release: security hardening + binary swap pipeline (agent@1.1.0, dashboard@1.1.0)

.github/CODEOWNERS

@@ -0,0 +1 @@
+* @Jaro-c

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,5 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Security vulnerability
+    url: https://github.com/Jaro-c/Lynx/security/advisories/new
+    about: Report a security vulnerability privately (do not open a public issue)

.github/dependabot.yml

@@ -12,13 +12,13 @@ updates:
     target-branch: "develop"
 
   - package-ecosystem: "cargo"
-    directory: "/lynx/translators/compose"
+    directory: "/lynx"
     schedule:
-      interval: "weekly"
+      interval: "daily"
     labels:
       - "dependencies"
-      - "translator/compose"
-    open-pull-requests-limit: 5
+      - "rust"
+    open-pull-requests-limit: 10
     target-branch: "develop"
 
   - package-ecosystem: "bun"

.github/scripts/audit-urls.py

@@ -0,0 +1,77 @@
+#!/usr/bin/env python3
+"""Audit download modules for HTTP URLs outside the allowed GitHub domains.
+
+Only scans files that perform binary downloads (update modules and scheduler).
+Other files (agent command endpoints, nginx configs) are intentionally excluded.
+
+Exits 1 if any non-allowed URL literal is found in non-comment lines.
+
+To suppress a specific line that is intentionally non-GitHub (e.g. a self health check),
+add an inline comment:
+    .get("http://127.0.0.1:8080/health") // audit-urls: ok — reason
+
+Run from the repository root.
+"""
+import re
+import sys
+import pathlib
+
+# Only GitHub release domains are allowed for binary downloads.
+ALLOWED = re.compile(
+    r"https?://"
+    r"(github\.com|objects\.githubusercontent\.com|api\.github\.com)"
+)
+
+URL_RE = re.compile(r'https?://[^\s\'">,)]+')
+
+# Format strings / templates — skip lines containing these (not real URLs)
+FORMAT_MARKERS = re.compile(r"\{[^}]*\}|\$\w+|%[sdfi]")
+
+COMMENT_RE = re.compile(r"^\s*//")
+SUPPRESS_RE = re.compile(r"//\s*audit-urls:\s*ok")
+
+# Only files that perform outbound binary downloads.
+# Adding a new download path outside these files requires a conscious update here.
+SCAN_FILES = [
+    "lynx/agent/src/update/mod.rs",
+    "lynx/agent/src/update/fallback.rs",
+    "lynx/dashboard/server/src/update.rs",
+    "lynx/dashboard/server/src/scheduler.rs",
+]
+
+failures: list[str] = []
+
+for path_str in SCAN_FILES:
+    f = pathlib.Path(path_str)
+    if not f.exists():
+        print(f"⚠️  Scan target not found: {f} (skipped)")
+        continue
+    for i, line in enumerate(f.read_text(encoding="utf-8").splitlines(), 1):
+        if COMMENT_RE.match(line):
+            continue
+        if SUPPRESS_RE.search(line):
+            continue
+        if FORMAT_MARKERS.search(line):
+            continue
+        for url in URL_RE.findall(line):
+            if not ALLOWED.match(url):
+                failures.append(f"  {f}:{i}  {url}")
+
+if failures:
+    print("❌ Non-allowed URL found in download modules:")
+    for entry in failures:
+        print(entry)
+    print()
+    print("Allowed domains: github.com, objects.githubusercontent.com, api.github.com")
+    print()
+    print("If this URL is intentional (e.g. a self health check, not a download):")
+    print("  Add an inline suppression comment on that line:")
+    print('    .get("http://...") // audit-urls: ok — reason')
+    print()
+    print("If this is a new external download domain:")
+    print("  Add it to ALLOWED in .github/scripts/audit-urls.py with justification.")
+    sys.exit(1)
+
+scanned = ", ".join(SCAN_FILES)
+print(f"✅ All HTTP URLs in download modules are from allowed domains.")
+print(f"   Scanned: {len(SCAN_FILES)} files")

.github/scripts/sign.py

@@ -0,0 +1,40 @@
+#!/usr/bin/env python3
+"""Sign a file with an Ed25519 private key (raw 32-byte seed, base64-encoded).
+
+Usage:
+  sign.py <base64-private-key> <input-file> [<output-sig-file>]
+
+If output-sig-file is omitted, writes to <input-file>.sig.
+The key must be the raw 32-byte Ed25519 seed in standard base64.
+"""
+import base64
+import sys
+
+from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
+
+
+def main() -> None:
+    if len(sys.argv) < 3:
+        print(__doc__, file=sys.stderr)
+        sys.exit(1)
+
+    key_b64 = sys.argv[1]
+    input_file = sys.argv[2]
+    sig_file = sys.argv[3] if len(sys.argv) > 3 else input_file + ".sig"
+
+    key_bytes = base64.b64decode(key_b64 + "==")
+    private_key = Ed25519PrivateKey.from_private_bytes(key_bytes)
+
+    with open(input_file, "rb") as f:
+        data = f.read()
+
+    sig = private_key.sign(data)
+
+    with open(sig_file, "wb") as f:
+        f.write(sig)
+
+    print(f"signed {input_file} ({len(data):,} bytes) → {sig_file} ({len(sig)} bytes)")
+
+
+if __name__ == "__main__":
+    main()

.github/workflows/agent.yml

@@ -35,7 +35,7 @@ jobs:
       run:
         working-directory: lynx
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9 # stable
         with:
@@ -45,14 +45,23 @@ jobs:
       - name: fmt
         run: cargo fmt --package lynx-agent -- --check
 
+  audit-urls:
+    name: Audit download URLs
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Check download URLs are from allowed domains
+        run: python3 .github/scripts/audit-urls.py
+
   audit:
     name: Security audit
     runs-on: ubuntu-latest
     defaults:
       run:
         working-directory: lynx
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9 # stable
         with:
@@ -85,7 +94,7 @@ jobs:
           --health-timeout 5s
           --health-retries 10
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9 # stable
         with:
@@ -129,7 +138,7 @@ jobs:
           --health-timeout 5s
           --health-retries 10
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9 # stable
         with:

.github/workflows/compose.yml

@@ -23,14 +23,33 @@ env:
   RUST_BACKTRACE: 1
 
 jobs:
+  audit:
+    name: Security audit
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: lynx
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9 # stable
+        with:
+          toolchain: stable
+
+      - name: Install cargo-audit
+        run: cargo install cargo-audit --locked
+
+      - name: audit
+        run: cargo audit --ignore RUSTSEC-2023-0071
+
   check:
     name: Check & Lint
     runs-on: ubuntu-latest
     defaults:
       run:
         working-directory: lynx
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9 # stable
         with:
@@ -54,7 +73,7 @@ jobs:
       run:
         working-directory: lynx
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9 # stable
         with:

.github/workflows/dashboard-server.yml

@@ -33,7 +33,7 @@ jobs:
       run:
         working-directory: lynx
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9 # stable
         with:
@@ -43,14 +43,23 @@ jobs:
       - name: fmt
         run: cargo fmt --package lynx-dashboard-server -- --check
 
+  audit-urls:
+    name: Audit download URLs
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Check download URLs are from allowed domains
+        run: python3 .github/scripts/audit-urls.py
+
   audit:
     name: Security audit
     runs-on: ubuntu-latest
     defaults:
       run:
         working-directory: lynx
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9 # stable
         with:
@@ -83,7 +92,7 @@ jobs:
           --health-timeout 5s
           --health-retries 10
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9 # stable
         with:
@@ -136,7 +145,7 @@ jobs:
           --health-timeout 5s
           --health-retries 10
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9 # stable
         with:
@@ -155,7 +164,7 @@ jobs:
           DATABASE_URL: postgres://lynx_ci:lynx_ci@localhost:5432/lynx_ci
 
       - name: test
-        run: cargo test --package lynx-dashboard-server
+        run: cargo test --package lynx-dashboard-server -- --test-threads=1
         env:
           DATABASE_URL: postgres://lynx_ci:lynx_ci@localhost:5432/lynx_ci
           REDIS_URL: redis://localhost:6379

.github/workflows/dashboard-ui.yml

@@ -17,14 +17,33 @@ permissions:
   security-events: write
 
 jobs:
+  audit:
+    name: Security audit (bun)
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: lynx/dashboard/ui
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+        with:
+          bun-version: latest
+
+      - name: Install dependencies
+        run: bun install --frozen-lockfile
+
+      - name: audit
+        run: bun audit --audit-level high
+
   typecheck:
     name: TypeScript
     runs-on: ubuntu-latest
     defaults:
       run:
         working-directory: lynx/dashboard/ui
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
@@ -43,7 +62,7 @@ jobs:
       run:
         working-directory: lynx/dashboard/ui
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
@@ -62,7 +81,7 @@ jobs:
       run:
         working-directory: lynx/dashboard/ui
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
@@ -86,7 +105,7 @@ jobs:
           BACKEND_URL: http://localhost:8080
 
       - name: Upload Playwright report
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         if: failure()
         with:
           name: playwright-report

.github/workflows/lint-shell.yml

@@ -9,8 +9,6 @@ on:
   pull_request:
     branches:
       - main
-    paths:
-      - "**.sh"
 
 permissions:
   contents: read
@@ -21,7 +19,7 @@ jobs:
     name: shellcheck
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Run shellcheck
         run: bash scripts/lint.sh