Adam Moussa
c1c26579ab
Merge pull request #40 from Sea-Haven-Industries/ci/pin-reusables-v1.0.2
...
Deploy / deploy (push) Has been cancelled
ci(deps): pin org reusable workflows to v1.0.2
2026-07-28 18:14:14 -04:00
Adam Moussa
f7c26703d4
ci: declare workflow permissions and normalize block spacing
2026-07-28 18:06:23 -04:00
Adam Moussa
555e899d04
ci(deps): pin org reusable workflows to v1.0.2
2026-07-28 17:56:23 -04:00
dependabot[bot]
d0f51f4c01
chore(deps): bump boto3 ( #38 )
...
Deploy / deploy (push) Waiting to run
Bumps the minor-and-patch group with 1 update in the /src/auto_protect directory: [boto3](https://github.com/boto/boto3 ).
Updates `boto3` from 1.43.52 to 1.43.58
- [Release notes](https://github.com/boto/boto3/releases )
- [Commits](https://github.com/boto/boto3/compare/1.43.52...1.43.58 )
---
updated-dependencies:
- dependency-name: boto3
dependency-version: 1.43.57
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: minor-and-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-28 19:44:14 +00:00
dependabot[bot]
0beb31ab2c
chore(deps): bump boto3 ( #37 )
...
Bumps the minor-and-patch group with 1 update in the /src/health_digest directory: [boto3](https://github.com/boto/boto3 ).
Updates `boto3` from 1.43.52 to 1.43.58
- [Release notes](https://github.com/boto/boto3/releases )
- [Commits](https://github.com/boto/boto3/compare/1.43.52...1.43.58 )
---
updated-dependencies:
- dependency-name: boto3
dependency-version: 1.43.57
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: minor-and-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-28 19:41:12 +00:00
Adam Moussa
c0c591bac2
ci: bump ci-python-sam SHA pin to pick up the ruff 0.15.22 pin ( #39 )
...
The old pin (fd60e4c9) installs unpinned latest ruff; 0.16.0 flags
pre-existing code (BLE001 etc.), failing ci / ci on every PR — currently
blocking Dependabot #37 . The org workflow pinned ruff to 0.15.22 on
2026-07-23 (f71002a9); this picks that up along with setup-action bumps,
contents:read scoping, and SHA-pinned third-party actions.
2026-07-28 15:38:22 -04:00
dependabot[bot]
3c80276c5b
chore(deps): bump boto3 from 1.43.47 to 1.43.52 in /src/health_digest and /src/auto_protect in the minor-and-patch group ( #35 )
...
Deploy / deploy (push) Has been cancelled
* chore(deps): bump boto3
Bumps the minor-and-patch group in /src/health_digest with 1 update: [boto3](https://github.com/boto/boto3 ).
Updates `boto3` from 1.43.47 to 1.43.52
- [Release notes](https://github.com/boto/boto3/releases )
- [Commits](https://github.com/boto/boto3/compare/1.43.47...1.43.52 )
---
updated-dependencies:
- dependency-name: boto3
dependency-version: 1.43.52
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: minor-and-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
* chore(deps): bump boto3 (#36 )
Bumps the minor-and-patch group in /src/auto_protect with 1 update: [boto3](https://github.com/boto/boto3 ).
Updates `boto3` from 1.43.47 to 1.43.52
- [Release notes](https://github.com/boto/boto3/releases )
- [Commits](https://github.com/boto/boto3/compare/1.43.47...1.43.52 )
---
updated-dependencies:
- dependency-name: boto3
dependency-version: 1.43.52
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: minor-and-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-21 19:23:02 +00:00
dependabot[bot]
832cc63728
chore(deps): bump boto3 ( #33 )
...
Deploy / deploy (push) Has been cancelled
Bumps the minor-and-patch group in /src/auto_protect with 1 update: [boto3](https://github.com/boto/boto3 ).
Updates `boto3` from 1.43.43 to 1.43.47
- [Release notes](https://github.com/boto/boto3/releases )
- [Commits](https://github.com/boto/boto3/compare/1.43.43...1.43.47 )
---
updated-dependencies:
- dependency-name: boto3
dependency-version: 1.43.47
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: minor-and-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-14 22:05:14 +00:00
dependabot[bot]
bf6f009d0b
chore(deps): bump boto3 ( #34 )
...
Bumps the minor-and-patch group in /src/health_digest with 1 update: [boto3](https://github.com/boto/boto3 ).
Updates `boto3` from 1.43.43 to 1.43.47
- [Release notes](https://github.com/boto/boto3/releases )
- [Commits](https://github.com/boto/boto3/compare/1.43.43...1.43.47 )
---
updated-dependencies:
- dependency-name: boto3
dependency-version: 1.43.47
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: minor-and-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-14 18:04:00 -04:00
Adam Moussa
d2c6421064
docs: document template.yaml and repo structure in README ( #32 )
...
Deploy / deploy (push) Has been cancelled
Daily security sweep flagged that the README omitted template.yaml (the
SAM stack) as an existing component. Add a Repository Structure section
naming template.yaml and the src layout.
Also fix a related setup gap: the Slack webhook Secrets Manager secret
(SlackWebhookSecretArn, required by slack.py via SLACK_WEBHOOK_SECRET_ARN)
was not covered by the setup instructions.
2026-07-10 19:51:50 +00:00
dependabot[bot]
c898a18226
Bump boto3 ( #31 )
...
Deploy / deploy (push) Has been cancelled
Bumps the minor-and-patch group with 1 update in the /src/auto_protect directory: [boto3](https://github.com/boto/boto3 ).
Updates `boto3` from 1.43.42 to 1.43.43
- [Release notes](https://github.com/boto/boto3/releases )
- [Commits](https://github.com/boto/boto3/compare/1.43.42...1.43.43 )
---
updated-dependencies:
- dependency-name: boto3
dependency-version: 1.43.43
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: minor-and-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-08 21:06:01 +00:00
dependabot[bot]
a56a75a2b0
Bump boto3 in /src/health_digest in the minor-and-patch group ( #30 )
...
Bumps the minor-and-patch group in /src/health_digest with 1 update: [boto3](https://github.com/boto/boto3 ).
Updates `boto3` from 1.43.41 to 1.43.43
- [Release notes](https://github.com/boto/boto3/releases )
- [Commits](https://github.com/boto/boto3/compare/1.43.41...1.43.43 )
---
updated-dependencies:
- dependency-name: boto3
dependency-version: 1.43.43
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: minor-and-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-08 17:02:50 -04:00
Adam Moussa
93296c80b0
ci: add github-actions to dependabot coverage (INFRA-130) ( #29 )
2026-07-08 16:35:10 -04:00
dependabot[bot]
e966a56e4e
Bump boto3 in /src/auto_protect in the minor-and-patch group ( #28 )
...
Deploy / deploy (push) Waiting to run
Bumps the minor-and-patch group in /src/auto_protect with 1 update: [boto3](https://github.com/boto/boto3 ).
Updates `boto3` from 1.43.39 to 1.43.41
- [Release notes](https://github.com/boto/boto3/releases )
- [Commits](https://github.com/boto/boto3/compare/1.43.39...1.43.41 )
---
updated-dependencies:
- dependency-name: boto3
dependency-version: 1.43.41
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: minor-and-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-07 15:51:14 -04:00
dependabot[bot]
54fe1e68b6
Bump boto3 in /src/health_digest in the minor-and-patch group ( #27 )
...
Bumps the minor-and-patch group in /src/health_digest with 1 update: [boto3](https://github.com/boto/boto3 ).
Updates `boto3` from 1.43.37 to 1.43.41
- [Release notes](https://github.com/boto/boto3/releases )
- [Commits](https://github.com/boto/boto3/compare/1.43.37...1.43.41 )
---
updated-dependencies:
- dependency-name: boto3
dependency-version: 1.43.41
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: minor-and-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-07 15:48:30 -04:00
Adam Moussa
162d6463db
chore(ci): SHA-pin org reusable-workflow caller refs (INFRA-50) ( #26 )
Deploy / deploy (push) Waiting to run
2026-07-06 18:26:55 -04:00
Adam Moussa
55ca4de46b
docs: link Confluence AWS Architecture Map (INFRA-53) ( #25 )
Deploy / deploy (push) Waiting to run
2026-07-06 17:44:15 -04:00
dependabot[bot]
84d4caf825
Bump boto3 ( #24 )
...
Deploy / deploy (push) Has been cancelled
Bumps the minor-and-patch group with 1 update in the /src/auto_protect directory: [boto3](https://github.com/boto/boto3 ).
Updates `boto3` from 1.43.36 to 1.43.39
- [Release notes](https://github.com/boto/boto3/releases )
- [Commits](https://github.com/boto/boto3/compare/1.43.36...1.43.39 )
---
updated-dependencies:
- dependency-name: boto3
dependency-version: 1.43.37
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: minor-and-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-02 15:27:49 -04:00
dependabot[bot]
0f7c8b98cc
Bump boto3 in /src/health_digest in the minor-and-patch group ( #23 )
...
Deploy / deploy (push) Has been cancelled
Bumps the minor-and-patch group in /src/health_digest with 1 update: [boto3](https://github.com/boto/boto3 ).
Updates `boto3` from 1.43.36 to 1.43.37
- [Release notes](https://github.com/boto/boto3/releases )
- [Commits](https://github.com/boto/boto3/compare/1.43.36...1.43.37 )
---
updated-dependencies:
- dependency-name: boto3
dependency-version: 1.43.37
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: minor-and-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-30 19:45:59 -04:00
dependabot[bot]
1d85f5f5a3
Bump boto3 ( #22 )
...
Deploy / deploy (push) Has been cancelled
Bumps the minor-and-patch group with 1 update in the /src/auto_protect directory: [boto3](https://github.com/boto/boto3 ).
Updates `boto3` from 1.43.31 to 1.43.36
- [Release notes](https://github.com/boto/boto3/releases )
- [Commits](https://github.com/boto/boto3/compare/1.43.31...1.43.36 )
---
updated-dependencies:
- dependency-name: boto3
dependency-version: 1.43.36
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: minor-and-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-24 15:58:12 -04:00
dependabot[bot]
fa61d5c003
Bump boto3 in /src/health_digest in the minor-and-patch group ( #21 )
...
Bumps the minor-and-patch group in /src/health_digest with 1 update: [boto3](https://github.com/boto/boto3 ).
Updates `boto3` from 1.43.30 to 1.43.36
- [Release notes](https://github.com/boto/boto3/releases )
- [Commits](https://github.com/boto/boto3/compare/1.43.30...1.43.36 )
---
updated-dependencies:
- dependency-name: boto3
dependency-version: 1.43.36
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: minor-and-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-24 15:54:49 -04:00
dependabot[bot]
3f99db3095
Bump boto3 ( #20 )
...
Deploy / deploy (push) Has been cancelled
Bumps the minor-and-patch group with 1 update in the /src/auto_protect directory: [boto3](https://github.com/boto/boto3 ).
Updates `boto3` from 1.43.25 to 1.43.31
- [Release notes](https://github.com/boto/boto3/releases )
- [Commits](https://github.com/boto/boto3/compare/1.43.25...1.43.31 )
---
updated-dependencies:
- dependency-name: boto3
dependency-version: 1.43.30
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: minor-and-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-16 17:22:58 -04:00
dependabot[bot]
02b2f9815d
Bump boto3 in /src/health_digest in the minor-and-patch group ( #19 )
...
Bumps the minor-and-patch group in /src/health_digest with 1 update: [boto3](https://github.com/boto/boto3 ).
Updates `boto3` from 1.43.25 to 1.43.30
- [Release notes](https://github.com/boto/boto3/releases )
- [Commits](https://github.com/boto/boto3/compare/1.43.25...1.43.30 )
---
updated-dependencies:
- dependency-name: boto3
dependency-version: 1.43.30
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: minor-and-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-16 17:19:42 -04:00
Adam Moussa
7fb5758194
Add PR labeler caller + README badges (INFRA-56, INFRA-57) ( #18 )
...
Deploy / deploy (push) Has been cancelled
Add the org reusable labeler caller (callable-labeler.yaml@main) and a
static badge block (CI status, Python, AWS SAM, Slack) under the README
H1. Part of the INFRA-47 GitHub-hygiene rollout.
2026-06-11 14:13:08 -04:00
dependabot[bot]
14906708ae
Bump boto3 in /src/health_digest in the minor-and-patch group ( #16 )
...
Deploy / deploy (push) Waiting to run
Bumps the minor-and-patch group in /src/health_digest with 1 update: [boto3](https://github.com/boto/boto3 ).
Updates `boto3` from 1.43.23 to 1.43.25
- [Release notes](https://github.com/boto/boto3/releases )
- [Commits](https://github.com/boto/boto3/compare/1.43.23...1.43.25 )
---
updated-dependencies:
- dependency-name: boto3
dependency-version: 1.43.25
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: minor-and-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-10 18:11:45 -04:00
dependabot[bot]
8d8facda1b
Bump boto3 in /src/auto_protect in the minor-and-patch group ( #15 )
...
Bumps the minor-and-patch group in /src/auto_protect with 1 update: [boto3](https://github.com/boto/boto3 ).
Updates `boto3` from 1.43.23 to 1.43.25
- [Release notes](https://github.com/boto/boto3/releases )
- [Commits](https://github.com/boto/boto3/compare/1.43.23...1.43.25 )
---
updated-dependencies:
- dependency-name: boto3
dependency-version: 1.43.25
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: minor-and-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-10 18:11:41 -04:00
Adam Moussa
b8353e20aa
Attach permissions boundary to all Lambda roles ( #17 )
...
Deploy / deploy (push) Waiting to run
Scopes IAM role creation to the seahaven-lambda-execution-boundary
policy so the github-cfn-execution-role scope-down (INFRA-97) can
safely constrain CreateRole to boundary-attached roles only.
Refs: INFRA-103
2026-06-10 14:15:02 -04:00
Adam Moussa
471785d64a
fix(deps): pin Python requirements ( #12 )
...
Deploy / deploy (push) Has been cancelled
Pin previously unpinned boto3 dependency to an exact version across the
auto_protect and health_digest functions for reproducible builds.
2026-06-05 14:14:02 -04:00
Adam Moussa
1b1db14bc6
Add dependency-review caller workflow ( #13 )
...
Deploy / deploy (push) Waiting to run
* Add dependency-review caller workflow
Add a pull_request-triggered caller that invokes the org-level
callable-dependency-review workflow to scan dependency changes and
fail on high-severity advisories.
* chore: retrigger checks
* chore: retrigger dep review (post-fix)
2026-06-05 12:27:15 -04:00
Adam Moussa
4e23d6318b
Move parameter-overrides to secrets block ( #10 )
2026-05-08 17:22:45 -04:00
Adam Moussa
d3f23d0daf
Pass SAM parameter overrides to deploy workflow ( #9 )
2026-05-08 17:20:10 -04:00
Adam Moussa
b416836629
Add GitHub Actions deploy workflow ( #8 )
...
* Add GitHub Actions deploy workflow (OIDC)
* Add permissions block for OIDC token exchange
* Add concurrency control to prevent parallel deploys
2026-05-08 17:07:57 -04:00
Adam Moussa
40711bbc8b
Add CI workflow and apply ruff formatting ( #7 )
2026-05-08 15:48:29 -04:00
Adam Moussa
468e16b173
Update Dependabot: remove assignees, group minor/patch updates ( #6 )
2026-05-08 14:24:32 -04:00
Adam Moussa
3c5d6875a3
Remove wrapper workflow — using required workflow via org ruleset ( #5 )
2026-05-06 19:59:27 -04:00
Adam Moussa
f9313c9d03
Add Claude Code review workflow ( #4 )
2026-05-06 18:11:41 -04:00
Adam Moussa
931dfa47ad
Merge pull request #3 from Sea-Haven-Industries/feature/dependabot-auto-assign
...
Auto-assign Dependabot PRs
2026-05-02 17:28:34 -04:00
Adam Moussa
ab94fd3a27
Auto-assign Dependabot PRs to amoussa1229
2026-05-02 17:26:51 -04:00
Adam Moussa
484ca343e9
Merge pull request #2 from Sea-Haven-Industries/feature/add-dependabot-config
...
Add Dependabot version update configuration
2026-05-02 17:16:09 -04:00
Adam Moussa
666913fdb5
Add Dependabot version update configuration
2026-05-02 17:14:48 -04:00
Adam Moussa
e5cfc94009
Merge pull request #1 from Sea-Haven-Industries/feature/move-webhook-to-secrets-manager
...
Move Slack webhook URL to Secrets Manager
2026-04-28 15:15:31 -04:00
Adam Moussa
14923d8e5e
Move Slack webhook URL from env var to Secrets Manager
...
The webhook URL was passed as a NoEcho CF parameter but still
ended up as a plaintext Lambda environment variable. Now reads
from Secrets Manager at cold start and caches in a module-level
global, matching the pattern used for the Afi API key.
2026-04-28 15:14:17 -04:00
Adam Moussa
22f4268777
Initial commit: Afi backup monitor SAM stack
...
Two Lambda functions that integrate Afi.ai backup API with Slack:
- Auto-protect: weekly scan for unprotected users, applies backup policy
- Health digest: weekly backup task stats, quotas, and coverage report
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-06 13:42:28 -04:00
