From 1a2f0658c7a1787c3163cc0a204116632a42865b Mon Sep 17 00:00:00 2001 From: Leo Kacenjar Date: Fri, 26 Jun 2026 08:57:57 -0600 Subject: [PATCH 1/3] Require LOCALSTACK_AUTH_TOKEN for local LocalStack LocalStack's unified image (2026.03.0+) requires an auth token. Pass it through from the environment and fail fast with actionable guidance when it's unset, instead of the cryptic exit-code-55 license error. Co-Authored-By: Claude Opus 4.8 (1M context) --- docker-compose.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/docker-compose.yml b/docker-compose.yml index 78d463fb..d4378ceb 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -4,6 +4,7 @@ services: ports: - "4566:4566" # LocalStack edge port environment: + - LOCALSTACK_AUTH_TOKEN=${LOCALSTACK_AUTH_TOKEN:?LocalStack now requires an auth token. Get one at https://app.localstack.cloud and set LOCALSTACK_AUTH_TOKEN in your shell or a gitignored .env file.} - SERVICES=s3,lambda,logs,secretsmanager - AWS_DEFAULT_REGION=us-east-1 - DOCKER_HOST=unix:///var/run/docker.sock From b701221236da453334b132816d5cf751bf1ffd0c Mon Sep 17 00:00:00 2001 From: Leo Kacenjar Date: Fri, 26 Jun 2026 09:01:20 -0600 Subject: [PATCH 2/3] Dependabot: monitor Python components (pip) Add a pip ecosystem covering all six python_components manifests so their dependencies get update PRs and security alerts, closing the gap where only bundler/npm/actions were watched. Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/dependabot.yml | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index bd831bbf..7a538bec 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -21,3 +21,16 @@ updates: open-pull-requests-limit: 10 cooldown: default-days: 7 +- package-ecosystem: pip + directories: + - "/python_components/accessibility_scan" + - "/python_components/ci" + - "/python_components/classifier" + - "/python_components/crawler" + - "/python_components/document_inference" + - "/python_components/evaluation" + schedule: + interval: daily + open-pull-requests-limit: 10 + cooldown: + default-days: 7 From 04c9666f7210bb122776962de03da8e727aa801f Mon Sep 17 00:00:00 2001 From: Leo Kacenjar Date: Fri, 26 Jun 2026 09:01:20 -0600 Subject: [PATCH 3/3] SES: pin module to v0.25.2 to stop key rotation terraform/modules/ses/main.tf referenced cloudposse/terraform-aws-ses with no version ref (floating HEAD). An older module version created an auto-expiring SMTP access key (awsutils_expiring_iam_access_key, 30-day max_age); current upstream creates a plain non-rotating aws_iam_access_key. The floating ref made plans nondeterministic and triggered an expiring->regular key migration in CI that needs iam:DeleteAccessKey/ CreateAccessKey -- permissions the GitHub Actions role intentionally lacks. Pin to v0.25.2, which uses iam-system-user 1.2.1: a stable, non-rotating access key (iam_create_access_key defaults to true). No max_age knob is needed -- that variable does not exist in v0.25.2. Note: the expiring->regular switch is a one-time replacement requiring privileged IAM creds (not the CI role), and rotates the SMTP credentials, so SMTP_USER/SMTP_PASSWORD in Secrets Manager must be updated from the new key or outbound email breaks. After that single apply, CI deploys go green. Co-Authored-By: Claude Opus 4.8 (1M context) --- terraform/modules/ses/main.tf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/terraform/modules/ses/main.tf b/terraform/modules/ses/main.tf index 92848162..1c56f3ce 100644 --- a/terraform/modules/ses/main.tf +++ b/terraform/modules/ses/main.tf @@ -4,7 +4,7 @@ data "aws_route53_zone" "domain" { module "ses" { name = "${var.project_name}-${var.environment}-ses" - source = "github.com/cloudposse/terraform-aws-ses" + source = "github.com/cloudposse/terraform-aws-ses?ref=v0.25.2" domain = var.domain_name zone_id = data.aws_route53_zone.domain.id verify_domain = true