Skip to content

Commit be51a13

Browse files
hyperpolymathmistral-vibe
hyperpolymath
and
mistral-vibe
committed
fix(ci): add concurrency to workflows and deduplicate gatekeeper configs
- Add concurrency with cancel-in-progress to boj-build.yml and instant-sync.yml (read-only workflows) - Add concurrency without cancel-in-progress to signed-push-smoke.yml (manual mutation workflow) - Add secrets: inherit to hypatia-scan.yml for hypatia-scan-reusable.yml - Deduplicate .gatekeeper.yaml files: create shared _shared/container/.gatekeeper.yaml and replace 10 duplicate copies with symlinks - Add wrapper workflows for readme-derive-reusable.yml and scorecard-reusable.yml Generated by Mistral Vibe. Co-Authored-By: Mistral Vibe <vibe@mistral.ai>
1 parent d3d6328 commit be51a13

17 files changed

Lines changed: 202 additions & 1220 deletions

File tree

‎.github/workflows/boj-build.yml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,14 @@ on:
1212
branches: [main, master]
1313
workflow_dispatch:
1414

15+
# Estate guardrail: cancel superseded runs so re-pushes / rebased PR
16+
# updates do not pile up queued runs against the shared account-wide
17+
# Actions concurrency pool. Applied only to read-only check workflows
18+
# (no publish/mutation), so cancelling a superseded run is always safe.
19+
concurrency:
20+
group: ${{ github.workflow }}-${{ github.ref }}
21+
cancel-in-progress: true
22+
1523
permissions:
1624
actions: read
1725
contents: read

‎.github/workflows/hypatia-scan.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,3 +25,4 @@ permissions:
2525
jobs:
2626
scan:
2727
uses: ./.github/workflows/hypatia-scan-reusable.yml
28+
secrets: inherit

‎.github/workflows/instant-sync.yml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,14 @@ on:
88
release:
99
types: [published]
1010

11+
# Estate guardrail: cancel superseded runs so re-pushes / rebased PR
12+
# updates do not pile up queued runs against the shared account-wide
13+
# Actions concurrency pool. Applied only to read-only check workflows
14+
# (no publish/mutation), so cancelling a superseded run is always safe.
15+
concurrency:
16+
group: ${{ github.workflow }}-${{ github.ref }}
17+
cancel-in-progress: true
18+
1119
permissions:
1220
actions: read
1321
contents: read

‎.github/workflows/readme-derive.yml‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
# SPDX-License-Identifier: MPL-2.0
2+
name: README Derive
3+
4+
on:
5+
push:
6+
branches: [main, master]
7+
paths:
8+
- 'README.adoc'
9+
- '.publishing.readme'
10+
pull_request:
11+
branches: [main, master]
12+
paths:
13+
- 'README.adoc'
14+
- '.publishing.readme'
15+
16+
concurrency:
17+
group: ${{ github.workflow }}-${{ github.ref }}
18+
cancel-in-progress: true
19+
20+
permissions:
21+
contents: write
22+
23+
jobs:
24+
derive:
25+
uses: ./.github/workflows/readme-derive-reusable.yml

‎.github/workflows/scorecard.yml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
# SPDX-License-Identifier: MPL-2.0
2+
name: Scorecard
3+
4+
on:
5+
push:
6+
branches: [main, master]
7+
pull_request:
8+
branches: [main, master]
9+
schedule:
10+
- cron: '0 0 * * 0'
11+
workflow_dispatch:
12+
13+
concurrency:
14+
group: ${{ github.workflow }}-${{ github.ref }}
15+
cancel-in-progress: true
16+
17+
permissions:
18+
actions: read
19+
contents: read
20+
21+
jobs:
22+
scorecard:
23+
uses: ./.github/workflows/scorecard-reusable.yml

‎.github/workflows/signed-push-smoke.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,11 @@ name: signed-push smoke test
77
on:
88
workflow_dispatch:
99

10+
# Manual workflow: use concurrency group to prevent concurrent runs but
11+
# do NOT cancel-in-progress since this is a manually triggered mutation.
12+
concurrency:
13+
group: ${{ github.workflow }}
14+
1015
permissions:
1116
contents: write
1217

‎_shared/container/.gatekeeper.yaml‎

Lines changed: 122 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,122 @@
1+
# SPDX-License-Identifier: MPL-2.0
2+
#
3+
# Svalinn gatekeeper policy for {{PROJECT_NAME}}
4+
#
5+
# Controls which operations are permitted through the edge gateway.
6+
# This template provides moderate security defaults — not wide-open test
7+
# mode, but not production-hardened either. Tighten the values below
8+
# before deploying to production.
9+
#
10+
# See: stapeln/container-stack/svalinn/
11+
12+
version: "1.0"
13+
14+
# ============================================================================
15+
# Authentication
16+
# ============================================================================
17+
#
18+
# Define which endpoints require authentication and at what level.
19+
20+
auth:
21+
# Public endpoints — no authentication required.
22+
# Health and readiness probes must always be public so that
23+
# orchestrators (selur, Podman, k8s) can check service status.
24+
public:
25+
- path: "/health"
26+
methods: ["GET"]
27+
- path: "/ready"
28+
methods: ["GET"]
29+
- path: "/metrics"
30+
methods: ["GET"]
31+
32+
# Endpoints requiring JWT or OAuth2 authentication.
33+
# Svalinn validates the token before forwarding the request.
34+
authenticated:
35+
- path: "/api/v1/*"
36+
methods: ["GET", "POST", "PUT", "DELETE"]
37+
38+
# ============================================================================
39+
# Rate Limiting
40+
# ============================================================================
41+
#
42+
# Protects backend services from overload. Values here are moderate
43+
# defaults — adjust based on your service capacity.
44+
45+
rate_limits:
46+
# Global limit: applied to all authenticated clients.
47+
global:
48+
requests_per_second: 500
49+
burst: 1000
50+
51+
# Write operations: stricter limit to protect data stores.
52+
writes:
53+
paths: ["/api/v1/*"]
54+
methods: ["POST", "PUT", "DELETE"]
55+
requests_per_second: 100
56+
burst: 200
57+
58+
# ============================================================================
59+
# Container Trust
60+
# ============================================================================
61+
#
62+
# Svalinn verifies that all .ctp bundles in the stack are signed by
63+
# trusted keys and carry the required attestations.
64+
65+
trust:
66+
# Only accept .ctp bundles signed by these keys.
67+
trusted_signers:
68+
- key_id: "{{SERVICE_NAME}}-release"
69+
algorithm: "Ed25519"
70+
public_key_file: "/etc/svalinn/keys/{{SERVICE_NAME}}-release.pub"
71+
72+
# Require these attestations on all .ctp bundles.
73+
required_attestations:
74+
- "source-signature"
75+
- "sbom-complete"
76+
77+
# Reject unsigned or untrusted images.
78+
reject_unsigned: true
79+
80+
# ============================================================================
81+
# Request Validation
82+
# ============================================================================
83+
#
84+
# Input validation at the gateway layer — catches malformed requests
85+
# before they reach the application.
86+
87+
validation:
88+
# Maximum request body size.
89+
max_body_size: "8MB"
90+
91+
# Reject requests with NaN or Infinity in numeric fields.
92+
reject_nan_inf: true
93+
94+
# Maximum result limit per list/search query.
95+
max_result_limit: 500
96+
97+
# ============================================================================
98+
# CORS
99+
# ============================================================================
100+
#
101+
# Cross-Origin Resource Sharing policy. The defaults below allow all
102+
# origins — restrict to your frontend domain(s) in production.
103+
104+
cors:
105+
allow_origins: ["*"]
106+
allow_methods: ["GET", "POST", "PUT", "DELETE", "OPTIONS"]
107+
allow_headers: ["Content-Type", "Authorization"]
108+
max_age: 3600
109+
110+
# ============================================================================
111+
# Logging
112+
# ============================================================================
113+
#
114+
# Structured logging for svalinn itself. Audit paths log all requests
115+
# (including body hashes) for post-incident investigation.
116+
117+
logging:
118+
format: "json"
119+
level: "info"
120+
# Log all write operations for audit trail.
121+
audit_paths:
122+
- "/api/v1/*"

‎a2ml/bindings/deno/container/.gatekeeper.yaml‎

Lines changed: 0 additions & 122 deletions
This file was deleted.

‎a2ml/bindings/deno/container/.gatekeeper.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
../../../../_shared/container/.gatekeeper.yaml

0 commit comments

Comments
 (0)