chore: propagate changes from main into development - #1322
Merged
Wikid82 merged 19 commits intoSep 9, 2026
Merged
Conversation
…ublic registration Claude-Session: https://claude.ai/code/session_01Wm1jzKSdvz2LCusQC2qokM
…stration removal Claude-Session: https://claude.ai/code/session_01JyYXjnztSGFqTELR8KTUXT
The planning spec that commits 3055a913..ccc9cdbc were implemented from. Replaces the prior (already-delivered) toolchain-image spec in current_spec.md. Claude-Session: https://claude.ai/code/session_01JyYXjnztSGFqTELR8KTUXT
The shell integration-test scripts under scripts/ bootstrapped their
initial admin user by POSTing to the removed public account-creation
endpoint, then logging in. With that endpoint gone the login step now
returns HTTP 401 and the scripts abort ("Login failed (HTTP 401)"),
breaking the Rate Limiting, Cerberus, WAF, CrowdSec and Coraza
integration jobs.
Switch the bootstrap call in all eight scripts to POST /api/v1/setup,
which creates the first user (admin) with an identical request body
({name,email,password}). debug_rate_limit.sh additionally used a
7-character password that fails /setup's min=8 rule, so its setup and
matching login body are bumped to an 8-character password. Human-readable
"Registering ..." log/comment lines are reworded to "Setting up ...".
Existing "|| true" / redirect idempotency handling is preserved so a
403 "Setup already completed" on re-run stays harmless.
Claude-Session: https://claude.ai/code/session_01JyYXjnztSGFqTELR8KTUXT
`development` carries c32e611 (gRPC 1.83.2), a toolchain-key input that `main` does not have yet, so the toolchain pin propagated into `development` by #1307 (caddy-crowdsec-1efe7f19fa52a512 @ sha256:6575f4c6…, computed for main's gRPC 1.83.1 recipe) is stale here: the recipe on this branch recomputes to caddy-crowdsec-9eb9862f44b9e769, failing verify-toolchain-pin. Bumps the two ARG lines to the key/digest that match development's recipe. This is the manual equivalent of the daily open-bump-pr bot (now using the chore(docker): convention). Verified on this branch: - scripts/toolchain-key.sh -> caddy-crowdsec-9eb9862f44b9e769 - imagetools inspect <that tag> -> sha256:b41e571d5951bbfc3daa3dccdca033ad9dee535a8e720ac7e3b0bce338f223b2 Claude-Session: https://claude.ai/code/session_01KXA4x9LrA2AsnLrvdHMZbS
… public registration (#1316)
…p split The management-API authorization hardening changed RemoteServerHandler.RegisterRoutes to a (read, admin *gin.RouterGroup) split, adding lines above Update() and shifting the suppressed logger.Log()...Warn() sink in remote_server_handler.go from line 142 to ~148. The exact-line suppression entry no longer matched, so the findings-gate counted the (unchanged, still-false-positive) go/log-injection result as blocking on the full-tree scan run by the main->development propagation PR. Widen the entry to a line_range (146-150), mirroring the existing uptime_service.go sibling entry that hit the same drift, so the multi-line log chain stays covered regardless of which line CodeQL anchors to. No code or behavior change. Claude-Session: https://claude.ai/code/session_01Jz4LgwfkxaF8E7TdAgk94y
…into-development-20260909
Codecov Report❌ Patch coverage is
📢 Thoughts on this report? Let us know! |
Contributor
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
Contributor
✅ Supply Chain Verification Results✅ PASSED 📦 SBOM Summary
🔍 Vulnerability Scan
📎 Artifacts
Generated by Supply Chain Verification workflow • View Details |
This was referenced Sep 9, 2026
…e-main-into-development-20260909
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Supersedes #1320 (whose head was
main, so the toolchain-pin reconciliation commit couldn't be added without breakingmain's own freshness check).Brings into
development:fix(ci)integration-script bootstrap repair +fix(deps)gRPC 1.83.2 / toolchain pingo/log-injectionCodeQL suppression re-anchor (line_range after the route-group split shifted the sink)Follow-up commit needed on this branch
The
main+developmentmerge recipe produces a new toolchain key (both sides carry Dockerfile ARG bumps the other lacks:main= gRPC 1.83.2,development= x/net 0.59.0 + x/crypto 0.57.0). Once the Toolchain Image — Build & Publish job on this PR computes and publishes the image for the merge recipe, achore(docker): sync toolchain pincommit will bumpCHARON_TOOLCHAIN_TAG/CHARON_TOOLCHAIN_DIGESTto match, clearingverify-toolchain-pin.Merge with Create a merge commit per the promotion-PR rule — never squash/rebase.
Close #1320 in favor of this.