Bump node from 22-bookworm-slim to 26-bookworm-slim in /web

.cargo/audit.toml

@@ -0,0 +1,7 @@
+# rsa 0.9 (Marvin attack, RUSTSEC-2023-0071) reaches us only transitively through
+# russh/ssh-key, and rsa has shipped no patched release — the fix lands in 0.10.
+# Nothing here can be upgraded away, so the advisory would fail every CI run for a
+# dependency we do not call directly.
+# Revisit when `cargo tree -i rsa` shows 0.10 stable: drop this ignore, do not extend it.
+[advisories]
+ignore = ["RUSTSEC-2023-0071"]

.dockerignore

@@ -0,0 +1,13 @@
+# The Dockerfile only COPYs compiled binaries out of target/<profile>/, so nothing else is context —
+# not the source, and not the rest of target/ (gigabytes of rlibs and .d files).
+*
+!target/release/rustic-git
+!target/release/rustic-git-api
+!target/release/rustic-git-worker
+!target/release/rustic-git-agent
+!target/release/rustic-git-gateway
+!target/dev-image/rustic-git
+!target/dev-image/rustic-git-api
+!target/dev-image/rustic-git-worker
+!target/dev-image/rustic-git-agent
+!target/dev-image/rustic-git-gateway

.github/dependabot.yml

@@ -0,0 +1,24 @@
+# Every action, base image and dependency in this repo is pinned by SHA or digest, which is only
+# a virtue while something moves the pins. Weekly, grouped, so a Monday brings a handful of PRs
+# rather than one per crate.
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule: { interval: weekly }
+  - package-ecosystem: docker
+    directory: /
+    schedule: { interval: weekly }
+  - package-ecosystem: docker
+    directory: /web
+    schedule: { interval: weekly }
+  - package-ecosystem: cargo
+    directory: /
+    schedule: { interval: weekly }
+    groups:
+      cargo: { patterns: ["*"] }
+  - package-ecosystem: npm
+    directory: /web
+    schedule: { interval: weekly }
+    groups:
+      npm: { patterns: ["*"] }

.github/workflows/audit.yml

@@ -0,0 +1,35 @@
+# Advisories arrive without a commit. `image.yml` runs cargo-deny only when master moves, and the
+# web tree has no audit at all — this is the run that notices a CVE published on a quiet week.
+# Red here means: bump the crate (`cargo update -p <crate>`) or the package (`bun update <pkg>`),
+# or add a justified `ignore` to deny.toml, then let the normal push run confirm it.
+name: audit
+on:
+  schedule:
+    - cron: "0 6 * * 1" # weekly, Monday morning UTC
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  cargo:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: EmbarkStudios/cargo-deny-action@b66acf5e9fe20f8aba065be86778a8a4c846f902 # v2
+        with:
+          command: check advisories
+  web:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    defaults:
+      run:
+        working-directory: web
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+        with:
+          bun-version: 1.3.14
+      - run: bun install --frozen-lockfile
+      - run: bun audit

.github/workflows/cf-sync.yml

@@ -0,0 +1,20 @@
+# Does the committed Cloudflare range list still match what Cloudflare publishes? A stale list
+# fails safe on every copy (a new edge is refused, never wrongly trusted), which is exactly why
+# nobody notices — this is the noticing. Red here means: run deploy/cf-sync.sh, commit, re-apply.
+name: cf-sync
+on:
+  schedule:
+    - cron: "17 6 * * 1" # weekly; Cloudflare's last change was 2024, so this is plenty
+  workflow_dispatch:
+  pull_request:
+    paths: ["deploy/cf-sync.sh", "deploy/k3s/cloudflare-ips-v4.txt", "deploy/ingress-nginx-*.yaml"]
+
+permissions:
+  contents: read
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - run: deploy/cf-sync.sh

.github/workflows/image.yml

@@ -2,29 +2,163 @@ name: image
 on:
   push:
     branches: [master]
+  # PRs get the test job only: a red commit is cheapest to catch before it is on master, and a
+  # PR has no business producing a package. `build` and `image` are skipped on this event.
+  pull_request:
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
+  test:
+    # GitHub's runner, not the self-hosted VM: that VM exists for its docker layer cache and
+    # carries no Rust toolchain. The cargo cache below keys on Cargo.lock, so after the first
+    # cold build (the C deps: aws-lc-sys, ring, zstd) this is a few minutes.
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    permissions:
+      contents: read
+      # audit-check posts its findings as a check run on the commit.
+      checks: write
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
+        with:
+          components: clippy
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+      # Workspace-wide, not `--all-targets`: the test targets carry pre-existing lints that are not
+      # worth a reformat-sized diff (see CLAUDE.md). `cargo fmt --check` is deliberately absent
+      # for the same reason — the tree is not rustfmt-shaped and gating it means one repo-wide
+      # reformat commit, which is the owner's call, not CI's.
+      # `--locked` on both, like the Dockerfile and the build job: a stale lockfile must fail here,
+      # not pass here by rewriting Cargo.lock and then fail differently in `build`.
+      - run: cargo clippy --workspace --locked -- -D warnings
+      - run: cargo test --locked
+      - uses: rustsec/audit-check@69366f33c96575abad1ee0dba8212993eecbe998 # v2.0.0
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+      # `audit-check` above covers advisories only. This adds the three checks a repo with this
+      # much crypto surface wants: banned/duplicate crates, licence policy, and source
+      # allowlisting. Config lives in deny.toml, next to Cargo.toml.
+      - uses: EmbarkStudios/cargo-deny-action@b66acf5e9fe20f8aba065be86778a8a4c846f902 # v2
+        with:
+          command: check
+
   build:
+    # NOT `needs: test` — the compile and the tests run in parallel, and only `image` below waits
+    # for both. Waiting for tests before compiling added their whole duration (5m32s measured) to
+    # every image, serially, for nothing; gating the PUSH on them costs nothing extra.
+    #
+    # Compiled here, on the runner, NOT inside docker. cargo-chef under a `type=gha,mode=max` layer
+    # cache cached the dependency cook and nothing else: the workspace crates sat in the layer that
+    # also held the source, so every commit rebuilt them from scratch — 342 s of `cargo build` plus
+    # 114 s of cache export, per run. rust-cache keeps the whole target dir across commits, so an
+    # ordinary commit recompiles only the crates it touched.
+    #
+    # Inside rust:1-bookworm rather than on ubuntu-24.04 itself: the runtime images are
+    # bookworm-slim (glibc 2.36) and a binary linked against the runner's glibc 2.39 would not exec
+    # there. The step after the build checks that no newer symbol version crept in.
+    if: github.event_name != 'pull_request'
     runs-on: ubuntu-latest
+    timeout-minutes: 30
+    container: rust:1-bookworm@sha256:e70e2eec3d495fd5c8e0be74adda86507dfac7f51a724fbf9813ff59b2b247c7
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+        with:
+          # A red build that got through the C deps is still worth keeping.
+          cache-on-failure: true
+      - run: >
+          cargo build --release --locked
+          --bin rustic-git --bin rustic-git-api --bin rustic-git-worker
+          --bin rustic-git-agent --bin rustic-git-gateway
+      - name: glibc ceiling
+        run: |
+          set -eu
+          for b in rustic-git rustic-git-api rustic-git-worker rustic-git-agent rustic-git-gateway; do
+            need=$(objdump -T "target/release/$b" | grep -o 'GLIBC_[0-9.]*' | sort -uV | tail -1)
+            echo "$b needs $need"
+            if [ "$(printf '%s\nGLIBC_2.36\n' "$need" | sort -V | tail -1)" != GLIBC_2.36 ]; then
+              echo "::error::$b needs $need, bookworm-slim ships 2.36"; exit 1
+            fi
+          done
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: bins
+          path: |
+            target/release/rustic-git
+            target/release/rustic-git-api
+            target/release/rustic-git-worker
+            target/release/rustic-git-agent
+            target/release/rustic-git-gateway
+          if-no-files-found: error
+          retention-days: 1
+
+  image:
+    # Docker on the plain runner: buildx and the ghcr login have no business inside the rust
+    # container, and the artifact hop for five binaries is seconds.
+    #
+    # `needs: test` as well as `build`: a commit whose tests fail gets NO package — neither
+    # `:<sha>` nor `:latest`. The deploy side (`deploy/pin.sh`) can then treat "the tag exists"
+    # as "the tests passed", which is the only signal a repin from `git log` ever sees.
+    needs: [build, test]
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
     permissions:
       contents: read
       packages: write
     steps:
-      - uses: actions/checkout@v4
-      - uses: docker/setup-buildx-action@v3
-      - uses: docker/login-action@v3
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+        with:
+          name: bins
+          path: target/release
+      # upload-artifact drops the mode bits and the Dockerfile COPYs the files as they are.
+      - run: chmod +x target/release/rustic-git*
+      - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
+        # Default docker-container driver: required for `type=gha` cache, which the classic
+        # `docker` driver cannot export to.
+      - uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
-      - uses: docker/build-push-action@v6
+      # Plain `type=gha`, no `mode=max`: the only layers worth caching now are the apt-get ones,
+      # and those are in the final images. `max` existed for the builder stage that is gone.
+      - uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
         with:
           context: .
+          target: server
+          # linux/amd64 only: the cluster is amd64, and so are the binaries above.
           platforms: linux/amd64
           push: true
           tags: |
             ghcr.io/kloudlite/rustic-git:latest
             ghcr.io/kloudlite/rustic-git:${{ github.sha }}
           cache-from: type=gha
-          cache-to: type=gha,mode=max
+          cache-to: type=gha
+      - uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
+        with:
+          context: .
+          target: agent
+          platforms: linux/amd64
+          push: true
+          tags: |
+            ghcr.io/kloudlite/rustic-git-agent:latest
+            ghcr.io/kloudlite/rustic-git-agent:${{ github.sha }}
+          cache-from: type=gha
+          cache-to: type=gha
+      - uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
+        with:
+          context: .
+          target: gateway
+          platforms: linux/amd64
+          push: true
+          tags: |
+            ghcr.io/kloudlite/rustic-git-gateway:latest
+            ghcr.io/kloudlite/rustic-git-gateway:${{ github.sha }}
+          cache-from: type=gha
+          cache-to: type=gha

.github/workflows/kl.yml

@@ -0,0 +1,79 @@
+name: kl
+on:
+  push:
+    tags: ["kl-v*"]
+  workflow_dispatch:
+
+# The CLI ships on its own tags, not on master: `bins/kl` builds four host binaries for people's
+# laptops, which has nothing to do with the cluster images `image.yml` pushes per commit.
+permissions:
+  contents: read
+
+jobs:
+  build:
+    strategy:
+      matrix:
+        include:
+          - target: x86_64-unknown-linux-gnu
+            os: ubuntu-latest
+          # cross, because a glibc arm64 binary needs a matching sysroot the ubuntu runner has not
+          # got — the darwin pair build natively on macOS runners instead.
+          - target: aarch64-unknown-linux-gnu
+            os: ubuntu-latest
+            cross: true
+          - target: x86_64-apple-darwin
+            os: macos-latest
+          - target: aarch64-apple-darwin
+            os: macos-latest
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
+        with:
+          targets: ${{ matrix.target }}
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+      # A fixed version: `cross` is a build tool that runs arbitrary containers, and an
+      # unpinned `cargo install` at release time is the one unpinned input in this file.
+      - if: matrix.cross
+        run: cargo install cross --version 0.2.5 --locked
+      - run: ${{ matrix.cross && 'cross' || 'cargo' }} build -p kl --release --locked --target ${{ matrix.target }}
+      - name: package
+        run: |
+          set -eu
+          name="kl-${{ matrix.target }}"
+          cp "target/${{ matrix.target }}/release/kl" "$name"
+          shasum -a 256 "$name" > "$name.sha256" 2>/dev/null || sha256sum "$name" > "$name.sha256"
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: kl-${{ matrix.target }}
+          path: |
+            kl-${{ matrix.target }}
+            kl-${{ matrix.target }}.sha256
+
+  release:
+    needs: build
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    permissions:
+      contents: write
+      # For the provenance attestation below.
+      id-token: write
+      attestations: write
+    steps:
+      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+        with:
+          path: dist
+          merge-multiple: true
+      # One sha256sums file next to the assets: install.sh verifies against it.
+      - run: cd dist && cat *.sha256 > sha256sums && rm -f *.sha256
+      # `sha256sums` proves a download is intact; this proves it came from THIS workflow on THIS
+      # commit (`gh attestation verify kl-<target> -R kloudlite/rustic-git`). Free for a public
+      # repo, and the only origin signal `install.sh`'s same-origin checksum cannot give.
+      - uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a # v3
+        with:
+          subject-path: dist/kl-*
+      - uses: softprops/action-gh-release@72f2c25fcb47643c292f7107632f7a47c1df5cd8 # v2
+        with:
+          files: dist/*
+          generate_release_notes: true