renovate[bot]
3030b134fa
chore(deps): update sea-haven-industries/.github action to v1.0.19 ( #285 )
...
Deploy API / Deploy API to dev (push) Waiting to run
Deploy API / Deploy API to prod (push) Waiting to run
* chore(deps): update sea-haven-industries/.github action to v1.0.19
* test(ci): expect org workflow pin v1.0.19
---------
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: Adam Moussa <adam@seahavenind.com>
2026-09-28 16:45:27 +00:00
Adam Moussa
8a23d06a64
ci(workflows): call org reusable CI and Fargate CD ( #276 )
...
* ci(workflows): call org reusable CI and Fargate CD
Local CI and the image deploy duplicated the org workflows and still required ci / ci. Pin the callers to those workflows and trust the reusable deploy ref.
* test(ci): probe ruff with an undefined name
* test(ci): remove the undefined-name ruff probe
* ci: retrigger checks after removing the ruff probe
* test(ci): probe ruff with an unused import
* style: apply formatter
* test(ci): remove the autofix probe
---------
Co-authored-by: sea-haven-auto-fix[bot] <332630863+sea-haven-auto-fix[bot]@users.noreply.github.com>
2026-09-24 16:46:40 +00:00
renovate[bot]
9d43e3be9d
chore(deps): update sea-haven-industries/.github action to v1.0.11 ( #250 )
...
Deploy / Deploy to prod (push) Has been cancelled
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-09-16 16:38:44 +00:00
renovate[bot]
244ceaff10
chore(deps): update github actions ( #242 )
...
Deploy / deploy (push) Has been cancelled
Deploy / release (push) Has been cancelled
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-08-31 16:07:13 +00:00
dependabot[bot]
1748238ef3
chore(deps): bump the minor-and-patch group with 5 updates ( #225 )
...
Deploy / deploy (push) Waiting to run
Deploy / release (push) Blocked by required conditions
Bumps the minor-and-patch group with 5 updates:
| Package | From | To |
| --- | --- | --- |
| [Sea-Haven-Industries/.github/.github/workflows/ci-python-sam.yaml](https://github.com/sea-haven-industries/.github ) | `1.0.6` | `1.0.7` |
| [Sea-Haven-Industries/.github/.github/workflows/callable-dependency-review.yaml](https://github.com/sea-haven-industries/.github ) | `1.0.6` | `1.0.7` |
| [Sea-Haven-Industries/.github/.github/workflows/cd-sam.yaml](https://github.com/sea-haven-industries/.github ) | `1.0.6` | `1.0.7` |
| [Sea-Haven-Industries/.github/.github/workflows/callable-labeler.yaml](https://github.com/sea-haven-industries/.github ) | `1.0.6` | `1.0.7` |
| [Sea-Haven-Industries/.github/.github/workflows/callable-pr-policy.yaml](https://github.com/sea-haven-industries/.github ) | `1.0.6` | `1.0.7` |
Updates `Sea-Haven-Industries/.github/.github/workflows/ci-python-sam.yaml` from 1.0.6 to 1.0.7
- [Release notes](https://github.com/sea-haven-industries/.github/releases )
- [Commits](7ac3528750...e5691d8a7fhttps://github.com/sea-haven-industries/.github/releases )
- [Commits](7ac3528750...e5691d8a7fhttps://github.com/sea-haven-industries/.github/releases )
- [Commits](7ac3528750...e5691d8a7fhttps://github.com/sea-haven-industries/.github/releases )
- [Commits](7ac3528750...e5691d8a7fhttps://github.com/sea-haven-industries/.github/releases )
- [Commits](7ac3528750...e5691d8a7f
2026-08-18 19:26:58 -04:00
dependabot[bot]
ece9947840
chore(deps): bump the minor-and-patch group with 5 updates ( #217 )
...
Deploy / deploy (push) Has been cancelled
Deploy / release (push) Has been cancelled
Bumps the minor-and-patch group with 5 updates:
| Package | From | To |
| --- | --- | --- |
| [Sea-Haven-Industries/.github/.github/workflows/ci-python-sam.yaml](https://github.com/sea-haven-industries/.github ) | `1.0.3` | `1.0.6` |
| [Sea-Haven-Industries/.github/.github/workflows/callable-dependency-review.yaml](https://github.com/sea-haven-industries/.github ) | `1.0.3` | `1.0.6` |
| [Sea-Haven-Industries/.github/.github/workflows/cd-sam.yaml](https://github.com/sea-haven-industries/.github ) | `1.0.3` | `1.0.6` |
| [Sea-Haven-Industries/.github/.github/workflows/callable-labeler.yaml](https://github.com/sea-haven-industries/.github ) | `1.0.3` | `1.0.6` |
| [Sea-Haven-Industries/.github/.github/workflows/callable-pr-policy.yaml](https://github.com/sea-haven-industries/.github ) | `1.0.5` | `1.0.6` |
Updates `Sea-Haven-Industries/.github/.github/workflows/ci-python-sam.yaml` from 1.0.3 to 1.0.6
- [Release notes](https://github.com/sea-haven-industries/.github/releases )
- [Commits](3f74677422...7ac3528750https://github.com/sea-haven-industries/.github/releases )
- [Commits](3f74677422...7ac3528750https://github.com/sea-haven-industries/.github/releases )
- [Commits](3f74677422...7ac3528750https://github.com/sea-haven-industries/.github/releases )
- [Commits](3f74677422...7ac3528750https://github.com/sea-haven-industries/.github/releases )
- [Commits](9c1ecf9428...7ac3528750
2026-08-12 00:12:07 +00:00
dependabot[bot]
caa15a705d
chore(deps): bump the minor-and-patch group with 4 updates ( #191 )
...
Bumps the minor-and-patch group with 4 updates: [Sea-Haven-Industries/.github/.github/workflows/ci-python-sam.yaml](https://github.com/sea-haven-industries/.github ), [Sea-Haven-Industries/.github/.github/workflows/callable-dependency-review.yaml](https://github.com/sea-haven-industries/.github ), [Sea-Haven-Industries/.github/.github/workflows/cd-sam.yaml](https://github.com/sea-haven-industries/.github ) and [Sea-Haven-Industries/.github/.github/workflows/callable-labeler.yaml](https://github.com/sea-haven-industries/.github ).
Updates `Sea-Haven-Industries/.github/.github/workflows/ci-python-sam.yaml` from 1.0.2 to 1.0.3
- [Release notes](https://github.com/sea-haven-industries/.github/releases )
- [Commits](0170a57c0d...3f74677422https://github.com/sea-haven-industries/.github/releases )
- [Commits](0170a57c0d...3f74677422https://github.com/sea-haven-industries/.github/releases )
- [Commits](0170a57c0d...3f74677422https://github.com/sea-haven-industries/.github/releases )
- [Commits](0170a57c0d...3f74677422
2026-07-28 23:26:05 +00:00
Adam Moussa
f4712e0bcf
ci(deps): pin org reusable workflows to v1.0.2 ( #190 )
...
* ci(deps): pin org reusable workflows to v1.0.2
* style(ci): normalize workflow block spacing
2026-07-28 18:15:29 -04:00
Adam Moussa
f996f9600b
fix: resolve code-scanning alerts 11-15 (workflow permissions + log taint) ( #184 )
...
Deploy / deploy (push) Waiting to run
Deploy / release (push) Blocked by required conditions
* ci(dependency-review): set explicit read-only GITHUB_TOKEN permissions
Resolves code-scanning alert 11 (actions/missing-workflow-permissions).
The callable workflow only needs contents: read.
* fix(logging): remove taint-flagged values from 3CX and roster-sync logs
Resolves code-scanning alerts 12-15 (py/clear-text-logging-sensitive-data).
CodeQL taints the 3CX response dicts via the Secrets Manager-sourced
domain in the request URL, so entity IDs subscripted from those
responses (ivr_id, resource_id, queue_id) and the roster result dict
trip the query. None of the flagged values are secrets, but the log
lines are rewritten so the pattern cannot trip: entity IDs are dropped
in favor of the untainted destination DNs, and the roster summary logs
counts instead of the member-derived dict (which also keeps employee
names out of the logs).
* fix: update ci workflow SHA to latest version
* fix(logging): drop employee-derived DNs from forwarding log
Resolves new code-scanning alerts 16/17. The closed/holiday DNs added
in the previous commit derive from roster employee lookups in the
Slack bot, so CodeQL classifies them as private data. Log only the
resource type; ring_scheduler already logs the queue number.
2026-07-27 13:48:14 -04:00
Adam Moussa
e19a70b5df
chore(ci): SHA-pin org reusable-workflow caller refs (INFRA-50) ( #152 )
Deploy / deploy (push) Has been cancelled
Deploy / release (push) Has been cancelled
2026-07-06 18:26:46 -04:00
Adam Moussa
9bea3ed4c7
Add dependency-review caller workflow ( #97 )
...
Deploy / deploy (push) Waiting to run
* Add dependency-review caller workflow
Add a pull_request-triggered caller that invokes the org-level
callable-dependency-review workflow to scan dependency changes and
fail on high-severity advisories.
* chore: retrigger checks
* chore: retrigger dep review (post-fix)
2026-06-05 12:26:41 -04:00
