98 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
sharang	7369e031c4	feat(plc): control-application SBOM from CODESYS .projectarchive (#170)	2026-07-16 15:28:42 +00:00
sharang	386d8457d6	feat(plc): analyse graphical logic (FBD/LD) from PLCopen XML (#169)	2026-07-16 11:43:49 +00:00
sharang	3a53a1d7f2	feat(matrix): PlcSps composite device target (SBOM/CVE/DAST/pentest) (#168)	2026-07-16 10:56:36 +00:00
sharang	afa5c985ee	feat(onboarding): PLC/blob file upload (multipart) + single-file ingest fix (#163)	2026-07-16 09:41:12 +00:00
sharang	6d02b138c6	feat(pipeline): PLC/SPS control-logic security scanner (IEC 61131-3) (#162)	2026-07-16 08:31:43 +00:00
sharang	a981311413	refactor: rip out the legacy TrackedRepository / repositories path (#161)	2026-07-16 07:25:45 +00:00
sharang	87f240b26f	feat(onboarding): input validation + editable targets (#160)	2026-07-13 17:57:48 +00:00
sharang	613847d4d3	feat(agent): real nix (sandbox=false) for firmware SBOM, replacing nix-portable (#159)	2026-07-13 16:01:09 +00:00
sharang	71aceafa26	fix(deps): bump tramiton to v0.4.1 (proot-safe firmware build) (#158)	2026-07-13 11:21:43 +00:00
sharang	b12d18d99d	feat(pipeline): firmware SBOM via tramiton reproducible build (phase 2) (#157)	2026-07-13 10:15:06 +00:00
sharang	eaaafc0621	feat(pipeline): analysis-based firmware SBOM from tramiton (#156)	2026-07-13 08:31:33 +00:00
sharang	0ec5fd8295	fix(dashboard): Findings/SBOM filter by targets + accurate target findings_count (#155)	2026-07-13 07:59:45 +00:00
sharang	bf32b9939a	fix(onboarding): targets visibility + unified pipeline by default (#154)	2026-07-13 07:29:04 +00:00
sharang	669e1f1b03	feat(onboarding): scan-trigger endpoint + wizard Run-Scan button (#153)	2026-07-12 22:19:32 +00:00
sharang	9e70bd1c8e	ci: don't cancel-in-progress for main-branch runs (only pull_request) (#152)	2026-07-12 22:08:58 +00:00
sharang	9ec07ff7a1	fix(ci): authenticate tramiton fetch in dashboard + mcp image builds (#147)	2026-07-12 21:52:38 +00:00
sharang	0e57c2d7a7	feat(pipeline): run tramiton classification + provision DAST in run_target (#146)	2026-07-12 21:49:22 +00:00
sharang	c6a02f0ac3	feat(pipeline): unified run_target execution behind UNIFIED_PIPELINE (#145)	2026-07-12 21:31:21 +00:00
sharang	17f788858d	feat(dashboard): onboarding wizard UI (#144)	2026-07-12 21:28:52 +00:00
sharangandSharang Parnerkar	c6b5622113	fix(ci): authenticate tramiton-core fetch in the agent image build (main deploys) (#143) ... The PR `check` job authenticates the private tramiton-core git fetch, but the main-branch **`deploy-agent`** job builds `Dockerfile.agent` where cargo also fetches tramiton-core — inside the image build, with no credentials — so **agent image builds on main fail**. Fix: inject the PAT as a **BuildKit secret** (never baked into an image layer). - `Dockerfile.agent`: `RUN --mount=type=secret,id=tramiton_token …` applies the same `https`-insteadOf rewrite + `CARGO_NET_GIT_FETCH_WITH_CLI=true` before `cargo build`. - `deploy-agent`: `DOCKER_BUILDKIT=1 docker build --secret id=tramiton_token,env=TRAMITON_FETCH_TOKEN …`, reusing the existing `TRAMITON_FETCH_TOKEN` secret. Only the agent image depends on tramiton-core (dashboard/mcp/docs unaffected). **Self-tests on merge** — changing `Dockerfile.agent` makes `detect-changes` run `deploy-agent`. Note: couldn't fully run the image build locally (no PAT value on hand + no `.dockerignore` so the context is large), but this mirrors the working PR-stage auth and uses standard BuildKit secret injection. Assumes the deploy runner's Docker daemon supports BuildKit (docker:27-cli → yes). --------- Co-authored-by: Sharang Parnerkar <30073382+mighty840@users.noreply.github.com> Reviewed-on: #143	2026-07-12 20:25:39 +00:00
sharang	a204f0c59c	feat(api): onboarding endpoints for unified targets (#142)	2026-07-12 20:15:22 +00:00
sharang	cf4afdda1b	feat(migrate): onboarding backfill (repositories + dast_targets -> onboarded_targets) (#141)	2026-07-12 20:11:16 +00:00
sharang	a074efd0b4	ci: Kellnr crates.io mirror + persistent S3-backed sccache (#140)	2026-07-10 16:30:51 +00:00
sharang	ef6ee3dcd1	feat(onboarding): artifact ingest + classifier + native tramiton + suite seams (#138)	2026-07-10 16:00:51 +00:00
sharang	675c4ef699	feat(onboarding): unified multi-target model + scan matrix foundation (#134)	2026-07-10 13:41:25 +00:00
sharang	aed551231c	feat(dashboard): UI for managing MCP tokens (#94) ... Adds /mcp-tokens page so a logged-in user can mint, list, and revoke bearer tokens for the MCP server without curl. Pairs with #92's tenant-scoped MCP middleware — copy a token from the dashboard straight into an LLM client config.	2026-06-30 16:32:54 +00:00
sharang	b851f4267a	feat(m7.3): scheduler pulls tenants from registry, env as fallback (#96) ... Replaces M7.2-C static SCHEDULER_TENANT_IDS with a live query to the tenant-registry at every tick. New tenants picked up without an agent restart; env stays as fallback so a registry outage never silences the scheduler. Resolution order: registry -> SCHEDULER_TENANT_IDS env -> DEFAULT_SCHEDULER_TENANT_ID. Logs the active source on startup.	2026-06-30 16:32:35 +00:00
sharang	e9536b6d98	fix(audit): bump quinn-proto + ignore rmcp DNS-rebinding advisory (#97) ... RUSTSEC-2026-0185 (quinn-proto 0.11.14): patch-bump to 0.11.15. RUSTSEC-2026-0189 (rmcp 0.16 DNS rebinding): added to ignore with public-hostname + bearer-auth threat-model justification; rmcp 0.16->2.x migration tracked as a separate multi-hour PR.	2026-06-30 16:07:01 +00:00
sharang	a3a96fe2cc	feat(m7.3): MCP tenant-scoped bearer tokens (#92) ... MCP server validates per-tenant bearer tokens on incoming calls and routes each tool to the caller's tenant DB. Closes the cross-tenant data leak in the MCP path identified in M7.3.	2026-06-30 15:27:21 +00:00
sharang	ac24ca766a	feat(m7.3): cross-tenant admin HTTP endpoints (#95) ... GET /api/admin/tenants lists tenant DBs; DELETE /api/admin/tenants/{tenant_id} drops them (GDPR). Behind a separate auth path that rejects customer realm tokens.	2026-06-30 15:23:39 +00:00
sharang	485c3ff45e	chore(agent): remove stale unscoped webhook routes from API router (#93) ... Webhook routes live on the separate webhook server (port 3002). M7.2-C URL form is /webhook/{tenant_id}/{platform}/{repo_id}; mounting unscoped variants on the API router would mismatch handler signatures.	2026-06-30 15:18:31 +00:00
sharang	69c4f7bb78	feat(dashboard): proactively refresh expired Keycloak tokens (#91)	2026-06-17 20:01:37 +00:00
sharang	56482911b8	fix(dashboard): attach Keycloak token on agent API calls (#90)	2026-06-17 18:35:59 +00:00
sharang	183234f9af	feat(m7.1): wire compliance-agent to compliance-core auth + status gate (#85)	2026-06-17 09:36:52 +00:00
sharang	dbadff0aac	fix(m7.1): JWKS refresh-on-failure in auth middleware (#84)	2026-06-04 14:46:14 +00:00
sharang	116293519d	M7.1 smoke harness: lift auth to compliance-core + compliance-smoke service (#83)	2026-06-04 14:38:35 +00:00
sharang	a8cef58e02	feat(dashboard): add light/dark theme with sidebar toggle (#81)	2026-05-13 11:44:22 +00:00
sharang	927fbc8ecb	fix: live progress + concurrency for embedding builds (#80)	2026-05-13 10:01:05 +00:00
sharang	e67a13535a	fix: add HTTP timeout to reqwest client and CVE stage timeout (#79)	2026-05-13 07:30:26 +00:00
sharangandSharang Parnerkar	df0063abc0	fix: scanner timeouts, semgrep memory cap, syft remote lookups, Script error (#78) ... ## Summary - **Scan produces no results in Orca** — semgrep (`--config=auto`, unbounded memory) and syft (remote license network calls) were getting OOM-killed or hanging in resource-constrained Orca containers. Scan would "complete" with 0 findings/SBOMs silently because each scanner failure is caught and logged as a warning. - **Dashboard Script error spam** — `document::Script` in Dioxus 0.7 needs a single text node child for inline scripts; `dangerous_inner_html` was invalid and spammed the error log on every unauthenticated page load. ## Changes | File | Change | |------|--------| | `semgrep.rs` | Add `--max-memory 500 --jobs 1`; 10-minute timeout | | `syft.rs` | Remove remote license lookup env vars; 5-minute timeout | | `gitleaks.rs` | 5-minute timeout | | `app_shell.rs` | Fix `dangerous_inner_html` → text child in `document::Script` | ## Test plan - [ ] Trigger a scan on a repo in Orca — findings and SBOM entries should now appear - [ ] Agent logs should show timeout/error warnings rather than silent empty results when tools are killed - [ ] Navigate to dashboard unauthenticated — Script error gone from logs - [ ] Verify scans work end-to-end with `docker compose up` --------- Co-authored-by: Sharang Parnerkar <30073382+mighty840@users.noreply.github.com> Reviewed-on: #78	2026-05-12 11:27:24 +00:00
Sharang Parnerkar	5cafd13f44	ci: log orca webhook response so deploy steps arent silent	2026-04-08 15:09:27 +02:00
Sharang ParnerkarandClaude Opus 4.6	69209649a5	ci: trigger first orca build for all services ... Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-04-08 10:10:07 +02:00
Sharang ParnerkarandClaude Opus 4.6	d5439adc0d	ci: trigger build of dashboard, docs, mcp images for orca ... Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-04-08 10:09:49 +02:00
Sharang ParnerkarandClaude Opus 4.6	bc7cdd35e4	ci: replace coolify webhook with orca deploy ... Each deploy job now builds the per-service image, pushes to the private registry as :latest and :sha, then triggers an HMAC-signed orca redeploy webhook. Coolify webhooks are no longer used. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-04-08 10:06:11 +02:00
Sharang ParnerkarandClaude Opus 4.6	c062d834a1	fix: downgrade dotenv missing file from FAILED to info message ... Non-fatal in Docker where env vars come from container config. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-30 15:33:24 +02:00
sharang	23cf37b6c3	fix: CVE notifications during scan + help chat doc loading + Dockerfile (#55) v0.2.0	2026-03-30 13:10:56 +00:00
sharang	49d5cd4e0a	feat: hourly CVE alerting with notification bell and API (#53)	2026-03-30 10:39:39 +00:00
sharang	4388e98b5b	feat: add E2E test suite with nightly CI, fix dashboard Dockerfile (#52)	2026-03-30 10:04:07 +00:00
sharang	a8bb05d7b1	feat: add floating help chat widget, remove settings page (#51)	2026-03-30 08:05:29 +00:00
sharang	bae24f9cf8	fix: cascade-delete DAST targets, pentests, and downstream data on repo delete (#50)	2026-03-30 07:11:23 +00:00