Bump aws-cdk-lib in /cdk in the minor-and-patch group across 1 directory

Bumps the minor-and-patch group with 1 update in the /cdk directory: [aws-cdk-lib](https://github.com/aws/aws-cdk).


Updates `aws-cdk-lib` from 2.261.0 to 2.262.1
- [Release notes](https://github.com/aws/aws-cdk/releases)
- [Changelog](https://github.com/aws/aws-cdk/blob/main/CHANGELOG.v2.alpha.md)
- [Commits](https://github.com/aws/aws-cdk/compare/v2.261.0...v2.262.1)

---
updated-dependencies:
- dependency-name: aws-cdk-lib
  dependency-version: 2.262.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

.github/workflows/ci.yaml

@@ -3,9 +3,12 @@ on:
   pull_request:
     branches: [main]
 
+permissions:
+  contents: read
+
 jobs:
   ci:
-    uses: Sea-Haven-Industries/.github/.github/workflows/ci-python-sam.yaml@fd60e4c9041784f666ac0fdefb9bec3c7fbf5143 # main
+    uses: Sea-Haven-Industries/.github/.github/workflows/ci-python-sam.yaml@f71002a9ed2938730b683249b28059c92a081af6
     with:
       python-version: "3.12"
       source-dirs: "cdk lambdas tests"

.github/workflows/dependency-review.yml

@@ -1,6 +1,10 @@
 name: Dependency Review
 on:
   pull_request:
+
+permissions:
+  contents: read
+
 jobs:
   review:
     uses: Sea-Haven-Industries/.github/.github/workflows/callable-dependency-review.yaml@fd60e4c9041784f666ac0fdefb9bec3c7fbf5143 # main

cdk/requirements.txt

@@ -1,2 +1,2 @@
-aws-cdk-lib==2.261.0
-constructs>=10.7.0
+aws-cdk-lib==2.262.1
+constructs>=10.7.1

lambdas/classifier/classify.py

@@ -25,6 +25,7 @@ from __future__ import annotations
 import html
 import os
 import re
+from urllib.parse import unquote, urlparse
 
 # Axis 2 — Hold Reason → category.
 HOLD_TO_CATEGORY = {
@@ -118,6 +119,19 @@ def strip_html(comment: str | None) -> str:
 # ---------------------------------------------------------------------------
 
 
+def _contains_url_with_host(text: str, expected_host: str) -> bool:
+    """Return True when ''text'' contains an absolute URL with hostname ''expected_host''."""
+    for raw_url in re.findall(r"https?://[^\s<>'\"()]+", text, flags=re.IGNORECASE):
+        candidate = unquote(raw_url).rstrip(".,;:!?)]}\"'")
+        try:
+            host = urlparse(candidate).hostname
+        except ValueError:
+            continue
+        if host and host.lower() == expected_host:
+            return True
+    return False
+
+
 def comment_intent(comment: str) -> str | None:
     """Ordered, most-specific-first rule ladder over the *stripped* text.
 
@@ -147,7 +161,7 @@ def comment_intent(comment: str) -> str | None:
     # -- SIM Ticket: Amazon SIM tooling references.
     if (
         re.search(r"\bsim\b.*\b(ticket|tt|v\d{6,})\b", low)
-        or "t.corp.amazon.com" in low
+        or _contains_url_with_host(t, "t.corp.amazon.com")
         or re.search(r"\bsim\s*tt\b", low)
     ):
         return "SIM Ticket"