chore: propagate changes from main into development by github-actions[bot] · Pull Request #1325 · Wikid82/Charon

github-actions · 2026-09-09T12:41:40Z

⚠️ This propagation touches sensitive paths that need manual review before merging: docs/plans/current_spec.md

Automated PR to propagate changes from main into development.

Triggered by push to main.

…ublic registration Claude-Session: https://claude.ai/code/session_01Wm1jzKSdvz2LCusQC2qokM

Claude-Session: https://claude.ai/code/session_01Wm1jzKSdvz2LCusQC2qokM

…subroutes Claude-Session: https://claude.ai/code/session_01JyYXjnztSGFqTELR8KTUXT

Claude-Session: https://claude.ai/code/session_01JyYXjnztSGFqTELR8KTUXT

…n flow Claude-Session: https://claude.ai/code/session_01JyYXjnztSGFqTELR8KTUXT

… guard test Claude-Session: https://claude.ai/code/session_01JyYXjnztSGFqTELR8KTUXT

…stration removal Claude-Session: https://claude.ai/code/session_01JyYXjnztSGFqTELR8KTUXT

Claude-Session: https://claude.ai/code/session_01JyYXjnztSGFqTELR8KTUXT

The planning spec that commits 3055a913..ccc9cdbc were implemented from. Replaces the prior (already-delivered) toolchain-image spec in current_spec.md. Claude-Session: https://claude.ai/code/session_01JyYXjnztSGFqTELR8KTUXT

The shell integration-test scripts under scripts/ bootstrapped their initial admin user by POSTing to the removed public account-creation endpoint, then logging in. With that endpoint gone the login step now returns HTTP 401 and the scripts abort ("Login failed (HTTP 401)"), breaking the Rate Limiting, Cerberus, WAF, CrowdSec and Coraza integration jobs. Switch the bootstrap call in all eight scripts to POST /api/v1/setup, which creates the first user (admin) with an identical request body ({name,email,password}). debug_rate_limit.sh additionally used a 7-character password that fails /setup's min=8 rule, so its setup and matching login body are bumped to an 8-character password. Human-readable "Registering ..." log/comment lines are reworded to "Setting up ...". Existing "|| true" / redirect idempotency handling is preserved so a 403 "Setup already completed" on re-run stays harmless. Claude-Session: https://claude.ai/code/session_01JyYXjnztSGFqTELR8KTUXT

`development` carries c32e611 (gRPC 1.83.2), a toolchain-key input that `main` does not have yet, so the toolchain pin propagated into `development` by #1307 (caddy-crowdsec-1efe7f19fa52a512 @ sha256:6575f4c6…, computed for main's gRPC 1.83.1 recipe) is stale here: the recipe on this branch recomputes to caddy-crowdsec-9eb9862f44b9e769, failing verify-toolchain-pin. Bumps the two ARG lines to the key/digest that match development's recipe. This is the manual equivalent of the daily open-bump-pr bot (now using the chore(docker): convention). Verified on this branch: - scripts/toolchain-key.sh -> caddy-crowdsec-9eb9862f44b9e769 - imagetools inspect <that tag> -> sha256:b41e571d5951bbfc3daa3dccdca033ad9dee535a8e720ac7e3b0bce338f223b2 Claude-Session: https://claude.ai/code/session_01KXA4x9LrA2AsnLrvdHMZbS

… public registration (#1316)

…p split The management-API authorization hardening changed RemoteServerHandler.RegisterRoutes to a (read, admin *gin.RouterGroup) split, adding lines above Update() and shifting the suppressed logger.Log()...Warn() sink in remote_server_handler.go from line 142 to ~148. The exact-line suppression entry no longer matched, so the findings-gate counted the (unchanged, still-false-positive) go/log-injection result as blocking on the full-tree scan run by the main->development propagation PR. Widen the entry to a line_range (146-150), mirroring the existing uptime_service.go sibling entry that hit the same drift, so the multi-line log chain stays covered regardless of which line CodeQL anchors to. No code or behavior change. Claude-Session: https://claude.ai/code/session_01Jz4LgwfkxaF8E7TdAgk94y

…p split (#1321)

… branch The daily schedule / weekly workflow_call runs of toolchain-image.yml checked out the default branch (main) and computed the toolchain key from main's recipe, then compared it against main's Dockerfile pin. On main those always match, so open-bump-pr's 'did the pin move?' check was never true and no bot PR was opened — even though open-bump-pr targets 'base: development' and development accumulates its own Dockerfile ARG bumps (x/net, x/crypto, ...) that shift the toolchain key independently of main. Result: development-side toolchain-pin drift had no automated detection or repair path. It only surfaced when a main -> development propagation PR ran verify-toolchain-pin against the merge recipe (e.g. #1320/#1322), by which point the pin was already stale on the branch and no bot PR existed to fix it. Pin the build-toolchain, trivy-scan and open-bump-pr checkouts to 'development' on every non-pull_request trigger (schedule / workflow_dispatch / the weekly rebuild's workflow_call). pull_request runs keep the default merge-ref checkout. sync-pin-on-pr is unchanged (PR-only, already checks out the PR head; still guarded off for main/development/nightly/beta head refs). Claude-Session: https://claude.ai/code/session_01Jz4LgwfkxaF8E7TdAgk94y

… branch (#1323)

github-advanced-security · 2026-09-09T12:41:42Z

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

codecov · 2026-09-09T13:07:44Z

Codecov Report

❌ Patch coverage is 99.01961% with 1 line in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
...end/internal/api/handlers/remote_server_handler.go	87.50%	1 Missing ⚠️

📢 Thoughts on this report? Let us know!

github-actions · 2026-09-09T13:09:54Z

✅ Supply Chain Verification Results

✅ PASSED

📦 SBOM Summary

Components: 1769

🔍 Vulnerability Scan

Severity	Count
🔴 Critical	0
🟠 High	0
🟡 Medium	0
🟢 Low	0
Total	0

📎 Artifacts

SBOM (CycloneDX JSON) and Grype results available in workflow artifacts

_{Generated by Supply Chain Verification workflow • View Details}

Wikid82 · 2026-09-09T13:53:05Z

Superseded by #1322. This auto-generated draft has head: main, so sync-pin-on-pr can't reconcile the toolchain pin on it, and it now conflicts with development after #1326 changed the Dockerfile. #1322 (head on a topic branch, non-draft, verify-toolchain-pin green, carries #1326's recipe fix + matching pin) is the propagation PR to merge.

Wikid82 and others added 20 commits September 8, 2026 21:33

test: add fixme e2e specs for privileged-route authz and removal of p…

7e816a5

…ublic registration Claude-Session: https://claude.ai/code/session_01Wm1jzKSdvz2LCusQC2qokM

fix(security): tighten authorization checks on privileged API routes

6db813b

Claude-Session: https://claude.ai/code/session_01Wm1jzKSdvz2LCusQC2qokM

fix(security): apply deny-by-default authorization on management API …

8f5b1bf

…subroutes Claude-Session: https://claude.ai/code/session_01JyYXjnztSGFqTELR8KTUXT

fix(security): reduce unauthenticated API surface

8a1f5df

Claude-Session: https://claude.ai/code/session_01JyYXjnztSGFqTELR8KTUXT

docs: document management-API authorization model and account-creatio…

8eb20bd

…n flow Claude-Session: https://claude.ai/code/session_01JyYXjnztSGFqTELR8KTUXT

refactor(security): tidy authorization hardening and add self-service…

337f53e

… guard test Claude-Session: https://claude.ai/code/session_01JyYXjnztSGFqTELR8KTUXT

test: enable e2e coverage for privileged-route authorization and regi…

b58bd52

…stration removal Claude-Session: https://claude.ai/code/session_01JyYXjnztSGFqTELR8KTUXT

docs: add qa security report for management-API authorization hardening

c8acaf1

Claude-Session: https://claude.ai/code/session_01JyYXjnztSGFqTELR8KTUXT

docs: record management-API authorization hardening plan

887194e

The planning spec that commits 3055a913..ccc9cdbc were implemented from. Replaces the prior (already-delivered) toolchain-image spec in current_spec.md. Claude-Session: https://claude.ai/code/session_01JyYXjnztSGFqTELR8KTUXT

fix(deps): update gRPC version to 1.83.2

01a6a5c

fix(security): enforce admin authorization on management API + retire…

8168732

… public registration (#1316)

chore(main): release 0.40.2

8583987

chore(main): release 0.40.2 (#1319)

cb7bdbe

chore: re-anchor go/log-injection CodeQL suppression after route-grou…

bda03ce

…p split (#1321)

fix(ci): toolchain rebuild bot evaluates development, not the default…

07dc08d

… branch (#1323)

chore(main): release 0.40.3

e1788a9

github-actions Bot added the auto-propagate label Sep 9, 2026

Wikid82 temporarily deployed to github-pages September 9, 2026 12:41 — with GitHub Actions Inactive

chore(main): release 0.40.3 (#1324)

0a72b93

Wikid82 deployed to github-pages September 9, 2026 13:16 — with GitHub Actions View deployment

Wikid82 closed this Sep 9, 2026

Navigation Menu

Uh oh!

chore: propagate changes from main into development - #1325

chore: propagate changes from main into development#1325
github-actions[bot] wants to merge 21 commits into
developmentfrom
main

github-actions Bot commented Sep 9, 2026

Uh oh!

github-advanced-security AI commented Sep 9, 2026

Uh oh!

codecov Bot commented Sep 9, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Sep 9, 2026

Uh oh!

Wikid82 commented Sep 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

github-actions Bot commented Sep 9, 2026

Uh oh!

github-advanced-security AI commented Sep 9, 2026

What Enabling Code Scanning Means:

Uh oh!

codecov Bot commented Sep 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

github-actions Bot commented Sep 9, 2026

✅ Supply Chain Verification Results

📦 SBOM Summary

🔍 Vulnerability Scan

📎 Artifacts

Uh oh!

Wikid82 commented Sep 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

codecov Bot commented Sep 9, 2026 •

edited

Loading