From 9d48ae89a2460e65453f18f89cfe517f6785e648 Mon Sep 17 00:00:00 2001 From: jeremydixon22 Date: Mon, 17 Aug 2026 18:05:47 -0400 Subject: [PATCH] Security hardening --- .github/workflows/ci.yml | 5 +- .github/workflows/codeql.yml | 4 - .github/workflows/container-security.yml | 2 - .github/workflows/dependency-review.yml | 3 - .../workflows/execution-runtime-consumer.yml | 5 +- .github/workflows/publish-first-cohort.yml | 2 +- .github/workflows/release-integrity.yml | 3 - Directory.Build.props | 4 + Dockerfile | 5 +- README.md | 12 +- runtimes/python/README.md | 23 +- runtimes/python/requirements-server.in | 3 + runtimes/python/requirements-server.lock | 24 + .../packages.lock.json | 85 ++ .../packages.lock.json | 450 +++++++ .../packages.lock.json | 84 ++ .../packages.lock.json | 433 ++++++ ...date-execution-runtime-package-consumer.sh | 2 +- scripts/verify-mcp-container.sh | 65 +- scripts/verify-publication-policy.py | 22 +- scripts/verify-python-server-lock.py | 66 + scripts/verify-release-artifacts.sh | 2 +- scripts/verify-version-policy.py | 5 + src/Vyral.Abstractions/packages.lock.json | 15 + src/Vyral.Aws/packages.lock.json | 59 + src/Vyral.Azure/packages.lock.json | 239 ++++ .../packages.lock.json | 89 ++ src/Vyral.Cli/packages.lock.json | 344 +++++ src/Vyral.Cloudflare/packages.lock.json | 66 + src/Vyral.Embeddings.Onnx/packages.lock.json | 39 + src/Vyral.Execution.Aws/packages.lock.json | 45 + .../packages.lock.json | 162 +++ .../packages.lock.json | 16 + src/Vyral.Execution.Local/packages.lock.json | 77 ++ .../packages.lock.json | 343 +++++ .../packages.lock.json | 65 + .../packages.lock.json | 42 + .../packages.lock.json | 16 + src/Vyral.Execution/packages.lock.json | 15 + src/Vyral.Google/packages.lock.json | 262 ++++ src/Vyral.Local/packages.lock.json | 78 ++ src/Vyral.Mcp/packages.lock.json | 67 + src/Vyral.MySql/packages.lock.json | 39 + src/Vyral.Pgvector/packages.lock.json | 47 + src/Vyral.Primitives/packages.lock.json | 7 + .../packages.lock.json | 15 + src/Vyral.Providers.Cli/packages.lock.json | 16 + src/Vyral.Providers.Jules/packages.lock.json | 16 + src/Vyral.Providers.Local/packages.lock.json | 16 + src/Vyral.Providers.Onnx/packages.lock.json | 51 + src/Vyral.Server/packages.lock.json | 660 +++++++++ tests/Vyral.Tests.Aws/packages.lock.json | 279 ++++ tests/Vyral.Tests.Azure/packages.lock.json | 546 ++++++++ .../Vyral.Tests.Cloudflare/packages.lock.json | 268 ++++ .../packages.lock.json | 202 +++ .../packages.lock.json | 181 +++ tests/Vyral.Tests.Google/packages.lock.json | 459 +++++++ tests/Vyral.Tests.Local/packages.lock.json | 1187 +++++++++++++++++ tests/Vyral.Tests.MySql/packages.lock.json | 275 ++++ tests/Vyral.Tests.Pgvector/packages.lock.json | 248 ++++ .../Vyral.Tests.Providers/packages.lock.json | 167 +++ .../packages.lock.json | 433 ++++++ tests/Vyral.Tests.Temporal/packages.lock.json | 553 ++++++++ tools/Vyral.Benchmarks/packages.lock.json | 45 + .../packages.lock.json | 46 + 65 files changed, 9064 insertions(+), 40 deletions(-) create mode 100644 runtimes/python/requirements-server.in create mode 100644 runtimes/python/requirements-server.lock create mode 100644 samples/Vyral.CanonicalProjectionStarter/packages.lock.json create mode 100644 samples/Vyral.Execution.AzureDurableFunctionsSmoke/packages.lock.json create mode 100644 samples/Vyral.Execution.LocalSample/packages.lock.json create mode 100644 samples/Vyral.Execution.TemporalSample/packages.lock.json create mode 100644 scripts/verify-python-server-lock.py create mode 100644 src/Vyral.Abstractions/packages.lock.json create mode 100644 src/Vyral.Aws/packages.lock.json create mode 100644 src/Vyral.Azure/packages.lock.json create mode 100644 src/Vyral.Bridge.SemanticKernel/packages.lock.json create mode 100644 src/Vyral.Cli/packages.lock.json create mode 100644 src/Vyral.Cloudflare/packages.lock.json create mode 100644 src/Vyral.Embeddings.Onnx/packages.lock.json create mode 100644 src/Vyral.Execution.Aws/packages.lock.json create mode 100644 src/Vyral.Execution.AzureDurable.Functions/packages.lock.json create mode 100644 src/Vyral.Execution.AzureDurable/packages.lock.json create mode 100644 src/Vyral.Execution.Local/packages.lock.json create mode 100644 src/Vyral.Execution.Temporal.Hosting/packages.lock.json create mode 100644 src/Vyral.Execution.Temporal.Postgres/packages.lock.json create mode 100644 src/Vyral.Execution.Temporal/packages.lock.json create mode 100644 src/Vyral.Execution.WorkerClient/packages.lock.json create mode 100644 src/Vyral.Execution/packages.lock.json create mode 100644 src/Vyral.Google/packages.lock.json create mode 100644 src/Vyral.Local/packages.lock.json create mode 100644 src/Vyral.Mcp/packages.lock.json create mode 100644 src/Vyral.MySql/packages.lock.json create mode 100644 src/Vyral.Pgvector/packages.lock.json create mode 100644 src/Vyral.Primitives/packages.lock.json create mode 100644 src/Vyral.Providers.Abstractions/packages.lock.json create mode 100644 src/Vyral.Providers.Cli/packages.lock.json create mode 100644 src/Vyral.Providers.Jules/packages.lock.json create mode 100644 src/Vyral.Providers.Local/packages.lock.json create mode 100644 src/Vyral.Providers.Onnx/packages.lock.json create mode 100644 src/Vyral.Server/packages.lock.json create mode 100644 tests/Vyral.Tests.Aws/packages.lock.json create mode 100644 tests/Vyral.Tests.Azure/packages.lock.json create mode 100644 tests/Vyral.Tests.Cloudflare/packages.lock.json create mode 100644 tests/Vyral.Tests.Conformance/packages.lock.json create mode 100644 tests/Vyral.Tests.ExecutionWorkerClient/packages.lock.json create mode 100644 tests/Vyral.Tests.Google/packages.lock.json create mode 100644 tests/Vyral.Tests.Local/packages.lock.json create mode 100644 tests/Vyral.Tests.MySql/packages.lock.json create mode 100644 tests/Vyral.Tests.Pgvector/packages.lock.json create mode 100644 tests/Vyral.Tests.Providers/packages.lock.json create mode 100644 tests/Vyral.Tests.Temporal.WorkerHost/packages.lock.json create mode 100644 tests/Vyral.Tests.Temporal/packages.lock.json create mode 100644 tools/Vyral.Benchmarks/packages.lock.json create mode 100644 tools/Vyral.CanonicalStore.Benchmarks/packages.lock.json diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index e4c9a4f..2812800 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -70,7 +70,7 @@ jobs: - name: Restore if: ${{ needs.changes.outputs.dotnet == 'true' }} - run: dotnet restore Vyral.sln + run: dotnet restore Vyral.sln --locked-mode - name: Verify Azure Durable package coherence if: ${{ needs.changes.outputs.dotnet == 'true' }} @@ -126,6 +126,8 @@ jobs: cache-dependency-path: | clients/python/pyproject.toml runtimes/python/pyproject.toml + runtimes/python/requirements-server.in + runtimes/python/requirements-server.lock - name: Set up Go if: ${{ needs.changes.outputs.go == 'true' }} @@ -184,6 +186,7 @@ jobs: python3 scripts/verify-markdown-links.py python3 scripts/verify-publication-cohort.py python3 scripts/verify-publication-policy.py + python3 scripts/verify-python-server-lock.py python3 scripts/generate-sdk-types.py python3 scripts/sync-python-runtime-contracts.py git diff --exit-code diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index b60c857..5eec42f 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -18,7 +18,6 @@ permissions: jobs: scope: name: Select CodeQL languages - if: ${{ github.event_name == 'workflow_dispatch' || vars.VYRAL_ENABLE_AUTOMATED_WORKFLOWS == 'true' }} runs-on: ubuntu-24.04 timeout-minutes: 5 outputs: @@ -44,9 +43,6 @@ jobs: analyze: name: Analyze ${{ matrix.language }} needs: scope - # The repository variable is the emergency pause switch for hosted gates. - # Manual dispatch remains available for controlled diagnostics. - if: ${{ github.event_name == 'workflow_dispatch' || vars.VYRAL_ENABLE_AUTOMATED_WORKFLOWS == 'true' }} runs-on: ubuntu-latest timeout-minutes: 15 strategy: diff --git a/.github/workflows/container-security.yml b/.github/workflows/container-security.yml index ca455fe..6b245d4 100644 --- a/.github/workflows/container-security.yml +++ b/.github/workflows/container-security.yml @@ -29,8 +29,6 @@ permissions: jobs: scan: name: Scan current container surfaces - # Manual dispatch remains available when the hosted-automation pause switch is active. - if: ${{ github.event_name == 'workflow_dispatch' || vars.VYRAL_ENABLE_AUTOMATED_WORKFLOWS == 'true' }} runs-on: ubuntu-24.04 timeout-minutes: 20 env: diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml index cbedf38..50d96eb 100644 --- a/.github/workflows/dependency-review.yml +++ b/.github/workflows/dependency-review.yml @@ -10,9 +10,6 @@ permissions: jobs: review: name: Review dependency changes - # The repository variable is the emergency pause switch for hosted gates. - # Manual dispatch remains available for controlled diagnostics. - if: ${{ github.event_name == 'workflow_dispatch' || vars.VYRAL_ENABLE_AUTOMATED_WORKFLOWS == 'true' }} runs-on: ubuntu-latest permissions: contents: read diff --git a/.github/workflows/execution-runtime-consumer.yml b/.github/workflows/execution-runtime-consumer.yml index ac8248a..b8ce384 100644 --- a/.github/workflows/execution-runtime-consumer.yml +++ b/.github/workflows/execution-runtime-consumer.yml @@ -69,9 +69,6 @@ on: jobs: validate: name: Validate consumer path - # The repository variable is the emergency pause switch for hosted gates. - # Manual dispatch remains available for controlled diagnostics. - if: ${{ github.event_name == 'workflow_dispatch' || vars.VYRAL_ENABLE_AUTOMATED_WORKFLOWS == 'true' }} runs-on: ubuntu-latest env: DOTNET_CLI_TELEMETRY_OPTOUT: "1" @@ -92,7 +89,7 @@ jobs: cache: false - name: Restore - run: dotnet restore Vyral.sln + run: dotnet restore Vyral.sln --locked-mode - name: Validate local consumer contract run: scripts/validate-execution-runtime-consumer.sh diff --git a/.github/workflows/publish-first-cohort.yml b/.github/workflows/publish-first-cohort.yml index 4025ead..f4db523 100644 --- a/.github/workflows/publish-first-cohort.yml +++ b/.github/workflows/publish-first-cohort.yml @@ -102,7 +102,7 @@ jobs: set -euo pipefail python -m pip install --disable-pip-version-check build==1.3.0 python3 scripts/verify-publication-cohort.py - dotnet restore Vyral.sln + dotnet restore Vyral.sln --locked-mode mkdir -p artifacts/publish/nuget artifacts/publish/npm artifacts/publish/pypi for project in \ src/Vyral.Abstractions/Vyral.Abstractions.csproj \ diff --git a/.github/workflows/release-integrity.yml b/.github/workflows/release-integrity.yml index de4fd2e..9f8e9df 100644 --- a/.github/workflows/release-integrity.yml +++ b/.github/workflows/release-integrity.yml @@ -16,9 +16,6 @@ permissions: jobs: verify: name: Verify releasable artifacts - # The repository variable is the emergency pause switch for hosted gates. - # Manual dispatch remains available for controlled diagnostics. - if: ${{ github.event_name == 'workflow_dispatch' || vars.VYRAL_ENABLE_AUTOMATED_WORKFLOWS == 'true' }} # Ubuntu 24.04 restricts unprivileged user namespaces through AppArmor. The workspace-agent # security gate must exercise Bubblewrap's real namespace boundary, never an unsandboxed # fallback, so keep this job on the supported 22.04 runner until a reviewed AppArmor profile diff --git a/Directory.Build.props b/Directory.Build.props index 7415722..7e182e5 100644 --- a/Directory.Build.props +++ b/Directory.Build.props @@ -22,6 +22,10 @@ vyral;provider-neutral;contracts;retrieval;execution README.md true + + true + true