chore: state-of-the-art self-hosted hardening (P0+P1+P2) - #69

Closed

atulmgupta wants to merge 26 commits into

mainfrom

chore/state-of-the-art-hardening

Commits on May 18, 2026

ci(security): make security workflow blocking + align Go 1.25 + add gitleaks/npm-audit/trivy-config

atulmgupta
and
Copilot
committed
835935c
feat(helm): add NetworkPolicy + seccomp RuntimeDefault (P0 #3, part 1)

atulmgupta
and
Copilot
committed
ef0256d
fix(helm): tune chart defaults for self-hosted k3s; drop user-specific infra

atulmgupta
and
Copilot
committed
58b293b
feat(helm): apply pod + container security context to 7 third-party deployments (P0 #3 part 2)

atulmgupta
and
Copilot
committed
100cb58
docs: add CONTRIBUTING.md + CODE_OF_CONDUCT.md (P0 #6)

atulmgupta
and
Copilot
committed
99a378b
refactor: eliminate panic in router wiring; propagate errors from NewRouter (P0 #8)

atulmgupta
and
Copilot
committed
3e2b155
feat(backup): add cmd/backup + Helm CronJob + nightly restore drill (P0 #5)

atulgupta
and
Copilot
committed
525b93f
chore(deps): group Dependabot PRs + triage 19-PR backlog (P0 #7)

atulgupta
and
Copilot
committed
f52a573

Commits on May 19, 2026

feat(security+ci+helm): CORS fail-closed, trace_id in logs, SBOM+SLSA, values.schema.json (P1 #1, #6, #8, partial #2)

atulgupta
and
Copilot
committed
0ab656c
feat(observability+frontend): SLO catalog, MQTT trace propagation, type safety, raw HTML cleanup (P1 #5, #7, #10, #11, #12)

state-of-the-art-bot
and
Copilot
committed
b175c93
test(backend): tests + fuzz + benchmarks for codec/signal/units/integrations (P1 #3, #4) + fix utf8 panic

state-of-the-art-bot
and
Copilot
committed
15ffc77
test(web+ci): bootstrap Playwright E2E smoke suite (P1 #9)

state-of-the-art-bot
and
Copilot
committed
3ace4a4
chore(dx): one-command onboarding via devcontainer, EditorConfig, shared VS Code, Air hot-reload (P2 #5, #6)

state-of-the-art-bot
and
Copilot
committed
5eba9ce
refactor(web): i18n ErrorBoundary fallback, swap clsx→cn, delete obsolete skip test (P2 #7, #8, partial #cleanup)

state-of-the-art-bot
and
Copilot
committed
c13254b
feat(infra+ci): PrometheusRule CRs, digest-pinned base images, PR title lint, error budget policy (P2 SOTA-1/2/3/5)

state-of-the-art-bot
and
Copilot
committed
c0fd904
feat(loadtest+chaos+validation): k6 baseline, chaos faults, Zod runtime validation (P2 SOTA-6/7/8)

state-of-the-art-bot
and
Copilot
committed
0b755df
refactor(api): extract helpers from router.go monolith (P2 #1, partial)

state-of-the-art-bot
and
Copilot
committed
52bed02
feat(infra): ExternalSecrets template (P2 SOTA #9)

state-of-the-art-bot
and
Copilot
committed
3ce702e
refactor(web): split 3,263-line types.ts monolith + fix all baseline tsc errors (P2 #3)

state-of-the-art-bot
and
Copilot
committed
0868d29
fix(web): remove @ts-nocheck from InsightsEngine + use SI canonical fields (P2 #2)

atulmgupta
and
Copilot
committed
62fec44
chore(web): delete dead deprecated barrel web/src/api/index.ts

atulmgupta
and
Copilot
committed
5914c41
test(web): add smoke tests for RoadmapPage and SearchPage (P1 frontend coverage)

atulmgupta
and
Copilot
committed
9e598ed
fix(web): satisfy VehicleSchema in CommandPalette test fixtures (3 failing tests -> green)

atulmgupta
and
Copilot
committed
8a2979f
test(web): close zero-test page gap with 8 page smoke suites

atulmgupta
and
Copilot
committed
6507bbf
fix(arch): satisfy ADR-009 frozen-package + doc.go layer rules

atulmgupta
and
Copilot
committed
7326929
chore(security,test): CVE remediation + a11y + coverage ratchet

atulmgupta
and
Copilot
committed
9d078ae

Navigation Menu

chore: state-of-the-art self-hosted hardening (P0+P1+P2) - #69

chore: state-of-the-art self-hosted hardening (P0+P1+P2)#69
atulmgupta wants to merge 26 commits into
mainfrom
chore/state-of-the-art-hardening

Commits on May 18, 2026

ci(security): make security workflow blocking + align Go 1.25 + add gitleaks/npm-audit/trivy-config

feat(helm): add NetworkPolicy + seccomp RuntimeDefault (P0 #3, part 1)

fix(helm): tune chart defaults for self-hosted k3s; drop user-specific infra

feat(helm): apply pod + container security context to 7 third-party deployments (P0 #3 part 2)

docs: add CONTRIBUTING.md + CODE_OF_CONDUCT.md (P0 #6)

refactor: eliminate panic in router wiring; propagate errors from NewRouter (P0 #8)

feat(backup): add cmd/backup + Helm CronJob + nightly restore drill (P0 #5)

chore(deps): group Dependabot PRs + triage 19-PR backlog (P0 #7)

Commits on May 19, 2026

feat(security+ci+helm): CORS fail-closed, trace_id in logs, SBOM+SLSA, values.schema.json (P1 #1, #6, #8, partial #2)

feat(observability+frontend): SLO catalog, MQTT trace propagation, type safety, raw HTML cleanup (P1 #5, #7, #10, #11, #12)

test(backend): tests + fuzz + benchmarks for codec/signal/units/integrations (P1 #3, #4) + fix utf8 panic

test(web+ci): bootstrap Playwright E2E smoke suite (P1 #9)

chore(dx): one-command onboarding via devcontainer, EditorConfig, shared VS Code, Air hot-reload (P2 #5, #6)

refactor(web): i18n ErrorBoundary fallback, swap clsx→cn, delete obsolete skip test (P2 #7, #8, partial #cleanup)

feat(infra+ci): PrometheusRule CRs, digest-pinned base images, PR title lint, error budget policy (P2 SOTA-1/2/3/5)

feat(loadtest+chaos+validation): k6 baseline, chaos faults, Zod runtime validation (P2 SOTA-6/7/8)

refactor(api): extract helpers from router.go monolith (P2 #1, partial)

feat(infra): ExternalSecrets template (P2 SOTA #9)

refactor(web): split 3,263-line types.ts monolith + fix all baseline tsc errors (P2 #3)

fix(web): remove @ts-nocheck from InsightsEngine + use SI canonical fields (P2 #2)

chore(web): delete dead deprecated barrel web/src/api/index.ts

test(web): add smoke tests for RoadmapPage and SearchPage (P1 frontend coverage)

fix(web): satisfy VehicleSchema in CommandPalette test fixtures (3 failing tests -> green)

test(web): close zero-test page gap with 8 page smoke suites

fix(arch): satisfy ADR-009 frozen-package + doc.go layer rules

chore(security,test): CVE remediation + a11y + coverage ratchet