renovate[bot]
39013e8a65
chore(deps): update sea-haven-industries/.github action to v1.0.8 ( #77 )
2026-08-25 15:42:11 +00:00
Adam Moussa
fe89bc6649
chore(ci): remove pr policy workflow caller ( #74 )
Deploy / deploy (push) Waiting to run
2026-08-24 15:12:36 -04:00
Adam Moussa
fd459b12b6
chore(ci): switch auto-merge from seahaven-bot to Mergify ( #73 )
Deploy / deploy (push) Waiting to run
2026-08-24 13:53:15 -04:00
Adam Moussa
a00730675a
ci: enable squash auto-merge on ready PRs (PLAT-108) ( #71 )
...
Deploy / deploy (push) Has been cancelled
* ci: enable squash auto-merge on ready PRs
* fix(ci): serialize auto-merge enable and ignore already-enabled
2026-08-21 23:34:40 +00:00
Adam Moussa
0929d2fb6c
ci: add merge_group trigger for required ci / ci ( #70 )
Deploy / deploy (push) Waiting to run
2026-08-21 17:42:31 -04:00
dependabot[bot]
fea155279a
chore(deps): bump the minor-and-patch group with 4 updates ( #68 )
...
Bumps the minor-and-patch group with 4 updates: [Sea-Haven-Industries/.github/.github/workflows/ci-typescript-cdk.yaml](https://github.com/sea-haven-industries/.github ), [Sea-Haven-Industries/.github/.github/workflows/callable-dependency-review.yaml](https://github.com/sea-haven-industries/.github ), [Sea-Haven-Industries/.github/.github/workflows/cd-cdk.yaml](https://github.com/sea-haven-industries/.github ) and [Sea-Haven-Industries/.github/.github/workflows/callable-labeler.yaml](https://github.com/sea-haven-industries/.github ).
Updates `Sea-Haven-Industries/.github/.github/workflows/ci-typescript-cdk.yaml` from 1.0.6 to 1.0.7
- [Release notes](https://github.com/sea-haven-industries/.github/releases )
- [Commits](7ac3528750...e5691d8a7fhttps://github.com/sea-haven-industries/.github/releases )
- [Commits](7ac3528750...e5691d8a7fhttps://github.com/sea-haven-industries/.github/releases )
- [Commits](7ac3528750...e5691d8a7fhttps://github.com/sea-haven-industries/.github/releases )
- [Commits](7ac3528750...e5691d8a7f
2026-08-18 13:14:22 -04:00
dependabot[bot]
d650b4b945
chore(deps): bump the minor-and-patch group ( #66 )
...
Deploy / deploy (push) Has been cancelled
Bumps the minor-and-patch group with 5 updates in the / directory:
| Package | From | To |
| --- | --- | --- |
| [Sea-Haven-Industries/.github/.github/workflows/ci-typescript-cdk.yaml](https://github.com/sea-haven-industries/.github ) | `1.0.3` | `1.0.6` |
| [Sea-Haven-Industries/.github/.github/workflows/callable-dependency-review.yaml](https://github.com/sea-haven-industries/.github ) | `1.0.3` | `1.0.6` |
| [Sea-Haven-Industries/.github/.github/workflows/cd-cdk.yaml](https://github.com/sea-haven-industries/.github ) | `1.0.3` | `1.0.6` |
| [Sea-Haven-Industries/.github/.github/workflows/callable-labeler.yaml](https://github.com/sea-haven-industries/.github ) | `1.0.3` | `1.0.6` |
| [Sea-Haven-Industries/.github/.github/workflows/callable-pr-policy.yaml](https://github.com/sea-haven-industries/.github ) | `1.0.5` | `1.0.6` |
Updates `Sea-Haven-Industries/.github/.github/workflows/ci-typescript-cdk.yaml` from 1.0.3 to 1.0.6
- [Release notes](https://github.com/sea-haven-industries/.github/releases )
- [Commits](3f74677422...7ac3528750https://github.com/sea-haven-industries/.github/releases )
- [Commits](3f74677422...7ac3528750https://github.com/sea-haven-industries/.github/releases )
- [Commits](3f74677422...7ac3528750https://github.com/sea-haven-industries/.github/releases )
- [Commits](3f74677422...7ac3528750https://github.com/sea-haven-industries/.github/releases )
- [Commits](9c1ecf9428...7ac3528750
2026-08-11 12:00:24 -04:00
Adam Moussa
67a577bf90
ci: update PR policy workflow to v1.0.7 ( #67 )
...
Signed-off-by: Adam Moussa <adam@seahavenind.com>
2026-08-11 11:42:41 -04:00
1e0ed68a11
ci: add org PR policy caller
...
Refs: PLAT-62
2026-08-11 11:15:08 -04:00
dependabot[bot]
ab7dd977ac
build(deps): bump the minor-and-patch group with 4 updates ( #62 )
...
Deploy / deploy (push) Has been cancelled
Bumps the minor-and-patch group with 4 updates: [Sea-Haven-Industries/.github/.github/workflows/ci-typescript-cdk.yaml](https://github.com/sea-haven-industries/.github ), [Sea-Haven-Industries/.github/.github/workflows/callable-dependency-review.yaml](https://github.com/sea-haven-industries/.github ), [Sea-Haven-Industries/.github/.github/workflows/cd-cdk.yaml](https://github.com/sea-haven-industries/.github ) and [Sea-Haven-Industries/.github/.github/workflows/callable-labeler.yaml](https://github.com/sea-haven-industries/.github ).
Updates `Sea-Haven-Industries/.github/.github/workflows/ci-typescript-cdk.yaml` from 1.0.2 to 1.0.3
- [Release notes](https://github.com/sea-haven-industries/.github/releases )
- [Commits](0170a57c0d...3f74677422https://github.com/sea-haven-industries/.github/releases )
- [Commits](0170a57c0d...3f74677422https://github.com/sea-haven-industries/.github/releases )
- [Commits](0170a57c0d...3f74677422https://github.com/sea-haven-industries/.github/releases )
- [Commits](0170a57c0d...3f74677422
2026-08-04 11:02:19 -04:00
Adam Moussa
3787a82eb1
ci(deps): pin org reusable workflows to v1.0.2 ( #61 )
...
Deploy / deploy (push) Has been cancelled
* ci(deps): pin org reusable workflows to v1.0.2
* style(ci): normalize workflow block spacing
2026-07-28 18:16:43 -04:00
Adam Moussa
211a00a013
chore(security): resolve open dependabot and code scanning alerts ( #59 )
...
Deploy / deploy (push) Has been cancelled
* ci: add least-privilege permissions blocks to workflow callers
Resolves code scanning alerts #3 and #4 (actions/missing-workflow-permissions). Both callable workflows only need contents: read; the dependency-review callable already declares it internally, this caps the caller token to match.
Signed-off-by: Adam Moussa <adam@seahavenind.com>
* build(deps): bump aws-cdk-lib to 2.262.0 to patch brace-expansion
aws-cdk-lib 2.261.0 bundles brace-expansion 5.0.6, which is vulnerable to CVE-2026-13149 (GHSA-3jxr-9vmj-r5cp), an exponential-time DoS in expand(). This was the only path pulling the vulnerable package into the tree. 2.262.0 vendors the patched 5.0.7, resolving Dependabot alert 7.
Because brace-expansion arrives bundled inside the aws-cdk-lib tarball rather than resolved by npm, the aws-cdk-lib bump is the only way to move it.
Signed-off-by: Adam Moussa <adam@seahavenind.com>
* refactor(cdk): drop unreferenced ssm value parameters
fromStringParameterName injects an AWS::SSM::Parameter::Value
CloudFormation parameter to carry the parameter's value, but DoorId
and PhoneIps are only used for grantRead, which builds the ARN from
the name string — so DoorIdParameter and PhoneIpsParameter sat
unreferenced in the template (flagged W2001 by the CloudFormation
validator newly bundled in aws-cdk-lib 2.262.0).
Switching to fromStringParameterAttributes with forceDynamicReference
resolves the value lazily via an SSM dynamic reference, emitting
nothing when unused. Verified the synthesized template is identical
apart from the removed Parameters entries and the CDKMetadata
analytics hash — no IAM or resource changes.
Also re-points the four line-keyed semgrep detect-child-process
suppressions (adjudicated FPs, INFRA-105) to the shifted line
numbers; the findings themselves are unchanged.
Signed-off-by: Adam Moussa <adam@seahavenind.com>
---------
Signed-off-by: Adam Moussa <adam@seahavenind.com>
2026-07-23 20:24:23 +00:00
Adam Moussa
097b8a3fbf
chore(ci): SHA-pin org reusable-workflow caller refs (INFRA-50) ( #49 )
Deploy / deploy (push) Waiting to run
2026-07-06 18:27:54 -04:00
Adam Moussa
1edf1c8b93
Repo hygiene: PR labeler + README badges (INFRA-56/57) ( #35 )
2026-06-11 14:13:45 -04:00
Adam Moussa
118ea41e87
Add dependency-review caller workflow ( #25 )
...
* Add dependency-review caller workflow
Add a pull_request-triggered caller that invokes the org-level
callable-dependency-review workflow to scan dependency changes and
fail on high-severity advisories.
* chore: retrigger checks
* chore: retrigger dep review (post-fix)
* chore: add .env to .gitignore
2026-06-05 12:34:08 -04:00
Adam Moussa
b5e75f8306
Add GitHub Actions deploy workflow ( #18 )
...
* Add GitHub Actions deploy workflow (OIDC)
* Add permissions block for OIDC token exchange
* Add concurrency control to prevent parallel deploys
2026-05-08 17:08:22 -04:00
Adam Moussa
c3d1c399f2
Add CI workflow ( #17 )
...
* Add CI workflow
* Fix TypeScript compilation for CI
Add types: ["node"] to tsconfig so tsc resolves Node.js globals
(console, process, __dirname). Add @aws-sdk/client-ssm and
source-map-support as devDependencies for type resolution.
2026-05-08 16:03:06 -04:00
Adam Moussa
222e6fd49d
Remove wrapper workflow — using required workflow via org ruleset ( #14 )
2026-05-06 19:59:02 -04:00
Adam Moussa
07f81be535
Add Claude Code review workflow ( #13 )
2026-05-06 18:12:11 -04:00
