From 2ee51eed590b4722efcdca2fe4685ef24600bced Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Wed, 9 Sep 2026 23:36:32 +0100 Subject: [PATCH 1/2] fix(action): replace external symlinks and verify repository archives --- .github/workflows/validate-action-tests.yml | 15 +++ editors/vscode/container/.gatekeeper.yaml | 123 ++++++++++++++++++- pandoc/container/.gatekeeper.yaml | 123 ++++++++++++++++++- site/assets/style.css | 122 +++++++++++++++++- site/templates/default.html | 41 ++++++- validate-action/tests/check-archive-links.sh | 17 +++ validate-action/tests/test-archive-links.sh | 23 ++++ 7 files changed, 460 insertions(+), 4 deletions(-) mode change 120000 => 100644 editors/vscode/container/.gatekeeper.yaml mode change 120000 => 100644 pandoc/container/.gatekeeper.yaml mode change 120000 => 100644 site/assets/style.css mode change 120000 => 100644 site/templates/default.html create mode 100644 validate-action/tests/check-archive-links.sh create mode 100644 validate-action/tests/test-archive-links.sh diff --git a/.github/workflows/validate-action-tests.yml b/.github/workflows/validate-action-tests.yml index 070cafc..1e9a962 100644 --- a/.github/workflows/validate-action-tests.yml +++ b/.github/workflows/validate-action-tests.yml @@ -6,11 +6,17 @@ on: paths: - ".github/workflows/validate-action-tests.yml" - "validate-action/**" + - "editors/vscode/container/.gatekeeper.yaml" + - "pandoc/container/.gatekeeper.yaml" + - "site/**" push: branches: [main] paths: - ".github/workflows/validate-action-tests.yml" - "validate-action/**" + - "editors/vscode/container/.gatekeeper.yaml" + - "pandoc/container/.gatekeeper.yaml" + - "site/**" workflow_dispatch: permissions: @@ -27,3 +33,12 @@ jobs: run: bash -n validate-action/validate-k9.sh validate-action/tests/test-validate-k9.sh - name: Run regression and positive-control tests run: validate-action/tests/test-validate-k9.sh + - name: Check archive-link instrument + run: bash validate-action/tests/test-archive-links.sh + - name: Verify links in the actual Git archive + shell: bash + run: | + archive_root="$RUNNER_TEMP/k9-archive" + mkdir -p "$archive_root" + git archive HEAD | tar -x -C "$archive_root" + bash validate-action/tests/check-archive-links.sh "$archive_root" diff --git a/editors/vscode/container/.gatekeeper.yaml b/editors/vscode/container/.gatekeeper.yaml deleted file mode 120000 index 87731df..0000000 --- a/editors/vscode/container/.gatekeeper.yaml +++ /dev/null @@ -1 +0,0 @@ -../../../../_shared/container/.gatekeeper.yaml \ No newline at end of file diff --git a/editors/vscode/container/.gatekeeper.yaml b/editors/vscode/container/.gatekeeper.yaml new file mode 100644 index 0000000..4aac671 --- /dev/null +++ b/editors/vscode/container/.gatekeeper.yaml @@ -0,0 +1,122 @@ +# SPDX-License-Identifier: MPL-2.0 +# +# Svalinn gatekeeper policy for {{PROJECT_NAME}} +# +# Controls which operations are permitted through the edge gateway. +# This template provides moderate security defaults — not wide-open test +# mode, but not production-hardened either. Tighten the values below +# before deploying to production. +# +# See: stapeln/container-stack/svalinn/ + +version: "1.0" + +# ============================================================================ +# Authentication +# ============================================================================ +# +# Define which endpoints require authentication and at what level. + +auth: + # Public endpoints — no authentication required. + # Health and readiness probes must always be public so that + # orchestrators (selur, Podman, k8s) can check service status. + public: + - path: "/health" + methods: ["GET"] + - path: "/ready" + methods: ["GET"] + - path: "/metrics" + methods: ["GET"] + + # Endpoints requiring JWT or OAuth2 authentication. + # Svalinn validates the token before forwarding the request. + authenticated: + - path: "/api/v1/*" + methods: ["GET", "POST", "PUT", "DELETE"] + +# ============================================================================ +# Rate Limiting +# ============================================================================ +# +# Protects backend services from overload. Values here are moderate +# defaults — adjust based on your service capacity. + +rate_limits: + # Global limit: applied to all authenticated clients. + global: + requests_per_second: 500 + burst: 1000 + + # Write operations: stricter limit to protect data stores. + writes: + paths: ["/api/v1/*"] + methods: ["POST", "PUT", "DELETE"] + requests_per_second: 100 + burst: 200 + +# ============================================================================ +# Container Trust +# ============================================================================ +# +# Svalinn verifies that all .ctp bundles in the stack are signed by +# trusted keys and carry the required attestations. + +trust: + # Only accept .ctp bundles signed by these keys. + trusted_signers: + - key_id: "{{SERVICE_NAME}}-release" + algorithm: "Ed25519" + public_key_file: "/etc/svalinn/keys/{{SERVICE_NAME}}-release.pub" + + # Require these attestations on all .ctp bundles. + required_attestations: + - "source-signature" + - "sbom-complete" + + # Reject unsigned or untrusted images. + reject_unsigned: true + +# ============================================================================ +# Request Validation +# ============================================================================ +# +# Input validation at the gateway layer — catches malformed requests +# before they reach the application. + +validation: + # Maximum request body size. + max_body_size: "8MB" + + # Reject requests with NaN or Infinity in numeric fields. + reject_nan_inf: true + + # Maximum result limit per list/search query. + max_result_limit: 500 + +# ============================================================================ +# CORS +# ============================================================================ +# +# Cross-Origin Resource Sharing policy. The defaults below allow all +# origins — restrict to your frontend domain(s) in production. + +cors: + allow_origins: ["*"] + allow_methods: ["GET", "POST", "PUT", "DELETE", "OPTIONS"] + allow_headers: ["Content-Type", "Authorization"] + max_age: 3600 + +# ============================================================================ +# Logging +# ============================================================================ +# +# Structured logging for svalinn itself. Audit paths log all requests +# (including body hashes) for post-incident investigation. + +logging: + format: "json" + level: "info" + # Log all write operations for audit trail. + audit_paths: + - "/api/v1/*" diff --git a/pandoc/container/.gatekeeper.yaml b/pandoc/container/.gatekeeper.yaml deleted file mode 120000 index 87731df..0000000 --- a/pandoc/container/.gatekeeper.yaml +++ /dev/null @@ -1 +0,0 @@ -../../../../_shared/container/.gatekeeper.yaml \ No newline at end of file diff --git a/pandoc/container/.gatekeeper.yaml b/pandoc/container/.gatekeeper.yaml new file mode 100644 index 0000000..4aac671 --- /dev/null +++ b/pandoc/container/.gatekeeper.yaml @@ -0,0 +1,122 @@ +# SPDX-License-Identifier: MPL-2.0 +# +# Svalinn gatekeeper policy for {{PROJECT_NAME}} +# +# Controls which operations are permitted through the edge gateway. +# This template provides moderate security defaults — not wide-open test +# mode, but not production-hardened either. Tighten the values below +# before deploying to production. +# +# See: stapeln/container-stack/svalinn/ + +version: "1.0" + +# ============================================================================ +# Authentication +# ============================================================================ +# +# Define which endpoints require authentication and at what level. + +auth: + # Public endpoints — no authentication required. + # Health and readiness probes must always be public so that + # orchestrators (selur, Podman, k8s) can check service status. + public: + - path: "/health" + methods: ["GET"] + - path: "/ready" + methods: ["GET"] + - path: "/metrics" + methods: ["GET"] + + # Endpoints requiring JWT or OAuth2 authentication. + # Svalinn validates the token before forwarding the request. + authenticated: + - path: "/api/v1/*" + methods: ["GET", "POST", "PUT", "DELETE"] + +# ============================================================================ +# Rate Limiting +# ============================================================================ +# +# Protects backend services from overload. Values here are moderate +# defaults — adjust based on your service capacity. + +rate_limits: + # Global limit: applied to all authenticated clients. + global: + requests_per_second: 500 + burst: 1000 + + # Write operations: stricter limit to protect data stores. + writes: + paths: ["/api/v1/*"] + methods: ["POST", "PUT", "DELETE"] + requests_per_second: 100 + burst: 200 + +# ============================================================================ +# Container Trust +# ============================================================================ +# +# Svalinn verifies that all .ctp bundles in the stack are signed by +# trusted keys and carry the required attestations. + +trust: + # Only accept .ctp bundles signed by these keys. + trusted_signers: + - key_id: "{{SERVICE_NAME}}-release" + algorithm: "Ed25519" + public_key_file: "/etc/svalinn/keys/{{SERVICE_NAME}}-release.pub" + + # Require these attestations on all .ctp bundles. + required_attestations: + - "source-signature" + - "sbom-complete" + + # Reject unsigned or untrusted images. + reject_unsigned: true + +# ============================================================================ +# Request Validation +# ============================================================================ +# +# Input validation at the gateway layer — catches malformed requests +# before they reach the application. + +validation: + # Maximum request body size. + max_body_size: "8MB" + + # Reject requests with NaN or Infinity in numeric fields. + reject_nan_inf: true + + # Maximum result limit per list/search query. + max_result_limit: 500 + +# ============================================================================ +# CORS +# ============================================================================ +# +# Cross-Origin Resource Sharing policy. The defaults below allow all +# origins — restrict to your frontend domain(s) in production. + +cors: + allow_origins: ["*"] + allow_methods: ["GET", "POST", "PUT", "DELETE", "OPTIONS"] + allow_headers: ["Content-Type", "Authorization"] + max_age: 3600 + +# ============================================================================ +# Logging +# ============================================================================ +# +# Structured logging for svalinn itself. Audit paths log all requests +# (including body hashes) for post-incident investigation. + +logging: + format: "json" + level: "info" + # Log all write operations for audit trail. + audit_paths: + - "/api/v1/*" diff --git a/site/assets/style.css b/site/assets/style.css deleted file mode 120000 index a7c3bb8..0000000 --- a/site/assets/style.css +++ /dev/null @@ -1 +0,0 @@ -../../../_shared/assets/style.css \ No newline at end of file diff --git a/site/assets/style.css b/site/assets/style.css new file mode 100644 index 0000000..3b4be31 --- /dev/null +++ b/site/assets/style.css @@ -0,0 +1,121 @@ +/* SPDX-License-Identifier: MPL-2.0 */ +/* Copyright (c) 2025-2026 Jonathan D.A. Jewell */ +/* + * a2ml.net / k9-svc.net site theme — built on the ddraig-ssg AAA base. + * WCAG 2.2 AAA: all text/UI colours contrast-verified >= 7:1 (light + dark), + * focus ring >= 3:1, reduced-motion, reflow, >= 44px targets. + */ + +:root { + --bg: #ffffff; + --bg-soft: #f4f5f9; + --bg-code: #eceef5; + --fg: #1a1b26; /* 17.09:1 on --bg */ + --fg-muted: #3a3d4d; /* 10.74:1 on --bg */ + --link: #3730a3; /* 9.93:1 on --bg */ + --link-hover: #1f1b6b; + --border: #5a5e73; + --focus: #3730a3; + --btn-fg: #ffffff; /* on --link (#3730a3) = 9.93:1 */ + --radius: 8px; + --maxw: 70rem; + --measure: 40rem; +} +@media (prefers-color-scheme: dark) { + :root { + --bg: #0e0f1a; + --bg-soft: #181a2a; + --bg-code: #1c1f33; + --fg: #e6e8f2; /* 15.60:1 */ + --fg-muted: #c2c6d8; /* lightened for >=7:1 on --bg-soft */ + --link: #b9c2ff; /* 11.09:1 */ + --link-hover: #dde2ff; + --border: #8c91ad; + --focus: #b9c2ff; + --btn-fg: #0e0f1a; /* dark text on light --link in dark mode */ + } +} + +*, *::before, *::after { box-sizing: border-box; } +html { font-size: 100%; -webkit-text-size-adjust: 100%; } +body { + margin: 0; + font-family: system-ui, -apple-system, "Segoe UI", Roboto, sans-serif; + font-size: 1.0625rem; line-height: 1.6; + color: var(--fg); background: var(--bg); + overflow-wrap: break-word; +} +.container { width: 100%; max-width: var(--maxw); margin-inline: auto; padding-inline: 1.25rem; } + +/* Skip link (2.4.1) */ +.skip-link { position: absolute; left: -9999px; top: 0; background: var(--link); color: #fff; padding: .75rem 1.25rem; border-radius: 0 0 var(--radius) 0; font-weight: 600; z-index: 100; min-height: 44px; line-height: 1.4; } +.skip-link:focus { left: 0; } + +/* Focus (2.4.7/2.4.11/2.4.13) */ +:focus-visible { outline: 3px solid var(--focus); outline-offset: 2px; border-radius: 2px; } +a:focus, button:focus, [tabindex]:focus { outline: 3px solid var(--focus); outline-offset: 2px; } + +/* Header / nav */ +.site-header { border-bottom: 1px solid var(--border); } +.nav { display: flex; flex-wrap: wrap; align-items: center; gap: 1rem; padding-block: .75rem; } +.brand { font-weight: 700; font-size: 1.2rem; color: var(--fg); text-decoration: none; } +.nav-links { list-style: none; display: flex; flex-wrap: wrap; gap: .5rem 1.25rem; margin: 0; padding: 0; } +.nav-links a, .brand { display: inline-flex; align-items: center; min-height: 44px; } + +/* Links: underlined (1.4.1) */ +a { color: var(--link); text-decoration: underline; text-underline-offset: 2px; } +a:hover { color: var(--link-hover); } +.brand, .nav-links a, .btn { text-decoration: none; } +.nav-links a:hover, .nav-links a:focus { text-decoration: underline; } + +main { display: block; } +.prose { padding-block: 2rem; } +.prose h1 { font-size: 2.25rem; line-height: 1.2; margin: 0 0 1rem; } +.prose h2 { font-size: 1.6rem; line-height: 1.3; margin: 2.25rem 0 .75rem; } +.prose h3 { font-size: 1.25rem; margin: 1.5rem 0 .5rem; } +.prose :is(h1,h2,h3,h4), .prose p, .prose li { max-width: var(--measure); } + +/* Lede */ +.lede { font-size: 1.3rem; line-height: 1.5; color: var(--fg); max-width: var(--measure); margin: 0 0 1.5rem; } + +/* Badges */ +.badges { display: flex; flex-wrap: wrap; gap: .5rem; margin: 1rem 0; padding: 0; list-style: none; } +.badge { display: inline-flex; align-items: center; min-height: 1.9rem; padding: .25rem .7rem; border: 1px solid var(--border); border-radius: 999px; font-size: .85rem; color: var(--fg); background: var(--bg-soft); } + +/* Buttons (>=44px target, 2.5.5) */ +.btn-row { display: flex; flex-wrap: wrap; gap: .75rem; margin: 1.5rem 0; } +.btn { display: inline-flex; align-items: center; min-height: 44px; padding: .6rem 1.15rem; border-radius: var(--radius); font-weight: 600; border: 2px solid var(--link); } +.btn-primary { background: var(--link); color: var(--btn-fg); } +.btn-primary:hover { background: var(--link-hover); border-color: var(--link-hover); color: var(--btn-fg); } +.btn-ghost { background: transparent; color: var(--link); } +.btn-ghost:hover { background: var(--bg-soft); } + +/* Cards */ +.cards { display: grid; grid-template-columns: repeat(auto-fit, minmax(15rem, 1fr)); gap: 1rem; margin: 1.5rem 0; } +.card { border: 1px solid var(--border); border-radius: var(--radius); padding: 1.25rem; background: var(--bg-soft); } +.card h3 { margin: 0 0 .5rem; font-size: 1.1rem; } +.card p { margin: 0; color: var(--fg); } + +/* Code */ +code { background: var(--bg-code); padding: .15em .35em; border-radius: 4px; font-size: .9em; } +pre { background: var(--bg-code); padding: 1rem; border-radius: var(--radius); overflow-x: auto; } +pre code { background: none; padding: 0; } + +/* Tables */ +.prose table { border-collapse: collapse; width: 100%; max-width: 100%; margin: 1rem 0; } +.prose caption { text-align: left; font-weight: 600; color: var(--fg-muted); padding: .5rem 0; } +.prose th, .prose td { border: 1px solid var(--border); padding: .5rem .75rem; text-align: left; } +.prose th { background: var(--bg-soft); } + +blockquote { margin: 1rem 0; padding: .5rem 1rem; border-left: 4px solid var(--link); color: var(--fg); background: var(--bg-soft); } +img { max-width: 100%; height: auto; } +hr { border: none; border-top: 1px solid var(--border); margin: 2rem 0; } +.muted { color: var(--fg-muted); } + +.site-footer { border-top: 1px solid var(--border); margin-top: 3rem; padding-block: 1.5rem; color: var(--fg-muted); font-size: .95rem; } +.site-footer a { color: var(--link); } + +@media (prefers-reduced-motion: reduce) { + *, *::before, *::after { animation-duration: .001ms !important; animation-iteration-count: 1 !important; transition-duration: .001ms !important; scroll-behavior: auto !important; } +} +@media (max-width: 30rem) { .nav { gap: .5rem; } body { font-size: 1rem; } } diff --git a/site/templates/default.html b/site/templates/default.html deleted file mode 120000 index 57f0c4f..0000000 --- a/site/templates/default.html +++ /dev/null @@ -1 +0,0 @@ -../../../_shared/templates/site-default.html \ No newline at end of file diff --git a/site/templates/default.html b/site/templates/default.html new file mode 100644 index 0000000..37cd59d --- /dev/null +++ b/site/templates/default.html @@ -0,0 +1,40 @@ + + + + + + + {{title}} + + + + + + + +
+ +
+
+
+ {{content}} +
+
+ + + diff --git a/validate-action/tests/check-archive-links.sh b/validate-action/tests/check-archive-links.sh new file mode 100644 index 0000000..ae5bc85 --- /dev/null +++ b/validate-action/tests/check-archive-links.sh @@ -0,0 +1,17 @@ +#!/usr/bin/env bash +# SPDX-License-Identifier: MPL-2.0 +# Actions downloads the entire repository archive, including files outside +# validate-action. Dangling or external links can prevent extraction entirely. +set -euo pipefail +root=$(realpath -e "${1:-.}") +failed=0 +while IFS= read -r -d '' link; do + if ! target=$(realpath -e "$link"); then + echo "::error::Dangling archive link: ${link#"$root/"}" >&2 + failed=1 + elif [[ "$target" != "$root" && "$target" != "$root/"* ]]; then + echo "::error::Archive link escapes the repository: ${link#"$root/"}" >&2 + failed=1 + fi +done < <(find "$root" -name .git -prune -o -type l -print0) +exit "$failed" diff --git a/validate-action/tests/test-archive-links.sh b/validate-action/tests/test-archive-links.sh new file mode 100644 index 0000000..783842b --- /dev/null +++ b/validate-action/tests/test-archive-links.sh @@ -0,0 +1,23 @@ +#!/usr/bin/env bash +# SPDX-License-Identifier: MPL-2.0 +set -euo pipefail +checker="$(cd "$(dirname "$0")" && pwd)/check-archive-links.sh" +fixture=$(mktemp -d) +trap 'rm -rf "$fixture"' EXIT +mkdir -p "$fixture/repo/assets" +printf 'fixture\n' > "$fixture/repo/assets/style.css" +ln -s assets/style.css "$fixture/repo/style.css" +bash "$checker" "$fixture/repo" +ln -s ../missing "$fixture/repo/broken" +if bash "$checker" "$fixture/repo"; then + echo 'FAIL: dangling link accepted' >&2 + exit 1 +fi +rm "$fixture/repo/broken" +printf 'outside\n' > "$fixture/outside" +ln -s ../outside "$fixture/repo/escape" +if bash "$checker" "$fixture/repo"; then + echo 'FAIL: external link accepted' >&2 + exit 1 +fi +echo 'PASS: internal links pass; dangling and external archive links fail' From 0c185ea6e7a22f3478fabd49b82c0addec87a0c9 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Wed, 9 Sep 2026 23:38:48 +0100 Subject: [PATCH 2/2] fix(ci): verify archive links on every repository change --- .github/workflows/validate-action-tests.yml | 13 +------------ 1 file changed, 1 insertion(+), 12 deletions(-) diff --git a/.github/workflows/validate-action-tests.yml b/.github/workflows/validate-action-tests.yml index 1e9a962..0d747db 100644 --- a/.github/workflows/validate-action-tests.yml +++ b/.github/workflows/validate-action-tests.yml @@ -3,20 +3,8 @@ name: Validate K9 action on: pull_request: - paths: - - ".github/workflows/validate-action-tests.yml" - - "validate-action/**" - - "editors/vscode/container/.gatekeeper.yaml" - - "pandoc/container/.gatekeeper.yaml" - - "site/**" push: branches: [main] - paths: - - ".github/workflows/validate-action-tests.yml" - - "validate-action/**" - - "editors/vscode/container/.gatekeeper.yaml" - - "pandoc/container/.gatekeeper.yaml" - - "site/**" workflow_dispatch: permissions: @@ -26,6 +14,7 @@ jobs: regression-tests: name: K9 validator regression tests runs-on: ubuntu-latest + timeout-minutes: 10 steps: - name: Check out source uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4