ci: align workflows with Sea Haven CI/CD handbook (#29)

* Align workflows with Sea Haven CI/CD handbook

Bring the workflow suite in line with the handbook: bump
actions/checkout to v7 (Node 24 runtime, already standardized),
kebab-case the two snake_case workflow filenames, and add the
org-standard Labeler caller and Dependency Review gate so vulnerable
or disallowed-license deps and unlabeled PRs are caught automatically.

File renames only — job/check display names are unchanged, so the
promotion gate's REQUIRED_CHECKS and branch-protection required
checks are unaffected.

Refs: INFRA-115

* Drop Agent prefix from CI workflow + job names

The handbook names workflows for what they do (CI, Deploy, Labeler),
not the component they run, matching .github and afterhours-shift-manager.
Rename the suite to CI and its jobs to Lint / Format check / Unit tests,
and keep the promotion gate's REQUIRED_CHECKS in sync.

Refs: INFRA-115

---------

Co-authored-by: seahaven-openswe[bot] <296972425+seahaven-openswe[bot]@users.noreply.github.com>

.github/scripts/check-dev-green.sh

@@ -4,7 +4,7 @@
 # Reads check-runs on stdin — one
 #   name<US>status<US>conclusion<US>details_url
 # per line, fields separated by ASCII Unit Separator (0x1F) — so it is unit-testable
-# WITHOUT GitHub. promote_dev_to_prod.yml pipes the live `gh api .../check-runs`
+# WITHOUT GitHub. promote-dev-to-prod.yml pipes the live `gh api .../check-runs`
 # output in. 0x1F (not TAB) is used deliberately: TAB is IFS-whitespace, so an empty
 # conclusion (every in_progress check has a null conclusion) would collapse and shift
 # the columns — which would make the promote run fail to exclude itself. 0x1F is
@@ -26,12 +26,12 @@
 set -euo pipefail
 
 EXCLUDE_RUN_ID="${EXCLUDE_RUN_ID:-}"
-# Mandatory checks (one per line). Defaults to the Agent CI suite, which runs on
+# Mandatory checks (one per line). Defaults to the CI suite, which runs on
 # every push to dev (see ci.yml). Keep in sync with those job names; if a name
 # drifts the gate blocks (fails safe) until the list is updated.
-REQUIRED_CHECKS="${REQUIRED_CHECKS:-Agent lint
+REQUIRED_CHECKS="${REQUIRED_CHECKS:-Lint
-Agent format check
+Format check
-Agent unit tests
+Unit tests
 Playwright E2E}"
 
 declare -A GREEN

.github/workflows/build-artifacts.yml

@@ -62,7 +62,7 @@ jobs:
       BUCKET: open-swe-dev-assets
       DEPLOY_DOC: open-swe-dev-deploy
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: oven-sh/setup-bun@v2
         with:
           bun-version: latest
@@ -100,7 +100,7 @@ jobs:
       BUCKET: open-swe-prod-assets
       DEPLOY_DOC: open-swe-prod-deploy
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: oven-sh/setup-bun@v2
         with:
           bun-version: latest

.github/workflows/cd-infra.yml

@@ -66,7 +66,7 @@ jobs:
       id-token: write
       contents: read
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: actions/setup-node@v4
         with:
           node-version: "24"
@@ -102,7 +102,7 @@ jobs:
       id-token: write
       contents: read
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: actions/setup-node@v4
         with:
           node-version: "24"

.github/workflows/ci-infra.yml

@@ -1,6 +1,6 @@
 name: Infra CI
 
-# Path-filtered CI for the /infra CDK app (TypeScript). The existing "Agent CI"
+# Path-filtered CI for the /infra CDK app (TypeScript). The existing "CI"
 # (ci.yml) covers the Python agent; this adds tsc + jest + cdk synth for /infra so
 # infra changes are gated on a PR the same way. Runs only when /infra changes.
 

.github/workflows/ci.yml

@@ -1,11 +1,11 @@
-name: Agent CI
+name: CI
 
 permissions:
   contents: read
 
 on:
   push:
-    # dev as well as main so every dev HEAD carries the full Agent CI signal that
+    # dev as well as main so every dev HEAD carries the full CI signal that
     # the dev->main promotion gate (check-dev-green.sh) reads. PR checks alone are
     # not enough: an admin-merge can land a red PR onto dev.
     branches: ["main", "dev"]
@@ -18,10 +18,10 @@ concurrency:
 
 jobs:
   lint:
-    name: Agent lint
+    name: Lint
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
       - name: Install dependencies
         run: uv sync --locked --extra dev
@@ -29,10 +29,10 @@ jobs:
         run: make lint
 
   format:
-    name: Agent format check
+    name: Format check
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
       - name: Install dependencies
         run: uv sync --locked --extra dev
@@ -40,10 +40,10 @@ jobs:
         run: make format-check
 
   unit-tests:
-    name: Agent unit tests
+    name: Unit tests
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
       - name: Install dependencies
         run: uv sync --locked --extra dev
@@ -55,7 +55,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
       - uses: actions/setup-node@v4
         with:

.github/workflows/dependency-review.yml

@@ -0,0 +1,15 @@
+name: Dependency Review
+
+on: pull_request
+
+permissions:
+  contents: read
+
+jobs:
+  dependency-review:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/dependency-review-action@v4
+        with:
+          fail-on-severity: high

.github/workflows/labeler.yml

@@ -0,0 +1,13 @@
+name: Labeler
+
+on:
+  pull_request:
+
+permissions:
+  contents: read
+  pull-requests: write
+  issues: write
+
+jobs:
+  labeler:
+    uses: Sea-Haven-Industries/.github/.github/workflows/callable-labeler.yaml@main

.github/workflows/promote-dev-to-prod.yml

@@ -19,7 +19,7 @@ jobs:
       contents: write
       checks: read
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           ref: dev
           fetch-depth: 0

.github/workflows/reviewer-eval.yml

@@ -78,7 +78,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 360
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
       - name: Install dependencies
         run: uv sync --locked

.github/workflows/rollback.yml

@@ -50,7 +50,7 @@ jobs:
       DEPLOY_DOC: open-swe-dev-deploy
       TARGET_SHA: ${{ inputs.sha }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: aws-actions/configure-aws-credentials@v6
         with:
           role-to-assume: ${{ vars.AWS_DEPLOY_ROLE_APP_DEV }}
@@ -75,7 +75,7 @@ jobs:
       DEPLOY_DOC: open-swe-prod-deploy
       TARGET_SHA: ${{ inputs.sha }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: aws-actions/configure-aws-credentials@v6
         with:
           role-to-assume: ${{ vars.AWS_DEPLOY_ROLE_APP_PROD }}

evals/reviewer/README.md

@@ -57,8 +57,8 @@ uv run python -m evals.reviewer.run_eval --limit 3
 
 ### From the GitHub Action (recommended for full runs)
 
-Trigger the **Reviewer eval** workflow (`.github/workflows/reviewer_eval.yml`)
+Trigger the **Reviewer eval** workflow (`.github/workflows/reviewer-eval.yml`)
-from the Actions UI or `gh workflow run reviewer_eval.yml --ref prod -f limit=3`.
+from the Actions UI or `gh workflow run reviewer-eval.yml --ref prod -f limit=3`.
 Run it on the **prod** branch so the harness/judge match the deployed reviewer it
 scores. Running it on a durable runner (instead of inside the serving deployment)
 means a deploy or container recycle can't kill a long run.

infra/README.md

@@ -245,7 +245,7 @@ npm test            # jest — naming Aspect
 ## CI/CD (T18 — `.github/workflows/ci-infra.yml` + `cd-infra.yml`)
 
 Path-filtered, OIDC-only (no static keys). The Python agent keeps its own
-`ci.yml` ("Agent CI"); these two add the `/infra` half.
+`ci.yml` ("CI"); these two add the `/infra` half.
 
 | Workflow | Trigger | Does |
 |---|---|---|