From 161f88f9896f19e5c09ad4f12a6e94a1ba018c2c Mon Sep 17 00:00:00 2001
From: Eli Polonsky <epolon@amazon.com>
Date: Mon, 26 Oct 2026 20:58:24 +0200
Subject: [PATCH 1/2] chore: publish cli-integ to npm only after aws-cdk is
 published

`@aws-cdk-testing/cli-integ` doesn't depend on `aws-cdk`, so its npm publish
job could run before the CLI is available on npm, and consumers could pick up
tests that won't pass against the published CLI.

Add a `NpmPublishAfter` projen component that adds other packages' npm publish
jobs to a package's publish job `needs`, and use it to order cli-integ after
aws-cdk.
---
 .github/workflows/release.yml |  4 +++-
 .projenrc.ts                  |  5 +++++
 projenrc/npm-publish-after.ts | 41 +++++++++++++++++++++++++++++++++++
 3 files changed, 49 insertions(+), 1 deletion(-)
 create mode 100644 projenrc/npm-publish-after.ts

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 1eb22a085..7760c8ea4 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -1624,7 +1624,9 @@ jobs:
           gh release create "$tag" -R "$GITHUB_REPOSITORY" -F "$CHANGELOG_FILE" -t "$tag" --target "$GITHUB_SHA"
   aws-cdk-testing-cli-integ_release_npm:
     name: "@aws-cdk-testing/cli-integ: Publish to npm"
-    needs: aws-cdk-testing-cli-integ_release
+    needs:
+      - aws-cdk-testing-cli-integ_release
+      - aws-cdk_release_npm
     runs-on: ubuntu-latest
     permissions:
       id-token: write
diff --git a/.projenrc.ts b/.projenrc.ts
index c13731041..b8e041399 100644
--- a/.projenrc.ts
+++ b/.projenrc.ts
@@ -14,6 +14,7 @@ import { IssueLabeler } from './projenrc/issue-labeler';
 import { IssueRegressionLabeler } from './projenrc/issue-regression-labeler';
 import { LargePrChecker } from './projenrc/large-pr-checker';
 import { PrLabeler } from './projenrc/pr-labeler';
+import { NpmPublishAfter } from './projenrc/npm-publish-after';
 import { RecordPublishingTimestamp } from './projenrc/record-publishing-timestamp';
 import { S3DocsPublishing } from './projenrc/s3-docs-publishing';
 import { SelfMutationOnForks } from './projenrc/SelfMutationOnForks';
@@ -1794,6 +1795,10 @@ cliInteg.npmignore?.addPatterns('!resources/**/*');
 cliInteg.postCompileTask.exec('yarn-cling');
 cliInteg.gitignore.addPatterns('npm-shrinkwrap.json');
 
+// cli-integ doesn't depend on aws-cdk, but its tests run against the published CLI.
+// Don't publish it before the CLI is available.
+new NpmPublishAfter(repoProject, cliInteg, [cli]);
+
 // #endregion
 //////////////////////////////////////////////////////////////////////
 // #region shared setup
diff --git a/projenrc/npm-publish-after.ts b/projenrc/npm-publish-after.ts
new file mode 100644
index 000000000..34af82548
--- /dev/null
+++ b/projenrc/npm-publish-after.ts
@@ -0,0 +1,41 @@
+import type { Monorepo } from 'cdklabs-projen-project-types/lib/yarn';
+import type { Project } from 'projen';
+import { Component, github } from 'projen';
+
+/**
+ * Make a package's npm publish job wait for the npm publish jobs of other packages.
+ *
+ * Release jobs are ordered by declared package dependencies. Use this for
+ * ordering that isn't expressed as a dependency.
+ */
+export class NpmPublishAfter extends Component {
+  constructor(
+    private readonly project_: Monorepo,
+    private readonly pkg: Project,
+    private readonly after: Project[],
+  ) {
+    super(project_);
+  }
+
+  public preSynthesize() {
+    const releaseWf = this.project_.github?.tryFindWorkflow('release');
+    if (!releaseWf) {
+      throw new Error('Could not find release workflow');
+    }
+
+    const jobId = npmJobId(this.pkg);
+    const job = releaseWf.getJob(jobId) as github.workflows.Job | undefined;
+    if (!job) {
+      throw new Error(`Could not find job ${jobId} in release workflow`);
+    }
+
+    releaseWf.updateJob(jobId, {
+      ...job,
+      needs: [...(job.needs ?? []), ...this.after.map(npmJobId)],
+    });
+  }
+}
+
+function npmJobId(project: Project) {
+  return `${project.name.replace('@', '').replace('/', '-')}_release_npm`;
+}

From 7801af1dd20d5f7a546292f1429fa00faff657fd Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Mon, 26 Oct 2026 19:34:33 +0000
Subject: [PATCH 2/2] chore: self mutation

Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
---
 .projenrc.ts                  | 2 +-
 projenrc/npm-publish-after.ts | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/.projenrc.ts b/.projenrc.ts
index b8e041399..919894170 100644
--- a/.projenrc.ts
+++ b/.projenrc.ts
@@ -13,8 +13,8 @@ import { configureEslint } from './projenrc/eslint';
 import { IssueLabeler } from './projenrc/issue-labeler';
 import { IssueRegressionLabeler } from './projenrc/issue-regression-labeler';
 import { LargePrChecker } from './projenrc/large-pr-checker';
-import { PrLabeler } from './projenrc/pr-labeler';
 import { NpmPublishAfter } from './projenrc/npm-publish-after';
+import { PrLabeler } from './projenrc/pr-labeler';
 import { RecordPublishingTimestamp } from './projenrc/record-publishing-timestamp';
 import { S3DocsPublishing } from './projenrc/s3-docs-publishing';
 import { SelfMutationOnForks } from './projenrc/SelfMutationOnForks';
diff --git a/projenrc/npm-publish-after.ts b/projenrc/npm-publish-after.ts
index 34af82548..fa3e63ad5 100644
--- a/projenrc/npm-publish-after.ts
+++ b/projenrc/npm-publish-after.ts
@@ -1,6 +1,6 @@
 import type { Monorepo } from 'cdklabs-projen-project-types/lib/yarn';
-import type { Project } from 'projen';
-import { Component, github } from 'projen';
+import type { Project, github } from 'projen';
+import { Component } from 'projen';
 
 /**
  * Make a package's npm publish job wait for the npm publish jobs of other packages.