CI installs unpinned latest ruff; 0.16.0 flags two pre-existing lines,
failing ci / ci on every PR (including safe Dependabot bumps #31/#32).
- sla_monitor: parse START_DATE with date.fromisoformat() instead of a
naive strptime().date() round-trip (identical result, no naive datetime)
- user_sync: keep the deliberate per-user blanket catch (one failed update
must not abort the sync) with a justified noqa: BLE001
_business_minutes_elapsed clamped each weekday span to midnight instead
of BH_END, and never applied BH_START, so overnight hours (17:00-08:00)
were counted as business time. BH_START/BH_END were defined but unused
in the calculation. A ticket opened Fri 16:00 and evaluated Mon 10:00
scored 1080 min instead of the correct 180 min (6x overcount), flipping
a tier-1 breach into a false tier-2 page.
Clamp each weekday to the [BH_START, BH_END) window and only accrue the
overlap with [since, now); weekends remain excluded. Holidays are still
unhandled (pre-existing, separate gap).
Found by the daily scanner (agentic, CWE-440); proof-or-kill confirmed.
* Add dependency-review caller workflow
Add a pull_request-triggered caller that invokes the org-level
callable-dependency-review workflow to scan dependency changes and
fail on high-severity advisories.
* chore: retrigger checks
* chore: retrigger dep review (post-fix)
* style: ruff format src
Consolidates front-sla-monitor (Python SAM) and google-user-sync
(JavaScript CDK) into a single Python SAM repo with two Lambdas:
front-sla-monitor and front-user-sync.
