chore: publish cli-integ to npm only after aws-cdk is published

.projenrc.ts

@@ -13,6 +13,7 @@ import { configureEslint } from './projenrc/eslint';
 import { IssueLabeler } from './projenrc/issue-labeler';
 import { IssueRegressionLabeler } from './projenrc/issue-regression-labeler';
 import { LargePrChecker } from './projenrc/large-pr-checker';
+import { NpmPublishAfter } from './projenrc/npm-publish-after';
 import { PrLabeler } from './projenrc/pr-labeler';
 import { RecordPublishingTimestamp } from './projenrc/record-publishing-timestamp';
 import { S3DocsPublishing } from './projenrc/s3-docs-publishing';
@@ -1794,6 +1795,10 @@ cliInteg.npmignore?.addPatterns('!resources/**/*');
 cliInteg.postCompileTask.exec('yarn-cling');
 cliInteg.gitignore.addPatterns('npm-shrinkwrap.json');
 
+// cli-integ doesn't depend on aws-cdk, but its tests run against the published CLI.
+// Don't publish it before the CLI is available.
+new NpmPublishAfter(repoProject, cliInteg, [cli]);
+
 // #endregion
 //////////////////////////////////////////////////////////////////////
 // #region shared setup

projenrc/npm-publish-after.ts

@@ -0,0 +1,41 @@
+import type { Monorepo } from 'cdklabs-projen-project-types/lib/yarn';
+import type { Project, github } from 'projen';
+import { Component } from 'projen';
+
+/**
+ * Make a package's npm publish job wait for the npm publish jobs of other packages.
+ *
+ * Release jobs are ordered by declared package dependencies. Use this for
+ * ordering that isn't expressed as a dependency.
+ */
+export class NpmPublishAfter extends Component {
+  constructor(
+    private readonly project_: Monorepo,
+    private readonly pkg: Project,
+    private readonly after: Project[],
+  ) {
+    super(project_);
+  }
+
+  public preSynthesize() {
+    const releaseWf = this.project_.github?.tryFindWorkflow('release');
+    if (!releaseWf) {
+      throw new Error('Could not find release workflow');
+    }
+
+    const jobId = npmJobId(this.pkg);
+    const job = releaseWf.getJob(jobId) as github.workflows.Job | undefined;
+    if (!job) {
+      throw new Error(`Could not find job ${jobId} in release workflow`);
+    }
+
+    releaseWf.updateJob(jobId, {
+      ...job,
+      needs: [...(job.needs ?? []), ...this.after.map(npmJobId)],
+    });
+  }
+}
+
+function npmJobId(project: Project) {
+  return `${project.name.replace('@', '').replace('/', '-')}_release_npm`;
+}