Merge branch 'develop' into 'main'

Promote develop → main

Closes #10

See merge request pub-projects/hort!93

Author: tom

.gitlab-ci.yml

@@ -130,6 +130,17 @@ variables:
   - apt-get install -y -qq --no-install-recommends
       protobuf-compiler pkg-config libssl-dev ca-certificates curl git
 
+# Fetch the PREBUILT cargo-binstall (a single static binary) into
+# $CARGO_HOME/bin, so tool installs (`cargo binstall <tool>`) download a
+# prebuilt release instead of compiling the tool from source every pipeline.
+# Best-effort (`|| true`): if the fetch is unreachable, the per-tool install
+# lines fall back to `cargo install` (source), so binstall is a pure
+# accelerator and never a hard dependency of a gate. Requires curl on PATH.
+.install-binstall: &install-binstall
+  - curl -L --proto '=https' --tlsv1.2 -sSf
+      https://raw.githubusercontent.com/cargo-bins/cargo-binstall/main/install-from-binstall-release.sh
+      | bash || true
+
 # Conditional internal-PKI CA trust. Two trust-store flavours: RHEL-family
 # (the buildah image) and Debian/Alpine (rust:slim, alpine/helm). Both are
 # no-ops when PLATFORM_CA_PATH is unset or the file is absent, so a public-CA
@@ -335,7 +346,9 @@ test:coverage:
     - *platform-ca-deb
     - *hort-auth-steps
     - rustup component add llvm-tools-preview
-    - cargo install --locked cargo-llvm-cov || true
+    - *install-binstall
+    - cargo binstall --no-confirm --locked cargo-llvm-cov
+      || cargo install --locked cargo-llvm-cov || true
   script:
     - cargo llvm-cov --workspace --lib
         --lcov --output-path lcov.info
@@ -405,13 +418,16 @@ test:integration:
 security:cargo-audit:
   stage: security
   image: ${RUST_IMAGE}
-  needs:
-    - job: test:unit
-      artifacts: false
+  # No workspace compile — `cargo audit` reads Cargo.lock and the tool is a
+  # prebuilt binstall download — so this runs from pipeline start rather than
+  # queuing behind the serialized test-compile chain.
+  needs: []
   before_script:
     - apt-get update -qq
-    - apt-get install -y -qq --no-install-recommends ca-certificates git pkg-config libssl-dev
-    - cargo install --locked cargo-audit || true
+    - apt-get install -y -qq --no-install-recommends ca-certificates git pkg-config libssl-dev curl
+    - *install-binstall
+    - cargo binstall --no-confirm --locked cargo-audit
+      || cargo install --locked cargo-audit || true
   script:
     # Diagnostic JSON artefact captured first; failure-tolerant (||
     # true) so a non-zero exit still produces the upload below.
@@ -489,13 +505,16 @@ quality:no-plans-on-default-branch:
 security:cargo-deny:
   stage: security
   image: ${RUST_IMAGE}
-  needs:
-    - job: test:unit
-      artifacts: false
+  # No workspace compile — `cargo deny check` reads `cargo metadata` and the
+  # tool is a prebuilt binstall download — so this runs from pipeline start
+  # rather than queuing behind the serialized test-compile chain.
+  needs: []
   before_script:
     - apt-get update -qq
-    - apt-get install -y -qq --no-install-recommends ca-certificates git pkg-config libssl-dev
-    - cargo install --locked cargo-deny || true
+    - apt-get install -y -qq --no-install-recommends ca-certificates git pkg-config libssl-dev curl
+    - *install-binstall
+    - cargo binstall --no-confirm --locked cargo-deny
+      || cargo install --locked cargo-deny || true
   script:
     - cargo deny --workspace check
 
@@ -986,7 +1005,9 @@ release:sbom:
     # already pulls curl + ca-certificates; add jq explicitly so the
     # Vault-token + key fetch in cosign-setup.sh succeeds.
     - apt-get install -y -qq --no-install-recommends jq
-    - cargo install --locked cargo-cyclonedx || true
+    - *install-binstall
+    - cargo binstall --no-confirm --locked cargo-cyclonedx
+      || cargo install --locked cargo-cyclonedx || true
     # Trust the platform CA (internal PKI) BEFORE cosign-setup.sh runs: in
     # vault-key mode its HTTPS call to ${VAULT_ADDR} (OpenBao) must verify
     # against an internal CA not in the public bundle. No-op when

CHANGELOG.md

@@ -7,6 +7,29 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Added
+
+- **`HORT_RATELIMIT_EXEMPT_CIDRS`** (Helm `rateLimitExemptCidrs`) — source CIDRs
+  whose resolved client IP bypasses both rate-limit buckets. For first-party CI
+  that shares one egress IP (or sits behind one ingress) and would otherwise
+  collapse into a single per-IP bucket and `429` on legitimate publish bursts.
+  Keyed on the trust-resolved client IP (not a spoofable header). Note: this
+  also removes the per-IP anti-credential-stuffing limit on the token-mint
+  paths for that range — list only fully trusted CI egress ranges.
+
+### Fixed
+
+- **The inbound rate limiter now sustains its configured per-minute rate.** The
+  auth (`HORT_RATELIMIT_AUTH_PER_MIN`, default 60) and write
+  (`HORT_RATELIMIT_WRITE_PER_MIN`, default 300) token buckets replenished one
+  token per minute regardless of the cap, so after the initial burst, sustained
+  traffic was throttled to ~1 request/minute — roughly 60×/300× tighter than
+  documented — which persistently `429`'d automated writers such as CI pushing
+  multi-layer images. Tokens now replenish at the configured per-minute rate.
+- **Rate-limit `429` responses no longer advertise `Retry-After: 0`.** A
+  sub-second wait is rounded up to at least 1 second, so a throttled client
+  backs off for a beat instead of hot-looping on an immediate retry.
+
 ## [0.9.8] - 2026-07-05
 
 Headlines: OCI **image-index / manifest-list (multi-arch) push**; **working

Cargo.lock

@@ -154,7 +154,7 @@ struct ApiTokenUsedGate {
 ///
 /// Defaults: **30 misses / 5 min triggers a 15-min
 /// lockout**. Argon2id at OWASP-2024 cost is ~50–80 ms per verify, so
-/// an attacker botnet of N IPs × 60/min through `tower_governor`
+/// an attacker botnet of N IPs × 60/min through the per-IP rate limiter
 /// would otherwise pin N×80 CPU-cores at no auth cost — this
 /// gate caps the verify rate per IP-bucket regardless of where the
 /// global rate-limiter is.

crates/hort-app/src/use_cases/pat_validation_use_case.rs

@@ -36,7 +36,6 @@ hort-adapters-ephemeral-memory = { path = "../hort-adapters-ephemeral-memory", o
 axum                        = { workspace = true }
 tower                       = { workspace = true }
 tower-http                  = { workspace = true }
-tower_governor              = { version = "=0.5.0", default-features = false, features = ["axum"] }
 governor                    = "0.8"
 tokio                       = { workspace = true }
 tokio-util                  = { workspace = true }

crates/hort-http-core/Cargo.toml

@@ -15,8 +15,9 @@
 //!   in-flight per IP (`HORT_MAX_INFLIGHT_PER_IP`). Reads
 //!   [`RequestTrust::client_ip`] from request extensions (populated by
 //!   the request trust layer); a missing trust extension surfaces as a 500
-//!   rather than silently bypassing the cap (mirrors
-//!   [`crate::middleware::rate_limit::TrustAwareKeyExtractor`]).
+//!   rather than silently bypassing the cap (same "missing trust → 500,
+//!   never bucket-bypass" invariant the rate-limit middleware enforces —
+//!   see [`crate::middleware::rate_limit`]).
 //!
 //! # Threat model
 //!
@@ -319,7 +320,8 @@ pub async fn global_load_shed_middleware(
 ///
 /// Reads `client_ip` from [`RequestTrust`] (populated by the request
 /// trust layer). On a missing extension surfaces 500 — same conservative
-/// failure mode as [`crate::middleware::rate_limit::TrustAwareKeyExtractor`].
+/// failure mode the rate-limit middleware uses (see
+/// [`crate::middleware::rate_limit`]).
 /// Get-or-inserts an `Arc<Semaphore>` for that IP and try-acquires one
 /// permit; failure sheds with 503 and the
 /// `result=per_ip_shed` metric label.