Merge branch 'main' into chore/sha-pin-actions

.github/CODEOWNERS

@@ -0,0 +1 @@
+* @amoussa1229

.github/PULL_REQUEST_TEMPLATE.md

@@ -16,3 +16,12 @@ PR conventions — see engineering-handbook/pull-requests.md
 
 ## Notes
 <!-- Anything reviewers should know: migration steps, deploy order, follow-ups, breaking changes. Delete this section if empty. -->
+
+## Sea Haven checklist
+- [ ] CDK diff / SAM changeset reviewed (if infra change)
+- [ ] Secrets added to Parameter Store / Secrets Manager (not hardcoded)
+- [ ] DynamoDB PITR verified on new tables
+- [ ] Slack notification tested in staging
+- [ ] Confluence Architecture Map updated
+- [ ] Memory update queued (if new repo/stack)
+- [ ] Cross-review requested (if IAM or Lambda handler signature change)

.github/workflows/callable-dependency-review.yaml

@@ -0,0 +1,14 @@
+name: Dependency Review
+on:
+  workflow_call:
+permissions:
+  contents: read
+  pull-requests: write
+jobs:
+  dependency-review:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: actions/dependency-review-action@v4
+        with:
+          fail-on-severity: high

.github/workflows/cd-cdk.yaml

@@ -53,7 +53,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - uses: docker/setup-qemu-action@v3
         if: ${{ inputs.enable-qemu }}
@@ -90,7 +90,7 @@ jobs:
             pip install -r "$req"
           done
 
-      - uses: aws-actions/configure-aws-credentials@v4
+      - uses: aws-actions/configure-aws-credentials@v6
         with:
           role-to-assume: ${{ secrets.deploy-role-arn }}
           aws-region: ${{ inputs.region }}

.github/workflows/cd-mobile-ios.yaml

@@ -60,9 +60,9 @@ jobs:
       run:
         working-directory: ${{ inputs.working-directory }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
-      - uses: aws-actions/configure-aws-credentials@v4
+      - uses: aws-actions/configure-aws-credentials@v6
         with:
           role-to-assume: ${{ secrets.deploy-role-arn }}
           aws-region: ${{ inputs.region }}

.github/workflows/cd-sam.yaml

@@ -40,7 +40,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - uses: actions/setup-python@v5
         with:
@@ -48,7 +48,7 @@ jobs:
 
       - uses: aws-actions/setup-sam@v2
 
-      - uses: aws-actions/configure-aws-credentials@v4
+      - uses: aws-actions/configure-aws-credentials@v6
         with:
           role-to-assume: ${{ secrets.deploy-role-arn }}
           aws-region: ${{ inputs.region }}

.github/workflows/ci-dotnet.yaml

@@ -24,11 +24,14 @@ jobs:
   ci:
     runs-on: ubuntu-latest
     timeout-minutes: 20
+    concurrency:
+      group: ci-${{ github.workflow }}-${{ github.ref }}
+      cancel-in-progress: true
     defaults:
       run:
         working-directory: ${{ inputs.working-directory }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - uses: actions/setup-dotnet@v5
         with:

.github/workflows/ci-python-sam.yaml

@@ -48,8 +48,11 @@ jobs:
   ci:
     runs-on: ubuntu-latest
     timeout-minutes: 10
+    concurrency:
+      group: ci-${{ github.workflow }}-${{ github.ref }}
+      cancel-in-progress: true
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - uses: actions/setup-python@v5
         with:

.github/workflows/ci-typescript-cdk.yaml

@@ -60,8 +60,11 @@ jobs:
   ci:
     runs-on: ubuntu-latest
     timeout-minutes: 30
+    concurrency:
+      group: ci-${{ github.workflow }}-${{ github.ref }}
+      cancel-in-progress: true
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - uses: docker/setup-qemu-action@v3
         if: ${{ inputs.enable-qemu }}

.github/workflows/compliance-audit.yaml

@@ -57,13 +57,13 @@ jobs:
           repositories: ${{ matrix.repo }},engineering-handbook
 
       - name: Checkout repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           repository: Sea-Haven-Industries/${{ matrix.repo }}
           token: ${{ steps.app-token.outputs.token }}
 
       - name: Checkout engineering handbook
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           repository: Sea-Haven-Industries/engineering-handbook
           token: ${{ steps.app-token.outputs.token }}