3 Commits

Author	SHA1	Message	Date
devitway	6ad710ff32	ci: add security scanning and SBOM to release pipeline ... - ci.yml: add security job (gitleaks, cargo-audit, cargo-deny, trivy fs) - release.yml: restructure into build-binary + build-docker matrix + release - build binary once on self-hosted, reuse across all Docker builds - trivy image scan per matrix variant, results to GitHub Security tab - SBOM generation in SPDX and CycloneDX formats attached to release - deny.toml: cargo-deny policy (allowed licenses, banned openssl, crates.io only) - Dockerfile: remove Rust build stage, use pre-built binary - Dockerfile.astra, Dockerfile.redos: FROM scratch for Russian certified OS support	2026-02-23 11:37:27 +00:00
devitway	037204a3eb	fix: use FROM scratch for Astra and RedOS builds ... Russian OS registries (registry.astralinux.ru, registry.red-soft.ru) require auth not available in CI. Use scratch base with static musl binary instead — runs on any Linux including Astra SE and RED OS. Comment in each Dockerfile shows how to switch to official base image once registry access is configured.	2026-02-23 08:43:13 +00:00
devitway	1e01d4df56	ci: add Astra Linux and RedOS parallel builds ... Add Dockerfile.astra (astralinux/alse) and Dockerfile.redos (redos/redos) for FSTEC-certified Russian OS targets. Update release.yml with a matrix strategy that produces three image variants per release: - ghcr.io/.../nora:0.x.x (Alpine, default) - ghcr.io/.../nora:0.x.x-astra (Astra Linux SE) - ghcr.io/.../nora:0.x.x-redos (RED OS) Build stage is shared (musl static binary) across all variants.	2026-02-23 08:24:48 +00:00