adam/seahaven-door-unlock-api
1
0
Fork 0
mirror of https://github.com/Sea-Haven-Industries/seahaven-door-unlock-api.git synced 2026-09-30 07:03:12 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions
96 commits 2 branches 8 tags 49 MiB
Commit graph

96 commits

This branch
This branch
All branches
Author SHA1 Message Date
renovate[bot]
90b94ad091
chore(deps): update terraform aws to v6.65.0 (#93) 
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-09-21 15:47:28 +00:00
renovate[bot]
50564bdffb
chore(deps): update sea-haven-industries/.github action to v1.0.11 (#91) 
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-09-14 17:46:53 +00:00
renovate[bot]
44681ca2c8
chore(deps): update terraform minor and patch (#92) 
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-09-14 17:46:35 +00:00
Adam Moussa
9063d0f438
docs(readme): record HCP VCS trigger patterns (PLAT-183) (#90) 2026-09-10 21:00:45 +00:00
renovate[bot]
e4083558e1
fix(deps): update npm minor and patch (#89) 
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-09-09 18:45:04 +00:00
renovate[bot]
e12d671e1f
chore(deps): update terraform aws to v6.63.0 (#88) 
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-09-09 18:44:39 +00:00
Adam Moussa
c23f990c6f
feat(phones): add T57W door-unlock-with-sp template (#87) 
* feat(phones): add T57W door-unlock-with-sp template

* feat: add firmware dir and add latest 3cx supported yealink firmware
 2026-09-03 22:56:04 +00:00
Adam Moussa
b43335b4a7
feat(iam): import hcptf roles into app Terraform (PLAT-146) (#86) 
* feat(iam): import hcptf roles into app Terraform (PLAT-146)

Move the existing hcptf pair into this repo so app Terraform owns prod IAM after the substrate handoff.

* fix(iam): add apply-role IAM list permissions (PLAT-146)

IamReadOnly omitted ListRoleTags and ListInstanceProfilesForRole needed after detaching the substrate guardrail.
 2026-09-02 21:47:15 +00:00
renovate[bot]
ad74f02ec4
chore(deps): update terraform aws to v6.62.0 (#85) 
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-08-31 22:41:03 +00:00
renovate[bot]
57dc807618
chore(deps): update sea-haven-industries/.github action to v1.0.10 (#84) 
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-08-31 22:40:47 +00:00
Adam Moussa
61f13bddfe
fix(terraform): defer api domain until dns cutover (#83) 
API Gateway custom domain names are unique per region across accounts, so prod cannot create doorunlock.seahaven.com while mgmt still holds it.
 2026-08-27 23:06:52 +00:00
Adam Moussa
cdd810001d
fix(terraform): bootstrap node from gzip tarball (#82) 
HCP Linux workers do not ship xz, so the plan-time Node download must use the gzip distro tarball.
 2026-08-27 22:25:04 +00:00
Adam Moussa
c43bee214c
feat(terraform): add hcp terraform for prod door-unlock-api (PLAT-76) (#81) 
* feat(terraform): add hcp terraform for prod door-unlock-api

Move deploy off frozen CDK CD onto an HCP workspace that recreates the HTTP API, five Lambdas, disabled EventBridge rules, and alarms in seahaven-prod without a poller VPC.

* docs(readme): link the door unlock api ops page

* fix(terraform): invoke package build via bash

HCP launches the external data source with bash, so the inner build script should not depend on the git executable bit.
 2026-08-27 22:03:12 +00:00
Adam Moussa
bbc113497a
feat(3cx): sync office department blfs via xapi (PLAT-116) (#80)
Some checks failed
Deploy / deploy (push) Has been cancelled
Details 
* feat(3cx): sync office department BLFs via XAPI

Keep unlock and lockdown keys in the templates and write colleague plus shared-parking BLFs per extension so phones skip their own line.

* fix(3cx): preserve parking BLF IDs and fail the job on PATCH errors
 2026-08-27 14:58:55 -04:00
renovate[bot]
39414156ef
fix(deps): update npm minor and patch (#78)
Some checks failed
Deploy / deploy (push) Has been cancelled
Details
2026-08-25 15:55:33 +00:00
Adam Moussa
6481f0c23a
chore(deps): remove dependabot version updates (#79) 
Renovate is the version-update bot. GitHub Dependabot alerts stay.
 2026-08-25 11:51:15 -04:00
renovate[bot]
39013e8a65
chore(deps): update sea-haven-industries/.github action to v1.0.8 (#77) 2026-08-25 15:42:11 +00:00
Adam Moussa
fe89bc6649
chore(ci): remove pr policy workflow caller (#74)
Some checks are pending
Deploy / deploy (push) Waiting to run
Details
2026-08-24 15:12:36 -04:00
Adam Moussa
fd459b12b6
chore(ci): switch auto-merge from seahaven-bot to Mergify (#73)
Some checks are pending
Deploy / deploy (push) Waiting to run
Details
2026-08-24 13:53:15 -04:00
Adam Moussa
a00730675a
ci: enable squash auto-merge on ready PRs (PLAT-108) (#71)
Some checks failed
Deploy / deploy (push) Has been cancelled
Details 
* ci: enable squash auto-merge on ready PRs

* fix(ci): serialize auto-merge enable and ignore already-enabled
 2026-08-21 23:34:40 +00:00
Adam Moussa
0929d2fb6c
ci: add merge_group trigger for required ci / ci (#70)
Some checks are pending
Deploy / deploy (push) Waiting to run
Details
2026-08-21 17:42:31 -04:00
dependabot[bot]
5d5439acf7
chore(deps): bump the minor-and-patch group with 4 updates (#69)
Some checks failed
Deploy / deploy (push) Has been cancelled
Details 
Bumps the minor-and-patch group with 4 updates: [@aws-sdk/client-ssm](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-ssm), [aws-cdk](https://github.com/aws/aws-cdk-cli/tree/HEAD/packages/aws-cdk), [esbuild](https://github.com/evanw/esbuild) and [tsx](https://github.com/privatenumber/tsx).


Updates `@aws-sdk/client-ssm` from 3.1106.0 to 3.1111.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-ssm/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1111.0/clients/client-ssm)

Updates `aws-cdk` from 2.1135.1 to 2.1136.0
- [Release notes](https://github.com/aws/aws-cdk-cli/releases)
- [Commits](https://github.com/aws/aws-cdk-cli/commits/aws-cdk@v2.1136.0/packages/aws-cdk)

Updates `esbuild` from 0.28.1 to 0.28.2
- [Release notes](https://github.com/evanw/esbuild/releases)
- [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG.md)
- [Commits](https://github.com/evanw/esbuild/compare/v0.28.1...v0.28.2)

Updates `tsx` from 4.23.11 to 4.23.12
- [Release notes](https://github.com/privatenumber/tsx/releases)
- [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs)
- [Commits](https://github.com/privatenumber/tsx/compare/v4.23.11...v4.23.12)

---
updated-dependencies:
- dependency-name: "@aws-sdk/client-ssm"
  dependency-version: 3.1111.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: aws-cdk
  dependency-version: 2.1136.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: esbuild
  dependency-version: 0.28.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: tsx
  dependency-version: 4.23.12
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Adam Moussa <166072409+amoussa1229@users.noreply.github.com>
 2026-08-18 17:16:21 +00:00
dependabot[bot]
fea155279a
chore(deps): bump the minor-and-patch group with 4 updates (#68) 
Bumps the minor-and-patch group with 4 updates: [Sea-Haven-Industries/.github/.github/workflows/ci-typescript-cdk.yaml](https://github.com/sea-haven-industries/.github), [Sea-Haven-Industries/.github/.github/workflows/callable-dependency-review.yaml](https://github.com/sea-haven-industries/.github), [Sea-Haven-Industries/.github/.github/workflows/cd-cdk.yaml](https://github.com/sea-haven-industries/.github) and [Sea-Haven-Industries/.github/.github/workflows/callable-labeler.yaml](https://github.com/sea-haven-industries/.github).


Updates `Sea-Haven-Industries/.github/.github/workflows/ci-typescript-cdk.yaml` from 1.0.6 to 1.0.7
- [Release notes](https://github.com/sea-haven-industries/.github/releases)
- [Commits](7ac3528750...e5691d8a7f)

Updates `Sea-Haven-Industries/.github/.github/workflows/callable-dependency-review.yaml` from 1.0.6 to 1.0.7
- [Release notes](https://github.com/sea-haven-industries/.github/releases)
- [Commits](7ac3528750...e5691d8a7f)

Updates `Sea-Haven-Industries/.github/.github/workflows/cd-cdk.yaml` from 1.0.6 to 1.0.7
- [Release notes](https://github.com/sea-haven-industries/.github/releases)
- [Commits](7ac3528750...e5691d8a7f)

Updates `Sea-Haven-Industries/.github/.github/workflows/callable-labeler.yaml` from 1.0.6 to 1.0.7
- [Release notes](https://github.com/sea-haven-industries/.github/releases)
- [Commits](7ac3528750...e5691d8a7f)

---
updated-dependencies:
- dependency-name: Sea-Haven-Industries/.github/.github/workflows/ci-typescript-cdk.yaml
  dependency-version: 1.0.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: Sea-Haven-Industries/.github/.github/workflows/callable-dependency-review.yaml
  dependency-version: 1.0.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: Sea-Haven-Industries/.github/.github/workflows/cd-cdk.yaml
  dependency-version: 1.0.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: Sea-Haven-Industries/.github/.github/workflows/callable-labeler.yaml
  dependency-version: 1.0.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-18 13:14:22 -04:00
dependabot[bot]
4e84f52379
chore(deps): bump the minor-and-patch group across 1 directory with 5 updates (#65)
Some checks are pending
Deploy / deploy (push) Waiting to run
Details 
* chore(deps): bump the minor-and-patch group across 1 directory with 5 updates

Bumps the minor-and-patch group with 5 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [aws-cdk-lib](https://github.com/aws/aws-cdk/tree/HEAD/packages/aws-cdk-lib) | `2.262.1` | `2.263.0` |
| [constructs](https://github.com/aws/constructs) | `10.7.1` | `10.8.1` |
| [@aws-sdk/client-ssm](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-ssm) | `3.1096.0` | `3.1106.0` |
| [aws-cdk](https://github.com/aws/aws-cdk-cli/tree/HEAD/packages/aws-cdk) | `2.1133.0` | `2.1135.1` |
| [tsx](https://github.com/privatenumber/tsx) | `4.23.1` | `4.23.11` |



Updates `aws-cdk-lib` from 2.262.1 to 2.263.0
- [Release notes](https://github.com/aws/aws-cdk/releases)
- [Changelog](https://github.com/aws/aws-cdk/blob/main/CHANGELOG.v2.alpha.md)
- [Commits](https://github.com/aws/aws-cdk/commits/v2.263.0/packages/aws-cdk-lib)

Updates `constructs` from 10.7.1 to 10.8.1
- [Release notes](https://github.com/aws/constructs/releases)
- [Commits](https://github.com/aws/constructs/compare/v10.7.1...v10.8.1)

Updates `@aws-sdk/client-ssm` from 3.1096.0 to 3.1106.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-ssm/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1106.0/clients/client-ssm)

Updates `aws-cdk` from 2.1133.0 to 2.1135.1
- [Release notes](https://github.com/aws/aws-cdk-cli/releases)
- [Commits](https://github.com/aws/aws-cdk-cli/commits/aws-cdk@v2.1135.1/packages/aws-cdk)

Updates `tsx` from 4.23.1 to 4.23.11
- [Release notes](https://github.com/privatenumber/tsx/releases)
- [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs)
- [Commits](https://github.com/privatenumber/tsx/compare/v4.23.1...v4.23.11)

---
updated-dependencies:
- dependency-name: "@aws-sdk/client-ssm"
  dependency-version: 3.1106.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: aws-cdk
  dependency-version: 2.1135.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: aws-cdk-lib
  dependency-version: 2.263.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: constructs
  dependency-version: 10.8.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: tsx
  dependency-version: 4.23.11
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

* fix: bump aws-cdk-lib to 2.265.0

Signed-off-by: Adam Moussa <adam@seahavenind.com>

---------

Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: Adam Moussa <adam@seahavenind.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Adam Moussa <adam@seahavenind.com>
Co-authored-by: Adam Moussa <166072409+amoussa1229@users.noreply.github.com>
 2026-08-17 18:03:50 -04:00
dependabot[bot]
d650b4b945
chore(deps): bump the minor-and-patch group (#66)
Some checks failed
Deploy / deploy (push) Has been cancelled
Details 
Bumps the minor-and-patch group with 5 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [Sea-Haven-Industries/.github/.github/workflows/ci-typescript-cdk.yaml](https://github.com/sea-haven-industries/.github) | `1.0.3` | `1.0.6` |
| [Sea-Haven-Industries/.github/.github/workflows/callable-dependency-review.yaml](https://github.com/sea-haven-industries/.github) | `1.0.3` | `1.0.6` |
| [Sea-Haven-Industries/.github/.github/workflows/cd-cdk.yaml](https://github.com/sea-haven-industries/.github) | `1.0.3` | `1.0.6` |
| [Sea-Haven-Industries/.github/.github/workflows/callable-labeler.yaml](https://github.com/sea-haven-industries/.github) | `1.0.3` | `1.0.6` |
| [Sea-Haven-Industries/.github/.github/workflows/callable-pr-policy.yaml](https://github.com/sea-haven-industries/.github) | `1.0.5` | `1.0.6` |

Updates `Sea-Haven-Industries/.github/.github/workflows/ci-typescript-cdk.yaml` from 1.0.3 to 1.0.6
- [Release notes](https://github.com/sea-haven-industries/.github/releases)
- [Commits](3f74677422...7ac3528750)

Updates `Sea-Haven-Industries/.github/.github/workflows/callable-dependency-review.yaml` from 1.0.3 to 1.0.6
- [Release notes](https://github.com/sea-haven-industries/.github/releases)
- [Commits](3f74677422...7ac3528750)

Updates `Sea-Haven-Industries/.github/.github/workflows/cd-cdk.yaml` from 1.0.3 to 1.0.6
- [Release notes](https://github.com/sea-haven-industries/.github/releases)
- [Commits](3f74677422...7ac3528750)

Updates `Sea-Haven-Industries/.github/.github/workflows/callable-labeler.yaml` from 1.0.3 to 1.0.6
- [Release notes](https://github.com/sea-haven-industries/.github/releases)
- [Commits](3f74677422...7ac3528750)

Updates `Sea-Haven-Industries/.github/.github/workflows/callable-pr-policy.yaml` from 1.0.5 to 1.0.6
- [Release notes](https://github.com/sea-haven-industries/.github/releases)
- [Commits](9c1ecf9428...7ac3528750)

---
updated-dependencies:
- dependency-name: Sea-Haven-Industries/.github/.github/workflows/ci-typescript-cdk.yaml
  dependency-version: 1.0.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: Sea-Haven-Industries/.github/.github/workflows/callable-dependency-review.yaml
  dependency-version: 1.0.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: Sea-Haven-Industries/.github/.github/workflows/cd-cdk.yaml
  dependency-version: 1.0.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: Sea-Haven-Industries/.github/.github/workflows/callable-labeler.yaml
  dependency-version: 1.0.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: Sea-Haven-Industries/.github/.github/workflows/callable-pr-policy.yaml
  dependency-version: 1.0.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-11 12:00:24 -04:00
Adam Moussa
67a577bf90
ci: update PR policy workflow to v1.0.7 (#67) 
Signed-off-by: Adam Moussa <adam@seahavenind.com>
 2026-08-11 11:42:41 -04:00
Adam Moussa
1e0ed68a11
ci: add org PR policy caller 
Refs: PLAT-62
 2026-08-11 11:15:08 -04:00
dependabot[bot]
ab7dd977ac
build(deps): bump the minor-and-patch group with 4 updates (#62)
Some checks failed
Deploy / deploy (push) Has been cancelled
Details 
Bumps the minor-and-patch group with 4 updates: [Sea-Haven-Industries/.github/.github/workflows/ci-typescript-cdk.yaml](https://github.com/sea-haven-industries/.github), [Sea-Haven-Industries/.github/.github/workflows/callable-dependency-review.yaml](https://github.com/sea-haven-industries/.github), [Sea-Haven-Industries/.github/.github/workflows/cd-cdk.yaml](https://github.com/sea-haven-industries/.github) and [Sea-Haven-Industries/.github/.github/workflows/callable-labeler.yaml](https://github.com/sea-haven-industries/.github).


Updates `Sea-Haven-Industries/.github/.github/workflows/ci-typescript-cdk.yaml` from 1.0.2 to 1.0.3
- [Release notes](https://github.com/sea-haven-industries/.github/releases)
- [Commits](0170a57c0d...3f74677422)

Updates `Sea-Haven-Industries/.github/.github/workflows/callable-dependency-review.yaml` from 1.0.2 to 1.0.3
- [Release notes](https://github.com/sea-haven-industries/.github/releases)
- [Commits](0170a57c0d...3f74677422)

Updates `Sea-Haven-Industries/.github/.github/workflows/cd-cdk.yaml` from 1.0.2 to 1.0.3
- [Release notes](https://github.com/sea-haven-industries/.github/releases)
- [Commits](0170a57c0d...3f74677422)

Updates `Sea-Haven-Industries/.github/.github/workflows/callable-labeler.yaml` from 1.0.2 to 1.0.3
- [Release notes](https://github.com/sea-haven-industries/.github/releases)
- [Commits](0170a57c0d...3f74677422)

---
updated-dependencies:
- dependency-name: Sea-Haven-Industries/.github/.github/workflows/ci-typescript-cdk.yaml
  dependency-version: 1.0.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: Sea-Haven-Industries/.github/.github/workflows/callable-dependency-review.yaml
  dependency-version: 1.0.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: Sea-Haven-Industries/.github/.github/workflows/cd-cdk.yaml
  dependency-version: 1.0.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: Sea-Haven-Industries/.github/.github/workflows/callable-labeler.yaml
  dependency-version: 1.0.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-04 11:02:19 -04:00
Adam Moussa
3787a82eb1
ci(deps): pin org reusable workflows to v1.0.2 (#61)
Some checks failed
Deploy / deploy (push) Has been cancelled
Details 
* ci(deps): pin org reusable workflows to v1.0.2

* style(ci): normalize workflow block spacing
 2026-07-28 18:16:43 -04:00
dependabot[bot]
8e43dc3805
build(deps): bump the minor-and-patch group with 3 updates (#60)
Some checks are pending
Deploy / deploy (push) Waiting to run
Details 
Bumps the minor-and-patch group with 3 updates: [aws-cdk-lib](https://github.com/aws/aws-cdk/tree/HEAD/packages/aws-cdk-lib), [@aws-sdk/client-ssm](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-ssm) and [aws-cdk](https://github.com/aws/aws-cdk-cli/tree/HEAD/packages/aws-cdk).


Updates `aws-cdk-lib` from 2.262.0 to 2.262.1
- [Release notes](https://github.com/aws/aws-cdk/releases)
- [Changelog](https://github.com/aws/aws-cdk/blob/main/CHANGELOG.v2.alpha.md)
- [Commits](https://github.com/aws/aws-cdk/commits/v2.262.1/packages/aws-cdk-lib)

Updates `@aws-sdk/client-ssm` from 3.1091.0 to 3.1096.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-ssm/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1096.0/clients/client-ssm)

Updates `aws-cdk` from 2.1132.0 to 2.1133.0
- [Release notes](https://github.com/aws/aws-cdk-cli/releases)
- [Commits](https://github.com/aws/aws-cdk-cli/commits/aws-cdk@v2.1133.0/packages/aws-cdk)

---
updated-dependencies:
- dependency-name: aws-cdk-lib
  dependency-version: 2.262.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@aws-sdk/client-ssm"
  dependency-version: 3.1096.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: aws-cdk
  dependency-version: 2.1133.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-28 11:51:51 -04:00
Adam Moussa
211a00a013
chore(security): resolve open dependabot and code scanning alerts (#59)
Some checks failed
Deploy / deploy (push) Has been cancelled
Details 
* ci: add least-privilege permissions blocks to workflow callers
Resolves code scanning alerts #3 and #4 (actions/missing-workflow-permissions). Both callable workflows only need contents: read; the dependency-review callable already declares it internally, this caps the caller token to match.

Signed-off-by: Adam Moussa <adam@seahavenind.com>

* build(deps): bump aws-cdk-lib to 2.262.0 to patch brace-expansion

aws-cdk-lib 2.261.0 bundles brace-expansion 5.0.6, which is vulnerable to CVE-2026-13149 (GHSA-3jxr-9vmj-r5cp), an exponential-time DoS in expand(). This was the only path pulling the vulnerable package into the tree. 2.262.0 vendors the patched 5.0.7, resolving Dependabot alert 7.

Because brace-expansion arrives bundled inside the aws-cdk-lib tarball rather than resolved by npm, the aws-cdk-lib bump is the only way to move it.

Signed-off-by: Adam Moussa <adam@seahavenind.com>

* refactor(cdk): drop unreferenced ssm value parameters

fromStringParameterName injects an AWS::SSM::Parameter::Value
CloudFormation parameter to carry the parameter's value, but DoorId
and PhoneIps are only used for grantRead, which builds the ARN from
the name string — so DoorIdParameter and PhoneIpsParameter sat
unreferenced in the template (flagged W2001 by the CloudFormation
validator newly bundled in aws-cdk-lib 2.262.0).

Switching to fromStringParameterAttributes with forceDynamicReference
resolves the value lazily via an SSM dynamic reference, emitting
nothing when unused. Verified the synthesized template is identical
apart from the removed Parameters entries and the CDKMetadata
analytics hash — no IAM or resource changes.

Also re-points the four line-keyed semgrep detect-child-process
suppressions (adjudicated FPs, INFRA-105) to the shifted line
numbers; the findings themselves are unchanged.

Signed-off-by: Adam Moussa <adam@seahavenind.com>

---------

Signed-off-by: Adam Moussa <adam@seahavenind.com>
 2026-07-23 20:24:23 +00:00
dependabot[bot]
c662688ae3
build(deps): bump the minor-and-patch group with 3 updates (#58)
Some checks failed
Deploy / deploy (push) Has been cancelled
Details 
Bumps the minor-and-patch group with 3 updates: [constructs](https://github.com/aws/constructs), [@aws-sdk/client-ssm](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-ssm) and [aws-cdk](https://github.com/aws/aws-cdk-cli/tree/HEAD/packages/aws-cdk).


Updates `constructs` from 10.6.0 to 10.7.1
- [Release notes](https://github.com/aws/constructs/releases)
- [Commits](https://github.com/aws/constructs/compare/v10.6.0...v10.7.1)

Updates `@aws-sdk/client-ssm` from 3.1086.0 to 3.1091.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-ssm/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1091.0/clients/client-ssm)

Updates `aws-cdk` from 2.1130.0 to 2.1132.0
- [Release notes](https://github.com/aws/aws-cdk-cli/releases)
- [Commits](https://github.com/aws/aws-cdk-cli/commits/aws-cdk@v2.1132.0/packages/aws-cdk)

---
updated-dependencies:
- dependency-name: constructs
  dependency-version: 10.7.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@aws-sdk/client-ssm"
  dependency-version: 3.1091.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: aws-cdk
  dependency-version: 2.1132.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-21 15:33:15 -04:00
dependabot[bot]
bf51bf7aa2
build(deps-dev): bump the minor-and-patch group with 3 updates (#57)
Some checks failed
Deploy / deploy (push) Has been cancelled
Details 
Bumps the minor-and-patch group with 3 updates: [@aws-sdk/client-ssm](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-ssm), [aws-cdk](https://github.com/aws/aws-cdk-cli/tree/HEAD/packages/aws-cdk) and [tsx](https://github.com/privatenumber/tsx).


Updates `@aws-sdk/client-ssm` from 3.1082.0 to 3.1086.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-ssm/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1086.0/clients/client-ssm)

Updates `aws-cdk` from 2.1129.0 to 2.1130.0
- [Release notes](https://github.com/aws/aws-cdk-cli/releases)
- [Commits](https://github.com/aws/aws-cdk-cli/commits/aws-cdk@v2.1130.0/packages/aws-cdk)

Updates `tsx` from 4.23.0 to 4.23.1
- [Release notes](https://github.com/privatenumber/tsx/releases)
- [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs)
- [Commits](https://github.com/privatenumber/tsx/compare/v4.23.0...v4.23.1)

---
updated-dependencies:
- dependency-name: "@aws-sdk/client-ssm"
  dependency-version: 3.1086.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: aws-cdk
  dependency-version: 2.1130.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: tsx
  dependency-version: 4.23.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-14 11:30:30 -04:00
Adam Moussa
f2bc576dfd
chore(security): add repo-local suppressions for adjudicated FPs (#56)
Some checks are pending
Deploy / deploy (push) Waiting to run
Details 
Moves proof-or-kill-verified false positives (CDK synth-time esbuild execSync x4;
CDK LogRetention IAM boilerplate; Yealink provisioning-template token placeholders)
from machine-level to a tracked repo-local .security-review/suppressions.json so
the Open SWE daily-report automation resolves them. Machine-level copy retained
until merge. INFRA-105.
 2026-07-13 14:30:55 -04:00
Adam Moussa
07247d4044
Document the CDK app in the README (#55)
Some checks failed
Deploy / deploy (push) Has been cancelled
Details 
The README covered the runtime architecture but never described the
CDK app itself — the infrastructure-as-code component that cdk.json
represents. Add an "Infrastructure (CDK)" section documenting the
project layout, the app entry point, the DoorUnlockStack resources,
cdk.json (the tsx-based app command and context), and synth/diff/deploy
commands. Also list the per-Lambda CloudWatch error alarms the stack
defines under Architecture.
 2026-07-10 16:07:24 -04:00
Adam Moussa
c2c45562e4
build(deps): migrate CDK app ts-node->tsx, adopt typescript 7 (INFRA-183) (#54)
Some checks failed
Deploy / deploy (push) Has been cancelled
Details 
ts-node 10.x is incompatible with the TypeScript 7 compiler API, causing
cdk synth to fail with "Cannot read properties of undefined (reading
'fileExists')". Switch the cdk.json app command to tsx and bump
typescript to ~7.0.2. Supersedes Dependabot PR #53.
 2026-07-08 17:48:18 -04:00
dependabot[bot]
0d40c471b0
Bump the minor-and-patch group with 2 updates (#52) 
Bumps the minor-and-patch group with 2 updates: [@aws-sdk/client-ssm](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-ssm) and [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node).


Updates `@aws-sdk/client-ssm` from 3.1080.0 to 3.1082.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-ssm/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1082.0/clients/client-ssm)

Updates `@types/node` from 24.13.2 to 24.13.3
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

---
updated-dependencies:
- dependency-name: "@aws-sdk/client-ssm"
  dependency-version: 3.1082.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@types/node"
  dependency-version: 24.13.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-08 17:03:08 -04:00
Adam Moussa
dec88eac5d
ci: add github-actions to dependabot coverage (INFRA-130) (#51)
Some checks are pending
Deploy / deploy (push) Waiting to run
Details
2026-07-08 16:53:48 -04:00
dependabot[bot]
97402aac9b
Bump @aws-sdk/client-ssm in the minor-and-patch group (#50)
Some checks failed
Deploy / deploy (push) Has been cancelled
Details 
Bumps the minor-and-patch group with 1 update: [@aws-sdk/client-ssm](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-ssm).


Updates `@aws-sdk/client-ssm` from 3.1079.0 to 3.1080.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-ssm/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1080.0/clients/client-ssm)

---
updated-dependencies:
- dependency-name: "@aws-sdk/client-ssm"
  dependency-version: 3.1080.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-07 12:35:42 -04:00
Adam Moussa
097b8a3fbf
chore(ci): SHA-pin org reusable-workflow caller refs (INFRA-50) (#49)
Some checks are pending
Deploy / deploy (push) Waiting to run
Details
2026-07-06 18:27:54 -04:00
Adam Moussa
3283e62ff2
docs: link Confluence AWS Architecture Map (INFRA-53) (#48)
Some checks are pending
Deploy / deploy (push) Waiting to run
Details
2026-07-06 17:44:18 -04:00
Adam Moussa
a86465d0e2
security: door-unlock token rotation runbook + executed cutover (INFRA-105) (#47)
Some checks are pending
Deploy / deploy (push) Waiting to run
Details 
* security: placeholder committed door-unlock token + rotation runbook (INFRA-105)

The live door-system auth token was hard-coded in the Yealink Push-XML
provisioning templates (both /unlock and /lockdown) and present in git
history since 2c9b863. Replace it with __DOOR_UNLOCK_TOKEN__ so future
templates carry no secret; add RUNBOOK-token-rotation.md covering the
rotation, phone re-provisioning, and history scrub.

Rotation + history scrub are NOT performed here — staged for a scheduled
phone re-provisioning window. The old token is compromised until rotated.

* security: mark INFRA-105 rotation executed; correct false cache-expiry claim

The runbook claimed the old token stops working ~5 min after SSM rotation.
/sh-security-review (2026-07-06) confirmed this is false: the authorizer and
both handlers cache the token in module scope with no TTL, so warm containers
honor the old token until recycled (unbounded). Add the mandatory forced
cold-start step, mark the cutover EXECUTED (token rotated to SSM v3, history
scrubbed + force-pushed, Lambdas recycled), stop embedding partial token bytes,
and note the accepted refs/pull/* residual. Design fix (cache TTL) tracked.
 2026-07-06 16:54:32 -04:00
dependabot[bot]
2a20b68584 Bump the minor-and-patch group with 3 updates (#46) 2026-07-04 16:35:11 -04:00
seahaven-openswe[bot]
3e869ff373 chore: upgrade Lambda runtime nodejs22.x to nodejs24.x (#45) 2026-07-04 01:25:45 -04:00
dependabot[bot]
21eaa2b5ab Bump @aws-sdk/client-ssm in the minor-and-patch group (#43) 
Bumps the minor-and-patch group with 1 update: [@aws-sdk/client-ssm](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-ssm).


Updates `@aws-sdk/client-ssm` from 3.1075.0 to 3.1076.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-ssm/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1076.0/clients/client-ssm)

---
updated-dependencies:
- dependency-name: "@aws-sdk/client-ssm"
  dependency-version: 3.1076.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-30 19:46:18 -04:00
dependabot[bot]
00786aaae4 Bump the minor-and-patch group across 1 directory with 3 updates (#39) 
Bumps the minor-and-patch group with 3 updates in the / directory: [aws-cdk-lib](https://github.com/aws/aws-cdk/tree/HEAD/packages/aws-cdk-lib), [@aws-sdk/client-ssm](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-ssm) and [aws-cdk](https://github.com/aws/aws-cdk-cli/tree/HEAD/packages/aws-cdk).


Updates `aws-cdk-lib` from 2.259.0 to 2.260.0
- [Release notes](https://github.com/aws/aws-cdk/releases)
- [Changelog](https://github.com/aws/aws-cdk/blob/main/CHANGELOG.v2.alpha.md)
- [Commits](https://github.com/aws/aws-cdk/commits/v2.260.0/packages/aws-cdk-lib)

Updates `@aws-sdk/client-ssm` from 3.1070.0 to 3.1075.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-ssm/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1075.0/clients/client-ssm)

Updates `aws-cdk` from 2.1127.0 to 2.1128.1
- [Release notes](https://github.com/aws/aws-cdk-cli/releases)
- [Commits](https://github.com/aws/aws-cdk-cli/commits/aws-cdk@v2.1128.1/packages/aws-cdk)

---
updated-dependencies:
- dependency-name: "@aws-sdk/client-ssm"
  dependency-version: 3.1075.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: aws-cdk
  dependency-version: 2.1128.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: aws-cdk-lib
  dependency-version: 2.260.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-24 15:55:04 -04:00
Adam Moussa
769c712bcb Pin @types/node to runtime major (Node 22) (#41) 
The Lambdas in this stack run on the nodejs22.x runtime, but @types/node
had drifted to ^25 via Dependabot. A too-new types major still compiles,
so the mismatch passed CI while describing APIs absent at runtime.

Repin to ^22 to match the Lambda runtime and add a scoped Dependabot
ignore for @types/node semver-major bumps so the alignment can only be
broken deliberately, alongside a runtime upgrade. Minor/patch within the
major still flow. Sanctioned exception to the no-blanket-ignore rule
(engineering-handbook github-standards Pinning Principle).
 2026-06-24 15:01:13 -04:00
dependabot[bot]
5f3b963d00 Bump the minor-and-patch group across 1 directory with 4 updates (#38) 
Bumps the minor-and-patch group with 4 updates in the / directory: [aws-cdk-lib](https://github.com/aws/aws-cdk/tree/HEAD/packages/aws-cdk-lib), [@aws-sdk/client-ssm](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-ssm), [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) and [aws-cdk](https://github.com/aws/aws-cdk-cli/tree/HEAD/packages/aws-cdk).


Updates `aws-cdk-lib` from 2.258.1 to 2.259.0
- [Release notes](https://github.com/aws/aws-cdk/releases)
- [Changelog](https://github.com/aws/aws-cdk/blob/main/CHANGELOG.v2.alpha.md)
- [Commits](https://github.com/aws/aws-cdk/commits/v2.259.0/packages/aws-cdk-lib)

Updates `@aws-sdk/client-ssm` from 3.1064.0 to 3.1070.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-ssm/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1070.0/clients/client-ssm)

Updates `@types/node` from 25.9.2 to 25.9.3
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `aws-cdk` from 2.1126.0 to 2.1127.0
- [Release notes](https://github.com/aws/aws-cdk-cli/releases)
- [Commits](https://github.com/aws/aws-cdk-cli/commits/aws-cdk@v2.1127.0/packages/aws-cdk)

---
updated-dependencies:
- dependency-name: aws-cdk-lib
  dependency-version: 2.259.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@aws-sdk/client-ssm"
  dependency-version: 3.1070.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@types/node"
  dependency-version: 25.9.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: aws-cdk
  dependency-version: 2.1127.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-17 11:15:33 -04:00
dependabot[bot]
fae171f907 Bump esbuild from 0.28.0 to 0.28.1 (#36) 
Bumps [esbuild](https://github.com/evanw/esbuild) from 0.28.0 to 0.28.1.
- [Release notes](https://github.com/evanw/esbuild/releases)
- [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG.md)
- [Commits](https://github.com/evanw/esbuild/compare/v0.28.0...v0.28.1)

---
updated-dependencies:
- dependency-name: esbuild
  dependency-version: 0.28.1
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-16 17:20:25 -04:00
Adam Moussa
1edf1c8b93 Repo hygiene: PR labeler + README badges (INFRA-56/57) (#35) 2026-06-11 14:13:45 -04:00