Road to 1.11 🚀

.busted

@@ -0,0 +1,10 @@
+return {
+	default = {
+		-- Run from the repo root so `require("authentik/authentik_helpers")`
+		-- resolves authentik/authentik_helpers.lua, mirroring how BunkerWeb
+		-- requires plugins ("<id>/<id>").
+		lpath = "./?.lua",
+		ROOT = { "spec" },
+		pattern = "_spec",
+	},
+}

.github/dependabot.yml

@@ -16,6 +16,21 @@ updates:
       prefix: "deps/gha"
     target-branch: "dev"
 
+  # npm (Prettier tooling)
+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule:
+      interval: "daily"
+      time: "09:00"
+      timezone: "Europe/Paris"
+    assignees:
+      - "TheophileDiot"
+    reviewers:
+      - "TheophileDiot"
+    commit-message:
+      prefix: "deps/npm"
+    target-branch: "dev"
+
   # Coraza
   - package-ecosystem: "docker"
     directory: "/coraza/api"

.github/workflows/codeql.yml

@@ -19,13 +19,13 @@ jobs:
         language: ["python", "go"]
     steps:
       - name: Checkout repository
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@6bb031afdd8eb862ea3fc1848194185e076637e5 # v3.28.11
+        uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
         with:
           languages: ${{ matrix.language }}
           config-file: ./.github/codeql.yml
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@6bb031afdd8eb862ea3fc1848194185e076637e5 # v3.28.11
+        uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
         with:
           category: "/language:${{matrix.language}}"

.github/workflows/release.yml

@@ -0,0 +1,81 @@
+name: Release
+
+# Cut a GitHub release once per plugin version bump. Mirrors the release-creation
+# step of bunkerity/bunkerweb (softprops/action-gh-release, pinned SHA, draft for
+# human review) without the heavy build matrix the plugins repo does not need.
+#
+# Fires only after the "Tests" workflow succeeds on main, and only when the
+# version in plugin.json does not already have a release — so a normal push to
+# main that does not bump the version is a no-op.
+
+on:
+  workflow_run:
+    workflows: [Tests]
+    types: [completed]
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  release:
+    if: github.event.workflow_run.conclusion == 'success'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write # create the tag + release
+    steps:
+      - name: Checkout the tested commit
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          ref: ${{ github.event.workflow_run.head_sha }}
+          fetch-depth: 0 # full history so generated release notes are complete
+
+      - name: Resolve plugin version
+        id: version
+        run: |
+          # All plugin.json carry the same version (kept in lockstep by
+          # misc/update_version.sh), so any one of them is the source of truth.
+          version="$(jq -r .version clamav/plugin.json)"
+          case "$version" in
+          "" | null | *[!0-9.]*)
+            echo "::error::unexpected plugin version '$version'"
+            exit 1
+            ;;
+          esac
+          echo "version=$version" >> "$GITHUB_OUTPUT"
+          echo "tag=v$version" >> "$GITHUB_OUTPUT"
+
+      - name: Skip if this version is already released
+        id: guard
+        env:
+          GH_TOKEN: ${{ github.token }}
+          TAG: ${{ steps.version.outputs.tag }}
+        run: |
+          # Match on tag_name across ALL releases, drafts included. A draft has
+          # no git tag until it is published, so `gh release view <tag>` would
+          # miss an unpublished draft and we'd create a duplicate on every push.
+          # The assignment aborts the step if `gh api` fails (no fail-open to
+          # "create" on an auth/network error).
+          tags="$(gh api "repos/$GITHUB_REPOSITORY/releases" --paginate --jq '.[].tag_name')"
+          if grep -Fxq "$TAG" <<<"$tags"; then
+            echo "exists=true" >> "$GITHUB_OUTPUT"
+            echo "Release $TAG already exists (including drafts) — nothing to do."
+          else
+            echo "exists=false" >> "$GITHUB_OUTPUT"
+            echo "No release for $TAG yet — creating a draft."
+          fi
+
+      - name: Create draft release
+        if: steps.guard.outputs.exists == 'false'
+        uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3.0.1
+        with:
+          tag_name: ${{ steps.version.outputs.tag }}
+          target_commitish: ${{ github.event.workflow_run.head_sha }}
+          name: ${{ steps.version.outputs.tag }}
+          draft: true # published by a maintainer after a quick review
+          generate_release_notes: true # auto-changelog from merged PRs/commits
+          body: |
+            BunkerWeb external plugins **${{ steps.version.outputs.tag }}**.
+
+            Install a plugin by mounting its directory into the scheduler's `/data/plugins`
+            (see the README). Coraza ships its WAF API as `bunkerity/bunkerweb-coraza`.

.github/workflows/tests.yml

@@ -4,6 +4,10 @@ on:
   push:
     branches: [dev, main]
 
+concurrency:
+  group: tests-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   codeql:
     uses: ./.github/workflows/codeql.yml
@@ -12,40 +16,143 @@ jobs:
       contents: read
       security-events: write
 
-  setup:
+  tag:
+    runs-on: ubuntu-latest
+    outputs:
+      bw_tag: ${{ steps.tag.outputs.bw_tag }}
+    steps:
+      - name: Resolve latest stable BunkerWeb tag
+        id: tag
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          # Always test against the latest STABLE BunkerWeb release, resolved at
+          # runtime so it never goes stale. GitHub's releases/latest endpoint
+          # excludes drafts and pre-releases (rc/beta), giving us "stable".
+          # Same tag on every branch (dev and main) — there is no pinned version.
+          # `|| true`: a 404 (no stable release yet) or rate-limit makes gh exit
+          # non-zero, which under `bash -e` would abort the step here with a raw
+          # error. Swallow it so the empty tag falls through to the case below
+          # and reports our own diagnostic.
+          tag="$(gh api repos/bunkerity/bunkerweb/releases/latest --jq .tag_name || true)"
+          tag="${tag#v}" # release tag may be "v1.6.1"; Docker tags have no "v"
+          case "$tag" in
+          "" | *-*)
+            echo "::error::could not resolve a stable BunkerWeb tag (got '${tag:-<empty>}')"
+            exit 1
+            ;;
+          esac
+          echo "Resolved latest stable BunkerWeb tag: $tag"
+          echo "bw_tag=$tag" >> "$GITHUB_OUTPUT"
+
+  lint:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout source code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - name: Set up Python
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+        with:
+          python-version: "3.11"
+      - name: Install pre-commit
+        run: pip install pre-commit
+      - name: Install Lua toolchain
+        # The luacheck pre-commit hook is language:lua and needs luarocks on the
+        # runner to bootstrap its environment.
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y lua5.4 liblua5.4-dev luarocks
+      - name: Set up Node
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: "22"
+          cache: "npm"
+      - name: Install Prettier
+        # The prettier hook is language:system and resolves prettier from the
+        # repo's pinned package-lock.json via npx.
+        run: npm ci
+      - name: Run pre-commit
+        run: pre-commit run --all-files
+
+  unit:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        lang: [go, python, lua]
+    steps:
+      - name: Checkout source code
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+
+      # --- Go : coraza API service ---
+      - name: Set up Go
+        if: matrix.lang == 'go'
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        with:
+          go-version: "1.25"
+      - name: Run Go unit tests
+        if: matrix.lang == 'go'
+        working-directory: coraza/api
+        run: |
+          # No go.sum is committed (the Dockerfile resolves deps at build time),
+          # so populate it before testing. Build tag must match the binary.
+          go mod tidy
+          go test -tags=coraza.rule.multiphase_evaluation ./...
+
+      # --- Python : ui/actions.py ---
+      - name: Set up Python
+        if: matrix.lang == 'python'
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+        with:
+          python-version: "3.11"
+      - name: Run Python unit tests
+        if: matrix.lang == 'python'
+        run: |
+          pip install pytest
+          pytest tests/ -q
 
-      - name: Get BW tag
+      # --- Lua : busted specs ---
+      - name: Run Lua unit tests
+        if: matrix.lang == 'lua'
         run: |
-          if [ "$GITHUB_REF" = "refs/heads/main" ] ; then
-            echo "BW_TAG=1.6.1" >> $GITHUB_ENV
-          else
-            echo "BW_TAG=dev" >> $GITHUB_ENV
-          fi
+          sudo apt-get update
+          # liblua5.4-dev provides headers for busted's C deps; pin the luarocks
+          # tree to 5.4 so the busted CLI runs against the lua5.4 we installed.
+          sudo apt-get install -y lua5.4 liblua5.4-dev luarocks
+          sudo luarocks --lua-version=5.4 install busted
+          busted
 
+  integration:
+    needs: [tag, lint, unit]
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        plugin: [clamav, cloudflare, coraza, virustotal, authentik, notifier]
+    steps:
+      - name: Checkout source code
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Login to Docker Hub
-        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_TOKEN }}
-
       - name: Pull and build BW
-        run: ./.tests/bw.sh "${{ env.BW_TAG }}"
-
-      - name: Run ClamAV tests
-        run: ./.tests/clamav.sh
-
-      - name: Run Coraza tests
-        run: ./.tests/coraza.sh
-
-      - name: Run VirusTotal tests
-        run: ./.tests/virustotal.sh
-        env:
-          VIRUSTOTAL_API_KEY: ${{ secrets.VIRUSTOTAL_API_KEY }}
+        run: bash .tests/bw.sh "${{ needs.tag.outputs.bw_tag }}"
+      - name: Run ${{ matrix.plugin }} tests
+        run: bash .tests/${{ matrix.plugin }}.sh
 
+  build-push:
+    needs: [tag, integration]
+    if: github.ref == 'refs/heads/main'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout source code
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - name: Login to Docker Hub
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
+        with:
+          username: ${{ secrets.DOCKER_USERNAME }}
+          password: ${{ secrets.DOCKER_TOKEN }}
       - name: Build and push APIs
-        if: env.BW_TAG == '1.6.1'
-        run: ./.tests/build-push.sh "${{ env.BW_TAG }}"
+        run: bash .tests/build-push.sh "${{ needs.tag.outputs.bw_tag }}"

.gitignore

@@ -4,3 +4,12 @@
 env
 node_modules
 style.css
+.idea
+
+# Python test artifacts
+__pycache__/
+*.pyc
+.pytest_cache/
+
+# Go: deps are resolved at build time; go.sum is regenerated, not committed
+coraza/api/go.sum