Merge branch 'main' into fix/dependency-review-permissions

.github/workflows/cd-cdk.yaml

@@ -62,7 +62,7 @@ jobs:
       - uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4
         if: ${{ inputs.enable-qemu }}
 
-      - uses: actions/setup-dotnet@v5
+      - uses: actions/setup-dotnet@v6
         if: ${{ inputs.dotnet-version != '' }}
         with:
           dotnet-version: ${{ inputs.dotnet-version }}
@@ -71,11 +71,11 @@ jobs:
         if: ${{ inputs.dotnet-publish-project != '' }}
         run: dotnet publish ${{ inputs.dotnet-publish-project }} --configuration Release --runtime linux-arm64 --self-contained false --output $(dirname ${{ inputs.dotnet-publish-project }})/bin/Release/net8.0/linux-arm64/publish
 
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v7
         with:
           node-version: ${{ inputs.node-version }}
 
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v7
         if: ${{ inputs.python-version != '' }}
         with:
           python-version: ${{ inputs.python-version }}

.github/workflows/cd-mobile-ios.yaml

@@ -67,13 +67,13 @@ jobs:
           role-to-assume: ${{ secrets.deploy-role-arn }}
           aws-region: ${{ inputs.region }}
 
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v7
         with:
           node-version: ${{ inputs.node-version }}
           cache: npm
           cache-dependency-path: ${{ inputs.cache-dependency-path }}
 
-      - uses: ruby/setup-ruby@d45b1a4e94b71acab930e56e79c6aa188764e7f9 # v1
+      - uses: ruby/setup-ruby@003a5c4d8d6321bd302e38f6f0ec593f77f06600 # v1
         with:
           ruby-version: ${{ inputs.ruby-version }}
           bundler-cache: true

.github/workflows/cd-sam.yaml

@@ -42,7 +42,7 @@ jobs:
     steps:
       - uses: actions/checkout@v7
 
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v7
         with:
           python-version: ${{ inputs.python-version }}
 

.github/workflows/ci-dotnet.yaml

@@ -33,7 +33,7 @@ jobs:
     steps:
       - uses: actions/checkout@v7
 
-      - uses: actions/setup-dotnet@v5
+      - uses: actions/setup-dotnet@v6
         with:
           dotnet-version: ${{ inputs.dotnet-version }}
 

.github/workflows/ci-python-app.yaml

@@ -56,7 +56,7 @@ jobs:
     steps:
       - uses: actions/checkout@v7
 
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v7
         with:
           python-version: ${{ inputs.python-version }}
 
@@ -105,7 +105,7 @@ jobs:
     steps:
       - uses: actions/checkout@v7
 
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v7
         with:
           python-version: ${{ inputs.python-version }}
           cache: pip
@@ -129,7 +129,7 @@ jobs:
     steps:
       - uses: actions/checkout@v7
 
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v7
         with:
           python-version: ${{ inputs.python-version }}
           cache: pip

.github/workflows/ci-python-sam.yaml

@@ -54,7 +54,7 @@ jobs:
     steps:
       - uses: actions/checkout@v7
 
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v7
         with:
           python-version: ${{ inputs.python-version }}
 
@@ -83,7 +83,7 @@ jobs:
 
       - name: Setup Node.js
         if: ${{ inputs.run-cdk-synth }}
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v7
         with:
           node-version: ${{ inputs.node-version }}
 

.github/workflows/ci-static.yaml

@@ -72,7 +72,7 @@ jobs:
     steps:
       - uses: actions/checkout@v7
 
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v7
         if: ${{ inputs.run-htmlhint || inputs.build-command != '' }}
         with:
           node-version: ${{ inputs.node-version }}

.github/workflows/ci-typescript-cdk.yaml

@@ -69,7 +69,7 @@ jobs:
       - uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4
         if: ${{ inputs.enable-qemu }}
 
-      - uses: actions/setup-dotnet@v5
+      - uses: actions/setup-dotnet@v6
         if: ${{ inputs.dotnet-version != '' }}
         with:
           dotnet-version: ${{ inputs.dotnet-version }}
@@ -78,7 +78,7 @@ jobs:
         if: ${{ inputs.dotnet-publish-project != '' }}
         run: dotnet publish ${{ inputs.dotnet-publish-project }} --configuration Release --runtime linux-arm64 --self-contained
 
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v7
         with:
           node-version: ${{ inputs.node-version }}
           cache: npm

.github/workflows/ci-typescript-frontend.yaml

@@ -91,7 +91,7 @@ jobs:
         with:
           fetch-depth: 0
 
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v7
         with:
           node-version: ${{ inputs.node-version }}
           cache: npm

.github/workflows/compliance-audit.yaml

@@ -76,7 +76,7 @@ jobs:
 
       - name: Run compliance audit
         id: audit
-        uses: anthropics/claude-code-action@e90deca47693f9457b72f2b53c17d7c445a87342 # v1
+        uses: anthropics/claude-code-action@af0559ee4f514d1ef21826982bed13f7edc3c35e # v1
         with:
           anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
           prompt: |

oidc-deploy-roles.yaml

@@ -417,6 +417,10 @@ Resources:
                   - s3:PutLifecycleConfiguration
                   - s3:GetBucketPublicAccessBlock
                   - s3:PutBucketPublicAccessBlock
+                  # Explicit BucketEncryption blocks (first: payments-dashboard
+                  # BoaRawBucket, 2026-07-22) need the encryption config pair.
+                  - s3:GetEncryptionConfiguration
+                  - s3:PutEncryptionConfiguration
                   - s3:GetBucketNotification
                   - s3:PutBucketNotification
                   - s3:GetBucketWebsite