mirror of
https://github.com/sredevopsorg/deepseek-kubernetes-sandbox.git
synced 2026-11-03 01:13:24 +00:00
2f959e6afb
Security audit of .github/workflows found a script-injection vector in the release workflow, over-broad token grants on non-publishing jobs, and downloaded tooling/manifests executed without integrity checks. - release: pass the tag/dispatch input through env instead of interpolating it into the validation script; default workflow permissions to contents:read - build-main/build-gateway: grant write scopes only to the build job - _build-image/codeql: stop persisting checkout credentials - ci/release: verify actionlint, hadolint and git-cliff against pinned SHA-256s - ci-manifests/e2e: verify upstream CRD manifests against versions.env pins - e2e: redact token material before uploading cluster diagnostics - docs: add workflow-security.md with controls, audit record and residual repository-setting recommendations Co-authored-by: SREDevOpsAgents <agents@sredevops.org>
50 lines
3.6 KiB
Markdown
50 lines
3.6 KiB
Markdown
# Repository documentation
|
|
|
|
Repository-wide documentation lives here. Example-specific material lives with
|
|
its example under [`examples/<name>/docs/`](../examples/) — see the
|
|
[agents-as-a-service architecture](../examples/dsh-agents-as-a-service/docs/architecture.md).
|
|
|
|
If you are new, read the [root README](../README.md) first: it is image-first and
|
|
gets a DSH Web container running before anything else.
|
|
|
|
## Index
|
|
|
|
| Document | Read it for |
|
|
| --- | --- |
|
|
| [main-image.md](main-image.md) | The primary artifact: build args, runtime environment, entrypoint, probes, volumes/ports/signals, non-root contract, image names, tags and digests. |
|
|
| [examples.md](examples.md) | The example contract: required layout, manifest rules, exposure variants, components and image naming, scripts, docs, and how to add a new example. |
|
|
| [gitflow.md](gitflow.md) | Branches, protected `main`, squash merges, Conventional PR titles, required CI checks, release branches, hotfixes and the one-time GitHub settings checklist. |
|
|
| [versioning.md](versioning.md) | Release identity (`DSH ref` + optional `-rN`), the current identity `dsh-v0.2.1-rc.5`, why identities are immutable, channels, compatibility matrix, bumping pins, the release checklist, rollback, git-cliff and digest pinning. |
|
|
| [workflow-security.md](workflow-security.md) | GitHub Actions security posture: least-privilege tokens, pinned actions, untrusted-input handling, download integrity checks, artifact hygiene, the latest audit record and residual repository-setting recommendations. |
|
|
|
|
## Project skills
|
|
|
|
DSH discovers project skills from `<git root>/.dsh/skills/<name>/SKILL.md`
|
|
(the nearest `.git` ancestor). This repository ships one:
|
|
|
|
| Skill | Read it for |
|
|
| --- | --- |
|
|
| [dsh-agent-sandbox-platform](../.dsh/skills/dsh-agent-sandbox-platform/SKILL.md) | Operating and extending the agents-as-a-service platform, agent-sandbox MCP limits and deployment, and a read-only preflight. |
|
|
|
|
## Example documentation
|
|
|
|
| Document | Read it for |
|
|
| --- | --- |
|
|
| [examples/README.md](../examples/README.md) | The index of implementations in this repository. |
|
|
| [dsh-agents-as-a-service README](../examples/dsh-agents-as-a-service/README.md) | The multi-tenant platform walkthrough: warm pool, claims, suspend/resume, gateway, exposure and troubleshooting. |
|
|
| [dsh-agents-as-a-service architecture](../examples/dsh-agents-as-a-service/docs/architecture.md) | Container/sequence diagrams, ADRs, security and RBAC, failure modes and the evolution path. |
|
|
| [gateway README](../examples/dsh-agents-as-a-service/gateway/README.md) | The gateway's HTTP/WebSocket API, configuration, auth (including SSO), and limitations. |
|
|
| [optional hardening](../examples/dsh-agents-as-a-service/docs/optional-hardening.md) | Opt-in gVisor, nodeSelector, NetworkPolicy, provider keys and failed-Pod recovery. |
|
|
| [exposure variants](../examples/dsh-agents-as-a-service/manifests/exposure/README.md) | The mutually exclusive Ingress and Gateway API + SSO exposure paths. |
|
|
|
|
## Project policies
|
|
|
|
| Document | Read it for |
|
|
| --- | --- |
|
|
| [AGENTS.md](../AGENTS.md) | Repository conventions for AI agents and humans, and the commands the CI runs. |
|
|
| [CONTRIBUTING.md](../CONTRIBUTING.md) | Local setup, the change workflow and what a pull request needs. |
|
|
| [SECURITY.md](../SECURITY.md) | Vulnerability reporting and project-specific threat notes (pod logs, SSO header trust, shared provider key, TLS). |
|
|
| [CODE_OF_CONDUCT.md](../CODE_OF_CONDUCT.md) | Community standards. |
|
|
| [CHANGELOG.md](../CHANGELOG.md) | Generated release history (do not edit by hand). |
|
|
| [LICENSE](../LICENSE) | MIT. |
|