Foundational hardening (Waves 1–4): CI/Docker, flag-gated Zitadel auth, validation, tests #2

Merged

sax3l merged 3 commits from foundation/hardening into main 2026-07-25 16:10:26 +00:00

Conversation 0 Commits 3 Files Changed 36

+3895 -49

sax3l commented 2026-07-25 15:45:51 +00:00

Copy Link

Copy Source

Foundational hardening (Waves 1–4)

Systematic, verified hardening of this repo on foundation/hardening. Additive/flag-gated — deploy-safe.

• Wave 1 — CI gate (.gitea/workflows), Dockerfile, .dockerignore, .env.example
• Wave 2 — flag-gated Zitadel JWT auth (AUTH_ENFORCE default off = non-breaking, attach-if-valid), Zod input validation, eslint/prettier, auth+validation tests
• Wave 3/4 (where applicable) — integrity/persistence, verified against a real Postgres (no mocks)

Verification: typecheck + full test suite pass in node:22-alpine; persistence verified against live Postgres. Nothing merged/deployed until this PR is merged.

Before flipping AUTH_ENFORCE=true in prod: issue Zitadel service-account tokens to callers first (per-service rollout).

🤖 Generated with Claude Code

## Foundational hardening (Waves 1–4) Systematic, verified hardening of this repo on `foundation/hardening`. **Additive/flag-gated — deploy-safe.** - **Wave 1** — CI gate (.gitea/workflows), Dockerfile, .dockerignore, .env.example - **Wave 2** — flag-gated Zitadel JWT auth (`AUTH_ENFORCE` **default off** = non-breaking, attach-if-valid), Zod input validation, eslint/prettier, auth+validation tests - **Wave 3/4** (where applicable) — integrity/persistence, verified against a **real Postgres** (no mocks) **Verification:** typecheck + full test suite pass in `node:22-alpine`; persistence verified against live Postgres. Nothing merged/deployed until this PR is merged. **Before flipping `AUTH_ENFORCE=true` in prod:** issue Zitadel service-account tokens to callers first (per-service rollout). 🤖 Generated with [Claude Code](https://claude.com/claude-code)

sax3l added 3 commits 2026-07-25 15:45:51 +00:00

chore(foundation): Wave 1 scaffolding — CI gate / Dockerfile / .env.example bd5e309851

feat(foundation): Wave 3 integrity/persistence/build fixes 844220d9f5

feat(auth,foundation): Wave 2 flag-gated Zitadel JWT verify + validation + eslint + tests ... 1d76d50f3d

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

sax3l merged commit into main 2026-07-25 16:10:26 +00:00

admin referenced this issue from a commit 2026-08-09 09:31:06 +00:00

Merge pull request #2 from sax3l/fix/0pt-missing-client-service-modules

admin referenced this issue from a commit 2026-09-15 02:36:38 +00:00

ci(release-chain): re-trigger #2 — REGISTRY/SIAX_CI_TOKEN tillbaka på admin-identitet (siax-bots ci-approvers-team har permission none -> 401 pa registry-push; dedikerad registry-user = rotationsobjekt) + push-whitelist klar

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

No items

No labels

Milestone

No items

No Milestone

Projects

Clear projects

No projects

Assignees

Clear assignees

siax-bot siax-ci siax-healer (siax-healer (CI self-healing agent)) admin (Simon Axelsson)

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: admin/0pt#2