[iliapolo]

Enable npmVerifyPublished for all packages (with a 3 hour timeout for aws-cdk). This will prevent in-repo packages from being published before their (in-repo) dependencies are available. Specifically, the cdk -> aws-cdk chain which was impacted in our last 3 releases.

Note that in case NPM has ingestion delays (like we've already seen), the release will fail and will need to be retried.

Checklist

• This change contains a major version upgrade for a dependency and I confirm all breaking changes are addressed
  • Release notes for the new version:

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Scorecard details

Package	Version	Score	Details
npm/cdklabs-projen-project-types	^0.6.20	Unknown	Unknown
npm/projen	^0.104.14	Unknown	Unknown
npm/projen	^0.104.14	Unknown	Unknown
npm/projen	^0.104.14	Unknown	Unknown
npm/projen	^0.104.14	Unknown	Unknown
npm/projen	^0.104.14	Unknown	Unknown
npm/projen	^0.104.14	Unknown	Unknown
npm/projen	^0.104.14	Unknown	Unknown
npm/projen	^0.104.14	Unknown	Unknown
npm/projen	^0.104.14	Unknown	Unknown
npm/projen	^0.104.14	Unknown	Unknown
npm/projen	^0.104.14	Unknown	Unknown
npm/projen	^0.104.14	Unknown	Unknown
npm/projen	^0.104.14	Unknown	Unknown
npm/projen	^0.104.14	Unknown	Unknown
npm/projen	^0.104.14	Unknown	Unknown
npm/projen	^0.104.14	Unknown	Unknown
npm/cdklabs-projen-project-types	0.6.20	Unknown	Unknown
npm/projen	0.104.14	🟢 7.2	Details Check Score Reason Security-Policy 🟢 10 security policy file detected Code-Review 🟢 10 all changesets reviewed Maintained 🟢 10 30 commit(s) and 8 issue activity found in the last 90 days -- score normalized to 10 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Packaging ⚠️ -1 packaging workflow not detected Binary-Artifacts 🟢 10 no binaries found in the repo Token-Permissions 🟢 4 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Pinned-Dependencies 🟢 6 dependency not pinned by hash detected -- score normalized to 6 License 🟢 10 license file detected Fuzzing ⚠️ 0 project is not fuzzed Signed-Releases ⚠️ -1 no releases found Branch-Protection 🟢 4 branch protection is not maximal on development and all release branches SAST 🟢 6 SAST tool is not run on all commits -- score normalized to 6

Scanned Files

• package.json
• packages/@aws-cdk-testing/cli-integ/package.json
• packages/@aws-cdk/cdk-assets-lib/package.json
• packages/@aws-cdk/cdk-explorer/package.json
• packages/@aws-cdk/cli-plugin-contract/package.json
• packages/@aws-cdk/cloud-assembly-api/package.json
• packages/@aws-cdk/cloud-assembly-schema/package.json
• packages/@aws-cdk/cloudformation-diff/package.json
• packages/@aws-cdk/integ-runner/package.json
• packages/@aws-cdk/private-tools/package.json
• packages/@aws-cdk/toolkit-lib/package.json
• packages/@aws-cdk/user-input-gen/package.json
• packages/@aws-cdk/yarn-cling/package.json
• packages/aws-cdk/package.json
• packages/cdk-assets/package.json
• packages/cdk/package.json
• yarn.lock