Merge branch 'main' into move-by-id

.github/workflows/build.yml

@@ -22,7 +22,7 @@ jobs:
     timeout-minutes: 60
 
     steps:
-      - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
       - name: "Add Git safe.directory" # Go 1.18+ started embedding repo info in the build and e.g. building @cdktf/hcl2json fails without this
         run: git config --global --add safe.directory /__w/terraform-cdk/terraform-cdk
       - name: ensure correct user

.github/workflows/cdktf-provider-docs-rollout.yml

@@ -53,7 +53,7 @@ jobs:
       languages: "typescript,python"
       parallelFileConversions: 1
       maxRunners: 20
-      cdktfRegistryDocsVersion: "1.16.1"
+      cdktfRegistryDocsVersion: "1.17.0"
       additionalProviderFqns: ${{ matrix.provider.additionalProviderFqns }}
 
   reportFailureToSlack:

.github/workflows/docker.yml

@@ -9,13 +9,14 @@ on:
       - "website/**"
       - "cdk.tf/**"
       - "tools/update-github-project-board/**"
+  workflow_dispatch: {}
 
 jobs:
   build-docker-image:
     if: github.repository == 'hashicorp/terraform-cdk'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@f95db51fddba0c2d1ec667646a06c2ce06100226 # v3.0.0
       - name: Cache Docker layers
@@ -36,12 +37,20 @@ jobs:
           AVAILABLE_TERRAFORM_VERSIONS=$(cat .terraform.versions.json | jq -r '.available | join(" ")')
           echo "default=$DEFAULT_TERRAFORM_VERSION" >> $GITHUB_OUTPUT
           echo "available=$AVAILABLE_TERRAFORM_VERSIONS" >> $GITHUB_OUTPUT
+      - id: cdktf-version
+        run: |
+          CDKTF_VERSION=$(cat package.json | jq -r '.version')
+          echo "cdktf=$CDKTF_VERSION" >> $GITHUB_OUTPUT
+      - id: git-sha
+        run: |
+          GIT_SHA=$(git rev-parse HEAD)
+          echo "git-sha=$GIT_SHA" >> $GITHUB_OUTPUT
       - name: Build and push
         uses: docker/build-push-action@0565240e2d4ab88bba5387d719585280857ece09 # v5.0.0
         with:
           pull: true
           push: true
-          tags: hashicorp/jsii-terraform:latest
+          tags: hashicorp/jsii-terraform:latest,hashicorp/jsii-terraform:${{ steps.cdktf-version.outputs.cdktf }},hashicorp/jsii-terraform:${{ steps.cdktf-version.outputs.cdktf }}-${{ steps.git-sha.outputs.git-sha }}
           cache-from: type=local,src=/tmp/.buildx-cache
           cache-to: type=local,dest=/tmp/.buildx-cache
           build-args: |

.github/workflows/examples-pr.yml

@@ -1,5 +1,7 @@
 name: Examples - PR
 on:
+  merge_group:
+    types: [checks_requested]
   pull_request:
     types:
       - opened
@@ -11,7 +13,8 @@ on:
 
 jobs:
   examples:
-    if: ${{ contains(github.event.pull_request.labels.*.name, 'ci/run-examples') || contains(github.event.pull_request.labels.*.name, 'ci/run-all') }}
+    name: "Examples Integration Test - PR"
+    if: ${{ !contains(github.event.pull_request.labels.*.name, 'ci/skip-examples') && !contains(github.event.pull_request.labels.*.name, 'ci/unit-only') }}
     uses: ./.github/workflows/examples.yml
     with:
       concurrency_group_prefix: pr

.github/workflows/examples.yml

@@ -24,7 +24,7 @@ jobs:
       examples: ${{ steps.set-examples.outputs.examples }}
     steps:
       - name: Checkout
-        uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
       - id: set-examples
         run: |
           tfDefault=$(cat .terraform.versions.json | jq -r '.default')
@@ -45,7 +45,7 @@ jobs:
       CHECKPOINT_DISABLE: "1"
     timeout-minutes: 60
     steps:
-      - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
       - name: "Add Git safe.directory" # Go 1.18+ started embedding repo info in the build and e.g. building @cdktf/hcl2json fails without this
         run: git config --global --add safe.directory /__w/terraform-cdk/terraform-cdk
       - name: ensure correct user

.github/workflows/integration.yml

@@ -28,7 +28,7 @@ jobs:
     timeout-minutes: 60
 
     steps:
-      - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
       - name: "Add Git safe.directory" # Go 1.18+ started embedding repo info in the build and e.g. building @cdktf/hcl2json fails without this
         run: git config --global --add safe.directory /__w/terraform-cdk/terraform-cdk
       - name: ensure correct user
@@ -102,7 +102,7 @@ jobs:
     timeout-minutes: 60
 
     steps:
-      - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
       - name: ensure correct user
         run: chown -R root /__w/terraform-cdk
       # Setup caches for yarn, terraform, and go
@@ -176,7 +176,7 @@ jobs:
     timeout-minutes: 60
 
     steps:
-      - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
       # Setup caches for yarn, terraform, and go
       - name: Get cache directory paths
         id: global-cache-dir-path

.github/workflows/linting.yml

@@ -18,7 +18,7 @@ jobs:
   prettier:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
       - name: installing dependencies
         run: |
           yarn install --frozen-lockfile
@@ -29,7 +29,7 @@ jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
       - name: installing dependencies
         run: |
           yarn install --frozen-lockfile

.github/workflows/pr-copyright.yml

@@ -18,7 +18,7 @@ jobs:
       contents: write
     steps:
       - name: Checkout
-        uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
         with:
           ref: ${{ github.event.pull_request.head.ref }}
           repository: ${{ github.event.pull_request.head.repo.full_name }}

.github/workflows/pr-depcheck.yml

@@ -0,0 +1,34 @@
+name: Depcheck
+on:
+  merge_group:
+    types: [checks_requested]
+  pull_request:
+    branches:
+      - main
+jobs:
+  depcheck:
+    runs-on: ubuntu-latest
+    container:
+      image: docker.mirror.hashicorp.services/hashicorp/jsii-terraform
+    env:
+      CHECKPOINT_DISABLE: "1"
+    timeout-minutes: 60
+    strategy:
+      fail-fast: false
+      matrix:
+        package: [
+            cdktf,
+            # cdktf-cli,
+            "@cdktf/hcl2json",
+            "@cdktf/hcl2cdk",
+            "@cdktf/provider-schema",
+            "@cdktf/provider-generator",
+            "@cdktf/commons",
+            # "@cdktf/cli-core",
+          ]
+
+    steps:
+      - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
+      - name: "Run Depcheck"
+        run: |
+          npx lerna exec --scope '${{ matrix.package }}' -- npx -y depcheck --ignores="@types/*,jsii,jsii-pacmak,jsii-srcmak,jsii-docgen,yoga-layout-prebuilt,eslint,jest,tsc-files,typescript,esbuild,esbuild-jest,graphology-types"

.github/workflows/pr-integration.yml

@@ -1,5 +1,7 @@
 name: Integration Tests - PR
 on:
+  merge_group:
+    types: [checks_requested]
   pull_request:
     types:
       - opened
@@ -11,7 +13,8 @@ on:
 
 jobs:
   integration_test:
-    if: ${{ contains(github.event.pull_request.labels.*.name, 'ci/run-integration') || contains(github.event.pull_request.labels.*.name, 'ci/run-all') }}
+    name: "Integration Tests - PR"
+    if: ${{ !contains(github.event.pull_request.labels.*.name, 'ci/skip-integration') && !contains(github.event.pull_request.labels.*.name, 'ci/unit-only') }}
     uses: ./.github/workflows/integration.yml
     with:
       concurrency_group_prefix: pr

.github/workflows/pr-lint.yml

@@ -12,6 +12,7 @@ on:
 
 jobs:
   lintPr:
+    name: "Lint PR"
     runs-on: ubuntu-latest
     steps:
       # Please look up the latest version from

.github/workflows/pr-provider-integration.yml

@@ -1,5 +1,7 @@
 name: Provider Integration Tests - PR
 on:
+  merge_group:
+    types: [checks_requested]
   pull_request:
     types:
       - opened
@@ -11,7 +13,8 @@ on:
 
 jobs:
   provider_integration_test:
-    if: ${{ contains(github.event.pull_request.labels.*.name, 'ci/provider-integration') || contains(github.event.pull_request.labels.*.name, 'ci/run-all') }}
+    name: "Provider Integration Tests - PR"
+    if: ${{ !contains(github.event.pull_request.labels.*.name, 'ci/skip-provider-integration') && !contains(github.event.pull_request.labels.*.name, 'ci/unit-only') }}
     uses: ./.github/workflows/provider-integration.yml
     with:
       concurrency_group_prefix: pr

.github/workflows/pr-unit.yml

@@ -13,6 +13,7 @@ on:
 
 jobs:
   all_unit_tests:
+    name: "All Unit Tests"
     if: ${{ contains(github.event.pull_request.labels.*.name, 'ci/run-unit') || contains(github.event.pull_request.labels.*.name, 'ci/run-all') }}
     uses: ./.github/workflows/unit.yml
     strategy:
@@ -24,6 +25,7 @@ jobs:
             cdktf-cli,
             "@cdktf/hcl2cdk",
             "@cdktf/hcl2json",
+            "@cdktf/provider-schema",
             "@cdktf/provider-generator",
             "@cdktf/commons",
             "@cdktf/cli-core",
@@ -36,6 +38,7 @@ jobs:
     secrets: inherit
 
   cdktf_cli_core:
+    name: "@cdktf/cli Unit Tests"
     if: ${{ contains(github.event.pull_request.labels.*.name, 'ci/run-unit/@cdktf/cli-core') }}
     uses: ./.github/workflows/unit.yml
     strategy:
@@ -49,6 +52,7 @@ jobs:
     secrets: inherit
 
   cdktf_commons:
+    name: "@cdktf/commons Unit Tests"
     if: ${{ contains(github.event.pull_request.labels.*.name, 'ci/run-unit/@cdktf/commons') }}
     uses: ./.github/workflows/unit.yml
     strategy:
@@ -62,6 +66,7 @@ jobs:
     secrets: inherit
 
   cdktf_hcl2cdk:
+    name: "@cdktf/hcl2cdk Unit Tests"
     if: ${{ contains(github.event.pull_request.labels.*.name, 'ci/run-unit/@cdktf/hcl2cdk') }}
     uses: ./.github/workflows/unit.yml
     strategy:
@@ -75,6 +80,7 @@ jobs:
     secrets: inherit
 
   cdktf_hcl2json:
+    name: "@cdktf/hcl2json Unit Tests"
     if: ${{ contains(github.event.pull_request.labels.*.name, 'ci/run-unit/@cdktf/hcl2json') }}
     uses: ./.github/workflows/unit.yml
     strategy:
@@ -88,6 +94,7 @@ jobs:
     secrets: inherit
 
   cdktf_provider_generator:
+    name: "@cdktf/provider-generator Unit Tests"
     if: ${{ contains(github.event.pull_request.labels.*.name, 'ci/run-unit/@cdktf/provider-generator') }}
     uses: ./.github/workflows/unit.yml
     strategy:
@@ -101,6 +108,7 @@ jobs:
     secrets: inherit
 
   cdktf_cli:
+    name: "cdktf-cli Unit Tests"
     if: ${{ contains(github.event.pull_request.labels.*.name, 'ci/run-unit/cdktf-cli') }}
     uses: ./.github/workflows/unit.yml
     strategy:
@@ -114,6 +122,7 @@ jobs:
     secrets: inherit
 
   cdktf:
+    name: "cdktf Unit Tests"
     if: ${{ contains(github.event.pull_request.labels.*.name, 'ci/run-unit/cdktf') }}
     uses: ./.github/workflows/unit.yml
     strategy:

.github/workflows/provider-integration.yml

@@ -33,7 +33,7 @@ jobs:
     timeout-minutes: 60
 
     steps:
-      - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
       - name: "Add Git safe.directory" # Go 1.18+ started embedding repo info in the build and e.g. building @cdktf/hcl2json fails without this
         run: git config --global --add safe.directory /__w/terraform-cdk/terraform-cdk
       - name: ensure correct user
@@ -96,7 +96,7 @@ jobs:
     timeout-minutes: 60
 
     steps:
-      - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
       - name: Download dist
         uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2
         with:
@@ -146,7 +146,7 @@ jobs:
     timeout-minutes: 60
 
     steps:
-      - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
       - name: HashiCorp - Setup Terraform
         uses: hashicorp/setup-terraform@633666f66e0061ca3b725c73b2ec20cd13a8fdd1
         with:

.github/workflows/registry-docs-pr-based.yml

@@ -58,7 +58,7 @@ on:
       cdktfRegistryDocsVersion:
         description: "Version of cdktf-registry-docs to use"
         required: false
-        default: "1.16.1"
+        default: "1.18.0"
         type: string
     secrets:
       GH_PR_TOKEN:
@@ -74,7 +74,7 @@ jobs:
   cdktfDocsSetupBranch:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
         with:
           repository: ${{ inputs.repository }}
           ref: ${{ inputs.branch }}
@@ -96,14 +96,14 @@ jobs:
       CHECKPOINT_DISABLE: "1"
     timeout-minutes: 120
     steps:
-      - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
         with:
           repository: ${{ inputs.repository }}
           ref: ${{ inputs.branch }}
           token: ${{ secrets.GH_PR_TOKEN }}
 
       - name: Setup Node.js
-        uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3.8.1
+        uses: actions/setup-node@8f152de45cc393bb48ce5d89d36b731f54556e65 # v4.0.0
         with:
           node-version: "18.x"
 
@@ -136,7 +136,7 @@ jobs:
       CHECKPOINT_DISABLE: "1"
     timeout-minutes: 120
     steps:
-      - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
         with:
           repository: ${{ inputs.repository }}
           ref: ${{ inputs.branch }}
@@ -148,7 +148,7 @@ jobs:
           git config --global --add safe.directory $(pwd)
 
       - name: Setup Node.js
-        uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3.8.1
+        uses: actions/setup-node@8f152de45cc393bb48ce5d89d36b731f54556e65 # v4.0.0
         with:
           node-version: "18.x"
 
@@ -201,7 +201,7 @@ jobs:
       - cdktfDocsConvert
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
         with:
           repository: ${{ inputs.repository }}
           fetch-depth: 0 # complete checkout