renovate[bot]
56a6cf648e
chore(deps): update docker/setup-qemu-action action to v4
2026-09-22 00:13:51 +00:00
Adam Moussa
df3f0c037d
chore(iam): delete leftover Lambda execution roles (PLAT-218) ( #267 )
...
* chore(iam): delete leftover Lambda execution roles (PLAT-218)
* test(iam): keep leftover Lambda boundary after role deletion (PLAT-218)
2026-09-21 23:48:47 +00:00
Adam Moussa
26e9716df4
fix(ci): drop leftover changelog-guard and release-notifier (PLAT-219) ( #266 )
...
Deploy API / Resolve target (push) Waiting to run
Deploy API / Deploy API to (push) Blocked by required conditions
Prod is already a human GitHub Release. Remove the SAM tagging path so CHANGELOG.md stays App Home copy and leftover notifier IAM is destroyed on the next apply.
2026-09-21 23:24:05 +00:00
Adam Moussa
be1160192c
fix(infra): allow hcptf apply to create ECS and ELB service-linked roles (PLAT-216) ( #265 )
2026-09-21 22:56:09 +00:00
Adam Moussa
cbda46ba87
chore(infra): remove API Gateway and Lambda dual-run (PLAT-216) ( #264 )
...
Origins already point at the Fargate hostnames. Drop the HTTP API, eight
functions, zip CD, and Lambda/API Gateway alarms while keeping leftover
Lambda IAM so Paychex can still name weekly-post.
2026-09-21 22:37:13 +00:00
Adam Moussa
6c4018d6b8
fix(infra): move hcptf ECS apply perms to a managed policy (PLAT-216) ( #263 )
...
Deploy API / Resolve target (push) Waiting to run
Deploy API / Deploy API to (push) Blocked by required conditions
Deploy / Deploy to prod (push) Has been cancelled
PutRolePolicy cannot add a third inline on the prod apply role; CreatePolicy of /tf-managed/afterhours-shift-manager-ecs still needs the bootstrap window.
2026-09-21 20:47:25 +00:00
Adam Moussa
1362a6cd90
fix(infra): keep ecs-task-boundary CreatePolicy off live resources (PLAT-216) ( #262 )
...
Deploy API / Resolve target (push) Waiting to run
Deploy API / Deploy API to (push) Blocked by required conditions
Deploy / Deploy to prod (push) Waiting to run
Bootstrap is an IAM factory. The boundary must not wait on DynamoDB, SQS, ECR, or the ECS log group.
2026-09-21 19:57:12 +00:00
Adam Moussa
d49c4bb4f2
fix(infra): split hcptf apply policy and omit empty queue ARNs (PLAT-216) ( #261 )
...
The combined services inline policy exceeded 10KB, and an empty
checkcomponents ARN made CreatePolicy reject the Lambda boundary in dev.
2026-09-21 19:46:36 +00:00
Adam Moussa
593cab66ef
fix(infra): own a dedicated VPC for Fargate (PLAT-216) ( #260 )
...
Prod has no default VPC; 10.70 is unused and matches the meals seam.
2026-09-21 19:30:54 +00:00
Adam Moussa
26adb8e6c0
feat(api): collapse Slack, portal, and jobs onto Fargate (PLAT-216) ( #259 )
...
* feat(api): collapse Slack, portal, and jobs onto Fargate (PLAT-216)
Move HTTP and scheduled work onto one always-on Flask task so after-hours
loses Lambda cold start without changing the Cognito or roster contracts.
* fix(portal-api): keep CORS headers on unexpected 500s
Portal SPA error handling needs Access-Control-Allow-Origin even when
DynamoDB or other internals fail, otherwise the browser hides the 500.
* fix(api): retarget holidays per account and ship App Home changelog (PLAT-216)
* fix(iam): list ECS tasks and fail closed on non-prod Paychex (PLAT-216)
* fix(portal-api): serve portal JSON with an explicit JSON content type
2026-09-21 19:13:30 +00:00
Adam Moussa
969ebf90de
feat(portal-api): add Cognito shift API for the employee portal (DEV-287) ( #255 )
...
Deploy / Deploy to prod (push) Waiting to run
* feat(portal-api): add Cognito shift API for the employee portal (DEV-287)
Employees and admins can pick, drop, swap, and manage coverage through
GET/POST/DELETE /api/shifts. Roster PUT accepts optional email for portal
identity. Slack slash commands and App Home admin modals stay in place.
Co-authored-by: adam <adam@seahavenind.com>
* fix(portal-api): preserve shift and deployment invariants (DEV-287)
Co-authored-by: adam <adam@seahavenind.com>
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
2026-09-21 17:50:57 +00:00
renovate[bot]
f1695cadfa
chore(deps): update pip minor and patch ( #256 )
...
Deploy / Deploy to prod (push) Waiting to run
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-09-21 15:42:56 +00:00
renovate[bot]
ea2910906f
chore(deps): update aws-actions/configure-aws-credentials action to v6.3.0 ( #257 )
...
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-09-21 15:42:43 +00:00
renovate[bot]
0690767509
chore(deps): update terraform aws to ~> 6.65 ( #258 )
...
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-09-21 15:42:29 +00:00
renovate[bot]
9d43e3be9d
chore(deps): update sea-haven-industries/.github action to v1.0.11 ( #250 )
...
Deploy / Deploy to prod (push) Has been cancelled
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-09-16 16:38:44 +00:00
renovate[bot]
b53d856a75
chore(deps): update pip minor and patch ( #251 )
...
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-09-16 16:38:24 +00:00
Adam Moussa
9544dd696a
fix(slack-bot): return 400 on malformed request bodies ( #254 )
...
Bolt parse_body raises JSONDecodeError for empty or non-JSON form
payload fields, which turned probe POSTs into unhandled Lambda 500s.
Fixes AFTERHOURS-SHIFT-MANAGER-2
2026-09-16 16:37:54 +00:00
Adam Moussa
7a513b30ca
fix(infra): match live githubdeploy OIDC and plan-role S3 Gets (PLAT-74) ( #253 )
...
Deploy / Deploy to prod (push) Waiting to run
* fix(infra): match live githubdeploy OIDC and plan-role S3 Gets (PLAT-74)
* fix(infra): pin githubdeploy job_workflow_ref to main (PLAT-74)
2026-09-16 00:48:37 +00:00
Adam Moussa
13350b72d0
feat(infra): migrate afterhours to HCP Terraform (PLAT-74) ( #252 )
...
Deploy / Deploy to prod (push) Waiting to run
* fix(cutover): write Slack secrets into empty Terraform shells
DescribeSecret succeeds on HCP-created shells with no version, so skip-if-exists left roster and Slack tokens unset.
* feat(infra): migrate afterhours to HCP Terraform (PLAT-74)
Replace the mgmt SAM stack with a prod-only HCP workspace, in-repo hcptf IAM, stub Lambdas, and zip CD on push to main.
* fix(cutover): retry DDB unprocessed items and skip past at() holidays
Unprocessed BatchWriteItem rows and leftover past at() schedules would drop roster data or abort holiday recreation during prod cutover.
2026-09-15 23:31:59 +00:00
Adam Moussa
dbef3bda52
chore(pay): remove weekly-post payroll email code, env, and failure alarm ( #249 )
...
Deploy / deploy (push) Has been cancelled
Deploy / release (push) Has been cancelled
PR #248 disabled the SES send by blanking PAYROLL_RECIPIENTS and dropping the
ses:SendEmail grant. This removes the now-dead path: _send_pay_email and
_build_pay_email_html, the SES_SENDER and PAYROLL_RECIPIENTS env, and the
PayrollEmailFailure metric filter and alarm that only fired on that path.
Slack schedule post, pay-summary DM, and checkcomponents enqueue unchanged.
2026-09-10 19:58:59 +00:00
Adam Moussa
2dbe99ef0b
chore(pay): disable weekly-post payroll SES email (PLAT-135) ( #248 )
...
Deploy / deploy (push) Waiting to run
Deploy / release (push) Blocked by required conditions
Empty PAYROLL_RECIPIENTS and drop ses:SendEmail so Monday Slack posts stay, SES pay mail stops.
2026-09-10 19:30:00 +00:00
Adam Moussa
23bad9bee6
feat(roster): add HTTP PUT/DELETE roster API (PLAT-180) ( #247 )
...
Deploy / deploy (push) Waiting to run
Deploy / release (push) Blocked by required conditions
* feat(roster): add Bearer PUT/DELETE roster API
Identity hire needs to write Slack IDs onto roster rows without a stale
daily 3CX sync clearing them, using the existing HTTP client contract.
* fix(roster): strip Secrets Manager token whitespace
A file:// secret commonly includes a trailing newline, so compare_digest
must strip the cached value the same way it strips the Bearer header.
2026-09-09 21:13:27 +00:00
renovate[bot]
37f12421fd
chore(deps): update pip minor and patch ( #246 )
...
Deploy / deploy (push) Waiting to run
Deploy / release (push) Blocked by required conditions
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-09-09 18:40:59 +00:00
renovate[bot]
c52cfc2d0e
chore(deps): update aws-actions/configure-aws-credentials action to v6.2.4 ( #245 )
...
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-09-09 18:40:16 +00:00
Adam Moussa
4ffa09bd3e
feat(pay): send after-hours lines to paychex checkcomponents (PLAT-154) ( #244 )
...
Deploy / deploy (push) Has been cancelled
Deploy / release (push) Has been cancelled
* feat(pay): send after-hours lines to paychex checkcomponents (PLAT-154)
* style(pay): drop trailing blank line in weekly post tests
* fix(pay): skip duplicate checkcomponents send on weekly-post retry
2026-09-03 22:12:55 +00:00
renovate[bot]
244ceaff10
chore(deps): update github actions ( #242 )
...
Deploy / deploy (push) Has been cancelled
Deploy / release (push) Has been cancelled
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-08-31 16:07:13 +00:00
renovate[bot]
42921aa2ba
chore(deps): update pip minor and patch ( #243 )
...
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-08-31 16:06:56 +00:00
Adam Moussa
6eb2e52a74
feat(observability): add Sentry error reporting to Lambdas ( #241 )
...
Deploy / deploy (push) Has been cancelled
Deploy / release (push) Has been cancelled
Unhandled errors and timeout warnings go to Sentry when SENTRY_DSN is set; Slack and 3CX secrets are stripped before send.
2026-08-29 20:52:28 +00:00
Adam Moussa
b048bfeaa1
chore(deps): remove dependabot version updates ( #240 )
...
Deploy / deploy (push) Has been cancelled
Deploy / release (push) Has been cancelled
Renovate is the version-update bot on this Interactive repo. GitHub Dependabot alerts stay.
2026-08-25 11:50:55 -04:00
renovate[bot]
b30828b701
chore(deps): update dependency boto3 to >=1.43.78 ( #238 )
Deploy / deploy (push) Waiting to run
Deploy / release (push) Blocked by required conditions
2026-08-24 21:54:44 +00:00
Adam Moussa
f42a0f7505
chore(ci): remove pr policy workflow caller ( #237 )
Deploy / deploy (push) Waiting to run
Deploy / release (push) Blocked by required conditions
2026-08-24 15:11:53 -04:00
Adam Moussa
036267b98d
chore(ci): switch auto-merge from seahaven-bot to Mergify ( #236 )
Deploy / deploy (push) Waiting to run
Deploy / release (push) Blocked by required conditions
2026-08-24 13:52:43 -04:00
Adam Moussa
a91a1aa718
ci: enable squash auto-merge on ready PRs (PLAT-108) ( #234 )
...
Deploy / deploy (push) Waiting to run
Deploy / release (push) Blocked by required conditions
* ci: enable squash auto-merge on ready PRs
* fix(ci): serialize auto-merge enable and ignore already-enabled
* fix(ci): enqueue merge queue as seahaven-bot
* fix(ci): re-arm auto-merge as seahaven-bot after failed enqueue
2026-08-24 14:47:46 +00:00
Adam Moussa
50ab00947b
ci: add merge_group trigger for required ci / ci ( #233 )
Deploy / deploy (push) Has been cancelled
Deploy / release (push) Has been cancelled
2026-08-21 17:42:19 -04:00
dependabot[bot]
dc96388fa6
chore(deps): update boto3 requirement in /src/slack-bot ( #231 )
Deploy / deploy (push) Has been cancelled
Deploy / release (push) Has been cancelled
2026-08-19 03:56:51 +00:00
dependabot[bot]
84964aa983
chore(deps): update boto3 requirement in /src/shared ( #230 )
2026-08-19 03:54:30 +00:00
dependabot[bot]
b35730faa0
chore(deps): update boto3 requirement in /src/roster-sync ( #229 )
2026-08-19 03:51:45 +00:00
dependabot[bot]
1590aca846
chore(deps): update boto3 requirement in /src/ring-scheduler ( #228 )
2026-08-19 03:48:47 +00:00
dependabot[bot]
f599294e75
chore(deps): update boto3 requirement in /src/release-notifier ( #227 )
2026-08-19 03:46:07 +00:00
dependabot[bot]
f6369e71fd
chore(deps): update boto3 requirement in /src/holiday-router ( #226 )
2026-08-19 03:43:24 +00:00
dependabot[bot]
58795d90a9
chore(deps): update boto3 requirement in /src/weekly-post ( #232 )
2026-08-19 03:41:01 +00:00
dependabot[bot]
1748238ef3
chore(deps): bump the minor-and-patch group with 5 updates ( #225 )
...
Deploy / deploy (push) Waiting to run
Deploy / release (push) Blocked by required conditions
Bumps the minor-and-patch group with 5 updates:
| Package | From | To |
| --- | --- | --- |
| [Sea-Haven-Industries/.github/.github/workflows/ci-python-sam.yaml](https://github.com/sea-haven-industries/.github ) | `1.0.6` | `1.0.7` |
| [Sea-Haven-Industries/.github/.github/workflows/callable-dependency-review.yaml](https://github.com/sea-haven-industries/.github ) | `1.0.6` | `1.0.7` |
| [Sea-Haven-Industries/.github/.github/workflows/cd-sam.yaml](https://github.com/sea-haven-industries/.github ) | `1.0.6` | `1.0.7` |
| [Sea-Haven-Industries/.github/.github/workflows/callable-labeler.yaml](https://github.com/sea-haven-industries/.github ) | `1.0.6` | `1.0.7` |
| [Sea-Haven-Industries/.github/.github/workflows/callable-pr-policy.yaml](https://github.com/sea-haven-industries/.github ) | `1.0.6` | `1.0.7` |
Updates `Sea-Haven-Industries/.github/.github/workflows/ci-python-sam.yaml` from 1.0.6 to 1.0.7
- [Release notes](https://github.com/sea-haven-industries/.github/releases )
- [Commits](7ac3528750...e5691d8a7fhttps://github.com/sea-haven-industries/.github/releases )
- [Commits](7ac3528750...e5691d8a7fhttps://github.com/sea-haven-industries/.github/releases )
- [Commits](7ac3528750...e5691d8a7fhttps://github.com/sea-haven-industries/.github/releases )
- [Commits](7ac3528750...e5691d8a7fhttps://github.com/sea-haven-industries/.github/releases )
- [Commits](7ac3528750...e5691d8a7f
2026-08-18 19:26:58 -04:00
dependabot[bot]
ece9947840
chore(deps): bump the minor-and-patch group with 5 updates ( #217 )
...
Deploy / deploy (push) Has been cancelled
Deploy / release (push) Has been cancelled
Bumps the minor-and-patch group with 5 updates:
| Package | From | To |
| --- | --- | --- |
| [Sea-Haven-Industries/.github/.github/workflows/ci-python-sam.yaml](https://github.com/sea-haven-industries/.github ) | `1.0.3` | `1.0.6` |
| [Sea-Haven-Industries/.github/.github/workflows/callable-dependency-review.yaml](https://github.com/sea-haven-industries/.github ) | `1.0.3` | `1.0.6` |
| [Sea-Haven-Industries/.github/.github/workflows/cd-sam.yaml](https://github.com/sea-haven-industries/.github ) | `1.0.3` | `1.0.6` |
| [Sea-Haven-Industries/.github/.github/workflows/callable-labeler.yaml](https://github.com/sea-haven-industries/.github ) | `1.0.3` | `1.0.6` |
| [Sea-Haven-Industries/.github/.github/workflows/callable-pr-policy.yaml](https://github.com/sea-haven-industries/.github ) | `1.0.5` | `1.0.6` |
Updates `Sea-Haven-Industries/.github/.github/workflows/ci-python-sam.yaml` from 1.0.3 to 1.0.6
- [Release notes](https://github.com/sea-haven-industries/.github/releases )
- [Commits](3f74677422...7ac3528750https://github.com/sea-haven-industries/.github/releases )
- [Commits](3f74677422...7ac3528750https://github.com/sea-haven-industries/.github/releases )
- [Commits](3f74677422...7ac3528750https://github.com/sea-haven-industries/.github/releases )
- [Commits](3f74677422...7ac3528750https://github.com/sea-haven-industries/.github/releases )
- [Commits](9c1ecf9428...7ac3528750
2026-08-12 00:12:07 +00:00
dependabot[bot]
f3cd27aa18
chore(deps): update boto3 requirement in /src/holiday-router ( #218 )
...
Updates the requirements on [boto3](https://github.com/boto/boto3 ) to permit the latest version.
- [Release notes](https://github.com/boto/boto3/releases )
- [Commits](https://github.com/boto/boto3/compare/1.43.62...1.43.67 )
---
updated-dependencies:
- dependency-name: boto3
dependency-version: 1.43.67
dependency-type: direct:production
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-12 00:09:56 +00:00
dependabot[bot]
6141cd38be
chore(deps): update boto3 requirement in /src/release-notifier ( #219 )
...
Updates the requirements on [boto3](https://github.com/boto/boto3 ) to permit the latest version.
- [Release notes](https://github.com/boto/boto3/releases )
- [Commits](https://github.com/boto/boto3/compare/1.43.62...1.43.67 )
---
updated-dependencies:
- dependency-name: boto3
dependency-version: 1.43.67
dependency-type: direct:production
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-12 00:06:43 +00:00
dependabot[bot]
2b79148ded
chore(deps): update boto3 requirement in /src/ring-scheduler ( #220 )
...
Updates the requirements on [boto3](https://github.com/boto/boto3 ) to permit the latest version.
- [Release notes](https://github.com/boto/boto3/releases )
- [Commits](https://github.com/boto/boto3/compare/1.43.62...1.43.67 )
---
updated-dependencies:
- dependency-name: boto3
dependency-version: 1.43.67
dependency-type: direct:production
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-12 00:03:59 +00:00
dependabot[bot]
813c134ae9
chore(deps): update boto3 requirement in /src/roster-sync ( #221 )
...
Updates the requirements on [boto3](https://github.com/boto/boto3 ) to permit the latest version.
- [Release notes](https://github.com/boto/boto3/releases )
- [Commits](https://github.com/boto/boto3/compare/1.43.62...1.43.67 )
---
updated-dependencies:
- dependency-name: boto3
dependency-version: 1.43.67
dependency-type: direct:production
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-12 00:01:37 +00:00
dependabot[bot]
c1df33dbdc
chore(deps): update boto3 requirement in /src/shared ( #222 )
...
Updates the requirements on [boto3](https://github.com/boto/boto3 ) to permit the latest version.
- [Release notes](https://github.com/boto/boto3/releases )
- [Commits](https://github.com/boto/boto3/compare/1.43.62...1.43.67 )
---
updated-dependencies:
- dependency-name: boto3
dependency-version: 1.43.67
dependency-type: direct:production
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-11 23:59:11 +00:00
dependabot[bot]
7f5b85c774
chore(deps): update boto3 requirement in /src/slack-bot ( #223 )
...
Updates the requirements on [boto3](https://github.com/boto/boto3 ) to permit the latest version.
- [Release notes](https://github.com/boto/boto3/releases )
- [Commits](https://github.com/boto/boto3/compare/1.43.62...1.43.67 )
---
updated-dependencies:
- dependency-name: boto3
dependency-version: 1.43.67
dependency-type: direct:production
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-11 23:56:50 +00:00
dependabot[bot]
71c3dc1093
chore(deps): update boto3 requirement in /src/weekly-post ( #224 )
...
Updates the requirements on [boto3](https://github.com/boto/boto3 ) to permit the latest version.
- [Release notes](https://github.com/boto/boto3/releases )
- [Commits](https://github.com/boto/boto3/compare/1.43.62...1.43.67 )
---
updated-dependencies:
- dependency-name: boto3
dependency-version: 1.43.67
dependency-type: direct:production
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-11 19:54:19 -04:00
