The README covered the deployed controls, config inputs, and CI/CD but
never explained that the repo is a CDK app or what cdk.json does. Add a
CDK app section describing the cdk.json entry point, project layout
(bin/app.ts and the lib/ constructs), and the local synth/diff/deploy
workflow so contributors can orient without reading the source.
* ci: add standard labeler caller (INFRA-136)
Adds the org standard callable-labeler thin caller, missing on this repo
(present on 26/28 repos; another symptom of the skipped provisioning
checklist). All three permission grants are load-bearing; omitting one
causes a silent startup_failure.
* Update .github/workflows/labeler.yaml
Co-authored-by: seahaven-openswe[bot] <296972425+seahaven-openswe[bot]@users.noreply.github.com>
---------
Co-authored-by: seahaven-openswe[bot] <296972425+seahaven-openswe[bot]@users.noreply.github.com>
This pure CDK app is built and synthed on Node 24 (no Lambdas), so
@types/node is pinned to ^24. A too-new types major still compiles, so a
major bump passes CI while describing APIs absent at the build Node.
Add a scoped Dependabot ignore for @types/node semver-major bumps so the
alignment can only be broken deliberately, alongside a Node upgrade.
Minor/patch within the major still flow. Sanctioned exception to the
no-blanket-ignore rule (engineering-handbook github-standards Pinning
Principle).
Stripped fork of seahaven-account-baseline for the isolated external-dev
account (396287094661). Single stack: AWS Config, GuardDuty, Security Hub
(FSBP + CIS v3.0), IAM Access Analyzer, VPC flow logs (VPC ids via context),
and a $200/mo budget alerting adam@seahaven.com.
Drops all org-level / prod-specific controls (local CloudTrail, CIS metric
alarms, WAF, SES, Bedrock, DynamoDB CMK, Backup) per the isolated-account
design; the org trail already covers this account centrally. Inspector2 is a
documented post-deploy CLI step (no CloudFormation enable resource exists).
