Adam Moussa
f13d2e3ff1
feat(infra): migrate pipeline and Grafana to HCP Terraform (PLAT-75) ( #57 )
...
Deploy / Deploy to prod (push) Waiting to run
* feat(infra): migrate pipeline and Grafana to HCP Terraform (PLAT-75)
Move apm-wo-analysis into seahaven-prod under workspace apm-wo-analysis-prod
with in-repo hcptf/githubdeploy IAM, stub Lambdas, and GitHub Actions zip CD.
* chore(iam): add Checkov skip comments for HCP IAM documents
Pre-push HIGH findings are the DLM snapshot describe, tagged EC2 creates,
exec boundary DescribeLogGroups star, and the drop-uploader user policy.
2026-09-16 20:33:24 +00:00
Adam Moussa
b7e76a0bb8
ci: add merge_group trigger for required ci / ci ( #50 )
Deploy / deploy (push) Waiting to run
2026-08-21 17:42:02 -04:00
dependabot[bot]
a9ea3a4dcd
chore(deps): bump the minor-and-patch group with 5 updates
...
Bumps the minor-and-patch group with 5 updates:
| Package | From | To |
| --- | --- | --- |
| [Sea-Haven-Industries/.github/.github/workflows/ci-python-sam.yaml](https://github.com/sea-haven-industries/.github ) | `1.0.3` | `1.0.7` |
| [Sea-Haven-Industries/.github/.github/workflows/callable-dependency-review.yaml](https://github.com/sea-haven-industries/.github ) | `1.0.3` | `1.0.7` |
| [Sea-Haven-Industries/.github/.github/workflows/cd-cdk.yaml](https://github.com/sea-haven-industries/.github ) | `1.0.3` | `1.0.7` |
| [Sea-Haven-Industries/.github/.github/workflows/callable-labeler.yaml](https://github.com/sea-haven-industries/.github ) | `1.0.3` | `1.0.7` |
| [Sea-Haven-Industries/.github/.github/workflows/callable-pr-policy.yaml](https://github.com/sea-haven-industries/.github ) | `1.0.5` | `1.0.7` |
Updates `Sea-Haven-Industries/.github/.github/workflows/ci-python-sam.yaml` from 1.0.3 to 1.0.7
- [Release notes](https://github.com/sea-haven-industries/.github/releases )
- [Commits](3f74677422...e5691d8a7fhttps://github.com/sea-haven-industries/.github/releases )
- [Commits](3f74677422...e5691d8a7fhttps://github.com/sea-haven-industries/.github/releases )
- [Commits](3f74677422...e5691d8a7fhttps://github.com/sea-haven-industries/.github/releases )
- [Commits](3f74677422...e5691d8a7fhttps://github.com/sea-haven-industries/.github/releases )
- [Commits](9c1ecf9428...e5691d8a7f
2026-08-13 18:54:41 +00:00
dependabot[bot]
6a31a4549c
chore(deps): bump the minor-and-patch group with 4 updates ( #41 )
...
Bumps the minor-and-patch group with 4 updates: [Sea-Haven-Industries/.github/.github/workflows/ci-python-sam.yaml](https://github.com/sea-haven-industries/.github ), [Sea-Haven-Industries/.github/.github/workflows/callable-dependency-review.yaml](https://github.com/sea-haven-industries/.github ), [Sea-Haven-Industries/.github/.github/workflows/cd-cdk.yaml](https://github.com/sea-haven-industries/.github ) and [Sea-Haven-Industries/.github/.github/workflows/callable-labeler.yaml](https://github.com/sea-haven-industries/.github ).
Updates `Sea-Haven-Industries/.github/.github/workflows/ci-python-sam.yaml` from 1.0.2 to 1.0.3
- [Release notes](https://github.com/sea-haven-industries/.github/releases )
- [Commits](0170a57c0d...3f74677422https://github.com/sea-haven-industries/.github/releases )
- [Commits](0170a57c0d...3f74677422https://github.com/sea-haven-industries/.github/releases )
- [Commits](0170a57c0d...3f74677422https://github.com/sea-haven-industries/.github/releases )
- [Commits](0170a57c0d...3f74677422
2026-08-04 18:25:30 -04:00
Adam Moussa
300fdab3bb
ci(deps): pin org reusable workflows to v1.0.2
2026-07-28 17:57:51 -04:00
Adam Moussa
eaf214a733
ci: bump reusable workflow pin to f71002a (ruff 0.15.22 pin) ( #37 )
...
Picks up Sea-Haven-Industries/.github#88 , which pins ruff in ci-python-sam so unpinned installs no longer float to new releases with changed default rule sets. Ruff 0.16.0's default-rule expansion broke this repo's CI with 21 pre-existing findings (89 in meal-order-manager, the first repo hit). Refs Sea-Haven-Industries/.github#87 .
2026-07-24 16:32:37 +00:00
Adam Moussa
299ead89b3
chore: resolve open code scanning alerts (URL host matching + workflow permissions) ( #36 )
...
Deploy / deploy (push) Waiting to run
* fix: Refactor `comment_intent` to use `_contains_url_with_host` for URL host matching.
* ci: add least-privilege permissions blocks to workflow callers
Resolves code scanning alerts #4 and #5 (actions/missing-workflow-permissions). Both callable workflows only need contents: read; the dependency-review callable already declares it internally, this caps the caller token to match.
2026-07-23 19:10:45 +00:00
Adam Moussa
27dd15c541
chore(ci): SHA-pin org reusable-workflow caller refs (INFRA-50) ( #30 )
Deploy / deploy (push) Has been cancelled
2026-07-06 18:27:14 -04:00
Adam Moussa
1a126c8179
Enable test execution in CI
2026-05-29 14:30:44 -04:00
Adam Moussa
d33b82bd92
Enable QEMU for arm64 Lambda bundling in CI/CD
2026-05-29 13:36:56 -04:00
Adam Moussa
58b91bda70
Scaffold apm-wo-analysis repository
...
Stand up the Phase 0 CDK scaffold for the daily APM work-order
analysis pipeline: two-stack CDK app (pipeline + grafana), classifier
and slack-post Lambda packages, dashboards-as-code, the local
drop-folder uploader, and a classifier smoke-test placeholder.
Wire CI/CD to the org reusable workflows: ci.yaml -> ci-python-sam
(ruff + cdk synth) and deploy.yaml -> cd-cdk (OIDC, cdk deploy --all).
Pin aws-cdk-lib==2.253.1; Lambdas target Python 3.12 / arm64.
Rewrite .gitignore to the org Python-CDK standard so the source-of-
truth files (CLAUDE.md, docs/, .claude/agents) are tracked while build
artifacts (.venv, cdk.out, caches) stay ignored.
Domain logic, stack resources, and dashboards are stubbed and filled
in across Phases 1-5 (docs/BUILD.md). cdk synth is green for both
stacks; ruff check/format pass.
2026-05-28 16:13:13 -04:00
