feat: harden deployment and CI pipeline

Co-authored-by: Codex <noreply@openai.com>
2026-11-06 08:06:19 +00:00 · 2026-07-11 17:18:17 +08:00
parent 49120d0efb
commit 4dcd9dc31d
19 changed files with 884 additions and 246 deletions
@@ -0,0 +1,237 @@
+name: Reusable Container
+
+on:
+  workflow_call:
+    inputs:
+      ref:
+        description: Exact commit SHA to build and validate
+        required: true
+        type: string
+
+permissions:
+  contents: read
+  security-events: write
+
+jobs:
+  container:
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    env:
+      COMPOSE_PROJECT_NAME: cpr-ci-${{ github.run_id }}-${{ github.run_attempt }}
+      CPR_IMAGE: codex-proxy-rs:ci-${{ inputs.ref }}
+      CPR_ADMIN_DEFAULT_PASSWORD: 'admin @:/?#%2F ci password'
+      CPR_POSTGRES_PASSWORD: 'pg @:/?#%2F ci'
+      CPR_REDIS_PASSWORD: 'redis @:/?#%2F ci'
+      CPR_SMOKE_PORT: '18080'
+      TRIVY_QUIET: 'true'
+      TRIVY_SKIP_VERSION_CHECK: 'true'
+    steps:
+      - name: Define isolated runtime paths
+        shell: bash
+        run: |
+          {
+            echo "CPR_CONFIG_FILE=$GITHUB_WORKSPACE/.runtime/ci-$GITHUB_RUN_ID-$GITHUB_RUN_ATTEMPT/config.yaml"
+            echo "CPR_DATA_DIR=$GITHUB_WORKSPACE/.runtime/ci-$GITHUB_RUN_ID-$GITHUB_RUN_ATTEMPT/data"
+            echo "CPR_LOG_DIR=$GITHUB_WORKSPACE/.runtime/ci-$GITHUB_RUN_ID-$GITHUB_RUN_ATTEMPT/logs"
+            echo "DIAGNOSTICS_DIR=$RUNNER_TEMP/codex-proxy-rs-diagnostics"
+          } >> "$GITHUB_ENV"
+
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          ref: ${{ inputs.ref }}
+
+      - name: Setup Docker Buildx
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4
+
+      - name: Build runtime image
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
+        with:
+          context: .
+          file: deploy/Dockerfile
+          target: runtime
+          load: true
+          tags: ${{ env.CPR_IMAGE }}
+          cache-from: type=gha,scope=runtime-ci
+          cache-to: type=gha,mode=max,scope=runtime-ci
+
+      - name: Generate Trivy SARIF
+        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
+        with:
+          image-ref: ${{ env.CPR_IMAGE }}
+          version: v0.72.0
+          format: sarif
+          output: trivy-results.sarif
+          severity: HIGH,CRITICAL
+          vuln-type: os,library
+          scanners: vuln
+          ignore-unfixed: true
+          exit-code: '0'
+
+      - name: Upload Trivy SARIF
+        if: >-
+          ${{ hashFiles('trivy-results.sarif') != '' &&
+              (github.event_name != 'pull_request' ||
+               github.event.pull_request.head.repo.full_name == github.repository) }}
+        uses: github/codeql-action/upload-sarif@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4
+        with:
+          sarif_file: trivy-results.sarif
+          category: runtime-container
+
+      - name: Enforce Trivy vulnerability gate
+        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
+        with:
+          image-ref: ${{ env.CPR_IMAGE }}
+          version: v0.72.0
+          format: table
+          severity: HIGH,CRITICAL
+          vuln-type: os,library
+          scanners: vuln
+          ignore-unfixed: true
+          exit-code: '1'
+
+      - name: Prepare isolated runtime
+        shell: bash
+        run: |
+          set -euo pipefail
+          runtime_dir="$(dirname "$CPR_CONFIG_FILE")"
+          mkdir -p "$runtime_dir" "$DIAGNOSTICS_DIR"
+          sudo install -d -m 0770 -o "$(id -u)" -g 10001 "$CPR_DATA_DIR" "$CPR_LOG_DIR"
+          cp deploy/config.example.yaml "$CPR_CONFIG_FILE"
+          sudo chown "$(id -u):10001" "$CPR_CONFIG_FILE"
+          chmod 0640 "$CPR_CONFIG_FILE"
+
+      - name: Validate Docker Compose
+        shell: bash
+        run: |
+          set -euo pipefail
+          docker compose --project-name "$COMPOSE_PROJECT_NAME" \
+            -f deploy/docker-compose.yml -f deploy/docker-compose.smoke.yml config --quiet
+
+      - name: Verify PostgreSQL and Redis volume persistence
+        shell: bash
+        run: |
+          set -euo pipefail
+          compose=(docker compose --project-name "$COMPOSE_PROJECT_NAME" \
+            -f deploy/docker-compose.yml -f deploy/docker-compose.smoke.yml)
+          "${compose[@]}" up -d --no-build --wait postgres redis
+          "${compose[@]}" exec -T -e PGPASSWORD="$CPR_POSTGRES_PASSWORD" postgres \
+            psql -v ON_ERROR_STOP=1 -U codex_proxy -d codex_proxy -c \
+            "CREATE TABLE cpr_ci_persistence_probe (value text PRIMARY KEY); INSERT INTO cpr_ci_persistence_probe VALUES ('persisted');"
+          "${compose[@]}" exec -T -e REDISCLI_AUTH="$CPR_REDIS_PASSWORD" redis \
+            redis-cli SET cpr:ci:persistence-probe persisted
+          "${compose[@]}" up -d --no-build --wait --force-recreate postgres redis
+          test "$("${compose[@]}" exec -T -e PGPASSWORD="$CPR_POSTGRES_PASSWORD" postgres \
+            psql -At -U codex_proxy -d codex_proxy -c \
+            "SELECT value FROM cpr_ci_persistence_probe;")" = persisted
+          test "$("${compose[@]}" exec -T -e REDISCLI_AUTH="$CPR_REDIS_PASSWORD" redis \
+            redis-cli --raw GET cpr:ci:persistence-probe | tr -d '\r')" = persisted
+          "${compose[@]}" exec -T -e PGPASSWORD="$CPR_POSTGRES_PASSWORD" postgres \
+            psql -v ON_ERROR_STOP=1 -U codex_proxy -d codex_proxy -c \
+            "DROP TABLE cpr_ci_persistence_probe;"
+          "${compose[@]}" exec -T -e REDISCLI_AUTH="$CPR_REDIS_PASSWORD" redis \
+            redis-cli DEL cpr:ci:persistence-probe
+
+      - name: Start and verify application
+        shell: bash
+        run: |
+          set -euo pipefail
+          compose=(docker compose --project-name "$COMPOSE_PROJECT_NAME" \
+            -f deploy/docker-compose.yml -f deploy/docker-compose.smoke.yml)
+          "${compose[@]}" up -d --no-build --wait codex-proxy-rs
+          status="$(curl --silent --show-error --output /dev/null --write-out '%{http_code}' \
+            "http://127.0.0.1:${CPR_SMOKE_PORT}/healthz")"
+          test "$status" = 204
+          test "$("${compose[@]}" exec -T codex-proxy-rs id -u | tr -d '\r')" = 10001
+          test "$("${compose[@]}" exec -T codex-proxy-rs id -g | tr -d '\r')" = 10001
+          "${compose[@]}" exec -T codex-proxy-rs sh -c \
+            'touch /app/data/.ci-write /app/logs/.ci-write && rm /app/data/.ci-write /app/logs/.ci-write'
+
+      - name: Verify clean logs and graceful shutdown
+        shell: bash
+        run: |
+          set -euo pipefail
+          compose=(docker compose --project-name "$COMPOSE_PROJECT_NAME" \
+            -f deploy/docker-compose.yml -f deploy/docker-compose.smoke.yml)
+          "${compose[@]}" stop --timeout 30 codex-proxy-rs
+          container_id="$("${compose[@]}" ps -a -q codex-proxy-rs)"
+          test -n "$container_id"
+          test "$(docker inspect --format '{{.State.ExitCode}}' "$container_id")" = 0
+          "${compose[@]}" logs --no-color --timestamps codex-proxy-rs \
+            > "$DIAGNOSTICS_DIR/application.log"
+          "${compose[@]}" logs --no-color --timestamps postgres \
+            > "$DIAGNOSTICS_DIR/postgres.log"
+          "${compose[@]}" logs --no-color --timestamps redis \
+            > "$DIAGNOSTICS_DIR/redis.log"
+          if grep --extended-regexp --ignore-case \
+            '"level"[[:space:]]*:[[:space:]]*"(warn|error|fatal|panic)"|(^|[^[:alnum:]_])panic([^[:alnum:]_]|$)' \
+            "$DIAGNOSTICS_DIR/application.log" \
+            || grep --extended-regexp --ignore-case \
+              '(^|[[:space:]])(warning|error|fatal|panic):' \
+              "$DIAGNOSTICS_DIR/postgres.log" \
+            || grep --extended-regexp --ignore-case \
+              '[0-9]+:[A-Z][[:space:]].*[[:space:]]#[[:space:]]|(^|[|[:space:]])(warning|error|fatal|panic)(:|[[:space:]])' \
+              "$DIAGNOSTICS_DIR/redis.log"; then
+            echo "container logs contain a warning or error severity" >&2
+            exit 1
+          fi
+
+      - name: Collect container diagnostics
+        if: always()
+        shell: bash
+        run: |
+          set +e
+          mkdir -p "$DIAGNOSTICS_DIR"
+          raw_dir="$(mktemp -d)"
+          compose=(docker compose --project-name "$COMPOSE_PROJECT_NAME" \
+            -f deploy/docker-compose.yml -f deploy/docker-compose.smoke.yml)
+          "${compose[@]}" config > "$raw_dir/compose-config.yaml" 2>&1
+          "${compose[@]}" ps -a > "$raw_dir/compose-ps.txt" 2>&1
+          "${compose[@]}" logs --no-color --timestamps > "$raw_dir/compose.log" 2>&1
+          mapfile -t container_ids < <("${compose[@]}" ps -a -q)
+          if [ "${#container_ids[@]}" -gt 0 ]; then
+            docker inspect "${container_ids[@]}" > "$raw_dir/docker-inspect.json" 2>&1
+          fi
+          RAW_DIR="$raw_dir" OUTPUT_DIR="$DIAGNOSTICS_DIR" ruby <<'RUBY'
+          raw_dir = ENV.fetch("RAW_DIR")
+          output_dir = ENV.fetch("OUTPUT_DIR")
+          secrets = [
+            ENV.fetch("CPR_ADMIN_DEFAULT_PASSWORD"),
+            ENV.fetch("CPR_POSTGRES_PASSWORD"),
+            ENV.fetch("CPR_REDIS_PASSWORD"),
+          ]
+          encoded_secrets = secrets.map do |secret|
+            secret.encode("UTF-8").bytes.map do |byte|
+              character = byte.chr
+              character.match?(/[A-Za-z0-9]/) ? character : format("%%%02X", byte)
+            end.join
+          end
+
+          Dir.children(raw_dir).each do |name|
+            content = File.binread(File.join(raw_dir, name))
+            (secrets + encoded_secrets).each do |secret|
+              content = content.gsub(secret, "<redacted>")
+            end
+            File.binwrite(File.join(output_dir, name), content)
+          end
+          RUBY
+          rm -rf "$raw_dir"
+          cp trivy-results.sarif "$DIAGNOSTICS_DIR/" 2>/dev/null || true
+
+      - name: Upload container diagnostics
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: container-diagnostics-${{ github.run_id }}-${{ github.run_attempt }}
+          path: ${{ runner.temp }}/codex-proxy-rs-diagnostics
+          if-no-files-found: warn
+          retention-days: 7
+
+      - name: Remove isolated runtime
+        if: always()
+        shell: bash
+        run: |
+          docker compose --project-name "$COMPOSE_PROJECT_NAME" \
+            -f deploy/docker-compose.yml -f deploy/docker-compose.smoke.yml \
+            down --volumes --remove-orphans || true
+          sudo rm -rf "$GITHUB_WORKSPACE/.runtime/ci-$GITHUB_RUN_ID-$GITHUB_RUN_ATTEMPT"
@@ -0,0 +1,137 @@
+name: Reusable Quality
+
+on:
+  workflow_call:
+    inputs:
+      ref:
+        description: Exact commit SHA to validate
+        required: true
+        type: string
+      upload_frontend:
+        description: Upload the built frontend for release jobs
+        required: false
+        default: false
+        type: boolean
+
+permissions:
+  contents: read
+
+jobs:
+  backend:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    env:
+      CARGO_TERM_COLOR: always
+      CPR_TEST_DATABASE_URL: postgres://codex_proxy:codex_proxy@127.0.0.1:5432/codex_proxy
+      CPR_TEST_REDIS_URL: redis://127.0.0.1:6379
+      RUSTFLAGS: -D warnings
+    services:
+      postgres:
+        image: postgres:18-alpine@sha256:9a8afca54e7861fd90fab5fdf4c42477a6b1cb7d293595148e674e0a3181de15
+        env:
+          POSTGRES_DB: codex_proxy
+          POSTGRES_USER: codex_proxy
+          POSTGRES_PASSWORD: codex_proxy
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd "pg_isready -U codex_proxy -d codex_proxy"
+          --health-interval 5s
+          --health-timeout 5s
+          --health-retries 10
+      redis:
+        image: redis:8-alpine@sha256:9d317178eceac8454a2284a9e6df2466b93c745529947f0cd42a0fa9609d7005
+        ports:
+          - 6379:6379
+        options: >-
+          --health-cmd "redis-cli ping"
+          --health-interval 5s
+          --health-timeout 5s
+          --health-retries 10
+    steps:
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          ref: ${{ inputs.ref }}
+
+      - name: Setup Rust
+        uses: dtolnay/rust-toolchain@eac0f66a48bc4b70a10b9acd4c4e930f835d95ff # 1.95
+        with:
+          toolchain: '1.95'
+          components: rustfmt,clippy
+
+      - name: Cache Rust
+        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
+        with:
+          workspaces: backend -> target
+
+      - name: Rust format
+        working-directory: backend
+        run: cargo fmt --check
+
+      - name: Rust clippy
+        working-directory: backend
+        run: cargo clippy --all-targets --all-features --locked -- -D warnings
+
+      - name: Rust tests
+        working-directory: backend
+        run: cargo test --test main --locked
+
+  frontend:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    env:
+      CI: 'true'
+    steps:
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          ref: ${{ inputs.ref }}
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6
+        with:
+          version: 11.7.0
+
+      - name: Setup Node
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+        with:
+          node-version: 24
+          cache: pnpm
+          cache-dependency-path: frontend/pnpm-lock.yaml
+
+      - name: Install frontend dependencies
+        run: pnpm --dir frontend install --frozen-lockfile
+
+      - name: Frontend format
+        run: pnpm --dir frontend format:check
+
+      - name: Frontend build
+        run: pnpm --dir frontend build
+
+      - name: Upload frontend artifact
+        if: inputs.upload_frontend
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: frontend-dist
+          path: frontend/dist
+          if-no-files-found: error
+          retention-days: 1
+
+  workflow-lint:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          ref: ${{ inputs.ref }}
+
+      - name: Lint GitHub Actions workflows
+        run: >-
+          docker run --rm
+          --volume "$PWD:/repo"
+          --workdir /repo
+          rhysd/actionlint:1.7.7@sha256:887a259a5a534f3c4f36cb02dca341673c6089431057242cdc931e9f133147e9
+          -color
+          .github/workflows/*.yml
@@ -10,96 +10,47 @@ permissions:
  contents: read

 concurrency:
-  group: ci-${{ github.workflow }}-${{ github.ref }}
+  group: ci-${{ github.event.pull_request.head.repo.full_name || github.repository }}-${{ github.head_ref || github.ref_name }}
  cancel-in-progress: true

 jobs:
-  backend:
+  changes:
    runs-on: ubuntu-latest
-    services:
-      postgres:
-        image: postgres:18-alpine
-        env:
-          POSTGRES_DB: codex_proxy
-          POSTGRES_USER: codex_proxy
-          POSTGRES_PASSWORD: codex_proxy
-        ports:
-          - 5432:5432
-        options: >-
-          --health-cmd "pg_isready -U codex_proxy -d codex_proxy"
-          --health-interval 5s
-          --health-timeout 5s
-          --health-retries 10
-      redis:
-        image: redis:8-alpine
-        ports:
-          - 6379:6379
-        options: >-
-          --health-cmd "redis-cli ping"
-          --health-interval 5s
-          --health-timeout 5s
-          --health-retries 10
+    timeout-minutes: 5
+    outputs:
+      container: ${{ steps.filter.outputs.container }}
    steps:
      - name: Checkout
-        uses: actions/checkout@v7
-
-      - name: Setup Rust
-        uses: dtolnay/rust-toolchain@1.95
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
        with:
-          components: rustfmt,clippy
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+          fetch-depth: 0

-      - name: Cache Rust
-        uses: Swatinem/rust-cache@v2.9.1
+      - name: Detect container changes
+        id: filter
+        uses: dorny/paths-filter@d1c1ffe0248fe513906c8e24db8ea791d46f8590 # v3
        with:
-          workspaces: backend -> target
+          filters: |
+            container:
+              - 'backend/**'
+              - 'frontend/**'
+              - 'deploy/**'
+              - '.dockerignore'
+              - 'release/version.yaml'
+              - '.github/workflows/_container.yml'
+              - '.github/workflows/ci.yml'

-      - name: Rust format
-        working-directory: backend
-        run: cargo fmt --check
+  quality:
+    uses: ./.github/workflows/_quality.yml
+    with:
+      ref: ${{ github.event.pull_request.head.sha || github.sha }}

-      - name: Rust clippy
-        working-directory: backend
-        run: cargo clippy --all-targets --all-features --locked -- -D warnings
-
-      - name: Rust tests
-        working-directory: backend
-        run: cargo test --test main --locked
-
-  frontend:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v7
-
-      - name: Setup pnpm
-        uses: pnpm/action-setup@v6
-        with:
-          version: 11.7.0
-
-      - name: Setup Node
-        uses: actions/setup-node@v6
-        with:
-          node-version: 24
-          cache: pnpm
-          cache-dependency-path: frontend/pnpm-lock.yaml
-
-      - name: Install frontend dependencies
-        run: pnpm --dir frontend install --frozen-lockfile
-
-      - name: Frontend format
-        run: pnpm --dir frontend format:check
-
-      - name: Frontend build
-        run: pnpm --dir frontend build
-
-  deploy:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v7
-
-      - name: Validate Docker Compose
-        run: docker compose -f deploy/docker-compose.yml config
-
-      - name: Build runtime image
-        run: docker build -f deploy/Dockerfile --target runtime -t codex-proxy-rs:ci .
+  container:
+    needs: [changes, quality]
+    if: needs.changes.outputs.container == 'true'
+    permissions:
+      contents: read
+      security-events: write
+    uses: ./.github/workflows/_container.yml
+    with:
+      ref: ${{ github.event.pull_request.head.sha || github.sha }}
@@ -25,6 +25,7 @@ env:
 jobs:
  release-info:
    runs-on: ubuntu-latest
+    timeout-minutes: 10
    outputs:
      tag: ${{ steps.version.outputs.tag }}
      version: ${{ steps.version.outputs.version }}
@@ -35,10 +36,11 @@ jobs:
      non_docker_matrix: ${{ steps.version.outputs.non_docker_matrix }}
      docker_platforms: ${{ steps.version.outputs.docker_platforms }}
      previous_tag: ${{ steps.version.outputs.previous_tag }}
+      prerelease: ${{ steps.version.outputs.prerelease }}

    steps:
      - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
        with:
          ref: ${{ github.event_name == 'workflow_dispatch' && inputs.tag || github.ref }}
          fetch-depth: 0
@@ -151,62 +153,33 @@ jobs:
          puts "non_docker_matrix=#{non_docker_matrix}"
          puts "docker_platforms=#{docker_platforms.join(",")}"
          puts "previous_tag=#{previous_tag}"
+          puts "prerelease=#{version.split("+", 2).first.include?("-")}"
          RUBY

-  build-frontend:
+  quality:
    needs: [release-info]
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v7
-        with:
-          ref: ${{ needs.release-info.outputs.tag }}
-
-      - name: Setup pnpm
-        uses: pnpm/action-setup@v6
-        with:
-          version: 11.7.0
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v6
-        with:
-          node-version: 24
-          cache: pnpm
-          cache-dependency-path: frontend/pnpm-lock.yaml
-
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-        working-directory: frontend
-
-      - name: Build frontend
-        run: pnpm build
-        working-directory: frontend
-
-      - name: Upload frontend artifact
-        uses: actions/upload-artifact@v7
-        with:
-          name: frontend-dist
-          path: frontend/dist
-          if-no-files-found: error
-          retention-days: 1
+    uses: ./.github/workflows/_quality.yml
+    with:
+      ref: ${{ needs.release-info.outputs.git_sha }}
+      upload_frontend: true

  build-docker-binary:
    name: build-docker-binary (${{ matrix.os }}-${{ matrix.arch }})
-    needs: [release-info]
+    needs: [release-info, quality]
    strategy:
      fail-fast: false
      matrix: ${{ fromJson(needs.release-info.outputs.docker_matrix) }}
    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 90

    steps:
      - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
        with:
-          ref: ${{ needs.release-info.outputs.tag }}
+          ref: ${{ needs.release-info.outputs.git_sha }}

      - name: Cache Cargo
-        uses: actions/cache@v6
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
        with:
          path: |
            ~/.cargo/registry
@@ -232,9 +205,8 @@ jobs:
            -v "$HOME/.cargo:/cargo" \
            -v "$PWD/..:/workspace" \
            -w /workspace/backend \
-            rust:1.95-bookworm \
+            rust:1.95-bookworm@sha256:6258907abe69656e41cd992e0b705cdcfabcbbe3db374f92ed2d47121282d4a1 \
            cargo build --release --locked --target "${{ matrix.target }}" --bin codex-proxy-rs
-          mkdir -p "../dist/binaries/${{ matrix.os }}-${{ matrix.arch }}"
          cp "target/${{ matrix.target }}/release/${{ matrix.binary }}" "../dist/binaries/${{ matrix.os }}-${{ matrix.arch }}/${{ matrix.binary }}"
        working-directory: backend
        env:
@@ -244,7 +216,7 @@ jobs:
          CPR_BUILD_TYPE: release

      - name: Upload binary artifact
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: codex-proxy-rs-${{ matrix.os }}-${{ matrix.arch }}
          path: dist/binaries/${{ matrix.os }}-${{ matrix.arch }}/
@@ -253,20 +225,27 @@ jobs:

  build-binary:
    name: build-binary (${{ matrix.os }}-${{ matrix.arch }})
-    needs: [release-info]
+    needs: [release-info, quality]
    strategy:
      fail-fast: false
      matrix: ${{ fromJson(needs.release-info.outputs.non_docker_matrix) }}
    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 90

    steps:
      - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
        with:
-          ref: ${{ needs.release-info.outputs.tag }}
+          ref: ${{ needs.release-info.outputs.git_sha }}
+
+      - name: Setup Rust
+        uses: dtolnay/rust-toolchain@eac0f66a48bc4b70a10b9acd4c4e930f835d95ff # 1.95
+        with:
+          toolchain: '1.95'
+          targets: ${{ matrix.target }}

      - name: Cache Cargo
-        uses: actions/cache@v6
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
        with:
          path: |
            ~/.cargo/registry
@@ -276,10 +255,6 @@ jobs:
          restore-keys: |
            cargo-${{ runner.os }}-${{ matrix.target }}-

-      - name: Install Rust target
-        run: rustup target add ${{ matrix.target }}
-        working-directory: backend
-
      - name: Build binary
        shell: bash
        run: |
@@ -294,7 +269,7 @@ jobs:
          CPR_BUILD_TYPE: release

      - name: Upload binary artifact
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: codex-proxy-rs-${{ matrix.os }}-${{ matrix.arch }}
          path: dist/binaries/${{ matrix.os }}-${{ matrix.arch }}/
@@ -302,8 +277,9 @@ jobs:
          retention-days: 1

  package-assets:
-    needs: [release-info, build-frontend, build-docker-binary, build-binary]
+    needs: [release-info, quality, build-docker-binary, build-binary]
    runs-on: ubuntu-latest
+    timeout-minutes: 20
    permissions:
      contents: read
      id-token: write
@@ -311,18 +287,18 @@ jobs:

    steps:
      - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
        with:
-          ref: ${{ needs.release-info.outputs.tag }}
+          ref: ${{ needs.release-info.outputs.git_sha }}

      - name: Download frontend artifact
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          name: frontend-dist
          path: dist/frontend

      - name: Download binary artifacts
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          pattern: codex-proxy-rs-*
          path: dist/binaries
@@ -407,12 +383,12 @@ jobs:
          PY

      - name: Generate release asset provenance
-        uses: actions/attest@v4
+        uses: actions/attest@a1948c3f048ba23858d222213b7c278aabede763 # v4
        with:
          subject-path: dist/release/*

      - name: Upload release assets
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: release-assets
          path: dist/release
@@ -421,30 +397,34 @@ jobs:

  build-docker-image:
    name: build-docker-image (${{ matrix.dockerPlatform }})
-    needs: [release-info, build-frontend, build-docker-binary]
+    needs: [release-info, quality, build-docker-binary]
    strategy:
      fail-fast: false
      matrix: ${{ fromJson(needs.release-info.outputs.docker_matrix) }}
    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 45
    permissions:
      contents: read
      packages: write
      id-token: write
+    env:
+      TRIVY_QUIET: 'true'
+      TRIVY_SKIP_VERSION_CHECK: 'true'

    steps:
      - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
        with:
-          ref: ${{ needs.release-info.outputs.tag }}
+          ref: ${{ needs.release-info.outputs.git_sha }}

      - name: Download frontend artifact
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          name: frontend-dist
          path: dist/docker/web/dist

      - name: Download Docker binary artifacts
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          name: codex-proxy-rs-${{ matrix.os }}-${{ matrix.arch }}
          path: dist/docker-artifacts/codex-proxy-rs-${{ matrix.os }}-${{ matrix.arch }}
@@ -476,10 +456,10 @@ jobs:
          PY

      - name: Setup Docker Buildx
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4

      - name: Login to GHCR
-        uses: docker/login-action@v4
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
@@ -487,7 +467,7 @@ jobs:

      - name: Build and push app image
        id: build-and-push
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
        with:
          context: .
          file: deploy/Dockerfile
@@ -505,13 +485,24 @@ jobs:
            org.opencontainers.image.version=${{ needs.release-info.outputs.version }}
            org.opencontainers.image.revision=${{ needs.release-info.outputs.git_sha }}
            org.opencontainers.image.source=https://github.com/zyycn/codex-proxy-rs
-          tags: |
-            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ needs.release-info.outputs.version }}-${{ matrix.arch }}
-            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:sha-${{ needs.release-info.outputs.git_sha }}-${{ matrix.arch }}
+          tags: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:sha-${{ needs.release-info.outputs.git_sha }}-${{ matrix.arch }}
+
+      - name: Scan exact app image digest
+        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
+        with:
+          image-ref: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@${{ steps.build-and-push.outputs.digest }}
+          version: v0.72.0
+          format: table
+          severity: HIGH,CRITICAL
+          vuln-type: os,library
+          scanners: vuln
+          ignore-unfixed: true
+          exit-code: '1'

  publish:
    needs: [release-info, package-assets, build-docker-image]
    runs-on: ubuntu-latest
+    timeout-minutes: 20
    permissions:
      contents: write
      packages: write
@@ -520,24 +511,24 @@ jobs:

    steps:
      - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
        with:
-          ref: ${{ needs.release-info.outputs.tag }}
+          ref: ${{ needs.release-info.outputs.git_sha }}

      - name: Download release assets
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          name: release-assets
          path: dist/release

      - name: Setup Docker Buildx
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4

      - name: Install Cosign
-        uses: sigstore/cosign-installer@v4.1.2
+        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2

      - name: Login to GHCR
-        uses: docker/login-action@v4
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
@@ -550,6 +541,7 @@ jobs:
          VERSION: ${{ needs.release-info.outputs.version }}
          GIT_SHA: ${{ needs.release-info.outputs.git_sha }}
          DOCKER_PLATFORMS: ${{ needs.release-info.outputs.docker_platforms }}
+          PRERELEASE: ${{ needs.release-info.outputs.prerelease }}
        run: |
          set -euo pipefail

@@ -560,7 +552,7 @@ jobs:
            platform="${platform//[[:space:]]/}"
            [ -n "${platform}" ] || continue
            arch="${platform##*/}"
-            sources+=("${image}:${VERSION}-${arch}")
+            sources+=("${image}:sha-${GIT_SHA}-${arch}")
          done

          if [ "${#sources[@]}" -eq 0 ]; then
@@ -568,11 +560,14 @@ jobs:
            exit 1
          fi

-          docker buildx imagetools create \
-            -t "${image}:${VERSION}" \
-            -t "${image}:latest" \
-            -t "${image}:sha-${GIT_SHA}" \
-            "${sources[@]}"
+          target_args=(
+            -t "${image}:${VERSION}"
+            -t "${image}:sha-${GIT_SHA}"
+          )
+          if [ "$PRERELEASE" != true ]; then
+            target_args+=(-t "${image}:latest")
+          fi
+          docker buildx imagetools create "${target_args[@]}" "${sources[@]}"

          inspect_output="$(docker buildx imagetools inspect "${image}:${VERSION}")"
          platform_list="$(awk '$1 == "Platform:" { print $2 }' <<< "${inspect_output}")"
@@ -592,7 +587,7 @@ jobs:
          echo "digest=${digest}" >> "$GITHUB_OUTPUT"

      - name: Generate container provenance attestation
-        uses: actions/attest@v4
+        uses: actions/attest@a1948c3f048ba23858d222213b7c278aabede763 # v4
        with:
          subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          subject-digest: ${{ steps.manifest.outputs.digest }}
@@ -602,10 +597,9 @@ jobs:
        shell: bash
        env:
          DIGEST: ${{ steps.manifest.outputs.digest }}
-          IMAGE_TAGS: |
-            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ needs.release-info.outputs.version }}
-            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
-            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:sha-${{ needs.release-info.outputs.git_sha }}
+          VERSION: ${{ needs.release-info.outputs.version }}
+          GIT_SHA: ${{ needs.release-info.outputs.git_sha }}
+          PRERELEASE: ${{ needs.release-info.outputs.prerelease }}
        run: |
          set -euo pipefail
          if [ -z "${DIGEST}" ]; then
@@ -613,20 +607,26 @@ jobs:
            exit 1
          fi

+          image="${REGISTRY}/${IMAGE_NAME}"
+          tags=("${image}:${VERSION}" "${image}:sha-${GIT_SHA}")
+          if [ "$PRERELEASE" != true ]; then
+            tags+=("${image}:latest")
+          fi
          images=()
-          while IFS= read -r tag; do
-            [ -n "${tag}" ] || continue
+          for tag in "${tags[@]}"; do
            images+=("${tag}@${DIGEST}")
-          done <<< "${IMAGE_TAGS}"
+          done

          cosign sign --yes "${images[@]}"

      - name: Publish GitHub Release
-        uses: softprops/action-gh-release@v3
+        uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3
        with:
          tag_name: ${{ needs.release-info.outputs.tag }}
          generate_release_notes: true
          previous_tag: ${{ needs.release-info.outputs.previous_tag }}
+          prerelease: ${{ needs.release-info.outputs.prerelease == 'true' }}
+          make_latest: ${{ needs.release-info.outputs.prerelease == 'true' && 'false' || 'true' }}
          body: |
            ## 📥 Installation

@@ -12,7 +12,7 @@ permissions:
  contents: read

 concurrency:
-  group: security-scan-${{ github.workflow }}-${{ github.ref }}
+  group: security-scan-${{ github.event.pull_request.head.repo.full_name || github.repository }}-${{ github.head_ref || github.ref_name }}
  cancel-in-progress: true

 jobs:
@@ -21,18 +21,22 @@ jobs:
    timeout-minutes: 20
    steps:
      - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}

      - name: Setup Rust
-        uses: dtolnay/rust-toolchain@1.95
+        uses: dtolnay/rust-toolchain@eac0f66a48bc4b70a10b9acd4c4e930f835d95ff # 1.95
+        with:
+          toolchain: '1.95'

      - name: Cache Rust
-        uses: Swatinem/rust-cache@v2.9.1
+        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
        with:
          workspaces: backend -> target

      - name: Install cargo-audit
-        run: cargo install cargo-audit --locked
+        run: cargo install cargo-audit --version 0.22.2 --locked

      - name: Run cargo audit
        working-directory: backend
@@ -43,15 +47,17 @@ jobs:
    timeout-minutes: 15
    steps:
      - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}

      - name: Setup pnpm
-        uses: pnpm/action-setup@v6
+        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6
        with:
          version: 11.7.0

      - name: Setup Node
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
        with:
          node-version: 24
          cache: pnpm
@@ -63,21 +69,11 @@ jobs:
      - name: Run pnpm audit
        run: pnpm --dir frontend audit --prod --audit-level=high

-  docker-security:
-    runs-on: ubuntu-latest
-    timeout-minutes: 30
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v7
-
-      - name: Build runtime image
-        run: docker build -f deploy/Dockerfile --target runtime -t codex-proxy-rs:security-scan .
-
-      - name: Scan runtime image
-        uses: aquasecurity/trivy-action@v0.36.0
-        with:
-          image-ref: codex-proxy-rs:security-scan
-          severity: HIGH,CRITICAL
-          vuln-type: os,library
-          ignore-unfixed: true
-          exit-code: '1'
+  container-security:
+    if: github.event_name == 'schedule'
+    permissions:
+      contents: read
+      security-events: write
+    uses: ./.github/workflows/_container.yml
+    with:
+      ref: ${{ github.sha }}