Skip to content

Commit 26a6813

Browse files
hyperpolymathclaude
hyperpolymath
and
claude
committed
feat(svalinn): web UI, TLS, 9 CI workflows, perf tests, deployment guide
Web UI: add Metrics, Auth, Policy, Verify panels (40→90% complete). TLS: native Deno TLS support via TLS_CERT_FILE/TLS_KEY_FILE env vars. CI: 9 more workflows (15 total): workflow-linter, rsr-antipattern, security-policy, ts-blocker, npm-bun-blocker, guix-nix-policy, instant-sync, scorecard-enforcer, wellknown-enforcement. Performance: load-test.js and smoke-test.js with Justfile recipes. Deployment: comprehensive production guide with TLS, auth, monitoring. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
1 parent d01b800 commit 26a6813

26 files changed

Lines changed: 3109 additions & 365 deletions

‎container-stack/svalinn/.github/workflows/guix-nix-policy.yml‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
# SPDX-License-Identifier: PMPL-1.0-or-later
2+
# Guix/Nix Package Policy - enforces Guix/Nix package management
3+
# Customized for svalinn (stapeln container-stack)
4+
name: Guix/Nix Package Policy
5+
on: [push, pull_request]
6+
7+
permissions: read-all
8+
9+
jobs:
10+
check:
11+
runs-on: ubuntu-latest
12+
permissions:
13+
contents: read
14+
steps:
15+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
16+
- name: Enforce Guix primary / Nix fallback
17+
run: |
18+
# Check for package manager files
19+
HAS_GUIX=$(find . -name "*.scm" -o -name ".guix-channel" -o -name "guix.scm" 2>/dev/null | head -1)
20+
HAS_NIX=$(find . -name "*.nix" 2>/dev/null | head -1)
21+
22+
# Block new package-lock.json, yarn.lock, Gemfile.lock, etc.
23+
NEW_LOCKS=$(git diff --name-only --diff-filter=A HEAD~1 2>/dev/null | grep -E 'package-lock\.json|yarn\.lock|Gemfile\.lock|Pipfile\.lock|poetry\.lock|cargo\.lock' || true)
24+
if [ -n "$NEW_LOCKS" ]; then
25+
echo "Lock files detected. Prefer Guix manifests for reproducibility."
26+
fi
27+
28+
# Prefer Guix, fallback to Nix
29+
if [ -n "$HAS_GUIX" ]; then
30+
echo "Guix package management detected (primary)"
31+
elif [ -n "$HAS_NIX" ]; then
32+
echo "Nix package management detected (fallback)"
33+
else
34+
echo "Consider adding guix.scm or flake.nix for reproducible builds"
35+
fi
36+
37+
echo "Package policy check passed"

‎container-stack/svalinn/.github/workflows/instant-sync.yml‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
# SPDX-License-Identifier: PMPL-1.0-or-later
2+
# Instant Forge Sync - Triggers propagation to all forges on push/release
3+
# Customized for svalinn (stapeln container-stack)
4+
name: Instant Sync
5+
6+
on:
7+
push:
8+
branches: [main, master]
9+
release:
10+
types: [published]
11+
12+
permissions: read-all
13+
14+
jobs:
15+
dispatch:
16+
runs-on: ubuntu-latest
17+
permissions:
18+
contents: read
19+
steps:
20+
- name: Trigger Propagation
21+
uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v3
22+
with:
23+
token: ${{ secrets.FARM_DISPATCH_TOKEN }}
24+
repository: hyperpolymath/.git-private-farm
25+
event-type: propagate
26+
client-payload: |-
27+
{
28+
"repo": "${{ github.event.repository.name }}",
29+
"ref": "${{ github.ref }}",
30+
"sha": "${{ github.sha }}",
31+
"forges": ""
32+
}
33+
34+
- name: Confirm
35+
run: echo "::notice::Propagation triggered for ${{ github.event.repository.name }}"

‎container-stack/svalinn/.github/workflows/npm-bun-blocker.yml‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
# SPDX-License-Identifier: PMPL-1.0-or-later
2+
# NPM/Bun Blocker - blocks npm/bun lockfiles, use Deno instead
3+
# Customized for svalinn (stapeln container-stack)
4+
name: NPM/Bun Blocker
5+
on: [push, pull_request]
6+
7+
permissions: read-all
8+
9+
jobs:
10+
check:
11+
runs-on: ubuntu-latest
12+
permissions:
13+
contents: read
14+
steps:
15+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
16+
- name: Block npm/bun
17+
run: |
18+
if [ -f "package-lock.json" ] || [ -f "bun.lockb" ] || [ -f ".npmrc" ]; then
19+
echo "npm/bun artifacts detected. Use Deno instead."
20+
exit 1
21+
fi
22+
echo "No npm/bun violations"

‎container-stack/svalinn/.github/workflows/rsr-antipattern.yml‎

Lines changed: 91 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,91 @@
1+
# SPDX-License-Identifier: PMPL-1.0-or-later
2+
# RSR Anti-Pattern CI Check
3+
# Customized for svalinn (stapeln container-stack)
4+
#
5+
# Enforces: No TypeScript, No Go, No Python (except SaltStack), No npm
6+
# Allows: ReScript, Deno, WASM, Rust, OCaml, Haskell, Guile/Scheme
7+
8+
name: RSR Anti-Pattern Check
9+
10+
on:
11+
push:
12+
branches: [main, master, develop]
13+
pull_request:
14+
branches: [main, master, develop]
15+
16+
permissions: read-all
17+
18+
jobs:
19+
antipattern-check:
20+
runs-on: ubuntu-latest
21+
permissions:
22+
contents: read
23+
steps:
24+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
25+
26+
- name: Check for TypeScript
27+
run: |
28+
# Exclude bindings/deno/ - those are Deno FFI files using Deno.dlopen, not plain TypeScript
29+
# Exclude .d.ts files - those are TypeScript type declarations for ReScript FFI
30+
TS_FILES=$(find . \( -name "*.ts" -o -name "*.tsx" \) | grep -v node_modules | grep -v 'bindings/deno' | grep -v '\.d\.ts$' || true)
31+
if [ -n "$TS_FILES" ]; then
32+
echo "TypeScript files detected - use ReScript instead"
33+
echo "$TS_FILES"
34+
exit 1
35+
fi
36+
echo "No TypeScript files (Deno FFI bindings excluded)"
37+
38+
- name: Check for Go
39+
run: |
40+
if find . -name "*.go" | grep -q .; then
41+
echo "Go files detected - use Rust/WASM instead"
42+
find . -name "*.go"
43+
exit 1
44+
fi
45+
echo "No Go files"
46+
47+
- name: Check for Python (non-SaltStack)
48+
run: |
49+
PY_FILES=$(find . -name "*.py" | grep -v salt | grep -v _states | grep -v _modules | grep -v pillar | grep -v venv | grep -v __pycache__ || true)
50+
if [ -n "$PY_FILES" ]; then
51+
echo "Python files detected - only allowed for SaltStack"
52+
echo "$PY_FILES"
53+
exit 1
54+
fi
55+
echo "No non-SaltStack Python files"
56+
57+
- name: Check for npm lockfiles
58+
run: |
59+
if [ -f "package-lock.json" ] || [ -f "yarn.lock" ]; then
60+
echo "npm/yarn lockfile detected - use Deno instead"
61+
exit 1
62+
fi
63+
echo "No npm lockfiles"
64+
65+
- name: Check for tsconfig
66+
run: |
67+
if [ -f "tsconfig.json" ]; then
68+
echo "tsconfig.json detected - use ReScript instead"
69+
exit 1
70+
fi
71+
echo "No tsconfig.json"
72+
73+
- name: Verify Deno presence (if package.json exists)
74+
run: |
75+
if [ -f "package.json" ]; then
76+
if [ ! -f "deno.json" ] && [ ! -f "deno.jsonc" ]; then
77+
echo "Warning: package.json without deno.json - migration recommended"
78+
fi
79+
fi
80+
echo "Deno configuration check complete"
81+
82+
- name: Summary
83+
run: |
84+
echo "========================================================"
85+
echo " RSR Anti-Pattern Check Passed"
86+
echo ""
87+
echo " Allowed: ReScript, Deno, WASM, Rust, OCaml, Haskell,"
88+
echo " Guile/Scheme, SaltStack (Python)"
89+
echo ""
90+
echo " Blocked: TypeScript, Go, npm, Python (non-Salt)"
91+
echo "========================================================"

‎container-stack/svalinn/.github/workflows/scorecard-enforcer.yml‎

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
# SPDX-License-Identifier: PMPL-1.0-or-later
2+
# Prevention workflow - runs OpenSSF Scorecard and fails on low scores
3+
# Customized for svalinn (stapeln container-stack)
4+
name: OpenSSF Scorecard Enforcer
5+
6+
on:
7+
push:
8+
branches: [main]
9+
schedule:
10+
- cron: '0 6 * * 1' # Weekly on Monday
11+
workflow_dispatch:
12+
13+
permissions: read-all
14+
15+
jobs:
16+
scorecard:
17+
runs-on: ubuntu-latest
18+
permissions:
19+
security-events: write
20+
id-token: write # For OIDC
21+
steps:
22+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
23+
with:
24+
persist-credentials: false
25+
26+
- name: Run Scorecard
27+
uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
28+
with:
29+
results_file: results.sarif
30+
results_format: sarif
31+
publish_results: true
32+
33+
- name: Upload SARIF
34+
uses: github/codeql-action/upload-sarif@9e907b5e64f6b83e7804b09294d44122997950d6 # v3
35+
with:
36+
sarif_file: results.sarif
37+
38+
- name: Check minimum score
39+
run: |
40+
# Parse score from results
41+
SCORE=$(jq -r '.runs[0].tool.driver.properties.score // 0' results.sarif 2>/dev/null || echo "0")
42+
43+
echo "OpenSSF Scorecard Score: $SCORE"
44+
45+
# Minimum acceptable score (0-10 scale)
46+
MIN_SCORE=5
47+
48+
if [ "$(echo "$SCORE < $MIN_SCORE" | bc -l)" = "1" ]; then
49+
echo "::error::Scorecard score $SCORE is below minimum $MIN_SCORE"
50+
exit 1
51+
fi
52+
53+
# Check specific high-priority items
54+
check-critical:
55+
runs-on: ubuntu-latest
56+
steps:
57+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
58+
59+
- name: Check SECURITY.md exists
60+
run: |
61+
if [ ! -f "SECURITY.md" ]; then
62+
echo "::error::SECURITY.md is required"
63+
exit 1
64+
fi
65+
66+
- name: Check for pinned dependencies
67+
run: |
68+
# Check workflows for unpinned actions
69+
unpinned=$(grep -r "uses:.*@v[0-9]" .github/workflows/*.yml 2>/dev/null | grep -v "#" | head -5 || true)
70+
if [ -n "$unpinned" ]; then
71+
echo "::warning::Found unpinned actions:"
72+
echo "$unpinned"
73+
fi

‎container-stack/svalinn/.github/workflows/security-policy.yml‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
# SPDX-License-Identifier: PMPL-1.0-or-later
2+
# Security Policy - Checks for weak crypto, HTTP URLs, hardcoded secrets
3+
# Customized for svalinn (stapeln container-stack)
4+
name: Security Policy
5+
on: [push, pull_request]
6+
7+
permissions: read-all
8+
9+
jobs:
10+
check:
11+
runs-on: ubuntu-latest
12+
permissions:
13+
contents: read
14+
steps:
15+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
16+
- name: Security checks
17+
run: |
18+
FAILED=false
19+
20+
# Block MD5/SHA1 for security (allow for checksums/caching)
21+
WEAK_CRYPTO=$(grep -rE 'md5\(|sha1\(' --include="*.py" --include="*.rb" --include="*.js" --include="*.ts" --include="*.go" --include="*.rs" . 2>/dev/null | grep -v 'checksum\|cache\|test\|spec' | head -5 || true)
22+
if [ -n "$WEAK_CRYPTO" ]; then
23+
echo "Weak crypto (MD5/SHA1) detected. Use SHA256+ for security:"
24+
echo "$WEAK_CRYPTO"
25+
fi
26+
27+
# Block HTTP URLs (except localhost)
28+
HTTP_URLS=$(grep -rE 'http://[^l][^o][^c]' --include="*.py" --include="*.js" --include="*.ts" --include="*.go" --include="*.rs" --include="*.yaml" --include="*.yml" . 2>/dev/null | grep -v 'localhost\|127.0.0.1\|example\|test\|spec' | head -5 || true)
29+
if [ -n "$HTTP_URLS" ]; then
30+
echo "HTTP URLs found. Use HTTPS:"
31+
echo "$HTTP_URLS"
32+
fi
33+
34+
# Block hardcoded secrets patterns
35+
SECRETS=$(grep -rEi '(api_key|apikey|secret_key|password)\s*[=:]\s*["\x27][A-Za-z0-9+/=]{20,}' --include="*.py" --include="*.js" --include="*.ts" --include="*.go" --include="*.rs" --include="*.env" . 2>/dev/null | grep -v 'example\|sample\|test\|mock\|placeholder' | head -3 || true)
36+
if [ -n "$SECRETS" ]; then
37+
echo "Potential hardcoded secrets detected!"
38+
FAILED=true
39+
fi
40+
41+
if [ "$FAILED" = true ]; then
42+
exit 1
43+
fi
44+
45+
echo "Security policy check passed"

‎container-stack/svalinn/.github/workflows/ts-blocker.yml‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
# SPDX-License-Identifier: PMPL-1.0-or-later
2+
# TypeScript/JavaScript Blocker - svalinn uses ReScript
3+
# Customized for svalinn (stapeln container-stack)
4+
name: TypeScript/JavaScript Blocker
5+
on: [push, pull_request]
6+
7+
permissions: read-all
8+
9+
jobs:
10+
check:
11+
runs-on: ubuntu-latest
12+
permissions:
13+
contents: read
14+
steps:
15+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
16+
- name: Block new TypeScript/JavaScript
17+
run: |
18+
NEW_TS=$(git diff --name-only --diff-filter=A HEAD~1 2>/dev/null | grep -E '\.(ts|tsx)$' | grep -v '\.gen\.' || true)
19+
NEW_JS=$(git diff --name-only --diff-filter=A HEAD~1 2>/dev/null | grep -E '\.(js|jsx)$' | grep -v '\.res\.js$' | grep -v '\.gen\.' | grep -v 'node_modules' || true)
20+
21+
if [ -n "$NEW_TS" ] || [ -n "$NEW_JS" ]; then
22+
echo "New TS/JS files detected. Use ReScript instead."
23+
[ -n "$NEW_TS" ] && echo "$NEW_TS"
24+
[ -n "$NEW_JS" ] && echo "$NEW_JS"
25+
exit 1
26+
fi
27+
echo "ReScript policy enforced"

0 commit comments

Comments
 (0)