Adam Moussa
c43bee214c
feat(terraform): add hcp terraform for prod door-unlock-api (PLAT-76) ( #81 )
...
* feat(terraform): add hcp terraform for prod door-unlock-api
Move deploy off frozen CDK CD onto an HCP workspace that recreates the HTTP API, five Lambdas, disabled EventBridge rules, and alarms in seahaven-prod without a poller VPC.
* docs(readme): link the door unlock api ops page
* fix(terraform): invoke package build via bash
HCP launches the external data source with bash, so the inner build script should not depend on the git executable bit.
2026-08-27 22:03:12 +00:00
Adam Moussa
6481f0c23a
chore(deps): remove dependabot version updates ( #79 )
...
Renovate is the version-update bot. GitHub Dependabot alerts stay.
2026-08-25 11:51:15 -04:00
renovate[bot]
39013e8a65
chore(deps): update sea-haven-industries/.github action to v1.0.8 ( #77 )
2026-08-25 15:42:11 +00:00
Adam Moussa
fe89bc6649
chore(ci): remove pr policy workflow caller ( #74 )
Deploy / deploy (push) Waiting to run
2026-08-24 15:12:36 -04:00
Adam Moussa
fd459b12b6
chore(ci): switch auto-merge from seahaven-bot to Mergify ( #73 )
Deploy / deploy (push) Waiting to run
2026-08-24 13:53:15 -04:00
Adam Moussa
a00730675a
ci: enable squash auto-merge on ready PRs (PLAT-108) ( #71 )
...
Deploy / deploy (push) Has been cancelled
* ci: enable squash auto-merge on ready PRs
* fix(ci): serialize auto-merge enable and ignore already-enabled
2026-08-21 23:34:40 +00:00
Adam Moussa
0929d2fb6c
ci: add merge_group trigger for required ci / ci ( #70 )
Deploy / deploy (push) Waiting to run
2026-08-21 17:42:31 -04:00
dependabot[bot]
fea155279a
chore(deps): bump the minor-and-patch group with 4 updates ( #68 )
...
Bumps the minor-and-patch group with 4 updates: [Sea-Haven-Industries/.github/.github/workflows/ci-typescript-cdk.yaml](https://github.com/sea-haven-industries/.github ), [Sea-Haven-Industries/.github/.github/workflows/callable-dependency-review.yaml](https://github.com/sea-haven-industries/.github ), [Sea-Haven-Industries/.github/.github/workflows/cd-cdk.yaml](https://github.com/sea-haven-industries/.github ) and [Sea-Haven-Industries/.github/.github/workflows/callable-labeler.yaml](https://github.com/sea-haven-industries/.github ).
Updates `Sea-Haven-Industries/.github/.github/workflows/ci-typescript-cdk.yaml` from 1.0.6 to 1.0.7
- [Release notes](https://github.com/sea-haven-industries/.github/releases )
- [Commits](7ac3528750...e5691d8a7fhttps://github.com/sea-haven-industries/.github/releases )
- [Commits](7ac3528750...e5691d8a7fhttps://github.com/sea-haven-industries/.github/releases )
- [Commits](7ac3528750...e5691d8a7fhttps://github.com/sea-haven-industries/.github/releases )
- [Commits](7ac3528750...e5691d8a7f
2026-08-18 13:14:22 -04:00
dependabot[bot]
d650b4b945
chore(deps): bump the minor-and-patch group ( #66 )
...
Deploy / deploy (push) Has been cancelled
Bumps the minor-and-patch group with 5 updates in the / directory:
| Package | From | To |
| --- | --- | --- |
| [Sea-Haven-Industries/.github/.github/workflows/ci-typescript-cdk.yaml](https://github.com/sea-haven-industries/.github ) | `1.0.3` | `1.0.6` |
| [Sea-Haven-Industries/.github/.github/workflows/callable-dependency-review.yaml](https://github.com/sea-haven-industries/.github ) | `1.0.3` | `1.0.6` |
| [Sea-Haven-Industries/.github/.github/workflows/cd-cdk.yaml](https://github.com/sea-haven-industries/.github ) | `1.0.3` | `1.0.6` |
| [Sea-Haven-Industries/.github/.github/workflows/callable-labeler.yaml](https://github.com/sea-haven-industries/.github ) | `1.0.3` | `1.0.6` |
| [Sea-Haven-Industries/.github/.github/workflows/callable-pr-policy.yaml](https://github.com/sea-haven-industries/.github ) | `1.0.5` | `1.0.6` |
Updates `Sea-Haven-Industries/.github/.github/workflows/ci-typescript-cdk.yaml` from 1.0.3 to 1.0.6
- [Release notes](https://github.com/sea-haven-industries/.github/releases )
- [Commits](3f74677422...7ac3528750https://github.com/sea-haven-industries/.github/releases )
- [Commits](3f74677422...7ac3528750https://github.com/sea-haven-industries/.github/releases )
- [Commits](3f74677422...7ac3528750https://github.com/sea-haven-industries/.github/releases )
- [Commits](3f74677422...7ac3528750https://github.com/sea-haven-industries/.github/releases )
- [Commits](9c1ecf9428...7ac3528750
2026-08-11 12:00:24 -04:00
Adam Moussa
67a577bf90
ci: update PR policy workflow to v1.0.7 ( #67 )
...
Signed-off-by: Adam Moussa <adam@seahavenind.com>
2026-08-11 11:42:41 -04:00
1e0ed68a11
ci: add org PR policy caller
...
Refs: PLAT-62
2026-08-11 11:15:08 -04:00
dependabot[bot]
ab7dd977ac
build(deps): bump the minor-and-patch group with 4 updates ( #62 )
...
Deploy / deploy (push) Has been cancelled
Bumps the minor-and-patch group with 4 updates: [Sea-Haven-Industries/.github/.github/workflows/ci-typescript-cdk.yaml](https://github.com/sea-haven-industries/.github ), [Sea-Haven-Industries/.github/.github/workflows/callable-dependency-review.yaml](https://github.com/sea-haven-industries/.github ), [Sea-Haven-Industries/.github/.github/workflows/cd-cdk.yaml](https://github.com/sea-haven-industries/.github ) and [Sea-Haven-Industries/.github/.github/workflows/callable-labeler.yaml](https://github.com/sea-haven-industries/.github ).
Updates `Sea-Haven-Industries/.github/.github/workflows/ci-typescript-cdk.yaml` from 1.0.2 to 1.0.3
- [Release notes](https://github.com/sea-haven-industries/.github/releases )
- [Commits](0170a57c0d...3f74677422https://github.com/sea-haven-industries/.github/releases )
- [Commits](0170a57c0d...3f74677422https://github.com/sea-haven-industries/.github/releases )
- [Commits](0170a57c0d...3f74677422https://github.com/sea-haven-industries/.github/releases )
- [Commits](0170a57c0d...3f74677422
2026-08-04 11:02:19 -04:00
Adam Moussa
3787a82eb1
ci(deps): pin org reusable workflows to v1.0.2 ( #61 )
...
Deploy / deploy (push) Has been cancelled
* ci(deps): pin org reusable workflows to v1.0.2
* style(ci): normalize workflow block spacing
2026-07-28 18:16:43 -04:00
Adam Moussa
211a00a013
chore(security): resolve open dependabot and code scanning alerts ( #59 )
...
Deploy / deploy (push) Has been cancelled
* ci: add least-privilege permissions blocks to workflow callers
Resolves code scanning alerts #3 and #4 (actions/missing-workflow-permissions). Both callable workflows only need contents: read; the dependency-review callable already declares it internally, this caps the caller token to match.
Signed-off-by: Adam Moussa <adam@seahavenind.com>
* build(deps): bump aws-cdk-lib to 2.262.0 to patch brace-expansion
aws-cdk-lib 2.261.0 bundles brace-expansion 5.0.6, which is vulnerable to CVE-2026-13149 (GHSA-3jxr-9vmj-r5cp), an exponential-time DoS in expand(). This was the only path pulling the vulnerable package into the tree. 2.262.0 vendors the patched 5.0.7, resolving Dependabot alert 7.
Because brace-expansion arrives bundled inside the aws-cdk-lib tarball rather than resolved by npm, the aws-cdk-lib bump is the only way to move it.
Signed-off-by: Adam Moussa <adam@seahavenind.com>
* refactor(cdk): drop unreferenced ssm value parameters
fromStringParameterName injects an AWS::SSM::Parameter::Value
CloudFormation parameter to carry the parameter's value, but DoorId
and PhoneIps are only used for grantRead, which builds the ARN from
the name string — so DoorIdParameter and PhoneIpsParameter sat
unreferenced in the template (flagged W2001 by the CloudFormation
validator newly bundled in aws-cdk-lib 2.262.0).
Switching to fromStringParameterAttributes with forceDynamicReference
resolves the value lazily via an SSM dynamic reference, emitting
nothing when unused. Verified the synthesized template is identical
apart from the removed Parameters entries and the CDKMetadata
analytics hash — no IAM or resource changes.
Also re-points the four line-keyed semgrep detect-child-process
suppressions (adjudicated FPs, INFRA-105) to the shifted line
numbers; the findings themselves are unchanged.
Signed-off-by: Adam Moussa <adam@seahavenind.com>
---------
Signed-off-by: Adam Moussa <adam@seahavenind.com>
2026-07-23 20:24:23 +00:00
Adam Moussa
dec88eac5d
ci: add github-actions to dependabot coverage (INFRA-130) ( #51 )
Deploy / deploy (push) Waiting to run
2026-07-08 16:53:48 -04:00
Adam Moussa
097b8a3fbf
chore(ci): SHA-pin org reusable-workflow caller refs (INFRA-50) ( #49 )
Deploy / deploy (push) Waiting to run
2026-07-06 18:27:54 -04:00
seahaven-openswe[bot]
3e869ff373
chore: upgrade Lambda runtime nodejs22.x to nodejs24.x ( #45 )
2026-07-04 01:25:45 -04:00
Adam Moussa
769c712bcb
Pin @types/node to runtime major (Node 22) ( #41 )
...
The Lambdas in this stack run on the nodejs22.x runtime, but @types/node
had drifted to ^25 via Dependabot. A too-new types major still compiles,
so the mismatch passed CI while describing APIs absent at runtime.
Repin to ^22 to match the Lambda runtime and add a scoped Dependabot
ignore for @types/node semver-major bumps so the alignment can only be
broken deliberately, alongside a runtime upgrade. Minor/patch within the
major still flow. Sanctioned exception to the no-blanket-ignore rule
(engineering-handbook github-standards Pinning Principle).
2026-06-24 15:01:13 -04:00
Adam Moussa
1edf1c8b93
Repo hygiene: PR labeler + README badges (INFRA-56/57) ( #35 )
2026-06-11 14:13:45 -04:00
Adam Moussa
1a3eb51628
chore(deps): remove blanket aws-cdk-lib dependabot ignore ( #27 )
...
Per handbook Pinning Principle: exact pins are kept current by Dependabot version updates gated by CI + dependency review. Blanket ignores let pins rot (see today's fast-uri incident).
2026-06-05 13:56:52 -04:00
Adam Moussa
912a860462
fix(deps): pin aws-cdk-lib to ==2.257.0 ( #26 )
...
* fix(deps): re-pin aws-cdk-lib to ==2.253.1
* fix(deps): pin aws-cdk-lib to 2.257.0 (exact)
2026-06-05 13:01:30 -04:00
Adam Moussa
118ea41e87
Add dependency-review caller workflow ( #25 )
...
* Add dependency-review caller workflow
Add a pull_request-triggered caller that invokes the org-level
callable-dependency-review workflow to scan dependency changes and
fail on high-severity advisories.
* chore: retrigger checks
* chore: retrigger dep review (post-fix)
* chore: add .env to .gitignore
2026-06-05 12:34:08 -04:00
Adam Moussa
b5e75f8306
Add GitHub Actions deploy workflow ( #18 )
...
* Add GitHub Actions deploy workflow (OIDC)
* Add permissions block for OIDC token exchange
* Add concurrency control to prevent parallel deploys
2026-05-08 17:08:22 -04:00
Adam Moussa
c3d1c399f2
Add CI workflow ( #17 )
...
* Add CI workflow
* Fix TypeScript compilation for CI
Add types: ["node"] to tsconfig so tsc resolves Node.js globals
(console, process, __dirname). Add @aws-sdk/client-ssm and
source-map-support as devDependencies for type resolution.
2026-05-08 16:03:06 -04:00
Adam Moussa
1849d3db50
Update Dependabot: remove assignees, group minor/patch updates ( #15 )
2026-05-08 14:23:20 -04:00
Adam Moussa
222e6fd49d
Remove wrapper workflow — using required workflow via org ruleset ( #14 )
2026-05-06 19:59:02 -04:00
Adam Moussa
07f81be535
Add Claude Code review workflow ( #13 )
2026-05-06 18:12:11 -04:00
Adam Moussa
23c860187f
Auto-assign Dependabot PRs to amoussa1229
2026-05-02 17:26:13 -04:00
Adam Moussa
e7b4ae272b
Add Dependabot version update configuration
2026-05-02 17:14:19 -04:00
