Shared security and delivery workflows

Reusable Forgejo Actions for personal repositories and any organization. Pin the workflow and library_ref to the same immutable semantic version tag, such as v1.2.1. Caller repos can be private; the shared workflow target is public.

Start with adoption, release protocol, and security policy. The combined security.yml is the supported gate. The original four individual scan workflows remain for compatibility, but must not authorize deployments.

Central workflow upgrades prepares the protected manual stable-v1 promotion/rollback procedure requested in #93. Callers migrate once; frozen workflow adapters keep each run paired with its exact released library. Hosted channel acceptance and consumer adoption remain pending.

Before committing locally, install native Gitleaks 8.30.1 and run sh .githooks/install.sh (Git Bash on Windows). See local secret prevention for clone/worktree installation and new-repository adoption. Keep all existing CI source/history scans in place.

Managed application onboarding adds automatic per-environment deployment identities from the platform, without per-app role variables or a new workflow-library contract/release for every application.

Security image execution adds explicit preinstalled-* entry points using the accepted, digest-pinned security image with released v1.33.0 library code and verified tools. The original workflow entry points retain their runner-label setup. The image was published on 2026-10-13 UTC; hosted startup acceptance, workflow release and caller adoption remain pending in #86.

Workflow	Result
validate-source.yml / package-image-security.yml	Caller-owned Python checks and complete promotion-image decisions; release and adoption prerequisites
node-ci.yml / node-ci-image.yml	Combined pnpm generation/format/typecheck/lint/test/build using a writable Node cache or an explicitly adopted owned Node 26 CI image; release and caller prerequisites
npm-ci.yml	Combined npm clean install, existing check script, optional additional prebuild check and production build using the shared writable Node cache; release and caller prerequisites
discover-base-images.yml / base-image.yml	Discover implemented bases; shared build, full scans and optional protected signed publication; see base-image pipeline
select-base-images.yml / validate-base-images.yml / require-base-image-scans.yml	Shared routing, definition checks and aggregate gate; release and adoption prerequisites
security.yml	Secrets, dependency vulnerabilities, IaC, SAST, optional digest-pinned image scans and SBOMs
build-bundle.yml (delivery extension)	Scan manifests/images, build one UDS archive, sign receipt, publish release assets
deploy-bundle.yml (delivery extension)	Verify archive, refresh image scans, deploy same archive and check rollout
rke2-delivery.yml / validate-rke2.yml	Signed RKE2 bootstrap/controller/Plan delivery, scoped OIDC credentials and upgrade validation
core-delivery.yml / core-runner-identity.yml	Protected UDS Core and runner identity delivery; publish/promote before adopting the new callers
cleanup-dev-bundle.yml	Preview or remove an opted-in dev bundle, namespace, disposable CSI storage and declared external PostgreSQL databases
deploy-bundle-k8s.yml (migration canary)	Validate Kubernetes credentials or deploy to dev on deploy-k8s; see runner canary
publish-release.yml	Manually publish an immutable semantic workflow release from protected main
terraform.yml	Protected OIDC/OpenBao-backed plan/apply and state-bucket bootstrap; see Terraform provisioning

Private UDS bundle settings extends the existing OpenBao Terraform profile with reviewed public version/package overlays and ephemeral/write-only preservation of populated configuration.

Tools install into job-local storage with verified checksums and Python dependency hashes. Semgrep rules download at runtime under their internal-use license. The delivery extension is reviewed separately; its PR adds docs/delivery.md. Homelab/bundles supplies the app template.

Fast, disposable dev delivery adds an explicit dev scan profile while preserving full scans by default. Dev-only releases cannot deploy to production; cleanup uses managed dev credentials and defaults to a preview.

The reviewed shared tool lock selects UDS CLI 0.38.0. Bundle creation and deployment explicitly select NextMode=false to preserve the existing signed legacy archive contract. The library PR checks also build disposable fixture packages and a bundle with the real checksum-verified CLI, without publishing or deploying them. See delivery compatibility.

Long operations report their stage and elapsed time every 30 seconds. See workflow progress and adoption for coverage and limits.

Runner migration remains separate in #2. Existing hosts can execute these jobs in an isolated Linux job environment. Runner labels, branch protection and owner-supplied credentials must be configured.

This repository scans its own complete history and working tree for every pull request, every push to main, manual dispatches, and a weekly schedule. The self-scan pins a released library version so pull requests cannot replace the trusted scanner implementation that evaluates them. Forgejo 16 ignores GitHub's permissions field. Protected release/tag writes use short-lived native Authorized Integrations, scoped separately to the release and channel workflows; the automatic job token performs read-only preflight checks. Complete the one-time integration setup before dispatching either publisher.

Tracking: secrets #1, reuse #3, security #4, delivery #5. The build-container.yml delivery extension builds Dockerfiles locally, scans with Gitleaks/Trivy/Semgrep/ClamAV, stores signed evidence, then publishes the image. See docs/delivery.md for the complete UI-driven workflow and credential boundaries.