# API Reference
## Structs
### CdkDiffIamTemplateGeneratorProps
Props for generating CDK Diff IAM templates (no Projen dependency).
#### Initializer
```typescript
import { CdkDiffIamTemplateGeneratorProps } from '@jjrawlins/cdk-diff-pr-github-action'
const cdkDiffIamTemplateGeneratorProps: CdkDiffIamTemplateGeneratorProps = { ... }
```
#### Properties
| **Name** | **Type** | **Description** |
| --- | --- | --- |
| roleName | string | Name for the changeset IAM role. |
| createOidcRole | boolean | Create a GitHub OIDC role within this template instead of using an existing one. |
| githubOidc | GitHubOidcConfig | GitHub OIDC configuration for repo/branch restrictions. |
| oidcRegion | string | Region for the OIDC trust condition. |
| oidcRoleArn | string | ARN of the existing GitHub OIDC role that can assume this changeset role. |
| oidcRoleName | string | Name of the GitHub OIDC role to create. |
| skipOidcProviderCreation | boolean | Skip creating the OIDC provider (use existing one). |
---
##### `roleName`Required
```typescript
public readonly roleName: string;
```
- *Type:* string
Name for the changeset IAM role.
---
##### `createOidcRole`Optional
```typescript
public readonly createOidcRole: boolean;
```
- *Type:* boolean
Create a GitHub OIDC role within this template instead of using an existing one.
When true, githubOidc configuration is required and oidcRoleArn is ignored.
Default: false
---
##### `githubOidc`Optional
```typescript
public readonly githubOidc: GitHubOidcConfig;
```
- *Type:* GitHubOidcConfig
GitHub OIDC configuration for repo/branch restrictions.
Required when createOidcRole is true.
---
##### `oidcRegion`Optional
```typescript
public readonly oidcRegion: string;
```
- *Type:* string
Region for the OIDC trust condition.
Only used when oidcRoleArn is provided (external OIDC role).
---
##### `oidcRoleArn`Optional
```typescript
public readonly oidcRoleArn: string;
```
- *Type:* string
ARN of the existing GitHub OIDC role that can assume this changeset role.
Required when createOidcRole is false or undefined.
---
##### `oidcRoleName`Optional
```typescript
public readonly oidcRoleName: string;
```
- *Type:* string
Name of the GitHub OIDC role to create.
Only used when createOidcRole is true.
Default: 'GitHubOIDCRole'
---
##### `skipOidcProviderCreation`Optional
```typescript
public readonly skipOidcProviderCreation: boolean;
```
- *Type:* boolean
Skip creating the OIDC provider (use existing one).
Set to true if the account already has a GitHub OIDC provider.
Only used when createOidcRole is true.
Default: false
---
### CdkDiffIamTemplateProps
Props for the Projen-integrated CDK Diff IAM template construct.
#### Initializer
```typescript
import { CdkDiffIamTemplateProps } from '@jjrawlins/cdk-diff-pr-github-action'
const cdkDiffIamTemplateProps: CdkDiffIamTemplateProps = { ... }
```
#### Properties
| **Name** | **Type** | **Description** |
| --- | --- | --- |
| roleName | string | Name for the changeset IAM role. |
| createOidcRole | boolean | Create a GitHub OIDC role within this template instead of using an existing one. |
| githubOidc | GitHubOidcConfig | GitHub OIDC configuration for repo/branch restrictions. |
| oidcRegion | string | Region for the OIDC trust condition. |
| oidcRoleArn | string | ARN of the existing GitHub OIDC role that can assume this changeset role. |
| oidcRoleName | string | Name of the GitHub OIDC role to create. |
| skipOidcProviderCreation | boolean | Skip creating the OIDC provider (use existing one). |
| project | any | Projen project instance. |
| outputPath | string | Output path for the template file (default: 'cdk-diff-workflow-iam-template.yaml'). |
---
##### `roleName`Required
```typescript
public readonly roleName: string;
```
- *Type:* string
Name for the changeset IAM role.
---
##### `createOidcRole`Optional
```typescript
public readonly createOidcRole: boolean;
```
- *Type:* boolean
Create a GitHub OIDC role within this template instead of using an existing one.
When true, githubOidc configuration is required and oidcRoleArn is ignored.
Default: false
---
##### `githubOidc`Optional
```typescript
public readonly githubOidc: GitHubOidcConfig;
```
- *Type:* GitHubOidcConfig
GitHub OIDC configuration for repo/branch restrictions.
Required when createOidcRole is true.
---
##### `oidcRegion`Optional
```typescript
public readonly oidcRegion: string;
```
- *Type:* string
Region for the OIDC trust condition.
Only used when oidcRoleArn is provided (external OIDC role).
---
##### `oidcRoleArn`Optional
```typescript
public readonly oidcRoleArn: string;
```
- *Type:* string
ARN of the existing GitHub OIDC role that can assume this changeset role.
Required when createOidcRole is false or undefined.
---
##### `oidcRoleName`Optional
```typescript
public readonly oidcRoleName: string;
```
- *Type:* string
Name of the GitHub OIDC role to create.
Only used when createOidcRole is true.
Default: 'GitHubOIDCRole'
---
##### `skipOidcProviderCreation`Optional
```typescript
public readonly skipOidcProviderCreation: boolean;
```
- *Type:* boolean
Skip creating the OIDC provider (use existing one).
Set to true if the account already has a GitHub OIDC provider.
Only used when createOidcRole is true.
Default: false
---
##### `project`Required
```typescript
public readonly project: any;
```
- *Type:* any
Projen project instance.
---
##### `outputPath`Optional
```typescript
public readonly outputPath: string;
```
- *Type:* string
Output path for the template file (default: 'cdk-diff-workflow-iam-template.yaml').
---
### CdkDiffIamTemplateStackSetCommandsProps
Props for generating StackSet CLI commands (no Projen dependency).
#### Initializer
```typescript
import { CdkDiffIamTemplateStackSetCommandsProps } from '@jjrawlins/cdk-diff-pr-github-action'
const cdkDiffIamTemplateStackSetCommandsProps: CdkDiffIamTemplateStackSetCommandsProps = { ... }
```
#### Properties
| **Name** | **Type** | **Description** |
| --- | --- | --- |
| autoDeployment | StackSetAutoDeployment | Auto-deployment configuration. |
| delegatedAdmin | boolean | Whether to use delegated admin mode for StackSet operations. |
| regions | string[] | Target regions for deployment (e.g., ['us-east-1', 'eu-west-1']). |
| stackSetName | string | Name of the StackSet (default: 'cdk-diff-workflow-iam-stackset'). |
| targetOrganizationalUnitIds | string[] | Target OUs for deployment (e.g., ['ou-xxxx-xxxxxxxx', 'r-xxxx']). |
| templatePath | string | Path to the template file (default: 'cdk-diff-workflow-stackset-template.yaml'). |
---
##### `autoDeployment`Optional
```typescript
public readonly autoDeployment: StackSetAutoDeployment;
```
- *Type:* StackSetAutoDeployment
Auto-deployment configuration.
---
##### `delegatedAdmin`Optional
```typescript
public readonly delegatedAdmin: boolean;
```
- *Type:* boolean
Whether to use delegated admin mode for StackSet operations.
If true, adds --call-as DELEGATED_ADMIN to commands.
Default: true
---
##### `regions`Optional
```typescript
public readonly regions: string[];
```
- *Type:* string[]
Target regions for deployment (e.g., ['us-east-1', 'eu-west-1']).
---
##### `stackSetName`Optional
```typescript
public readonly stackSetName: string;
```
- *Type:* string
Name of the StackSet (default: 'cdk-diff-workflow-iam-stackset').
---
##### `targetOrganizationalUnitIds`Optional
```typescript
public readonly targetOrganizationalUnitIds: string[];
```
- *Type:* string[]
Target OUs for deployment (e.g., ['ou-xxxx-xxxxxxxx', 'r-xxxx']).
---
##### `templatePath`Optional
```typescript
public readonly templatePath: string;
```
- *Type:* string
Path to the template file (default: 'cdk-diff-workflow-stackset-template.yaml').
---
### CdkDiffIamTemplateStackSetGeneratorProps
Props for generating StackSet templates (no Projen dependency).
#### Initializer
```typescript
import { CdkDiffIamTemplateStackSetGeneratorProps } from '@jjrawlins/cdk-diff-pr-github-action'
const cdkDiffIamTemplateStackSetGeneratorProps: CdkDiffIamTemplateStackSetGeneratorProps = { ... }
```
#### Properties
| **Name** | **Type** | **Description** |
| --- | --- | --- |
| githubOidc | GitHubOidcConfig | GitHub OIDC configuration for repo/branch restrictions. |
| changesetRoleName | string | Name of the CdkChangesetRole (default: 'CdkChangesetRole'). |
| description | string | Description for the StackSet. |
| driftRoleName | string | Name of the CdkDriftRole (default: 'CdkDriftRole'). |
| oidcRoleName | string | Name of the GitHub OIDC role (default: 'GitHubOIDCRole'). |
| roleSelection | StackSetRoleSelection | Which roles to include (default: BOTH). |
| skipOidcProviderCreation | boolean | Skip creating the OIDC provider (use existing one). |
---
##### `githubOidc`Required
```typescript
public readonly githubOidc: GitHubOidcConfig;
```
- *Type:* GitHubOidcConfig
GitHub OIDC configuration for repo/branch restrictions.
---
##### `changesetRoleName`Optional
```typescript
public readonly changesetRoleName: string;
```
- *Type:* string
Name of the CdkChangesetRole (default: 'CdkChangesetRole').
---
##### `description`Optional
```typescript
public readonly description: string;
```
- *Type:* string
Description for the StackSet.
---
##### `driftRoleName`Optional
```typescript
public readonly driftRoleName: string;
```
- *Type:* string
Name of the CdkDriftRole (default: 'CdkDriftRole').
---
##### `oidcRoleName`Optional
```typescript
public readonly oidcRoleName: string;
```
- *Type:* string
Name of the GitHub OIDC role (default: 'GitHubOIDCRole').
---
##### `roleSelection`Optional
```typescript
public readonly roleSelection: StackSetRoleSelection;
```
- *Type:* StackSetRoleSelection
Which roles to include (default: BOTH).
---
##### `skipOidcProviderCreation`Optional
```typescript
public readonly skipOidcProviderCreation: boolean;
```
- *Type:* boolean
Skip creating the OIDC provider (use existing one).
Set to true if accounts already have a GitHub OIDC provider.
The template will reference the existing provider by ARN.
Default: false
---
### CdkDiffIamTemplateStackSetProps
Props for the Projen-integrated StackSet construct.
#### Initializer
```typescript
import { CdkDiffIamTemplateStackSetProps } from '@jjrawlins/cdk-diff-pr-github-action'
const cdkDiffIamTemplateStackSetProps: CdkDiffIamTemplateStackSetProps = { ... }
```
#### Properties
| **Name** | **Type** | **Description** |
| --- | --- | --- |
| githubOidc | GitHubOidcConfig | GitHub OIDC configuration for repo/branch restrictions. |
| changesetRoleName | string | Name of the CdkChangesetRole (default: 'CdkChangesetRole'). |
| description | string | Description for the StackSet. |
| driftRoleName | string | Name of the CdkDriftRole (default: 'CdkDriftRole'). |
| oidcRoleName | string | Name of the GitHub OIDC role (default: 'GitHubOIDCRole'). |
| roleSelection | StackSetRoleSelection | Which roles to include (default: BOTH). |
| skipOidcProviderCreation | boolean | Skip creating the OIDC provider (use existing one). |
| project | any | Projen project instance. |
| autoDeployment | StackSetAutoDeployment | Auto-deployment configuration. |
| delegatedAdmin | boolean | Whether to use delegated admin mode for StackSet operations. |
| outputPath | string | Output path for the template file (default: 'cdk-diff-workflow-stackset-template.yaml'). |
| regions | string[] | Target regions for deployment (e.g., ['us-east-1', 'eu-west-1']). |
| stackSetName | string | Name of the StackSet (default: 'cdk-diff-workflow-iam-stackset'). |
| targetOrganizationalUnitIds | string[] | Target OUs for deployment (e.g., ['ou-xxxx-xxxxxxxx', 'r-xxxx']). |
---
##### `githubOidc`Required
```typescript
public readonly githubOidc: GitHubOidcConfig;
```
- *Type:* GitHubOidcConfig
GitHub OIDC configuration for repo/branch restrictions.
---
##### `changesetRoleName`Optional
```typescript
public readonly changesetRoleName: string;
```
- *Type:* string
Name of the CdkChangesetRole (default: 'CdkChangesetRole').
---
##### `description`Optional
```typescript
public readonly description: string;
```
- *Type:* string
Description for the StackSet.
---
##### `driftRoleName`Optional
```typescript
public readonly driftRoleName: string;
```
- *Type:* string
Name of the CdkDriftRole (default: 'CdkDriftRole').
---
##### `oidcRoleName`Optional
```typescript
public readonly oidcRoleName: string;
```
- *Type:* string
Name of the GitHub OIDC role (default: 'GitHubOIDCRole').
---
##### `roleSelection`Optional
```typescript
public readonly roleSelection: StackSetRoleSelection;
```
- *Type:* StackSetRoleSelection
Which roles to include (default: BOTH).
---
##### `skipOidcProviderCreation`Optional
```typescript
public readonly skipOidcProviderCreation: boolean;
```
- *Type:* boolean
Skip creating the OIDC provider (use existing one).
Set to true if accounts already have a GitHub OIDC provider.
The template will reference the existing provider by ARN.
Default: false
---
##### `project`Required
```typescript
public readonly project: any;
```
- *Type:* any
Projen project instance.
---
##### `autoDeployment`Optional
```typescript
public readonly autoDeployment: StackSetAutoDeployment;
```
- *Type:* StackSetAutoDeployment
Auto-deployment configuration.
---
##### `delegatedAdmin`Optional
```typescript
public readonly delegatedAdmin: boolean;
```
- *Type:* boolean
Whether to use delegated admin mode for StackSet operations.
If true, adds --call-as DELEGATED_ADMIN to commands.
If false, assumes running from the management account.
Default: true
---
##### `outputPath`Optional
```typescript
public readonly outputPath: string;
```
- *Type:* string
Output path for the template file (default: 'cdk-diff-workflow-stackset-template.yaml').
---
##### `regions`Optional
```typescript
public readonly regions: string[];
```
- *Type:* string[]
Target regions for deployment (e.g., ['us-east-1', 'eu-west-1']).
---
##### `stackSetName`Optional
```typescript
public readonly stackSetName: string;
```
- *Type:* string
Name of the StackSet (default: 'cdk-diff-workflow-iam-stackset').
---
##### `targetOrganizationalUnitIds`Optional
```typescript
public readonly targetOrganizationalUnitIds: string[];
```
- *Type:* string[]
Target OUs for deployment (e.g., ['ou-xxxx-xxxxxxxx', 'r-xxxx']).
---
### CdkDiffStack
#### Initializer
```typescript
import { CdkDiffStack } from '@jjrawlins/cdk-diff-pr-github-action'
const cdkDiffStack: CdkDiffStack = { ... }
```
#### Properties
| **Name** | **Type** | **Description** |
| --- | --- | --- |
| changesetRoleToAssumeArn | string | *No description.* |
| changesetRoleToAssumeRegion | string | *No description.* |
| stackName | string | *No description.* |
| oidcRegion | string | *No description.* |
| oidcRoleArn | string | *No description.* |
---
##### `changesetRoleToAssumeArn`Required
```typescript
public readonly changesetRoleToAssumeArn: string;
```
- *Type:* string
---
##### `changesetRoleToAssumeRegion`Required
```typescript
public readonly changesetRoleToAssumeRegion: string;
```
- *Type:* string
---
##### `stackName`Required
```typescript
public readonly stackName: string;
```
- *Type:* string
---
##### `oidcRegion`Optional
```typescript
public readonly oidcRegion: string;
```
- *Type:* string
---
##### `oidcRoleArn`Optional
```typescript
public readonly oidcRoleArn: string;
```
- *Type:* string
---
### CdkDiffStackWorkflowProps
#### Initializer
```typescript
import { CdkDiffStackWorkflowProps } from '@jjrawlins/cdk-diff-pr-github-action'
const cdkDiffStackWorkflowProps: CdkDiffStackWorkflowProps = { ... }
```
#### Properties
| **Name** | **Type** | **Description** |
| --- | --- | --- |
| project | any | *No description.* |
| stacks | CdkDiffStack[] | *No description.* |
| cdkYarnCommand | string | *No description.* |
| nodeVersion | string | *No description.* |
| oidcRegion | string | *No description.* |
| oidcRoleArn | string | *No description.* |
| postGitHubSteps | any | Additional GitHub Actions steps to run after all CDK operations complete. |
| preGitHubSteps | any | Additional GitHub Actions steps to run before CDK operations (after install, before AWS creds). |
| scriptOutputPath | string | *No description.* |
| workingDirectory | string | Working directory for the CDK app, relative to the repository root. |
---
##### `project`Required
```typescript
public readonly project: any;
```
- *Type:* any
---
##### `stacks`Required
```typescript
public readonly stacks: CdkDiffStack[];
```
- *Type:* CdkDiffStack[]
---
##### `cdkYarnCommand`Optional
```typescript
public readonly cdkYarnCommand: string;
```
- *Type:* string
---
##### `nodeVersion`Optional
```typescript
public readonly nodeVersion: string;
```
- *Type:* string
---
##### `oidcRegion`Optional
```typescript
public readonly oidcRegion: string;
```
- *Type:* string
---
##### `oidcRoleArn`Optional
```typescript
public readonly oidcRoleArn: string;
```
- *Type:* string
---
##### `postGitHubSteps`Optional
```typescript
public readonly postGitHubSteps: any;
```
- *Type:* any
Additional GitHub Actions steps to run after all CDK operations complete.
Accepts a static array of steps, or a factory function receiving context:
`(ctx: { stack: string; workingDirectory?: string }) => GitHubStep[]`
When `workingDirectory` is set, all `run:` steps inherit that directory.
To run a step at the repository root, add `working-directory: '.'` to that step.
---
##### `preGitHubSteps`Optional
```typescript
public readonly preGitHubSteps: any;
```
- *Type:* any
Additional GitHub Actions steps to run before CDK operations (after install, before AWS creds).
Accepts a static array of steps, or a factory function receiving context:
`(ctx: { stack: string; workingDirectory?: string }) => GitHubStep[]`
When `workingDirectory` is set, all `run:` steps inherit that directory.
To run a step at the repository root, add `working-directory: '.'` to that step.
---
##### `scriptOutputPath`Optional
```typescript
public readonly scriptOutputPath: string;
```
- *Type:* string
---
##### `workingDirectory`Optional
```typescript
public readonly workingDirectory: string;
```
- *Type:* string
- *Default:* repository root
Working directory for the CDK app, relative to the repository root.
Useful for monorepos where infrastructure lives in a subdirectory (e.g., 'infra').
When set, all workflow run steps will use `defaults.run.working-directory`
and script paths will be adjusted to use absolute references.
---
### CdkDriftDetectionWorkflowProps
#### Initializer
```typescript
import { CdkDriftDetectionWorkflowProps } from '@jjrawlins/cdk-diff-pr-github-action'
const cdkDriftDetectionWorkflowProps: CdkDriftDetectionWorkflowProps = { ... }
```
#### Properties
| **Name** | **Type** | **Description** |
| --- | --- | --- |
| project | any | *No description.* |
| stacks | Stack[] | *No description.* |
| createIssues | boolean | *No description.* |
| nodeVersion | string | *No description.* |
| oidcRegion | string | *No description.* |
| oidcRoleArn | string | *No description.* |
| postGitHubSteps | any | Optional additional GitHub Action steps to run after drift detection for each stack. |
| preGitHubSteps | any | Additional GitHub Actions steps to run before drift detection (after install, before AWS creds). |
| schedule | string | *No description.* |
| scriptOutputPath | string | *No description.* |
| workflowName | string | *No description.* |
| workingDirectory | string | Working directory for the CDK app, relative to the repository root. |
---
##### `project`Required
```typescript
public readonly project: any;
```
- *Type:* any
---
##### `stacks`Required
```typescript
public readonly stacks: Stack[];
```
- *Type:* Stack[]
---
##### `createIssues`Optional
```typescript
public readonly createIssues: boolean;
```
- *Type:* boolean
---
##### `nodeVersion`Optional
```typescript
public readonly nodeVersion: string;
```
- *Type:* string
---
##### `oidcRegion`Optional
```typescript
public readonly oidcRegion: string;
```
- *Type:* string
---
##### `oidcRoleArn`Optional
```typescript
public readonly oidcRoleArn: string;
```
- *Type:* string
---
##### `postGitHubSteps`Optional
```typescript
public readonly postGitHubSteps: any;
```
- *Type:* any
Optional additional GitHub Action steps to run after drift detection for each stack.
These steps run after results are uploaded for each stack. You can include
any notifications you like (e.g., Slack). Provide explicit inputs (e.g., payload/markdown)
directly in your step without relying on a pre-generated payload.
---
##### `preGitHubSteps`Optional
```typescript
public readonly preGitHubSteps: any;
```
- *Type:* any
Additional GitHub Actions steps to run before drift detection (after install, before AWS creds).
Accepts a static array of steps, or a factory function receiving context:
`(ctx: { stack: string; workingDirectory?: string }) => GitHubStep[]`
When `workingDirectory` is set, all `run:` steps inherit that directory.
To run a step at the repository root, add `working-directory: '.'` to that step.
Pre-steps automatically receive the stack-selection condition (`if`) so they
only run when the stack is selected via dispatch.
---
##### `schedule`Optional
```typescript
public readonly schedule: string;
```
- *Type:* string
---
##### `scriptOutputPath`Optional
```typescript
public readonly scriptOutputPath: string;
```
- *Type:* string
---
##### `workflowName`Optional
```typescript
public readonly workflowName: string;
```
- *Type:* string
---
##### `workingDirectory`Optional
```typescript
public readonly workingDirectory: string;
```
- *Type:* string
- *Default:* repository root
Working directory for the CDK app, relative to the repository root.
Useful for monorepos where infrastructure lives in a subdirectory (e.g., 'infra').
When set, all workflow run steps will use `defaults.run.working-directory`
and artifact/script paths will be adjusted accordingly.
---
### CdkDriftIamTemplateGeneratorProps
Props for generating CDK Drift IAM templates (no Projen dependency).
#### Initializer
```typescript
import { CdkDriftIamTemplateGeneratorProps } from '@jjrawlins/cdk-diff-pr-github-action'
const cdkDriftIamTemplateGeneratorProps: CdkDriftIamTemplateGeneratorProps = { ... }
```
#### Properties
| **Name** | **Type** | **Description** |
| --- | --- | --- |
| oidcRegion | string | Region for the OIDC trust condition. |
| oidcRoleArn | string | ARN of the existing GitHub OIDC role that can assume this drift role. |
| roleName | string | Name for the IAM role. |
---
##### `oidcRegion`Required
```typescript
public readonly oidcRegion: string;
```
- *Type:* string
Region for the OIDC trust condition.
---
##### `oidcRoleArn`Required
```typescript
public readonly oidcRoleArn: string;
```
- *Type:* string
ARN of the existing GitHub OIDC role that can assume this drift role.
---
##### `roleName`Required
```typescript
public readonly roleName: string;
```
- *Type:* string
Name for the IAM role.
---
### CdkDriftIamTemplateProps
Props for the Projen-integrated CDK Drift IAM template construct.
#### Initializer
```typescript
import { CdkDriftIamTemplateProps } from '@jjrawlins/cdk-diff-pr-github-action'
const cdkDriftIamTemplateProps: CdkDriftIamTemplateProps = { ... }
```
#### Properties
| **Name** | **Type** | **Description** |
| --- | --- | --- |
| oidcRegion | string | Region for the OIDC trust condition. |
| oidcRoleArn | string | ARN of the existing GitHub OIDC role that can assume this drift role. |
| roleName | string | Name for the IAM role. |
| project | any | Projen project instance. |
| outputPath | string | Output path for the template file (default: 'cdk-drift-workflow-iam-template.yaml'). |
---
##### `oidcRegion`Required
```typescript
public readonly oidcRegion: string;
```
- *Type:* string
Region for the OIDC trust condition.
---
##### `oidcRoleArn`Required
```typescript
public readonly oidcRoleArn: string;
```
- *Type:* string
ARN of the existing GitHub OIDC role that can assume this drift role.
---
##### `roleName`Required
```typescript
public readonly roleName: string;
```
- *Type:* string
Name for the IAM role.
---
##### `project`Required
```typescript
public readonly project: any;
```
- *Type:* any
Projen project instance.
---
##### `outputPath`Optional
```typescript
public readonly outputPath: string;
```
- *Type:* string
Output path for the template file (default: 'cdk-drift-workflow-iam-template.yaml').
---
### GitHubOidcConfig
GitHub repository restrictions for OIDC authentication.
#### Initializer
```typescript
import { GitHubOidcConfig } from '@jjrawlins/cdk-diff-pr-github-action'
const gitHubOidcConfig: GitHubOidcConfig = { ... }
```
#### Properties
| **Name** | **Type** | **Description** |
| --- | --- | --- |
| owner | string | GitHub organization or username (e.g., 'my-org' or 'my-username'). |
| repositories | string[] | Repository names allowed to assume the role (e.g., ['repo1', 'repo2']) Use ['*'] to allow all repos in the organization. |
| additionalClaims | string[] | Additional subject claims for fine-grained access e.g., ['pull_request', 'environment:production']. |
| branches | string[] | Branch patterns allowed (e.g., ['main', 'release/*']) Default: ['*'] (all branches). |
---
##### `owner`Required
```typescript
public readonly owner: string;
```
- *Type:* string
GitHub organization or username (e.g., 'my-org' or 'my-username').
---
##### `repositories`Required
```typescript
public readonly repositories: string[];
```
- *Type:* string[]
Repository names allowed to assume the role (e.g., ['repo1', 'repo2']) Use ['*'] to allow all repos in the organization.
---
##### `additionalClaims`Optional
```typescript
public readonly additionalClaims: string[];
```
- *Type:* string[]
Additional subject claims for fine-grained access e.g., ['pull_request', 'environment:production'].
---
##### `branches`Optional
```typescript
public readonly branches: string[];
```
- *Type:* string[]
Branch patterns allowed (e.g., ['main', 'release/*']) Default: ['*'] (all branches).
---
### Stack
#### Initializer
```typescript
import { Stack } from '@jjrawlins/cdk-diff-pr-github-action'
const stack: Stack = { ... }
```
#### Properties
| **Name** | **Type** | **Description** |
| --- | --- | --- |
| driftDetectionRoleToAssumeArn | string | *No description.* |
| driftDetectionRoleToAssumeRegion | string | *No description.* |
| stackName | string | *No description.* |
| failOnDrift | boolean | *No description.* |
| oidcRegion | string | *No description.* |
| oidcRoleArn | string | *No description.* |
---
##### `driftDetectionRoleToAssumeArn`Required
```typescript
public readonly driftDetectionRoleToAssumeArn: string;
```
- *Type:* string
---
##### `driftDetectionRoleToAssumeRegion`Required
```typescript
public readonly driftDetectionRoleToAssumeRegion: string;
```
- *Type:* string
---
##### `stackName`Required
```typescript
public readonly stackName: string;
```
- *Type:* string
---
##### `failOnDrift`Optional
```typescript
public readonly failOnDrift: boolean;
```
- *Type:* boolean
---
##### `oidcRegion`Optional
```typescript
public readonly oidcRegion: string;
```
- *Type:* string
---
##### `oidcRoleArn`Optional
```typescript
public readonly oidcRoleArn: string;
```
- *Type:* string
---
### StackSetAutoDeployment
Configuration for StackSet auto-deployment.
#### Initializer
```typescript
import { StackSetAutoDeployment } from '@jjrawlins/cdk-diff-pr-github-action'
const stackSetAutoDeployment: StackSetAutoDeployment = { ... }
```
#### Properties
| **Name** | **Type** | **Description** |
| --- | --- | --- |
| enabled | boolean | Enable auto-deployment to new accounts in target OUs (default: true). |
| retainStacksOnAccountRemoval | boolean | Retain stacks when account leaves OU (default: false). |
---
##### `enabled`Optional
```typescript
public readonly enabled: boolean;
```
- *Type:* boolean
Enable auto-deployment to new accounts in target OUs (default: true).
---
##### `retainStacksOnAccountRemoval`Optional
```typescript
public readonly retainStacksOnAccountRemoval: boolean;
```
- *Type:* boolean
Retain stacks when account leaves OU (default: false).
---
## Classes
### CdkDiffIamTemplate
Projen construct that emits a CloudFormation template with minimal IAM permissions for the CDK Diff Stack Workflow.
For non-Projen projects, use `CdkDiffIamTemplateGenerator` directly.
#### Initializers
```typescript
import { CdkDiffIamTemplate } from '@jjrawlins/cdk-diff-pr-github-action'
new CdkDiffIamTemplate(props: CdkDiffIamTemplateProps)
```
| **Name** | **Type** | **Description** |
| --- | --- | --- |
| props | CdkDiffIamTemplateProps | *No description.* |
---
##### `props`Required
- *Type:* CdkDiffIamTemplateProps
---
### CdkDiffIamTemplateGenerator
Pure generator class for CDK Diff IAM templates.
No Projen dependency - can be used in any project.
#### Initializers
```typescript
import { CdkDiffIamTemplateGenerator } from '@jjrawlins/cdk-diff-pr-github-action'
new CdkDiffIamTemplateGenerator()
```
| **Name** | **Type** | **Description** |
| --- | --- | --- |
---
#### Static Functions
| **Name** | **Description** |
| --- | --- |
| generateDeployCommand | Generate the AWS CLI deploy command for the IAM template. |
| generateTemplate | Generate the CloudFormation IAM template as a YAML string. |
---
##### `generateDeployCommand`
```typescript
import { CdkDiffIamTemplateGenerator } from '@jjrawlins/cdk-diff-pr-github-action'
CdkDiffIamTemplateGenerator.generateDeployCommand(templatePath?: string)
```
Generate the AWS CLI deploy command for the IAM template.
###### `templatePath`Optional
- *Type:* string
---
##### `generateTemplate`
```typescript
import { CdkDiffIamTemplateGenerator } from '@jjrawlins/cdk-diff-pr-github-action'
CdkDiffIamTemplateGenerator.generateTemplate(props: CdkDiffIamTemplateGeneratorProps)
```
Generate the CloudFormation IAM template as a YAML string.
###### `props`Required
- *Type:* CdkDiffIamTemplateGeneratorProps
---
### CdkDiffIamTemplateStackSet
Projen construct that creates a CloudFormation StackSet template for org-wide deployment of GitHub OIDC provider, OIDC role, and CDK Diff/Drift IAM roles.
This provides a self-contained per-account deployment with no role chaining required.
For non-Projen projects, use `CdkDiffIamTemplateStackSetGenerator` directly.
#### Initializers
```typescript
import { CdkDiffIamTemplateStackSet } from '@jjrawlins/cdk-diff-pr-github-action'
new CdkDiffIamTemplateStackSet(props: CdkDiffIamTemplateStackSetProps)
```
| **Name** | **Type** | **Description** |
| --- | --- | --- |
| props | CdkDiffIamTemplateStackSetProps | *No description.* |
---
##### `props`Required
- *Type:* CdkDiffIamTemplateStackSetProps
---
### CdkDiffIamTemplateStackSetGenerator
Pure generator class for StackSet templates and commands.
No Projen dependency - can be used in any project.
#### Initializers
```typescript
import { CdkDiffIamTemplateStackSetGenerator } from '@jjrawlins/cdk-diff-pr-github-action'
new CdkDiffIamTemplateStackSetGenerator()
```
| **Name** | **Type** | **Description** |
| --- | --- | --- |
---
#### Static Functions
| **Name** | **Description** |
| --- | --- |
| generateCommands | Generate AWS CLI commands for StackSet operations. |
| generateTemplate | Generate the CloudFormation StackSet template as a YAML string. |
---
##### `generateCommands`
```typescript
import { CdkDiffIamTemplateStackSetGenerator } from '@jjrawlins/cdk-diff-pr-github-action'
CdkDiffIamTemplateStackSetGenerator.generateCommands(props?: CdkDiffIamTemplateStackSetCommandsProps)
```
Generate AWS CLI commands for StackSet operations.
Returns a map of command names to shell commands.
###### `props`Optional
- *Type:* CdkDiffIamTemplateStackSetCommandsProps
---
##### `generateTemplate`
```typescript
import { CdkDiffIamTemplateStackSetGenerator } from '@jjrawlins/cdk-diff-pr-github-action'
CdkDiffIamTemplateStackSetGenerator.generateTemplate(props: CdkDiffIamTemplateStackSetGeneratorProps)
```
Generate the CloudFormation StackSet template as a YAML string.
###### `props`Required
- *Type:* CdkDiffIamTemplateStackSetGeneratorProps
---
### CdkDiffStackWorkflow
#### Initializers
```typescript
import { CdkDiffStackWorkflow } from '@jjrawlins/cdk-diff-pr-github-action'
new CdkDiffStackWorkflow(props: CdkDiffStackWorkflowProps)
```
| **Name** | **Type** | **Description** |
| --- | --- | --- |
| props | CdkDiffStackWorkflowProps | *No description.* |
---
##### `props`Required
- *Type:* CdkDiffStackWorkflowProps
---
### CdkDriftDetectionWorkflow
#### Initializers
```typescript
import { CdkDriftDetectionWorkflow } from '@jjrawlins/cdk-diff-pr-github-action'
new CdkDriftDetectionWorkflow(props: CdkDriftDetectionWorkflowProps)
```
| **Name** | **Type** | **Description** |
| --- | --- | --- |
| props | CdkDriftDetectionWorkflowProps | *No description.* |
---
##### `props`Required
- *Type:* CdkDriftDetectionWorkflowProps
---
### CdkDriftIamTemplate
Projen construct that emits a CloudFormation template with minimal IAM permissions for the CDK Drift Detection Workflow.
For non-Projen projects, use `CdkDriftIamTemplateGenerator` directly.
#### Initializers
```typescript
import { CdkDriftIamTemplate } from '@jjrawlins/cdk-diff-pr-github-action'
new CdkDriftIamTemplate(props: CdkDriftIamTemplateProps)
```
| **Name** | **Type** | **Description** |
| --- | --- | --- |
| props | CdkDriftIamTemplateProps | *No description.* |
---
##### `props`Required
- *Type:* CdkDriftIamTemplateProps
---
### CdkDriftIamTemplateGenerator
Pure generator class for CDK Drift IAM templates.
No Projen dependency - can be used in any project.
#### Initializers
```typescript
import { CdkDriftIamTemplateGenerator } from '@jjrawlins/cdk-diff-pr-github-action'
new CdkDriftIamTemplateGenerator()
```
| **Name** | **Type** | **Description** |
| --- | --- | --- |
---
#### Static Functions
| **Name** | **Description** |
| --- | --- |
| generateDeployCommand | Generate the AWS CLI deploy command for the IAM template. |
| generateTemplate | Generate the CloudFormation IAM template as a YAML string. |
---
##### `generateDeployCommand`
```typescript
import { CdkDriftIamTemplateGenerator } from '@jjrawlins/cdk-diff-pr-github-action'
CdkDriftIamTemplateGenerator.generateDeployCommand(templatePath?: string)
```
Generate the AWS CLI deploy command for the IAM template.
###### `templatePath`Optional
- *Type:* string
---
##### `generateTemplate`
```typescript
import { CdkDriftIamTemplateGenerator } from '@jjrawlins/cdk-diff-pr-github-action'
CdkDriftIamTemplateGenerator.generateTemplate(props: CdkDriftIamTemplateGeneratorProps)
```
Generate the CloudFormation IAM template as a YAML string.
###### `props`Required
- *Type:* CdkDriftIamTemplateGeneratorProps
---
## Enums
### StackSetRoleSelection
Which roles to include in the StackSet.
#### Members
| **Name** | **Description** |
| --- | --- |
| CHANGESET_ONLY | Include only the changeset role (CdkChangesetRole). |
| DRIFT_ONLY | Include only the drift role (CdkDriftRole). |
| BOTH | Include both roles (default). |
---
##### `CHANGESET_ONLY`
Include only the changeset role (CdkChangesetRole).
---
##### `DRIFT_ONLY`
Include only the drift role (CdkDriftRole).
---
##### `BOTH`
Include both roles (default).
---