chore: ban direct child_process and shell:true outside the subprocess tool

[iankhou]

Fixes #1903

Description

Locks in the subprocess consolidation (#1763, #1849) so new code or changes to existing code can't spawn shells outside the shared tool.

• no-restricted-imports: ban child_process / node:child_process
• no-restricted-syntax: ban enabling the shell spawn option — any shell property that isn't statically false (so { shell }, shell: cond, shell: someVar, shell: '/bin/sh' are all caught, not just the literal true)

Spawn paths have to go through run/runSync/runUserCommandLine from the subprocess tool. The tool itself carries a localized eslint-disable at the two sanctioned lines.

Test files and build tooling (projenrc) are exempt. The two un-migrated shipped sinks carry in-file eslint-disable comments (each with a reason) at the spawn site rather than projen overrides: cli-integ is a test harness that intentionally spawns through a shell to exercise the CLI as a user would (permanent, like test code), and integ-runner's exec() is argv-based/no-shell, so it exempts only the child_process import — the shell rule stays active there — with migration onto the shared tool deferred as follow-up. cdk-build-tools is not managed by the root projen config, so the rule does not reach it yet; will address it in a follow-up.

Testing

Inserted a child_process import into a migrated lib/ file, and the rule fires as expected. Obviously did not keep that import.

Checklist

• This change contains a major version upgrade for a dependency and I confirm all breaking changes are addressed
  • Release notes for the new version:

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 91.30%. Comparing base (d51353e) to head (b0ff6a7).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1902      +/-   ##
==========================================
- Coverage   91.39%   91.30%   -0.09%     
==========================================
  Files          79       79              
  Lines       12139    12139              
  Branches     1728     1722       -6     
==========================================
- Hits        11094    11084      -10     
- Misses       1010     1020      +10     
  Partials       35       35              

Flag	Coverage Δ
suite.unit	91.30% <ø> (-0.09%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Copilot]

Pull request overview

Adds ESLint safeguards to centralize subprocess execution in the shared utility.

Changes:

• Restricts direct child_process imports and shell: true.
• Adds scoped exemptions for tests and integration tooling.
• Regenerates package ESLint configurations.

Reviewed changes

Copilot reviewed 21 out of 21 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
projenrc/eslint/team.ts	Adds the shell restriction.
projenrc/eslint/index.ts	Configures test/build exemptions.
projenrc/eslint/imports.ts	Restricts child-process imports.
.projenrc.ts	Adds integration-tool exemptions.
.eslintrc.json	Regenerates root ESLint rules.
packages/cdk/.eslintrc.json	Regenerates package rules.
packages/cdk-assets/.eslintrc.json	Regenerates package rules.
packages/aws-cdk/.eslintrc.json	Regenerates CLI rules.
packages/@aws-cdk/yarn-cling/.eslintrc.json	Regenerates package rules.
packages/@aws-cdk/user-input-gen/.eslintrc.json	Regenerates package rules.
packages/@aws-cdk/toolkit-lib/.eslintrc.json	Regenerates toolkit rules.
packages/@aws-cdk/private-tools/lib/subprocess/index.ts	Exempts sanctioned subprocess operations.
packages/@aws-cdk/private-tools/.eslintrc.json	Regenerates private-tools rules.
packages/@aws-cdk/integ-runner/.eslintrc.json	Adds integ-runner exemption.
packages/@aws-cdk/cloudformation-diff/.eslintrc.json	Regenerates package rules.
packages/@aws-cdk/cloud-assembly-schema/.eslintrc.json	Regenerates package rules.
packages/@aws-cdk/cloud-assembly-api/.eslintrc.json	Regenerates package rules.
packages/@aws-cdk/cli-plugin-contract/.eslintrc.json	Regenerates package rules.
packages/@aws-cdk/cdk-explorer/.eslintrc.json	Regenerates package rules.
packages/@aws-cdk/cdk-assets-lib/.eslintrc.json	Regenerates package rules.
packages/@aws-cdk-testing/cli-integ/.eslintrc.json	Adds CLI integration exemptions.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 28 out of 28 changed files in this pull request and generated 1 comment.

Suppressed comments (1)

Previously missed (1) — in code that hasn't changed since the last review.

projenrc/eslint/imports.ts:28

• no-restricted-imports only checks static import/export declarations, so shipped code can still use await import('node:child_process') and call exec/spawn outside the shared wrapper. This leaves a direct bypass of the shell-consolidation guard; add coverage for ImportExpression (for both specifiers), for example via no-restricted-syntax or a dedicated rule.

          name: 'child_process',
          message: 'Do not use `child_process` directly. Use `run`/`runSync`/`runUserCommandLine` from the subprocess tool (\'./private/tools\').',
        },
        {
          name: 'node:child_process',