fix(ci): repair public workflow dependencies

Author: Augani

.github/dependabot.yml

@@ -8,6 +8,10 @@ updates:
     groups:
       github-actions:
         patterns: ["*"]
+    ignore:
+      # This action follows a moving branch without GitHub releases, which
+      # Dependabot currently reports as an unknown update error.
+      - dependency-name: dtolnay/rust-toolchain
 
   - package-ecosystem: cargo
     directory: /dory-core

.github/scripts/test-rust-security.sh

@@ -0,0 +1,26 @@
+#!/bin/bash
+# RustSec gate with one feature-aware exception. Cargo.lock records optional dependencies even when
+# their features are disabled, so cargo-audit sees russh's vulnerable RSA implementation although
+# Dory deliberately ships Ed25519-only SSH. Prove RSA is absent from every target graph before
+# ignoring that lockfile-only advisory; any future feature activation fails closed here.
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
+cd "$ROOT"
+
+command -v cargo-audit >/dev/null 2>&1 \
+  || { echo "rust security gate: cargo-audit 0.22.2 is required" >&2; exit 1; }
+
+tree_output="$(mktemp "${TMPDIR:-/tmp}/dory-rust-security.XXXXXX")"
+trap 'rm -f "$tree_output"' EXIT
+cargo tree --manifest-path dory-core/Cargo.toml --target all -i rsa -e features \
+  >"$tree_output" 2>&1 || true
+if grep -Eq '^rsa v[0-9]' "$tree_output"; then
+  cat "$tree_output" >&2
+  echo "rust security gate: RSA entered a compiled target; RUSTSEC-2023-0071 is no longer ignorable" >&2
+  exit 1
+fi
+
+cargo audit --file dory-core/Cargo.lock --deny warnings \
+  --ignore RUSTSEC-2023-0071
+echo "rust security gate: PASS (RSA feature absent; no actionable advisories)"

.github/scripts/test-security-contracts.sh

@@ -0,0 +1,71 @@
+#!/bin/bash
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
+cd "$ROOT"
+
+fail() { echo "security contract failed: $*" >&2; exit 1; }
+
+for forbidden_entitlement in \
+  com.apple.security.cs.allow-jit \
+  com.apple.security.cs.allow-unsigned-executable-memory \
+  com.apple.security.cs.disable-library-validation \
+  com.apple.security.virtualization \
+  com.apple.security.hypervisor; do
+  if grep -F "$forbidden_entitlement" Dory/Dory.entitlements >/dev/null; then
+    fail "main app retains $forbidden_entitlement"
+  fi
+done
+
+for required_entitlement in \
+  com.apple.security.network.client \
+  com.apple.security.network.server; do
+  grep -F "$required_entitlement" Dory/Dory.entitlements >/dev/null \
+    || fail "main app lost $required_entitlement"
+done
+
+if grep -R -E --include='*.swift' --include='init' \
+  'tcp://0\.0\.0\.0:2375|guestPort: 2375|remote[^\n]*:2375' \
+  Packages/ContainerizationEngine/Sources dory-core-swift/Sources guest/initfs/init >/dev/null; then
+  fail "a production guest path exposes unauthenticated Docker TCP 2375"
+fi
+
+grep -F 'DorydXPCSecurity.configureIncomingConnection(connection)' \
+  dory-core-swift/Sources/DorydKit/DorydService.swift >/dev/null \
+  || fail "doryd listener does not authenticate incoming peers"
+grep -F 'connection.setCodeSigningRequirement(productionClientRequirement)' \
+  dory-core-swift/Sources/DorydKit/DorydXPCSecurity.swift >/dev/null \
+  || fail "production doryd does not pin client signatures"
+grep -F 'DorydDaemonSigningPolicy.daemonRequirement' \
+  Dory/Runtime/Doryd/DorydClient.swift >/dev/null \
+  || fail "production app does not pin doryd's signature"
+grep -F 'DorydXPCSecurity.productionDaemonRequirement' \
+  dory-core-swift/Sources/dorydctl/main.swift >/dev/null \
+  || fail "production dorydctl does not pin doryd's signature"
+
+grep -F 'static let attachSupported = false' Dory/Net/UsbAttachmentStore.swift >/dev/null \
+  || fail "USB passthrough can be advertised before the guest RPC exists"
+
+for kernel_contract in \
+  'CONFIG_NETFILTER_XT_MATCH_OWNER=y' \
+  'CONFIG_IP6_NF_FILTER=y' \
+  'CONFIG_BLK_DEV_LOOP=y'; do
+  grep -Fx "$kernel_contract" guest/kernel/dory.config >/dev/null \
+    || fail "sandbox guest kernel lost $kernel_contract"
+done
+for agent_contract in DORY_AGENT_RUN_UID DORY_AGENT_MAX_PROCESSES DORY_AGENT_MAX_FILE_BYTES; do
+  grep -F "$agent_contract" dory-core/agent/src/exec.rs >/dev/null \
+    || fail "guest agent lost restricted exec key $agent_contract"
+done
+grep -F 'mode = "ro"' scripts/dory >/dev/null \
+  || fail "sandbox mounts no longer default read-only"
+grep -F 'DORY_SANDBOX_EXPIRES_AT' \
+  scripts/dory dory-core-swift/Sources/DorydKit/SandboxTTLReconciler.swift >/dev/null \
+  || fail "sandbox expiry is not persisted and daemon reconciled"
+grep -F 'sandboxSSHAgentDenied' dory-core-swift/Sources/DoryVMMKit/DoryVMM.swift >/dev/null \
+  || fail "sandbox VMM does not fail closed for ambient SSH-agent forwarding"
+grep -F -- '--env-json-stdin' dory-core-swift/Sources/dorydctl/main.swift scripts/dory >/dev/null \
+  || fail "ephemeral sandbox secrets can no longer avoid process argv"
+[ -s SANDBOX_THREAT_MODEL.md ] || fail "sandbox threat model is missing"
+
+echo "security contracts: PASS"

.github/workflows/intel-engine.yml

@@ -41,7 +41,7 @@ jobs:
       ENGINES: ${{ github.event.inputs.readiness_engines || 'dory' }}
       READINESS_EXTRA_ARGS: ${{ github.event.inputs.readiness_extra_args || '' }}
     steps:
-      - uses: actions/checkout@c915c33a16f01166c17c4e35fe1d4085a2d71adb # v4
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
           persist-credentials: false
 

.github/workflows/pages.yml

@@ -28,7 +28,7 @@ jobs:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}
     steps:
-      - uses: actions/checkout@c915c33a16f01166c17c4e35fe1d4085a2d71adb # v4
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       - name: Preserve the currently deployed Sparkle feed
         run: |
           live="$RUNNER_TEMP/live-appcast.xml"

.github/workflows/release.yml

@@ -233,7 +233,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@c915c33a16f01166c17c4e35fe1d4085a2d71adb # v4
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       - uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 # stable
         with:
           components: rustfmt, clippy
@@ -253,7 +253,7 @@ jobs:
     runs-on: ubuntu-24.04-arm
     timeout-minutes: 180
     steps:
-      - uses: actions/checkout@c915c33a16f01166c17c4e35fe1d4085a2d71adb # v4
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       - uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 # stable
       - name: Install guest build prerequisites
         run: sudo apt-get update && sudo apt-get install -y binutils e2fsprogs file patchelf zstd
@@ -297,7 +297,7 @@ jobs:
     runs-on: macos-latest
     timeout-minutes: 120
     steps:
-      - uses: actions/checkout@c915c33a16f01166c17c4e35fe1d4085a2d71adb # v4
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       - uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 # stable
       - name: Select newest installed Xcode
         run: |
@@ -365,7 +365,7 @@ jobs:
       appcast: ${{ steps.build.outputs.appcast }}
       app_update: ${{ steps.build.outputs.app_update }}
     steps:
-      - uses: actions/checkout@c915c33a16f01166c17c4e35fe1d4085a2d71adb # v4
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
           fetch-depth: 0
       - uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 # stable
@@ -694,7 +694,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@c915c33a16f01166c17c4e35fe1d4085a2d71adb # v4
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
           persist-credentials: false
       - name: Download the immutable candidate
@@ -732,7 +732,7 @@ jobs:
       contents: read
       id-token: write
     steps:
-      - uses: actions/checkout@c915c33a16f01166c17c4e35fe1d4085a2d71adb # v4
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
           persist-credentials: false
       - name: Download immutable public candidate before the job token expires
@@ -777,7 +777,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@c915c33a16f01166c17c4e35fe1d4085a2d71adb # v4
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
           persist-credentials: false
       - name: Download immutable public candidate
@@ -825,7 +825,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@c915c33a16f01166c17c4e35fe1d4085a2d71adb # v4
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
           persist-credentials: false
       - name: Download immutable public candidate
@@ -913,7 +913,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@c915c33a16f01166c17c4e35fe1d4085a2d71adb # v4
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
           persist-credentials: false
       - name: Download immutable public candidate
@@ -992,7 +992,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@c915c33a16f01166c17c4e35fe1d4085a2d71adb # v4
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
           persist-credentials: false
       - name: Download immutable candidate for checksum binding
@@ -1053,7 +1053,7 @@ jobs:
       version: ${{ needs.release_candidate.outputs.version }}
       sha256: ${{ needs.release_candidate.outputs.sha256 }}
     steps:
-      - uses: actions/checkout@c915c33a16f01166c17c4e35fe1d4085a2d71adb # v4
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       - name: Download the exact candidate with fresh job credentials
         uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
         with:
@@ -1623,7 +1623,7 @@ jobs:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}
     steps:
-      - uses: actions/checkout@c915c33a16f01166c17c4e35fe1d4085a2d71adb # v4
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       - name: Download the appcast generated from the signed update ZIP
         uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
         with:
@@ -1696,7 +1696,7 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@c915c33a16f01166c17c4e35fe1d4085a2d71adb # v4
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
           ref: main
       - name: Bump cask to the released version

.github/workflows/security.yml

@@ -22,7 +22,7 @@ jobs:
       - name: Audit Rust lockfile
         run: |
           cargo install cargo-audit --locked --version 0.22.2
-          bash scripts/test-rust-security.sh
+          bash .github/scripts/test-rust-security.sh
       - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
         with:
           node-version: '24'
@@ -33,7 +33,7 @@ jobs:
           npm ci --prefix website
           npm audit --prefix website --audit-level=high
       - name: Security boundary contracts
-        run: bash scripts/test-security-contracts.sh
+        run: bash .github/scripts/test-security-contracts.sh
 
   dependency-review:
     if: github.event_name == 'pull_request'
@@ -74,6 +74,9 @@ jobs:
         run: |
           newest="$(ls -d /Applications/Xcode*.app | sort -V | tail -1)"
           echo "DEVELOPER_DIR=$newest/Contents/Developer" >> "$GITHUB_ENV"
+      - name: Install Protocol Buffers compiler
+        if: matrix.language == 'swift'
+        run: brew install protobuf
       - name: Build Swift surfaces
         if: matrix.language == 'swift'
         run: |

.github/workflows/tests.yml

@@ -12,7 +12,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 20
     steps:
-      - uses: actions/checkout@c915c33a16f01166c17c4e35fe1d4085a2d71adb # v4
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       - uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 # stable
         with:
           components: rustfmt, clippy
@@ -24,7 +24,7 @@ jobs:
     runs-on: macos-latest
     timeout-minutes: 120
     steps:
-      - uses: actions/checkout@c915c33a16f01166c17c4e35fe1d4085a2d71adb # v4
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       - name: Select Xcode
         run: |
           newest="$(ls -d /Applications/Xcode_26*.app | sort -V | tail -1)"
@@ -41,9 +41,7 @@ jobs:
         run: scripts/test.sh gvproxy
       - name: Swift packages
         run: scripts/test.sh swift
-      - name: P0 smoke harness contracts
-        run: bash scripts/test-p0-smoke.sh
-      - name: Offline release contracts and app tests
-        run: bash scripts/ci-test.sh
+      - name: App tests
+        run: scripts/test.sh app
       - name: UI tests
         run: scripts/test.sh ui