lockdown.yml

# SPDX-License-Identifier: MPL-2.0
# SPDX-FileCopyrightText: 2025 Hyperpolymath
#
# CI/CD Lockdown Workflow - Maximum Protection
# Enforces no code changes unless explicitly forked

name: Lockdown Enforcement

on:
  push:
    branches: ['**']
  pull_request:
    branches: ['**']
  fork:
  create:
  delete:
  repository_dispatch:

permissions:
  contents: read
  security-events: write

jobs:
  # ==========================================================================
  # Verify Signed Commits
  # ==========================================================================
  verify-signatures:
    name: Verify Commit Signatures
    runs-on: ubuntu-latest
    timeout-minutes: 15
    permissions:
      contents: read
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4
        with:
          fetch-depth: 0

      - name: Verify All Commits Signed (via GitHub API)
        env:
          GH_TOKEN: ${{ github.token }}
          REPO: ${{ github.repository }}
        run: |
          # The previous implementation used `git verify-commit` locally
          # on the runner. That ALWAYS fails for signed commits because
          # CI runners have no GPG keyring with the signer's public
          # key, so verify-commit can't validate the signature and
          # exits 1 — flagging every signed human commit as "unsigned"
          # (saw on PR #89, 2026-05-25 — commits with local `%G?: G`
          # rejected in CI).
          #
          # GitHub already verifies signatures server-side and exposes
          # the result via the REST API. We query each commit's
          # verification status directly. This also implicitly handles
          # the auto-merge-commit case: the API only knows about real
          # commits, not the ephemeral `refs/pull/N/merge`.
          echo "Checking commit signatures via GitHub API..."

          # Trusted bot accounts that don't require signatures.
          TRUSTED_BOTS="noreply@anthropic.com github-actions[bot] dependabot[bot]"

          # Range: PR head vs base (PRs) or current branch tip vs main (pushes).
          if [[ -n "${GITHUB_BASE_REF:-}" ]]; then
            RANGE="origin/${GITHUB_BASE_REF}..HEAD"
            git fetch --no-tags --depth=50 origin "${GITHUB_BASE_REF}" || true
          else
            RANGE="origin/main..HEAD"
          fi

          failed=0
          for commit in $(git log --no-merges --format=%H "$RANGE" 2>/dev/null || git log --no-merges --format=%H -10); do
            AUTHOR_EMAIL=$(git log -1 --format='%ae' "$commit")
            AUTHOR_NAME=$(git log -1 --format='%an' "$commit")

            # Trusted bot allowlist (still useful for dependabot etc.).
            is_bot=false
            for bot in $TRUSTED_BOTS; do
              if [[ "$AUTHOR_EMAIL" == "$bot" ]] || [[ "$AUTHOR_NAME" == "$bot" ]]; then
                is_bot=true
                echo "✓ Trusted bot commit: $commit ($AUTHOR_EMAIL)"
                break
              fi
            done
            [[ "$is_bot" == "true" ]] && continue

            verified=$(gh api "repos/${REPO}/commits/${commit}" --jq '.commit.verification.verified' 2>/dev/null || echo "")
            reason=$(gh api "repos/${REPO}/commits/${commit}" --jq '.commit.verification.reason' 2>/dev/null || echo "unknown")

            # `bad_email` means the SIGNATURE itself is valid (GPG checks
            # out) but the signing key's UID set on the GitHub-registered
            # key doesn't include this commit's author email. Soft-pass
            # with a warning: the commit IS cryptographically signed by a
            # key the user controls; only the GitHub-side UID binding is
            # incomplete. Hard policy enforcement would require the user
            # to add the noreply email as a UID on the key and re-upload.
            if [[ "$verified" == "true" ]]; then
              echo "✓ Signed and verified by GitHub: $commit"
            elif [[ "$reason" == "bad_email" ]]; then
              echo "⚠ Signed but GitHub UID mismatch (bad_email): $commit"
              echo "  Signature valid; key's GitHub-registered UIDs don't include $AUTHOR_EMAIL."
              echo "  Fix: add the email as a UID on the signing key, re-upload to GitHub."
            else
              echo "ERROR: Unsigned or unverifiable commit: $commit"
              echo "  Author: $AUTHOR_NAME <$AUTHOR_EMAIL>"
              echo "  GitHub verification: verified=$verified reason=$reason"
              echo "  All human commits MUST be GPG- or SSH-signed."
              failed=1
            fi
          done

          if [[ $failed -eq 1 ]]; then
            exit 1
          fi
          echo "All non-bot commits verified."

  # ==========================================================================
  # Enforce Branch Protection
  # ==========================================================================
  branch-protection:
    name: Enforce Branch Protection
    runs-on: ubuntu-latest
    timeout-minutes: 15
    # Server-side branch protection rules are the actual gate against direct
    # pushes; this job exists to surface that intent on the PR check page.
    # Running it on `push` events would always fail by design — useless noise
    # for maintainers landing fixes from main.
    if: github.event_name == 'pull_request'
    steps:
      - name: Check Protected Branches
        run: |
          BASE="${GITHUB_BASE_REF:-main}"
          PROTECTED_BRANCHES="main release"

          for protected in $PROTECTED_BRANCHES; do
            if [[ "$BASE" == "$protected"* ]]; then
              echo "PR targets protected branch: $BASE — gating applies."
            fi
          done

  # ==========================================================================
  # Verify No Unauthorized Changes
  # ==========================================================================
  verify-no-changes:
    name: Verify Authorized Changes Only
    runs-on: ubuntu-latest
    timeout-minutes: 15
    if: github.event_name == 'pull_request'
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4
        with:
          fetch-depth: 0

      - name: Check for Sensitive File Changes
        run: |
          # Files that require special authorization to modify
          SENSITIVE_FILES=(
            ".github/workflows/"
            ".github/CODEOWNERS"
            ".github/settings.yml"
            "SECURITY.md"
            "Mustfile"
            "container/config/selinux/"
            "security/"
          )

          CHANGED_FILES=$(git diff --name-only origin/main...HEAD)

          for file in $CHANGED_FILES; do
            for sensitive in "${SENSITIVE_FILES[@]}"; do
              if [[ "$file" == $sensitive* ]]; then
                echo "WARNING: Sensitive file modified: $file"
                echo "This change requires additional review from CODEOWNERS."
                # Don't fail, but flag for review
              fi
            done
          done

      - name: Verify No Force Push Attempted
        run: |
          # Check if this appears to be a rewritten history
          if ! git merge-base --is-ancestor origin/main HEAD 2>/dev/null; then
            echo "ERROR: History rewrite detected."
            echo "Force push and history modification are NOT allowed."
            exit 1
          fi

  # ==========================================================================
  # Verify Fork Requirements
  # ==========================================================================
  fork-check:
    name: Fork Requirements
    runs-on: ubuntu-latest
    timeout-minutes: 15
    if: github.event_name == 'fork'
    steps:
      - name: Document Fork
        run: |
          echo "Repository forked."
          echo "Fork owner: ${{ github.actor }}"
          echo "Original repo: ${{ github.repository }}"
          echo ""
          echo "NOTICE: Forks must comply with AGPL-3.0-or-later license."
          echo "All modifications must:"
          echo "  1. Keep source code publicly available"
          echo "  2. Maintain license notices"
          echo "  3. Document all changes"
          echo "  4. Keep security measures intact"

  # ==========================================================================
  # Validate Mustfile Compliance
  # ==========================================================================
  mustfile-compliance:
    name: Mustfile Compliance
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4

      - name: Install Mustfile Validator
        run: |
          # Install mustfile validator (placeholder)
          echo "Installing mustfile validator..."
          # cargo install mustfile-validator

      - name: Validate Mustfile
        run: |
          echo "Validating Mustfile compliance..."
          # mustfile validate Mustfile

          # Manual checks for critical requirements
          if ! grep -q "require_signed_commits = true" Mustfile; then
            echo "ERROR: Mustfile must require signed commits"
            exit 1
          fi

          if ! grep -q "no_force_push = true" Mustfile; then
            echo "ERROR: Mustfile must prohibit force push"
            exit 1
          fi

          echo "Mustfile compliance verified."

  # ==========================================================================
  # File Permission Lockdown Verification
  # ==========================================================================
  permission-check:
    name: Verify Lockdown Permissions
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4

      - name: Check File Permissions in Config
        run: |
          echo "Verifying lockdown permission requirements..."

          # Check config.nickel for proper lockdown settings
          if grep -q 'vault_files = "000"' config.nickel; then
            echo "✓ Vault files locked (000) when closed"
          else
            echo "WARNING: Vault lockdown may not be configured correctly"
          fi

          # Check Justfile has lockdown commands
          if grep -q "lock-files:" Justfile; then
            echo "✓ Justfile has lock-files recipe"
          else
            echo "ERROR: Justfile missing lock-files recipe"
            exit 1
          fi

  # ==========================================================================
  # Chroot Configuration Verification
  # ==========================================================================
  chroot-check:
    name: Verify Chroot Configuration
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4

      - name: Verify Chroot Settings
        run: |
          echo "Checking chroot jail configuration..."

          # Verify cadre-router has chroot enabled
          if grep -q 'chroot.*enabled.*true' network/cadre-router/cadre-config.nickel; then
            echo "✓ Chroot enabled in cadre-router"
          else
            echo "ERROR: Chroot must be enabled"
            exit 1
          fi

          # Verify minimal jail permissions
          if grep -q 'chmod 500' Justfile || grep -q 'jail_mode = "500"' Mustfile; then
            echo "✓ Chroot jail has restricted permissions"
          fi

          echo "Chroot configuration verified."

  # ==========================================================================
  # API Surface Minimization
  # ==========================================================================
  api-surface-check:
    name: Verify Minimal API Surface
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4

      - name: Check API Restrictions
        run: |
          echo "Verifying minimal API attack surface..."

          # Check that only necessary endpoints exist
          # Verify no debug/admin endpoints in production config

          if grep -q 'accept_xml.*enabled.*false' network/cadre-router/cadre-config.nickel; then
            echo "✓ XML parsing disabled (XXE prevention)"
          fi

          if grep -q 'accept_form.*enabled.*false' network/cadre-router/cadre-config.nickel; then
            echo "✓ Form data disabled"
          fi

          if grep -q 'accept_multipart.*enabled.*false' network/cadre-router/cadre-config.nickel; then
            echo "✓ File uploads disabled"
          fi

          echo "API surface minimized."

  # ==========================================================================
  # Final Lockdown Report
  # ==========================================================================
  lockdown-report:
    name: Lockdown Status Report
    runs-on: ubuntu-latest
    timeout-minutes: 15
    needs: [verify-signatures, branch-protection, mustfile-compliance, permission-check, chroot-check, api-surface-check]
    if: always()
    steps:
      - name: Generate Report
        run: |
          echo "╔══════════════════════════════════════════════════════════════╗"
          echo "║              RGTV LOCKDOWN REPORT                   ║"
          echo "╠══════════════════════════════════════════════════════════════╣"
          echo "║ Commit Signatures: ${{ needs.verify-signatures.result }}"
          echo "║ Branch Protection: ${{ needs.branch-protection.result }}"
          echo "║ Mustfile Compliance: ${{ needs.mustfile-compliance.result }}"
          echo "║ Permission Lockdown: ${{ needs.permission-check.result }}"
          echo "║ Chroot Configuration: ${{ needs.chroot-check.result }}"
          echo "║ API Surface: ${{ needs.api-surface-check.result }}"
          echo "╚══════════════════════════════════════════════════════════════╝"

          # Fail if any critical check failed
          if [[ "${{ needs.verify-signatures.result }}" == "failure" ]] || \
             [[ "${{ needs.mustfile-compliance.result }}" == "failure" ]]; then
            echo "CRITICAL: Lockdown requirements not met."
            exit 1
          fi