From 3f4bf4f54d7b240d88e65f20bd3c44d43786ff00 Mon Sep 17 00:00:00 2001 From: Adam Moussa <166072409+amoussa1229@users.noreply.github.com> Date: Fri, 5 Jun 2026 12:11:36 -0400 Subject: [PATCH] Add dependency-review workflow and Sea Haven PR checklist (#36) Add a reusable callable-dependency-review workflow that runs actions/dependency-review-action with fail-on-severity: high, and append a Sea Haven checklist to the PR template covering infra, secrets, PITR, Slack, Confluence, memory, and cross-review. --- .github/PULL_REQUEST_TEMPLATE.md | 9 +++++++++ .github/workflows/callable-dependency-review.yaml | 14 ++++++++++++++ 2 files changed, 23 insertions(+) create mode 100644 .github/workflows/callable-dependency-review.yaml diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md index 9cab3a8..bf5c9df 100644 --- a/.github/PULL_REQUEST_TEMPLATE.md +++ b/.github/PULL_REQUEST_TEMPLATE.md @@ -16,3 +16,12 @@ PR conventions — see engineering-handbook/pull-requests.md ## Notes + +## Sea Haven checklist +- [ ] CDK diff / SAM changeset reviewed (if infra change) +- [ ] Secrets added to Parameter Store / Secrets Manager (not hardcoded) +- [ ] DynamoDB PITR verified on new tables +- [ ] Slack notification tested in staging +- [ ] Confluence Architecture Map updated +- [ ] Memory update queued (if new repo/stack) +- [ ] Cross-review requested (if IAM or Lambda handler signature change) diff --git a/.github/workflows/callable-dependency-review.yaml b/.github/workflows/callable-dependency-review.yaml new file mode 100644 index 0000000..646225b --- /dev/null +++ b/.github/workflows/callable-dependency-review.yaml @@ -0,0 +1,14 @@ +name: Dependency Review +on: + workflow_call: +permissions: + contents: read + pull-requests: write +jobs: + dependency-review: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v6 + - uses: actions/dependency-review-action@v4 + with: + fail-on-severity: high