chore(infra): harden prod images, compose, CI, and dep hygiene (BUNYIP-80) #232

Merged

Claude-Run merged 1 commit from chore/bunyip-80-harden-images-compose-ci into main

2026-06-26 02:29:28 +02:00

Claude-Run commented

2026-06-26 02:11:13 +02:00

Member

Close the hardening and hygiene gaps the infra/CI/build audit flagged across the production images, compose, CI workflows, and workspace manifests.

bunyip-web prod image: add a non-root appuser (UID 1001) + chown + USER directive and an OCI ARG/LABEL block (GIT_COMMIT/GIT_TAG/BUILD_DATE), mirroring bunyip-api/oci-build/Dockerfile; build-web.yml now passes the three build-args like build-api.yml.
compose.yml: replace the hardcoded dev OIDC key path with ${OIDC_JWT_PRIVATE_KEY_PATH:-/run/secrets/oidc/dev-2026.pem} and drop the runtime-no-op SQLX_OFFLINE=true from the api env.
check.yml: add rust-toolchain.toml and .cargo/config.toml to the push paths, and add a docker build --target builder step mirroring just check-docker.
bunyip-web dev Dockerfile: run bun install in the CMD so the web-node-modules named volume (and the .:/app bind mount) no longer shadow the build-time install, leaving the tailwind CLI missing at runtime.
TLS: move bunyip-domain and bunyip-oidc to reqwest 0.12 with rustls (default-features = false), matching api/web and the rustls-only policy; removes bunyip's own native-tls reqwest. The residual reqwest 0.11/native-tls in the lock is pulled transitively by the dunite git crates and by async-stripe/lettre defaults, outside this repo's manifests.
Workspace deps: drop the unused validator 0.19 entry (crates pin 0.18 directly), the uuid v7/js features, and the chrono wasmbind feature (server-only binary).
Dedup get-tags.nu: replace the byte-for-byte api/web copies with a single shared oci-build/get-tags.nu; both build workflows reference it and gained an oci-build/** path trigger.
bunyip-web/.env.example: convert YAML colon syntax to dotenv KEY=VALUE so a copied .env is valid; drop the never-referenced FEEDBACK_FORGEJO_REPO/FEEDBACK_FORGEJO_TOKEN from the root .env.example.
Remove the stale AUDIT.md (Dioxus/WASM-era rewire notes, obsolete after the Axum/Maud SSR rewrite) and fix the dangling link in dev-docs/milestone-1-handoff.md.

Verified in the pinned rust-builder container: fmt --check, clippy -D warnings, cargo build --workspace --all-targets --locked, and cargo test --workspace --lib all green.

#BUNYIP-80

Close the hardening and hygiene gaps the infra/CI/build audit flagged across the production images, compose, CI workflows, and workspace manifests. - bunyip-web prod image: add a non-root `appuser` (UID 1001) + chown + USER directive and an OCI ARG/LABEL block (GIT_COMMIT/GIT_TAG/BUILD_DATE), mirroring `bunyip-api/oci-build/Dockerfile`; `build-web.yml` now passes the three build-args like `build-api.yml`. - compose.yml: replace the hardcoded dev OIDC key path with `${OIDC_JWT_PRIVATE_KEY_PATH:-/run/secrets/oidc/dev-2026.pem}` and drop the runtime-no-op `SQLX_OFFLINE=true` from the api env. - check.yml: add `rust-toolchain.toml` and `.cargo/config.toml` to the push paths, and add a `docker build --target builder` step mirroring `just check-docker`. - bunyip-web dev Dockerfile: run `bun install` in the CMD so the `web-node-modules` named volume (and the `.:/app` bind mount) no longer shadow the build-time install, leaving the tailwind CLI missing at runtime. - TLS: move bunyip-domain and bunyip-oidc to reqwest 0.12 with rustls (default-features = false), matching api/web and the rustls-only policy; removes bunyip's own native-tls reqwest. The residual reqwest 0.11/native-tls in the lock is pulled transitively by the dunite git crates and by async-stripe/lettre defaults, outside this repo's manifests. - Workspace deps: drop the unused `validator` 0.19 entry (crates pin 0.18 directly), the `uuid` v7/js features, and the `chrono` wasmbind feature (server-only binary). - Dedup `get-tags.nu`: replace the byte-for-byte api/web copies with a single shared `oci-build/get-tags.nu`; both build workflows reference it and gained an `oci-build/**` path trigger. - bunyip-web/.env.example: convert YAML colon syntax to dotenv `KEY=VALUE` so a copied `.env` is valid; drop the never-referenced `FEEDBACK_FORGEJO_REPO`/`FEEDBACK_FORGEJO_TOKEN` from the root `.env.example`. - Remove the stale `AUDIT.md` (Dioxus/WASM-era rewire notes, obsolete after the Axum/Maud SSR rewrite) and fix the dangling link in `dev-docs/milestone-1-handoff.md`. Verified in the pinned rust-builder container: fmt --check, clippy -D warnings, `cargo build --workspace --all-targets --locked`, and `cargo test --workspace --lib` all green. #BUNYIP-80

Claude-Run added 1 commit

2026-06-26 02:11:14 +02:00

chore(infra): harden prod images, compose, CI, and dep hygiene (BUNYIP-80)

E2E / Playwright against deployment (pull_request) Successful in 20s

Details

Check / fmt + clippy + build + tests (pull_request) Successful in 18m8s

Details

Create release / Create release from merged PR (pull_request) Has been skipped

Details

649bf9b823

Close the hardening and hygiene gaps the infra/CI/build audit flagged across the production images, compose, CI workflows, and workspace manifests.

- bunyip-web prod image: add a non-root `appuser` (UID 1001) + chown + USER directive and an OCI ARG/LABEL block (GIT_COMMIT/GIT_TAG/BUILD_DATE), mirroring `bunyip-api/oci-build/Dockerfile`; `build-web.yml` now passes the three build-args like `build-api.yml`.
- compose.yml: replace the hardcoded dev OIDC key path with `${OIDC_JWT_PRIVATE_KEY_PATH:-/run/secrets/oidc/dev-2026.pem}` and drop the runtime-no-op `SQLX_OFFLINE=true` from the api env.
- check.yml: add `rust-toolchain.toml` and `.cargo/config.toml` to the push paths, and add a `docker build --target builder` step mirroring `just check-docker`.
- bunyip-web dev Dockerfile: run `bun install` in the CMD so the `web-node-modules` named volume (and the `.:/app` bind mount) no longer shadow the build-time install, leaving the tailwind CLI missing at runtime.
- TLS: move bunyip-domain and bunyip-oidc to reqwest 0.12 with rustls (default-features = false), matching api/web and the rustls-only policy; removes bunyip's own native-tls reqwest. The residual reqwest 0.11/native-tls in the lock is pulled transitively by the dunite git crates and by async-stripe/lettre defaults, outside this repo's manifests.
- Workspace deps: drop the unused `validator` 0.19 entry (crates pin 0.18 directly), the `uuid` v7/js features, and the `chrono` wasmbind feature (server-only binary).
- Dedup `get-tags.nu`: replace the byte-for-byte api/web copies with a single shared `oci-build/get-tags.nu`; both build workflows reference it and gained an `oci-build/**` path trigger.
- bunyip-web/.env.example: convert YAML colon syntax to dotenv `KEY=VALUE` so a copied `.env` is valid; drop the never-referenced `FEEDBACK_FORGEJO_REPO`/`FEEDBACK_FORGEJO_TOKEN` from the root `.env.example`.
- Remove the stale `AUDIT.md` (Dioxus/WASM-era rewire notes, obsolete after the Axum/Maud SSR rewrite) and fix the dangling link in `dev-docs/milestone-1-handoff.md`.

Verified in the pinned rust-builder container: fmt --check, clippy -D warnings, `cargo build --workspace --all-targets --locked`, and `cargo test --workspace --lib` all green.

#BUNYIP-80