31d5f5d432
Remove gratuitous KMS grant on shared DynamoDB CMK
...
wo-email-processor held grant_encrypt_decrypt on the shared
seahaven-dynamodb CMK, but the WorkOrders/WorkOrderComments tables
are not encrypted with that CMK. The grant was dead weight that
extended the WO processor's decrypt reach to the CMK protecting the
purchase-orders table (cross-stack decrypt). Drop it to restore
least privilege; re-add as part of the table CMK migration (INFRA-6).
Refs: INFRA-6
2026-06-17 11:37:03 -04:00
dependabot[bot]
cab4a035ed
Update boto3 requirement in /lambdas/wo/email_processor ( #67 )
...
Deploy / deploy (push) Waiting to run
Updates the requirements on [boto3](https://github.com/boto/boto3 ) to permit the latest version.
- [Release notes](https://github.com/boto/boto3/releases )
- [Commits](https://github.com/boto/boto3/compare/1.43.28...1.43.31 )
---
updated-dependencies:
- dependency-name: boto3
dependency-version: 1.43.30
dependency-type: direct:production
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-16 21:16:19 +00:00
dependabot[bot]
a8d076aae6
Update anthropic requirement in /lambdas/po/email_processor ( #66 )
...
Updates the requirements on [anthropic](https://github.com/anthropics/anthropic-sdk-python ) to permit the latest version.
- [Release notes](https://github.com/anthropics/anthropic-sdk-python/releases )
- [Changelog](https://github.com/anthropics/anthropic-sdk-python/blob/main/CHANGELOG.md )
- [Commits](https://github.com/anthropics/anthropic-sdk-python/compare/v0.109.1...v0.109.2 )
---
updated-dependencies:
- dependency-name: anthropic
dependency-version: 0.109.2
dependency-type: direct:production
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-16 17:12:23 -04:00
dependabot[bot]
b9b7e727b4
Update boto3 requirement in /lambdas/po/email_processor ( #64 )
...
Updates the requirements on [boto3](https://github.com/boto/boto3 ) to permit the latest version.
- [Release notes](https://github.com/boto/boto3/releases )
- [Commits](https://github.com/boto/boto3/compare/1.43.28...1.43.31 )
---
updated-dependencies:
- dependency-name: boto3
dependency-version: 1.43.30
dependency-type: direct:production
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-16 21:07:23 +00:00
dependabot[bot]
0f699595b5
Bump aws-cdk-lib in /cdk in the minor-and-patch group across 1 directory ( #65 )
...
Bumps the minor-and-patch group with 1 update in the /cdk directory: [aws-cdk-lib](https://github.com/aws/aws-cdk ).
Updates `aws-cdk-lib` from 2.258.1 to 2.259.0
- [Release notes](https://github.com/aws/aws-cdk/releases )
- [Changelog](https://github.com/aws/aws-cdk/blob/main/CHANGELOG.v2.alpha.md )
- [Commits](https://github.com/aws/aws-cdk/compare/v2.258.1...v2.259.0 )
---
updated-dependencies:
- dependency-name: aws-cdk-lib
dependency-version: 2.259.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: minor-and-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-16 20:57:49 +00:00
dependabot[bot]
3a4f4889ab
Update boto3 requirement in /lambdas/wo/web_ui ( #63 )
...
Updates the requirements on [boto3](https://github.com/boto/boto3 ) to permit the latest version.
- [Release notes](https://github.com/boto/boto3/releases )
- [Commits](https://github.com/boto/boto3/compare/1.43.28...1.43.31 )
---
updated-dependencies:
- dependency-name: boto3
dependency-version: 1.43.30
dependency-type: direct:production
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-16 20:50:39 +00:00
dependabot[bot]
14794946ba
Update anthropic requirement in /lambdas/wo/email_processor ( #62 )
...
Updates the requirements on [anthropic](https://github.com/anthropics/anthropic-sdk-python ) to permit the latest version.
- [Release notes](https://github.com/anthropics/anthropic-sdk-python/releases )
- [Changelog](https://github.com/anthropics/anthropic-sdk-python/blob/main/CHANGELOG.md )
- [Commits](https://github.com/anthropics/anthropic-sdk-python/compare/v0.109.1...v0.109.2 )
---
updated-dependencies:
- dependency-name: anthropic
dependency-version: 0.109.2
dependency-type: direct:production
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-16 16:46:29 -04:00
dependabot[bot]
edb022a72b
Update boto3 requirement in /lambdas/po/email_processor ( #61 )
...
Deploy / deploy (push) Has been cancelled
Updates the requirements on [boto3](https://github.com/boto/boto3 ) to permit the latest version.
- [Release notes](https://github.com/boto/boto3/releases )
- [Commits](https://github.com/boto/boto3/compare/1.43.25...1.43.28 )
---
updated-dependencies:
- dependency-name: boto3
dependency-version: 1.43.27
dependency-type: direct:production
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-12 19:23:09 +00:00
dependabot[bot]
109f9336e0
Update boto3 requirement in /lambdas/wo/web_ui ( #60 )
...
Updates the requirements on [boto3](https://github.com/boto/boto3 ) to permit the latest version.
- [Release notes](https://github.com/boto/boto3/releases )
- [Commits](https://github.com/boto/boto3/compare/1.43.25...1.43.28 )
---
updated-dependencies:
- dependency-name: boto3
dependency-version: 1.43.27
dependency-type: direct:production
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-12 15:19:41 -04:00
dependabot[bot]
01dc4f6368
Update boto3 requirement in /lambdas/wo/email_processor ( #59 )
...
Deploy / deploy (push) Waiting to run
Updates the requirements on [boto3](https://github.com/boto/boto3 ) to permit the latest version.
- [Release notes](https://github.com/boto/boto3/releases )
- [Commits](https://github.com/boto/boto3/compare/1.43.25...1.43.28 )
---
updated-dependencies:
- dependency-name: boto3
dependency-version: 1.43.27
dependency-type: direct:production
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-12 15:15:51 -04:00
dependabot[bot]
98a9ae1979
Bump aws-cdk-lib in /cdk in the minor-and-patch group ( #58 )
...
Bumps the minor-and-patch group in /cdk with 1 update: [aws-cdk-lib](https://github.com/aws/aws-cdk ).
Updates `aws-cdk-lib` from 2.258.0 to 2.258.1
- [Release notes](https://github.com/aws/aws-cdk/releases )
- [Changelog](https://github.com/aws/aws-cdk/blob/main/CHANGELOG.v2.alpha.md )
- [Commits](https://github.com/aws/aws-cdk/compare/v2.258.0...v2.258.1 )
---
updated-dependencies:
- dependency-name: aws-cdk-lib
dependency-version: 2.258.1
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: minor-and-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-12 15:08:34 -04:00
Adam Moussa
4cc049e958
Repo hygiene: PR labeler + README badges + dependabot (INFRA-56/57/66) ( #57 )
Deploy / deploy (push) Waiting to run
2026-06-11 14:44:27 -04:00
Adam Moussa
47fa35688d
fix(po): grant KMS on seahaven-dynamodb CMK to purchase-orders consumers (INFRA-104) ( #56 )
...
Deploy / deploy (push) Waiting to run
The purchase-orders table was migrated to SSE-KMS (alias/seahaven-dynamodb,
INFRA-95/M-3) out-of-band, but po_stack never declared the key, so
grant_read_write_data did not propagate kms perms. po-email-processor failed
~99.6% of invocations with kms:Decrypt AccessDeniedException, a data-loss
outage on the PO ingestion write path.
- po_stack: declare encryption_key on purchase-orders (reconciles SSE drift;
no-op against the already-encrypted live table) so the existing grants add
kms:Decrypt/GenerateDataKey/DescribeKey to EmailProcessor, WebUI, SiteExtractor.
- wo_stack: pre-emptive grant_encrypt_decrypt on the WO processor role ahead of
the WorkOrders CMK migration (INFRA-6); tables left unencrypted, no table change.
GPT-4.1 cross-review: no blockers.
2026-06-10 19:31:55 -04:00
dependabot[bot]
d217caac13
Update anthropic requirement in /lambdas/wo/email_processor ( #53 )
...
Deploy / deploy (push) Waiting to run
Updates the requirements on [anthropic](https://github.com/anthropics/anthropic-sdk-python ) to permit the latest version.
- [Release notes](https://github.com/anthropics/anthropic-sdk-python/releases )
- [Changelog](https://github.com/anthropics/anthropic-sdk-python/blob/main/CHANGELOG.md )
- [Commits](https://github.com/anthropics/anthropic-sdk-python/compare/v0.105.2...v0.109.1 )
---
updated-dependencies:
- dependency-name: anthropic
dependency-version: 0.107.1
dependency-type: direct:production
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Adam Moussa <166072409+amoussa1229@users.noreply.github.com>
2026-06-10 22:21:45 +00:00
dependabot[bot]
910959be7a
Update anthropic requirement in /lambdas/po/email_processor ( #55 )
...
Updates the requirements on [anthropic](https://github.com/anthropics/anthropic-sdk-python ) to permit the latest version.
- [Release notes](https://github.com/anthropics/anthropic-sdk-python/releases )
- [Changelog](https://github.com/anthropics/anthropic-sdk-python/blob/main/CHANGELOG.md )
- [Commits](https://github.com/anthropics/anthropic-sdk-python/compare/v0.105.2...v0.109.1 )
---
updated-dependencies:
- dependency-name: anthropic
dependency-version: 0.107.1
dependency-type: direct:production
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-10 18:17:53 -04:00
dependabot[bot]
6af5312409
Update boto3 requirement in /lambdas/wo/web_ui ( #54 )
...
Updates the requirements on [boto3](https://github.com/boto/boto3 ) to permit the latest version.
- [Release notes](https://github.com/boto/boto3/releases )
- [Commits](https://github.com/boto/boto3/compare/1.43.23...1.43.25 )
---
updated-dependencies:
- dependency-name: boto3
dependency-version: 1.43.25
dependency-type: direct:production
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-10 18:14:13 -04:00
dependabot[bot]
8da6fd07cd
Update boto3 requirement in /lambdas/po/email_processor ( #52 )
...
Updates the requirements on [boto3](https://github.com/boto/boto3 ) to permit the latest version.
- [Release notes](https://github.com/boto/boto3/releases )
- [Commits](https://github.com/boto/boto3/compare/1.43.23...1.43.25 )
---
updated-dependencies:
- dependency-name: boto3
dependency-version: 1.43.25
dependency-type: direct:production
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-10 18:14:06 -04:00
dependabot[bot]
d0dcfb51fc
Update boto3 requirement in /lambdas/wo/email_processor ( #51 )
...
Updates the requirements on [boto3](https://github.com/boto/boto3 ) to permit the latest version.
- [Release notes](https://github.com/boto/boto3/releases )
- [Commits](https://github.com/boto/boto3/compare/1.43.23...1.43.25 )
---
updated-dependencies:
- dependency-name: boto3
dependency-version: 1.43.25
dependency-type: direct:production
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-10 18:14:01 -04:00
dependabot[bot]
dedbbda7a1
Update boto3 requirement in /lambdas/wo/web_ui ( #46 )
...
Deploy / deploy (push) Has been cancelled
Updates the requirements on [boto3](https://github.com/boto/boto3 ) to permit the latest version.
- [Release notes](https://github.com/boto/boto3/releases )
- [Commits](https://github.com/boto/boto3/compare/1.43.22...1.43.23 )
---
updated-dependencies:
- dependency-name: boto3
dependency-version: 1.43.23
dependency-type: direct:production
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Adam Moussa <166072409+amoussa1229@users.noreply.github.com>
2026-06-08 22:37:44 +00:00
dependabot[bot]
d26714c6e5
Update boto3 requirement in /lambdas/po/email_processor ( #45 )
...
Updates the requirements on [boto3](https://github.com/boto/boto3 ) to permit the latest version.
- [Release notes](https://github.com/boto/boto3/releases )
- [Commits](https://github.com/boto/boto3/compare/1.43.22...1.43.23 )
---
updated-dependencies:
- dependency-name: boto3
dependency-version: 1.43.23
dependency-type: direct:production
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Adam Moussa <166072409+amoussa1229@users.noreply.github.com>
2026-06-08 22:35:51 +00:00
dependabot[bot]
7b3b01ec05
Update boto3 requirement in /lambdas/wo/email_processor ( #44 )
...
Updates the requirements on [boto3](https://github.com/boto/boto3 ) to permit the latest version.
- [Release notes](https://github.com/boto/boto3/releases )
- [Commits](https://github.com/boto/boto3/compare/1.43.10...1.43.23 )
---
updated-dependencies:
- dependency-name: boto3
dependency-version: 1.43.23
dependency-type: direct:production
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Adam Moussa <166072409+amoussa1229@users.noreply.github.com>
2026-06-08 22:33:01 +00:00
Adam Moussa
109c565cbf
Reconcile IaC with out-of-band DLQ + Function URL changes (INFRA-74, INFRA-41) ( #50 )
...
Deploy / deploy (push) Waiting to run
Make CDK the source of truth for two sets of changes applied out-of-band
via CLI to the po-ingest and WorkorderIngestStack stacks.
INFRA-74 (audit C-5): remove the public FunctionUrlAuthType.NONE Function
URL construct (and its auto-generated Principal:* invoke permission +
output) from both po-web-ui and workorder-web-ui. The URLs were already
deleted live via CLI; CFN's delete is idempotent.
INFRA-41 (audit H-8): add a CDK-managed SQS dead-letter queue
(dead_letter_queue=, 14d retention, SSL-enforced, CDK-generated name) and
an ALARM-only Errors alarm (Sum, threshold>0, site-alerts topic) for both
po-email-processor and workorder-email-processor, mirroring the
apm-wo-analysis-classifier DLQ and payments-payroll-batch alarm patterns.
Interim CLI resources (per-fn -dlq queues, -errors alarms, dlq-send inline
policies, OnFailure event-invoke-configs) removed post-deploy.
2026-06-08 16:02:29 -04:00
Adam Moussa
bd0682661f
Document purchase-orders table ownership (INFRA-1) ( #49 )
...
Deploy / deploy (push) Has been cancelled
Add a Shared Resources section recording that this stack owns the
purchase-orders DynamoDB table and is the authoritative writer, with
payments-dashboard and seahaven-slack-bot as read-only consumers.
Note the cross-repo schema-coordination rule and the amazon-po-parser
direct-write exception being folded in under INFRA-51.
2026-06-05 17:26:22 -04:00
dependabot[bot]
64ff6f09ca
Bump aws-cdk-lib in /cdk in the minor-and-patch group ( #48 )
...
Deploy / deploy (push) Waiting to run
Bumps the minor-and-patch group in /cdk with 1 update: [aws-cdk-lib](https://github.com/aws/aws-cdk ).
Updates `aws-cdk-lib` from 2.257.0 to 2.258.0
- [Release notes](https://github.com/aws/aws-cdk/releases )
- [Changelog](https://github.com/aws/aws-cdk/blob/main/CHANGELOG.v2.alpha.md )
- [Commits](https://github.com/aws/aws-cdk/compare/v2.257.0...v2.258.0 )
---
updated-dependencies:
- dependency-name: aws-cdk-lib
dependency-version: 2.258.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: minor-and-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-05 14:49:27 -04:00
Adam Moussa
c0b68382c8
chore(deps): remove blanket aws-cdk-lib dependabot ignore ( #47 )
...
Per handbook Pinning Principle: exact pins are kept current by Dependabot version updates gated by CI + dependency review. Blanket ignores let pins rot (see today's fast-uri incident).
2026-06-05 13:57:53 -04:00
Adam Moussa
7732069a73
fix(deps): pin aws-cdk-lib to ==2.257.0 ( #43 )
...
Deploy / deploy (push) Waiting to run
* fix(deps): re-pin aws-cdk-lib to ==2.253.1
* fix(deps): pin aws-cdk-lib to 2.257.0 (exact)
2026-06-05 13:22:45 -04:00
Adam Moussa
fb7a355607
Add dependency-review caller workflow ( #42 )
...
* Add dependency-review caller workflow
Add a pull_request-triggered caller that invokes the org-level
callable-dependency-review workflow to scan dependency changes and
fail on high-severity advisories.
* chore: retrigger checks
* chore: retrigger dep review (post-fix)
2026-06-05 12:26:49 -04:00
dependabot[bot]
e47cd7685e
Update boto3 requirement in /lambdas/po/email_processor ( #39 )
...
Deploy / deploy (push) Has been cancelled
Updates the requirements on [boto3](https://github.com/boto/boto3 ) to permit the latest version.
- [Release notes](https://github.com/boto/boto3/releases )
- [Commits](https://github.com/boto/boto3/compare/1.43.10...1.43.22 )
---
updated-dependencies:
- dependency-name: boto3
dependency-version: 1.43.22
dependency-type: direct:production
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-03 22:52:38 +00:00
dependabot[bot]
d145178c8d
Update boto3 requirement in /lambdas/wo/web_ui ( #41 )
...
Updates the requirements on [boto3](https://github.com/boto/boto3 ) to permit the latest version.
- [Release notes](https://github.com/boto/boto3/releases )
- [Commits](https://github.com/boto/boto3/compare/1.43.10...1.43.22 )
---
updated-dependencies:
- dependency-name: boto3
dependency-version: 1.43.22
dependency-type: direct:production
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-03 22:51:28 +00:00
dependabot[bot]
53e906bf56
Update anthropic requirement in /lambdas/wo/email_processor ( #38 )
...
Updates the requirements on [anthropic](https://github.com/anthropics/anthropic-sdk-python ) to permit the latest version.
- [Release notes](https://github.com/anthropics/anthropic-sdk-python/releases )
- [Changelog](https://github.com/anthropics/anthropic-sdk-python/blob/main/CHANGELOG.md )
- [Commits](https://github.com/anthropics/anthropic-sdk-python/compare/v0.103.1...v0.105.2 )
---
updated-dependencies:
- dependency-name: anthropic
dependency-version: 0.105.2
dependency-type: direct:production
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-03 22:49:37 +00:00
dependabot[bot]
3481a7a8d5
Update anthropic requirement in /lambdas/po/email_processor ( #37 )
...
Updates the requirements on [anthropic](https://github.com/anthropics/anthropic-sdk-python ) to permit the latest version.
- [Release notes](https://github.com/anthropics/anthropic-sdk-python/releases )
- [Changelog](https://github.com/anthropics/anthropic-sdk-python/blob/main/CHANGELOG.md )
- [Commits](https://github.com/anthropics/anthropic-sdk-python/compare/v0.103.1...v0.105.2 )
---
updated-dependencies:
- dependency-name: anthropic
dependency-version: 0.105.2
dependency-type: direct:production
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-03 22:49:20 +00:00
dependabot[bot]
ad17cac484
Update aws-cdk-lib requirement from >=2.255.0 to >=2.257.0 in /cdk ( #36 )
...
Updates the requirements on [aws-cdk-lib](https://github.com/aws/aws-cdk ) to permit the latest version.
- [Release notes](https://github.com/aws/aws-cdk/releases )
- [Changelog](https://github.com/aws/aws-cdk/blob/main/CHANGELOG.v2.alpha.md )
- [Commits](https://github.com/aws/aws-cdk/compare/v2.255.0...v2.257.0 )
---
updated-dependencies:
- dependency-name: aws-cdk-lib
dependency-version: 2.257.0
dependency-type: direct:production
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-03 22:48:09 +00:00
Adam Moussa
9370abf9ab
Drop three read-idle GSIs (audit M-20) ( #35 )
...
Deploy / deploy (push) Waiting to run
* Drop read-idle GSIs: by-state and status-index
Audit M-20: 30 days of CloudWatch metrics show 0 reads on both
indexes against 518 (by-state) and ~50k (status-index) WCU of write
amplification. No code path queries either index.
site-code-index follows in the next commit - CloudFormation allows
only one GSI change per table per deploy.
* Drop read-idle site-code-index GSI
Second half of the M-20 cleanup - deployed separately because
CloudFormation allows one GSI change per table per update.
2026-06-03 15:32:23 -04:00
Adam Moussa
a5d2bee748
Fix po-email-processor bundling for arm64 target ( #34 )
...
po-email-processor has been down since 2026-05-12: the bundling
command installed wheels for the build host's architecture, so CD
deploys from amd64 runners shipped x86_64 pydantic_core into an
ARM_64 function, crashing every INIT with Runtime.ImportModuleError.
Pin the pip platform to manylinux2014_aarch64 with --only-binary,
matching the pattern wo_stack already uses.
Verified live: deployed from branch, manual invoke OK; 920 emails
from the outage window backfilled via scripts/reprocess logic.
2026-06-03 14:56:02 -04:00
dependabot[bot]
dfd2a77126
Update boto3 requirement in /lambdas/wo/email_processor ( #33 )
...
Deploy / deploy (push) Has been cancelled
Updates the requirements on [boto3](https://github.com/boto/boto3 ) to permit the latest version.
- [Release notes](https://github.com/boto/boto3/releases )
- [Commits](https://github.com/boto/boto3/compare/1.43.6...1.43.10 )
---
updated-dependencies:
- dependency-name: boto3
dependency-version: 1.43.10
dependency-type: direct:production
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-05-19 19:24:01 +00:00
dependabot[bot]
49ecf29631
Update anthropic requirement in /lambdas/po/email_processor ( #29 )
...
Updates the requirements on [anthropic](https://github.com/anthropics/anthropic-sdk-python ) to permit the latest version.
- [Release notes](https://github.com/anthropics/anthropic-sdk-python/releases )
- [Changelog](https://github.com/anthropics/anthropic-sdk-python/blob/main/CHANGELOG.md )
- [Commits](https://github.com/anthropics/anthropic-sdk-python/compare/v0.101.0...v0.103.1 )
---
updated-dependencies:
- dependency-name: anthropic
dependency-version: 0.103.1
dependency-type: direct:production
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-05-19 19:23:37 +00:00
dependabot[bot]
73838c7da9
Update boto3 requirement in /lambdas/po/email_processor ( #32 )
...
Updates the requirements on [boto3](https://github.com/boto/boto3 ) to permit the latest version.
- [Release notes](https://github.com/boto/boto3/releases )
- [Commits](https://github.com/boto/boto3/compare/1.43.6...1.43.10 )
---
updated-dependencies:
- dependency-name: boto3
dependency-version: 1.43.10
dependency-type: direct:production
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-05-19 19:21:23 +00:00
dependabot[bot]
dc3355b7a8
Update boto3 requirement in /lambdas/wo/web_ui ( #31 )
...
Updates the requirements on [boto3](https://github.com/boto/boto3 ) to permit the latest version.
- [Release notes](https://github.com/boto/boto3/releases )
- [Commits](https://github.com/boto/boto3/compare/1.43.6...1.43.10 )
---
updated-dependencies:
- dependency-name: boto3
dependency-version: 1.43.10
dependency-type: direct:production
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-05-19 19:21:02 +00:00
dependabot[bot]
51f4272b0e
Update anthropic requirement in /lambdas/wo/email_processor ( #30 )
...
Updates the requirements on [anthropic](https://github.com/anthropics/anthropic-sdk-python ) to permit the latest version.
- [Release notes](https://github.com/anthropics/anthropic-sdk-python/releases )
- [Changelog](https://github.com/anthropics/anthropic-sdk-python/blob/main/CHANGELOG.md )
- [Commits](https://github.com/anthropics/anthropic-sdk-python/compare/v0.101.0...v0.103.1 )
---
updated-dependencies:
- dependency-name: anthropic
dependency-version: 0.103.1
dependency-type: direct:production
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-05-19 19:20:53 +00:00
dependabot[bot]
d233488875
Update aws-cdk-lib requirement from >=2.253.1 to >=2.255.0 in /cdk ( #28 )
...
Updates the requirements on [aws-cdk-lib](https://github.com/aws/aws-cdk ) to permit the latest version.
- [Release notes](https://github.com/aws/aws-cdk/releases )
- [Changelog](https://github.com/aws/aws-cdk/blob/main/CHANGELOG.v2.alpha.md )
- [Commits](https://github.com/aws/aws-cdk/compare/v2.253.1...v2.255.0 )
---
updated-dependencies:
- dependency-name: aws-cdk-lib
dependency-version: 2.255.0
dependency-type: direct:production
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-05-19 19:20:42 +00:00
dependabot[bot]
cb2af81615
Update anthropic requirement in /lambdas/wo/email_processor ( #27 )
...
Deploy / deploy (push) Has been cancelled
Updates the requirements on [anthropic](https://github.com/anthropics/anthropic-sdk-python ) to permit the latest version.
- [Release notes](https://github.com/anthropics/anthropic-sdk-python/releases )
- [Changelog](https://github.com/anthropics/anthropic-sdk-python/blob/main/CHANGELOG.md )
- [Commits](https://github.com/anthropics/anthropic-sdk-python/compare/v0.42.0...v0.101.0 )
---
updated-dependencies:
- dependency-name: anthropic
dependency-version: 0.101.0
dependency-type: direct:production
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-05-12 19:26:04 +00:00
dependabot[bot]
b7dd722de6
Update boto3 requirement from >=1.35.0 to >=1.43.6 in /lambdas/wo/web_ui ( #25 )
...
Updates the requirements on [boto3](https://github.com/boto/boto3 ) to permit the latest version.
- [Release notes](https://github.com/boto/boto3/releases )
- [Commits](https://github.com/boto/boto3/compare/1.35.0...1.43.6 )
---
updated-dependencies:
- dependency-name: boto3
dependency-version: 1.43.6
dependency-type: direct:production
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-05-12 19:23:39 +00:00
dependabot[bot]
3c9f845a32
Update boto3 requirement in /lambdas/wo/email_processor ( #26 )
...
Updates the requirements on [boto3](https://github.com/boto/boto3 ) to permit the latest version.
- [Release notes](https://github.com/boto/boto3/releases )
- [Commits](https://github.com/boto/boto3/compare/1.35.0...1.43.6 )
---
updated-dependencies:
- dependency-name: boto3
dependency-version: 1.43.6
dependency-type: direct:production
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-05-12 19:23:36 +00:00
Adam Moussa
5112c1345b
Merge workorder-ingest into unified procurement repo ( #22 )
...
* Merge workorder-ingest pipeline into unified repo
Move PO lambdas under lambdas/po/, add WO pipeline under lambdas/wo/.
Two independent CloudFormation stacks in one CDK app. Fix WO stack
compliance: ARM64 architecture, 60-day log retention, aarch64 bundling,
RETAIN on Anthropic secret. Remove stale CodePipeline buildspec.
* Fix test_local.py import path and remove dead shared/models.py
test_local.py referenced the old lambdas/email_processor path. Updated
to lambdas/wo/email_processor. Removed shared/ directory entirely as
nothing imports from it.
* Escape HTML in both web UI dashboards to prevent XSS
Both Function URLs are public (auth_type=NONE) and render
email-derived content via f-strings. Attacker-crafted emails
could inject scripts. Added html.escape() on all interpolated
values in both PO and WO dashboards.
* Add pagination to WO web UI scan
get_work_orders() only fetched the first 1MB page from DynamoDB.
Loop on LastEvaluatedKey to match the PO web UI pattern.
* Fix esc(None) TypeError and javascript: scheme in PO web UI
Coerce supplier name through `or ""` before escaping to handle
nested None from DynamoDB. Add scheme allowlist on view_order_url
to block javascript:/data: hrefs from LLM-extracted URLs.
* Fix WO render_badge None guard, updated_at slice, and backfill path
Add null guard to WO render_badge matching the PO version. Use
`or ""` before slicing updated_at to handle explicit None values.
Fix backfill_sites.py sys.path to use new lambdas/po/site_extractor.
* Harden WO web UI and fix JS-context XSS in both dashboards
- Use json.dumps for onclick URLs to prevent JS string breakout
- Add .lower() to WO render_badge color lookup matching PO pattern
- Add pagination to get_comments query
- Cap get_work_orders to 500 results matching PO pattern
* Apply ruff formatting to web UI handlers
2026-05-12 15:21:06 -04:00
dependabot[bot]
c0b276f2bc
Update anthropic requirement in /lambdas/email_processor ( #21 )
...
Updates the requirements on [anthropic](https://github.com/anthropics/anthropic-sdk-python ) to permit the latest version.
- [Release notes](https://github.com/anthropics/anthropic-sdk-python/releases )
- [Changelog](https://github.com/anthropics/anthropic-sdk-python/blob/main/CHANGELOG.md )
- [Commits](https://github.com/anthropics/anthropic-sdk-python/compare/v0.100.0...v0.101.0 )
---
updated-dependencies:
- dependency-name: anthropic
dependency-version: 0.101.0
dependency-type: direct:production
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-05-12 11:46:32 +00:00
dependabot[bot]
e7022d0772
Update boto3 requirement in /lambdas/email_processor ( #17 )
...
Updates the requirements on [boto3](https://github.com/boto/boto3 ) to permit the latest version.
- [Release notes](https://github.com/boto/boto3/releases )
- [Commits](https://github.com/boto/boto3/compare/1.43.3...1.43.6 )
---
updated-dependencies:
- dependency-name: boto3
dependency-version: 1.43.6
dependency-type: direct:production
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-05-08 22:27:31 +00:00
dependabot[bot]
429611030e
Update aws-cdk-lib requirement from >=2.252.0 to >=2.253.1 in /cdk ( #16 )
...
Updates the requirements on [aws-cdk-lib](https://github.com/aws/aws-cdk ) to permit the latest version.
- [Release notes](https://github.com/aws/aws-cdk/releases )
- [Changelog](https://github.com/aws/aws-cdk/blob/v2.253.1/CHANGELOG.v2.alpha.md )
- [Commits](https://github.com/aws/aws-cdk/compare/v2.252.0...v2.253.1 )
---
updated-dependencies:
- dependency-name: aws-cdk-lib
dependency-version: 2.253.1
dependency-type: direct:production
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-05-08 22:27:13 +00:00
Adam Moussa
12c9759fe5
Add GitHub Actions deploy workflow ( #19 )
...
* Add GitHub Actions deploy workflow (OIDC)
* Add permissions block for OIDC token exchange
* Add concurrency control to prevent parallel deploys
2026-05-08 17:08:27 -04:00
Adam Moussa
abdf2aa035
Add CI workflow ( #18 )
...
* Add CI workflow and apply ruff formatting
* Disable cdk synth — email_processor uses pre-built package dir
The email_processor Lambda bundles deps into a gitignored package/
directory. cdk synth fails in CI without a build step to recreate it.
Disabling until packaging is standardized.
* Use CDK BundlingOptions for email_processor Lambda packaging
Replaces the pre-built gitignored package/ directory with CDK's
built-in bundling. Deps are now installed inside a Docker container
during cdk synth, so the build works identically locally and in CI.
Re-enables run-cdk-synth in the CI workflow.
2026-05-08 16:01:21 -04:00
Adam Moussa
d1c1cb2f8b
Update Dependabot: remove assignees, group minor/patch updates ( #15 )
2026-05-08 14:24:21 -04:00
