Merge branch 'main' into rds-aurora-pgsql-versions

Author: mergify[bot]

.github/workflows/codecov-collect.yml

@@ -0,0 +1,35 @@
+name: Codecov Collect
+
+on:
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  collect:
+    name: Collect Coverage
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Node
+        uses: actions/setup-node@v4
+
+      - name: Install dependencies
+        run: yarn install
+
+      - name: Build Library
+        run: npx lerna run build --scope=aws-cdk-lib
+
+      - name: Run Core tests
+        run: cd packages/aws-cdk-lib && yarn test core
+
+      - name: Upload Coverage and PR Info
+        uses: actions/upload-artifact@v4
+        with:
+          name: coverage-artifacts
+          path: |
+            packages/aws-cdk-lib/coverage/cobertura-coverage.xml

.github/workflows/codecov-upload.yml

@@ -0,0 +1,36 @@
+name: Codecov Upload
+
+on:
+  workflow_run:
+    workflows: ["Codecov Collect"]
+    types:
+      - completed
+
+permissions:
+  contents: write
+  id-token: write
+
+jobs:
+  upload:
+    name: Upload to Codecov
+    runs-on: ubuntu-latest
+    if: >
+      github.event.workflow_run.event == 'pull_request' &&
+      github.event.workflow_run.conclusion == 'success'
+
+    steps:
+      - name: Download Artifacts
+        uses: actions/download-artifact@v4
+        with:
+          name: coverage-artifacts
+          path: ./coverage
+          repository: ${{ github.repository }}
+          run-id: ${{ github.event.workflow_run.id }}
+
+      - name: Upload to Codecov
+        uses: codecov/codecov-action@v5
+        with:
+          files: ./coverage/packages/aws-cdk-lib/coverage/cobertura-coverage.xml
+          fail_ci_if_error: true
+          flags: suite.unit
+          use_oidc: true

.github/workflows/security-guardian.yml

@@ -3,21 +3,23 @@ on:
   pull_request: {}
 
 jobs:
+  log-skip:
+    if: |
+      startsWith(github.event.pull_request.title, 'chore(release):') ||
+      startsWith(github.event.pull_request.title, 'chore(merge-back):')
+    runs-on: ubuntu-latest
+    steps:
+      - run: echo "Skipping Security Guardian for release/merge-back PR"
   run-security-guardian:
+    if: |
+      !startsWith(github.event.pull_request.title, 'chore(release):') &&
+      !startsWith(github.event.pull_request.title, 'chore(merge-back):')
     runs-on: ubuntu-latest
     steps:      
-      - name: Skip check for release PRs
-        if: |
-            (
-              startsWith(github.event.pull_request.title, 'chore(release):') ||
-              startsWith(github.event.pull_request.title, 'chore(merge-back):')
-            )
-        run: echo "Skipping Security Guardian for release PR" && exit 0
-
       - name: Checkout
         uses: actions/checkout@v4
         with:
-          fetch-depth: 0  # Required to enable full git diff
+          fetch-depth: 0  
 
       - name: Install cfn-guard
         run: |

package.json

@@ -30,9 +30,9 @@
     "jsii-reflect": "1.112.0",
     "lerna": "^8.2.2",
     "nx": "^20",
-    "semver": "^7.7.1",
+    "semver": "^7.7.2",
     "standard-version": "^9.5.0",
-    "ts-jest": "^29.3.2",
+    "ts-jest": "^29.3.3",
     "ts-node": "^10.9.2",
     "typescript": "~5.5.4"
   },

packages/@aws-cdk-testing/framework-integ/package.json

@@ -30,7 +30,7 @@
   "license": "Apache-2.0",
   "devDependencies": {
     "@aws-cdk/cdk-build-tools": "0.0.0",
-    "@aws-cdk/integ-runner": "^2.186.6",
+    "@aws-cdk/integ-runner": "^2.186.7",
     "@aws-cdk/pkglint": "0.0.0",
     "@aws-sdk/client-acm": "3.632.0",
     "@aws-sdk/client-rds": "3.632.0",
@@ -47,7 +47,7 @@
     "@aws-cdk/lambda-layer-kubectl-v31": "^2.0.3",
     "@aws-cdk/lambda-layer-kubectl-v32": "^2.1.0",
     "aws-cdk-lib": "0.0.0",
-    "cdk8s": "2.69.67",
+    "cdk8s": "2.69.68",
     "cdk8s-plus-27": "2.9.5",
     "constructs": "^10.0.0"
   },