mirror of
https://github.com/suitenumerique/messages.git
synced 2026-09-11 12:27:45 +02:00
BastienandGitHub
ac387db978
The Scalingo build script pins Caddy a second time, so both pins move together. The checksums come from the official release checksum files. DJANGO_ADMIN_IP_ALLOWLIST limits the Django admin URL to a CIDR list; unset keeps the current open behavior. The client_ip matcher reads X-Forwarded-For only from MESSAGES_FRONTEND_TRUSTED_PROXIES, and trusted_proxies_strict takes the rightmost untrusted address, so a spoofed or appended header never passes the filter. On Scalingo, set the trusted proxies to private_ranges; the router IP ranges are not published. make test-front-distroless builds the production image and smoke-tests it: heartbeat, lprobe healthcheck, allow/deny cases, spoofed headers, and the trusted-proxy path. The CI runs it; the published image had no test before. The script picks bridge or host network mode from the daemon, so it also runs on Docker Desktop. A moving major tag can change after a compromise of the action repository. Each pin keeps the version as a comment. The pins also upgrade every action to its latest major: the new majors only move the runtime to node24 and remove inputs these workflows do not use. crowdin v3 changes only custom CLI args, which we do not pass. Set persist-credentials: false on every checkout step, so the job token does not stay in .git/config for later steps. Remove the unused GITHUB_TOKEN from the crowdin upload workflow: the action reads it only in the push and pull-request paths, and this workflow disables both. Restrict the crowdin workflow permissions to contents: read.