Commit Graph

56 Commits

Author SHA1 Message Date
Jeremy
9527333b78 Merge branch 'development' into renovate/actions-attest-sbom-3.x 2026-01-02 22:24:23 -05:00
Jeremy
d25712aad1 Merge pull request #464 from Wikid82/renovate/anchore-sbom-action-0.x
chore(deps): update anchore/sbom-action action to v0.21.0
2026-01-02 22:23:43 -05:00
renovate[bot]
b328c3d3a5 chore(deps): update actions/attest-sbom action to v3 2026-01-03 03:18:50 +00:00
renovate[bot]
871447d7b7 chore(deps): update anchore/sbom-action action to v0.21.0 2026-01-03 03:18:46 +00:00
renovate[bot]
b856170f70 chore(deps): update actions/attest-sbom action to v2.4.0 2026-01-03 03:18:41 +00:00
Jeremy
5cd578bcb9 Merge branch 'development' into feature/issue-365-additional-security 2025-12-21 23:06:36 -05:00
renovate[bot]
8311d68ddd chore(deps): update docker/setup-buildx-action action to v3.12.0 (#443)
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2025-12-22 04:04:01 +00:00
GitHub Actions
2dfe7ee241 feat: add additional security enhancements (Issue #365)
- Add constant-time token comparison utility (crypto/subtle)
- Add SBOM generation and attestation to CI/CD pipeline
- Document TLS enforcement, DNS security (DoH/DoT), and container hardening
- Create Security Incident Response Plan (SIRP)
- Add security update notification documentation

Security enhancements:
- Mitigates timing attacks on invite token validation
- Provides supply chain transparency with CycloneDX SBOM
- Documents production container hardening (read_only, cap_drop)

Closes #365
2025-12-21 19:00:29 +00:00
GitHub Actions
af8384046c chore: implement instruction compliance remediation
- Replace Go interface{} with any (Go 1.18+ standard)
- Add database indexes to frequently queried model fields
- Add JSDoc documentation to frontend API client methods
- Remove deprecated docker-compose version keys
- Add concurrency groups to all 25 GitHub Actions workflows
- Add YAML front matter and fix H1→H2 headings in docs

Coverage: Backend 85.5%, Frontend 87.73%
Security: No vulnerabilities detected

Refs: docs/plans/instruction_compliance_spec.md
2025-12-21 04:08:42 +00:00
GitHub Actions
fd9d09b341 fix: add timeouts to Docker container run and CrowdSec hub update for improved reliability 2025-12-19 18:55:48 +00:00
GitHub Actions
193ba124c7 fix: correct extraction of expr-lang version from caddy_deps.txt 2025-12-18 00:17:12 +00:00
GitHub Actions
ed7dc3f904 fix: update regex for expr-lang version check to ensure accurate vulnerability assessment 2025-12-18 00:05:31 +00:00
GitHub Actions
761d59c7e9 fix: add timeout to Caddy version verification step to prevent hangs 2025-12-17 23:58:40 +00:00
GitHub Actions
bc23eb3800 fix: add timeout to integration tests to prevent CI hangs
- Add timeout-minutes: 5 to docker-build.yml integration test step
- Add set -o pipefail to integration-test.sh
- Add 4-minute timeout wrapper (INTEGRATION_TEST_TIMEOUT env var)

Resolves hang after Caddy TLS cleanup in GitHub Actions run #20319807650
2025-12-17 23:41:27 +00:00
GitHub Actions
76895a9674 fix: load Docker image for PR events to resolve CI failure 2025-12-17 22:52:56 +00:00
GitHub Actions
6d18854e92 fix: use PR number instead of ref_name for Docker image tags
GitHub's github.ref_name returns "421/merge" for PR merge refs,
creating invalid Docker tags like "pr-421/merge". Docker tags
cannot contain forward slashes.

Changed to use github.event.pull_request.number which returns
just the PR number (e.g., "421") for valid tags like "pr-421".

Fixes CI/CD failure in PR #421.
2025-12-17 20:00:44 +00:00
GitHub Actions
942901fb9a fix: remove Caddy version check that hangs build (CVE-2025-68156) 2025-12-17 18:37:20 +00:00
renovate[bot]
793315336a chore(deps): update github/codeql-action action to v4.31.9 2025-12-17 14:25:51 +00:00
GitHub Actions
cb5bd01a93 fix: add pull:true to docker-build to ensure fresh base images
Ensures all Docker builds pull fresh Alpine base images to get
security patches like c-ares 1.34.6-r0 (CVE-2025-62408).

This mirrors the change made to security-weekly-rebuild.yml.
2025-12-14 06:18:42 +00:00
renovate[bot]
8752173a95 chore(deps): update github/codeql-action action to v4.31.8 (#357)
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2025-12-12 16:40:00 +00:00
GitHub Actions
733875d1d9 ci(docker): normalize IMAGE_NAME reliably to avoid invalid tags 2025-12-09 14:48:27 +00:00
GitHub Actions
cf747cc5f5 feat(ci): add Docker build, publish, and test workflow for feature/beta-release branch 2025-12-09 14:46:42 +00:00
Jeremy
8c9e04d458 ci: add minimal docker-build workflow (placeholder) to satisfy code scanning config discovery for feature/beta-release 2025-12-09 09:39:32 -05:00
Wikid82
6ba87eb121 fix: rename workflow to Docker Build, Publish & Test and enhance image testing steps 2025-11-21 09:55:46 -05:00
renovate[bot]
0369e51918 chore(deps): update actions/checkout action to v6 2025-11-20 16:37:52 +00:00
Wikid82
f166007e3f fix: update RequireAuth component to accept ReactNode as children type 2025-11-20 01:22:48 -05:00
Jeremy
f7bbce10e8 Merge pull request #138 from Wikid82/renovate/github-codeql-action-4.x
chore(deps): update github/codeql-action action to v4
2025-11-19 23:31:04 -05:00
renovate[bot]
f09cb19108 chore(deps): update github/codeql-action action to v4 2025-11-20 04:28:47 +00:00
renovate[bot]
36e4730a2f chore(deps): update docker/build-push-action action to v6 2025-11-20 04:28:42 +00:00
Wikid82
6471e24f11 feat: Add GitHub Actions workflows for Docker build, publish, documentation deployment, and quality checks
- Implemented `docker-build.yml` for building and pushing Docker images with multi-platform support, Trivy security scanning, and conditional builds based on commit messages.
- Created `docker-publish.yml` for streamlined Docker image publishing with Trivy vulnerability scanning on push events.
- Added `docs.yml` to automate documentation deployment to GitHub Pages, including a custom HTML structure and markdown conversion.
- Introduced `propagate-changes.yml` to automate PR creation for synchronizing changes between main, development, and feature branches.
- Established `quality-checks.yml` for running backend (Go) and frontend (React) quality checks, including tests and linting.
- Developed `release.yml` for generating changelogs and creating GitHub releases upon version tag pushes.
- Set up `renovate.yml` for automated dependency updates on a daily schedule.
2025-11-19 22:53:42 -05:00
Wikid82
1e2d87755d Remove Settings and Setup pages along with their tests and related API services
- Deleted Settings.tsx and Setup.tsx pages, which included functionality for changing passwords and setting up an admin account.
- Removed associated test files for Setup page.
- Eliminated API service definitions related to proxy hosts, remote servers, import functionality, and health checks.
- Cleaned up mock data and test setup files.
- Removed configuration files for TypeScript, Vite, and Tailwind CSS.
- Deleted scripts for testing coverage, release management, Dockerfile validation, and Python compilation checks.
- Removed Sourcery pre-commit wrapper script.
2025-11-19 22:53:32 -05:00
Wikid82
1bc6be10a1 fix(ci): add docker login to test-image job in docker-build workflow 2025-11-19 22:38:45 -05:00
Wikid82
00981be8dc fix: CI workflow shell injection vulnerability
- Use environment variables for GitHub context in shell scripts to prevent injection attacks and syntax errors when commit messages contain special characters (e.g. single quotes, ampersands).
- Fixes failure when merging branches with special characters in their names.
2025-11-19 19:59:45 -05:00
renovate[bot]
17672c2b53 chore(deps): update actions/checkout action to v5 2025-11-20 00:45:05 +00:00
Wikid82
50d710ba7b chore: rename project artifacts to CPMP 2025-11-19 18:07:36 -05:00
Jeremy
a28dec399e Merge pull request #94 from Wikid82/renovate/actions-checkout-digest
chore(deps): update actions/checkout digest to 34e1148
2025-11-19 11:52:09 -05:00
renovate[bot]
0474c83782 chore(deps): update actions/checkout digest to 34e1148 2025-11-19 16:47:32 +00:00
renovate[bot]
e5b9ae8a90 chore(deps): pin dependencies 2025-11-19 16:47:27 +00:00
Wikid82
3537dc0084 ci: add GitHub Actions workflow for building and pushing Docker images 2025-11-19 10:19:15 -05:00
Wikid82
7ca6d8f606 ci: streamline workflows, consolidate docker build/publish, add quality checks 2025-11-19 10:13:41 -05:00
Wikid82
de484db648 ci(secrets): migrate GITHUB_TOKEN references to PROJECT_TOKEN secret 2025-11-19 10:07:18 -05:00
Wikid82
069e8112c3 fix(ci): correct indentation for skip summary step in docker-build 2025-11-19 10:03:45 -05:00
Wikid82
1cf07a892a ci: skip heavy docker build/publish for renovate bot and chore(deps)/chore commits 2025-11-19 10:03:40 -05:00
Wikid82
939847e6af ci: robust health check with retries; normalize IMAGE_NAME in publish workflow 2025-11-19 10:03:15 -05:00
Wikid82
0d6fb54370 fix(ci): normalize IMAGE_NAME to lowercase for registry compliance 2025-11-19 10:02:20 -05:00
Wikid82
eec702a335 fix(ci): lowercase IMAGE_NAME in workflows; fix Renovate packageRule (remove matchUpdateTypes from allowedVersions rule) 2025-11-19 09:58:32 -05:00
Wikid82
ae4f03e26e CI: Show Trivy table output before SARIF upload; always upload SARIF; fail late on CRITICAL/HIGH 2025-11-19 09:53:57 -05:00
Wikid82
3111421b92 CI: Pin Caddy base by digest in builds; enforce Trivy fail on CRITICAL/HIGH; pass CADDY_IMAGE build-arg 2025-11-19 09:52:10 -05:00
Wikid82
d65b55144d CI: Generate PR tag via ref_name; skip push & security scan on PR 2025-11-19 09:52:09 -05:00
Wikid82
ffa1bd9af7 CI: Fix Trivy scan refs and guard SARIF upload; use metadata tags for docker-build scan; add outcome gating 2025-11-19 09:52:09 -05:00