Adam Moussa
e8f241712a
ci: add merge_group trigger for required ci / ci ( #114 )
Deploy / deploy-management (push) Waiting to run
Deploy / deploy-external-dev (push) Waiting to run
Deploy / deploy-security (push) Waiting to run
Deploy / deploy-dev (push) Waiting to run
Deploy / deploy-prod (push) Waiting to run
2026-08-21 17:41:38 -04:00
dependabot[bot]
9f7b7d522e
chore(deps): bump ci-typescript-cdk.yaml from 1.0.6 to 1.0.7
...
Bumps [Sea-Haven-Industries/.github/.github/workflows/ci-typescript-cdk.yaml](https://github.com/sea-haven-industries/.github ) from 1.0.6 to 1.0.7.
- [Release notes](https://github.com/sea-haven-industries/.github/releases )
- [Commits](7ac3528750...e5691d8a7f
2026-08-14 20:28:36 -04:00
dependabot[bot]
775f9a5809
chore(deps): bump Sea-Haven-Industries/.github/.github/workflows/ci-typescript-cdk.yaml ( #92 )
...
Bumps [Sea-Haven-Industries/.github/.github/workflows/ci-typescript-cdk.yaml](https://github.com/sea-haven-industries/.github ) from 1.0.3 to 1.0.6.
- [Release notes](https://github.com/sea-haven-industries/.github/releases )
- [Commits](3f74677422...7ac3528750
2026-08-07 19:29:12 +00:00
dependabot[bot]
c73680207a
build(deps): bump Sea-Haven-Industries/.github/.github/workflows/ci-typescript-cdk.yaml ( #70 )
...
Bumps [Sea-Haven-Industries/.github/.github/workflows/ci-typescript-cdk.yaml](https://github.com/sea-haven-industries/.github ) from 1.0.2 to 1.0.3.
- [Release notes](https://github.com/sea-haven-industries/.github/releases )
- [Commits](0170a57c0d...3f74677422
2026-08-01 20:17:55 -04:00
Adam Moussa
935b5ffb5a
ci(deps): pin org reusable workflows to v1.0.2
2026-07-28 17:57:16 -04:00
Adam Moussa
cc54b1e28b
chore(security): add explicit workflow permissions and bump aws-cdk-lib to 2.262.0 ( #56 )
...
Deploy / deploy-management (push) Waiting to run
Deploy / deploy-external-dev (push) Waiting to run
Deploy / deploy-security (push) Waiting to run
Deploy / deploy-dev (push) Waiting to run
Deploy / deploy-prod (push) Waiting to run
* docs: update aws profile specified in script (local renaming)
* ci: add least-privilege permissions blocks to workflow callers
Resolves code scanning alerts #3 and #4 (actions/missing-workflow-permissions). Both callable workflows only need contents: read; the dependency-review callable already declares it internally, this caps the caller token to match."
* chore(deps): bump aws-cdk-lib to 2.262.0 for patched brace-expansion
Resolves Dependabot alert #4 (CVE-2026-13149, exponential-time DoS in brace-expansion expand()). The vulnerable 5.0.6 is a bundled dependency inside the aws-cdk-lib tarball, so it cannot be updated independently; 2.262.0 bundles the patched 5.0.7.
Also migrates Stack#addDependency to addStackDependency (deprecated in this release) in bin/app.ts.
2026-07-23 17:38:17 +00:00
Adam Moussa
6ce8b96b22
chore(ci): SHA-pin org reusable-workflow caller refs (INFRA-50) ( #35 )
2026-07-06 18:27:41 -04:00
Adam Moussa
dc079edb93
Initial account-baseline stack with CloudTrail (audit C-1)
...
Multi-region CloudTrail with log-file validation, a rotating KMS CMK, an
Object-Lock'd S3 log bucket, and CloudWatch Logs delivery. First resident of
the account-level security baseline; AWS Backup / 3-2-1 (C-7) lands alongside.
IAM/KMS/S3 policies cross-reviewed; review caught a missing CloudTrail KMS
grant, now added (SourceArn + encryption-context scoped).
2026-05-29 17:44:55 -04:00
