Merge remote-tracking branch 'origin/main' into regional-natgw

Author: badmintoncryer

.gitattributes

@@ -7,6 +7,7 @@
 *.zip binary
 *.png binary
 *.jpg binary
+*.tar binary
 *.tgz binary
 *.tar.gz binary
 # Hide snapshots from GitHub UI, except for the actual templates

.github/workflows/analytics-metadata-updater.yml

@@ -43,20 +43,22 @@ jobs:
 
       - name: Commit & Push changes
         if: steps.git-check.outputs.changes == 'true'
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PR_HEAD: ${{ github.event.pull_request.head.ref }}
         run: |
           git config --global user.name 'aws-cdk-automation'
           git config --global user.email 'aws-cdk-automation@users.noreply.github.com'
 
-          git fetch origin ${{ github.event.pull_request.head.ref }}
+          git fetch origin "$PR_HEAD"
 
-          if [ "$(git rev-parse HEAD)" != "$(git rev-parse origin/${{ github.event.pull_request.head.ref }})" ]; then
+          PR_HEAD_REV="$(git rev-parse origin/"$PR_HEAD")"
+          if [ "$(git rev-parse HEAD)" != "$PR_HEAD_REV" ]; then
             echo "Remote branch updated since approved commit; aborting."
             exit 1
           fi
 
-          git checkout -B ${{ github.event.pull_request.head.ref }}
+          git checkout -B "$PR_HEAD"
           git add .
           git commit -m "chore: update analytics metadata blueprints"
-          git push origin ${{ github.event.pull_request.head.ref }}
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          git push origin "$PR_HEAD"

.github/workflows/check-lfs.yml

@@ -2,6 +2,9 @@ name: Check all requires files are in LFS
 on:
   pull_request: {}
 
+permissions:
+  contents: read
+
 jobs:
   check-lfs:
     runs-on: ubuntu-latest

.github/workflows/close-stale-prs.yml

@@ -10,6 +10,7 @@ jobs:
     permissions:
       pull-requests: write
     runs-on: ubuntu-latest
+    environment: automation
     steps:
       - uses: cdklabs/close-stale-prs@main
         with:

.github/workflows/codebuild-pr-build.yml

@@ -22,6 +22,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}-${{ github.event.pull_request.number || github.run_id }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   build:
     # Runner exists only for aws-cdk repo
@@ -43,7 +46,7 @@ jobs:
           cache: "yarn"
 
       - name: Set up Docker
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
 
       - name: Load Docker images
         id: docker-cache
@@ -102,7 +105,7 @@ jobs:
 
       - name: Upload PR info artifact
         if: github.event_name == 'pull_request'
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: pr_info
           path: pr/

.github/workflows/codecov-collect.yml

@@ -28,7 +28,7 @@ jobs:
         run: cd packages/aws-cdk-lib && yarn test core
 
       - name: Upload Coverage and PR Info
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: coverage-artifacts
           path: |

.github/workflows/codecov-upload.yml

@@ -23,7 +23,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v6
       - name: Download Artifacts
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@v8
         with:
           name: coverage-artifacts
           path: ./packages/aws-cdk-lib/core/coverage

.github/workflows/enum-auto-updater.yml

@@ -23,7 +23,7 @@ jobs:
           NODE_OPTIONS: "--max-old-space-size=8196 --experimental-worker ${NODE_OPTIONS:-}"
 
       - name: Install dependencies
-        run: cd tools/@aws-cdk/enum-updater && yarn install --frozen-lockfile && yarn build
+        run: yarn install --frozen-lockfile && cd tools/@aws-cdk/enum-updater && yarn build
 
       - name: Identify Missing Values and Apply Code Changes
         run: |

.github/workflows/integration-test-deployment-auto.yml

@@ -59,7 +59,7 @@ jobs:
         id: check_team
         if: steps.check_snapshots.outputs.has_snapshots == 'true'
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_TOKEN: ${{ secrets.PROJEN_GITHUB_TOKEN }}
           APPROVER: ${{ github.event.review.user.login }}
         run: |
           # Use gh CLI to check team membership (pre-installed in GitHub Actions runners)
@@ -107,7 +107,7 @@ jobs:
             yarn.lock
 
       - name: Set up Docker
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
 
       - name: Load Docker images
         id: docker-cache
@@ -152,6 +152,6 @@ jobs:
           TARGET_BRANCH_COMMIT: ${{ github.event.pull_request.base.sha }}
           SOURCE_BRANCH_COMMIT: ${{ github.event.pull_request.head.sha }}
           # GitHub context for preflight check (validates CDK team membership)
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_TOKEN: ${{ secrets.PROJEN_GITHUB_TOKEN }}
           GITHUB_REPOSITORY: ${{ github.repository }}
           PR_NUMBER: ${{ github.event.pull_request.number }}

.github/workflows/integration-test-deployment.yml

@@ -49,7 +49,7 @@ jobs:
             yarn.lock
 
       - name: Set up Docker
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
 
       - name: Load Docker images
         id: docker-cache