adam/procurement-ingest
1
0
Fork 0
mirror of https://github.com/Sea-Haven-Industries/procurement-ingest.git synced 2026-09-30 07:13:13 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions
65 commits 6 branches 0 tags 6.7 MiB
Commit graph

65 commits

This branch
This branch
All branches
Author SHA1 Message Date
Adam Moussa
47fa35688d
fix(po): grant KMS on seahaven-dynamodb CMK to purchase-orders consumers (INFRA-104) (#56)
Some checks are pending
Deploy / deploy (push) Waiting to run
Details 
The purchase-orders table was migrated to SSE-KMS (alias/seahaven-dynamodb,
INFRA-95/M-3) out-of-band, but po_stack never declared the key, so
grant_read_write_data did not propagate kms perms. po-email-processor failed
~99.6% of invocations with kms:Decrypt AccessDeniedException, a data-loss
outage on the PO ingestion write path.

- po_stack: declare encryption_key on purchase-orders (reconciles SSE drift;
  no-op against the already-encrypted live table) so the existing grants add
  kms:Decrypt/GenerateDataKey/DescribeKey to EmailProcessor, WebUI, SiteExtractor.
- wo_stack: pre-emptive grant_encrypt_decrypt on the WO processor role ahead of
  the WorkOrders CMK migration (INFRA-6); tables left unencrypted, no table change.

GPT-4.1 cross-review: no blockers.
 2026-06-10 19:31:55 -04:00
dependabot[bot]
d217caac13
Update anthropic requirement in /lambdas/wo/email_processor (#53)
Some checks are pending
Deploy / deploy (push) Waiting to run
Details 
Updates the requirements on [anthropic](https://github.com/anthropics/anthropic-sdk-python) to permit the latest version.
- [Release notes](https://github.com/anthropics/anthropic-sdk-python/releases)
- [Changelog](https://github.com/anthropics/anthropic-sdk-python/blob/main/CHANGELOG.md)
- [Commits](https://github.com/anthropics/anthropic-sdk-python/compare/v0.105.2...v0.109.1)

---
updated-dependencies:
- dependency-name: anthropic
  dependency-version: 0.107.1
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Adam Moussa <166072409+amoussa1229@users.noreply.github.com>
 2026-06-10 22:21:45 +00:00
dependabot[bot]
910959be7a
Update anthropic requirement in /lambdas/po/email_processor (#55) 
Updates the requirements on [anthropic](https://github.com/anthropics/anthropic-sdk-python) to permit the latest version.
- [Release notes](https://github.com/anthropics/anthropic-sdk-python/releases)
- [Changelog](https://github.com/anthropics/anthropic-sdk-python/blob/main/CHANGELOG.md)
- [Commits](https://github.com/anthropics/anthropic-sdk-python/compare/v0.105.2...v0.109.1)

---
updated-dependencies:
- dependency-name: anthropic
  dependency-version: 0.107.1
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-10 18:17:53 -04:00
dependabot[bot]
6af5312409
Update boto3 requirement in /lambdas/wo/web_ui (#54) 
Updates the requirements on [boto3](https://github.com/boto/boto3) to permit the latest version.
- [Release notes](https://github.com/boto/boto3/releases)
- [Commits](https://github.com/boto/boto3/compare/1.43.23...1.43.25)

---
updated-dependencies:
- dependency-name: boto3
  dependency-version: 1.43.25
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-10 18:14:13 -04:00
dependabot[bot]
8da6fd07cd
Update boto3 requirement in /lambdas/po/email_processor (#52) 
Updates the requirements on [boto3](https://github.com/boto/boto3) to permit the latest version.
- [Release notes](https://github.com/boto/boto3/releases)
- [Commits](https://github.com/boto/boto3/compare/1.43.23...1.43.25)

---
updated-dependencies:
- dependency-name: boto3
  dependency-version: 1.43.25
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-10 18:14:06 -04:00
dependabot[bot]
d0dcfb51fc
Update boto3 requirement in /lambdas/wo/email_processor (#51) 
Updates the requirements on [boto3](https://github.com/boto/boto3) to permit the latest version.
- [Release notes](https://github.com/boto/boto3/releases)
- [Commits](https://github.com/boto/boto3/compare/1.43.23...1.43.25)

---
updated-dependencies:
- dependency-name: boto3
  dependency-version: 1.43.25
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-10 18:14:01 -04:00
dependabot[bot]
dedbbda7a1
Update boto3 requirement in /lambdas/wo/web_ui (#46)
Some checks failed
Deploy / deploy (push) Has been cancelled
Details 
Updates the requirements on [boto3](https://github.com/boto/boto3) to permit the latest version.
- [Release notes](https://github.com/boto/boto3/releases)
- [Commits](https://github.com/boto/boto3/compare/1.43.22...1.43.23)

---
updated-dependencies:
- dependency-name: boto3
  dependency-version: 1.43.23
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Adam Moussa <166072409+amoussa1229@users.noreply.github.com>
 2026-06-08 22:37:44 +00:00
dependabot[bot]
d26714c6e5
Update boto3 requirement in /lambdas/po/email_processor (#45) 
Updates the requirements on [boto3](https://github.com/boto/boto3) to permit the latest version.
- [Release notes](https://github.com/boto/boto3/releases)
- [Commits](https://github.com/boto/boto3/compare/1.43.22...1.43.23)

---
updated-dependencies:
- dependency-name: boto3
  dependency-version: 1.43.23
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Adam Moussa <166072409+amoussa1229@users.noreply.github.com>
 2026-06-08 22:35:51 +00:00
dependabot[bot]
7b3b01ec05
Update boto3 requirement in /lambdas/wo/email_processor (#44) 
Updates the requirements on [boto3](https://github.com/boto/boto3) to permit the latest version.
- [Release notes](https://github.com/boto/boto3/releases)
- [Commits](https://github.com/boto/boto3/compare/1.43.10...1.43.23)

---
updated-dependencies:
- dependency-name: boto3
  dependency-version: 1.43.23
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Adam Moussa <166072409+amoussa1229@users.noreply.github.com>
 2026-06-08 22:33:01 +00:00
Adam Moussa
109c565cbf
Reconcile IaC with out-of-band DLQ + Function URL changes (INFRA-74, INFRA-41) (#50)
Some checks are pending
Deploy / deploy (push) Waiting to run
Details 
Make CDK the source of truth for two sets of changes applied out-of-band
via CLI to the po-ingest and WorkorderIngestStack stacks.

INFRA-74 (audit C-5): remove the public FunctionUrlAuthType.NONE Function
URL construct (and its auto-generated Principal:* invoke permission +
output) from both po-web-ui and workorder-web-ui. The URLs were already
deleted live via CLI; CFN's delete is idempotent.

INFRA-41 (audit H-8): add a CDK-managed SQS dead-letter queue
(dead_letter_queue=, 14d retention, SSL-enforced, CDK-generated name) and
an ALARM-only Errors alarm (Sum, threshold>0, site-alerts topic) for both
po-email-processor and workorder-email-processor, mirroring the
apm-wo-analysis-classifier DLQ and payments-payroll-batch alarm patterns.

Interim CLI resources (per-fn -dlq queues, -errors alarms, dlq-send inline
policies, OnFailure event-invoke-configs) removed post-deploy.
 2026-06-08 16:02:29 -04:00
Adam Moussa
bd0682661f
Document purchase-orders table ownership (INFRA-1) (#49)
Some checks failed
Deploy / deploy (push) Has been cancelled
Details 
Add a Shared Resources section recording that this stack owns the
purchase-orders DynamoDB table and is the authoritative writer, with
payments-dashboard and seahaven-slack-bot as read-only consumers.
Note the cross-repo schema-coordination rule and the amazon-po-parser
direct-write exception being folded in under INFRA-51.
 2026-06-05 17:26:22 -04:00
dependabot[bot]
64ff6f09ca
Bump aws-cdk-lib in /cdk in the minor-and-patch group (#48)
Some checks are pending
Deploy / deploy (push) Waiting to run
Details 
Bumps the minor-and-patch group in /cdk with 1 update: [aws-cdk-lib](https://github.com/aws/aws-cdk).


Updates `aws-cdk-lib` from 2.257.0 to 2.258.0
- [Release notes](https://github.com/aws/aws-cdk/releases)
- [Changelog](https://github.com/aws/aws-cdk/blob/main/CHANGELOG.v2.alpha.md)
- [Commits](https://github.com/aws/aws-cdk/compare/v2.257.0...v2.258.0)

---
updated-dependencies:
- dependency-name: aws-cdk-lib
  dependency-version: 2.258.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-05 14:49:27 -04:00
Adam Moussa
c0b68382c8
chore(deps): remove blanket aws-cdk-lib dependabot ignore (#47) 
Per handbook Pinning Principle: exact pins are kept current by Dependabot version updates gated by CI + dependency review. Blanket ignores let pins rot (see today's fast-uri incident).
 2026-06-05 13:57:53 -04:00
Adam Moussa
7732069a73
fix(deps): pin aws-cdk-lib to ==2.257.0 (#43)
Some checks are pending
Deploy / deploy (push) Waiting to run
Details 
* fix(deps): re-pin aws-cdk-lib to ==2.253.1

* fix(deps): pin aws-cdk-lib to 2.257.0 (exact)
 2026-06-05 13:22:45 -04:00
Adam Moussa
fb7a355607
Add dependency-review caller workflow (#42) 
* Add dependency-review caller workflow

Add a pull_request-triggered caller that invokes the org-level
callable-dependency-review workflow to scan dependency changes and
fail on high-severity advisories.

* chore: retrigger checks

* chore: retrigger dep review (post-fix)
 2026-06-05 12:26:49 -04:00
dependabot[bot]
e47cd7685e
Update boto3 requirement in /lambdas/po/email_processor (#39)
Some checks failed
Deploy / deploy (push) Has been cancelled
Details 
Updates the requirements on [boto3](https://github.com/boto/boto3) to permit the latest version.
- [Release notes](https://github.com/boto/boto3/releases)
- [Commits](https://github.com/boto/boto3/compare/1.43.10...1.43.22)

---
updated-dependencies:
- dependency-name: boto3
  dependency-version: 1.43.22
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-03 22:52:38 +00:00
dependabot[bot]
d145178c8d
Update boto3 requirement in /lambdas/wo/web_ui (#41) 
Updates the requirements on [boto3](https://github.com/boto/boto3) to permit the latest version.
- [Release notes](https://github.com/boto/boto3/releases)
- [Commits](https://github.com/boto/boto3/compare/1.43.10...1.43.22)

---
updated-dependencies:
- dependency-name: boto3
  dependency-version: 1.43.22
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-03 22:51:28 +00:00
dependabot[bot]
53e906bf56
Update anthropic requirement in /lambdas/wo/email_processor (#38) 
Updates the requirements on [anthropic](https://github.com/anthropics/anthropic-sdk-python) to permit the latest version.
- [Release notes](https://github.com/anthropics/anthropic-sdk-python/releases)
- [Changelog](https://github.com/anthropics/anthropic-sdk-python/blob/main/CHANGELOG.md)
- [Commits](https://github.com/anthropics/anthropic-sdk-python/compare/v0.103.1...v0.105.2)

---
updated-dependencies:
- dependency-name: anthropic
  dependency-version: 0.105.2
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-03 22:49:37 +00:00
dependabot[bot]
3481a7a8d5
Update anthropic requirement in /lambdas/po/email_processor (#37) 
Updates the requirements on [anthropic](https://github.com/anthropics/anthropic-sdk-python) to permit the latest version.
- [Release notes](https://github.com/anthropics/anthropic-sdk-python/releases)
- [Changelog](https://github.com/anthropics/anthropic-sdk-python/blob/main/CHANGELOG.md)
- [Commits](https://github.com/anthropics/anthropic-sdk-python/compare/v0.103.1...v0.105.2)

---
updated-dependencies:
- dependency-name: anthropic
  dependency-version: 0.105.2
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-03 22:49:20 +00:00
dependabot[bot]
ad17cac484
Update aws-cdk-lib requirement from >=2.255.0 to >=2.257.0 in /cdk (#36) 
Updates the requirements on [aws-cdk-lib](https://github.com/aws/aws-cdk) to permit the latest version.
- [Release notes](https://github.com/aws/aws-cdk/releases)
- [Changelog](https://github.com/aws/aws-cdk/blob/main/CHANGELOG.v2.alpha.md)
- [Commits](https://github.com/aws/aws-cdk/compare/v2.255.0...v2.257.0)

---
updated-dependencies:
- dependency-name: aws-cdk-lib
  dependency-version: 2.257.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-03 22:48:09 +00:00
Adam Moussa
9370abf9ab
Drop three read-idle GSIs (audit M-20) (#35)
Some checks are pending
Deploy / deploy (push) Waiting to run
Details 
* Drop read-idle GSIs: by-state and status-index

Audit M-20: 30 days of CloudWatch metrics show 0 reads on both
indexes against 518 (by-state) and ~50k (status-index) WCU of write
amplification. No code path queries either index.

site-code-index follows in the next commit - CloudFormation allows
only one GSI change per table per deploy.

* Drop read-idle site-code-index GSI

Second half of the M-20 cleanup - deployed separately because
CloudFormation allows one GSI change per table per update.
 2026-06-03 15:32:23 -04:00
Adam Moussa
a5d2bee748
Fix po-email-processor bundling for arm64 target (#34) 
po-email-processor has been down since 2026-05-12: the bundling
command installed wheels for the build host's architecture, so CD
deploys from amd64 runners shipped x86_64 pydantic_core into an
ARM_64 function, crashing every INIT with Runtime.ImportModuleError.

Pin the pip platform to manylinux2014_aarch64 with --only-binary,
matching the pattern wo_stack already uses.

Verified live: deployed from branch, manual invoke OK; 920 emails
from the outage window backfilled via scripts/reprocess logic.
 2026-06-03 14:56:02 -04:00
dependabot[bot]
dfd2a77126
Update boto3 requirement in /lambdas/wo/email_processor (#33)
Some checks failed
Deploy / deploy (push) Has been cancelled
Details 
Updates the requirements on [boto3](https://github.com/boto/boto3) to permit the latest version.
- [Release notes](https://github.com/boto/boto3/releases)
- [Commits](https://github.com/boto/boto3/compare/1.43.6...1.43.10)

---
updated-dependencies:
- dependency-name: boto3
  dependency-version: 1.43.10
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-05-19 19:24:01 +00:00
dependabot[bot]
49ecf29631
Update anthropic requirement in /lambdas/po/email_processor (#29) 
Updates the requirements on [anthropic](https://github.com/anthropics/anthropic-sdk-python) to permit the latest version.
- [Release notes](https://github.com/anthropics/anthropic-sdk-python/releases)
- [Changelog](https://github.com/anthropics/anthropic-sdk-python/blob/main/CHANGELOG.md)
- [Commits](https://github.com/anthropics/anthropic-sdk-python/compare/v0.101.0...v0.103.1)

---
updated-dependencies:
- dependency-name: anthropic
  dependency-version: 0.103.1
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-05-19 19:23:37 +00:00
dependabot[bot]
73838c7da9
Update boto3 requirement in /lambdas/po/email_processor (#32) 
Updates the requirements on [boto3](https://github.com/boto/boto3) to permit the latest version.
- [Release notes](https://github.com/boto/boto3/releases)
- [Commits](https://github.com/boto/boto3/compare/1.43.6...1.43.10)

---
updated-dependencies:
- dependency-name: boto3
  dependency-version: 1.43.10
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-05-19 19:21:23 +00:00
dependabot[bot]
dc3355b7a8
Update boto3 requirement in /lambdas/wo/web_ui (#31) 
Updates the requirements on [boto3](https://github.com/boto/boto3) to permit the latest version.
- [Release notes](https://github.com/boto/boto3/releases)
- [Commits](https://github.com/boto/boto3/compare/1.43.6...1.43.10)

---
updated-dependencies:
- dependency-name: boto3
  dependency-version: 1.43.10
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-05-19 19:21:02 +00:00
dependabot[bot]
51f4272b0e
Update anthropic requirement in /lambdas/wo/email_processor (#30) 
Updates the requirements on [anthropic](https://github.com/anthropics/anthropic-sdk-python) to permit the latest version.
- [Release notes](https://github.com/anthropics/anthropic-sdk-python/releases)
- [Changelog](https://github.com/anthropics/anthropic-sdk-python/blob/main/CHANGELOG.md)
- [Commits](https://github.com/anthropics/anthropic-sdk-python/compare/v0.101.0...v0.103.1)

---
updated-dependencies:
- dependency-name: anthropic
  dependency-version: 0.103.1
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-05-19 19:20:53 +00:00
dependabot[bot]
d233488875
Update aws-cdk-lib requirement from >=2.253.1 to >=2.255.0 in /cdk (#28) 
Updates the requirements on [aws-cdk-lib](https://github.com/aws/aws-cdk) to permit the latest version.
- [Release notes](https://github.com/aws/aws-cdk/releases)
- [Changelog](https://github.com/aws/aws-cdk/blob/main/CHANGELOG.v2.alpha.md)
- [Commits](https://github.com/aws/aws-cdk/compare/v2.253.1...v2.255.0)

---
updated-dependencies:
- dependency-name: aws-cdk-lib
  dependency-version: 2.255.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-05-19 19:20:42 +00:00
dependabot[bot]
cb2af81615
Update anthropic requirement in /lambdas/wo/email_processor (#27)
Some checks failed
Deploy / deploy (push) Has been cancelled
Details 
Updates the requirements on [anthropic](https://github.com/anthropics/anthropic-sdk-python) to permit the latest version.
- [Release notes](https://github.com/anthropics/anthropic-sdk-python/releases)
- [Changelog](https://github.com/anthropics/anthropic-sdk-python/blob/main/CHANGELOG.md)
- [Commits](https://github.com/anthropics/anthropic-sdk-python/compare/v0.42.0...v0.101.0)

---
updated-dependencies:
- dependency-name: anthropic
  dependency-version: 0.101.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-05-12 19:26:04 +00:00
dependabot[bot]
b7dd722de6
Update boto3 requirement from >=1.35.0 to >=1.43.6 in /lambdas/wo/web_ui (#25) 
Updates the requirements on [boto3](https://github.com/boto/boto3) to permit the latest version.
- [Release notes](https://github.com/boto/boto3/releases)
- [Commits](https://github.com/boto/boto3/compare/1.35.0...1.43.6)

---
updated-dependencies:
- dependency-name: boto3
  dependency-version: 1.43.6
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-05-12 19:23:39 +00:00
dependabot[bot]
3c9f845a32
Update boto3 requirement in /lambdas/wo/email_processor (#26) 
Updates the requirements on [boto3](https://github.com/boto/boto3) to permit the latest version.
- [Release notes](https://github.com/boto/boto3/releases)
- [Commits](https://github.com/boto/boto3/compare/1.35.0...1.43.6)

---
updated-dependencies:
- dependency-name: boto3
  dependency-version: 1.43.6
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-05-12 19:23:36 +00:00
Adam Moussa
5112c1345b
Merge workorder-ingest into unified procurement repo (#22) 
* Merge workorder-ingest pipeline into unified repo

Move PO lambdas under lambdas/po/, add WO pipeline under lambdas/wo/.
Two independent CloudFormation stacks in one CDK app. Fix WO stack
compliance: ARM64 architecture, 60-day log retention, aarch64 bundling,
RETAIN on Anthropic secret. Remove stale CodePipeline buildspec.

* Fix test_local.py import path and remove dead shared/models.py

test_local.py referenced the old lambdas/email_processor path. Updated
to lambdas/wo/email_processor. Removed shared/ directory entirely as
nothing imports from it.

* Escape HTML in both web UI dashboards to prevent XSS

Both Function URLs are public (auth_type=NONE) and render
email-derived content via f-strings. Attacker-crafted emails
could inject scripts. Added html.escape() on all interpolated
values in both PO and WO dashboards.

* Add pagination to WO web UI scan

get_work_orders() only fetched the first 1MB page from DynamoDB.
Loop on LastEvaluatedKey to match the PO web UI pattern.

* Fix esc(None) TypeError and javascript: scheme in PO web UI

Coerce supplier name through `or ""` before escaping to handle
nested None from DynamoDB. Add scheme allowlist on view_order_url
to block javascript:/data: hrefs from LLM-extracted URLs.

* Fix WO render_badge None guard, updated_at slice, and backfill path

Add null guard to WO render_badge matching the PO version. Use
`or ""` before slicing updated_at to handle explicit None values.
Fix backfill_sites.py sys.path to use new lambdas/po/site_extractor.

* Harden WO web UI and fix JS-context XSS in both dashboards

- Use json.dumps for onclick URLs to prevent JS string breakout
- Add .lower() to WO render_badge color lookup matching PO pattern
- Add pagination to get_comments query
- Cap get_work_orders to 500 results matching PO pattern

* Apply ruff formatting to web UI handlers
 2026-05-12 15:21:06 -04:00
dependabot[bot]
c0b276f2bc
Update anthropic requirement in /lambdas/email_processor (#21) 
Updates the requirements on [anthropic](https://github.com/anthropics/anthropic-sdk-python) to permit the latest version.
- [Release notes](https://github.com/anthropics/anthropic-sdk-python/releases)
- [Changelog](https://github.com/anthropics/anthropic-sdk-python/blob/main/CHANGELOG.md)
- [Commits](https://github.com/anthropics/anthropic-sdk-python/compare/v0.100.0...v0.101.0)

---
updated-dependencies:
- dependency-name: anthropic
  dependency-version: 0.101.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-05-12 11:46:32 +00:00
dependabot[bot]
e7022d0772
Update boto3 requirement in /lambdas/email_processor (#17) 
Updates the requirements on [boto3](https://github.com/boto/boto3) to permit the latest version.
- [Release notes](https://github.com/boto/boto3/releases)
- [Commits](https://github.com/boto/boto3/compare/1.43.3...1.43.6)

---
updated-dependencies:
- dependency-name: boto3
  dependency-version: 1.43.6
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-05-08 22:27:31 +00:00
dependabot[bot]
429611030e
Update aws-cdk-lib requirement from >=2.252.0 to >=2.253.1 in /cdk (#16) 
Updates the requirements on [aws-cdk-lib](https://github.com/aws/aws-cdk) to permit the latest version.
- [Release notes](https://github.com/aws/aws-cdk/releases)
- [Changelog](https://github.com/aws/aws-cdk/blob/v2.253.1/CHANGELOG.v2.alpha.md)
- [Commits](https://github.com/aws/aws-cdk/compare/v2.252.0...v2.253.1)

---
updated-dependencies:
- dependency-name: aws-cdk-lib
  dependency-version: 2.253.1
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-05-08 22:27:13 +00:00
Adam Moussa
12c9759fe5
Add GitHub Actions deploy workflow (#19) 
* Add GitHub Actions deploy workflow (OIDC)

* Add permissions block for OIDC token exchange

* Add concurrency control to prevent parallel deploys
 2026-05-08 17:08:27 -04:00
Adam Moussa
abdf2aa035
Add CI workflow (#18) 
* Add CI workflow and apply ruff formatting

* Disable cdk synth — email_processor uses pre-built package dir

The email_processor Lambda bundles deps into a gitignored package/
directory. cdk synth fails in CI without a build step to recreate it.
Disabling until packaging is standardized.

* Use CDK BundlingOptions for email_processor Lambda packaging

Replaces the pre-built gitignored package/ directory with CDK's
built-in bundling. Deps are now installed inside a Docker container
during cdk synth, so the build works identically locally and in CI.
Re-enables run-cdk-synth in the CI workflow.
 2026-05-08 16:01:21 -04:00
Adam Moussa
d1c1cb2f8b
Update Dependabot: remove assignees, group minor/patch updates (#15) 2026-05-08 14:24:21 -04:00
Adam Moussa
84cd4e63a7
Remove wrapper workflow — using required workflow via org ruleset (#14) 2026-05-06 19:59:18 -04:00
dependabot[bot]
9e2ac362dc
Update anthropic requirement in /lambdas/email_processor (#12) 
Updates the requirements on [anthropic](https://github.com/anthropics/anthropic-sdk-python) to permit the latest version.
- [Release notes](https://github.com/anthropics/anthropic-sdk-python/releases)
- [Changelog](https://github.com/anthropics/anthropic-sdk-python/blob/main/CHANGELOG.md)
- [Commits](https://github.com/anthropics/anthropic-sdk-python/compare/v0.42.0...v0.100.0)

---
updated-dependencies:
- dependency-name: anthropic
  dependency-version: 0.98.1
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-05-06 18:23:55 -04:00
dependabot[bot]
7225f5c768
Update boto3 requirement in /lambdas/email_processor (#11) 
Updates the requirements on [boto3](https://github.com/boto/boto3) to permit the latest version.
- [Release notes](https://github.com/boto/boto3/releases)
- [Commits](https://github.com/boto/boto3/compare/1.43.2...1.43.3)

---
updated-dependencies:
- dependency-name: boto3
  dependency-version: 1.43.3
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-05-06 18:21:29 -04:00
Adam Moussa
f77568da3f
Add Claude Code review workflow (#13) 2026-05-06 18:11:45 -04:00
Adam Moussa
4a8816e85e
Merge pull request #10 from Sea-Haven-Industries/feature/dependabot-auto-assign 
Auto-assign Dependabot PRs
 2026-05-02 17:28:31 -04:00
Adam Moussa
18b3e082b8 Auto-assign Dependabot PRs to amoussa1229 2026-05-02 17:26:47 -04:00
Adam Moussa
46cf39e891
Merge pull request #9 from Sea-Haven-Industries/dependabot/pip/cdk/aws-cdk-lib-gte-2.252.0 
Update aws-cdk-lib requirement from >=2.150.0 to >=2.252.0 in /cdk
 2026-05-02 17:25:45 -04:00
dependabot[bot]
a7ca58d9d9
Update aws-cdk-lib requirement from >=2.150.0 to >=2.252.0 in /cdk 
Updates the requirements on [aws-cdk-lib](https://github.com/aws/aws-cdk) to permit the latest version.
- [Release notes](https://github.com/aws/aws-cdk/releases)
- [Changelog](https://github.com/aws/aws-cdk/blob/main/CHANGELOG.v2.alpha.md)
- [Commits](https://github.com/aws/aws-cdk/compare/v2.150.0...v2.252.0)

---
updated-dependencies:
- dependency-name: aws-cdk-lib
  dependency-version: 2.252.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-05-02 21:24:26 +00:00
Adam Moussa
b9c9e70080
Merge pull request #8 from Sea-Haven-Industries/dependabot/pip/lambdas/email_processor/boto3-gte-1.43.2 
Update boto3 requirement from >=1.35.0 to >=1.43.2 in /lambdas/email_processor
 2026-05-02 17:23:21 -04:00
Adam Moussa
4a49c187cf
Merge pull request #7 from Sea-Haven-Industries/dependabot/pip/cdk/constructs-gte-10.6.0 
Update constructs requirement from >=10.0.0 to >=10.6.0 in /cdk
 2026-05-02 17:23:17 -04:00
dependabot[bot]
636177ecfd
Update boto3 requirement in /lambdas/email_processor 
Updates the requirements on [boto3](https://github.com/boto/boto3) to permit the latest version.
- [Release notes](https://github.com/boto/boto3/releases)
- [Commits](https://github.com/boto/boto3/compare/1.35.0...1.43.2)

---
updated-dependencies:
- dependency-name: boto3
  dependency-version: 1.43.2
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-05-02 21:17:26 +00:00
dependabot[bot]
1832ce2853
Update constructs requirement from >=10.0.0 to >=10.6.0 in /cdk 
Updates the requirements on [constructs](https://github.com/aws/constructs) to permit the latest version.
- [Release notes](https://github.com/aws/constructs/releases)
- [Commits](https://github.com/aws/constructs/compare/v10.0.0...v10.6.0)

---
updated-dependencies:
- dependency-name: constructs
  dependency-version: 10.6.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-05-02 21:17:20 +00:00