Bake improvement - #260
Open
vsilent wants to merge 13 commits into
Open
Bake improvement#260vsilent wants to merge 13 commits into
vsilent wants to merge 13 commits into
Conversation
- Chat session management with archive and encryption - Agent hardening: per-tenant ownership, token digest verification, fail-closed auth - Marketplace field policy: config_contract, generated-field stripping, derived_jwt signing - Project sync, one-click deploy improvements, deployment container tracking - SSH key authorization fixes, mTLS for Vault, port validation - Stale project/server cleanup, audit-log cron, env size validator - Multiple BDD and migration fixes
- create_handler now uses update_metadata_for_resubmit for submitted/under_review/approved templates
- CLI submit command uses resubmit endpoint for approved templates instead of submit endpoint
- adds marketplace_resubmit client method for POST /api/templates/{id}/resubmit
…lookup for resubmit - build_project_app now copies config_contract from the form app - get_source_project_id checks all versions (not just latest) since resubmit_with_new_version creates a new version row before set_source_project_id is called
…ubmit - unit test: project_level_apps_from_form propagates config_contract - integration test: sync persists config_contract on project apps - integration test: create_handler updates approved template metadata - integration test: resubmit with new version preserves source_project_id
The insert/update SQL does not include config_contract — it is persisted via a dedicated set_config_contract call. sync_project_level_apps_from_form now calls set_config_contract after each insert/update when the form app declares a config_contract.
Remove dead agent rows whose deployment is deleted/missing and that show no sign of life within 30 days (last_heartbeat AND audit_log). Remove rows with structurally invalid deployment_hash unconditionally — these can never authenticate and often leak a raw token in plaintext. The audit_log check protects agents that are alive but failing authentication: last_heartbeat only advances on successful wait/report, while audit_log captures auth_failure entries. Migration 20260113000002 already converted audit_log.created_at to timestamptz — no new migration needed. Includes 9 integration tests covering the key cases from the sweep plan.
…ed snapshots
- Add parameterize_compose_env_vars() to replace literal env values with
${VAR} references in generated compose files
- Integrate into deploy pipeline so compose never contains author secrets
- Docker Compose resolves ${VAR} from co-located .env at runtime
- Add 3 unit tests for parameterization behavior
This fixes the security issue where every buyer of a marketplace template
received the author's literal secrets in the baked compose file.
|
| GitGuardian id | GitGuardian status | Secret | Commit | Filename | |
|---|---|---|---|---|---|
| 37449299 | Triggered | Generic High Entropy Secret | 7b6c5e6 | src/cli/generator/compose.rs | View secret |
| 37449298 | Triggered | Generic Password | 7b6c5e6 | src/cli/generator/compose.rs | View secret |
| 37456823 | Triggered | Generic Password | 27017fa | src/helpers/bake_finalize.rs | View secret |
| 37456824 | Triggered | Generic High Entropy Secret | 27017fa | src/cli/generator/compose.rs | View secret |
| 37456824 | Triggered | Generic High Entropy Secret | 27017fa | src/cli/generator/compose.rs | View secret |
🛠 Guidelines to remediate hardcoded secrets
- Understand the implications of revoking this secret by investigating where it is used in your code.
- Replace and store your secrets safely. Learn here the best practices.
- Revoke and rotate these secrets.
- If possible, rewrite git history. Rewriting git history is not a trivial act. You might completely break other contributing developers' workflow and you risk accidentally deleting legitimate data.
To avoid such incidents in the future consider
- following these best practices for managing and storing secrets including API keys and other credentials
- install secret detection on pre-commit to catch secret before it leaves your machine and ease remediation.
🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
|
|
||
| assert!( | ||
| result.contains("postgresql://stackpilot:${POSTGRES_PASSWORD}@db:5432/stackpilot"), | ||
| "password replaced in place:\n{result}" |
| ); | ||
| assert!( | ||
| !result.contains("2213a996143863b99a0f2d3e22907690"), | ||
| "no literal left:\n{result}" |
| .expect("no conflict"); | ||
| assert!( | ||
| result.contains("GREETING: administrator"), | ||
| "untouched:\n{result}" |
| .expect("no conflict"); | ||
| assert!( | ||
| result.contains("aaaaaaaaaaaaaaaa"), | ||
| "left literal:\n{result}" |
|
|
||
| assert!( | ||
| result.contains("image: myapp:2213a996143863b99a0f2d3e22907690"), | ||
| "image digest untouched:\n{result}" |
| ); | ||
| assert!( | ||
| result.contains("TOKEN: ${TOKEN}"), | ||
| "env replaced:\n{result}" |
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This pull request introduces version 0.3.3, which includes several new features, enhancements, and bug fixes across chat session management, agent hardening, marketplace field policy, deployment lifecycle, and security. It also adds important database migrations and improvements to the
bakeutility to enforce build box sanitization and track required environment keys.Major new features and improvements:
Release and Versioning
0.3.3inCargo.tomland document all changes inCHANGELOG.md. (F7f5fb14R1, [1] [2]Chat, Agent, and Security Enhancements
Marketplace and Field Policy
fixed,editable,generated,derived_jwt), secret federation, and policy-driven secret generation.Deployment and Cleanup Lifecycle
cleanup_logtable. [1] [2]Bake Utility and Snapshot Registry
bakeutility now requires--ssh-keyby default to sanitize the build box before snapshotting, preventing accidental credential leakage;--allow-unsanitized-snapshotcan override this for private images. [1] [2] [3] [4]Bug Fixes
Database and Migrations
required_env_keysfield tobaked_snapshotsto record which environment variables are needed for deployment, with up and down migrations. [1] [2]Most important changes by theme:
1. Security and Agent Hardening
baketool now requires an SSH key to sanitize the build box before snapshotting, preventing accidental leakage of credentials and secrets. [1] [2] [3] [4]2. Marketplace and Field Policy
3. Deployment Lifecycle and Cleanup
deployment_containertracking, scheduled cleanup for stale resources, and a cron job for audit-log cleanup.cleanup_logtable. [1] [2]4. Bake Utility and Deployment Robustness
baked_snapshotstable, preventing silent misconfiguration on deploy. [1] [2] [3]5. Bug Fixes and Quality Improvements