530bd7210e
feat(terraform): migrate forgejo to HCP Terraform
...
Move the prod host onto workspace forgejo-prod in the After Hours VPC and freeze CDK push deploys so cutover can happen without applying into seahaven-prod.
2026-09-29 18:36:17 -04:00
Adam Moussa
8b1c8bf500
chore(ci): remove pr policy workflow caller ( #96 )
Deploy / deploy (push) Waiting to run
2026-08-24 15:12:06 -04:00
Adam Moussa
0e62f4c862
chore(ci): switch auto-merge from seahaven-bot to Mergify ( #95 )
Deploy / deploy (push) Waiting to run
2026-08-24 13:53:41 -04:00
Adam Moussa
f7d47d7ae8
ci: enable squash auto-merge on ready PRs (PLAT-108) ( #93 )
...
Deploy / deploy (push) Has been cancelled
* ci: enable squash auto-merge on ready PRs
* fix(ci): serialize auto-merge enable and ignore already-enabled
2026-08-21 23:34:24 +00:00
Adam Moussa
554d79f304
ci: add merge_group trigger for required ci / ci ( #92 )
Deploy / deploy (push) Waiting to run
2026-08-21 17:42:12 -04:00
dependabot[bot]
c8778a702e
chore(deps): bump callable-labeler.yaml ( #82 )
...
Deploy / deploy (push) Has been cancelled
Bumps [Sea-Haven-Industries/.github/.github/workflows/callable-labeler.yaml](https://github.com/sea-haven-industries/.github ) from 1.0.6 to 1.0.7.
- [Release notes](https://github.com/sea-haven-industries/.github/releases )
- [Commits](7ac3528750...e5691d8a7f
2026-08-13 13:19:29 -04:00
dependabot[bot]
335899e6d0
chore(deps): bump ci-typescript-cdk.yaml ( #83 )
...
Bumps [Sea-Haven-Industries/.github/.github/workflows/ci-typescript-cdk.yaml](https://github.com/sea-haven-industries/.github ) from 1.0.6 to 1.0.7.
- [Release notes](https://github.com/sea-haven-industries/.github/releases )
- [Commits](7ac3528750...e5691d8a7f
2026-08-13 13:10:36 -04:00
dependabot[bot]
2b0b5e590b
chore(deps): bump callable-pr-policy.yaml ( #81 )
...
Deploy / deploy (push) Waiting to run
Bumps [Sea-Haven-Industries/.github/.github/workflows/callable-pr-policy.yaml](https://github.com/sea-haven-industries/.github ) from 1.0.6 to 1.0.7.
- [Release notes](https://github.com/sea-haven-industries/.github/releases )
- [Commits](7ac3528750...e5691d8a7f
2026-08-13 16:51:12 +00:00
dependabot[bot]
150174a3c8
chore(deps): bump cd-cdk.yaml ( #80 )
...
Bumps [Sea-Haven-Industries/.github/.github/workflows/cd-cdk.yaml](https://github.com/sea-haven-industries/.github ) from 1.0.6 to 1.0.7.
- [Release notes](https://github.com/sea-haven-industries/.github/releases )
- [Commits](7ac3528750...e5691d8a7f
2026-08-13 16:46:15 +00:00
dependabot[bot]
95dfc6cb94
chore(deps): callable-dependency-review.yaml ( #79 )
...
Bumps [Sea-Haven-Industries/.github/.github/workflows/callable-dependency-review.yaml](https://github.com/sea-haven-industries/.github ) from 1.0.6 to 1.0.7.
- [Release notes](https://github.com/sea-haven-industries/.github/releases )
- [Commits](7ac3528750...e5691d8a7f
2026-08-13 16:29:36 +00:00
dependabot[bot]
bb6902ef8e
chore(deps): bump callable-dependency-review.yaml ( #73 )
...
Deploy / deploy (push) Waiting to run
Bumps [Sea-Haven-Industries/.github/.github/workflows/callable-dependency-review.yaml](https://github.com/sea-haven-industries/.github ) from 1.0.4 to 1.0.6.
- [Release notes](https://github.com/sea-haven-industries/.github/releases )
- [Commits](81cf168170...7ac3528750
2026-08-07 11:44:09 -04:00
dependabot[bot]
00be78169a
chore(deps): bump callable-labeler.yaml ( #75 )
...
Bumps [Sea-Haven-Industries/.github/.github/workflows/callable-labeler.yaml](https://github.com/sea-haven-industries/.github ) from 1.0.4 to 1.0.6.
- [Release notes](https://github.com/sea-haven-industries/.github/releases )
- [Commits](81cf168170...7ac3528750
2026-08-07 15:21:45 +00:00
dependabot[bot]
23233d40c2
chore(deps): bump cd-cdk.yaml ( #76 )
...
Bumps [Sea-Haven-Industries/.github/.github/workflows/cd-cdk.yaml](https://github.com/sea-haven-industries/.github ) from 1.0.4 to 1.0.6.
- [Release notes](https://github.com/sea-haven-industries/.github/releases )
- [Commits](81cf168170...7ac3528750
2026-08-07 15:11:40 +00:00
dependabot[bot]
7cc5283d02
chore(deps): bump ci-typescript-cdk.yaml ( #74 )
...
Bumps [Sea-Haven-Industries/.github/.github/workflows/ci-typescript-cdk.yaml](https://github.com/sea-haven-industries/.github ) from 1.0.4 to 1.0.6.
- [Release notes](https://github.com/sea-haven-industries/.github/releases )
- [Commits](81cf168170...7ac3528750
2026-08-07 15:04:38 +00:00
dependabot[bot]
43d1ff48c0
chore(deps): bump callable-labeler.yaml to 1.0.4 ( #66 )
...
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-07 10:54:09 -04:00
dependabot[bot]
7baf8f3061
chore(deps): bump dependency-review.yaml to 1.0.4 ( #65 )
...
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-07 10:54:08 -04:00
dependabot[bot]
8a6c8c57dd
chore(deps): bump ci-typescript-cdk.yaml to 1.0.4 ( #64 )
...
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-07 10:54:08 -04:00
dependabot[bot]
c6a760f146
chore(deps): bump cd-cdk.yaml from 1.0.3 to 1.0.4 ( #63 )
...
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-07 10:54:07 -04:00
Adam Moussa
d0659ebf6f
ci: add org PR policy caller (PLAT-62) ( #69 )
...
* ci: add org PR policy caller
Refs: PLAT-62
* ci: update callable-pr-policy to v1.0.6
* chore: retrigger PR checks
2026-08-07 10:54:07 -04:00
dependabot[bot]
fdee41dc82
chore(deps): bump Sea-Haven-Industries/.github/.github/workflows/cd-cdk.yaml
...
Bumps [Sea-Haven-Industries/.github/.github/workflows/cd-cdk.yaml](https://github.com/sea-haven-industries/.github ) from 1.0.2 to 1.0.3.
- [Release notes](https://github.com/sea-haven-industries/.github/releases )
- [Commits](0170a57c0d...3f74677422
2026-07-30 05:49:42 +00:00
dependabot[bot]
184a289f9c
chore(deps): bump Sea-Haven-Industries/.github/.github/workflows/ci-typescript-cdk.yaml
...
Bumps [Sea-Haven-Industries/.github/.github/workflows/ci-typescript-cdk.yaml](https://github.com/sea-haven-industries/.github ) from 1.0.2 to 1.0.3.
- [Release notes](https://github.com/sea-haven-industries/.github/releases )
- [Commits](0170a57c0d...3f74677422
2026-07-30 05:44:02 +00:00
dependabot[bot]
6066807ad2
chore(deps): bump Sea-Haven-Industries/.github/.github/workflows/callable-labeler.yaml
...
Bumps [Sea-Haven-Industries/.github/.github/workflows/callable-labeler.yaml](https://github.com/sea-haven-industries/.github ) from 1.0.2 to 1.0.3.
- [Release notes](https://github.com/sea-haven-industries/.github/releases )
- [Commits](0170a57c0d...3f74677422
2026-07-30 05:38:41 +00:00
dependabot[bot]
7fb9cb7818
chore(deps): bump Sea-Haven-Industries/.github/.github/workflows/callable-dependency-review.yaml
...
Bumps [Sea-Haven-Industries/.github/.github/workflows/callable-dependency-review.yaml](https://github.com/sea-haven-industries/.github ) from 1.0.2 to 1.0.3.
- [Release notes](https://github.com/sea-haven-industries/.github/releases )
- [Commits](0170a57c0d...3f74677422
2026-07-30 02:13:25 +00:00
Adam Moussa
ed5985672b
ci: declare workflow permissions and normalize block spacing
2026-07-28 18:07:48 -04:00
Adam Moussa
09443bf179
ci(deps): pin org reusable workflows to v1.0.2
2026-07-28 17:58:00 -04:00
Adam Moussa
848682cc94
chore(ci): SHA-pin org reusable-workflow caller refs (INFRA-50) ( #42 )
Deploy / deploy (push) Has been cancelled
2026-07-06 18:27:25 -04:00
Adam Moussa
e32401e554
Repo hygiene: PR labeler + README badges + dependabot (INFRA-56/57/66) ( #29 )
Deploy / deploy (push) Waiting to run
2026-06-11 14:13:26 -04:00
Adam Moussa
6754ceaa42
Add dependency-review caller workflow ( #20 )
...
* Add dependency-review caller workflow
Add a pull_request-triggered caller that invokes the org-level
callable-dependency-review workflow to scan dependency changes and
fail on high-severity advisories.
* chore: retrigger checks
* chore: retrigger dep review (post-fix)
2026-06-05 12:26:38 -04:00
Adam Moussa
d2b718a126
Fix compliance audit violations from issue #6 ( #7 )
...
Pin aws-cdk-lib to blessed 2.253.1, add dependabot.yml, export
backup verification Lambda ARN, pin node-version: 24 in workflows,
add __pycache__ to .gitignore.
2026-05-18 16:35:23 -04:00
Adam Moussa
cfda99927b
Add 3-2-1 backup strategy ( #2 )
...
* Add 3-2-1 backup strategy with cross-region replication and GCS offsite
Implements a fully compliant 3-2-1 backup architecture:
- Copy 1 (live): Harden existing EBS snapshots to 30-day retention
- Copy 2 (near-site): S3 cross-region replication to us-west-2 with
Object Lock (governance 90d) and versioning
- Copy 3 (offsite): GCS bucket in dedicated seahaven-backups GCP project
with 2-year irreversible retention lock
Also adds a verification Lambda that checks all 3 locations daily and
runs monthly restore tests with SQLite integrity checks.
* Enable QEMU in CI for arm64 Lambda Docker builds
* Commit cdk.context.json for CI synth without AWS credentials
Vpc.fromLookup requires cached context to synthesize without
AWS credentials. Required for CI which runs cdk synth without
an OIDC role.
* Fix GCP project ID to sea-haven-backups
* Address code review findings for backup verification
Fix 4 critical issues:
- Add filter/priority/deleteMarkerReplication to S3 CRR rule (deploy would fail without)
- Add stack dependency so replica deploys before main stack
- Fix DB file extension matching (.sqlite3/.sql instead of .db)
- Replace nonexistent `forgejo restore` command with actual restore steps in README
Fix 4 moderate issues:
- Add timeout=10 to Slack webhook urlopen call
- Add filter='data' to tarfile.extract for PEP 706 compliance
- Add explicit ValueError for unknown handler mode
- Use date-scoped S3/GCS prefix instead of unbounded listing
* Fix backup strategy bug findings
* Handle SQL text dumps separately from binary SQLite in restore test
Forgejo dump produces gitea-db.sql as a text SQL dump (XORM export),
not a binary SQLite file. Opening it directly with sqlite3.connect()
throws DatabaseError. Now imports the SQL dump into a temp DB first.
* Fix GCS backup check: align staleness cutoff and add size validation
GCS check used a 72h cutoff but only listed 2 days of prefixes (~48h),
making the staleness check unreachable. Also added 1MB minimum file
size validation to match the S3 check.
* Rename SECRET_ARN env vars to SECRET_NAME to match actual values
* Fix EBS snapshot state check, drop unused GCS write grant and dead lifecycle rule
* Fix restore runbook, DLM snapshot tagging, README cleanup, and gsutil prompt
* Fix restore runbook: trailing-dot cp idiom and Glacier restore step
* Rename GCS service account to match read-only permissions
* Add 4 GiB ephemeral storage to verification Lambda
Monthly restore-test downloads and extracts the full dump tarball
in /tmp. As the dump grows with LFS data, the default 512 MB will
eventually cause ENOSPC failures.
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
2026-05-14 18:08:06 -04:00
Adam Moussa
a500d69716
Add Forgejo CDK stack
...
EC2 (t4g.small, arm64) in private subnet with VPN-only access,
DLM nightly snapshots, and Route53 DNS at forgejo.seahaven.com.
2026-05-11 17:52:37 -04:00
