45b30e9e30
ci(workflows): call org reusable CI and Fargate CD
...
Local CI and the image deploy duplicated the org workflows and still required ci / ci. Pin the callers to those workflows and trust the reusable deploy ref.
2026-09-24 12:05:24 -04:00
Adam Moussa
e600dd47a3
chore(ci): remove unused Mergify stub ( #275 )
Deploy API / Resolve target (push) Has been cancelled
Deploy API / Deploy API to (push) Has been cancelled
2026-09-22 18:41:40 +00:00
renovate[bot]
682f272c5a
chore(deps): update dependency boto3 to >=1.43.98 ( #270 )
...
Deploy API / Resolve target (push) Waiting to run
Deploy API / Deploy API to (push) Blocked by required conditions
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-09-22 14:24:13 +00:00
renovate[bot]
b8079a1707
chore(deps): update github actions ( #271 )
...
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-09-22 14:24:10 +00:00
renovate[bot]
4988fbe706
chore(deps): pin python docker tag to 2f17fc0 ( #269 )
...
Deploy API / Resolve target (push) Waiting to run
Deploy API / Deploy API to (push) Blocked by required conditions
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-09-22 14:23:38 +00:00
Adam Moussa
c611fd5d2b
feat(api): add OpenAPI Redocly contract and VPC outputs (DEV-289) ( #268 )
...
Deploy API / Resolve target (push) Waiting to run
Deploy API / Deploy API to (push) Blocked by required conditions
* feat(infra): export vpc_id and public subnet outputs (DEV-289)
Portal Fargate and meals already attach to this VPC. These outputs are
the HCP existing_vpc_id / existing_public_subnet_ids values.
Co-authored-by: Adam Moussa <amoussa1229@users.noreply.github.com>
* feat(api): add OpenAPI 3.1 and Redocly lint in CI (DEV-289)
Same extends: recommended ruleset and @redocly/cli 2.52.1 as
internal-portal. Covers health, roster, and portal /api/shifts.
Co-authored-by: Adam Moussa <amoussa1229@users.noreply.github.com>
* fix(api): document 4xx and treat 302 as success in Redocly (DEV-289)
Health and CORS preflight document 400. Recommended only counted 2XX,
so login-style 302s use a shared 2XX-or-3XX rule.
Co-authored-by: Adam Moussa <amoussa1229@users.noreply.github.com>
* fix(api): fail Redocly on missing 4xx and 2xx/3xx (DEV-289)
Promote operation-4xx-response and the 2xx-or-3xx success rule to error.
Drop unused 400s on health and CORS OPTIONS. Health documents 403 like the
portal. CORS stays in Flask and is not part of the employee contract.
Co-authored-by: Adam Moussa <amoussa1229@users.noreply.github.com>
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: Adam Moussa <amoussa1229@users.noreply.github.com>
2026-09-22 00:34:15 +00:00
Adam Moussa
df3f0c037d
chore(iam): delete leftover Lambda execution roles (PLAT-218) ( #267 )
...
* chore(iam): delete leftover Lambda execution roles (PLAT-218)
* test(iam): keep leftover Lambda boundary after role deletion (PLAT-218)
2026-09-21 23:48:47 +00:00
Adam Moussa
26e9716df4
fix(ci): drop leftover changelog-guard and release-notifier (PLAT-219) ( #266 )
...
Deploy API / Resolve target (push) Waiting to run
Deploy API / Deploy API to (push) Blocked by required conditions
Prod is already a human GitHub Release. Remove the SAM tagging path so CHANGELOG.md stays App Home copy and leftover notifier IAM is destroyed on the next apply.
2026-09-21 23:24:05 +00:00
Adam Moussa
be1160192c
fix(infra): allow hcptf apply to create ECS and ELB service-linked roles (PLAT-216) ( #265 )
2026-09-21 22:56:09 +00:00
Adam Moussa
cbda46ba87
chore(infra): remove API Gateway and Lambda dual-run (PLAT-216) ( #264 )
...
Origins already point at the Fargate hostnames. Drop the HTTP API, eight
functions, zip CD, and Lambda/API Gateway alarms while keeping leftover
Lambda IAM so Paychex can still name weekly-post.
2026-09-21 22:37:13 +00:00
Adam Moussa
6c4018d6b8
fix(infra): move hcptf ECS apply perms to a managed policy (PLAT-216) ( #263 )
...
Deploy API / Resolve target (push) Waiting to run
Deploy API / Deploy API to (push) Blocked by required conditions
Deploy / Deploy to prod (push) Has been cancelled
PutRolePolicy cannot add a third inline on the prod apply role; CreatePolicy of /tf-managed/afterhours-shift-manager-ecs still needs the bootstrap window.
2026-09-21 20:47:25 +00:00
Adam Moussa
1362a6cd90
fix(infra): keep ecs-task-boundary CreatePolicy off live resources (PLAT-216) ( #262 )
...
Deploy API / Resolve target (push) Waiting to run
Deploy API / Deploy API to (push) Blocked by required conditions
Deploy / Deploy to prod (push) Waiting to run
Bootstrap is an IAM factory. The boundary must not wait on DynamoDB, SQS, ECR, or the ECS log group.
2026-09-21 19:57:12 +00:00
Adam Moussa
d49c4bb4f2
fix(infra): split hcptf apply policy and omit empty queue ARNs (PLAT-216) ( #261 )
...
The combined services inline policy exceeded 10KB, and an empty
checkcomponents ARN made CreatePolicy reject the Lambda boundary in dev.
2026-09-21 19:46:36 +00:00
Adam Moussa
593cab66ef
fix(infra): own a dedicated VPC for Fargate (PLAT-216) ( #260 )
...
Prod has no default VPC; 10.70 is unused and matches the meals seam.
2026-09-21 19:30:54 +00:00
Adam Moussa
26adb8e6c0
feat(api): collapse Slack, portal, and jobs onto Fargate (PLAT-216) ( #259 )
...
* feat(api): collapse Slack, portal, and jobs onto Fargate (PLAT-216)
Move HTTP and scheduled work onto one always-on Flask task so after-hours
loses Lambda cold start without changing the Cognito or roster contracts.
* fix(portal-api): keep CORS headers on unexpected 500s
Portal SPA error handling needs Access-Control-Allow-Origin even when
DynamoDB or other internals fail, otherwise the browser hides the 500.
* fix(api): retarget holidays per account and ship App Home changelog (PLAT-216)
* fix(iam): list ECS tasks and fail closed on non-prod Paychex (PLAT-216)
* fix(portal-api): serve portal JSON with an explicit JSON content type
2026-09-21 19:13:30 +00:00
Adam Moussa
969ebf90de
feat(portal-api): add Cognito shift API for the employee portal (DEV-287) ( #255 )
...
Deploy / Deploy to prod (push) Waiting to run
* feat(portal-api): add Cognito shift API for the employee portal (DEV-287)
Employees and admins can pick, drop, swap, and manage coverage through
GET/POST/DELETE /api/shifts. Roster PUT accepts optional email for portal
identity. Slack slash commands and App Home admin modals stay in place.
Co-authored-by: adam <adam@seahavenind.com>
* fix(portal-api): preserve shift and deployment invariants (DEV-287)
Co-authored-by: adam <adam@seahavenind.com>
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
2026-09-21 17:50:57 +00:00
renovate[bot]
f1695cadfa
chore(deps): update pip minor and patch ( #256 )
...
Deploy / Deploy to prod (push) Waiting to run
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-09-21 15:42:56 +00:00
renovate[bot]
ea2910906f
chore(deps): update aws-actions/configure-aws-credentials action to v6.3.0 ( #257 )
...
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-09-21 15:42:43 +00:00
renovate[bot]
0690767509
chore(deps): update terraform aws to ~> 6.65 ( #258 )
...
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-09-21 15:42:29 +00:00
renovate[bot]
9d43e3be9d
chore(deps): update sea-haven-industries/.github action to v1.0.11 ( #250 )
...
Deploy / Deploy to prod (push) Has been cancelled
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-09-16 16:38:44 +00:00
renovate[bot]
b53d856a75
chore(deps): update pip minor and patch ( #251 )
...
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-09-16 16:38:24 +00:00
Adam Moussa
9544dd696a
fix(slack-bot): return 400 on malformed request bodies ( #254 )
...
Bolt parse_body raises JSONDecodeError for empty or non-JSON form
payload fields, which turned probe POSTs into unhandled Lambda 500s.
Fixes AFTERHOURS-SHIFT-MANAGER-2
2026-09-16 16:37:54 +00:00
Adam Moussa
7a513b30ca
fix(infra): match live githubdeploy OIDC and plan-role S3 Gets (PLAT-74) ( #253 )
...
Deploy / Deploy to prod (push) Waiting to run
* fix(infra): match live githubdeploy OIDC and plan-role S3 Gets (PLAT-74)
* fix(infra): pin githubdeploy job_workflow_ref to main (PLAT-74)
2026-09-16 00:48:37 +00:00
Adam Moussa
13350b72d0
feat(infra): migrate afterhours to HCP Terraform (PLAT-74) ( #252 )
...
Deploy / Deploy to prod (push) Waiting to run
* fix(cutover): write Slack secrets into empty Terraform shells
DescribeSecret succeeds on HCP-created shells with no version, so skip-if-exists left roster and Slack tokens unset.
* feat(infra): migrate afterhours to HCP Terraform (PLAT-74)
Replace the mgmt SAM stack with a prod-only HCP workspace, in-repo hcptf IAM, stub Lambdas, and zip CD on push to main.
* fix(cutover): retry DDB unprocessed items and skip past at() holidays
Unprocessed BatchWriteItem rows and leftover past at() schedules would drop roster data or abort holiday recreation during prod cutover.
2026-09-15 23:31:59 +00:00
Adam Moussa
dbef3bda52
chore(pay): remove weekly-post payroll email code, env, and failure alarm ( #249 )
...
Deploy / deploy (push) Has been cancelled
Deploy / release (push) Has been cancelled
PR #248 disabled the SES send by blanking PAYROLL_RECIPIENTS and dropping the
ses:SendEmail grant. This removes the now-dead path: _send_pay_email and
_build_pay_email_html, the SES_SENDER and PAYROLL_RECIPIENTS env, and the
PayrollEmailFailure metric filter and alarm that only fired on that path.
Slack schedule post, pay-summary DM, and checkcomponents enqueue unchanged.
2026-09-10 19:58:59 +00:00
Adam Moussa
2dbe99ef0b
chore(pay): disable weekly-post payroll SES email (PLAT-135) ( #248 )
...
Deploy / deploy (push) Waiting to run
Deploy / release (push) Blocked by required conditions
Empty PAYROLL_RECIPIENTS and drop ses:SendEmail so Monday Slack posts stay, SES pay mail stops.
2026-09-10 19:30:00 +00:00
Adam Moussa
23bad9bee6
feat(roster): add HTTP PUT/DELETE roster API (PLAT-180) ( #247 )
...
Deploy / deploy (push) Waiting to run
Deploy / release (push) Blocked by required conditions
* feat(roster): add Bearer PUT/DELETE roster API
Identity hire needs to write Slack IDs onto roster rows without a stale
daily 3CX sync clearing them, using the existing HTTP client contract.
* fix(roster): strip Secrets Manager token whitespace
A file:// secret commonly includes a trailing newline, so compare_digest
must strip the cached value the same way it strips the Bearer header.
2026-09-09 21:13:27 +00:00
renovate[bot]
37f12421fd
chore(deps): update pip minor and patch ( #246 )
...
Deploy / deploy (push) Waiting to run
Deploy / release (push) Blocked by required conditions
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-09-09 18:40:59 +00:00
renovate[bot]
c52cfc2d0e
chore(deps): update aws-actions/configure-aws-credentials action to v6.2.4 ( #245 )
...
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-09-09 18:40:16 +00:00
Adam Moussa
4ffa09bd3e
feat(pay): send after-hours lines to paychex checkcomponents (PLAT-154) ( #244 )
...
Deploy / deploy (push) Has been cancelled
Deploy / release (push) Has been cancelled
* feat(pay): send after-hours lines to paychex checkcomponents (PLAT-154)
* style(pay): drop trailing blank line in weekly post tests
* fix(pay): skip duplicate checkcomponents send on weekly-post retry
2026-09-03 22:12:55 +00:00
renovate[bot]
244ceaff10
chore(deps): update github actions ( #242 )
...
Deploy / deploy (push) Has been cancelled
Deploy / release (push) Has been cancelled
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-08-31 16:07:13 +00:00
renovate[bot]
42921aa2ba
chore(deps): update pip minor and patch ( #243 )
...
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-08-31 16:06:56 +00:00
Adam Moussa
6eb2e52a74
feat(observability): add Sentry error reporting to Lambdas ( #241 )
...
Deploy / deploy (push) Has been cancelled
Deploy / release (push) Has been cancelled
Unhandled errors and timeout warnings go to Sentry when SENTRY_DSN is set; Slack and 3CX secrets are stripped before send.
2026-08-29 20:52:28 +00:00
Adam Moussa
b048bfeaa1
chore(deps): remove dependabot version updates ( #240 )
...
Deploy / deploy (push) Has been cancelled
Deploy / release (push) Has been cancelled
Renovate is the version-update bot on this Interactive repo. GitHub Dependabot alerts stay.
2026-08-25 11:50:55 -04:00
renovate[bot]
b30828b701
chore(deps): update dependency boto3 to >=1.43.78 ( #238 )
Deploy / deploy (push) Waiting to run
Deploy / release (push) Blocked by required conditions
2026-08-24 21:54:44 +00:00
Adam Moussa
f42a0f7505
chore(ci): remove pr policy workflow caller ( #237 )
Deploy / deploy (push) Waiting to run
Deploy / release (push) Blocked by required conditions
2026-08-24 15:11:53 -04:00
Adam Moussa
036267b98d
chore(ci): switch auto-merge from seahaven-bot to Mergify ( #236 )
Deploy / deploy (push) Waiting to run
Deploy / release (push) Blocked by required conditions
2026-08-24 13:52:43 -04:00
Adam Moussa
a91a1aa718
ci: enable squash auto-merge on ready PRs (PLAT-108) ( #234 )
...
Deploy / deploy (push) Waiting to run
Deploy / release (push) Blocked by required conditions
* ci: enable squash auto-merge on ready PRs
* fix(ci): serialize auto-merge enable and ignore already-enabled
* fix(ci): enqueue merge queue as seahaven-bot
* fix(ci): re-arm auto-merge as seahaven-bot after failed enqueue
2026-08-24 14:47:46 +00:00
Adam Moussa
50ab00947b
ci: add merge_group trigger for required ci / ci ( #233 )
Deploy / deploy (push) Has been cancelled
Deploy / release (push) Has been cancelled
2026-08-21 17:42:19 -04:00
dependabot[bot]
dc96388fa6
chore(deps): update boto3 requirement in /src/slack-bot ( #231 )
Deploy / deploy (push) Has been cancelled
Deploy / release (push) Has been cancelled
2026-08-19 03:56:51 +00:00
dependabot[bot]
84964aa983
chore(deps): update boto3 requirement in /src/shared ( #230 )
2026-08-19 03:54:30 +00:00
dependabot[bot]
b35730faa0
chore(deps): update boto3 requirement in /src/roster-sync ( #229 )
2026-08-19 03:51:45 +00:00
dependabot[bot]
1590aca846
chore(deps): update boto3 requirement in /src/ring-scheduler ( #228 )
2026-08-19 03:48:47 +00:00
dependabot[bot]
f599294e75
chore(deps): update boto3 requirement in /src/release-notifier ( #227 )
2026-08-19 03:46:07 +00:00
dependabot[bot]
f6369e71fd
chore(deps): update boto3 requirement in /src/holiday-router ( #226 )
2026-08-19 03:43:24 +00:00
dependabot[bot]
58795d90a9
chore(deps): update boto3 requirement in /src/weekly-post ( #232 )
2026-08-19 03:41:01 +00:00
dependabot[bot]
1748238ef3
chore(deps): bump the minor-and-patch group with 5 updates ( #225 )
...
Deploy / deploy (push) Waiting to run
Deploy / release (push) Blocked by required conditions
Bumps the minor-and-patch group with 5 updates:
| Package | From | To |
| --- | --- | --- |
| [Sea-Haven-Industries/.github/.github/workflows/ci-python-sam.yaml](https://github.com/sea-haven-industries/.github ) | `1.0.6` | `1.0.7` |
| [Sea-Haven-Industries/.github/.github/workflows/callable-dependency-review.yaml](https://github.com/sea-haven-industries/.github ) | `1.0.6` | `1.0.7` |
| [Sea-Haven-Industries/.github/.github/workflows/cd-sam.yaml](https://github.com/sea-haven-industries/.github ) | `1.0.6` | `1.0.7` |
| [Sea-Haven-Industries/.github/.github/workflows/callable-labeler.yaml](https://github.com/sea-haven-industries/.github ) | `1.0.6` | `1.0.7` |
| [Sea-Haven-Industries/.github/.github/workflows/callable-pr-policy.yaml](https://github.com/sea-haven-industries/.github ) | `1.0.6` | `1.0.7` |
Updates `Sea-Haven-Industries/.github/.github/workflows/ci-python-sam.yaml` from 1.0.6 to 1.0.7
- [Release notes](https://github.com/sea-haven-industries/.github/releases )
- [Commits](7ac3528750...e5691d8a7fhttps://github.com/sea-haven-industries/.github/releases )
- [Commits](7ac3528750...e5691d8a7fhttps://github.com/sea-haven-industries/.github/releases )
- [Commits](7ac3528750...e5691d8a7fhttps://github.com/sea-haven-industries/.github/releases )
- [Commits](7ac3528750...e5691d8a7fhttps://github.com/sea-haven-industries/.github/releases )
- [Commits](7ac3528750...e5691d8a7f
2026-08-18 19:26:58 -04:00
dependabot[bot]
ece9947840
chore(deps): bump the minor-and-patch group with 5 updates ( #217 )
...
Deploy / deploy (push) Has been cancelled
Deploy / release (push) Has been cancelled
Bumps the minor-and-patch group with 5 updates:
| Package | From | To |
| --- | --- | --- |
| [Sea-Haven-Industries/.github/.github/workflows/ci-python-sam.yaml](https://github.com/sea-haven-industries/.github ) | `1.0.3` | `1.0.6` |
| [Sea-Haven-Industries/.github/.github/workflows/callable-dependency-review.yaml](https://github.com/sea-haven-industries/.github ) | `1.0.3` | `1.0.6` |
| [Sea-Haven-Industries/.github/.github/workflows/cd-sam.yaml](https://github.com/sea-haven-industries/.github ) | `1.0.3` | `1.0.6` |
| [Sea-Haven-Industries/.github/.github/workflows/callable-labeler.yaml](https://github.com/sea-haven-industries/.github ) | `1.0.3` | `1.0.6` |
| [Sea-Haven-Industries/.github/.github/workflows/callable-pr-policy.yaml](https://github.com/sea-haven-industries/.github ) | `1.0.5` | `1.0.6` |
Updates `Sea-Haven-Industries/.github/.github/workflows/ci-python-sam.yaml` from 1.0.3 to 1.0.6
- [Release notes](https://github.com/sea-haven-industries/.github/releases )
- [Commits](3f74677422...7ac3528750https://github.com/sea-haven-industries/.github/releases )
- [Commits](3f74677422...7ac3528750https://github.com/sea-haven-industries/.github/releases )
- [Commits](3f74677422...7ac3528750https://github.com/sea-haven-industries/.github/releases )
- [Commits](3f74677422...7ac3528750https://github.com/sea-haven-industries/.github/releases )
- [Commits](9c1ecf9428...7ac3528750
2026-08-12 00:12:07 +00:00
dependabot[bot]
f3cd27aa18
chore(deps): update boto3 requirement in /src/holiday-router ( #218 )
...
Updates the requirements on [boto3](https://github.com/boto/boto3 ) to permit the latest version.
- [Release notes](https://github.com/boto/boto3/releases )
- [Commits](https://github.com/boto/boto3/compare/1.43.62...1.43.67 )
---
updated-dependencies:
- dependency-name: boto3
dependency-version: 1.43.67
dependency-type: direct:production
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-12 00:09:56 +00:00
dependabot[bot]
6141cd38be
chore(deps): update boto3 requirement in /src/release-notifier ( #219 )
...
Updates the requirements on [boto3](https://github.com/boto/boto3 ) to permit the latest version.
- [Release notes](https://github.com/boto/boto3/releases )
- [Commits](https://github.com/boto/boto3/compare/1.43.62...1.43.67 )
---
updated-dependencies:
- dependency-name: boto3
dependency-version: 1.43.67
dependency-type: direct:production
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-12 00:06:43 +00:00
