ci: add dry-aged-deps for dependency freshness checks

.dry-aged-deps.json

@@ -0,0 +1,24 @@
+{
+  "exclude": {
+    "@types/jest": "Pinned to jest 27.x; upgrade requires jest 29+ migration",
+    "cspell": "Major version upgrade; requires compatibility testing with current config",
+    "eslint": "Pinned to ^8; upgrade to 9+ requires flat config migration and plugin compatibility",
+    "eslint-config-prettier": "Major version upgrade; blocked by eslint 8.x constraint",
+    "eslint-import-resolver-node": "Pinned by eslint-plugin-import compatibility",
+    "eslint-import-resolver-typescript": "Major version upgrade; blocked by eslint 8.x constraint",
+    "eslint-plugin-import": "Pinned by eslint 8.x compatibility",
+    "eslint-plugin-no-secrets": "Major version upgrade; blocked by eslint 8.x constraint",
+    "eslint-plugin-prettier": "Major version upgrade; blocked by eslint 8.x constraint",
+    "eslint-plugin-unicorn": "Major version upgrade; blocked by eslint 8.x constraint",
+    "http-status-codes": "Used only in tests; minor update with no security impact",
+    "husky": "Major version upgrade; requires migration to new config format",
+    "jest": "Pinned to ^27 by projen; upgrade requires projen and ts-jest migration",
+    "jest-junit": "Major version upgrade; blocked by jest 27.x constraint",
+    "npm-check-updates": "Major version upgrade; used only for maintenance scripts",
+    "prettier": "Major version upgrade; may cause formatting changes across codebase",
+    "projen": "Pinned to ^0.58; upgrade may cause breaking changes to project config",
+    "ts-jest": "Pinned to jest 27.x; upgrade requires jest migration",
+    "ts-node": "Minor update; low priority with no security impact",
+    "typescript": "Major version upgrade; requires codebase compatibility verification"
+  }
+}

.project-words.txt

@@ -1,2 +1,4 @@
 Hubber
 deps
+mergify
+yarnrc

.projenrc.ts

@@ -39,6 +39,7 @@ const project = new TypeScriptProject({
     "http-status-codes",
     "@types/http-status-codes",
     "@mountainpass/cool-bits-for-projen",
+    "dry-aged-deps",
   ] /* Build dependencies for this module. */,
   keywords: ["problem-details", "rfc7807"],
   defaultReleaseBranch: "main",
@@ -63,6 +64,7 @@ const project = new TypeScriptProject({
     secret: "GITHUB_TOKEN",
   },
   githubOptions: {
+    mergify: false,
     pullRequestLintOptions: {
       semanticTitleOptions: {
         types: [
@@ -83,12 +85,99 @@ const project = new TypeScriptProject({
   },
 });
 
-new Recommended(project, {
-  cSpellOptions: { language: "en-GB", ignorePaths: ["docs"] },
+const recommended = new Recommended(project, {
+  cSpellOptions: {
+    language: "en-GB",
+    ignorePaths: ["docs", ".dry-aged-deps.json"],
+  },
 });
 
+// Add dry-aged-deps check to the pre-push hook
+recommended.husky.addHook("pre-push", "npx dry-aged-deps --check");
+
 new CodeOfConduct(project, { contactMethod: "tom@mountain-pass.com.au" });
 
+// Fix npm pack command for newer npm versions
+const packageTask = project.tasks.tryFind("package")!;
+packageTask.reset();
+packageTask.exec("mkdir -p dist/js");
+packageTask.exec("npm pack --pack-destination dist/js");
+
+// Add dry-aged-deps check to the build workflow
+project.buildWorkflow?.addPostBuildSteps({
+  name: "Check for outdated dependencies",
+  run: "npx dry-aged-deps --check",
+});
+
+// Upgrade deprecated GitHub Actions from v2/v3 to v4
+const buildWorkflow = project.github?.tryFindWorkflow("build");
+if (buildWorkflow?.file) {
+  buildWorkflow.file.addOverride(
+    "jobs.build.steps.0.uses",
+    "actions/checkout@v4"
+  );
+  buildWorkflow.file.addOverride(
+    "jobs.build.steps.5.uses",
+    "actions/upload-artifact@v4"
+  );
+  buildWorkflow.file.addOverride(
+    "jobs.self-mutation.steps.0.uses",
+    "actions/checkout@v4"
+  );
+  buildWorkflow.file.addOverride(
+    "jobs.self-mutation.steps.1.uses",
+    "actions/download-artifact@v4"
+  );
+}
+
+const releaseWorkflow = project.github?.tryFindWorkflow("release");
+if (releaseWorkflow?.file) {
+  releaseWorkflow.file.addOverride(
+    "jobs.release.steps.0.uses",
+    "actions/checkout@v4"
+  );
+  releaseWorkflow.file.addOverride(
+    "jobs.release.steps.5.uses",
+    "actions/upload-artifact@v4"
+  );
+  releaseWorkflow.file.addOverride(
+    "jobs.release_github.steps.0.uses",
+    "actions/setup-node@v4"
+  );
+  releaseWorkflow.file.addOverride(
+    "jobs.release_github.steps.1.uses",
+    "actions/download-artifact@v4"
+  );
+  releaseWorkflow.file.addOverride(
+    "jobs.release_npm.steps.0.uses",
+    "actions/setup-node@v4"
+  );
+  releaseWorkflow.file.addOverride(
+    "jobs.release_npm.steps.1.uses",
+    "actions/download-artifact@v4"
+  );
+}
+
+const upgradeWorkflow = project.github?.tryFindWorkflow("upgrade-main");
+if (upgradeWorkflow?.file) {
+  upgradeWorkflow.file.addOverride(
+    "jobs.upgrade.steps.0.uses",
+    "actions/checkout@v4"
+  );
+  upgradeWorkflow.file.addOverride(
+    "jobs.upgrade.steps.4.uses",
+    "actions/upload-artifact@v4"
+  );
+  upgradeWorkflow.file.addOverride(
+    "jobs.pr.steps.0.uses",
+    "actions/checkout@v4"
+  );
+  upgradeWorkflow.file.addOverride(
+    "jobs.pr.steps.1.uses",
+    "actions/download-artifact@v4"
+  );
+}
+
 gitHubber.addToProject(project);
 npmReleaser.addToProject(project);
 organisational.addToProject(project);

.yarnrc

@@ -0,0 +1 @@
+--ignore-engines true