mirror of
https://github.com/sredevopsorg/deepseek-kubernetes-sandbox.git
synced 2026-11-03 01:13:24 +00:00
ae8aba8241
- Replace user:token cookies with opaque server-side sessions, revocable on logout, delete, recreate and expiry; bind every credential to the path user and add cross-user regression tests. - Rate-limit /users and /login, add optional signup invite codes and form same-origin checks, and unify login failures to 401. - Require explicit ALLOW_INSECURE_COOKIES for plain HTTP, use __Host-dsh_gw_session when secure, and fix secure cookie deletion. - Strip client-supplied forwarding/SSO headers, add an optional upstream allowlist, per-user in-flight and WebSocket message caps, credential-free handshake errors, and sweep-time state pruning. - Digest-pin base images, hash-pin gateway dependencies, verify DSH_COMMIT in the build, and run the gateway image as non-root with a pinned Python base. - Update manifests, production checklist, architecture/security docs and add an SSO preflight script. BREAKING CHANGE: existing dsh_gw_session=<user>:<token> cookies are invalid; users must sign in again. Unknown users on POST /login now return 401 instead of 404, and the gateway refuses COOKIE_SECURE=false unless ALLOW_INSECURE_COOKIES=1.
88 lines
2.6 KiB
YAML
88 lines
2.6 KiB
YAML
# Development channel for the main DSH Web image: every merge to main that
|
|
# touches the image definition publishes ghcr.io/<owner>/<repo>:main.
|
|
# Releases are published by release.yaml with immutable version tags.
|
|
name: Build main image
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
push:
|
|
branches: [main]
|
|
paths:
|
|
- Dockerfile
|
|
- versions.env
|
|
- .github/workflows/build-main.yaml
|
|
- .github/workflows/_build-image.yaml
|
|
|
|
permissions:
|
|
contents: read
|
|
packages: write
|
|
id-token: write
|
|
attestations: write
|
|
|
|
concurrency:
|
|
group: build-main-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
meta:
|
|
name: Read versions
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 5
|
|
outputs:
|
|
identity: ${{ steps.meta.outputs.identity }}
|
|
dsh_version: ${{ steps.meta.outputs.dsh_version }}
|
|
dsh_commit: ${{ steps.meta.outputs.dsh_commit }}
|
|
pnpm_version: ${{ steps.meta.outputs.pnpm_version }}
|
|
release_revision: ${{ steps.meta.outputs.release_revision }}
|
|
ghcr_image: ${{ steps.meta.outputs.ghcr_image }}
|
|
gateway_image: ${{ steps.meta.outputs.gateway_image }}
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- name: Read versions.env
|
|
id: meta
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
set -a
|
|
# shellcheck disable=SC1091
|
|
source versions.env
|
|
set +a
|
|
identity="$DSH_VERSION"
|
|
[ -z "$RELEASE_REVISION" ] || identity="$DSH_VERSION-$RELEASE_REVISION"
|
|
{
|
|
echo "identity=$identity"
|
|
echo "dsh_version=$DSH_VERSION"
|
|
echo "dsh_commit=$DSH_COMMIT"
|
|
echo "pnpm_version=$PNPM_VERSION"
|
|
echo "release_revision=$RELEASE_REVISION"
|
|
echo "ghcr_image=$GHCR_IMAGE"
|
|
echo "gateway_image=$GATEWAY_IMAGE"
|
|
} >> "$GITHUB_OUTPUT"
|
|
|
|
build:
|
|
name: Build and push main image
|
|
needs: meta
|
|
uses: ./.github/workflows/_build-image.yaml
|
|
permissions:
|
|
contents: read
|
|
packages: write
|
|
id-token: write
|
|
attestations: write
|
|
with:
|
|
image: ${{ needs.meta.outputs.ghcr_image }}
|
|
version: ${{ needs.meta.outputs.identity }}
|
|
context: .
|
|
dockerfile: Dockerfile
|
|
build-args: |
|
|
DSH_VERSION=${{ needs.meta.outputs.dsh_version }}
|
|
DSH_COMMIT=${{ needs.meta.outputs.dsh_commit }}
|
|
RELEASE_REVISION=${{ needs.meta.outputs.release_revision }}
|
|
PNPM_VERSION=${{ needs.meta.outputs.pnpm_version }}
|
|
VCS_REF=${{ github.sha }}
|
|
tags: |
|
|
${{ needs.meta.outputs.ghcr_image }}:main
|