deployment control, improving operational efficiency and security by consolidating deployment management through a singular, monitored channel. Here is a simplified diagram for the setup:\n\n![Trust relationship](documentation/trust.svg)\n\n#### Step 1: Bootstrapping Each Account\n\nBootstrapping initializes the AWS CDK environment in each account. It prepares the account to work with AWS CDK apps deployed from other accounts. Use the `cdk bootstrap` command for this purpose. Replace `<deployment_account_id>` with the actual AWS account ID of your deployment account.\n\nYou can use the [CloudShell](https://aws.amazon.com/cloudshell/) to bootstrap each staging account:\n\n```bash\ncdk bootstrap --trust <deployment_account_id> --cloudformation-execution-policies \"arn:aws:iam::aws:policy/AdministratorAccess\"\n```\n\n**Note:**\n\nWhile `AdministratorAccess` grants full access to all AWS services and resources, it's not recommended for production environments due to security risks. Instead, create custom IAM policies that grant only the necessary permissions required for deployment operations.\n\n### Deployment\n\nThe `<Engine>CDKPipeline` class creates and adds several tasks to the projen project that then can be used in your pipeline to deploy your application to AWS.\n\nHere's a brief description of each one:\n\n1. **deploy:personal** - This task deploys the application's personal stage, which is a distinct, isolated deployment of the application. The personal stage is intended for personal use, such as testing and development.\n\n2. **watch:personal** - This task deploys the personal stage of the application in watch mode. In this mode, the AWS CDK monitors your application source files for changes, automatically re-synthesizing and deploying when it detects any changes.\n\n3. **diff:personal** - This task compares the deployed personal stage with the current state of the application code. It's used to understand what changes would be made if the application were deployed.\n\n4. **destroy:personal** - This task destroys the resources created for the personal stage of the application.\n\n5. **deploy:feature** - This task deploys the application's feature stage. The feature stage is used for new features testing before these are merged into the main branch.\n\n6. **diff:feature** - This task is similar to `diff:personal`, but for the feature stage.\n\n7. **destroy:feature** - This task destroys the resources created for the feature stage of the application.\n\n8. **deploy:<stageName>** - This task deploys a specific stage of the application (like 'dev' or 'prod').\n\n9. **diff:<stageName>** - This task compares the specified application stage with the current state of the application code.\n\n10. **publish:assets** - This task publishes the CDK assets to all accounts. This is useful when the CDK application uses assets like Docker images or files from the S3 bucket.\n\n11. **bump** - This task bumps the version based on the latest git tag and pushes the updated tag to the git repository.\n\n12. **release:push-assembly** - This task creates a manifest, bumps the version without creating a git tag, and publishes the cloud assembly to your registry.\n\nRemember that these tasks are created and managed automatically by the `CDKPipeline` class. You can run these tasks using the `npx projen TASK_NAME` command.\n\n## Versioning\n\nProjen Pipelines includes a comprehensive versioning system that automatically tracks and exposes deployment versions through various AWS services. This feature enables deployment traceability, automated rollback decisions, and comprehensive audit trails.\n\n### Basic Versioning Configuration\n\nTo enable versioning in your pipeline, add the `versioning` configuration:\n\n```typescript\nimport { awscdk } from 'projen';\nimport { GithubCDKPipeline, VersioningStrategy, VersioningOutputs } from 'projen-pipelines';\n\nconst app = new awscdk.AwsCdkTypeScriptApp({\n  // ... other config\n});\n\nnew GithubCDKPipeline(app, {\n  // ... other pipeline config\n\n  versioning: {\n    enabled: true,\n    strategy: VersioningStrategy.commitCount(),\n    outputs: VersioningOutputs.standard()\n  }\n});\n```\n\n### Versioning Strategies\n\nProjen Pipelines provides several built-in versioning strategies:\n\n#### Git Tag Strategy\nUses git tags as the version source, with optional prefix stripping:\n\n```typescript\n// Basic git tag strategy\nconst strategy = VersioningStrategy.gitTag();\n\n// With custom configuration\nconst strategy = VersioningStrategy.gitTag({\n  stripPrefix: 'v',           // Strip 'v' from tags (v1.2.3 → 1.2.3)\n  annotatedOnly: true,        // Only use annotated tags\n  includeSinceTag: true       // Include commits since tag\n});\n```\n\n#### Package.json Strategy\nUses the version from your package.json file:\n\n```typescript\n// Basic package.json strategy\nconst strategy = VersioningStrategy.packageJson();\n\n// With custom configuration\nconst strategy = VersioningStrategy.packageJson({\n  path: './package.json',\n  includePrerelease: true,\n  appendCommitInfo: true\n});\n```\n\n#### Commit Count Strategy\nUses the number of commits as the version:\n\n```typescript\n// Basic commit count strategy\nconst strategy = VersioningStrategy.commitCount();\n\n// With custom configuration\nconst strategy = VersioningStrategy.commitCount({\n  countFrom: 'all',           // 'all' | 'since-tag'\n  includeBranch: true,        // Include branch name\n  padding: 5                  // Zero-pad count (00001)\n});\n```\n\n#### Build Number Strategy\nCreates a version from build metadata:\n\n```typescript\n// Basic build number strategy\nconst strategy = VersioningStrategy.buildNumber();\n\n// With custom configuration\nconst strategy = VersioningStrategy.buildNumber({\n  prefix: 'release',\n  commitCount: { countFrom: 'all', padding: 5 }\n});\n// Output: release-01234-3a4b5c6d\n```\n\n#### Custom Composite Strategy\nCreate your own version format using template variables:\n\n```typescript\nconst strategy = VersioningStrategy.create(\n  '{git-tag}+{commit-count}-{commit-hash:8}',\n  {\n    gitTag: { stripPrefix: 'v' },\n    commitCount: { countFrom: 'since-tag' }\n  }\n);\n// Output: 1.2.3+45-3a4b5c6d\n```\n\n### Version Output Configurations\n\nControl how and where version information is exposed:\n\n#### CloudFormation Outputs\nExport version information as CloudFormation stack outputs:\n\n```typescript\n// Basic CloudFormation output\nconst outputs = VersioningOutputs.cloudFormationOnly();\n\n// With custom configuration\nconst outputs = VersioningOutputs.cloudFormationOnly({\n  exportName: 'MyApp-{stage}-Version'\n});\n```\n\n#### SSM Parameter Store\nStore version information in AWS Systems Manager Parameter Store:\n\n```typescript\n// Basic parameter store\nconst outputs = VersioningOutputs.parameterStoreOnly('/myapp/{stage}/version');\n\n// Hierarchical parameters\nconst outputs = VersioningOutputs.hierarchicalParameters('/myapp/{stage}/version', {\n  includeCloudFormation: true\n});\n```\n\nThis creates parameters like:\n- `/myapp/prod/version` → Full version JSON\n- `/myapp/prod/version/commit` → Commit hash\n- `/myapp/prod/version/tag` → Git tag\n- `/myapp/prod/version/count` → Commit count\n\n#### Standard Configuration\nThe recommended configuration that uses CloudFormation outputs with optional Parameter Store:\n\n```typescript\nconst outputs = VersioningOutputs.standard({\n  parameterName: '/myapp/{stage}/version',\n});\n```\n\n### Output Formats\n\nVersion information can be output in two formats:\n\n**Plain Format:** Simple string values in CloudFormation\n```yaml\nOutputs:\n  AppVersion:\n    Value: \"1.2.3+45-3a4b5c6d\"\n    Description: \"Application version\"\n  AppCommitHash:\n    Value: \"3a4b5c6def1234567890\"\n    Description: \"Git commit hash\"\n```\n\n**Structured Format:** JSON object with comprehensive metadata in SSM\n```json\n{\n  \"version\": \"1.2.3\",\n  \"commitHash\": \"3a4b5c6def1234567890\",\n  \"commitCount\": 1234,\n  \"commitsSinceTag\": 45,\n  \"branch\": \"main\",\n  \"tag\": \"v1.2.3\",\n  \"deployedAt\": \"2024-01-15T10:30:00Z\",\n  \"deployedBy\": \"github-actions\",\n  \"buildNumber\": \"456\",\n  \"environment\": \"production\"\n}\n```\n\n### Stage-Specific Overrides\n\nConfigure different versioning strategies for different stages:\n\n```typescript\nnew GithubCDKPipeline(app, {\n  versioning: {\n    enabled: true,\n    strategy: VersioningStrategy.gitTag(),\n    outputs: VersioningOutputs.standard(),\n    stageOverrides: {\n      dev: {\n        strategy: VersioningStrategy.commitCount(),\n        outputs: VersioningOutputs.minimal()\n      },\n      prod: {\n        validation: {\n          requireTag: true,\n          tagPattern: /^v\\d+\\.\\d+\\.\\d+$/\n        }\n      }\n    }\n  }\n});\n```\n\n### Template Variables\n\nAll strategies support these template variables:\n- `{git-tag}` - Git tag (with optional prefix stripping)\n- `{package-version}` - Version from package.json\n- `{commit-count}` - Number of commits\n- `{commit-hash}` - Full commit hash\n- `{commit-hash:8}` - Short commit hash (8 characters)\n- `{branch}` - Git branch name\n- `{build-number}` - CI/CD build number\n\n### Benefits of Versioning\n\n1. **Deployment Traceability**: Always know exactly which code version is deployed\n2. **Automated Rollback**: Use version information for automated rollback decisions\n3. **Audit Trail**: Comprehensive deployment history with metadata\n4. **Multi-Stage Support**: Different versioning strategies per environment\n5. **Zero Configuration**: Works out-of-the-box with sensible defaults\n6. **CI/CD Integration**: Automatically detects version info from CI/CD environments\n\n### Feature Branch Deployments\n\nProjen Pipelines supports automated feature branch deployments for GitHub Actions. This allows you to deploy and test your changes in isolated environments before merging to the main branch. Gitlab support is currently missing.\n\n#### Configuration\n\nTo enable feature branch deployments, add the `featureStages` configuration to your pipeline:\n\n```typescript\nnew GithubCDKPipeline(app, {\n  stackPrefix: 'MyApp',\n  iamRoleArns: {\n    default: 'arn:aws:iam::123456789012:role/GithubDeploymentRole',\n  },\n  featureStages: {\n    env: { account: '123456789013', region: 'eu-central-1' },\n  },\n  stages: [\n    // ... your regular stages\n  ],\n});\n```\n\n#### How It Works\n\nWhen feature stages are configured, two GitHub workflows are created:\n\n1. **deploy-feature** - Automatically deploys your feature branch when a pull request is labeled with `feature-deployment`\n2. **destroy-feature** - Automatically destroys the feature deployment when:\n   - The pull request is closed\n   - The `feature-deployment` label is removed from the pull request\n\n#### Using Feature Deployments\n\n1. Create a pull request with your changes\n2. Add the `feature-deployment` label to trigger deployment\n3. The feature environment will be deployed with a stack name including your branch name\n4. Remove the label or close the PR to destroy the feature environment\n\nThe feature deployment uses the `--force` flag when destroying to ensure cleanup without manual confirmation.\n\n## Current Status\n\nProjen-Pipelines is currently in version 0.x, awaiting Projen's 1.0 release. Despite its pre-1.0 status, it's being used in several production environments.\n\n## Contributing\n\n### By raising feature requests or issues\n\nUse the Github integrated \"[Issues](https://github.com/taimos/projen-pipelines/issues/new)\" view to create an item that you would love to have added to our open source project.\n\n***No request is too big or too small*** - get your thoughts created and we'll get back to you if we have questions!\n\n### By committing code\n\nWe welcome all contributions to Projen Pipelines! Here's how you can get started:\n\n1. **Fork the Repository**: Click the 'Fork' button at the top right of this page to duplicate this repository in your GitHub account.\n\n2. **Clone your Fork**: Clone the forked repository to your local machine.\n\n```bash\ngit clone https://github.com/<your_username>/projen-pipelines.git\n```\n\n3. **Create a Branch**: To keep your work organized, create a branch for your contribution.\n\n```bash\ngit checkout -b my-branch\n```\n\n4. **Make your Changes**: Make your changes, additions, or fixes to the codebase. Remember to follow the existing code style.\n\n5. **Test your Changes**: Before committing your changes, make sure to test them to ensure they work as expected and do not introduce bugs.\n\n6. **Commit your Changes**: Commit your changes with a descriptive commit message using conventional commit messages.\n\n```bash\ngit commit -m \"feat: Your descriptive commit message\"\n```\n\n7. **Push to your Fork**: Push your commits to the branch in your forked repository.\n\n```bash\ngit push -u origin my-branch\n```\n\n8. **Submit a Pull Request**: Once your changes are ready to be reviewed, create a pull request from your forked repository's branch into the `main` branch of this repository.\n\nYour pull request will be reviewed and hopefully merged quickly. Thanks for contributing!\n\n### How to test changes?\nThe best way currently is to test things locally or - if you have a working stall of all supported CI/CD tools - manually test the functionalities there in diferent projects.\n\n_For local testing:_\nUsing `yalc push` you can install the project locally to your local yalc package manager. You can also use `npm run local-push` instead of this.\n\nWith `yalc add projen-pipelines` you can then use it in a local project.\n\n\n## Future Plans\n\n* Move the project to the Open Construct Foundation for broader community involvement\n* Continue expanding support for different CI/CD platforms and project types\n\nJoin us in elevating CI/CD pipeline discussions from implementation details to fundamental building blocks, and help create a more efficient, standardized approach to pipeline development!\n\n## Known issues\n\n### Environment variable not recognized during `npx projen`\n\nWhen attempting to run `npx projen`, users may encounter an error related to environment variable substitution within configuration files. Specifically, the `${GITHUB_TOKEN}` placeholder fails to be replaced.\n\n#### Solution\n\nTo resolve this issue, prefix the `npx projen` command with the `GITHUB_TOKEN=` environment variable:\n\n```bash\nGITHUB_TOKEN= npx projen\n```\n"
   },
   "repository": {
     "type": "git",
@@ -543,6 +544,82 @@
       "name": "BashCDKPipelineOptions",
       "symbolId": "src/awscdk/bash:BashCDKPipelineOptions"
     },
+    "projen-pipelines.BashDriftDetectionWorkflow": {
+      "assembly": "projen-pipelines",
+      "base": "projen-pipelines.DriftDetectionWorkflow",
+      "docs": {
+        "stability": "stable"
+      },
+      "fqn": "projen-pipelines.BashDriftDetectionWorkflow",
+      "initializer": {
+        "docs": {
+          "stability": "stable"
+        },
+        "locationInModule": {
+          "filename": "src/drift/bash.ts",
+          "line": 16
+        },
+        "parameters": [
+          {
+            "name": "project",
+            "type": {
+              "fqn": "projen.Project"
+            }
+          },
+          {
+            "name": "options",
+            "type": {
+              "fqn": "projen-pipelines.BashDriftDetectionWorkflowOptions"
+            }
+          }
+        ]
+      },
+      "kind": "class",
+      "locationInModule": {
+        "filename": "src/drift/bash.ts",
+        "line": 13
+      },
+      "name": "BashDriftDetectionWorkflow",
+      "symbolId": "src/drift/bash:BashDriftDetectionWorkflow"
+    },
+    "projen-pipelines.BashDriftDetectionWorkflowOptions": {
+      "assembly": "projen-pipelines",
+      "datatype": true,
+      "docs": {
+        "stability": "stable"
+      },
+      "fqn": "projen-pipelines.BashDriftDetectionWorkflowOptions",
+      "interfaces": [
+        "projen-pipelines.DriftDetectionWorkflowOptions"
+      ],
+      "kind": "interface",
+      "locationInModule": {
+        "filename": "src/drift/bash.ts",
+        "line": 5
+      },
+      "name": "BashDriftDetectionWorkflowOptions",
+      "properties": [
+        {
+          "abstract": true,
+          "docs": {
+            "default": "\"drift-detection.sh\"",
+            "stability": "stable",
+            "summary": "Path to the output script."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/drift/bash.ts",
+            "line": 10
+          },
+          "name": "scriptPath",
+          "optional": true,
+          "type": {
+            "primitive": "string"
+          }
+        }
+      ],
+      "symbolId": "src/drift/bash:BashDriftDetectionWorkflowOptions"
+    },
     "projen-pipelines.BashStepConfig": {
       "assembly": "projen-pipelines",
       "datatype": true,
@@ -2440,64 +2517,482 @@
             "summary": "Generates a configuration for a GitHub Actions step."
           },
           "locationInModule": {
-            "filename": "src/steps/artifact-steps.ts",
-            "line": 24
+            "filename": "src/steps/artifact-steps.ts",
+            "line": 24
+          },
+          "name": "toGithub",
+          "overrides": "projen-pipelines.PipelineStep",
+          "returns": {
+            "type": {
+              "fqn": "projen-pipelines.GithubStepConfig"
+            }
+          }
+        },
+        {
+          "docs": {
+            "remarks": "Should be implemented by subclasses.",
+            "stability": "stable",
+            "summary": "Generates a configuration for a GitLab CI step."
+          },
+          "locationInModule": {
+            "filename": "src/steps/artifact-steps.ts",
+            "line": 15
+          },
+          "name": "toGitlab",
+          "overrides": "projen-pipelines.PipelineStep",
+          "returns": {
+            "type": {
+              "fqn": "projen-pipelines.GitlabStepConfig"
+            }
+          }
+        }
+      ],
+      "name": "DownloadArtifactStep",
+      "symbolId": "src/steps/artifact-steps:DownloadArtifactStep"
+    },
+    "projen-pipelines.DownloadArtifactStepConfig": {
+      "assembly": "projen-pipelines",
+      "datatype": true,
+      "docs": {
+        "stability": "stable"
+      },
+      "fqn": "projen-pipelines.DownloadArtifactStepConfig",
+      "kind": "interface",
+      "locationInModule": {
+        "filename": "src/steps/artifact-steps.ts",
+        "line": 4
+      },
+      "name": "DownloadArtifactStepConfig",
+      "properties": [
+        {
+          "abstract": true,
+          "docs": {
+            "stability": "stable"
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/steps/artifact-steps.ts",
+            "line": 5
+          },
+          "name": "name",
+          "type": {
+            "primitive": "string"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "stability": "stable"
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/steps/artifact-steps.ts",
+            "line": 6
+          },
+          "name": "path",
+          "type": {
+            "primitive": "string"
+          }
+        }
+      ],
+      "symbolId": "src/steps/artifact-steps:DownloadArtifactStepConfig"
+    },
+    "projen-pipelines.DriftDetectionStageOptions": {
+      "assembly": "projen-pipelines",
+      "datatype": true,
+      "docs": {
+        "stability": "stable"
+      },
+      "fqn": "projen-pipelines.DriftDetectionStageOptions",
+      "kind": "interface",
+      "locationInModule": {
+        "filename": "src/drift/base.ts",
+        "line": 3
+      },
+      "name": "DriftDetectionStageOptions",
+      "properties": [
+        {
+          "abstract": true,
+          "docs": {
+            "stability": "stable",
+            "summary": "Name of the stage."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/drift/base.ts",
+            "line": 7
+          },
+          "name": "name",
+          "type": {
+            "primitive": "string"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "stability": "stable",
+            "summary": "AWS region for this stage."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/drift/base.ts",
+            "line": 12
+          },
+          "name": "region",
+          "type": {
+            "primitive": "string"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "stability": "stable",
+            "summary": "Environment variables for this stage."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/drift/base.ts",
+            "line": 33
+          },
+          "name": "environment",
+          "optional": true,
+          "type": {
+            "collection": {
+              "elementtype": {
+                "primitive": "string"
+              },
+              "kind": "map"
+            }
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "true",
+            "stability": "stable",
+            "summary": "Whether to fail if drift is detected."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/drift/base.ts",
+            "line": 28
+          },
+          "name": "failOnDrift",
+          "optional": true,
+          "type": {
+            "primitive": "boolean"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "stability": "stable",
+            "summary": "Role to assume for drift detection."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/drift/base.ts",
+            "line": 17
+          },
+          "name": "roleArn",
+          "optional": true,
+          "type": {
+            "primitive": "string"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "stability": "stable",
+            "summary": "Stack names to check in this stage."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/drift/base.ts",
+            "line": 22
+          },
+          "name": "stackNames",
+          "optional": true,
+          "type": {
+            "collection": {
+              "elementtype": {
+                "primitive": "string"
+              },
+              "kind": "array"
+            }
+          }
+        }
+      ],
+      "symbolId": "src/drift/base:DriftDetectionStageOptions"
+    },
+    "projen-pipelines.DriftDetectionStep": {
+      "assembly": "projen-pipelines",
+      "base": "projen-pipelines.StepSequence",
+      "docs": {
+        "stability": "stable"
+      },
+      "fqn": "projen-pipelines.DriftDetectionStep",
+      "initializer": {
+        "docs": {
+          "stability": "stable"
+        },
+        "locationInModule": {
+          "filename": "src/drift/step.ts",
+          "line": 35
+        },
+        "parameters": [
+          {
+            "docs": {
+              "summary": "- The projen project reference."
+            },
+            "name": "project",
+            "type": {
+              "fqn": "projen.Project"
+            }
+          },
+          {
+            "name": "props",
+            "type": {
+              "fqn": "projen-pipelines.DriftDetectionStepProps"
+            }
+          }
+        ]
+      },
+      "kind": "class",
+      "locationInModule": {
+        "filename": "src/drift/step.ts",
+        "line": 13
+      },
+      "name": "DriftDetectionStep",
+      "symbolId": "src/drift/step:DriftDetectionStep"
+    },
+    "projen-pipelines.DriftDetectionStepProps": {
+      "assembly": "projen-pipelines",
+      "datatype": true,
+      "docs": {
+        "stability": "stable"
+      },
+      "fqn": "projen-pipelines.DriftDetectionStepProps",
+      "interfaces": [
+        "projen-pipelines.DriftDetectionStageOptions"
+      ],
+      "kind": "interface",
+      "locationInModule": {
+        "filename": "src/drift/step.ts",
+        "line": 5
+      },
+      "name": "DriftDetectionStepProps",
+      "properties": [
+        {
+          "abstract": true,
+          "docs": {
+            "default": "30",
+            "stability": "stable",
+            "summary": "Timeout in minutes for drift detection."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/drift/step.ts",
+            "line": 10
+          },
+          "name": "timeout",
+          "optional": true,
+          "type": {
+            "primitive": "number"
+          }
+        }
+      ],
+      "symbolId": "src/drift/step:DriftDetectionStepProps"
+    },
+    "projen-pipelines.DriftDetectionWorkflow": {
+      "abstract": true,
+      "assembly": "projen-pipelines",
+      "base": "projen.Component",
+      "docs": {
+        "stability": "stable"
+      },
+      "fqn": "projen-pipelines.DriftDetectionWorkflow",
+      "initializer": {
+        "docs": {
+          "stability": "stable"
+        },
+        "locationInModule": {
+          "filename": "src/drift/base.ts",
+          "line": 77
+        },
+        "parameters": [
+          {
+            "name": "project",
+            "type": {
+              "fqn": "projen.Project"
+            }
+          },
+          {
+            "name": "options",
+            "type": {
+              "fqn": "projen-pipelines.DriftDetectionWorkflowOptions"
+            }
+          }
+        ]
+      },
+      "kind": "class",
+      "locationInModule": {
+        "filename": "src/drift/base.ts",
+        "line": 72
+      },
+      "name": "DriftDetectionWorkflow",
+      "properties": [
+        {
+          "docs": {
+            "stability": "stable"
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/drift/base.ts",
+            "line": 73
+          },
+          "name": "name",
+          "type": {
+            "primitive": "string"
+          }
+        },
+        {
+          "docs": {
+            "stability": "stable"
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/drift/base.ts",
+            "line": 74
+          },
+          "name": "schedule",
+          "type": {
+            "primitive": "string"
+          }
+        },
+        {
+          "docs": {
+            "stability": "stable"
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/drift/base.ts",
+            "line": 75
+          },
+          "name": "stages",
+          "protected": true,
+          "type": {
+            "collection": {
+              "elementtype": {
+                "fqn": "projen-pipelines.DriftDetectionStageOptions"
+              },
+              "kind": "array"
+            }
+          }
+        }
+      ],
+      "symbolId": "src/drift/base:DriftDetectionWorkflow"
+    },
+    "projen-pipelines.DriftDetectionWorkflowOptions": {
+      "assembly": "projen-pipelines",
+      "datatype": true,
+      "docs": {
+        "stability": "stable"
+      },
+      "fqn": "projen-pipelines.DriftDetectionWorkflowOptions",
+      "kind": "interface",
+      "locationInModule": {
+        "filename": "src/drift/base.ts",
+        "line": 53
+      },
+      "name": "DriftDetectionWorkflowOptions",
+      "properties": [
+        {
+          "abstract": true,
+          "docs": {
+            "stability": "stable",
+            "summary": "Drift detection configurations for different environments."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/drift/base.ts",
+            "line": 69
+          },
+          "name": "stages",
+          "type": {
+            "collection": {
+              "elementtype": {
+                "fqn": "projen-pipelines.DriftDetectionStageOptions"
+              },
+              "kind": "array"
+            }
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "\"drift-detection\"",
+            "stability": "stable",
+            "summary": "Name of the workflow."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/drift/base.ts",
+            "line": 58
           },
-          "name": "toGithub",
-          "overrides": "projen-pipelines.PipelineStep",
-          "returns": {
-            "type": {
-              "fqn": "projen-pipelines.GithubStepConfig"
-            }
+          "name": "name",
+          "optional": true,
+          "type": {
+            "primitive": "string"
           }
         },
         {
+          "abstract": true,
           "docs": {
-            "remarks": "Should be implemented by subclasses.",
+            "default": "\"0 0 * * *\" (daily at midnight)",
             "stability": "stable",
-            "summary": "Generates a configuration for a GitLab CI step."
+            "summary": "Cron schedule for drift detection."
           },
+          "immutable": true,
           "locationInModule": {
-            "filename": "src/steps/artifact-steps.ts",
-            "line": 15
+            "filename": "src/drift/base.ts",
+            "line": 64
           },
-          "name": "toGitlab",
-          "overrides": "projen-pipelines.PipelineStep",
-          "returns": {
-            "type": {
-              "fqn": "projen-pipelines.GitlabStepConfig"
-            }
+          "name": "schedule",
+          "optional": true,
+          "type": {
+            "primitive": "string"
           }
         }
       ],
-      "name": "DownloadArtifactStep",
-      "symbolId": "src/steps/artifact-steps:DownloadArtifactStep"
+      "symbolId": "src/drift/base:DriftDetectionWorkflowOptions"
     },
-    "projen-pipelines.DownloadArtifactStepConfig": {
+    "projen-pipelines.DriftErrorHandler": {
       "assembly": "projen-pipelines",
       "datatype": true,
       "docs": {
         "stability": "stable"
       },
-      "fqn": "projen-pipelines.DownloadArtifactStepConfig",
+      "fqn": "projen-pipelines.DriftErrorHandler",
       "kind": "interface",
       "locationInModule": {
-        "filename": "src/steps/artifact-steps.ts",
-        "line": 4
+        "filename": "src/drift/base.ts",
+        "line": 36
       },
-      "name": "DownloadArtifactStepConfig",
+      "name": "DriftErrorHandler",
       "properties": [
         {
           "abstract": true,
           "docs": {
-            "stability": "stable"
+            "stability": "stable",
+            "summary": "Action to take when pattern matches."
           },
           "immutable": true,
           "locationInModule": {
-            "filename": "src/steps/artifact-steps.ts",
-            "line": 5
+            "filename": "src/drift/base.ts",
+            "line": 45
           },
-          "name": "name",
+          "name": "action",
           "type": {
             "primitive": "string"
           }
@@ -2505,20 +3000,38 @@
         {
           "abstract": true,
           "docs": {
-            "stability": "stable"
+            "stability": "stable",
+            "summary": "Pattern to match stack names."
           },
           "immutable": true,
           "locationInModule": {
-            "filename": "src/steps/artifact-steps.ts",
-            "line": 6
+            "filename": "src/drift/base.ts",
+            "line": 40
           },
-          "name": "path",
+          "name": "pattern",
+          "type": {
+            "primitive": "string"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "stability": "stable",
+            "summary": "Optional message to display."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/drift/base.ts",
+            "line": 50
+          },
+          "name": "message",
+          "optional": true,
           "type": {
             "primitive": "string"
           }
         }
       ],
-      "symbolId": "src/steps/artifact-steps:DownloadArtifactStepConfig"
+      "symbolId": "src/drift/base:DriftErrorHandler"
     },
     "projen-pipelines.Environment": {
       "assembly": "projen-pipelines",
@@ -2699,6 +3212,104 @@
       ],
       "symbolId": "src/assign-approver/github:GitHubAssignApproverOptions"
     },
+    "projen-pipelines.GitHubDriftDetectionWorkflow": {
+      "assembly": "projen-pipelines",
+      "base": "projen-pipelines.DriftDetectionWorkflow",
+      "docs": {
+        "stability": "stable"
+      },
+      "fqn": "projen-pipelines.GitHubDriftDetectionWorkflow",
+      "initializer": {
+        "docs": {
+          "stability": "stable"
+        },
+        "locationInModule": {
+          "filename": "src/drift/github.ts",
+          "line": 25
+        },
+        "parameters": [
+          {
+            "name": "project",
+            "type": {
+              "fqn": "projen.Project"
+            }
+          },
+          {
+            "name": "options",
+            "type": {
+              "fqn": "projen-pipelines.GitHubDriftDetectionWorkflowOptions"
+            }
+          }
+        ]
+      },
+      "kind": "class",
+      "locationInModule": {
+        "filename": "src/drift/github.ts",
+        "line": 20
+      },
+      "name": "GitHubDriftDetectionWorkflow",
+      "symbolId": "src/drift/github:GitHubDriftDetectionWorkflow"
+    },
+    "projen-pipelines.GitHubDriftDetectionWorkflowOptions": {
+      "assembly": "projen-pipelines",
+      "datatype": true,
+      "docs": {
+        "stability": "stable"
+      },
+      "fqn": "projen-pipelines.GitHubDriftDetectionWorkflowOptions",
+      "interfaces": [
+        "projen-pipelines.DriftDetectionWorkflowOptions"
+      ],
+      "kind": "interface",
+      "locationInModule": {
+        "filename": "src/drift/github.ts",
+        "line": 7
+      },
+      "name": "GitHubDriftDetectionWorkflowOptions",
+      "properties": [
+        {
+          "abstract": true,
+          "docs": {
+            "default": "false",
+            "stability": "stable",
+            "summary": "Whether to create issues on drift detection."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/drift/github.ts",
+            "line": 17
+          },
+          "name": "createIssues",
+          "optional": true,
+          "type": {
+            "primitive": "boolean"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "stability": "stable",
+            "summary": "Additional permissions for GitHub workflow."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/drift/github.ts",
+            "line": 11
+          },
+          "name": "permissions",
+          "optional": true,
+          "type": {
+            "collection": {
+              "elementtype": {
+                "primitive": "string"
+              },
+              "kind": "map"
+            }
+          }
+        }
+      ],
+      "symbolId": "src/drift/github:GitHubDriftDetectionWorkflowOptions"
+    },
     "projen-pipelines.GitInfo": {
       "assembly": "projen-pipelines",
       "datatype": true,
@@ -2919,6 +3530,104 @@
       ],
       "symbolId": "src/versioning/types:GitInfoInput"
     },
+    "projen-pipelines.GitLabDriftDetectionWorkflow": {
+      "assembly": "projen-pipelines",
+      "base": "projen-pipelines.DriftDetectionWorkflow",
+      "docs": {
+        "stability": "stable"
+      },
+      "fqn": "projen-pipelines.GitLabDriftDetectionWorkflow",
+      "initializer": {
+        "docs": {
+          "stability": "stable"
+        },
+        "locationInModule": {
+          "filename": "src/drift/gitlab.ts",
+          "line": 23
+        },
+        "parameters": [
+          {
+            "name": "project",
+            "type": {
+              "fqn": "projen.Project"
+            }
+          },
+          {
+            "name": "options",
+            "type": {
+              "fqn": "projen-pipelines.GitLabDriftDetectionWorkflowOptions"
+            }
+          }
+        ]
+      },
+      "kind": "class",
+      "locationInModule": {
+        "filename": "src/drift/gitlab.ts",
+        "line": 18
+      },
+      "name": "GitLabDriftDetectionWorkflow",
+      "symbolId": "src/drift/gitlab:GitLabDriftDetectionWorkflow"
+    },
+    "projen-pipelines.GitLabDriftDetectionWorkflowOptions": {
+      "assembly": "projen-pipelines",
+      "datatype": true,
+      "docs": {
+        "stability": "stable"
+      },
+      "fqn": "projen-pipelines.GitLabDriftDetectionWorkflowOptions",
+      "interfaces": [
+        "projen-pipelines.DriftDetectionWorkflowOptions"
+      ],
+      "kind": "interface",
+      "locationInModule": {
+        "filename": "src/drift/gitlab.ts",
+        "line": 5
+      },
+      "name": "GitLabDriftDetectionWorkflowOptions",
+      "properties": [
+        {
+          "abstract": true,
+          "docs": {
+            "default": "\"node:18\"",
+            "stability": "stable",
+            "summary": "Docker image to use for drift detection."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/drift/gitlab.ts",
+            "line": 15
+          },
+          "name": "image",
+          "optional": true,
+          "type": {
+            "primitive": "string"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "stability": "stable",
+            "summary": "GitLab runner tags."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/drift/gitlab.ts",
+            "line": 9
+          },
+          "name": "runnerTags",
+          "optional": true,
+          "type": {
+            "collection": {
+              "elementtype": {
+                "primitive": "string"
+              },
+              "kind": "array"
+            }
+          }
+        }
+      ],
+      "symbolId": "src/drift/gitlab:GitLabDriftDetectionWorkflowOptions"
+    },
     "projen-pipelines.GitTagConfig": {
       "assembly": "projen-pipelines",
       "datatype": true,
@@ -5215,7 +5924,7 @@
         },
         "locationInModule": {
           "filename": "src/steps/step.ts",
-          "line": 171
+          "line": 176
         },
         "parameters": [
           {
@@ -5245,7 +5954,7 @@
       "kind": "class",
       "locationInModule": {
         "filename": "src/steps/step.ts",
-        "line": 170
+        "line": 175
       },
       "name": "ProjenScriptStep",
       "symbolId": "src/steps/step:ProjenScriptStep"
@@ -5265,7 +5974,7 @@
         },
         "locationInModule": {
           "filename": "src/steps/step.ts",
-          "line": 121
+          "line": 122
         },
         "parameters": [
           {
@@ -5290,6 +5999,18 @@
                 "kind": "array"
               }
             }
+          },
+          {
+            "name": "env",
+            "optional": true,
+            "type": {
+              "collection": {
+                "elementtype": {
+                  "primitive": "string"
+                },
+                "kind": "map"
+              }
+            }
           }
         ]
       },
@@ -5306,7 +6027,7 @@
           },
           "locationInModule": {
             "filename": "src/steps/step.ts",
-            "line": 141
+            "line": 143
           },
           "name": "toBash",
           "overrides": "projen-pipelines.PipelineStep",
@@ -5323,7 +6044,7 @@
           },
           "locationInModule": {
             "filename": "src/steps/step.ts",
-            "line": 161
+            "line": 166
           },
           "name": "toCodeCatalyst",
           "overrides": "projen-pipelines.PipelineStep",
@@ -5340,7 +6061,7 @@
           },
           "locationInModule": {
             "filename": "src/steps/step.ts",
-            "line": 150
+            "line": 155
           },
           "name": "toGithub",
           "overrides": "projen-pipelines.PipelineStep",
@@ -5357,7 +6078,7 @@
           },
           "locationInModule": {
             "filename": "src/steps/step.ts",
-            "line": 129
+            "line": 131
           },
           "name": "toGitlab",
           "overrides": "projen-pipelines.PipelineStep",
@@ -5388,6 +6109,25 @@
               "kind": "array"
             }
           }
+        },
+        {
+          "docs": {
+            "stability": "stable"
+          },
+          "locationInModule": {
+            "filename": "src/steps/step.ts",
+            "line": 115
+          },
+          "name": "env",
+          "protected": true,
+          "type": {
+            "collection": {
+              "elementtype": {
+                "primitive": "string"
+              },
+              "kind": "map"
+            }
+          }
         }
       ],
       "symbolId": "src/steps/step:SimpleCommandStep"
@@ -5546,7 +6286,7 @@
         },
         "locationInModule": {
           "filename": "src/steps/step.ts",
-          "line": 186
+          "line": 191
         },
         "parameters": [
           {
@@ -5577,7 +6317,7 @@
       "kind": "class",
       "locationInModule": {
         "filename": "src/steps/step.ts",
-        "line": 177
+        "line": 182
       },
       "methods": [
         {
@@ -5586,7 +6326,7 @@
           },
           "locationInModule": {
             "filename": "src/steps/step.ts",
-            "line": 271
+            "line": 276
           },
           "name": "addSteps",
           "parameters": [
@@ -5606,7 +6346,7 @@
           },
           "locationInModule": {
             "filename": "src/steps/step.ts",
-            "line": 275
+            "line": 280
           },
           "name": "prependSteps",
           "parameters": [
@@ -5627,7 +6367,7 @@
           },
           "locationInModule": {
             "filename": "src/steps/step.ts",
-            "line": 217
+            "line": 222
           },
           "name": "toBash",
           "overrides": "projen-pipelines.PipelineStep",
@@ -5644,7 +6384,7 @@
           },
           "locationInModule": {
             "filename": "src/steps/step.ts",
-            "line": 254
+            "line": 259
           },
           "name": "toCodeCatalyst",
           "overrides": "projen-pipelines.PipelineStep",
@@ -5661,7 +6401,7 @@
           },
           "locationInModule": {
             "filename": "src/steps/step.ts",
-            "line": 229
+            "line": 234
           },
           "name": "toGithub",
           "overrides": "projen-pipelines.PipelineStep",
@@ -5678,7 +6418,7 @@
           },
           "locationInModule": {
             "filename": "src/steps/step.ts",
-            "line": 194
+            "line": 199
           },
           "name": "toGitlab",
           "overrides": "projen-pipelines.PipelineStep",
@@ -5697,7 +6437,7 @@
           },
           "locationInModule": {
             "filename": "src/steps/step.ts",
-            "line": 179
+            "line": 184
           },
           "name": "steps",
           "protected": true,
@@ -7453,6 +8193,6 @@
       "symbolId": "src/versioning/types:VersioningStrategyComponents"
     }
   },
-  "version": "0.2.13",
-  "fingerprint": "ZDP/TYyy/sbBrgcPK5wYTpwBcWMLrJrNCMDH+7S77YA="
+  "version": "0.2.14",
+  "fingerprint": "vyhHYd0IBVpuIvW/a7YYcqe8tEXR+3BPadIiQn/Nj8M="
 }