f34603ed98
fix(ci): restore the reusable workflow so the required check is named ci / ci
...
Inlining the job reported `ci` instead of the org ruleset's `ci / ci`.
2026-09-21 15:03:11 -04:00
af2743f23c
fix(api): return JSON objects and stop logging job payloads
...
Flask now jsonify-s handler dicts so API responses are not HTML, and the worker logs only event and status.
2026-09-21 15:00:33 -04:00
d7ee6a3b74
fix(jobs): run delayed close and reminder deliveries
...
Wall-clock skip windows dropped the only weekly SQS attempt when Scheduler already fired in Eastern time. Dev schedules stay disabled.
2026-09-21 14:48:59 -04:00
3e9a1c60bf
feat(api): serve meals on ECS Fargate instead of Lambda
...
Keep the Flask app always-on with in-process jobs so CloudFront no longer fronts a cold-start API Gateway.
2026-09-21 14:37:48 -04:00
renovate[bot]
12df37dab8
chore(deps): update terraform minor and patch ( #198 )
...
Build Lambda Layer / build (push) Has been cancelled
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-09-21 15:41:31 +00:00
renovate[bot]
67014c954a
chore(deps): update pip minor and patch ( #189 )
...
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-09-21 15:41:24 +00:00
renovate[bot]
b4078d3a8b
chore(deps): update dependency prettier to v3.9.8 ( #197 )
...
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-09-21 15:40:57 +00:00
Adam Moussa
bbbe359858
fix(iam): ignore default tags on hcptf roles (PLAT-210) ( #196 )
...
* fix(iam): ignore default tags on hcptf roles (PLAT-210)
The apply role cannot iam:TagRole on itself. Provider default_tags from
the env split 403'd the prod apply on hcptf-meal-order-manager and -plan.
* fix(iam): ignore tags_all on hcptf roles (PLAT-210)
ignore_changes on tags does not cover provider default_tags. The prod
speculative plan still wanted Environment on tags_all and would TagRole.
2026-09-18 20:53:13 +00:00
Adam Moussa
44c79fdefd
feat(infra): add lightweight meal-order-manager-dev (PLAT-210) ( #195 )
...
* feat(infra): add lightweight meal-order-manager-dev (PLAT-210)
Parameterize the HCP root for seahaven-dev with schedules, PITR, alarms, and Paychex gated off so a second env does not clone production cost or side effects.
* fix(infra): drop prod-only authorizer import so dev can create it (PLAT-210)
The PLAT-102 import is already in meal-order-manager-prod state. A shared import block fails in seahaven-dev because the permission does not exist there.
* fix(iam): allow creating the weekly-menu githubdeploy role in seahaven-dev (PLAT-210)
Prod imported that role. A new account needs CreateRole on tf-managed/githubdeploy-meal-order-manager-weekly-menu.
2026-09-18 18:38:45 +00:00
Adam Moussa
12f1eb881f
fix(auth): accept federated portal Cognito tokens for meals admin (DEV-283) ( #194 )
...
Build Lambda Layer / build (push) Has been cancelled
* fix(auth): accept federated portal Cognito tokens for meals admin
Google Workspace federation stores email_verified=false, which 403'd the
portal Admin probe while the public menu still loaded.
* fix(iam): grant plan role CloudFront DescribeFunction
2026-09-18 15:31:17 +00:00
Adam Moussa
85f36fcfff
feat(edge): proxy portal meals API paths on orders.seahaven.com (DEV-282) ( #193 )
...
Build Lambda Layer / build (push) Waiting to run
* feat(edge): proxy portal meals API paths on orders.seahaven.com (DEV-282)
Keep the static form on / while CloudFront forwards submit, form-status, admin, and caller-only order lookup so the portal can use the public meals host without a form redirect.
* fix(style): apply ruff format
2026-09-17 23:52:51 +00:00
renovate[bot]
a81241dc03
chore(deps): update sea-haven-industries/.github action to v1.0.11 ( #190 )
...
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-09-16 16:45:46 +00:00
Adam Moussa
26a92a2f62
feat(auth): accept portal Cognito ID tokens (DEV-238) ( #192 )
...
Build Lambda Layer / build (push) Has been cancelled
* feat(auth): accept portal Cognito ID tokens
* fix(auth): distinguish portal verification outages
* docs(auth): document Cognito workspace variables
2026-09-15 22:12:01 +00:00
Adam Moussa
86bb476e27
feat(menu): expose production menu API ( #191 )
2026-09-15 21:41:10 +00:00
Adam Moussa
ed98ad0ac9
docs(readme): record HCP VCS trigger patterns (PLAT-183) ( #188 )
2026-09-10 21:00:35 +00:00
Adam Moussa
c1552f0bd3
chore(meals): remove email_report payroll SES path (PLAT-135) ( #187 )
...
Build Lambda Layer / build (push) Has been cancelled
* chore(meals): remove email_report payroll SES path (PLAT-135)
Stop Monday SES deduction emails now that Flex checkcomponents owns payroll posting.
* chore(meals): delete email_report handler and SAM resources
Remove the leftover SES Lambda source so it cannot be redeployed from template.yaml.
2026-09-10 19:29:58 +00:00
renovate[bot]
aceb174c4b
chore(deps): update npm minor and patch ( #186 )
...
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-09-09 18:44:27 +00:00
renovate[bot]
0aeaff7b0c
chore(deps): update aws-actions/configure-aws-credentials action to v6.2.4 ( #185 )
...
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-09-09 18:43:51 +00:00
Adam Moussa
62f61f61d1
feat(meals): send weekly deductions to paychex checkcomponents (PLAT-154) ( #184 )
...
Build Lambda Layer / build (push) Has been cancelled
* feat(meals): send weekly deductions to paychex checkcomponents (PLAT-154)
* fix(meals): round checkcomponents amounts half-up
Keep SQS deduction amounts on the same rounding path as submit_order so extra-precision totals cannot diverge by a cent.
2026-09-03 22:04:02 +00:00
Adam Moussa
b043b86fc7
feat(iam): import hcptf roles into app Terraform (PLAT-146) ( #183 )
...
* feat(iam): import hcptf roles into app Terraform (PLAT-146)
Move the existing hcptf pair into this repo so app Terraform owns prod IAM after the substrate handoff.
* fix(iam): add apply-role IAM list permissions (PLAT-146)
IamReadOnly omitted ListRoleTags and ListInstanceProfilesForRole needed after detaching the substrate guardrail.
2026-09-02 21:47:12 +00:00
Adam Moussa
8489dc3986
feat(meals): dual-read week keys and meal-to-Flex join (PLAT-134) ( #182 )
...
Build Lambda Layer / build (push) Has been cancelled
* feat(meals): dual-read week keys and meal-to-Flex join (PLAT-134)
* style(meals): apply ruff format (PLAT-134)
* docs(meals): clarify week-key dual-read is same-instant (PLAT-134)
2026-09-02 00:01:44 +00:00
renovate[bot]
60aa30bf12
chore(deps): update dependency eslint to v10.9.1 ( #180 )
...
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-08-31 22:40:30 +00:00
renovate[bot]
38106bd8bc
chore(deps): update sea-haven-industries/.github action to v1.0.10 ( #181 )
...
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-08-31 22:40:14 +00:00
Adam Moussa
72ffb315b1
chore(deps): remove dependabot version updates ( #179 )
...
Renovate is the version-update bot on this Interactive repo. GitHub Dependabot alerts stay.
2026-08-25 11:50:59 -04:00
renovate[bot]
c224afcc3e
chore(deps): pin dependencies - abandoned ( #167 )
Build Lambda Layer / build (push) Has been cancelled
2026-08-24 20:59:58 +00:00
renovate[bot]
a742c4bfa5
chore(deps): update dependency globals to v17.11.0 ( #172 )
2026-08-24 20:54:55 +00:00
renovate[bot]
4cbc28aba1
chore(deps): update dependency eslint to v10.9.0 ( #171 )
2026-08-24 20:50:28 +00:00
renovate[bot]
ffef33fbb9
chore(deps): update terraform external to ~> 2.4 ( #170 )
2026-08-24 20:40:00 +00:00
renovate[bot]
7818afce09
chore(deps): update github actions ( #169 )
2026-08-24 20:35:23 +00:00
renovate[bot]
432203f04d
chore(deps): update dependency boto3 to v1.43.78 ( #168 )
2026-08-24 20:32:21 +00:00
Adam Moussa
9407a3e6d7
chore(deps): batch minor and patch updates ( #165 )
Build Lambda Layer / build (push) Waiting to run
2026-08-24 19:47:00 +00:00
dependabot[bot]
ddfb73c9d4
chore(deps): bump boto3 ( #155 )
...
Bumps the minor-and-patch group with 1 update in the /functions/email_report directory: [boto3](https://github.com/boto/boto3 ).
Updates `boto3` from 1.43.71 to 1.43.77
- [Release notes](https://github.com/boto/boto3/releases )
- [Commits](https://github.com/boto/boto3/compare/1.43.71...1.43.77 )
---
updated-dependencies:
- dependency-name: boto3
dependency-version: 1.43.76
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: minor-and-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-24 15:27:34 -04:00
Adam Moussa
7e6a4f6851
chore(ci): remove pr policy workflow caller ( #163 )
2026-08-24 15:12:15 -04:00
Adam Moussa
25178cc228
chore(ci): switch auto-merge from seahaven-bot to Mergify ( #162 )
2026-08-24 13:52:27 -04:00
Adam Moussa
8ef63b51eb
fix(ci): enqueue merge queue as seahaven-bot (PLAT-108) ( #160 )
...
* fix(ci): enqueue merge queue as seahaven-bot
* fix(ci): limit seahaven-bot enqueue to PRs targeting main
2026-08-24 15:22:45 +00:00
Adam Moussa
04f49bf4b0
ci: enable squash auto-merge on ready PRs (PLAT-108) ( #150 )
...
* ci: enable squash auto-merge on ready PRs
* fix(ci): serialize auto-merge enable and ignore already-enabled
2026-08-21 23:34:27 +00:00
Adam Moussa
9f5ca7773e
ci: add merge_group trigger for required ci / ci ( #149 )
2026-08-21 17:41:52 -04:00
Adam Moussa
c5c29b2bef
fix(iam): attach per-workload lambda permissions boundary (PLAT-52) ( #148 )
...
* fix(iam): attach per-workload lambda permissions boundary (PLAT-52)
* fix(iam): skip boundary delete on weekly-menu role (PLAT-52)
2026-08-20 16:02:46 -04:00
dependabot[bot]
a247f2f45a
chore(deps): bump boto3 ( #147 )
...
Build Lambda Layer / build (push) Has been cancelled
Bumps the minor-and-patch group in /functions/slack_notifier with 1 update: [boto3](https://github.com/boto/boto3 ).
Updates `boto3` from 1.43.66 to 1.43.71
- [Release notes](https://github.com/boto/boto3/releases )
- [Commits](https://github.com/boto/boto3/compare/1.43.66...1.43.71 )
---
updated-dependencies:
- dependency-name: boto3
dependency-version: 1.43.71
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: minor-and-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-17 18:57:10 +00:00
dependabot[bot]
ed5249c20e
chore(deps): bump the minor-and-patch group ( #145 )
...
Bumps the minor-and-patch group in /src/shared with 2 updates: [boto3](https://github.com/boto/boto3 ) and [fpdf2](https://github.com/py-pdf/fpdf2 ).
Updates `boto3` from 1.43.66 to 1.43.71
- [Release notes](https://github.com/boto/boto3/releases )
- [Commits](https://github.com/boto/boto3/compare/1.43.66...1.43.71 )
Updates `fpdf2` from 2.8.7 to 2.8.8
- [Release notes](https://github.com/py-pdf/fpdf2/releases )
- [Changelog](https://github.com/py-pdf/fpdf2/blob/master/CHANGELOG.md )
- [Commits](https://github.com/py-pdf/fpdf2/compare/2.8.7...2.8.8 )
---
updated-dependencies:
- dependency-name: boto3
dependency-version: 1.43.71
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: minor-and-patch
- dependency-name: fpdf2
dependency-version: 2.8.8
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: minor-and-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-17 18:55:53 +00:00
dependabot[bot]
60eaae921b
chore(deps): bump the minor-and-patch group with 4 updates ( #146 )
...
Bumps the minor-and-patch group with 4 updates: [Sea-Haven-Industries/.github/.github/workflows/ci-python-sam.yaml](https://github.com/sea-haven-industries/.github ), [Sea-Haven-Industries/.github/.github/workflows/callable-dependency-review.yaml](https://github.com/sea-haven-industries/.github ), [Sea-Haven-Industries/.github/.github/workflows/callable-labeler.yaml](https://github.com/sea-haven-industries/.github ) and [Sea-Haven-Industries/.github/.github/workflows/callable-pr-policy.yaml](https://github.com/sea-haven-industries/.github ).
Updates `Sea-Haven-Industries/.github/.github/workflows/ci-python-sam.yaml` from 1.0.6 to 1.0.7
- [Release notes](https://github.com/sea-haven-industries/.github/releases )
- [Commits](7ac3528750...e5691d8a7fhttps://github.com/sea-haven-industries/.github/releases )
- [Commits](7ac3528750...e5691d8a7fhttps://github.com/sea-haven-industries/.github/releases )
- [Commits](7ac3528750...e5691d8a7fhttps://github.com/sea-haven-industries/.github/releases )
- [Commits](7ac3528750...e5691d8a7f
2026-08-17 18:54:33 +00:00
dependabot[bot]
caac622c76
chore(deps): bump boto3 in the minor-and-patch group ( #144 )
...
Bumps the minor-and-patch group with 1 update: [boto3](https://github.com/boto/boto3 ).
Updates `boto3` from 1.43.66 to 1.43.71
- [Release notes](https://github.com/boto/boto3/releases )
- [Commits](https://github.com/boto/boto3/compare/1.43.66...1.43.71 )
---
updated-dependencies:
- dependency-name: boto3
dependency-version: 1.43.71
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: minor-and-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-17 18:53:16 +00:00
dependabot[bot]
d4cf02a5a5
chore(deps): bump boto3 ( #143 )
...
Bumps the minor-and-patch group in /functions/close_form with 1 update: [boto3](https://github.com/boto/boto3 ).
Updates `boto3` from 1.43.66 to 1.43.71
- [Release notes](https://github.com/boto/boto3/releases )
- [Commits](https://github.com/boto/boto3/compare/1.43.66...1.43.71 )
---
updated-dependencies:
- dependency-name: boto3
dependency-version: 1.43.71
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: minor-and-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-17 18:52:06 +00:00
dependabot[bot]
d3a0fe5e65
chore(deps): bump boto3 ( #142 )
...
Bumps the minor-and-patch group in /functions/email_report with 1 update: [boto3](https://github.com/boto/boto3 ).
Updates `boto3` from 1.43.66 to 1.43.71
- [Release notes](https://github.com/boto/boto3/releases )
- [Commits](https://github.com/boto/boto3/compare/1.43.66...1.43.71 )
---
updated-dependencies:
- dependency-name: boto3
dependency-version: 1.43.71
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: minor-and-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-17 18:34:42 +00:00
dependabot[bot]
861f959adf
chore(deps): bump boto3 ( #140 )
...
Bumps the minor-and-patch group in /functions/admin_authorizer with 1 update: [boto3](https://github.com/boto/boto3 ).
Updates `boto3` from 1.43.66 to 1.43.71
- [Release notes](https://github.com/boto/boto3/releases )
- [Commits](https://github.com/boto/boto3/compare/1.43.66...1.43.71 )
---
updated-dependencies:
- dependency-name: boto3
dependency-version: 1.43.71
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: minor-and-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-17 18:33:21 +00:00
dependabot[bot]
4b261246ca
chore(deps): bump boto3 ( #141 )
...
Bumps the minor-and-patch group in /functions/aggregate_orders with 1 update: [boto3](https://github.com/boto/boto3 ).
Updates `boto3` from 1.43.66 to 1.43.71
- [Release notes](https://github.com/boto/boto3/releases )
- [Commits](https://github.com/boto/boto3/compare/1.43.66...1.43.71 )
---
updated-dependencies:
- dependency-name: boto3
dependency-version: 1.43.71
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: minor-and-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Adam Moussa <166072409+amoussa1229@users.noreply.github.com>
2026-08-17 18:28:47 +00:00
dependabot[bot]
7a830882a8
chore(deps): bump boto3 ( #139 )
...
Bumps the minor-and-patch group in /functions/submit_order with 1 update: [boto3](https://github.com/boto/boto3 ).
Updates `boto3` from 1.43.66 to 1.43.71
- [Release notes](https://github.com/boto/boto3/releases )
- [Commits](https://github.com/boto/boto3/compare/1.43.66...1.43.71 )
---
updated-dependencies:
- dependency-name: boto3
dependency-version: 1.43.71
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: minor-and-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-17 14:26:55 -04:00
Adam Moussa
58b9d4f83b
fix(pdf): fit weekly summaries on one page without a broken title ( #138 )
...
Build Lambda Layer / build (push) Has been cancelled
Helvetica cannot encode an em dash, so the header rendered a question mark. Tighter single-column spacing keeps a 12-person week on page 1 while still paginating large weeks.
2026-08-15 00:17:27 +00:00
Adam Moussa
10c86f2de6
fix(apigateway): drop orphaned authorizer invoke role from state ( #137 )
...
Apply destroyed the inline policy then failed deleting the role on
iam:ListInstanceProfilesForRole; the role was removed out of band.
2026-08-10 17:48:05 -04:00
Adam Moussa
60abc9fb50
fix(apigateway): grant admin authorizer invoke via resource policy ( #136 )
...
Drop the broken AuthorizerCredentialsArn invoke role path that returned
500 without calling the authorizer, and adopt the live Lambda permission.
2026-08-10 17:17:51 -04:00
