Skip to content

Road to 1.11 🚀#206

Merged
TheophileDiot merged 54 commits into
mainfrom
dev
Jun 26, 2026
Merged

Road to 1.11 🚀#206
TheophileDiot merged 54 commits into
mainfrom
dev

Conversation

@TheophileDiot

Copy link
Copy Markdown
Member

No description provided.

jonas0b1011001 and others added 30 commits September 21, 2024 13:41
bash create_bunkerweb_plugin.sh -d "MYPLUGIN" --with-ui --with-jobs --with-configs --with-templates MYPLUGIN
will fix later
#needs_fix
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.28.11 to 4.36.2.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@6bb031a...8aad20d)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 4.32.2
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Bumps [docker/login-action](https://github.com/docker/login-action) from 3.3.0 to 4.2.0.
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](docker/login-action@9780b0c...650006c)

---
updated-dependencies:
- dependency-name: docker/login-action
  dependency-version: 3.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Bumps [actions/checkout](https://github.com/actions/checkout) from 4.2.2 to 7.0.0.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@11bd719...9c091bb)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 6.0.2
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
…github/codeql-action-4.32.2

deps/gha: bump github/codeql-action from 3.28.11 to 4.36.2
…actions/checkout-6.0.2

deps/gha: bump actions/checkout from 4.2.2 to 7.0.0
…docker/login-action-3.7.0

deps/gha: bump docker/login-action from 3.3.0 to 4.2.0
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
created a plugin for authentik / auth request
TheophileDiot and others added 24 commits June 25, 2026 11:36
fix(authentik): harden identity-header handling, docs, and tests
plugin generator for creating a new plugin structure
test: parallelize CI into a matrix, cover notifier plugins, add unit tests
fix: multipart parsing for HTTP/2 support in ClamAV plugin
Bumps [actions/setup-go](https://github.com/actions/setup-go) from 5.2.0 to 6.5.0.
- [Release notes](https://github.com/actions/setup-go/releases)
- [Commits](actions/setup-go@3041bf5...924ae3a)

---
updated-dependencies:
- dependency-name: actions/setup-go
  dependency-version: 6.5.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Bumps [actions/setup-python](https://github.com/actions/setup-python) from 5.3.0 to 6.3.0.
- [Release notes](https://github.com/actions/setup-python/releases)
- [Commits](actions/setup-python@0b93645...ece7cb0)

---
updated-dependencies:
- dependency-name: actions/setup-python
  dependency-version: 6.3.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
…actions/setup-go-6.5.0

deps/gha: bump actions/setup-go from 5.2.0 to 6.5.0
…actions/setup-python-6.3.0

deps/gha: bump actions/setup-python from 5.3.0 to 6.3.0
@TheophileDiot TheophileDiot changed the title initiald to 1.11 🚀 Road to 1.11 🚀 Jun 26, 2026
@TheophileDiot TheophileDiot merged commit fb55b84 into main Jun 26, 2026
15 of 16 checks passed
@coderabbitai

coderabbitai Bot commented Jun 26, 2026

Copy link
Copy Markdown

Review Change Stack

Caution

Review failed

The pull request is closed.

Warning

Ignoring CodeRabbit configuration file changes. For security, only the configuration from the base branch is applied for open source repositories.

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Repository UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: f58e034f-c4ea-4c71-b94a-c0af3d94bc82

📥 Commits

Reviewing files that changed from the base of the PR and between 1aa4dc5 and f2a2a8c.

⛔ Files ignored due to path filters (14)
  • clamav/docs/diagram.drawio is excluded by !**/docs/diagram.drawio, !**/*.drawio and included by **
  • clamav/docs/diagram.svg is excluded by !**/*.svg, !**/docs/diagram.svg, !**/*.svg and included by **
  • cloudflare/docs/api_token.png is excluded by !**/*.png, !**/docs/**/*.png and included by **
  • coraza/docs/diagram.drawio is excluded by !**/docs/diagram.drawio, !**/*.drawio and included by **
  • coraza/docs/diagram.svg is excluded by !**/*.svg, !**/docs/diagram.svg, !**/*.svg and included by **
  • discord/docs/diagram.drawio is excluded by !**/docs/diagram.drawio, !**/*.drawio and included by **
  • discord/docs/diagram.svg is excluded by !**/*.svg, !**/docs/diagram.svg, !**/*.svg and included by **
  • package-lock.json is excluded by !**/package-lock.json and included by **
  • slack/docs/diagram.drawio is excluded by !**/docs/diagram.drawio, !**/*.drawio and included by **
  • slack/docs/diagram.svg is excluded by !**/*.svg, !**/docs/diagram.svg, !**/*.svg and included by **
  • virustotal/docs/diagram.drawio is excluded by !**/docs/diagram.drawio, !**/*.drawio and included by **
  • virustotal/docs/diagram.svg is excluded by !**/*.svg, !**/docs/diagram.svg, !**/*.svg and included by **
  • webhook/docs/diagram.drawio is excluded by !**/docs/diagram.drawio, !**/*.drawio and included by **
  • webhook/docs/diagram.svg is excluded by !**/*.svg, !**/docs/diagram.svg, !**/*.svg and included by **
📒 Files selected for processing (116)
  • .busted
  • .coderabbit.yaml
  • .github/dependabot.yml
  • .github/workflows/codeql.yml
  • .github/workflows/release.yml
  • .github/workflows/tests.yml
  • .gitignore
  • .pre-commit-config.yaml
  • .prettierignore
  • .tests/authentik.sh
  • .tests/authentik/docker-compose.yml
  • .tests/authentik/mock-outpost.conf
  • .tests/build-push.sh
  • .tests/clamav.sh
  • .tests/cloudflare.sh
  • .tests/cloudflare/cf-api-mock/Dockerfile
  • .tests/cloudflare/cf-api-mock/app.py
  • .tests/cloudflare/cfips-mock.conf
  • .tests/cloudflare/docker-compose.yml
  • .tests/coraza.sh
  • .tests/misc/json2md.py
  • .tests/notifier.sh
  • .tests/notifier/docker-compose.yml
  • .tests/notifier/ratelimit.conf
  • .tests/virustotal.sh
  • .tests/virustotal/docker-compose.yml
  • .tests/virustotal/vt-mock.conf
  • CLAUDE.md
  • COMPATIBILITY.json
  • README.md
  • authentik/README.md
  • authentik/authentik.lua
  • authentik/authentik_helpers.lua
  • authentik/confs/server-http/authentik.conf
  • authentik/docs/diagram.mmd
  • authentik/plugin.json
  • clamav/README.md
  • clamav/clamav.lua
  • clamav/clamav_helpers.lua
  • clamav/docs/diagram.mmd
  • clamav/plugin.json
  • clamav/ui/actions.py
  • cloudflare/README.md
  • cloudflare/cloudflare.lua
  • cloudflare/cloudflare_helpers.lua
  • cloudflare/confs/default-server-http/cloudflare.conf
  • cloudflare/confs/server-http/cloudflare-ssl.conf
  • cloudflare/confs/server-http/cloudflare.conf
  • cloudflare/confs/server-stream/cloudflare.conf
  • cloudflare/docs/diagram.mmd
  • cloudflare/jobs/cf-aop-ca-download.py
  • cloudflare/jobs/cf-edge-ban-sync.py
  • cloudflare/jobs/cf-manage-origin-certs.py
  • cloudflare/jobs/cf-trusted-ips-download.py
  • cloudflare/jobs/cloudflare_helpers.py
  • cloudflare/plugin.json
  • cloudflare/ui/actions.py
  • coraza/README.md
  • coraza/api/Dockerfile
  • coraza/api/crs.sh
  • coraza/api/go.mod
  • coraza/api/main.go
  • coraza/api/main_test.go
  • coraza/docs/diagram.mmd
  • coraza/plugin.json
  • coraza/ui/actions.py
  • discord/README.md
  • discord/discord.lua
  • discord/discord_helpers.lua
  • discord/docs/diagram.mmd
  • discord/plugin.json
  • discord/ui/actions.py
  • matrix/README.md
  • matrix/docs/diagram.mmd
  • matrix/matrix.lua
  • matrix/matrix_helpers.lua
  • matrix/plugin.json
  • matrix/ui/actions.py
  • matrix/utils.lua
  • misc/update_version.sh
  • package.json
  • pyproject.toml
  • slack/README.md
  • slack/docs/diagram.mmd
  • slack/plugin.json
  • slack/slack.lua
  • slack/slack_helpers.lua
  • slack/ui/actions.py
  • spec/authentik_helpers_spec.lua
  • spec/clamav_helpers_spec.lua
  • spec/cloudflare_helpers_spec.lua
  • spec/discord_helpers_spec.lua
  • spec/helpers/fake_ipmatcher.lua
  • spec/helpers/fake_ngx.lua
  • spec/matrix_helpers_spec.lua
  • spec/slack_helpers_spec.lua
  • spec/virustotal_helpers_spec.lua
  • spec/webhook_helpers_spec.lua
  • templates/README.md
  • templates/create_bunkerweb_plugin.sh
  • templates/template_diagram.mmd
  • tests/conftest.py
  • tests/test_cloudflare_helpers.py
  • tests/test_ui_actions.py
  • virustotal/README.md
  • virustotal/docs/diagram.mmd
  • virustotal/plugin.json
  • virustotal/ui/actions.py
  • virustotal/virustotal.lua
  • virustotal/virustotal_helpers.lua
  • webhook/README.md
  • webhook/docs/diagram.mmd
  • webhook/plugin.json
  • webhook/ui/actions.py
  • webhook/webhook.lua
  • webhook/webhook_helpers.lua

Root / shared

  • Bumped the collection badge/version in README.md to 1.11 and expanded the plugin index.
  • Added CLAUDE.md repo guidance, package.json for Prettier, .coderabbit.yaml, .busted, and updated .gitignore, .pre-commit-config.yaml, .prettierignore, pyproject.toml.
  • Added COMPATIBILITY.json entries for 1.6.1 through 1.6.11.
  • Added misc/update_version.sh support for badge-based README rewrites.
  • Security/review impact: broader automated lint/review/tooling coverage; no runtime behaviour change.

.github

  • Added Dependabot config for npm updates.
  • Updated CodeQL action pinning.
  • Added release automation to draft GitHub releases after successful tests on main.
  • Reworked tests workflow to resolve the latest stable BunkerWeb tag at runtime and use job concurrency/cancellation.
  • Deployment impact: CI/release flow now tracks upstream BunkerWeb releases dynamically.

.tests

  • Added new integration suites and fixtures for authentik, cloudflare, and notifier, plus expanded coverage for clamav, coraza, and virustotal.
  • Added mock services/configs for Cloudflare API/IP ranges/AOP, Authentik outpost, VirusTotal API, notifier sinks, and ratelimit retry handling.
  • Test coverage now exercises redirect/auth header handling, spoofed header stripping, origin CA/AOP flows, ban sync, redaction, retry-after handling, cache behaviour, and fail-open/deny paths.
  • Security impact: validates header redaction, spoofing resistance, and fail-open/deny semantics.

clamav

  • Bumped plugin metadata to 1.11 and clarified timeout help text.
  • Extracted stream_size into clamav_helpers.lua and widened multipart filename detection to include filename*.
  • Updated README/docs and added helper tests.
  • Behaviour: broader file-scan coverage for multipart uploads.

coraza

  • coraza/plugin.json moved to 1.11 and updated wording to reflect the WAF sidecar model.
  • coraza/README.md and diagram were expanded; coraza/api now ships updated Go toolchain/deps, revised logging, and new unit tests.
  • coraza/api/main.go now initialises loggers at declaration and hardens audit log formatting.
  • Security impact: safer logging plus updated sidecar/runtime baseline.
  • Note: coraza.lua itself is not changed here; the standalone Go service under coraza/api/** is.

discord

  • Plugin manifest bumped to 1.11.
  • Added shared helpers for field truncation and header redaction; discord.lua now redacts sensitive headers and tightens error handling.
  • README/docs updated with async delivery, retry handling, and redaction behaviour.
  • Security impact: prevents leaking credential-bearing headers in notifications.

slack

  • Plugin manifest bumped to 1.11.
  • Added shared header helpers; slack.lua now redacts sensitive headers and returns earlier on webhook/client failures.
  • README/docs updated with async send/retry behaviour.
  • Security impact: same header-redaction hardening as Discord/WebHook.

virustotal

  • Plugin manifest bumped to 1.11 and added VIRUSTOTAL_API_URL.
  • virustotal.lua now uses a configurable API base URL and delegates verdict evaluation to helpers.
  • Added helper module/tests plus mock VT API for integration coverage.
  • Behaviour: API endpoint is now configurable; verdict evaluation is extracted and unit-tested.

webhook

  • Plugin manifest bumped to 1.11.
  • Added shared header helpers; webhook.lua now redacts sensitive headers and hardens error responses.
  • README/docs updated with async delivery and retry semantics.
  • Security impact: reduces sensitive-data leakage in outbound webhook payloads.

Version drift

  • Collection/docs were updated to 1.11.
  • Per-plugin plugin.json versions now align at 1.11 for clamav, coraza, discord, slack, virustotal, webhook, authentik, cloudflare, and matrix.
  • COMPATIBILITY.json still tracks collection compatibility separately; its new entries expand the 1.8 mapping and do not appear to introduce a mismatch with the plugin manifests shown here.

Walkthrough

This PR adds new Authentik, Cloudflare, Discord, Slack, Webhook, Matrix, ClamAV, Coraza, and VirusTotal plugin code, docs, tests, and mocks; updates generator scaffolding and repository workflows; and refreshes shared helper modules, compatibility metadata, and contributor guidance.

Changes

Repository automation and shared tooling

Layer / File(s) Summary
Review and release automation
.coderabbit.yaml, .github/dependabot.yml, .github/workflows/*.yml
Repository review settings, Dependabot, CodeQL, and release workflows are updated.
Test pipeline
.busted, .github/workflows/tests.yml, .tests/build-push.sh
Test discovery, the test workflow, and the build/push helper script are updated together.
Local tooling and test helpers
.gitignore, .pre-commit-config.yaml, .prettierignore, package.json, pyproject.toml, misc/update_version.sh, tests/conftest.py, tests/test_ui_actions.py, tests/misc/json2md.py, spec/helpers/*
Ignore rules, pre-commit hooks, package metadata, version rewriting, and shared test helpers are updated.
Repository docs and compatibility
README.md, CLAUDE.md, COMPATIBILITY.json
Repository overview, contributor guidance, and compatibility mappings are refreshed.

Plugin generator scaffolding

Layer / File(s) Summary
Generator docs and template
templates/README.md, templates/template_diagram.mmd
The generator README and plugin-flow template are populated.
Base scaffold output
templates/create_bunkerweb_plugin.sh
The scaffold script now validates plugin names and writes plugin metadata and Lua entrypoints.
Optional generated components
templates/create_bunkerweb_plugin.sh
The scaffold script now emits optional UI hooks, jobs, NGINX templates, and custom template files.
README output and CLI
templates/create_bunkerweb_plugin.sh
The scaffold script now writes plugin READMEs and handles overwrite prompts and CLI parsing.

Authentik plugin

Layer / File(s) Summary
Core auth flow
authentik/authentik_helpers.lua, authentik/authentik.lua, authentik/plugin.json
The Authentik manifest, helper module, and request-handling plugin are added.
Template and docs
authentik/confs/server-http/authentik.conf, authentik/docs/diagram.mmd, authentik/README.md
The outpost proxy template, request-flow diagram, and README are added.
Integration stack
.tests/authentik.sh, .tests/authentik/docker-compose.yml, .tests/authentik/mock-outpost.conf
The Authentik end-to-end stack, mock outpost, and shell assertions are added.
Helper spec
spec/authentik_helpers_spec.lua
The pure helper functions are covered by Busted specs.

Cloudflare plugin

Layer / File(s) Summary
Contract and helpers
cloudflare/plugin.json, cloudflare/cloudflare_helpers.lua
The Cloudflare manifest and helper module are added.
Configuration and docs
cloudflare/confs/*/cloudflare.conf, cloudflare/confs/server-http/cloudflare-ssl.conf, cloudflare/docs/diagram.mmd, cloudflare/README.md
Real-IP, mTLS, and ban-sync config templates, plus the flow diagram and README, are added.
Runtime and UI
cloudflare/cloudflare.lua, cloudflare/ui/actions.py
The request trust engine and UI ping action are added.
Job workers
cloudflare/jobs/cloudflare_helpers.py, cloudflare/jobs/cf-*.py
Shared Python helpers and the scheduled Cloudflare jobs are added.
Integration tests
.tests/cloudflare/*, spec/cloudflare_helpers_spec.lua, tests/test_cloudflare_helpers.py
The Cloudflare end-to-end stack, mocks, and helper tests are added.

Notification plugins

Layer / File(s) Summary
Discord notification flow
discord/*, spec/discord_helpers_spec.lua
Discord helper redaction, webhook dispatch, docs, UI status handling, and helper specs are updated.
Slack notification flow
slack/*, spec/slack_helpers_spec.lua
Slack helper redaction, webhook dispatch, docs, UI status handling, and helper specs are updated.
Webhook notification flow
webhook/*, spec/webhook_helpers_spec.lua
Webhook helper redaction, payload handling, docs, UI status handling, and helper specs are updated.
Matrix notification flow
matrix/*, spec/matrix_helpers_spec.lua
Matrix helper redaction, notification dispatch, docs, UI status handling, and helper specs are updated.
Shared notifier integration stack
.tests/notifier/*
The shared notifier compose stack, rate-limit mock, and end-to-end checks are added.

Security scanning plugins

Layer / File(s) Summary
ClamAV plugin
clamav/*, spec/clamav_helpers_spec.lua, .tests/clamav.sh
ClamAV helper extraction, scan matching, docs, UI, specs, and end-to-end checks are updated.
Coraza plugin
coraza/*, coraza/api/*
Coraza manifest, sidecar build/runtime, docs, UI, and unit tests are updated.
VirusTotal plugin
virustotal/*, spec/virustotal_helpers_spec.lua, .tests/virustotal/*
VirusTotal helper extraction, API base URL config, docs, mock stack, and helper specs are added.

Estimated code review effort

🎯 5 (Critical) | ⏱️ ~120 minutes

Possibly related PRs

Poem

A flock of plugins learned to sing,
With headers redacted, quiet and neat.
Mocks stood ready, CI at spring,
And tests marched in time with steady feet.
A tidy release, brisk and complete.

✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 golangci-lint (2.12.2)

level=error msg="[linters_context] typechecking error: pattern ./...: directory prefix . does not contain main module or its selected dependencies"


Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants