Merge remote-tracking branch 'origin/main' into fix/security-gateway-sessions

# Conflicts:
#	docs/versioning.md
#	versions.env

.github/workflows/_build-image.yaml

@@ -53,6 +53,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Prepare environment
         env:

.github/workflows/build-gateway.yaml

@@ -12,11 +12,9 @@ on:
       - .github/workflows/build-gateway.yaml
       - .github/workflows/_build-image.yaml
 
+# Write scopes are granted to the build job only; every other job stays read-only.
 permissions:
   contents: read
-  packages: write
-  id-token: write
-  attestations: write
 
 concurrency:
   group: build-gateway-${{ github.ref }}

.github/workflows/build-main.yaml

@@ -13,11 +13,9 @@ on:
       - .github/workflows/build-main.yaml
       - .github/workflows/_build-image.yaml
 
+# Write scopes are granted to the build job only; every other job stays read-only.
 permissions:
   contents: read
-  packages: write
-  id-token: write
-  attestations: write
 
 concurrency:
   group: build-main-${{ github.ref }}

.github/workflows/ci-manifests.yaml

@@ -46,12 +46,19 @@ jobs:
       - name: Install agent-sandbox and Gateway API CRDs
         run: |
           set -euo pipefail
-          kubectl apply -f "https://github.com/kubernetes-sigs/agent-sandbox/releases/download/$AGENT_SANDBOX_VERSION/sandbox-with-extensions.yaml"
+          # Download, verify the pinned digest from versions.env, then apply.
+          curl -fsSL --proto '=https' -o /tmp/agent-sandbox.yaml \
+            "https://github.com/kubernetes-sigs/agent-sandbox/releases/download/$AGENT_SANDBOX_VERSION/sandbox-with-extensions.yaml"
+          printf '%s  %s\n' "$AGENT_SANDBOX_MANIFEST_SHA256" /tmp/agent-sandbox.yaml | sha256sum -c -
+          kubectl apply -f /tmp/agent-sandbox.yaml
           kubectl wait --for=condition=Established crd/sandboxtemplates.extensions.agents.x-k8s.io --timeout=180s
           kubectl wait --for=condition=Established crd/sandboxwarmpools.extensions.agents.x-k8s.io --timeout=180s
           kubectl wait --for=condition=Established crd/sandboxclaims.extensions.agents.x-k8s.io --timeout=180s
           kubectl wait --for=condition=Established crd/sandboxes.agents.x-k8s.io --timeout=180s
-          kubectl apply -f "https://github.com/kubernetes-sigs/gateway-api/releases/download/$GATEWAY_API_VERSION/standard-install.yaml"
+          curl -fsSL --proto '=https' -o /tmp/gateway-api.yaml \
+            "https://github.com/kubernetes-sigs/gateway-api/releases/download/$GATEWAY_API_VERSION/standard-install.yaml"
+          printf '%s  %s\n' "$GATEWAY_API_MANIFEST_SHA256" /tmp/gateway-api.yaml | sha256sum -c -
+          kubectl apply -f /tmp/gateway-api.yaml
           kubectl wait --for=condition=Established crd/gateways.gateway.networking.k8s.io --timeout=180s
           kubectl wait --for=condition=Established crd/httproutes.gateway.networking.k8s.io --timeout=180s
       - name: Set up Python

.github/workflows/ci.yaml

@@ -37,19 +37,29 @@ jobs:
       - name: Install actionlint
         env:
           ACTIONLINT_VERSION: v1.7.12
+          # SHA-256 of actionlint_1.7.12_linux_amd64.tar.gz, published in the
+          # release's actionlint_1.7.12_checksums.txt. Update it with the version.
+          ACTIONLINT_SHA256: 8aca8db96f1b94770f1b0d72b6dddcb1ebb8123cb3712530b08cc387b349a3d8
         run: |
           set -euo pipefail
           version="${ACTIONLINT_VERSION#v}"
-          curl -fsSL -o /tmp/actionlint.tar.gz             "https://github.com/rhysd/actionlint/releases/download/$ACTIONLINT_VERSION/actionlint_${version}_linux_amd64.tar.gz"
-          tar -xzf /tmp/actionlint.tar.gz -C /tmp actionlint
+          asset="actionlint_${version}_linux_amd64.tar.gz"
+          curl -fsSL --proto '=https' -o "/tmp/$asset" \
+            "https://github.com/rhysd/actionlint/releases/download/$ACTIONLINT_VERSION/$asset"
+          printf '%s  %s\n' "$ACTIONLINT_SHA256" "/tmp/$asset" | sha256sum -c -
+          tar -xzf "/tmp/$asset" -C /tmp actionlint
           install -m 0755 /tmp/actionlint /usr/local/bin/actionlint
           actionlint -version
       - name: Install hadolint
         env:
           HADOLINT_VERSION: v2.12.0
+          # SHA-256 of hadolint-Linux-x86_64, published next to the download.
+          HADOLINT_SHA256: 56de6d5e5ec427e17b74fa48d51271c7fc0d61244bf5c90e828aab8362d55010
         run: |
           set -euo pipefail
-          curl -fsSL -o /tmp/hadolint             "https://github.com/hadolint/hadolint/releases/download/$HADOLINT_VERSION/hadolint-Linux-x86_64"
+          curl -fsSL --proto '=https' -o /tmp/hadolint \
+            "https://github.com/hadolint/hadolint/releases/download/$HADOLINT_VERSION/hadolint-Linux-x86_64"
+          printf '%s  %s\n' "$HADOLINT_SHA256" /tmp/hadolint | sha256sum -c -
           install -m 0755 /tmp/hadolint /usr/local/bin/hadolint
           hadolint --version
       - name: Repository checks

.github/workflows/codeql.yml

@@ -58,6 +58,8 @@ jobs:
     steps:
     - name: Checkout repository
       uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      with:
+        persist-credentials: false
 
     # Add any setup steps before running the `github/codeql-action/init` action.
     # This includes steps like installing compilers or runtimes (`actions/setup-node`

.github/workflows/e2e-kind.yaml

@@ -40,7 +40,10 @@ jobs:
       - name: Install agent-sandbox
         run: |
           set -euo pipefail
-          kubectl apply -f "https://github.com/kubernetes-sigs/agent-sandbox/releases/download/$AGENT_SANDBOX_VERSION/sandbox-with-extensions.yaml"
+          curl -fsSL --proto '=https' -o /tmp/agent-sandbox.yaml \
+            "https://github.com/kubernetes-sigs/agent-sandbox/releases/download/$AGENT_SANDBOX_VERSION/sandbox-with-extensions.yaml"
+          printf '%s  %s\n' "$AGENT_SANDBOX_MANIFEST_SHA256" /tmp/agent-sandbox.yaml | sha256sum -c -
+          kubectl apply -f /tmp/agent-sandbox.yaml
           kubectl -n agent-sandbox-system rollout status deployment --timeout=180s
           kubectl wait --for=condition=Established crd/sandboxtemplates.extensions.agents.x-k8s.io --timeout=180s
           kubectl wait --for=condition=Established crd/sandboxwarmpools.extensions.agents.x-k8s.io --timeout=180s
@@ -66,7 +69,9 @@ jobs:
             echo "== events =="
             kubectl get events -n dsh-demo --sort-by=.lastTimestamp 2>&1 || true
             echo "== gateway logs =="
-            kubectl -n dsh-demo logs deploy/dsh-gateway --tail=200 2>&1 || true
+            # Redact any token material before this file becomes an artifact.
+            kubectl -n dsh-demo logs deploy/dsh-gateway --tail=200 2>&1 \
+              | sed -E 's/(token=)[^&"[:space:]]+/\1[REDACTED]/g' || true
           } > /tmp/e2e-cluster.txt
       - name: Upload cluster state
         if: always()

.github/workflows/release.yaml

@@ -17,11 +17,10 @@ on:
         required: true
         type: string
 
+# Read-only by default; the build and publish jobs add the write scopes they
+# need as job-level grants.
 permissions:
-  contents: write
-  packages: write
-  id-token: write
-  attestations: write
+  contents: read
 
 concurrency:
   group: release-${{ github.ref }}
@@ -52,13 +51,17 @@ jobs:
       - name: Validate tag against versions.env
         id: meta
         shell: bash
+        env:
+          # Passed through the environment, never interpolated into the script:
+          # a tag name or dispatch input can contain shell metacharacters.
+          REQUESTED_TAG: ${{ inputs.tag || github.ref_name }}
         run: |
           set -euo pipefail
           set -a
           # shellcheck disable=SC1091
           source versions.env
           set +a
-          tag="${{ inputs.tag || github.ref_name }}"
+          tag="$REQUESTED_TAG"
           identity="$DSH_VERSION"
           [ -z "$RELEASE_REVISION" ] || identity="$DSH_VERSION-$RELEASE_REVISION"
           if [ "$tag" != "$identity" ]; then
@@ -222,11 +225,17 @@ jobs:
       - name: Install git-cliff
         env:
           GIT_CLIFF_VERSION: v2.14.2
+          # SHA-256 of git-cliff-2.14.2-x86_64-unknown-linux-gnu.tar.gz; upstream
+          # publishes the matching SHA-512 next to the asset. Update with the version.
+          GIT_CLIFF_SHA256: 24f397c733add5390fdceee3a2088588ab0d5f944ce00d34cb7029b888cf2db4
         run: |
           set -euo pipefail
           version="${GIT_CLIFF_VERSION#v}"
-          curl -fsSL -o /tmp/git-cliff.tar.gz             "https://github.com/orhun/git-cliff/releases/download/$GIT_CLIFF_VERSION/git-cliff-$version-x86_64-unknown-linux-gnu.tar.gz"
-          tar -xzf /tmp/git-cliff.tar.gz -C /tmp
+          asset="git-cliff-${version}-x86_64-unknown-linux-gnu.tar.gz"
+          curl -fsSL --proto '=https' -o "/tmp/$asset" \
+            "https://github.com/orhun/git-cliff/releases/download/$GIT_CLIFF_VERSION/$asset"
+          printf '%s  %s\n' "$GIT_CLIFF_SHA256" "/tmp/$asset" | sha256sum -c -
+          tar -xzf "/tmp/$asset" -C /tmp
           install -m 0755 "/tmp/git-cliff-$version/git-cliff" /usr/local/bin/git-cliff
           git-cliff --version