Начало Каталог Помощ
Вход
efren
/
d-OAuth-Server
1
0
Разклонения 0
Файлове Задачи 0 Заявки за сливане 0 Уики
Преглед на файлове

Updated components

Efren Yevale Varela преди 3 седмици
родител
c6dc019772
ревизия
3ad38f73cc
променени са 9 файла, в които са добавени 69 реда и са изтрити 52 реда
Обединен изглед Покажи статистика за разликите
  1. 1 1
      .github/workflows/cflite_batch.yml
  2. 1 1
      .github/workflows/cflite_pr.yml
  3. 26 26
      .github/workflows/ci.yml
  4. 2 2
      .github/workflows/docs.yml
  5. 26 15
      .github/workflows/supply-chain.yml
  6. 1 1
      Dockerfile
  7. 2 1
      RUNBOOK.md
  8. 9 4
      docs/DEPLOYMENT.md
  9. 1 1
      docs/SECURITY.md

+ 1 - 1
.github/workflows/cflite_batch.yml
Целия файл 

@@ -20,7 +20,7 @@ jobs:
 
     name: batch-fuzz
 
     name: batch-fuzz
 
     runs-on: ubuntu-24.04
 
     runs-on: ubuntu-24.04
 
     steps:
 
     steps:
 
-      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
 
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Build fuzzers
 
       - name: Build fuzzers
 
         uses: google/clusterfuzzlite/actions/build_fuzzers@884713a6c30a92e5e8544c39945cd7cb630abcd1 # v1
 
         uses: google/clusterfuzzlite/actions/build_fuzzers@884713a6c30a92e5e8544c39945cd7cb630abcd1 # v1
 
         with:
 
         with:

+ 1 - 1
.github/workflows/cflite_pr.yml
Целия файл 

@@ -17,7 +17,7 @@ jobs:
 
     name: pr-fuzz
 
     name: pr-fuzz
 
     runs-on: ubuntu-24.04
 
     runs-on: ubuntu-24.04
 
     steps:
 
     steps:
 
-      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
 
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Build fuzzers
 
       - name: Build fuzzers
 
         uses: google/clusterfuzzlite/actions/build_fuzzers@884713a6c30a92e5e8544c39945cd7cb630abcd1 # v1
 
         uses: google/clusterfuzzlite/actions/build_fuzzers@884713a6c30a92e5e8544c39945cd7cb630abcd1 # v1
 
         with:
 
         with:

+ 26 - 26
.github/workflows/ci.yml
Целия файл 

@@ -57,7 +57,7 @@ jobs:
 
     name: fmt
 
     name: fmt
 
     runs-on: ubuntu-24.04
 
     runs-on: ubuntu-24.04
 
     steps:
 
     steps:
 
-      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
 
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - uses: dtolnay/rust-toolchain@686976e191b89faba57d3206551f0f330d8cb249 # stable
 
       - uses: dtolnay/rust-toolchain@686976e191b89faba57d3206551f0f330d8cb249 # stable
 
         with:
 
         with:
 
           components: rustfmt
 
           components: rustfmt
 
@@ -70,12 +70,12 @@ jobs:
 
     env:
 
     env:
 
       RUSTC_WRAPPER: sccache
 
       RUSTC_WRAPPER: sccache
 
     steps:
 
     steps:
 
-      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
 
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - uses: dtolnay/rust-toolchain@686976e191b89faba57d3206551f0f330d8cb249 # stable
 
       - uses: dtolnay/rust-toolchain@686976e191b89faba57d3206551f0f330d8cb249 # stable
 
         with:
 
         with:
 
           components: clippy
 
           components: clippy
 
       - name: Cache sccache directory
 
       - name: Cache sccache directory
 
-        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5
 
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
 
         with:
 
         with:
 
           path: ${{ env.SCCACHE_DIR }}
 
           path: ${{ env.SCCACHE_DIR }}
 
           key: sccache-${{ runner.os }}-${{ hashFiles('Cargo.lock', 'fuzz/Cargo.lock') }}
 
           key: sccache-${{ runner.os }}-${{ hashFiles('Cargo.lock', 'fuzz/Cargo.lock') }}
 
@@ -92,7 +92,7 @@ jobs:
 
     name: audit
 
     name: audit
 
     runs-on: ubuntu-24.04
 
     runs-on: ubuntu-24.04
 
     steps:
 
     steps:
 
-      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
 
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - uses: dtolnay/rust-toolchain@686976e191b89faba57d3206551f0f330d8cb249 # stable
 
       - uses: dtolnay/rust-toolchain@686976e191b89faba57d3206551f0f330d8cb249 # stable
 
       - name: Install cargo-audit
 
       - name: Install cargo-audit
 
         uses: taiki-e/install-action@ab6895351a88b908e96a4697860d4ffea5e57dbe # v2
 
         uses: taiki-e/install-action@ab6895351a88b908e96a4697860d4ffea5e57dbe # v2
 
@@ -105,7 +105,7 @@ jobs:
 
     name: deny
 
     name: deny
 
     runs-on: ubuntu-24.04
 
     runs-on: ubuntu-24.04
 
     steps:
 
     steps:
 
-      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
 
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - uses: dtolnay/rust-toolchain@686976e191b89faba57d3206551f0f330d8cb249 # stable
 
       - uses: dtolnay/rust-toolchain@686976e191b89faba57d3206551f0f330d8cb249 # stable
 
       - name: Install cargo-deny
 
       - name: Install cargo-deny
 
         uses: taiki-e/install-action@ab6895351a88b908e96a4697860d4ffea5e57dbe # v2
 
         uses: taiki-e/install-action@ab6895351a88b908e96a4697860d4ffea5e57dbe # v2
 
@@ -134,10 +134,10 @@ jobs:
 
           --health-timeout 5s
 
           --health-timeout 5s
 
           --health-retries 10
 
           --health-retries 10
 
     steps:
 
     steps:
 
-      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
 
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - uses: dtolnay/rust-toolchain@686976e191b89faba57d3206551f0f330d8cb249 # stable
 
       - uses: dtolnay/rust-toolchain@686976e191b89faba57d3206551f0f330d8cb249 # stable
 
       - name: Cache sccache directory
 
       - name: Cache sccache directory
 
-        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5
 
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
 
         with:
 
         with:
 
           path: ${{ env.SCCACHE_DIR }}
 
           path: ${{ env.SCCACHE_DIR }}
 
           key: sccache-${{ runner.os }}-${{ hashFiles('Cargo.lock', 'fuzz/Cargo.lock') }}
 
           key: sccache-${{ runner.os }}-${{ hashFiles('Cargo.lock', 'fuzz/Cargo.lock') }}
 
@@ -164,8 +164,8 @@ jobs:
 
     name: doc-links
 
     name: doc-links
 
     runs-on: ubuntu-24.04
 
     runs-on: ubuntu-24.04
 
     steps:
 
     steps:
 
-      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
 
-      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
 
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
 
         with:
 
         with:
 
           python-version: "3.x"
 
           python-version: "3.x"
 
       - name: Check documentation links (markdown-link-check equivalent)
 
       - name: Check documentation links (markdown-link-check equivalent)
 
@@ -177,10 +177,10 @@ jobs:
 
     env:
 
     env:
 
       RUSTC_WRAPPER: sccache
 
       RUSTC_WRAPPER: sccache
 
     steps:
 
     steps:
 
-      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
 
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - uses: dtolnay/rust-toolchain@686976e191b89faba57d3206551f0f330d8cb249 # stable
 
       - uses: dtolnay/rust-toolchain@686976e191b89faba57d3206551f0f330d8cb249 # stable
 
       - name: Cache sccache directory
 
       - name: Cache sccache directory
 
-        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5
 
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
 
         with:
 
         with:
 
           path: ${{ env.SCCACHE_DIR }}
 
           path: ${{ env.SCCACHE_DIR }}
 
           key: sccache-${{ runner.os }}-${{ hashFiles('Cargo.lock', 'fuzz/Cargo.lock') }}
 
           key: sccache-${{ runner.os }}-${{ hashFiles('Cargo.lock', 'fuzz/Cargo.lock') }}
 
@@ -210,10 +210,10 @@ jobs:
 
     env:
 
     env:
 
       RUSTC_WRAPPER: sccache
 
       RUSTC_WRAPPER: sccache
 
     steps:
 
     steps:
 
-      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
 
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - uses: dtolnay/rust-toolchain@686976e191b89faba57d3206551f0f330d8cb249 # stable
 
       - uses: dtolnay/rust-toolchain@686976e191b89faba57d3206551f0f330d8cb249 # stable
 
       - name: Cache sccache directory
 
       - name: Cache sccache directory
 
-        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5
 
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
 
         with:
 
         with:
 
           path: ${{ env.SCCACHE_DIR }}
 
           path: ${{ env.SCCACHE_DIR }}
 
           key: sccache-${{ runner.os }}-${{ hashFiles('Cargo.lock', 'fuzz/Cargo.lock') }}
 
           key: sccache-${{ runner.os }}-${{ hashFiles('Cargo.lock', 'fuzz/Cargo.lock') }}
 
@@ -235,7 +235,7 @@ jobs:
 
       run:
 
       run:
 
         working-directory: fuzz
 
         working-directory: fuzz
 
     steps:
 
     steps:
 
-      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
 
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       # The `fuzz/rust-toolchain.toml` in the working directory selects
 
       # The `fuzz/rust-toolchain.toml` in the working directory selects
 
       # nightly via rustup override; the root stable pin is untouched.
 
       # nightly via rustup override; the root stable pin is untouched.
 
       - name: Install cargo-fuzz (nightly, per fuzz/rust-toolchain.toml)
 
       - name: Install cargo-fuzz (nightly, per fuzz/rust-toolchain.toml)
 
@@ -243,7 +243,7 @@ jobs:
 
         with:
 
         with:
 
           tool: cargo-fuzz
 
           tool: cargo-fuzz
 
       - name: Cache sccache directory
 
       - name: Cache sccache directory
 
-        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5
 
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
 
         with:
 
         with:
 
           path: ${{ env.SCCACHE_DIR }}
 
           path: ${{ env.SCCACHE_DIR }}
 
           key: sccache-${{ runner.os }}-${{ hashFiles('Cargo.lock', 'fuzz/Cargo.lock') }}
 
           key: sccache-${{ runner.os }}-${{ hashFiles('Cargo.lock', 'fuzz/Cargo.lock') }}
 
@@ -279,7 +279,7 @@ jobs:
 
       run:
 
       run:
 
         working-directory: fuzz
 
         working-directory: fuzz
 
     steps:
 
     steps:
 
-      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
 
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       # `fuzz/rust-toolchain.toml` selects nightly; the root stable pin is
 
       # `fuzz/rust-toolchain.toml` selects nightly; the root stable pin is
 
       # untouched, exactly as in `fuzz-build`.
 
       # untouched, exactly as in `fuzz-build`.
 
       - name: Install cargo-fuzz (nightly)
 
       - name: Install cargo-fuzz (nightly)
 
@@ -287,7 +287,7 @@ jobs:
 
         with:
 
         with:
 
           tool: cargo-fuzz
 
           tool: cargo-fuzz
 
       - name: Cache sccache directory
 
       - name: Cache sccache directory
 
-        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5
 
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
 
         with:
 
         with:
 
           path: ${{ env.SCCACHE_DIR }}
 
           path: ${{ env.SCCACHE_DIR }}
 
           key: sccache-${{ runner.os }}-${{ hashFiles('Cargo.lock', 'fuzz/Cargo.lock') }}
 
           key: sccache-${{ runner.os }}-${{ hashFiles('Cargo.lock', 'fuzz/Cargo.lock') }}
 
@@ -300,7 +300,7 @@ jobs:
 
       # `uses` steps resolve paths from the workspace root, not the job's
 
       # `uses` steps resolve paths from the workspace root, not the job's
 
       # `working-directory`; keep the fuzz/ prefix explicit.
 
       # `working-directory`; keep the fuzz/ prefix explicit.
 
       - name: Restore corpus for ${{ matrix.target }}
 
       - name: Restore corpus for ${{ matrix.target }}
 
-        uses: actions/cache/restore@caa296126883cff596d87d8935842f9db880ef25 # v5
 
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
 
         with:
 
         with:
 
           path: fuzz/corpus/${{ matrix.target }}
 
           path: fuzz/corpus/${{ matrix.target }}
 
           key: fuzz-corpus-${{ matrix.target }}-${{ github.run_id }}
 
           key: fuzz-corpus-${{ matrix.target }}-${{ github.run_id }}
 
@@ -314,13 +314,13 @@ jobs:
 
       # `restore-keys` always pick the newest entry.
 
       # `restore-keys` always pick the newest entry.
 
       - name: Save corpus for ${{ matrix.target }}
 
       - name: Save corpus for ${{ matrix.target }}
 
         if: success()
 
         if: success()
 
-        uses: actions/cache/save@caa296126883cff596d87d8935842f9db880ef25 # v5
 
+        uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
 
         with:
 
         with:
 
           path: fuzz/corpus/${{ matrix.target }}
 
           path: fuzz/corpus/${{ matrix.target }}
 
           key: fuzz-corpus-${{ matrix.target }}-${{ github.run_id }}
 
           key: fuzz-corpus-${{ matrix.target }}-${{ github.run_id }}
 
       - name: Upload crash artifacts
 
       - name: Upload crash artifacts
 
         if: failure()
 
         if: failure()
 
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
 
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
 
         with:
 
         with:
 
           name: fuzz-crash-${{ matrix.target }}
 
           name: fuzz-crash-${{ matrix.target }}
 
           path: fuzz/artifacts/${{ matrix.target }}
 
           path: fuzz/artifacts/${{ matrix.target }}
 
@@ -335,10 +335,10 @@ jobs:
 
       RUSTC_WRAPPER: sccache
 
       RUSTC_WRAPPER: sccache
 
     timeout-minutes: 60
 
     timeout-minutes: 60
 
     steps:
 
     steps:
 
-      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
 
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - uses: dtolnay/rust-toolchain@686976e191b89faba57d3206551f0f330d8cb249 # stable
 
       - uses: dtolnay/rust-toolchain@686976e191b89faba57d3206551f0f330d8cb249 # stable
 
       - name: Cache sccache directory
 
       - name: Cache sccache directory
 
-        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5
 
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
 
         with:
 
         with:
 
           path: ${{ env.SCCACHE_DIR }}
 
           path: ${{ env.SCCACHE_DIR }}
 
           key: sccache-${{ runner.os }}-${{ hashFiles('Cargo.lock', 'fuzz/Cargo.lock') }}
 
           key: sccache-${{ runner.os }}-${{ hashFiles('Cargo.lock', 'fuzz/Cargo.lock') }}
 
@@ -368,12 +368,12 @@ jobs:
 
       RUSTC_WRAPPER: sccache
 
       RUSTC_WRAPPER: sccache
 
     continue-on-error: true
 
     continue-on-error: true
 
     steps:
 
     steps:
 
-      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
 
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - uses: dtolnay/rust-toolchain@686976e191b89faba57d3206551f0f330d8cb249 # stable
 
       - uses: dtolnay/rust-toolchain@686976e191b89faba57d3206551f0f330d8cb249 # stable
 
         with:
 
         with:
 
           components: llvm-tools-preview
 
           components: llvm-tools-preview
 
       - name: Cache sccache directory
 
       - name: Cache sccache directory
 
-        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5
 
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
 
         with:
 
         with:
 
           path: ${{ env.SCCACHE_DIR }}
 
           path: ${{ env.SCCACHE_DIR }}
 
           key: sccache-${{ runner.os }}-${{ hashFiles('Cargo.lock', 'fuzz/Cargo.lock') }}
 
           key: sccache-${{ runner.os }}-${{ hashFiles('Cargo.lock', 'fuzz/Cargo.lock') }}
 
@@ -398,7 +398,7 @@ jobs:
 
         run: docker compose -f compose.test.yaml down -v
 
         run: docker compose -f compose.test.yaml down -v
 
       - name: Upload coverage report
 
       - name: Upload coverage report
 
         if: always()
 
         if: always()
 
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
 
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
 
         with:
 
         with:
 
           name: coverage-lcov
 
           name: coverage-lcov
 
           path: lcov.info
 
           path: lcov.info
 
@@ -423,7 +423,7 @@ jobs:
 
     timeout-minutes: 60
 
     timeout-minutes: 60
 
     continue-on-error: true
 
     continue-on-error: true
 
     steps:
 
     steps:
 
-      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
 
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - uses: dtolnay/rust-toolchain@f0d5300ba8908d942c808f4d31c08471d7798ba3 # nightly
 
       - uses: dtolnay/rust-toolchain@f0d5300ba8908d942c808f4d31c08471d7798ba3 # nightly
 
         with:
 
         with:
 
           components: miri
 
           components: miri

+ 2 - 2
.github/workflows/docs.yml
Целия файл 

@@ -35,8 +35,8 @@ jobs:
 
     name: docs link-check
 
     name: docs link-check
 
     runs-on: ubuntu-24.04
 
     runs-on: ubuntu-24.04
 
     steps:
 
     steps:
 
-      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
 
-      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
 
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
 
         with:
 
         with:
 
           python-version: "3.x"
 
           python-version: "3.x"
 
       - name: Check documentation links
 
       - name: Check documentation links

+ 26 - 15
.github/workflows/supply-chain.yml
Целия файл 

@@ -42,14 +42,14 @@ jobs:
 
     name: manifest-lint
 
     name: manifest-lint
 
     runs-on: ubuntu-24.04
 
     runs-on: ubuntu-24.04
 
     steps:
 
     steps:
 
-      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
 
-      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
 
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
 
         with:
 
         with:
 
           python-version: "3.x"
 
           python-version: "3.x"
 
       - name: Install pyyaml + kustomize
 
       - name: Install pyyaml + kustomize
 
         run: |
 
         run: |
 
           pip install pyyaml
 
           pip install pyyaml
 
-          curl -sSfL https://github.com/kubernetes-sigs/kustomize/releases/download/kustomize%2Fv5.4.3/kustomize_v5.4.3_linux_amd64.tar.gz \
 
+          curl -sSfL https://github.com/kubernetes-sigs/kustomize/releases/download/kustomize%2Fv5.8.3/kustomize_v5.8.3_linux_amd64.tar.gz \
 
             | tar -xzf - kustomize && sudo mv kustomize /usr/local/bin/
 
             | tar -xzf - kustomize && sudo mv kustomize /usr/local/bin/
 
       - name: Kustomize build
 
       - name: Kustomize build
 
         run: kustomize build deploy/k8s
 
         run: kustomize build deploy/k8s
 
@@ -75,9 +75,9 @@ jobs:
 
       packages: write
 
       packages: write
 
       id-token: write
 
       id-token: write
 
     steps:
 
     steps:
 
-      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
 
-      - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
 
-      - uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
 
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
 
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
 
         with:
 
         with:
 
           registry: ghcr.io
 
           registry: ghcr.io
 
           username: ${{ github.actor }}
 
           username: ${{ github.actor }}
 
@@ -100,7 +100,7 @@ jobs:
 
           mkdir -p "${RUNNER_TEMP}/digests"
 
           mkdir -p "${RUNNER_TEMP}/digests"
 
           touch "${RUNNER_TEMP}/digests/${digest#sha256:}"
 
           touch "${RUNNER_TEMP}/digests/${digest#sha256:}"
 
       - name: Upload ${{ matrix.arch }} digest
 
       - name: Upload ${{ matrix.arch }} digest
 
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
 
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
 
         with:
 
         with:
 
           name: digests-${{ matrix.arch }}
 
           name: digests-${{ matrix.arch }}
 
           path: ${{ runner.temp }}/digests/*
 
           path: ${{ runner.temp }}/digests/*
 
@@ -120,14 +120,14 @@ jobs:
 
     outputs:
 
     outputs:
 
       digest: ${{ steps.merge.outputs.digest }}
 
       digest: ${{ steps.merge.outputs.digest }}
 
     steps:
 
     steps:
 
-      - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
 
-      - uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
 
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
 
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
 
         with:
 
         with:
 
           registry: ghcr.io
 
           registry: ghcr.io
 
           username: ${{ github.actor }}
 
           username: ${{ github.actor }}
 
           password: ${{ secrets.GITHUB_TOKEN }}
 
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Download per-arch digests
 
       - name: Download per-arch digests
 
-        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6
 
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
 
         with:
 
         with:
 
           path: ${{ runner.temp }}/digests
 
           path: ${{ runner.temp }}/digests
 
           pattern: digests-*
 
           pattern: digests-*
 
@@ -167,7 +167,7 @@ jobs:
 
             --format '{{json .Manifest.Digest}}' | tr -d '"')
 
             --format '{{json .Manifest.Digest}}' | tr -d '"')
 
           echo "digest=${digest}" >> "${GITHUB_OUTPUT}"
 
           echo "digest=${digest}" >> "${GITHUB_OUTPUT}"
 
       - name: SBOM (syft, committed as artifact)
 
       - name: SBOM (syft, committed as artifact)
 
-        uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0
 
+        uses: anchore/sbom-action@66cbf4bc1f1c0d2edc94016e65bc221b6bb0ad6c # v0.24.3
 
         with:
 
         with:
 
           image: ${{ env.REGISTRY_IMAGE }}@${{ steps.merge.outputs.digest }}
 
           image: ${{ env.REGISTRY_IMAGE }}@${{ steps.merge.outputs.digest }}
 
           artifact-name: sbom.spdx.json
 
           artifact-name: sbom.spdx.json
 
@@ -192,12 +192,23 @@ jobs:
 
           sarif_file: trivy.sarif
 
           sarif_file: trivy.sarif
 
           category: trivy
 
           category: trivy
 
       - name: Scan (grype, gate high/critical)
 
       - name: Scan (grype, gate high/critical)
 
+        id: grype
 
         uses: anchore/scan-action@27805bf3b4e84b4a5c980df22ed233c00390a439 # v7.4.2
 
         uses: anchore/scan-action@27805bf3b4e84b4a5c980df22ed233c00390a439 # v7.4.2
 
         with:
 
         with:
 
           image: ${{ env.REGISTRY_IMAGE }}@${{ steps.merge.outputs.digest }}
 
           image: ${{ env.REGISTRY_IMAGE }}@${{ steps.merge.outputs.digest }}
 
           fail-build: true
 
           fail-build: true
 
           severity-cutoff: high
 
           severity-cutoff: high
 
-      - uses: sigstore/cosign-installer@398d4b0eeef1380460a10c8013a76f728fb906ac # v3
 
+      - name: Upload grype SARIF to code scanning
 
+        # `if: always()` so grype findings reach the Security tab even when the
 
+        # gate above fails the job.
 
+        if: always()
 
+        uses: github/codeql-action/upload-sarif@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
 
+        with:
 
+          sarif_file: ${{ steps.grype.outputs.sarif }}
 
+          category: grype
 
+      - uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
 
+        with:
 
+          cosign-release: "v3.0.6"
 
       - name: Keyless sign (cosign, OIDC)
 
       - name: Keyless sign (cosign, OIDC)
 
         env:
 
         env:
 
           COSIGN_YES: "true"
 
           COSIGN_YES: "true"
 
@@ -212,8 +223,8 @@ jobs:
 
     if: github.event_name != 'push' || !startsWith(github.ref, 'refs/tags/')
 
     if: github.event_name != 'push' || !startsWith(github.ref, 'refs/tags/')
 
     runs-on: ubuntu-24.04
 
     runs-on: ubuntu-24.04
 
     steps:
 
     steps:
 
-      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
 
-      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
 
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
 
         with:
 
         with:
 
           python-version: "3.x"
 
           python-version: "3.x"
 
       - name: Pin kustomization to the built digest + strict lint
 
       - name: Pin kustomization to the built digest + strict lint
 
@@ -245,7 +256,7 @@ jobs:
 
     permissions:
 
     permissions:
 
       contents: write
 
       contents: write
 
     steps:
 
     steps:
 
-      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
 
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Create GitHub Release
 
       - name: Create GitHub Release
 
         env:
 
         env:
 
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

+ 1 - 1
Dockerfile
Целия файл 

@@ -17,7 +17,7 @@
 
 # Pinned bases (multi-arch index digests; buildx selects per-platform):
 
 # Pinned bases (multi-arch index digests; buildx selects per-platform):
 
 # - rust 1.99-bookworm (matches rust-toolchain.toml stable; rustc 1.99.0)
 
 # - rust 1.99-bookworm (matches rust-toolchain.toml stable; rustc 1.99.0)
 
 # - distroless static-debian12:nonroot (UID:GID 65532, no shell)
 
 # - distroless static-debian12:nonroot (UID:GID 65532, no shell)
 
-ARG RUST_BASE=docker.io/library/rust:1.99-bookworm@sha256:59037199c44290f2befcdd58dcc540164763fc296950255aaefeef096a1866b0
 
+ARG RUST_BASE=docker.io/library/rust:1.99-bookworm@sha256:114c7a4425406451c2866b6aafe69fe29b1b298832db1277d411ac73c82d04d6
 
 ARG RUNTIME_BASE=gcr.io/distroless/static-debian12:nonroot@sha256:afa5c872c891853ca7fcf1f12c3edb23f7eeef36189728842dd51042ff57f7ab
 
 ARG RUNTIME_BASE=gcr.io/distroless/static-debian12:nonroot@sha256:afa5c872c891853ca7fcf1f12c3edb23f7eeef36189728842dd51042ff57f7ab
 
 
 
 FROM ${RUST_BASE} AS chef
 
 FROM ${RUST_BASE} AS chef

+ 2 - 1
RUNBOOK.md
Целия файл 

@@ -184,7 +184,8 @@ from an unverified local tarball. The full path is in
 
 - [ ] Read the digest the `pin-digest` job committed:
 
 - [ ] Read the digest the `pin-digest` job committed:
 
   `grep -A2 'name: ghcr.io/syavne/d-oauth-server' deploy/k8s/kustomization.yaml`.
 
   `grep -A2 'name: ghcr.io/syavne/d-oauth-server' deploy/k8s/kustomization.yaml`.
 
 - [ ] Verify it before applying (placeholder `sha256:<digest>` stands for the
 
 - [ ] Verify it before applying (placeholder `sha256:<digest>` stands for the
 
-  value from the previous step; no real digest is recorded here):
 
+  value from the previous step; no real digest is recorded here; signatures are
 
+  cosign v3 OCI 1.1 referrers, so use a cosign v3+ client):
 
 
 
   ```sh
 
   ```sh
 
   cosign verify \
 
   cosign verify \

+ 9 - 4
docs/DEPLOYMENT.md
Целия файл 

@@ -535,10 +535,10 @@ on:
 
   repository's code-scanning (Security) tab with category `trivy`; the SBOM is
 
   repository's code-scanning (Security) tab with category `trivy`; the SBOM is
 
   committed as the `sbom.spdx.json` artifact by step
 
   committed as the `sbom.spdx.json` artifact by step
 
   `SBOM (syft, committed as artifact)`.
 
   `SBOM (syft, committed as artifact)`.
 
-- Keyless signing with `cosign` (job `merge`, step
 
-  `Keyless sign (cosign, OIDC)`: `cosign sign` on the merged index digest; the
 
-  per-arch SBOM and SLSA provenance attestations are attached by the `build`
 
-  legs).
 
+- Keyless signing with `cosign` v3 (job `merge`, step
 
+  `Keyless sign (cosign, OIDC)`: `cosign sign` on the merged index digest,
 
+  stored as an OCI 1.1 referrer/bundle; the per-arch SBOM and SLSA provenance
 
+  attestations are attached by the `build` legs).
 
 - Digest pinning (job `pin-digest`, step
 
 - Digest pinning (job `pin-digest`, step
 
   `Pin kustomization to the built digest + strict lint`): the signed merge
 
   `Pin kustomization to the built digest + strict lint`): the signed merge
 
   digest overwrites `images[].digest` in `deploy/k8s/kustomization.yaml`,
 
   digest overwrites `images[].digest` in `deploy/k8s/kustomization.yaml`,
 
@@ -577,6 +577,11 @@ kubectl apply --dry-run=server -k deploy/k8s
 
 kubectl apply -k deploy/k8s
 
 kubectl apply -k deploy/k8s
 
 ```
 
 ```
 
 
 
+Signatures and attestations are written with cosign v3 as OCI 1.1 referrers and
 
+Sigstore bundles, not the legacy `sha256-<digest>.sig` tag; verify with a
 
+cosign v3+ client (cosign v2.6+ can read them with `--new-bundle-format`). The
 
+`cosign verify` flags above are unchanged from v2.
 
+
 
 Record the shipped `sha256:<digest>` in [RUNBOOK.md](../RUNBOOK.md)
 
 Record the shipped `sha256:<digest>` in [RUNBOOK.md](../RUNBOOK.md)
 
 (deploy provenance entry: digest, `sbom.spdx.json` / `trivy.sarif` run, and
 
 (deploy provenance entry: digest, `sbom.spdx.json` / `trivy.sarif` run, and
 
 the `cosign verify` result). A rollout with no matching record is an
 
 the `cosign verify` result). A rollout with no matching record is an

+ 1 - 1
docs/SECURITY.md
Целия файл 

@@ -69,7 +69,7 @@ class, or runtime setting).
 
 | Unrestricted pod egress (SSRF to metadata, exfiltration) | `networkpolicy.yaml` default-denies egress except DNS (53 to `kube-system`) and Postgres/Redis (5432/6379) scoped to the namespace hosting them — no internet-wide `0.0.0.0/0` peer; any `ipBlock` peer excludes `169.254.0.0/16`; ingress is limited to pod ports 8080/8081 | Enforcement depends on a NetworkPolicy-capable CNI; a cluster that ignores NetworkPolicy gets no benefit. A managed database outside the cluster needs a specific CIDR or a CNI FQDN policy. The default-deny also blocks the JAR `request_uri` HTTPS fetch — remote request objects are unsupported unless the deployment adds a scoped allowance (see `docs/DEPLOYMENT.md`). |
 
 | Unrestricted pod egress (SSRF to metadata, exfiltration) | `networkpolicy.yaml` default-denies egress except DNS (53 to `kube-system`) and Postgres/Redis (5432/6379) scoped to the namespace hosting them — no internet-wide `0.0.0.0/0` peer; any `ipBlock` peer excludes `169.254.0.0/16`; ingress is limited to pod ports 8080/8081 | Enforcement depends on a NetworkPolicy-capable CNI; a cluster that ignores NetworkPolicy gets no benefit. A managed database outside the cluster needs a specific CIDR or a CNI FQDN policy. The default-deny also blocks the JAR `request_uri` HTTPS fetch — remote request objects are unsupported unless the deployment adds a scoped allowance (see `docs/DEPLOYMENT.md`). |
 
 | Operator `exec` into a running pod | No shell and a non-root, read-only-rootfs container limit what runs; every secret is a file the container user already reads, and no secret is in the environment | `pods/exec` (and `docker exec`) bypass the application's own authorization; restrict it with RBAC and audit it (`docs/OPERATIONS.md`). |
 
 | Operator `exec` into a running pod | No shell and a non-root, read-only-rootfs container limit what runs; every secret is a file the container user already reads, and no secret is in the environment | `pods/exec` (and `docker exec`) bypass the application's own authorization; restrict it with RBAC and audit it (`docs/OPERATIONS.md`). |
 
 | Kubernetes API access from the pod | `automountServiceAccountToken: false`; the binary never calls the API | A future feature that needs the API would have to re-enable it deliberately. |
 
 | Kubernetes API access from the pod | `automountServiceAccountToken: false`; the binary never calls the API | A future feature that needs the API would have to re-enable it deliberately. |
 
-| Image/registry compromise | Digest pinning, keyless cosign signing in the `supply-chain.yml` `merge` job (`Keyless sign (cosign, OIDC)`), verify-before-rollout with `cosign verify` on the pinned `ghcr.io/syavne/d-oauth-server@sha256:<digest>` (see `docs/DEPLOYMENT.md`), `pin-digest` writing the signed digest into `kustomization.yaml` with a `--strict-digest` lint, a committed digest reference with no shippable `:latest`, and a recorded digest per rollout in `RUNBOOK.md`; the local-build fallback still signs (`cosign sign`) and verifies (`cosign verify`) before loading | A registry compromise of an unpinned tag still ships if the operator skips the verify step; an unsigned `docker save \\| docker load` tarball bypasses every control, so it is forbidden except through the documented local sign/verify fallback. |
 
+| Image/registry compromise | Digest pinning, keyless cosign v3 signing (OCI 1.1 referrer bundles) in the `supply-chain.yml` `merge` job (`Keyless sign (cosign, OIDC)`), verify-before-rollout with `cosign verify` on the pinned `ghcr.io/syavne/d-oauth-server@sha256:<digest>` (see `docs/DEPLOYMENT.md`), `pin-digest` writing the signed digest into `kustomization.yaml` with a `--strict-digest` lint, a committed digest reference with no shippable `:latest`, and a recorded digest per rollout in `RUNBOOK.md`; the local-build fallback still signs (`cosign sign`) and verifies (`cosign verify`) before loading | A registry compromise of an unpinned tag still ships if the operator skips the verify step; an unsigned `docker save \\| docker load` tarball bypasses every control, so it is forbidden except through the documented local sign/verify fallback. |
 
 | Rate-limit evasion via spoofed `X-Forwarded-For` behind an L7 proxy | Default-empty   `rate_limit.trusted_proxies` (headers ignored unless the TCP peer is an allowlisted proxy IP/CIDR); rightmost-untrusted selection; malformed headers fall back to the verified peer; attribution is bucket selection only, never authentication | An allowlist entry that is too broad (or a compromised proxy) attributes attacker-chosen IPs; keep entries to the proxy peers and never a `/0` (rejected at load). Proxies must emit bare IPs (no port/brackets/`unknown`); anything else is skipped, and only the rightmost 32 entries are considered. |
 
 | Rate-limit evasion via spoofed `X-Forwarded-For` behind an L7 proxy | Default-empty   `rate_limit.trusted_proxies` (headers ignored unless the TCP peer is an allowlisted proxy IP/CIDR); rightmost-untrusted selection; malformed headers fall back to the verified peer; attribution is bucket selection only, never authentication | An allowlist entry that is too broad (or a compromised proxy) attributes attacker-chosen IPs; keep entries to the proxy peers and never a `/0` (rejected at load). Proxies must emit bare IPs (no port/brackets/`unknown`); anything else is skipped, and only the rightmost 32 entries are considered. |
 
 
 
 Last reviewed: 2026-10-09. File-mounted DB/Redis passwords, digest pinning,
 
 Last reviewed: 2026-10-09. File-mounted DB/Redis passwords, digest pinning,