chore: propagate changes from main into development

.dockerignore

@@ -158,6 +158,17 @@ docs/implementation/
 # -----------------------------------------------------------------------------
 dist/
 
+# -----------------------------------------------------------------------------
+# Build-only helper scripts — used by .github/workflows/toolchain-image.yml and
+# the quality-checks.yml verify-toolchain-pin / bats jobs from a plain checkout,
+# never from inside a built container. The Dockerfile's `COPY scripts/` would
+# otherwise ship them into /app/scripts/ in the runtime image.
+# -----------------------------------------------------------------------------
+scripts/tests/
+scripts/toolchain-key.sh
+scripts/verify-toolchain-pin.sh
+scripts/lib/dockerfile-stage.sh
+
 # -----------------------------------------------------------------------------
 # Tools (not needed in image)
 # -----------------------------------------------------------------------------

.github/actions/build-charon-image/action.yml

@@ -1,8 +1,12 @@
 name: Build Charon image
 description: >-
-  Build the Charon Docker image locally for integration / security-scan jobs,
-  with GitHub Actions layer caching (type=gha) so the multi-stage build is not
-  rebuilt cold on every run. Loads the image into the local Docker daemon.
+  Build the Charon Docker image locally for integration / security-scan jobs.
+  The custom Caddy + CrowdSec binaries come from the digest-pinned, daily-
+  rebuilt-and-Trivy-scanned prebuilt toolchain image
+  (ghcr.io/wikid82/charon-toolchain) via COPY --from — no xcaddy / CrowdSec
+  compile on this path. Every remaining stage is GitHub Actions layer-cached
+  (type=gha). Pin freshness is enforced per-PR by
+  scripts/verify-toolchain-pin.sh. Loads the image into the local Docker daemon.
 inputs:
   tag:
     description: Image tag to load locally.
@@ -12,31 +16,54 @@ inputs:
     description: Value passed as the CI build-arg.
     required: false
     default: 'false'
-  no-cache-filters:
+  builder-src:
     description: >-
-      Comma-separated Dockerfile stages to force-rebuild (never restore from the
-      layer cache). Empty by default: every stage, including the expensive
-      caddy-builder xcaddy step, is GHA layer-cached — that is where the build
-      time is recovered. Suitable for the integration-test callers
-      (waf/crowdsec/rate-limit/cerberus), which exercise runtime behaviour and
-      do not care about dependency freshness.
-
-      CVE-scan-gate callers (security-pr.yml, supply-chain-pr.yml) MUST override
-      this with `caddy-builder,crowdsec-builder`. The caddy-builder and
-      crowdsec-builder stages patch pinned transitive dependencies in-place
-      (`go get pkg@fixed` in their Stage 2 blocks). A global build-arg bump does
-      not reliably invalidate the GHA layer-cache key for a stage that only
-      *consumes* that arg (the same edge case that produced CVE-2026-45135 and
-      the 2026-09-04 grpc-go v1.83.0 recurrence), so a restored stale layer keeps
-      shipping the superseded, still-vulnerable version. The release image
-      (docker-build.yml) already force-rebuilds caddy-builder for this reason.
+      Which source the Caddy / CrowdSec binaries come from:
+        prebuilt (default) — COPY --from the digest-pinned toolchain image
+                             (ghcr.io/wikid82/charon-toolchain), no compile.
+        inline             — compile caddy-inline / crowdsec-inline from source
+                             (fork PR / bootstrap / offline; ~14 min).
+    required: false
+    default: prebuilt
+  ghcr-token:
+    description: >-
+      Token with packages:read, used to log in to ghcr.io so BuildKit can pull
+      the (private) prebuilt toolchain image. Callers pass secrets.GITHUB_TOKEN.
+      Composite actions cannot read the secrets context themselves, so this must
+      be threaded in from the calling workflow. Ignored when builder-src=inline;
+      a fork PR that cannot supply a working token should pass builder-src=inline.
     required: false
     default: ''
 runs:
   using: composite
   steps:
+    - name: Resolve builder source stages
+      id: srcsel
+      shell: bash
+      env:
+        BUILDER_SRC: ${{ inputs.builder-src }}
+      run: |
+        set -euo pipefail
+        case "${BUILDER_SRC:-prebuilt}" in
+          inline)
+            echo "caddy=caddy-inline"        >> "$GITHUB_OUTPUT"
+            echo "crowdsec=crowdsec-inline"  >> "$GITHUB_OUTPUT" ;;
+          prebuilt)
+            echo "caddy=toolchain-prebuilt"    >> "$GITHUB_OUTPUT"
+            echo "crowdsec=toolchain-prebuilt" >> "$GITHUB_OUTPUT" ;;
+          *)
+            echo "::error::build-charon-image: invalid builder-src '${BUILDER_SRC}' (want prebuilt|inline)"
+            exit 1 ;;
+        esac
     - name: Set up Docker Buildx
       uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
+    - name: Log in to GHCR (pull prebuilt toolchain image)
+      if: inputs.builder-src != 'inline' && inputs.ghcr-token != ''
+      uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+      with:
+        registry: ghcr.io
+        username: ${{ github.actor }}
+        password: ${{ inputs.ghcr-token }}
     - name: Build image
       uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
       with:
@@ -47,6 +74,7 @@ runs:
         tags: ${{ inputs.tag }}
         build-args: |
           CI=${{ inputs.ci }}
+          CADDY_BUILDER_SRC=${{ steps.srcsel.outputs.caddy }}
+          CROWDSEC_BUILDER_SRC=${{ steps.srcsel.outputs.crowdsec }}
         cache-from: type=gha,scope=charon-integration-image
         cache-to: type=gha,mode=max,scope=charon-integration-image
-        no-cache-filters: ${{ inputs.no-cache-filters }}

.github/instructions/testing.instructions.md

@@ -93,7 +93,7 @@ This step:
 - Test requests routing through Caddy proxy with full middleware
 - **Port: 80 (User Traffic via Caddy)**
 - **Location: `backend/integration/` with `//go:build integration` tag**
-- **CI: Runs in separate workflows (cerberus-integration.yml, waf-integration.yml, etc.)**
+- **CI: Runs in `integration-tests.yml` (one shared image build, then parallel `cerberus` / `waf` / `rate-limit` / `crowdsec` suite jobs)**
 
 ### Two Modes: Docker vs Vite
 

.github/renovate.json

@@ -494,6 +494,13 @@
       ],
       "semanticCommitType": "chore"
     },
+    {
+      "description": "The ghcr.io/wikid82/charon-toolchain digest pin (Dockerfile ARG CHARON_TOOLCHAIN_TAG / CHARON_TOOLCHAIN_DIGEST) is owned by .github/workflows/toolchain-image.yml's bot PR, NOT Renovate: its content-hash tag (caddy-crowdsec-<hex>) has no version series to follow (spec N7). Disabled here so a stray digest bump cannot land without the matching key change the freshness guard requires.",
+      "matchPackageNames": [
+        "ghcr.io/wikid82/charon-toolchain"
+      ],
+      "enabled": false
+    },
     {
       "description": "Group GitHub Actions non-major updates into one PR",
       "matchManagers": [