The central label rules assumed a root-level project layout
(lib/**, bin/**, cdk/**, src/**), so monorepos that nest components
under top-level dirs (infra/, web/, mobile/, shared/) matched nothing
for those areas. PRs touching only infra/lib/** or web/** ran the
labeler green but received no label.
Label coverage:
- infra: + 'infra/**' (covers infra/lib, infra/bin, infra/cdk.json)
- app: + 'web/**', 'mobile/**', 'shared/**'
Additions are appended to the existing root paths, so single-project
repos are unaffected; deliberately avoided blanket '**/lib/**' globs
that would mislabel web/src/lib/** as infra.
Hardening rolled in while here:
- Pin actions/labeler to a commit SHA (was the floating @v6 tag)
- Add a per-PR concurrency group with a run_id fallback for non-PR
callers, so rapid pushes cancel superseded label runs
- Broaden 'ci' (.github/actions/**), 'dependencies'
(Directory.Packages.props, yarn.lock, pnpm-lock.yaml, Podfile/.lock)
and 'tests' (JS/TS .test/.spec, pytest test_*.py/conftest,
.NET *Tests.cs, Java *Test.java, Go, Ruby) globs
Caller repos must already have any label a rule can emit; actions/labeler
does not create missing labels. The org 'infra' label was backfilled
across repos separately.
Reusable CI for plain Python apps / locally-run tooling that don't deploy via
SAM or CDK. Beyond ruff lint/format + the conventions audit, it adds a
collect-only import check for a root suite whose live run needs secrets, and an
isolated full pytest run for a self-contained subproject dir (whose tests/
package would collide with the root tests/ under one rootdir).
Emits the org-required `ci / ci` via an aggregator job keyed `ci` that gates on
every other job. actionlint-clean.
Add a thin caller so the .github repo invokes its own reusable
callable-labeler.yaml on pull_request, like every consumer repo does. Without a
caller the workflow_call-only labeler never runs on .github's own PRs (this is
why #61 wasn't auto-labeled). Grants the three permissions the reusable requires
(contents:read, pull-requests:write, issues:write).
The org ruleset requires the 'ci / ci' status check on every repo, but this
.github repo only houses reusable (workflow_call) workflows and emitted no such
check — so every PR sat 'Expected — Waiting for status to be reported' and was
unmergeable, including the open Dependabot bumps (#58, #59, #60).
Add a workflow that runs actionlint (pinned, checksum-verified) over the
workflow files. The ruleset matches the required check against the JOB's
check-run name, so the job is named literally 'ci / ci' to emit that exact
context (a job named 'ci' emits context 'ci', which the UI only cosmetically
shows as 'ci / ci'). shellcheck integration is disabled for now; 4 pre-existing
run-step findings are left for a separate cleanup.
Pre-existing checkov IAM findings in oidc-deploy-roles.yaml are accepted-risk
and suppressed via machine-level security-review config, intentionally NOT
committed to this repo.
Add check-dir + build-command inputs. When build-command is set, run
npm ci + the build, then validate the built output in check-dir (e.g.
_site) instead of repo source. Without this, a site that templates its
HTML (Eleventy etc.) has no source HTML and the checks pass vacuously.
Backward-compatible: defaults (check-dir='.', build-command='') preserve
source-mode behavior for existing callers. build-command is passed via
env to avoid expression injection into the run script.
- ci-static.yaml: reusable CI for static HTML/CSS/JS sites (S3+CloudFront
repos with no build framework). Job 'ci' emits the 'ci / ci' status
context required by the org main-branch ruleset, which static sites
previously could not satisfy (only ci-dotnet/python-sam/typescript-cdk
existed). Checks: htmlhint, JSON-LD validity, sitemap well-formedness,
internal-link/asset resolution, README/.gitignore conventions.
- callable-labeler.yaml: add a 'content' rule (html/css/assets/sitemap/
robots) so static-site PRs get labeled instead of matching nothing.
Add callable-labeler.yaml, a reusable workflow that carries the label
rules inline as the single source of truth and writes them to the runner
at execution time, so caller repos need only a short caller workflow and
no per-repo labeler.yml. Triggered by callers on pull_request (private org
takes no fork PRs); requires contents:read + pull-requests:write +
issues:write on every caller so labeler@v5 can create missing labels.
Remove the workflow-templates/labeler.yml starter it supersedes (no
ruleset workflows-rule or compliance-audit reference depends on it).
Add the repo's own dependabot.yml (github-actions, weekly, grouped
minor+patch) to keep the action pins current per the Pinning Principle.
Retire the org-wide weekly Compliance Audit. Workflow is disabled in the
Actions tab and the schedule trigger is removed so it cannot run
automatically; manual workflow_dispatch is retained for archival only.
Repo compliance now runs via the Claude Code App on PRs + the engineering
handbook. The 19 open 'Compliance audit: violations found' issues it
generated are being closed.
INFRA-69: README documented the deleted claude-code-review.yaml workflow and
its rollout as the live PR-review setup. PR reviews are handled by the official
Claude Code App (since 2026-05-13); corrected the workflow list, added a PR
Reviews note, marked the legacy rollout script, and replaced the obsolete
rollout step. Preserved the claude-code-ci App + secrets (compliance-audit
still uses them).
INFRA-68: add SECURITY.md (private vuln reporting via GitHub advisory / email)
and SUPPORT.md (Jira INFRA, handbook, security pointer).
The bootstrap IAM stack (oidc-deploy-roles.yaml) had no README coverage:
how to deploy it manually (no CD pipeline; >51KB needs --s3-bucket), the
scoped github-cfn-execution-role contract, and the
seahaven-lambda-execution-boundary ceiling for SAM Lambda roles.
Documents the INFRA-97 / INFRA-103 work.
The CFN execution role held IAMFullAccess + seven *FullAccess managed
policies, giving it unconstrained AWS admin access. This replaces all
of those with per-service inline statements covering exactly what the
five SAM stacks require during a CloudFormation deploy.
PRIMARY ESCALATION CONTROL: iam:CreateRole, iam:AttachRolePolicy, and
iam:PutRolePolicy are now conditioned on iam:PermissionsBoundary
StringEquals the seahaven-lambda-execution-boundary ARN. Any role the
CFN execution role creates must carry that boundary, capping its
effective permissions at the boundary's ceiling.
SAM RolePath note: AWS::Serverless::Function does not support a custom
RolePath on auto-generated execution roles. Path scoping (e.g.
/cfn-managed/) cannot be used as the escalation guard for SAM auto-roles.
The iam:PermissionsBoundary condition achieves the same security goal.
DEPLOY ORDER DEPENDENCY: the seahaven-lambda-execution-boundary policy
(INFRA-103, PR #45) MUST exist before this stack is deployed. See the
PR description for the mandatory three-step deploy sequence.
Refs: INFRA-97
* Add seahaven-lambda-execution-boundary managed policy
Lambda execution roles auto-generated by SAM have no ceiling today —
a misconfigured Policies block could grant excessive permissions that
persist at runtime. This boundary caps every SAM function execution
role at the union of what the five stacks actually need, so the
effective permissions are always the intersection of the role's own
policies and this document.
The policy is a deliberate superset rather than exact-minimum: being
slightly broad is safer than a boundary that breaks functions at
runtime. Per-service scoping will tighten in follow-up work.
SAM template agents: add
PermissionsBoundary: arn:aws:iam::328440206208:policy/seahaven-lambda-execution-boundary
to Globals.Function in all five stacks after this stack deploys.
Refs: INFRA-103
* Fix boundary gaps found in GPT-4.1 cross-review
Three issues from the mandatory IAM cross-review (BLOCK/FIX):
1. Add KMS statement — PaymentsDashboard DynamoDB table and
payments-dashboard CloudWatch log groups use CMKs. Without
kms:Decrypt + kms:GenerateDataKey in the boundary, those Lambda
calls fail at the KMS layer at runtime. Scoped to account keys only.
2. Add table/*/index/* to DynamoDB resource — dynamodb:Query on a GSI
requires the index ARN; covering only table/* silently denied GSI
queries at the boundary.
3. Fix EC2 ENI statement — remove AssignPrivateIpAddresses /
UnassignPrivateIpAddresses (EFA-only, not part of Lambda ENI
lifecycle); add DescribeSubnets + DescribeSecurityGroups + DescribeVpcs
which are required by the Lambda service during VPC attachment and are
present in AWSLambdaVPCAccessExecutionRole.
4. Add SES configuration-set/* resource — ses:SendRawEmail requires
permission on the configuration set if one is passed at send time.
Refs: INFRA-103
The org ruleset now requires 1 approving review + code-owner review, so
auto-merge can never complete without a human approval — the workflow
only added a no-op (or erroring) check to every PR. Repo-level 'Allow
auto-merge' was also disabled on several repos, making the gh pr merge
--auto call fail benignly. The required-workflow rule referencing this
file was removed from org ruleset 15869156 first.
The group key ci-${{ github.workflow }}-${{ github.ref }} resolves
identically for every job in a caller workflow (github.workflow is the
caller's name in a reusable workflow), so repos calling two reusable CI
workflows from one ci.yaml (e.g. exec-aide python + typescript) had
their jobs cancel each other on every run.
Prefix each group with the reusable workflow's own filename and append
its distinguishing input (source-dirs / working-directory) so sibling
jobs get distinct groups while superseded runs of the same job still
cancel.
Callers grant no explicit permissions, so they pass the org default
read-only token. A reusable workflow cannot request more than its
caller grants, causing startup_failure on every dependency-review run.
dependency-review-action only needs contents: read when not posting
PR comments.
Replace mutable v1 tag references with immutable commit SHAs so a
compromised or force-moved tag cannot inject code into reusable
workflows. Each pin keeps a # v1 comment for readability.
- claude-code-action in compliance-audit.yaml
- ruby/setup-ruby in cd-mobile-ios.yaml (v1 branch)
Superseded CI runs on the same ref keep consuming runners and delay
feedback on the latest push. Add a job-level concurrency group keyed
on github.workflow and github.ref so a new push cancels the in-flight
CI run for that branch.
Concurrency is set at the job level rather than the workflow level
because these are workflow_call reusable workflows: workflow-level
concurrency would resolve github.workflow against the caller's context,
collapsing unrelated callers into one group. cd-* deploy workflows are
intentionally left untouched to avoid cancelling in-flight deploys.
Bump all aws-actions/configure-aws-credentials references to @v6 (org
target) across the reusable CD workflows. v6 is the verified org standard
alongside actions/checkout@v6.
Ref: engineering-handbook cicd.md (workflow standardization).
Bump all actions/checkout references to @v6 (org target). v4 runs on a
node runtime version that is being deprecated; v6 is the verified org
standard alongside configure-aws-credentials@v6.
Ref: engineering-handbook cicd.md (workflow standardization).
Set @amoussa1229 as the default owner for all paths so the new
required code-owner review rule on the org main-branch ruleset has
a reviewer to resolve against. The .github repo CODEOWNERS acts as
the org-wide fallback for repos without their own file.
Add a reusable callable-dependency-review workflow that runs
actions/dependency-review-action with fail-on-severity: high, and
append a Sea Haven checklist to the PR template covering infra,
secrets, PITR, Slack, Confluence, memory, and cross-review.
Codifies the handbook PR description format (Summary/Validation/Tests/
Notes) as the default template GitHub prefills for every repo in the org
that lacks its own. Hidden hint comments carry the title, scope, and Jira
linking conventions so contributors fill in structure instead of a blank
box.
Adds read + (dis)associate wafv2 actions so SAM/CFN deploys can attach the shared
seahaven-app-waf CloudFront WebACL to app distributions (meal-order orders).
Without it, the WebACL association fails 'Unable to verify read permissions on
Web ACL'. IAM cross-reviewed (no BLOCK). Not wafv2:* — scoped to read +
associate. Same manual-changeset deploy path as the H-16 change.
The SAM template secret check grepped the 5 lines after `Environment:` for
API_KEY|SECRET|TOKEN|PASSWORD|WEBHOOK. That flags env var *names* like
`SLACK_BOT_TOKEN_SECRET: my-app/slack-token`, whose value is a Secrets
Manager id — i.e. the recommended pattern — so any well-architected
template failed CI.
Match on the value's shape instead: known inline secret formats (Slack
xox* tokens, AWS AKIA keys, GitHub gh*_/PAT tokens, sk- keys, PEM private
keys). Secrets Manager references and intrinsic functions no longer trip
it, while pasted real secrets still fail the build.
- New githubdeploy-seahaven-account-baseline OIDC role (CDK pattern: assumes
cdk-hnb659fds-*, scoped to the repo's main branch). Wires CD for the shared
account-baseline repo (CloudTrail C-1 + AWS Backup C-7).
- Codify cloudfront:* and ssm:* on github-cfn-execution-role to reconcile
out-of-band drift (audit H-16). These are needed by live SAM deploys
(meal-order CloudFront; afterhours/payments/meal-order SSM params).
Deployed via change set wire-account-baseline-and-h16; stack now IN_SYNC.
IAM cross-review completed (new role confirmed; cfn-exec breadth documented).
Mirrors the existing per-repo deploy roles (StringLike sub claim, scoped to
repo:<org>/apm-wo-analysis:ref:refs/heads/main, sts:AssumeRole on
cdk-hnb659fds-* only). Cross-reviewed (cross_reviewer): additive, no existing
role modified; the one flagged item (StringLike->StringEquals) was a false
positive — all 8 existing roles use StringLike, so this is consistent.
Extend ci-typescript-cdk and cd-cdk with working-directory,
dotnet pre-build, and post-deploy script inputs. Add new
ci-dotnet and cd-mobile-ios reusable workflows.
