f22b3132a2
chore(ci): remove deprecated PR policy reusable
...
policy / pr is no longer a required check. Drop the callable, its unit tests, and the setup docs so callers stop pinning a retired gate.
2026-09-22 15:05:36 -04:00
9e3d0d4430
feat(ci): add HCP reusable workflows and drop Mergify
...
Callers can pin org Fargate/SPA CD and parallel CI instead of copying per-repo deploy jobs.
2026-09-22 14:53:46 -04:00
renovate[bot]
22c47f924f
chore(deps): update github actions ( #144 )
...
ci / ci / ci (push) Has been cancelled
Release on reusable change / version (push) Has been cancelled
Release on reusable change / release (push) Has been cancelled
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-09-21 15:46:36 +00:00
renovate[bot]
08d8ca31a9
chore(deps): update sea-haven-industries/.github action to v1.0.11 ( #143 )
...
ci / ci / ci (push) Has been cancelled
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-09-16 16:46:00 +00:00
Adam Moussa
514552df92
feat(iam): allow afterhours WeeklyPost to send to paychex-checkcomponents (PLAT-135) ( #142 )
ci / ci / ci (push) Has been cancelled
2026-09-09 23:59:57 +00:00
renovate[bot]
9781774f04
chore(deps): update github actions ( #141 )
...
ci / ci / ci (push) Waiting to run
Release on reusable change / version (push) Has been cancelled
Release on reusable change / release (push) Has been cancelled
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-09-09 18:41:06 +00:00
renovate[bot]
9b7b464d5c
chore(deps): update sea-haven-industries/.github action to v1.0.10 ( #140 )
...
ci / ci / ci (push) Has been cancelled
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-08-31 15:48:50 +00:00
Adam Moussa
4a6cbfd362
ci(workflows): pin remaining GitHub Actions to SHA ( #139 )
...
ci / ci / ci (push) Has been cancelled
Release on reusable change / version (push) Has been cancelled
Release on reusable change / release (push) Has been cancelled
Mutable tags and the dependency-review v5 branch executed inside every consumer, including OIDC deploy jobs. SHA pins with version comments match the policy scanner and let Renovate advance them.
2026-08-26 18:25:53 -04:00
Adam Moussa
1a45bf286f
fix(ci): unstick mergify queue timeout and draft protections ( #138 )
ci / ci / ci (push) Waiting to run
2026-08-25 13:51:45 -04:00
Adam Moussa
2fe812e3f9
fix(ci): batch mergify queue to avoid in-place review dismissal ( #137 )
2026-08-25 13:31:25 -04:00
Adam Moussa
727627f1da
chore(deps): remove dependabot version updates ( #136 )
...
ci / ci / ci (push) Waiting to run
Renovate is the version-update bot on this Interactive repo. GitHub Dependabot alerts stay.
2026-08-25 11:50:49 -04:00
Adam Moussa
6a35d89541
feat(ci): queue mergify PRs with a queue ready label ( #135 )
...
ci / ci / ci (push) Waiting to run
Applying the label kicks a stuck PR without an @mergifyio comment. Auto-queue and review/CI gates stay.
2026-08-24 19:16:43 -04:00
renovate[bot]
e5b0cf714d
chore(deps): update github actions ( #134 )
ci / ci / ci (push) Waiting to run
Release on reusable change / version (push) Has been cancelled
Release on reusable change / release (push) Has been cancelled
2026-08-24 21:18:32 +00:00
Adam Moussa
cc75356ed1
fix(ci): drop two-step mergify merge conditions ( #133 )
2026-08-24 16:47:44 -04:00
Adam Moussa
91ff9ed08e
fix(ci): gate mergify on github-review-decision instead of approval count ( #132 )
ci / ci / ci (push) Waiting to run
2026-08-24 15:42:59 -04:00
Adam Moussa
db5e1b4b19
chore(ci): remove pr-policy starter template ( #131 )
ci / ci / ci (push) Waiting to run
2026-08-24 15:11:41 -04:00
Adam Moussa
dc56defea2
fix(ci): allow dependabot and renovate in mergify queue ( #130 )
ci / ci / ci (push) Waiting to run
2026-08-24 14:13:41 -04:00
Adam Moussa
deff75a3bb
fix: update merge queue configuration ( #129 )
...
Signed-off-by: Adam Moussa <null>
2026-08-24 14:09:28 -04:00
mergify[bot]
08e8520c1f
Merge pull request #128 from Sea-Haven-Industries/chore/switch-to-mergify
...
chore(ci): switch auto-merge from seahaven-bot to Mergify (PLAT-108)
2026-08-24 17:50:58 +00:00
9fb1bb5549
fix(ci): use github-review-decision instead of illegal CODEOWNERS condition
2026-08-24 13:26:42 -04:00
a04036962c
fix(ci): require review and ci before mergify auto-queue
2026-08-24 13:17:14 -04:00
dce935ce31
chore(ci): switch auto-merge from seahaven-bot to Mergify
2026-08-24 13:06:47 -04:00
Adam Moussa
f2f2d4066c
ci: enable squash auto-merge on ready PRs (PLAT-108) ( #126 )
...
ci / ci / ci (push) Has been cancelled
* ci: enable squash auto-merge on ready PRs
* fix: add auto-merge.yaml as a release exclusion
* fix(ci): serialize auto-merge enable and ignore already-enabled
2026-08-21 23:34:16 +00:00
Adam Moussa
8ec1f627fe
ci: add merge_group and drop policy caller (PLAT-108) ( #125 )
...
ci / ci / ci (push) Waiting to run
* ci: add merge_group trigger for required ci / ci
* ci: drop this repo's PR policy caller
2026-08-21 17:41:23 -04:00
Adam Moussa
af0f002e14
ci: expand labeler globs and skip dependabot pr policy (PLAT-107) ( #124 )
...
ci / ci / ci (push) Waiting to run
Release on reusable change / version (push) Has been cancelled
Release on reusable change / release (push) Has been cancelled
* ci: expand labeler globs and skip dependabot pr policy
.NET product paths never matched app, so backend PRs stayed unlabeled. Dependabot PRs still ran commit-subject and pin checks on generated titles. Skip those PRs in the reusable policy job.
* fix(labeler): match nested elastic beanstalk config paths
Root-only .ebextensions and .platform globs miss api/.ebextensions in monorepos. Mirror the Dockerfile nested form.
2026-08-21 12:42:28 -04:00
Adam Moussa
59c7b1f9a3
chore(iam): remove mgmt meal-order weekly-menu OIDC role ( #123 )
...
ci / ci / ci (push) Waiting to run
Weekly-menu publish now assumes the prod HCP role; drop the orphaned
mgmt github-meal-order-manager-weekly-menu role from this stack.
2026-08-20 13:21:59 -04:00
dependabot[bot]
d37ca73ffa
chore(deps): bump callable-pr-policy.yaml ( #122 )
...
ci / ci / ci (push) Has been cancelled
Bumps the minor-and-patch group with 1 update: [Sea-Haven-Industries/.github/.github/workflows/callable-pr-policy.yaml](https://github.com/sea-haven-industries/.github ).
Updates `Sea-Haven-Industries/.github/.github/workflows/callable-pr-policy.yaml` from 1.0.6 to 1.0.7
- [Release notes](https://github.com/sea-haven-industries/.github/releases )
- [Commits](7ac3528750...e5691d8a7f
2026-08-17 19:11:53 +00:00
Adam Moussa
e5691d8a7f
fix(policy): accept AP Jira keys in PR titles ( #121 )
ci / ci / ci (push) Has been cancelled
Release on reusable change / version (push) Has been cancelled
Release on reusable change / release (push) Has been cancelled
2026-08-10 20:55:27 +00:00
dependabot[bot]
123366c3f1
chore(deps): bump callable-pr-policy.yaml ( #120 )
...
ci / ci / ci (push) Waiting to run
Bumps the minor-and-patch group with 1 update: [Sea-Haven-Industries/.github/.github/workflows/callable-pr-policy.yaml](https://github.com/sea-haven-industries/.github ).
Updates `Sea-Haven-Industries/.github/.github/workflows/callable-pr-policy.yaml` from 1.0.5 to 1.0.6
- [Release notes](https://github.com/sea-haven-industries/.github/releases )
- [Commits](9c1ecf9428...7ac3528750
2026-08-10 17:55:10 +00:00
Adam Moussa
9a2efffce3
fix(iam): grant weekly-menu role SSM deploy params ( #119 )
ci / ci / ci (push) Waiting to run
2026-08-10 11:39:40 -04:00
Adam Moussa
9f2adabbea
chore(iam): remove procurement-ingest OIDC deploy role (PLAT-88) ( #118 )
...
ci / ci / ci (push) Has been cancelled
* chore(iam): remove procurement-ingest OIDC deploy role
* chore(iam): drop procurement-ingest OIDC role output
2026-08-07 12:42:07 -04:00
Adam Moussa
7ac3528750
fix(policy): allow sync merges and longer PR titles ( #117 )
...
ci / ci / ci (push) Has been cancelled
Release on reusable change / version (push) Has been cancelled
Release on reusable change / release (push) Has been cancelled
Refs: PLAT-62
2026-08-04 14:41:48 -04:00
Adam Moussa
12e70a2279
ci: add released PR policy self-caller ( #116 )
...
ci / ci / ci (push) Waiting to run
Refs: PLAT-62
2026-08-04 11:16:48 -04:00
Adam Moussa
9c1ecf9428
ci: add deterministic PR policy and align org templates (PLAT-62) ( #115 )
...
ci / ci / ci (push) Waiting to run
Release on reusable change / version (push) Waiting to run
Release on reusable change / release (push) Blocked by required conditions
* docs: align organization templates with Cursor conventions
Refs: PLAT-62
* ci: add deterministic PR policy gate
Refs: PLAT-62
* fix(ci): grandfather unchanged workflow policy debt
Refs: PLAT-62
* fix(ci): address PR policy security review
Refs: PLAT-62
* fix(ci): scan copied workflow files
Refs: PLAT-62
* fix(ci): close remaining workflow policy bypasses
Refs: PLAT-62
* fix(policy): reject uses block scalar action refs
Co-authored-by: Adam Moussa <amoussa1229@users.noreply.github.com>
* fix(policy): preserve line-specific violation fingerprints
Co-authored-by: Adam Moussa <amoussa1229@users.noreply.github.com>
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: Adam Moussa <amoussa1229@users.noreply.github.com>
2026-08-03 20:30:32 -04:00
Adam Moussa
b94062bd86
fix(iam): grant weekly-menu role execute-api invoke ( #114 )
ci / ci / ci (push) Waiting to run
Release on reusable change / version (push) Waiting to run
Release on reusable change / release (push) Blocked by required conditions
2026-08-03 15:32:35 -04:00
Adam Moussa
81cf168170
fix(deploy): recover SAM stacks after update rollback
2026-08-03 14:38:39 -04:00
Adam Moussa
9a7171a855
Merge pull request #112 from Sea-Haven-Industries/docs/readme-pinning-and-catalog
...
ci / ci / ci (push) Has been cancelled
docs: align README pinning policy with SHA-pin convention and complete the catalog
2026-07-29 13:02:55 -04:00
ca5dae6aff
docs: align README pinning policy with SHA-pin convention and complete the catalog
2026-07-29 13:00:53 -04:00
Adam Moussa
18e207a799
Merge pull request #111 from Sea-Haven-Industries/feat/weekly-menu-scoped-role
...
ci / ci / ci (push) Waiting to run
Release on reusable change / version (push) Has been cancelled
Release on reusable change / release (push) Has been cancelled
feat(iam): add scoped OIDC role for the meal-order-manager weekly-menu job
2026-07-28 19:24:29 -04:00
c2c1b80b60
feat(iam): add scoped OIDC role for the meal-order-manager weekly-menu job
2026-07-28 19:16:05 -04:00
Adam Moussa
3f74677422
Merge pull request #110 from Sea-Haven-Industries/fix/ci-ts-cdk-npm-test
...
fix(ci): run npm test instead of hardcoded npx jest in ci-typescript-cdk
2026-07-28 18:46:15 -04:00
Adam Moussa
93a370bfa8
fix(ci): run npm test instead of hardcoded npx jest in ci-typescript-cdk
2026-07-28 18:44:30 -04:00
Adam Moussa
3620c84cbb
Merge pull request #109 from Sea-Haven-Industries/fix/audit-github-script
...
ci / ci / ci (push) Waiting to run
ci(templates): pin github-script to v9.0.0 in the triage starter
2026-07-28 18:40:58 -04:00
Adam Moussa
e2c43bd4ee
ci(templates): pin github-script to v9.0.0 in the triage starter
2026-07-28 18:37:45 -04:00
Adam Moussa
0170a57c0d
Merge pull request #108 from Sea-Haven-Industries/fix/reusable-concurrency-job-key
...
ci / ci / ci (push) Waiting to run
Release on reusable change / version (push) Waiting to run
Release on reusable change / release (push) Blocked by required conditions
fix(ci): key multi-job reusable concurrency on a literal job id
2026-07-28 17:26:19 -04:00
a394b54f82
fix(ci): key multi-job reusable concurrency on a literal job id
...
ci-python-app.yaml and ci-mobile-ios.yaml built their concurrency group
from ${{ github.job }}. In a called workflow that expression evaluates to
the caller's job id, not the job's own id, so every job in the reusable
resolved to the same group. With cancel-in-progress: true they cancelled
each other.
Observed in pr-reviewer after repinning it off a ref that predates the
concurrency blocks: one run, ci / lint cancelled 1s after start by a
sibling, ci / subproject-tests succeeded, and the aggregator failed on the
cancelled dependency.
Replaces the expression with the job id written out literally in all 7
groups, and records the reason at the first block in each file.
2026-07-28 17:22:51 -04:00
Adam Moussa
880ba803d2
Merge pull request #107 from Sea-Haven-Industries/docs/release-reusable-caller-note
...
docs(release): point the reusable at this repo's own caller
2026-07-28 17:15:11 -04:00
7c0c6ab984
docs(release): point the reusable at this repo's own caller
...
release.yaml documented a generic caller example but not the caller that
actually exists in this repo. Notes that release-on-merge.yaml computes the
version, calls this workflow by local path, and is the only caller that does
so without a version comment.
2026-07-28 17:13:44 -04:00
Adam Moussa
2fbfb2e7cf
Merge pull request #106 from Sea-Haven-Industries/feat/release-on-reusable-change
...
feat(release): cut a tag and release when a reusable workflow changes
2026-07-28 17:05:28 -04:00
34977d2457
feat(release): cut a tag and release when a reusable workflow changes
...
Callers pin `uses:` to a commit SHA of this repo. Dependabot's
github-actions updater finds a newer SHA for a pinned ref by reading the
target repo's tags and releases; this repo has 0 tags and 0 releases, so
there is nothing for it to resolve and it reports no update. The fleet's
pins have not moved as a result.
Adds a caller for the release reusable, triggered on push to main and
filtered to paths under .github/workflows/ excluding the three files no
caller consumes (ci.yaml, labeler.yaml, and this file).
Version is a patch bump from the highest existing vMAJOR.MINOR.PATCH tag,
1.0.0 when none exist. workflow_dispatch takes an explicit version for
minor and major bumps.
Runs are serialised with cancel-in-progress false: two merges landing
together would otherwise read the same highest tag, compute the same next
version, and the second would hit the reusable's existing-tag guard and
no-op, leaving that change unreleased.
2026-07-28 17:01:44 -04:00
