chore: merge develop → main

.github/workflows/auto-merge-pr.yml

@@ -0,0 +1,48 @@
+name: Auto Merge PR (develop → main)
+
+on:
+  push:
+    branches: [develop]
+  workflow_dispatch:
+
+permissions: {}
+
+jobs:
+  open-pr:
+    runs-on: ubuntu-latest
+    if: github.actor != 'github-actions[bot]'
+    permissions:
+      contents: write
+      pull-requests: write
+
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+
+      - name: Create Pull Request
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          gh pr create \
+            --base main \
+            --head develop \
+            --title "chore: merge develop → main" \
+            --body "Automated PR by github-actions[bot]." || \
+            echo "PR already exists, skipping."
+
+      - name: Request review and enable auto-merge
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          PR_NUMBER=$(gh pr list --head develop --base main --json number -q '.[0].number' 2>/dev/null || echo "")
+          if [ -n "$PR_NUMBER" ]; then
+            gh pr edit "$PR_NUMBER" --add-reviewer mendsec 2>/dev/null || \
+            echo "Could not request review."
+
+            # Enforce merge strategy to prevent squash, which causes develop to diverge
+            gh pr merge "$PR_NUMBER" --merge --auto 2>/dev/null || \
+            echo "Could not enable auto-merge. Ensure 'Allow merge commits' is enabled in repo settings."
+
+            echo "PR #$PR_NUMBER updated. Waiting for review from mendsec."
+          fi

.github/workflows/ci.yml

@@ -2,9 +2,9 @@ name: CI
 
 on:
   push:
-    branches: [main]
+    branches: [main, develop]
   pull_request:
-    branches: [main]
+    branches: [main, develop]
 
 permissions:
   contents: read
@@ -21,7 +21,7 @@ jobs:
       - uses: actions/checkout@v4
 
       - name: Set up Go ${{ matrix.go-version }}
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: ${{ matrix.go-version }}
           cache: true
@@ -37,6 +37,17 @@ jobs:
           fi
           echo "✓ No local replace directives"
 
+      - name: Set up Bun
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+        with:
+          bun-version: latest
+
+      - name: Build frontend assets
+        run: |
+          cd frontend
+          bun install
+          bun run build
+
       - name: Vet
         run: go vet ./...
 

.github/workflows/govulncheck.yml

@@ -1,8 +1,5 @@
 name: Govulncheck
 
-permissions:
-  contents: read
-
 on:
   push:
     branches: [ "main", "develop" ]
@@ -18,29 +15,17 @@ jobs:
   govulncheck:
     runs-on: ubuntu-latest
     steps:
-      - name: Checkout app
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-        with:
-          path: app
+      - name: Checkout repository
+        uses: actions/checkout@v4
 
-      - name: Checkout engine
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - name: Set up Go
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          repository: catnet-io/engine
-          path: engine
-
-      - name: Install dependencies
-        run: sudo apt-get update && sudo apt-get install -y libgtk-3-dev libwebkit2gtk-4.1-dev libwebkit2gtk-4.0-dev || true
-
-      - name: Mock frontend dist
-        shell: bash
-        working-directory: app
-        run: mkdir -p frontend/dist; echo "mock" > frontend/dist/index.html
-
+          go-version: '1.26.x'
+          cache: true
+
       - name: Run govulncheck
-        uses: golang/govulncheck-action@b625fbe08f3bccbe446d94fbf87fcc875a4f50ee # v1
+        uses: golang/govulncheck-action@032d45514ae346b1db93c04b0c90b841c370344f # v1
         with:
           go-version-input: '1.26.x'
           go-package: ./...
-          work-dir: ./app
-          repo-checkout: false

.github/workflows/pr-rules-enforcer.yml

@@ -0,0 +1,75 @@
+name: PR Rules Enforcer
+
+on:
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  enforce-rules:
+    name: Enforce Main Branch Rules
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Validate PR Source and Author
+        env:
+          HEAD_REF: ${{ github.event.pull_request.head.ref }}
+          PR_USER: ${{ github.event.pull_request.user.login }}
+        run: |
+          echo "PR HEAD ref: $HEAD_REF"
+          echo "PR creator: $PR_USER"
+
+          if [ "$HEAD_REF" != "develop" ]; then
+            echo "::error::PRs to main must only come from the 'develop' branch. Found: '$HEAD_REF'."
+            exit 1
+          fi
+
+          if [ "$PR_USER" != "github-actions[bot]" ] && [ "$PR_USER" != "app/github-actions" ]; then
+            echo "::error::PRs from 'develop' to 'main' must be created by 'github-actions[bot]'. Manual PRs are not allowed. Found: '$PR_USER'."
+            exit 1
+          fi
+
+          echo "✓ PR source branch and creator are valid."
+
+      - name: Validate Commit Signatures
+        env:
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+        run: |
+          # Fetch main branch to check commits differences
+          git fetch origin main
+
+          # Configure allowed_signers for SSH signature verification on runner
+          mkdir -p ~/.ssh
+          touch ~/.ssh/allowed_signers
+          git config --global gpg.ssh.allowedSignersFile ~/.ssh/allowed_signers
+
+          # Check signatures of all commits in the PR branch
+          echo "Checking commits signature up to: $HEAD_SHA"
+
+          HAS_UNSIGNED=0
+          while read -r sha sig; do
+            if [ -z "$sha" ]; then
+              continue
+            fi
+
+            # Check if commit object contains a gpgsig header (SSH or GPG signature)
+            HAS_GPGSIG=$(git cat-file -p "$sha" | grep -c "^gpgsig " || true)
+
+            if [ "$sig" = "N" ] && [ "$HAS_GPGSIG" -eq 0 ]; then
+              echo "::error::Commit $sha is NOT signed. All commits in a PR to main must be signed (GPG or SSH)."
+              HAS_UNSIGNED=1
+            else
+              echo "✓ Commit $sha has a valid signature (sig: $sig, gpgsig: $HAS_GPGSIG)"
+            fi
+          done < <(git log origin/main..$HEAD_SHA --pretty=format:"%H %G?")
+
+          if [ "$HAS_UNSIGNED" -eq 1 ]; then
+            exit 1
+          fi
+          echo "✓ All commits are properly signed."

.github/workflows/release.yml

@@ -37,7 +37,7 @@ jobs:
         path: engine
 
     - name: Set up Go
-      uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
+      uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
       with:
         go-version: '1.26.x'
 

.github/workflows/snyk.yml

@@ -10,51 +10,36 @@ on:
     branches: [ "main", "develop" ]
 
 jobs:
-  snyk-go:
+  Snyk:
     runs-on: ubuntu-latest
     steps:
-      - name: Checkout app
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-        with:
-          path: app
-      - name: Checkout engine
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-        with:
-          repository: catnet-io/engine
-          path: engine
+      - name: Checkout repository
+        uses: actions/checkout@v4
       - name: Mock frontend dist
-        working-directory: app
         run: mkdir -p frontend/dist; echo "mock" > frontend/dist/index.html
       - name: Run Snyk to check Go vulnerabilities
         uses: snyk/actions/golang@9adf32b1121593767fc3c057af55b55db032dc04 # v1.0.0
         env:
           SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
         with:
-          args: --file=app/go.mod
+          args: --file=go.mod
 
   snyk-frontend:
     runs-on: ubuntu-latest
     steps:
-      - name: Checkout app
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-        with:
-          path: app
-      - name: Checkout engine
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-        with:
-          repository: catnet-io/engine
-          path: engine
+      - name: Checkout repository
+        uses: actions/checkout@v4
       - name: Setup Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
           bun-version: latest
       - name: Install dependencies
-        working-directory: app/frontend
+        working-directory: frontend
         run: bun install
       - name: Setup Snyk
         uses: snyk/actions/setup@9adf32b1121593767fc3c057af55b55db032dc04 # v1.0.0
       - name: Run Snyk to check Bun vulnerabilities
-        working-directory: app/frontend
+        working-directory: frontend
         env:
           SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
         run: snyk test --file=package.json