Promote nightly to main (2026-10-05)

.github/codeql-custom-model.yml

@@ -16,6 +16,12 @@
 # - IPv6 Unique Local: fc00::/7
 #
 # Reference: /docs/plans/current_spec.md
+#
+# NOTE: this file is NOT loaded by code scanning. Data extensions are only
+# picked up from model packs under .github/codeql/extensions/ (see
+# charon-safehttp-models there). Entries below are kept for documentation; note
+# that a sinkModel marks a request-forgery sink rather than a sanitizer, so
+# they should not be moved into a pack as-is (use barrierModel instead).
 extensions:
   # =============================================================================
   # SSRF SANITIZER MODELS

.github/codeql/codeql-suppressions.yml

@@ -26,7 +26,9 @@
 suppressions:
   - rule_id: go/cookie-secure-not-set
     path: backend/internal/api/handlers/auth_handler.go
-    line: 187
+    line_range:
+      start: 187
+      end: 205
     reason: >
       Secure is false only when isLocalRequest(c) AND scheme != "https"
       (loopback/RFC1918/IPv6-ULA/Tailscale-CGNAT origin over plain HTTP) —
@@ -43,6 +45,10 @@ suppressions:
       the documented fallback for that case. See
       docs/issues/codeql-cookie-suppression-not-honored.md for the full
       investigation history.
+      Extended 2026-10-03: the request-origin/auth handler changes in the
+      security hardening PRs shift the SetCookie sink between lines 187 and
+      ~202 depending on merge state, so the entry is widened to a
+      line_range; this is the only SetCookie call in the file.
     added: "2026-08-04"
     review_by: "2026-11-04"
 

.github/codeql/extensions/charon-safehttp-models/codeql-pack.yml

@@ -0,0 +1,12 @@
+# CodeQL model pack: data extensions for Charon's own helpers.
+#
+# Code scanning (github/codeql-action) automatically discovers model packs
+# under .github/codeql/extensions/, so this pack applies to CI without being
+# listed in .github/codeql/codeql-config.yml.
+name: charon/safehttp-models
+version: 0.0.1
+library: true
+extensionTargets:
+  codeql/go-all: "*"
+dataExtensions:
+  - models/**/*.yml

.github/codeql/extensions/charon-safehttp-models/models/safehttp.model.yml

@@ -0,0 +1,21 @@
+# Barrier models for the shared outbound-request helpers in
+# backend/pkg/safehttp.
+#
+# The values returned by these functions are safe to use as a request URL:
+#   - ValidateURLSyntax / ValidateURL reject non-HTTP(S) schemes, embedded
+#     credentials, and literal blocked addresses (ValidateURL also resolves
+#     hostnames), and return a parsed *url.URL.
+#   - JoinPath only appends individually escaped path segments to a validated
+#     base URL (dot segments, separators, and control characters are rejected),
+#     so the scheme and host of the result always come from that base.
+# The dialer inside safehttp.NewClient re-validates every connection address
+# and is the authoritative control; these barriers only tell the query where
+# validation has already happened.
+extensions:
+  - addsTo:
+      pack: codeql/go-all
+      extensible: barrierModel
+    data:
+      - ["github.com/Wikid82/charon/backend/pkg/safehttp", "", False, "ValidateURLSyntax", "", "", "ReturnValue[0]", "request-forgery", "manual"]
+      - ["github.com/Wikid82/charon/backend/pkg/safehttp", "", False, "ValidateURL", "", "", "ReturnValue[0]", "request-forgery", "manual"]
+      - ["github.com/Wikid82/charon/backend/pkg/safehttp", "", False, "JoinPath", "", "", "ReturnValue[0]", "request-forgery", "manual"]

.github/renovate.json

@@ -857,6 +857,19 @@
       "depNameTemplate": "github.com/libdns/vercel",
       "datasourceTemplate": "go",
       "versioningTemplate": "semver"
+    },
+    {
+      "customType": "regex",
+      "description": "Track dnsimple-go/v8 forced transitive version ARG in Dockerfile",
+      "managerFilePatterns": [
+        "/^Dockerfile$/"
+      ],
+      "matchStrings": [
+        "ARG CADDY_DNS_DNSIMPLE_GO_VERSION=(?<currentValue>[^\\s]+)"
+      ],
+      "depNameTemplate": "github.com/dnsimple/dnsimple-go/v8",
+      "datasourceTemplate": "go",
+      "versioningTemplate": "semver"
     }
   ],
   "github-actions": {
@@ -892,6 +905,19 @@
       ],
       "enabled": false
     },
+    {
+      "description": "The bundled powerdns plugin consumes the in-repo backend module through a local replace directive; never let Renovate resolve or bump it.",
+      "matchManagers": [
+        "gomod"
+      ],
+      "matchFileNames": [
+        "plugins/powerdns/go.mod"
+      ],
+      "matchPackageNames": [
+        "github.com/Wikid82/charon/backend"
+      ],
+      "enabled": false
+    },
     {
       "description": "Group GitHub Actions non-major updates into one PR",
       "matchManagers": [

.github/workflows/benchmark.yml

@@ -32,6 +32,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
+          persist-credentials: false
           # For pull_request events, use the branch HEAD SHA (not the ephemeral merge
           # commit that github.sha resolves to), which is directly fetchable by SHA.
           # For workflow_run events fall back to the triggering HEAD SHA.

.github/workflows/build-offline.yml

@@ -56,6 +56,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1

.github/workflows/codecov-upload.yml

@@ -46,6 +46,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
+          persist-credentials: false
           fetch-depth: 0
           ref: ${{ github.sha }}
 
@@ -177,6 +178,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
+          persist-credentials: false
           fetch-depth: 0
           ref: ${{ github.sha }}
 
@@ -214,6 +216,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
+          persist-credentials: false
           fetch-depth: 0
           ref: ${{ github.sha }}
 

.github/workflows/codeql.yml

@@ -40,6 +40,7 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
+          persist-credentials: false
           # Use github.ref (full ref path) instead of github.ref_name:
           # - push/schedule: resolves to refs/heads/<branch>, checking out latest HEAD
           # - pull_request:  resolves to refs/pull/<n>/merge, the correct PR merge ref

.github/workflows/container-prune.yml

@@ -19,11 +19,13 @@ on:
         default: '30'
 
 permissions:
-  packages: write
   contents: read
 
 jobs:
   prune-ghcr:
+    permissions:
+      contents: read
+      packages: write   # delete old GHCR image versions
     runs-on: ubuntu-latest
     if: github.event_name != 'workflow_dispatch' || github.ref == format('refs/heads/{0}', github.event.repository.default_branch)
     strategy:
@@ -42,6 +44,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
 
       - name: Install tools
         run: |
@@ -124,6 +128,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
 
       - name: Install tools
         run: |

.github/workflows/docker-build.yml

@@ -93,7 +93,7 @@ jobs:
     # Actions' `on:` block cannot reference expressions/env, so there is no shared source).
     # `nightly` is deliberately excluded — it is not in `push.branches`, so a PR headed at
     # `nightly` never races a `push`-triggered run of this workflow.
-    if: ${{ (github.event_name != 'workflow_run' || (github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.name == 'Docker Lint' && github.event.workflow_run.path == '.github/workflows/docker-lint.yml')) && (github.event_name != 'pull_request' || !contains(fromJSON('["main","development"]'), github.head_ref)) }}
+    if: ${{ (github.event_name != 'workflow_run' || (github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.name == 'Docker Lint' && github.event.workflow_run.path == '.github/workflows/docker-lint.yml' && github.event.workflow_run.head_repository.full_name == github.repository)) && (github.event_name != 'pull_request' || !contains(fromJSON('["main","development"]'), github.head_ref)) }}
     runs-on: ubuntu-latest
     timeout-minutes: 5
     permissions:
@@ -113,6 +113,7 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
+          persist-credentials: false
           ref: ${{ env.TRIGGER_HEAD_SHA }}
           fetch-depth: 0
       - name: Normalize image name
@@ -448,6 +449,7 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
+          persist-credentials: false
           ref: ${{ env.TRIGGER_HEAD_SHA }}
       - name: Normalize image name
         run: |
@@ -534,6 +536,7 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
+          persist-credentials: false
           ref: ${{ env.TRIGGER_HEAD_SHA }}
       - name: Normalize image name
         run: |
@@ -647,6 +650,7 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
+          persist-credentials: false
           ref: ${{ env.TRIGGER_HEAD_SHA }}
       - name: Normalize image name
         run: |
@@ -1199,6 +1203,8 @@ jobs:
     steps:
       - name: Checkout repository for Trivy ignore rules
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
 
       - name: Normalize image name
         run: |

.github/workflows/docker-lint.yml

@@ -15,6 +15,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
 
       - name: Run Hadolint
         uses: hadolint/hadolint-action@06be81baf89a55ffd0e24b8f04a4185738dd3387 # v3.5.0

.github/workflows/docs-deploy.yml

@@ -32,6 +32,8 @@ jobs:
       # Step 1: Get the code
       - name: 📥 Checkout code
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
 
       # Step 2: Set up Node.js
       - name: 🔧 Set up Node.js

.github/workflows/docs-to-issues.yml

@@ -26,13 +26,15 @@ env:
   NODE_VERSION: '24.21.0'
 
 permissions:
-  contents: write
-  issues: write
-  pull-requests: write
+  contents: read
 
 jobs:
   convert-docs:
     name: Convert Markdown to Issues
+    permissions:
+      contents: write        # push moved issue files back to the branch
+      issues: write
+      pull-requests: write
     runs-on: ubuntu-latest
     if: >-
       github.actor != 'github-actions[bot]' &&
@@ -47,6 +49,7 @@ jobs:
         with:
           fetch-depth: 2
           ref: ${{ github.event.workflow_run.head_sha || github.sha }}
+          persist-credentials: false
 
       - name: Set up Node.js
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
@@ -346,14 +349,18 @@ jobs:
         if: steps.process.outputs.created_count != '0' && github.event.inputs.dry_run != 'true'
         env:
           BRANCH_NAME: ${{ github.event.workflow_run.head_branch || github.ref_name }}
+          PUSH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           git config --local user.email "github-actions[bot]@users.noreply.github.com"
           git config --local user.name "github-actions[bot]"
           git add docs/issues/
           # Removed [skip ci] to allow CI checks to run on PRs
           # Infinite loop protection: path filter excludes docs/issues/created/** AND github.actor guard prevents bot loops
           git diff --staged --quiet || git commit -m "chore: move processed issue files to created/"
-          git push origin "HEAD:refs/heads/${BRANCH_NAME}"
+          # Authenticate this push with an explicit token (checkout does not persist one).
+          AUTH_HEADER="AUTHORIZATION: basic $(printf 'x-access-token:%s' "$PUSH_TOKEN" | base64 -w0)"
+          echo "::add-mask::${AUTH_HEADER#AUTHORIZATION: basic }"
+          git -c http.https://github.com/.extraheader="$AUTH_HEADER" push origin "HEAD:refs/heads/${BRANCH_NAME}"
 
       - name: Summary
         if: always()

.github/workflows/dry-run-history-rewrite.yml

@@ -1,15 +1,12 @@
 name: History Rewrite Dry-Run
 
 on:
-  workflow_run:
-    workflows: ["Docker Build, Publish & Test"]
-    types: [completed]
   schedule:
     - cron: '0 2 * * *' # daily at 02:00 UTC
   workflow_dispatch:
 
 concurrency:
-  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.event.workflow_run.head_branch || github.head_ref || github.ref_name }}
+  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.head_ref || github.ref_name }}
   cancel-in-progress: true
 
 permissions:
@@ -19,16 +16,12 @@ jobs:
   preview-history:
     name: Dry-run preview for history rewrite
     runs-on: ubuntu-latest
-    if: >-
-      ${{ github.event_name != 'workflow_run' ||
-      (github.event.workflow_run.conclusion == 'success' &&
-      github.event.workflow_run.head_repository.full_name == github.repository) }}
     steps:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           fetch-depth: 0
-          ref: ${{ github.event.workflow_run.head_sha || github.sha }}
+          persist-credentials: false
 
       - name: Debug git info
         run: |