Fix compliance audit violations from issue #6 (#7)

Pin aws-cdk-lib to blessed 2.253.1, add dependabot.yml, export
backup verification Lambda ARN, pin node-version: 24 in workflows,
add __pycache__ to .gitignore.

.github/dependabot.yml

@@ -0,0 +1,15 @@
+version: 2
+updates:
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly
+    assignees:
+      - amoussa1229
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    assignees:
+      - amoussa1229

.github/workflows/ci.yaml

@@ -7,4 +7,5 @@ jobs:
   ci:
     uses: Sea-Haven-Industries/.github/.github/workflows/ci-typescript-cdk.yaml@main
     with:
+      node-version: "24"
       enable-qemu: true

.github/workflows/deploy.yaml

@@ -15,6 +15,7 @@ jobs:
   deploy:
     uses: Sea-Haven-Industries/.github/.github/workflows/cd-cdk.yaml@main
     with:
+      node-version: "24"
       enable-qemu: true
     secrets:
       deploy-role-arn: ${{ secrets.AWS_DEPLOY_ROLE_ARN }}

.gitignore

@@ -5,3 +5,4 @@ cdk.out/
 *.d.ts
 *.js.map
 docs/*.pdf
+__pycache__/

lib/constructs/backup-verification.ts

@@ -18,6 +18,8 @@ interface BackupVerificationProps {
 }
 
 export class BackupVerification extends Construct {
+  public readonly functionArn: string;
+
   constructor(scope: Construct, id: string, props: BackupVerificationProps) {
     super(scope, id);
 
@@ -106,5 +108,7 @@ export class BackupVerification extends Construct {
       treatMissingData: cloudwatch.TreatMissingData.BREACHING,
       comparisonOperator: cloudwatch.ComparisonOperator.GREATER_THAN_OR_EQUAL_TO_THRESHOLD,
     });
+
+    this.functionArn = fn.functionArn;
   }
 }

lib/forgejo-stack.ts

@@ -455,7 +455,7 @@ export class ForgejoStack extends cdk.Stack {
       ),
     });
 
-    new BackupVerification(this, "BackupVerification", {
+    const backupVerification = new BackupVerification(this, "BackupVerification", {
       sourceBucket: backupBucket,
       replicaBucketName: props.replicaBucketName,
       gcsBucket: "forgejo-backups-offsite-seahaven",
@@ -463,6 +463,10 @@ export class ForgejoStack extends cdk.Stack {
       slackWebhookSecretName: "forgejo/slack-webhook",
     });
 
+    new cdk.CfnOutput(this, "BackupVerificationFunctionArn", {
+      value: backupVerification.functionArn,
+    });
+
     new cdk.CfnOutput(this, "ForgejoUrl", {
       value: "https://forgejo.seahaven.com",
     });

package-lock.json

@@ -8,8 +8,8 @@
       "name": "forgejo",
       "version": "1.0.0",
       "dependencies": {
-        "@aws-cdk/aws-lambda-python-alpha": "^2.252.0-alpha.0",
-        "aws-cdk-lib": "^2.252.0",
+        "@aws-cdk/aws-lambda-python-alpha": "2.253.1-alpha.0",
+        "aws-cdk-lib": "2.253.1",
         "constructs": "^10.0.0"
       },
       "bin": {
@@ -35,15 +35,15 @@
       "license": "Apache-2.0"
     },
     "node_modules/@aws-cdk/aws-lambda-python-alpha": {
-      "version": "2.252.0-alpha.0",
-      "resolved": "https://registry.npmjs.org/@aws-cdk/aws-lambda-python-alpha/-/aws-lambda-python-alpha-2.252.0-alpha.0.tgz",
-      "integrity": "sha512-hVcursqZQ6tjToN4AvzOTfoeiN9epJGbUVi5VCGbIT88ide4hUzKsOda29+vw1Ket8nLi5i/xNB9odWU5QWdkw==",
+      "version": "2.253.1-alpha.0",
+      "resolved": "https://registry.npmjs.org/@aws-cdk/aws-lambda-python-alpha/-/aws-lambda-python-alpha-2.253.1-alpha.0.tgz",
+      "integrity": "sha512-k4yeoKExF7aGvmcY7pPFP6wjrt1L/mNtnddA72yIqcSDumAKI0hRqkqp7yG6GC45ubeuAD0pCQeSW9YGkEMI9A==",
       "license": "Apache-2.0",
       "engines": {
         "node": ">= 20.0.0"
       },
       "peerDependencies": {
-        "aws-cdk-lib": "^2.252.0",
+        "aws-cdk-lib": "^2.253.1",
         "constructs": "^10.5.0"
       }
     },

package.json

@@ -18,8 +18,8 @@
     "typescript": "~5.7.0"
   },
   "dependencies": {
-    "@aws-cdk/aws-lambda-python-alpha": "^2.252.0-alpha.0",
-    "aws-cdk-lib": "^2.252.0",
+    "@aws-cdk/aws-lambda-python-alpha": "2.253.1-alpha.0",
+    "aws-cdk-lib": "2.253.1",
     "constructs": "^10.0.0"
   }
 }