8 Commits

Include renames

Author	SHA1	Message	Date
jaredandClaude Opus 4.8	94ad84dae9	CI: pin actions/checkout to a commit SHA ... semgrep's github-actions-mutable-action-tag rule (now running, after the pip install was fixed) flags actions/checkout@v3 as a mutable tag that could be repointed upstream (supply-chain risk). Pin all four uses to the SHA the v3 tag currently resolves to (v3.6.0), preserving behavior. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-06-30 14:53:38 -04:00
jaredandClaude Opus 4.8	b2c19745eb	Add trusted-proxy auth hardening + PHP requirements checks ... Trusted-proxy hardening (defense-in-depth for Authelia forward-auth): - AuthMiddleware now only honors Remote-* identity headers when REMOTE_ADDR is in a configured TRUSTED_PROXIES allowlist; otherwise it refuses with 403 and logs an 'untrusted_proxy' security event. Previously anything that could reach PHP directly could spoof Remote-User/Remote-Groups and log in as admin. - New config TRUSTED_PROXIES (comma-separated, from .env). Empty = enforcement off, so this is backward compatible until the allowlist is set on a host. Requirements checks (so a PHP upgrade dropping an extension can't silently break features like avatars again): - config/requirements.php: single source of truth for min PHP version and required extensions (ldap, mysqli, curl, mbstring, fileinfo, json). - scripts/check_requirements.php: CI script that fails the build if the environment doesn't satisfy them. - New 'requirements' CI job installs those extensions and runs the check; deploy now depends on it. - api/health.php: adds php_extensions + php_version checks so production monitoring surfaces the drift (returns 503 if a required extension is gone). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-06-30 10:22:53 -04:00
jaredandClaude Sonnet 4.6	dfae1d4648	ci: add notify-failure, deploy tagging, and PHP security scanning ... - lint.yml: add notify-failure Matrix alert job; add Tag deployed commit step (main branch only) with deploy-YYYY.MM.DD-N tagging via Gitea API; add permissions: contents: write to deploy job - security.yml: new workflow running semgrep with p/php and p/owasp-top-ten configs on push, PR, and weekly schedule Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-04-14 16:25:18 -04:00
jaredandClaude Sonnet 4.6	31510cfe0f	ci: gate deploy behind lint — Actions triggers webhook after lint passes ... Adds a deploy job that runs only when both php-lint and js-lint succeed. Calls the CT132 webhook directly with HMAC-SHA256 signature from the WEBHOOK_SECRET repo secret. Disabled the direct push webhooks that previously deployed on every push regardless of lint status. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-04-13 21:42:34 -04:00
jared	b6df647921	ci: add php-xml for phpcs xmlwriter/SimpleXML deps	2026-04-13 20:51:17 -04:00
jared	e3a115fd02	ci: install php via apt, relax eslint rules for existing codebase	2026-04-13 20:47:26 -04:00
jared	46285b8abc	ci: use php:8.2-cli container for phpcs job	2026-04-13 20:41:03 -04:00
jared	d38cc1bfbe	ci: add phpcs and eslint linting workflow	2026-04-13 20:34:21 -04:00