Fix SDK template and runtime image findings

Author: Dexploarer

crates/actant-sdk-codegen/templates/client.py

@@ -1,8 +1,39 @@
 # Generated by actant-sdk-codegen. Edit the template, not this file.
-import urllib.request, json
+import json
+import urllib.parse
+import urllib.request
+
+_ALLOWED_URL_SCHEMES = {"http", "https"}
+
+
+def _validate_url_scheme(url):
+    scheme = urllib.parse.urlparse(url).scheme
+    if scheme not in _ALLOWED_URL_SCHEMES:
+        allowed = ", ".join(sorted(_ALLOWED_URL_SCHEMES))
+        raise ValueError(f"ActantClient only supports these URL schemes: {allowed}")
+
+
+def _build_http_opener():
+    opener = urllib.request.OpenerDirector()
+    opener.add_handler(urllib.request.HTTPHandler())
+    opener.add_handler(urllib.request.HTTPSHandler())
+    opener.add_handler(urllib.request.HTTPDefaultErrorHandler())
+    opener.add_handler(urllib.request.HTTPRedirectHandler())
+    opener.add_handler(urllib.request.HTTPErrorProcessor())
+    return opener
+
+
+_HTTP_OPENER = _build_http_opener()
+
+
+def _open_http_request(req):
+    _validate_url_scheme(req.full_url)
+    return _HTTP_OPENER.open(req)
+
 
 class ActantClient:
     def __init__(self, base="http://127.0.0.1:4555"):
+        _validate_url_scheme(base)
         self.base = base
 
     def command(self, workspace_id, actor_id, command_type, input_, idempotency_key=None):
@@ -19,5 +50,5 @@ def command(self, workspace_id, actor_id, command_type, input_, idempotency_key=
             data=json.dumps(body).encode("utf-8"),
             headers={"content-type": "application/json"},
         )
-        with urllib.request.urlopen(req) as r:
+        with _open_http_request(req) as r:
             return json.loads(r.read())

deploy/Dockerfile

@@ -21,7 +21,7 @@ COPY rustfmt.toml clippy.toml ./
 # Build only the server binary; cargo will pull just the crates it needs.
 RUN cargo build --release -p actant-server --bin actantdb-server
 
-FROM gcr.io/distroless/cc-debian12 AS runtime
+FROM gcr.io/distroless/cc-debian12:latest@sha256:aa0b7af67fa8211751ea6e00baa8373ba56cc1417ffc986ec9619bd0e1556b56 AS runtime
 COPY --from=builder /src/target/release/actantdb-server /usr/local/bin/actantdb-server
 COPY --from=builder /src/migrations /opt/actantdb/migrations