4 Commits

Author	SHA1	Message	Date
devitway	b50dd6386e	security: pin Docker base images by SHA, cosign signing in release, branch protection ... - Pin alpine:3.20 by SHA digest in all Dockerfiles (Pinned-Dependencies) - Add cosign keyless signing for Docker images and binary (Signed-Releases) - Enable branch protection: strict status checks, linear history, no force push - Add .sig and .pem to GitHub Release assets	2026-03-18 09:49:45 +00:00
devitway	6ad710ff32	ci: add security scanning and SBOM to release pipeline ... - ci.yml: add security job (gitleaks, cargo-audit, cargo-deny, trivy fs) - release.yml: restructure into build-binary + build-docker matrix + release - build binary once on self-hosted, reuse across all Docker builds - trivy image scan per matrix variant, results to GitHub Security tab - SBOM generation in SPDX and CycloneDX formats attached to release - deny.toml: cargo-deny policy (allowed licenses, banned openssl, crates.io only) - Dockerfile: remove Rust build stage, use pre-built binary - Dockerfile.astra, Dockerfile.redos: FROM scratch for Russian certified OS support	2026-02-23 11:37:27 +00:00
DevITWay	a19477c424	ci: add GitHub Actions workflow for Docker releases ... - Run tests on PR and push - Build multi-arch images (amd64, arm64) - Push to ghcr.io on main branch and tags - Auto-create GitHub Release on version tags - Use BuildKit cache for faster builds	2026-01-26 00:34:00 +00:00
DevITWay	586420a476	feat: initialize NORA artifact registry ... Cloud-native multi-protocol artifact registry in Rust. - Docker Registry v2 - Maven (+ proxy) - npm (+ proxy) - Cargo, PyPI - Web UI, Swagger, Prometheus - Local & S3 storage - 32MB Docker image Created by DevITWay https://getnora.io	2026-01-25 17:33:15 +00:00