ci: add concurrency to ci-python-app + fix sam-deploy template (INFRA-136) (#74)

Add job-level concurrency (cancel-in-progress) to all four ci-python-app
jobs, matching the ci-python-sam idiom. Per-job group keys include
github.job so the parallel jobs in a single run do not share a group.

Replace sam-deploy starter-template stack-name: $default-branch (which
GitHub substitutes to the literal branch name main) with a
REPLACE-ME-stack-name placeholder, and point cfn-role-arn at the real
shared github-cfn-execution-role.

.github/workflows/callable-dependency-review.yaml

@@ -3,6 +3,7 @@ on:
   workflow_call:
 permissions:
   contents: read
+  pull-requests: write
 jobs:
   dependency-review:
     runs-on: ubuntu-latest
@@ -11,3 +12,4 @@ jobs:
       - uses: actions/dependency-review-action@v5
         with:
           fail-on-severity: high
+          comment-summary-in-pr: on-failure

.github/workflows/ci-python-app.yaml

@@ -50,6 +50,9 @@ jobs:
   lint:
     runs-on: ubuntu-latest
     timeout-minutes: 10
+    concurrency:
+      group: ci-python-app-${{ github.workflow }}-${{ github.ref }}-${{ inputs.source-dirs }}-${{ github.job }}
+      cancel-in-progress: true
     steps:
       - uses: actions/checkout@v7
 
@@ -96,6 +99,9 @@ jobs:
     if: ${{ inputs.collect-only }}
     runs-on: ubuntu-latest
     timeout-minutes: 10
+    concurrency:
+      group: ci-python-app-${{ github.workflow }}-${{ github.ref }}-${{ inputs.source-dirs }}-${{ github.job }}
+      cancel-in-progress: true
     steps:
       - uses: actions/checkout@v7
 
@@ -117,6 +123,9 @@ jobs:
     if: ${{ inputs.subproject-dir != '' }}
     runs-on: ubuntu-latest
     timeout-minutes: 10
+    concurrency:
+      group: ci-python-app-${{ github.workflow }}-${{ github.ref }}-${{ inputs.source-dirs }}-${{ github.job }}
+      cancel-in-progress: true
     steps:
       - uses: actions/checkout@v7
 
@@ -140,6 +149,9 @@ jobs:
     needs: [lint, test-collect, subproject-tests]
     if: always()
     runs-on: ubuntu-latest
+    concurrency:
+      group: ci-python-app-${{ github.workflow }}-${{ github.ref }}-${{ inputs.source-dirs }}-${{ github.job }}
+      cancel-in-progress: true
     steps:
       - name: Require all jobs to have succeeded
         run: |

README.md

@@ -16,7 +16,33 @@ Organization-level GitHub configuration for Sea Haven Industries.
 
 **`.github/workflows/cd-cdk.yaml`** — Reusable CD workflow for CDK repos (TypeScript and Python). Runs `cdk deploy --all` with OIDC credentials. Supports optional Python setup for Python CDK repos and QEMU emulation for cross-platform Docker builds.
 
-**`.github/workflows/compliance-audit.yaml`** — Scheduled weekly audit (Mondays 10am ET) that checks all org repos for compliance with Sea Haven conventions. Creates GitHub issues on repos with violations. Can also be triggered manually via `workflow_dispatch`. Uses the `claude-code-ci` GitHub App + `ANTHROPIC_API_KEY` (see Setup).
+**`.github/workflows/ci-python-app.yaml`** — Reusable CI for non-SAM Python apps (ruff check + format, optional pytest; no SAM validate).
+
+**`.github/workflows/ci-dotnet.yaml`** — Reusable CI for .NET solutions (`dotnet build`, optional `dotnet test`; SDK version and solution path as inputs).
+
+**`.github/workflows/ci-static.yaml`** — Reusable CI for static sites (e.g. Eleventy builds for seahaven-site).
+
+**`.github/workflows/cd-mobile-ios.yaml`** — Reusable CD for iOS apps via Fastlane to TestFlight (Node + Ruby setup inputs).
+
+**`.github/workflows/callable-labeler.yaml`** — Org-wide PR auto-labeler. Label rules live inline here (single source of truth) — consumer repos need only a thin caller with `contents: read`, `pull-requests: write`, and `issues: write`; no per-repo labeler.yml.
+
+**`.github/workflows/callable-dependency-review.yaml`** — Dependency review on PRs, failing on high severity. Requires Dependency Graph.
+
+**`.github/workflows/ci.yaml`** — Self-CI for this repo: actionlint (checksum-verified install) over all workflow files, emitting the required `ci / ci` status context.
+
+**`.github/workflows/compliance-audit.yaml`** — **DEPRECATED (2026-06-10).** The weekly scheduled org-wide audit has been retired: the schedule was removed and the workflow is disabled in the Actions tab (manual `workflow_dispatch` only, kept for historical reference). Repo compliance is now handled by the Claude Code App on pull requests and the engineering handbook directly. Safe to delete in a future cleanup.
+
+### Workflow templates (`workflow-templates/`)
+
+Starter workflows offered on the org's **Actions → New workflow** page: `ci-python`, `ci-node`, `cdk-deploy`, `sam-deploy`, `dependency-review`, `labeler`, `triage`. Each is a thin caller of the corresponding reusable workflow above (`triage` is standalone). Every template has a paired `properties.json` (name, description, icon, `filePatterns` for auto-suggestion). Replace any `REPLACE-ME` placeholders before enabling.
+
+### Action pinning policy
+
+Third-party action refs across the org follow a tiered policy:
+
+- **High-trust / high-blast-radius third-party actions are SHA-pinned** with a trailing version comment (e.g. `actions/labeler` in `callable-labeler.yaml`), and binary installs are checksum-verified (actionlint in `ci.yaml`). Dependabot keeps the SHA current via its trailing-comment mechanism.
+- **Common first-party actions** (`actions/checkout`, `actions/dependency-review-action`, `actions/github-script`) are pinned to a **major tag** (`@v7`, `@v5`, …) and kept current by Dependabot version updates gated by CI.
+- **Org reusable workflows** are referenced at **`@main`** (`uses: Sea-Haven-Industries/.github/.github/workflows/…@main`). This is deliberate: caller and callable share one trust domain, and pinning callers to a SHA would freeze every consumer against central fixes. Templates in `workflow-templates/` follow the same `@main` convention.
 
 ### PR Reviews
 

workflow-templates/dependency-review.yml

@@ -9,12 +9,4 @@ permissions:
 
 jobs:
   dependency-review:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v7
-      - name: Dependency Review
-        uses: actions/dependency-review-action@v4
-        with:
-          fail-on-severity: high
-          comment-summary-in-pr: on-failure
+    uses: Sea-Haven-Industries/.github/.github/workflows/callable-dependency-review.yaml@main

workflow-templates/labeler.properties.json

@@ -0,0 +1,7 @@
+{
+  "name": "Sea Haven — PR Labeler",
+  "description": "Auto-labels PRs (infra/app/ci/docs/dependencies/tests) via the org callable labeler. Label rules live centrally in Sea-Haven-Industries/.github — no per-repo labeler.yml needed.",
+  "iconName": "octicon-tag",
+  "categories": ["Automation"],
+  "filePatterns": []
+}

workflow-templates/labeler.yml

@@ -0,0 +1,16 @@
+name: labeler
+on:
+  pull_request:
+
+# All three permission grants are load-bearing: reusable-workflow permissions can
+# only be downgraded from the caller, so omitting one (e.g. issues:write) either
+# fails to create labels or triggers a silent startup_failure. `pull_request`
+# (NOT pull_request_target) is correct — the org takes no fork PRs.
+permissions:
+  contents: read
+  pull-requests: write
+  issues: write
+
+jobs:
+  label:
+    uses: Sea-Haven-Industries/.github/.github/workflows/callable-labeler.yaml@main

workflow-templates/sam-deploy.yml

@@ -8,8 +8,10 @@ jobs:
     uses: Sea-Haven-Industries/.github/.github/workflows/cd-sam.yaml@main
     with:
       # Required: the CloudFormation stack name (kebab-case, matches repo name).
-      stack-name: $default-branch
+      # NOTE: this is a literal placeholder on purpose — starter-workflow variables
+      # like $default-branch substitute to the BRANCH name ("main"), not the repo name.
+      stack-name: REPLACE-ME-stack-name
       # Required: the CloudFormation execution role ARN for this stack.
-      cfn-role-arn: arn:aws:iam::328440206208:role/REPLACE-ME-cfn-exec-role
+      cfn-role-arn: arn:aws:iam::328440206208:role/github-cfn-execution-role
     secrets:
       deploy-role-arn: ${{ secrets.AWS_DEPLOY_ROLE_ARN }}