Merge pull request #93 from Sea-Haven-Industries/ci/sam-deploy-template-role-placeholder

ci(templates): replace hardcoded management-account role ARN with placeholder
2026-10-07 16:18:55 +00:00 · 2026-07-27 16:34:52 -04:00 · 2026-07-27 16:03:25 -04:00 · 2026-07-27 15:39:54 -04:00 · 2026-07-27 15:38:18 -04:00
8 changed files with 13 additions and 10 deletions
--- a/.github/workflows/ci-static.yaml
+++ b/.github/workflows/ci-static.yaml
@ -15,7 +15,7 @@ name: CI — Static Site
 # Caller example (build mode):
 #   jobs:
 #     ci:
-#       uses: Sea-Haven-Industries/.github/.github/workflows/ci-static.yaml@main
+#       uses: Sea-Haven-Industries/.github/.github/workflows/ci-static.yaml@<full-commit-sha> # main
 #       with:
 #         build-command: "npx @11ty/eleventy"
 #         check-dir: "_site"
--- a/.github/workflows/ci-typescript-frontend.yaml
+++ b/.github/workflows/ci-typescript-frontend.yaml
@ -13,7 +13,7 @@ name: CI — TypeScript Frontend
 # Caller example:
 #   jobs:
 #     ci:
-#       uses: Sea-Haven-Industries/.github/.github/workflows/ci-typescript-frontend.yaml@main
+#       uses: Sea-Haven-Industries/.github/.github/workflows/ci-typescript-frontend.yaml@<full-commit-sha> # main
 #       with:
 #         node-version: "24"

--- a/workflow-templates/cdk-deploy.yml
+++ b/workflow-templates/cdk-deploy.yml
@ -5,6 +5,6 @@ on:

 jobs:
  deploy:
-    uses: Sea-Haven-Industries/.github/.github/workflows/cd-cdk.yaml@main
+    uses: Sea-Haven-Industries/.github/.github/workflows/cd-cdk.yaml@555d07c3a240689a81668026787eba089df4c975 # main
    secrets:
      deploy-role-arn: ${{ secrets.AWS_DEPLOY_ROLE_ARN }}
--- a/workflow-templates/ci-node.yml
+++ b/workflow-templates/ci-node.yml
@ -5,4 +5,4 @@ on:

 jobs:
  ci:
-    uses: Sea-Haven-Industries/.github/.github/workflows/ci-typescript-cdk.yaml@main
+    uses: Sea-Haven-Industries/.github/.github/workflows/ci-typescript-cdk.yaml@555d07c3a240689a81668026787eba089df4c975 # main
--- a/workflow-templates/ci-python.yml
+++ b/workflow-templates/ci-python.yml
@ -5,6 +5,6 @@ on:

 jobs:
  ci:
-    uses: Sea-Haven-Industries/.github/.github/workflows/ci-python-sam.yaml@main
+    uses: Sea-Haven-Industries/.github/.github/workflows/ci-python-sam.yaml@555d07c3a240689a81668026787eba089df4c975 # main
    with:
      run-tests: true
--- a/workflow-templates/dependency-review.yml
+++ b/workflow-templates/dependency-review.yml
@ -8,4 +8,4 @@ permissions:

 jobs:
  dependency-review:
-    uses: Sea-Haven-Industries/.github/.github/workflows/callable-dependency-review.yaml@main
+    uses: Sea-Haven-Industries/.github/.github/workflows/callable-dependency-review.yaml@555d07c3a240689a81668026787eba089df4c975 # main
--- a/workflow-templates/labeler.yml
+++ b/workflow-templates/labeler.yml
@ -13,4 +13,4 @@ permissions:

 jobs:
  label:
-    uses: Sea-Haven-Industries/.github/.github/workflows/callable-labeler.yaml@main
+    uses: Sea-Haven-Industries/.github/.github/workflows/callable-labeler.yaml@555d07c3a240689a81668026787eba089df4c975 # main
--- a/workflow-templates/sam-deploy.yml
+++ b/workflow-templates/sam-deploy.yml
@ -5,13 +5,16 @@ on:

 jobs:
  deploy:
-    uses: Sea-Haven-Industries/.github/.github/workflows/cd-sam.yaml@main
+    uses: Sea-Haven-Industries/.github/.github/workflows/cd-sam.yaml@555d07c3a240689a81668026787eba089df4c975 # main
    with:
      # Required: the CloudFormation stack name (kebab-case, matches repo name).
      # NOTE: this is a literal placeholder on purpose — starter-workflow variables
      # like $default-branch substitute to the BRANCH name ("main"), not the repo name.
      stack-name: REPLACE-ME-stack-name
-      # Required: the CloudFormation execution role ARN for this stack.
-      cfn-role-arn: arn:aws:iam::328440206208:role/github-cfn-execution-role
+      # Required: the CloudFormation execution role ARN for this stack — the
+      # github-cfn-execution-role in the repo's TARGET account (part of the
+      # per-account deploy substrate; the account must have it provisioned
+      # before first deploy). Do not point new repos at the management account.
+      cfn-role-arn: REPLACE-ME-cfn-role-arn
    secrets:
      deploy-role-arn: ${{ secrets.AWS_DEPLOY_ROLE_ARN }}
Author	SHA1	Message	Date
Adam Moussa	a39585b60d	Merge pull request #93 from Sea-Haven-Industries/ci/sam-deploy-template-role-placeholder Some checks are pending ci / ci / ci (push) Waiting to run Details ci(templates): replace hardcoded management-account role ARN with placeholder	2026-07-27 16:34:52 -04:00
Adam Moussa	5a5ab684f6	ci(templates): replace hardcoded management-account role ARN with placeholder The sam-deploy starter template pointed every new repo's cfn-role-arn at the management account's execution role, silently landing new workloads in an account frozen for workloads. The ARN is now a REPLACE-ME placeholder with guidance to use the github-cfn-execution-role in the repo's target account.	2026-07-27 16:03:25 -04:00
Adam Moussa	786dcfe8d9	Merge pull request #92 from Sea-Haven-Industries/ci/sha-pin-workflow-refs ci: pin workflow-template refs to commit SHA	2026-07-27 15:39:54 -04:00
Adam Moussa	69b28c6f3a	ci: pin workflow-template refs to commit SHA Per the updated handbook convention (engineering-handbook PR #18), reusable-workflow references use full commit SHA pins with a '# main' comment instead of the mutable @main branch ref. Templates now ship pinned so new repos start convention-compliant; Dependabot advances the pin after instantiation. Commented usage examples in ci-static and ci-typescript-frontend use the <full-commit-sha> placeholder form.	2026-07-27 15:38:18 -04:00