1528c01e94
feat(ci): add HCP Lambda zip deploy reusable (PLAT-79)
2026-09-28 15:18:57 -04:00
Adam Moussa
892580d7d7
fix(iam): match org-baseline policy-check OIDC subject (PLAT-234) ( #155 )
...
ci / ci / ci (push) Waiting to run
Pull request tokens use repo:ORG/seahaven-org-baseline:pull_request.
Merge queue tokens use the gh-readonly-queue ref. The previous
refs/pull/* subject never matched either.
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: Adam Moussa <amoussa1229@users.noreply.github.com>
2026-09-28 18:38:19 +00:00
Adam Moussa
c9134742ce
chore(iam): remove soaked githubdeploy roles from the template (PLAT-232) ( #154 )
...
ci / ci / ci (push) Waiting to run
Drops the management-account deploy roles for front-integrations,
afi-backup-monitor, exec-aide, seahaven-door-unlock-api, and
apm-wo-analysis. CloudTrail showed no successful mutation for 14 days.
Deploying this stack deletes those roles. This change does not deploy it.
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: Adam Moussa <amoussa1229@users.noreply.github.com>
2026-09-28 16:55:02 +00:00
Adam Moussa
8e6b8e8665
feat(iam): add org-baseline Access Analyzer CI role (PLAT-234) ( #153 )
...
ci / ci / ci (push) Waiting to run
* feat(iam): add org-baseline Access Analyzer CI role (PLAT-234)
Adds githubdeploy-seahaven-org-baseline-policy-check with only
ValidatePolicy and CheckNoNewAccess, trusted for main and pull_request.
The deploy role stays limited to main and CDK assume.
Co-authored-by: Adam Moussa <amoussa1229@users.noreply.github.com>
* docs(iam): point the policy-check role at its CI job (PLAT-234)
The Access Analyzer checks live in seahaven-org-baseline pull request 160.
This role is only the principal that job assumes.
Co-authored-by: Adam Moussa <amoussa1229@users.noreply.github.com>
* fix(iam): match the default pull request OIDC subject (PLAT-234)
Trust refs/pull/* so seahaven-org-baseline pull request tokens can assume
the policy-check role. The immutable subject claim is not enabled.
Co-authored-by: Adam Moussa <amoussa1229@users.noreply.github.com>
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: Adam Moussa <amoussa1229@users.noreply.github.com>
2026-09-28 16:23:57 +00:00
Adam Moussa
0a1010e632
feat(ci): add a static-site HCP deploy caller (PLAT-225) ( #152 )
...
ci / ci / ci (push) Has been cancelled
Release on reusable change / version (push) Has been cancelled
Release on reusable change / release (push) Has been cancelled
Unfingerprinted Eleventy builds need a one-day asset cache, not the SPA immutable sync.
2026-09-24 23:24:57 +00:00
Adam Moussa
6fc4ca31e1
chore(renovate): add the empty org preset (PLAT-224) ( #151 )
...
ci / ci / ci (push) Waiting to run
local>Sea-Haven-Industries/.github resolves to default.json. Policy stays in renovate-config.
2026-09-24 18:38:49 +00:00
Adam Moussa
bf14925fcf
feat(ci): derive Fargate health URL from CloudFront ( #150 )
...
ci / ci / ci (push) Waiting to run
Release on reusable change / version (push) Waiting to run
Release on reusable change / release (push) Blocked by required conditions
Callers that cannot add an SSM parameter to a shared permissions boundary can set health-from-distribution. The default still reads SSM api-url.
2026-09-24 16:49:49 +00:00
Adam Moussa
acaf2bfc0d
feat(ci): let HCP deploys share an SSM prefix ( #149 )
...
ci / ci / ci (push) Waiting to run
Release on reusable change / version (push) Waiting to run
Release on reusable change / release (push) Blocked by required conditions
Optional task-env replace, source-map upload, health attempts, and a concurrency suffix keep existing callers on the same defaults.
2026-09-24 16:15:53 +00:00
Adam Moussa
2e2b3a282f
fix(ci): link autofix commits to the bot account ( #148 )
...
ci / ci / ci (push) Waiting to run
Release on reusable change / version (push) Waiting to run
Release on reusable change / release (push) Blocked by required conditions
Use the bot account id in the noreply email so GitHub attaches the
app logo. The App id prefix pushes a commit that stays unlinked.
2026-09-23 20:15:19 -04:00
Adam Moussa
61f15d78b5
feat(ci): add formatter presets to autofix ( #147 )
...
Callers can run prettier, eslint, ruff, and terraform without passing
npm run lint -- --fix, which chains non-fixers in several apps.
2026-09-23 23:47:30 +00:00
Adam Moussa
fd41132410
ci: drop pytest lanes from ci-python-app ( #146 )
...
ci / ci / ci (push) Has been cancelled
Release on reusable change / version (push) Has been cancelled
Release on reusable change / release (push) Has been cancelled
Collect-only and subproject-tests were unused on most callers. Pytest stays a caller-owned job. The reusable now emits lint plus the ci / ci aggregator.
2026-09-22 15:52:03 -04:00
Adam Moussa
216604ad67
feat(ci): add HCP reusable workflows and drop Mergify ( #145 )
...
* feat(ci): add HCP reusable workflows and drop Mergify
Callers can pin org Fargate/SPA CD and parallel CI instead of copying per-repo deploy jobs.
* chore(ci): remove deprecated PR policy reusable
policy / pr is no longer a required check. Drop the callable, its unit tests, and the setup docs so callers stop pinning a retired gate.
2026-09-22 19:22:23 +00:00
renovate[bot]
22c47f924f
chore(deps): update github actions ( #144 )
...
ci / ci / ci (push) Has been cancelled
Release on reusable change / version (push) Has been cancelled
Release on reusable change / release (push) Has been cancelled
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-09-21 15:46:36 +00:00
renovate[bot]
08d8ca31a9
chore(deps): update sea-haven-industries/.github action to v1.0.11 ( #143 )
...
ci / ci / ci (push) Has been cancelled
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-09-16 16:46:00 +00:00
Adam Moussa
514552df92
feat(iam): allow afterhours WeeklyPost to send to paychex-checkcomponents (PLAT-135) ( #142 )
ci / ci / ci (push) Has been cancelled
2026-09-09 23:59:57 +00:00
renovate[bot]
9781774f04
chore(deps): update github actions ( #141 )
...
ci / ci / ci (push) Waiting to run
Release on reusable change / version (push) Has been cancelled
Release on reusable change / release (push) Has been cancelled
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-09-09 18:41:06 +00:00
renovate[bot]
9b7b464d5c
chore(deps): update sea-haven-industries/.github action to v1.0.10 ( #140 )
...
ci / ci / ci (push) Has been cancelled
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-08-31 15:48:50 +00:00
Adam Moussa
4a6cbfd362
ci(workflows): pin remaining GitHub Actions to SHA ( #139 )
...
ci / ci / ci (push) Has been cancelled
Release on reusable change / version (push) Has been cancelled
Release on reusable change / release (push) Has been cancelled
Mutable tags and the dependency-review v5 branch executed inside every consumer, including OIDC deploy jobs. SHA pins with version comments match the policy scanner and let Renovate advance them.
2026-08-26 18:25:53 -04:00
Adam Moussa
1a45bf286f
fix(ci): unstick mergify queue timeout and draft protections ( #138 )
ci / ci / ci (push) Waiting to run
2026-08-25 13:51:45 -04:00
Adam Moussa
2fe812e3f9
fix(ci): batch mergify queue to avoid in-place review dismissal ( #137 )
2026-08-25 13:31:25 -04:00
Adam Moussa
727627f1da
chore(deps): remove dependabot version updates ( #136 )
...
ci / ci / ci (push) Waiting to run
Renovate is the version-update bot on this Interactive repo. GitHub Dependabot alerts stay.
2026-08-25 11:50:49 -04:00
Adam Moussa
6a35d89541
feat(ci): queue mergify PRs with a queue ready label ( #135 )
...
ci / ci / ci (push) Waiting to run
Applying the label kicks a stuck PR without an @mergifyio comment. Auto-queue and review/CI gates stay.
2026-08-24 19:16:43 -04:00
renovate[bot]
e5b0cf714d
chore(deps): update github actions ( #134 )
ci / ci / ci (push) Waiting to run
Release on reusable change / version (push) Has been cancelled
Release on reusable change / release (push) Has been cancelled
2026-08-24 21:18:32 +00:00
Adam Moussa
cc75356ed1
fix(ci): drop two-step mergify merge conditions ( #133 )
2026-08-24 16:47:44 -04:00
Adam Moussa
91ff9ed08e
fix(ci): gate mergify on github-review-decision instead of approval count ( #132 )
ci / ci / ci (push) Waiting to run
2026-08-24 15:42:59 -04:00
Adam Moussa
db5e1b4b19
chore(ci): remove pr-policy starter template ( #131 )
ci / ci / ci (push) Waiting to run
2026-08-24 15:11:41 -04:00
Adam Moussa
dc56defea2
fix(ci): allow dependabot and renovate in mergify queue ( #130 )
ci / ci / ci (push) Waiting to run
2026-08-24 14:13:41 -04:00
Adam Moussa
deff75a3bb
fix: update merge queue configuration ( #129 )
...
Signed-off-by: Adam Moussa <null>
2026-08-24 14:09:28 -04:00
mergify[bot]
08e8520c1f
Merge pull request #128 from Sea-Haven-Industries/chore/switch-to-mergify
...
chore(ci): switch auto-merge from seahaven-bot to Mergify (PLAT-108)
2026-08-24 17:50:58 +00:00
9fb1bb5549
fix(ci): use github-review-decision instead of illegal CODEOWNERS condition
2026-08-24 13:26:42 -04:00
a04036962c
fix(ci): require review and ci before mergify auto-queue
2026-08-24 13:17:14 -04:00
dce935ce31
chore(ci): switch auto-merge from seahaven-bot to Mergify
2026-08-24 13:06:47 -04:00
Adam Moussa
f2f2d4066c
ci: enable squash auto-merge on ready PRs (PLAT-108) ( #126 )
...
ci / ci / ci (push) Has been cancelled
* ci: enable squash auto-merge on ready PRs
* fix: add auto-merge.yaml as a release exclusion
* fix(ci): serialize auto-merge enable and ignore already-enabled
2026-08-21 23:34:16 +00:00
Adam Moussa
8ec1f627fe
ci: add merge_group and drop policy caller (PLAT-108) ( #125 )
...
ci / ci / ci (push) Waiting to run
* ci: add merge_group trigger for required ci / ci
* ci: drop this repo's PR policy caller
2026-08-21 17:41:23 -04:00
Adam Moussa
af0f002e14
ci: expand labeler globs and skip dependabot pr policy (PLAT-107) ( #124 )
...
ci / ci / ci (push) Waiting to run
Release on reusable change / version (push) Has been cancelled
Release on reusable change / release (push) Has been cancelled
* ci: expand labeler globs and skip dependabot pr policy
.NET product paths never matched app, so backend PRs stayed unlabeled. Dependabot PRs still ran commit-subject and pin checks on generated titles. Skip those PRs in the reusable policy job.
* fix(labeler): match nested elastic beanstalk config paths
Root-only .ebextensions and .platform globs miss api/.ebextensions in monorepos. Mirror the Dockerfile nested form.
2026-08-21 12:42:28 -04:00
Adam Moussa
59c7b1f9a3
chore(iam): remove mgmt meal-order weekly-menu OIDC role ( #123 )
...
ci / ci / ci (push) Waiting to run
Weekly-menu publish now assumes the prod HCP role; drop the orphaned
mgmt github-meal-order-manager-weekly-menu role from this stack.
2026-08-20 13:21:59 -04:00
dependabot[bot]
d37ca73ffa
chore(deps): bump callable-pr-policy.yaml ( #122 )
...
ci / ci / ci (push) Has been cancelled
Bumps the minor-and-patch group with 1 update: [Sea-Haven-Industries/.github/.github/workflows/callable-pr-policy.yaml](https://github.com/sea-haven-industries/.github ).
Updates `Sea-Haven-Industries/.github/.github/workflows/callable-pr-policy.yaml` from 1.0.6 to 1.0.7
- [Release notes](https://github.com/sea-haven-industries/.github/releases )
- [Commits](7ac3528750...e5691d8a7f
2026-08-17 19:11:53 +00:00
Adam Moussa
e5691d8a7f
fix(policy): accept AP Jira keys in PR titles ( #121 )
ci / ci / ci (push) Has been cancelled
Release on reusable change / version (push) Has been cancelled
Release on reusable change / release (push) Has been cancelled
2026-08-10 20:55:27 +00:00
dependabot[bot]
123366c3f1
chore(deps): bump callable-pr-policy.yaml ( #120 )
...
ci / ci / ci (push) Waiting to run
Bumps the minor-and-patch group with 1 update: [Sea-Haven-Industries/.github/.github/workflows/callable-pr-policy.yaml](https://github.com/sea-haven-industries/.github ).
Updates `Sea-Haven-Industries/.github/.github/workflows/callable-pr-policy.yaml` from 1.0.5 to 1.0.6
- [Release notes](https://github.com/sea-haven-industries/.github/releases )
- [Commits](9c1ecf9428...7ac3528750
2026-08-10 17:55:10 +00:00
Adam Moussa
9a2efffce3
fix(iam): grant weekly-menu role SSM deploy params ( #119 )
ci / ci / ci (push) Waiting to run
2026-08-10 11:39:40 -04:00
Adam Moussa
9f2adabbea
chore(iam): remove procurement-ingest OIDC deploy role (PLAT-88) ( #118 )
...
ci / ci / ci (push) Has been cancelled
* chore(iam): remove procurement-ingest OIDC deploy role
* chore(iam): drop procurement-ingest OIDC role output
2026-08-07 12:42:07 -04:00
Adam Moussa
7ac3528750
fix(policy): allow sync merges and longer PR titles ( #117 )
...
ci / ci / ci (push) Has been cancelled
Release on reusable change / version (push) Has been cancelled
Release on reusable change / release (push) Has been cancelled
Refs: PLAT-62
2026-08-04 14:41:48 -04:00
Adam Moussa
12e70a2279
ci: add released PR policy self-caller ( #116 )
...
ci / ci / ci (push) Waiting to run
Refs: PLAT-62
2026-08-04 11:16:48 -04:00
Adam Moussa
9c1ecf9428
ci: add deterministic PR policy and align org templates (PLAT-62) ( #115 )
...
ci / ci / ci (push) Waiting to run
Release on reusable change / version (push) Waiting to run
Release on reusable change / release (push) Blocked by required conditions
* docs: align organization templates with Cursor conventions
Refs: PLAT-62
* ci: add deterministic PR policy gate
Refs: PLAT-62
* fix(ci): grandfather unchanged workflow policy debt
Refs: PLAT-62
* fix(ci): address PR policy security review
Refs: PLAT-62
* fix(ci): scan copied workflow files
Refs: PLAT-62
* fix(ci): close remaining workflow policy bypasses
Refs: PLAT-62
* fix(policy): reject uses block scalar action refs
Co-authored-by: Adam Moussa <amoussa1229@users.noreply.github.com>
* fix(policy): preserve line-specific violation fingerprints
Co-authored-by: Adam Moussa <amoussa1229@users.noreply.github.com>
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: Adam Moussa <amoussa1229@users.noreply.github.com>
2026-08-03 20:30:32 -04:00
Adam Moussa
b94062bd86
fix(iam): grant weekly-menu role execute-api invoke ( #114 )
ci / ci / ci (push) Waiting to run
Release on reusable change / version (push) Waiting to run
Release on reusable change / release (push) Blocked by required conditions
2026-08-03 15:32:35 -04:00
Adam Moussa
81cf168170
fix(deploy): recover SAM stacks after update rollback
2026-08-03 14:38:39 -04:00
Adam Moussa
9a7171a855
Merge pull request #112 from Sea-Haven-Industries/docs/readme-pinning-and-catalog
...
ci / ci / ci (push) Has been cancelled
docs: align README pinning policy with SHA-pin convention and complete the catalog
2026-07-29 13:02:55 -04:00
ca5dae6aff
docs: align README pinning policy with SHA-pin convention and complete the catalog
2026-07-29 13:00:53 -04:00
Adam Moussa
18e207a799
Merge pull request #111 from Sea-Haven-Industries/feat/weekly-menu-scoped-role
...
ci / ci / ci (push) Waiting to run
Release on reusable change / version (push) Has been cancelled
Release on reusable change / release (push) Has been cancelled
feat(iam): add scoped OIDC role for the meal-order-manager weekly-menu job
2026-07-28 19:24:29 -04:00
c2c1b80b60
feat(iam): add scoped OIDC role for the meal-order-manager weekly-menu job
2026-07-28 19:16:05 -04:00
