dd23f08878
fix(terraform): restore the dump app.ini with the database
...
INTERNAL_TOKEN, JWT_SECRET, and LFS_JWT_SECRET live in that file. A restore that keeps the generated file cannot decrypt the dumped secrets.
2026-09-29 19:59:54 -04:00
494b63439f
docs(terraform): keep optional restore copies from aborting under set -e
...
if/fi matches user_data.sh. The file comment now says forgejo-services versions also go through the org-account role.
2026-09-29 19:53:28 -04:00
2541cd934c
docs(terraform): keep restore runbook on one bucket and fail closed
...
Glacier and the download use the prod bucket. GCS unpacks on the data volume. Neither path deletes live repos until the dump has a database.
2026-09-29 19:48:39 -04:00
2cc849024f
fix(terraform): accept dumps that already contain data/forgejo.db
...
Today's archive has no gitea-db.sqlite3 at the root. Copy that file only when it is present.
2026-09-29 19:37:48 -04:00
30f4b54052
fix(terraform): scope plan object reads and restore on the data volume
...
The plan role only needs object reads for the verification zip. Unpacking a dump in /tmp fills the root volume.
2026-09-29 19:35:07 -04:00
8eb19b4e55
fix(terraform): let the plan role read object tags and retention
...
The S3 provider refreshes tagging, ACL, attributes, and Object Lock on the Lambda zip.
2026-09-29 19:28:05 -04:00
566a669c7b
fix(terraform): let the plan role read backup object metadata
...
HeadObject on the Lambda zip is s3:GetObject. The plan role only had the bucket ARNs.
2026-09-29 19:25:14 -04:00
d511861296
fix(terraform): let the plan role read bucket website config
...
The S3 provider refreshes GetBucketWebsite. The plan role was denied on the three Forgejo buckets.
2026-09-29 19:22:34 -04:00
8360cfb1db
fix(terraform): allow HCP refresh of the log group and parameter
...
The scoped apply role can create those resources, but CloudWatch and SSM list them on a wildcard ARN. DescribeLogGroups and DescribeParameters need that resource.
2026-09-29 19:10:08 -04:00
Adam Moussa
e4982b87ad
feat(terraform): migrate forgejo to HCP Terraform (PLAT-80) ( #100 )
...
* feat(terraform): migrate forgejo to HCP Terraform
Move the prod host onto workspace forgejo-prod in the After Hours VPC and freeze CDK push deploys so cutover can happen without applying into seahaven-prod.
* fix(terraform): restore forgejo.db from the dump tarball
Boot restore was copying data/ and repos/ and leaving the sqlite file at the archive root, so a volume restore started Forgejo with no database.
2026-09-29 22:49:21 +00:00
Adam Moussa
e23afc0693
docs(agents): drop security review gates ( #99 )
...
Deploy / deploy (push) Has been cancelled
Agents no longer treat a security review or a cross-family review as a merge gate.
2026-09-26 17:17:25 -04:00
Adam Moussa
57cec908eb
chore(ci): remove unused Mergify stub ( #98 )
Deploy / deploy (push) Has been cancelled
2026-09-22 18:42:11 +00:00
Adam Moussa
8b8f20fd65
chore(deps): remove dependabot version updates ( #97 )
...
Deploy / deploy (push) Has been cancelled
Renovate is the version-update bot. GitHub Dependabot alerts stay.
2026-08-25 11:51:51 -04:00
Adam Moussa
8b1c8bf500
chore(ci): remove pr policy workflow caller ( #96 )
Deploy / deploy (push) Waiting to run
2026-08-24 15:12:06 -04:00
Adam Moussa
0e62f4c862
chore(ci): switch auto-merge from seahaven-bot to Mergify ( #95 )
Deploy / deploy (push) Waiting to run
2026-08-24 13:53:41 -04:00
Adam Moussa
f7d47d7ae8
ci: enable squash auto-merge on ready PRs (PLAT-108) ( #93 )
...
Deploy / deploy (push) Has been cancelled
* ci: enable squash auto-merge on ready PRs
* fix(ci): serialize auto-merge enable and ignore already-enabled
2026-08-21 23:34:24 +00:00
Adam Moussa
554d79f304
ci: add merge_group trigger for required ci / ci ( #92 )
Deploy / deploy (push) Waiting to run
2026-08-21 17:42:12 -04:00
dependabot[bot]
7b1292bd5d
chore(deps): bump tsx from 4.23.11 to 4.23.12 ( #91 )
Deploy / deploy (push) Has been cancelled
2026-08-20 06:45:12 +00:00
dependabot[bot]
998b75ca04
chore(deps): bump aws-cdk from 2.1135.1 to 2.1136.0 ( #90 )
2026-08-20 06:40:25 +00:00
dependabot[bot]
420db8a384
chore(deps): bump aws-cdk-lib from 2.262.2 to 2.265.0 ( #89 )
2026-08-20 02:35:37 -04:00
dependabot[bot]
c8778a702e
chore(deps): bump callable-labeler.yaml ( #82 )
...
Deploy / deploy (push) Has been cancelled
Bumps [Sea-Haven-Industries/.github/.github/workflows/callable-labeler.yaml](https://github.com/sea-haven-industries/.github ) from 1.0.6 to 1.0.7.
- [Release notes](https://github.com/sea-haven-industries/.github/releases )
- [Commits](7ac3528750...e5691d8a7f
2026-08-13 13:19:29 -04:00
dependabot[bot]
86dd40cce4
chore(deps): update google-cloud-storage requirement ( #86 )
...
Updates the requirements on [google-cloud-storage](https://github.com/googleapis/google-cloud-python ) to permit the latest version.
- [Release notes](https://github.com/googleapis/google-cloud-python/releases )
- [Changelog](https://github.com/googleapis/google-cloud-python/blob/main/packages/google-cloud-documentai/CHANGELOG.md )
- [Commits](https://github.com/googleapis/google-cloud-python/compare/google-cloud-storage-v3.13.0...google-cloud-storage-v3.13.1 )
---
updated-dependencies:
- dependency-name: google-cloud-storage
dependency-version: 3.13.1
dependency-type: direct:production
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-13 13:19:29 -04:00
dependabot[bot]
69e213361a
chore(deps): bump aws-cdk from 2.1135.0 to 2.1135.1 ( #85 )
...
Bumps [aws-cdk](https://github.com/aws/aws-cdk-cli/tree/HEAD/packages/aws-cdk ) from 2.1135.0 to 2.1135.1.
- [Release notes](https://github.com/aws/aws-cdk-cli/releases )
- [Commits](https://github.com/aws/aws-cdk-cli/commits/aws-cdk@v2.1135.1/packages/aws-cdk )
---
updated-dependencies:
- dependency-name: aws-cdk
dependency-version: 2.1135.1
dependency-type: direct:development
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-13 13:19:28 -04:00
dependabot[bot]
4da5addbcf
chore(deps): bump tsx from 4.23.1 to 4.23.11 ( #84 )
...
Bumps [tsx](https://github.com/privatenumber/tsx ) from 4.23.1 to 4.23.11.
- [Release notes](https://github.com/privatenumber/tsx/releases )
- [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs )
- [Commits](https://github.com/privatenumber/tsx/compare/v4.23.1...v4.23.11 )
---
updated-dependencies:
- dependency-name: tsx
dependency-version: 4.23.11
dependency-type: direct:development
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-13 13:19:28 -04:00
dependabot[bot]
335899e6d0
chore(deps): bump ci-typescript-cdk.yaml ( #83 )
...
Bumps [Sea-Haven-Industries/.github/.github/workflows/ci-typescript-cdk.yaml](https://github.com/sea-haven-industries/.github ) from 1.0.6 to 1.0.7.
- [Release notes](https://github.com/sea-haven-industries/.github/releases )
- [Commits](7ac3528750...e5691d8a7f
2026-08-13 13:10:36 -04:00
dependabot[bot]
2b0b5e590b
chore(deps): bump callable-pr-policy.yaml ( #81 )
...
Deploy / deploy (push) Waiting to run
Bumps [Sea-Haven-Industries/.github/.github/workflows/callable-pr-policy.yaml](https://github.com/sea-haven-industries/.github ) from 1.0.6 to 1.0.7.
- [Release notes](https://github.com/sea-haven-industries/.github/releases )
- [Commits](7ac3528750...e5691d8a7f
2026-08-13 16:51:12 +00:00
dependabot[bot]
150174a3c8
chore(deps): bump cd-cdk.yaml ( #80 )
...
Bumps [Sea-Haven-Industries/.github/.github/workflows/cd-cdk.yaml](https://github.com/sea-haven-industries/.github ) from 1.0.6 to 1.0.7.
- [Release notes](https://github.com/sea-haven-industries/.github/releases )
- [Commits](7ac3528750...e5691d8a7f
2026-08-13 16:46:15 +00:00
dependabot[bot]
95dfc6cb94
chore(deps): callable-dependency-review.yaml ( #79 )
...
Bumps [Sea-Haven-Industries/.github/.github/workflows/callable-dependency-review.yaml](https://github.com/sea-haven-industries/.github ) from 1.0.6 to 1.0.7.
- [Release notes](https://github.com/sea-haven-industries/.github/releases )
- [Commits](7ac3528750...e5691d8a7f
2026-08-13 16:29:36 +00:00
dependabot[bot]
9562ecce8d
chore(deps): bump constructs from 10.8.0 to 10.8.1 ( #77 )
...
Deploy / deploy (push) Has been cancelled
Bumps [constructs](https://github.com/aws/constructs ) from 10.8.0 to 10.8.1.
- [Release notes](https://github.com/aws/constructs/releases )
- [Commits](https://github.com/aws/constructs/compare/v10.8.0...v10.8.1 )
---
updated-dependencies:
- dependency-name: constructs
dependency-version: 10.8.1
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-07 15:55:34 +00:00
dependabot[bot]
ab03da6d9f
chore(deps): bump aws-cdk from 2.1134.0 to 2.1135.0 ( #78 )
...
Bumps [aws-cdk](https://github.com/aws/aws-cdk-cli/tree/HEAD/packages/aws-cdk ) from 2.1134.0 to 2.1135.0.
- [Release notes](https://github.com/aws/aws-cdk-cli/releases )
- [Commits](https://github.com/aws/aws-cdk-cli/commits/aws-cdk@v2.1135.0/packages/aws-cdk )
---
updated-dependencies:
- dependency-name: aws-cdk
dependency-version: 2.1135.0
dependency-type: direct:development
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-07 15:49:44 +00:00
dependabot[bot]
bb6902ef8e
chore(deps): bump callable-dependency-review.yaml ( #73 )
...
Deploy / deploy (push) Waiting to run
Bumps [Sea-Haven-Industries/.github/.github/workflows/callable-dependency-review.yaml](https://github.com/sea-haven-industries/.github ) from 1.0.4 to 1.0.6.
- [Release notes](https://github.com/sea-haven-industries/.github/releases )
- [Commits](81cf168170...7ac3528750
2026-08-07 11:44:09 -04:00
dependabot[bot]
00be78169a
chore(deps): bump callable-labeler.yaml ( #75 )
...
Bumps [Sea-Haven-Industries/.github/.github/workflows/callable-labeler.yaml](https://github.com/sea-haven-industries/.github ) from 1.0.4 to 1.0.6.
- [Release notes](https://github.com/sea-haven-industries/.github/releases )
- [Commits](81cf168170...7ac3528750
2026-08-07 15:21:45 +00:00
dependabot[bot]
23233d40c2
chore(deps): bump cd-cdk.yaml ( #76 )
...
Bumps [Sea-Haven-Industries/.github/.github/workflows/cd-cdk.yaml](https://github.com/sea-haven-industries/.github ) from 1.0.4 to 1.0.6.
- [Release notes](https://github.com/sea-haven-industries/.github/releases )
- [Commits](81cf168170...7ac3528750
2026-08-07 15:11:40 +00:00
dependabot[bot]
7cc5283d02
chore(deps): bump ci-typescript-cdk.yaml ( #74 )
...
Bumps [Sea-Haven-Industries/.github/.github/workflows/ci-typescript-cdk.yaml](https://github.com/sea-haven-industries/.github ) from 1.0.4 to 1.0.6.
- [Release notes](https://github.com/sea-haven-industries/.github/releases )
- [Commits](81cf168170...7ac3528750
2026-08-07 15:04:38 +00:00
Adam Moussa
32786de262
fix(scripts): ensure temp GCP SA key cleanup via EXIT trap (SEC-28) ( #70 )
...
* chore(deps): bump aws-cdk-lib from 2.262.2 to 2.263.0
Bumps [aws-cdk-lib](https://github.com/aws/aws-cdk/tree/HEAD/packages/aws-cdk-lib ) from 2.262.2 to 2.263.0.
- [Release notes](https://github.com/aws/aws-cdk/releases )
- [Changelog](https://github.com/aws/aws-cdk/blob/main/CHANGELOG.v2.alpha.md )
- [Commits](https://github.com/aws/aws-cdk/commits/v2.263.0/packages/aws-cdk-lib )
---
updated-dependencies:
- dependency-name: aws-cdk-lib
dependency-version: 2.263.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
* chore(deps-dev): bump tsx from 4.23.1 to 4.23.5
Bumps [tsx](https://github.com/privatenumber/tsx ) from 4.23.1 to 4.23.5.
- [Release notes](https://github.com/privatenumber/tsx/releases )
- [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs )
- [Commits](https://github.com/privatenumber/tsx/compare/v4.23.1...v4.23.5 )
---
updated-dependencies:
- dependency-name: tsx
dependency-version: 4.23.5
dependency-type: direct:development
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
* fix: add trap to ensure temp key file removal after GCP SA key creation
* fix(scripts): delete temp GCP key before success message
* chore(deps): drop cdk-lib and tsx bumps from this PR
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-07 10:58:30 -04:00
dependabot[bot]
43d1ff48c0
chore(deps): bump callable-labeler.yaml to 1.0.4 ( #66 )
...
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-07 10:54:09 -04:00
dependabot[bot]
7baf8f3061
chore(deps): bump dependency-review.yaml to 1.0.4 ( #65 )
...
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-07 10:54:08 -04:00
dependabot[bot]
8a6c8c57dd
chore(deps): bump ci-typescript-cdk.yaml to 1.0.4 ( #64 )
...
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-07 10:54:08 -04:00
dependabot[bot]
c6a760f146
chore(deps): bump cd-cdk.yaml from 1.0.3 to 1.0.4 ( #63 )
...
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-07 10:54:07 -04:00
Adam Moussa
d0659ebf6f
ci: add org PR policy caller (PLAT-62) ( #69 )
...
* ci: add org PR policy caller
Refs: PLAT-62
* ci: update callable-pr-policy to v1.0.6
* chore: retrigger PR checks
2026-08-07 10:54:07 -04:00
Adam Moussa
0613d8d6b0
Merge pull request #62 from Sea-Haven-Industries/dependabot/npm_and_yarn/aws-cdk-2.1133.0
Deploy / deploy (push) Has been cancelled
2026-07-30 14:08:02 -04:00
dependabot[bot]
b84bbe61f2
chore(deps-dev): bump aws-cdk from 2.1132.1 to 2.1134.0
...
Bumps [aws-cdk](https://github.com/aws/aws-cdk-cli/tree/HEAD/packages/aws-cdk ) from 2.1132.1 to 2.1134.0.
- [Release notes](https://github.com/aws/aws-cdk-cli/releases )
- [Commits](https://github.com/aws/aws-cdk-cli/commits/aws-cdk@v2.1134.0/packages/aws-cdk )
---
updated-dependencies:
- dependency-name: aws-cdk
dependency-version: 2.1133.0
dependency-type: direct:development
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
2026-07-30 13:52:10 +00:00
Adam Moussa
92dd62afbe
Merge pull request #61 from Sea-Haven-Industries/dependabot/npm_and_yarn/constructs-10.7.2
Deploy / deploy (push) Waiting to run
2026-07-30 09:50:45 -04:00
dependabot[bot]
698dc14626
chore(deps): bump constructs from 10.7.1 to 10.8.0
...
Bumps [constructs](https://github.com/aws/constructs ) from 10.7.1 to 10.8.0.
- [Release notes](https://github.com/aws/constructs/releases )
- [Commits](https://github.com/aws/constructs/compare/v10.7.1...v10.8.0 )
---
updated-dependencies:
- dependency-name: constructs
dependency-version: 10.7.2
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
2026-07-30 13:11:42 +00:00
Adam Moussa
f85d96ce0b
Merge pull request #60 from Sea-Haven-Industries/dependabot/npm_and_yarn/aws-cdk-lib-2.262.2
2026-07-30 09:09:18 -04:00
dependabot[bot]
968faa37c4
chore(deps): bump aws-cdk-lib from 2.262.0 to 2.262.2
...
Bumps [aws-cdk-lib](https://github.com/aws/aws-cdk/tree/HEAD/packages/aws-cdk-lib ) from 2.262.0 to 2.262.2.
- [Release notes](https://github.com/aws/aws-cdk/releases )
- [Changelog](https://github.com/aws/aws-cdk/blob/main/CHANGELOG.v2.alpha.md )
- [Commits](https://github.com/aws/aws-cdk/commits/v2.262.2/packages/aws-cdk-lib )
---
updated-dependencies:
- dependency-name: aws-cdk-lib
dependency-version: 2.262.2
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
2026-07-30 13:04:58 +00:00
Adam Moussa
3bbf81c122
Merge pull request #59 from Sea-Haven-Industries/dependabot/github_actions/Sea-Haven-Industries/dot-github/dot-github/workflows/cd-cdk.yaml-1.0.3
Deploy / deploy (push) Waiting to run
2026-07-30 01:53:45 -04:00
dependabot[bot]
fdee41dc82
chore(deps): bump Sea-Haven-Industries/.github/.github/workflows/cd-cdk.yaml
...
Bumps [Sea-Haven-Industries/.github/.github/workflows/cd-cdk.yaml](https://github.com/sea-haven-industries/.github ) from 1.0.2 to 1.0.3.
- [Release notes](https://github.com/sea-haven-industries/.github/releases )
- [Commits](0170a57c0d...3f74677422
2026-07-30 05:49:42 +00:00
Adam Moussa
cb64441656
Merge pull request #58 from Sea-Haven-Industries/dependabot/github_actions/Sea-Haven-Industries/dot-github/dot-github/workflows/ci-typescript-cdk.yaml-1.0.3
2026-07-30 01:48:04 -04:00
dependabot[bot]
184a289f9c
chore(deps): bump Sea-Haven-Industries/.github/.github/workflows/ci-typescript-cdk.yaml
...
Bumps [Sea-Haven-Industries/.github/.github/workflows/ci-typescript-cdk.yaml](https://github.com/sea-haven-industries/.github ) from 1.0.2 to 1.0.3.
- [Release notes](https://github.com/sea-haven-industries/.github/releases )
- [Commits](0170a57c0d...3f74677422
2026-07-30 05:44:02 +00:00
