fix(ci): disambiguate concurrency groups across sibling reusable-CI callers (#41)

The group key ci-${{ github.workflow }}-${{ github.ref }} resolves
identically for every job in a caller workflow (github.workflow is the
caller's name in a reusable workflow), so repos calling two reusable CI
workflows from one ci.yaml (e.g. exec-aide python + typescript) had
their jobs cancel each other on every run.

Prefix each group with the reusable workflow's own filename and append
its distinguishing input (source-dirs / working-directory) so sibling
jobs get distinct groups while superseded runs of the same job still
cancel.

.github/CODEOWNERS

@@ -0,0 +1 @@
+* @amoussa1229

.github/PULL_REQUEST_TEMPLATE.md

@@ -16,3 +16,12 @@ PR conventions — see engineering-handbook/pull-requests.md
 
 ## Notes
 <!-- Anything reviewers should know: migration steps, deploy order, follow-ups, breaking changes. Delete this section if empty. -->
+
+## Sea Haven checklist
+- [ ] CDK diff / SAM changeset reviewed (if infra change)
+- [ ] Secrets added to Parameter Store / Secrets Manager (not hardcoded)
+- [ ] DynamoDB PITR verified on new tables
+- [ ] Slack notification tested in staging
+- [ ] Confluence Architecture Map updated
+- [ ] Memory update queued (if new repo/stack)
+- [ ] Cross-review requested (if IAM or Lambda handler signature change)

.github/workflows/callable-dependency-review.yaml

@@ -0,0 +1,13 @@
+name: Dependency Review
+on:
+  workflow_call:
+permissions:
+  contents: read
+jobs:
+  dependency-review:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: actions/dependency-review-action@v4
+        with:
+          fail-on-severity: high

.github/workflows/cd-cdk.yaml

@@ -53,7 +53,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - uses: docker/setup-qemu-action@v3
         if: ${{ inputs.enable-qemu }}
@@ -90,7 +90,7 @@ jobs:
             pip install -r "$req"
           done
 
-      - uses: aws-actions/configure-aws-credentials@v4
+      - uses: aws-actions/configure-aws-credentials@v6
         with:
           role-to-assume: ${{ secrets.deploy-role-arn }}
           aws-region: ${{ inputs.region }}

.github/workflows/cd-mobile-ios.yaml

@@ -60,9 +60,9 @@ jobs:
       run:
         working-directory: ${{ inputs.working-directory }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
-      - uses: aws-actions/configure-aws-credentials@v4
+      - uses: aws-actions/configure-aws-credentials@v6
         with:
           role-to-assume: ${{ secrets.deploy-role-arn }}
           aws-region: ${{ inputs.region }}
@@ -73,7 +73,7 @@ jobs:
           cache: npm
           cache-dependency-path: ${{ inputs.cache-dependency-path }}
 
-      - uses: ruby/setup-ruby@v1
+      - uses: ruby/setup-ruby@afeafc3d1ab54a631816aba4c914a0081c12ff2f # v1
         with:
           ruby-version: ${{ inputs.ruby-version }}
           bundler-cache: true

.github/workflows/cd-sam.yaml

@@ -40,7 +40,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - uses: actions/setup-python@v5
         with:
@@ -48,7 +48,7 @@ jobs:
 
       - uses: aws-actions/setup-sam@v2
 
-      - uses: aws-actions/configure-aws-credentials@v4
+      - uses: aws-actions/configure-aws-credentials@v6
         with:
           role-to-assume: ${{ secrets.deploy-role-arn }}
           aws-region: ${{ inputs.region }}

.github/workflows/ci-dotnet.yaml

@@ -24,11 +24,14 @@ jobs:
   ci:
     runs-on: ubuntu-latest
     timeout-minutes: 20
+    concurrency:
+      group: ci-dotnet-${{ github.workflow }}-${{ github.ref }}-${{ inputs.working-directory }}
+      cancel-in-progress: true
     defaults:
       run:
         working-directory: ${{ inputs.working-directory }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - uses: actions/setup-dotnet@v5
         with:

.github/workflows/ci-python-sam.yaml

@@ -48,8 +48,11 @@ jobs:
   ci:
     runs-on: ubuntu-latest
     timeout-minutes: 10
+    concurrency:
+      group: ci-python-sam-${{ github.workflow }}-${{ github.ref }}-${{ inputs.source-dirs }}
+      cancel-in-progress: true
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - uses: actions/setup-python@v5
         with:

.github/workflows/ci-typescript-cdk.yaml

@@ -60,8 +60,11 @@ jobs:
   ci:
     runs-on: ubuntu-latest
     timeout-minutes: 30
+    concurrency:
+      group: ci-typescript-cdk-${{ github.workflow }}-${{ github.ref }}-${{ inputs.working-directory }}
+      cancel-in-progress: true
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - uses: docker/setup-qemu-action@v3
         if: ${{ inputs.enable-qemu }}

.github/workflows/compliance-audit.yaml

@@ -57,13 +57,13 @@ jobs:
           repositories: ${{ matrix.repo }},engineering-handbook
 
       - name: Checkout repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           repository: Sea-Haven-Industries/${{ matrix.repo }}
           token: ${{ steps.app-token.outputs.token }}
 
       - name: Checkout engineering handbook
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           repository: Sea-Haven-Industries/engineering-handbook
           token: ${{ steps.app-token.outputs.token }}
@@ -71,7 +71,7 @@ jobs:
 
       - name: Run compliance audit
         id: audit
-        uses: anthropics/claude-code-action@v1
+        uses: anthropics/claude-code-action@41ea7642c1436fa0ee57aae58347904b71a5af27 # v1
         with:
           anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
           prompt: |