exec-aide's caller jobs are named python/typescript, so the org ruleset's
required 'ci / ci' status check never reported here and every PR was
merge-blocked for non-admins. The aggregator needs all real CI jobs and
fails if any failed or was cancelled.
Per handbook Pinning Principle: exact pins are kept current by Dependabot version updates gated by CI + dependency review. Blanket ignores let pins rot (see today's fast-uri incident).
* Add dependency-review caller workflow
Add a pull_request-triggered caller that invokes the org-level
callable-dependency-review workflow to scan dependency changes and
fail on high-severity advisories.
* chore: retrigger checks
* chore: retrigger dep review (post-fix)
* chore: retrigger ci
* chore: retrigger CI after concurrency fix
* Add CI workflow and apply ruff formatting
* Disable cdk synth — PythonFunction requires Docker arm64 builds
The PythonFunction construct bundles via Docker with --platform
linux/arm64, which fails on GitHub Actions x86 runners. tsc --noEmit
still runs and catches TypeScript errors.
