feat(ci): validate workflows as part of builds

.projenrc.ts

@@ -41,7 +41,6 @@ const project = new cdk.JsiiProject({
   typescriptVersion: "~5.3.0", // should always be the same major/minor as JSII
   peerDeps: ["projen@^0.85.0", "constructs@^10.3.0"],
   deps: ["change-case", "fs-extra"],
-  devDeps: ["@types/fs-extra", "glob", "@types/glob"],
   bundledDeps: ["change-case", "fs-extra"],
   defaultReleaseBranch: "main",
   releaseToNpm: true,
@@ -89,10 +88,17 @@ const project = new cdk.JsiiProject({
   projenrcTs: true,
 });
 
-// @typescript-eslint v7+ requires Node.js 18.18, so we are stuck on v6
-// The below lines can probably be removed once Node 18 goes EOL and we upgrade minNodeVersion to 20
-project.addDevDeps("@typescript-eslint/eslint-plugin@^6");
-project.addDevDeps("@typescript-eslint/parser@^6");
+project.addDevDeps(
+  "glob",
+  "@types/glob",
+  "@types/fs-extra",
+  "@action-validator/core",
+  "@action-validator/cli",
+  // @typescript-eslint v7+ requires Node.js 18.18, so we are stuck on v6
+  // The below lines can probably be removed once Node 18 goes EOL and we upgrade minNodeVersion to 20
+  "@typescript-eslint/eslint-plugin@^6",
+  "@typescript-eslint/parser@^6"
+);
 
 project.addFields({ publishConfig: { access: "public" } });
 
@@ -147,6 +153,13 @@ project.addFields({
   },
 });
 
+const validateTask = project.addTask("validate-workflows", {
+  exec: `find ./.github/workflows -type f -name "*.yml" -print0 | xargs -0 -n 1 npx action-validator`,
+});
+validateTask.description =
+  "Lint the YAML files generated by Projen to define GitHub Actions and Workflows, checking them against published JSON schemas";
+project.postCompileTask.spawn(validateTask);
+
 // Run copywrite tool to add copyright headers to all files
 // This is for this repository itself, not for the projects
 // using this Projen template

src/index.ts

@@ -246,11 +246,6 @@ export class CdktfProviderProject extends cdk.JsiiProject {
       workflowRunsOn,
       licensed: false, // we do supply our own license file with a custom header
       releaseToNpm: true,
-      devDeps: [
-        "@actions/core@^1.1.0",
-        "dot-prop@^5.2.0",
-        ...(options.devDeps ?? []),
-      ],
       name: packageInfo.npm.name,
       description: `Prebuilt ${providerName} Provider for Terraform CDK (cdktf)`,
       keywords: ["cdktf", "terraform", "cdk", "provider", providerName],
@@ -305,6 +300,13 @@ export class CdktfProviderProject extends cdk.JsiiProject {
       docgen: false,
     });
 
+    this.addDevDeps(
+      "dot-prop@^5.2.0",
+      "@actions/core@^1.1.0",
+      "@action-validator/core",
+      "@action-validator/cli"
+    );
+
     // Default memory is 7GB: https://docs.github.com/en/actions/using-github-hosted-runners/about-github-hosted-runners#supported-runners-and-hardware-resources
     // Custom Runners we use have 32GB of memory
     // The below numbers set heap limits that are ~1gb and ~0.5gb less, respectively, than the total available memory
@@ -318,6 +320,13 @@ export class CdktfProviderProject extends cdk.JsiiProject {
 
     this.tasks.addEnvironment("CHECKPOINT_DISABLE", "1");
 
+    const validateTask = this.addTask("validate-workflows", {
+      exec: `find ./.github/workflows -type f -name "*.yml" -print0 | xargs -0 -n 1 npx action-validator`,
+    });
+    validateTask.description =
+      "Lint the YAML files generated by Projen to define GitHub Actions and Workflows, checking them against published JSON schemas";
+    this.postCompileTask.spawn(validateTask);
+
     this.package.addPackageResolutions("@types/[email protected]");
 
     const setSafeDirectory = {