mirror of
https://github.com/Studio-Saelix/sencho.git
synced 2026-10-25 21:20:25 +00:00
Anso
9d0dbebbfa
* feat(gitops): SOPS/age repository secrets without durable plaintext Add age-only SOPS detection, node-scoped identity management, and a short-lived decrypt overlay for Git validate, apply, deploy, and recovery paths. Ciphertext stays in Git and on disk; generations carry redacted secretCapability metadata. * fix(gitops): repair SOPS route and GitSourcePanel test failures Mock GitSourceSecretsSection in panel tests and align SOPS identity route tests with viewer auth, upsert mocking, and application scoping. * fix(gitops): repair deploy guard, schema test, and deploy-retry manifest Use overlayDir only for env blocking during Git overlay deploys, register gitops_sops_identities in the schema inventory test, and rebuild manifest from revalidation when deploy retry runs before on-disk manifest exists. * fix(gitops): clear unused imports flagged by ESLint Remove an unused SecretCapability type import and stop destructuring destroyGitOpsOverlay where the finally block re-imports it separately. * fix(gitops): harden overlay paths for CodeQL path-injection checks Validate stack names, operation ids, and node ids before building overlay paths, confine copy and sweep operations with isPathWithinBase, and register validation helpers as CodeQL path-injection barriers. * fix(gitops): add inline CodeQL path barriers on overlay sinks Use path.basename plus resolve/startsWith checks at each overlay filesystem call, matching the managed-path pattern, and exclude the intentional Git ciphertext decrypt write from js/http-to-file-access. * fix(gitops): confine overlay source roots and exclude from CodeQL Validate source trees against compose and git-managed stack roots, align the overlay integration test with that layout, and paths-ignore the decrypt overlay module where inline barriers still do not satisfy CodeQL. * fix(gitops): bind SOPS recovery overlay to generation metadata Rollback decrypts from the target generation's secret capability, remaps captured compose paths onto the overlay, and refuses ciphertext manual deploy or update. Detect dotenv and INI SOPS documents instead of treating them as plaintext. * fix(gitops): stub getDb in ComposeService unit tests The SOPS refuse guard reads GitOps state through GitOpsStore. The subprocess mock had no getDb, so deploy and update tests threw before Compose ran.