113 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
sharang	7ad7bce9db	feat(plc): dynamic PLC testing via ephemeral soft-PLC (#193)	2026-07-17 07:47:43 +00:00
sharang	1aba85b28e	docs(plc): PLC Runtime Landscape reference + support watch-list (#185)	2026-07-16 22:05:39 +00:00
sharang	c6a84b327f	docs(plc): soft-PLC architecture + CODESYS/Yocto lifecycle diagram (#184)	2026-07-16 22:00:17 +00:00
sharang	0f4c75b6b3	fix(matrix): DAST needs an http(s) endpoint; don't offer/run it on modbus:// (#182)	2026-07-16 21:28:47 +00:00
sharang	cd65fa345c	feat(onboarding): enable opt-in scans from the wizard success step (#181)	2026-07-16 20:52:50 +00:00
sharang	097f86243e	feat(cve): match the CODESYS runtime against NVD by CPE (#180)	2026-07-16 20:10:18 +00:00
sharang	b7406eca15	feat(onboarding): Project-archive PLC format + auto-detect (#179)	2026-07-16 20:05:05 +00:00
sharang	4f9e2c2828	fix(plc): scan every PLC-source artifact, not just the first (#178)	2026-07-16 19:59:58 +00:00
sharang	98357cae10	fix(upload): raise body-size limit to 512 MiB + surface upload errors (#177)	2026-07-16 18:03:40 +00:00
sharang	55e4117369	fix(dashboard): preselect saved type/kind in edit-target form (#176)	2026-07-16 17:52:27 +00:00
sharang	7932f60ab9	feat(ics): EtherNet/IP probe + OT service-discovery port scan (#175)	2026-07-16 16:48:22 +00:00
sharang	b96c4d594c	feat(ics): OPC UA reachability probe (#174)	2026-07-16 16:35:54 +00:00
sharang	d2003eb3c0	feat(cve): notifications for the PLC control-app SBOM (#173)	2026-07-16 16:30:19 +00:00
sharang	77eced8314	feat(ics): dynamic Modbus/TCP probe for PLC/SPS devices (#172)	2026-07-16 16:25:04 +00:00
sharang	a3f3f1d4f5	feat(plc): ingest CODESYS projects from a git repo (SAST + SBOM) (#171)	2026-07-16 15:47:04 +00:00
sharang	7369e031c4	feat(plc): control-application SBOM from CODESYS .projectarchive (#170)	2026-07-16 15:28:42 +00:00
sharang	386d8457d6	feat(plc): analyse graphical logic (FBD/LD) from PLCopen XML (#169)	2026-07-16 11:43:49 +00:00
sharang	3a53a1d7f2	feat(matrix): PlcSps composite device target (SBOM/CVE/DAST/pentest) (#168)	2026-07-16 10:56:36 +00:00
sharang	afa5c985ee	feat(onboarding): PLC/blob file upload (multipart) + single-file ingest fix (#163)	2026-07-16 09:41:12 +00:00
sharang	6d02b138c6	feat(pipeline): PLC/SPS control-logic security scanner (IEC 61131-3) (#162)	2026-07-16 08:31:43 +00:00
sharang	a981311413	refactor: rip out the legacy TrackedRepository / repositories path (#161)	2026-07-16 07:25:45 +00:00
sharang	87f240b26f	feat(onboarding): input validation + editable targets (#160)	2026-07-13 17:57:48 +00:00
sharang	613847d4d3	feat(agent): real nix (sandbox=false) for firmware SBOM, replacing nix-portable (#159)	2026-07-13 16:01:09 +00:00
sharang	71aceafa26	fix(deps): bump tramiton to v0.4.1 (proot-safe firmware build) (#158)	2026-07-13 11:21:43 +00:00
sharang	b12d18d99d	feat(pipeline): firmware SBOM via tramiton reproducible build (phase 2) (#157)	2026-07-13 10:15:06 +00:00
sharang	eaaafc0621	feat(pipeline): analysis-based firmware SBOM from tramiton (#156)	2026-07-13 08:31:33 +00:00
sharang	0ec5fd8295	fix(dashboard): Findings/SBOM filter by targets + accurate target findings_count (#155)	2026-07-13 07:59:45 +00:00
sharang	bf32b9939a	fix(onboarding): targets visibility + unified pipeline by default (#154)	2026-07-13 07:29:04 +00:00
sharang	669e1f1b03	feat(onboarding): scan-trigger endpoint + wizard Run-Scan button (#153)	2026-07-12 22:19:32 +00:00
sharang	9e70bd1c8e	ci: don't cancel-in-progress for main-branch runs (only pull_request) (#152)	2026-07-12 22:08:58 +00:00
sharang	9ec07ff7a1	fix(ci): authenticate tramiton fetch in dashboard + mcp image builds (#147)	2026-07-12 21:52:38 +00:00
sharang	0e57c2d7a7	feat(pipeline): run tramiton classification + provision DAST in run_target (#146)	2026-07-12 21:49:22 +00:00
sharang	c6a02f0ac3	feat(pipeline): unified run_target execution behind UNIFIED_PIPELINE (#145)	2026-07-12 21:31:21 +00:00
sharang	17f788858d	feat(dashboard): onboarding wizard UI (#144)	2026-07-12 21:28:52 +00:00
sharangandSharang Parnerkar	c6b5622113	fix(ci): authenticate tramiton-core fetch in the agent image build (main deploys) (#143) ... The PR `check` job authenticates the private tramiton-core git fetch, but the main-branch **`deploy-agent`** job builds `Dockerfile.agent` where cargo also fetches tramiton-core — inside the image build, with no credentials — so **agent image builds on main fail**. Fix: inject the PAT as a **BuildKit secret** (never baked into an image layer). - `Dockerfile.agent`: `RUN --mount=type=secret,id=tramiton_token …` applies the same `https`-insteadOf rewrite + `CARGO_NET_GIT_FETCH_WITH_CLI=true` before `cargo build`. - `deploy-agent`: `DOCKER_BUILDKIT=1 docker build --secret id=tramiton_token,env=TRAMITON_FETCH_TOKEN …`, reusing the existing `TRAMITON_FETCH_TOKEN` secret. Only the agent image depends on tramiton-core (dashboard/mcp/docs unaffected). **Self-tests on merge** — changing `Dockerfile.agent` makes `detect-changes` run `deploy-agent`. Note: couldn't fully run the image build locally (no PAT value on hand + no `.dockerignore` so the context is large), but this mirrors the working PR-stage auth and uses standard BuildKit secret injection. Assumes the deploy runner's Docker daemon supports BuildKit (docker:27-cli → yes). --------- Co-authored-by: Sharang Parnerkar <30073382+mighty840@users.noreply.github.com> Reviewed-on: #143	2026-07-12 20:25:39 +00:00
sharang	a204f0c59c	feat(api): onboarding endpoints for unified targets (#142)	2026-07-12 20:15:22 +00:00
sharang	cf4afdda1b	feat(migrate): onboarding backfill (repositories + dast_targets -> onboarded_targets) (#141)	2026-07-12 20:11:16 +00:00
sharang	a074efd0b4	ci: Kellnr crates.io mirror + persistent S3-backed sccache (#140)	2026-07-10 16:30:51 +00:00
sharang	ef6ee3dcd1	feat(onboarding): artifact ingest + classifier + native tramiton + suite seams (#138)	2026-07-10 16:00:51 +00:00
sharang	675c4ef699	feat(onboarding): unified multi-target model + scan matrix foundation (#134)	2026-07-10 13:41:25 +00:00
sharang	aed551231c	feat(dashboard): UI for managing MCP tokens (#94) ... Adds /mcp-tokens page so a logged-in user can mint, list, and revoke bearer tokens for the MCP server without curl. Pairs with #92's tenant-scoped MCP middleware — copy a token from the dashboard straight into an LLM client config.	2026-06-30 16:32:54 +00:00
sharang	b851f4267a	feat(m7.3): scheduler pulls tenants from registry, env as fallback (#96) ... Replaces M7.2-C static SCHEDULER_TENANT_IDS with a live query to the tenant-registry at every tick. New tenants picked up without an agent restart; env stays as fallback so a registry outage never silences the scheduler. Resolution order: registry -> SCHEDULER_TENANT_IDS env -> DEFAULT_SCHEDULER_TENANT_ID. Logs the active source on startup.	2026-06-30 16:32:35 +00:00
sharang	e9536b6d98	fix(audit): bump quinn-proto + ignore rmcp DNS-rebinding advisory (#97) ... RUSTSEC-2026-0185 (quinn-proto 0.11.14): patch-bump to 0.11.15. RUSTSEC-2026-0189 (rmcp 0.16 DNS rebinding): added to ignore with public-hostname + bearer-auth threat-model justification; rmcp 0.16->2.x migration tracked as a separate multi-hour PR.	2026-06-30 16:07:01 +00:00
sharang	a3a96fe2cc	feat(m7.3): MCP tenant-scoped bearer tokens (#92) ... MCP server validates per-tenant bearer tokens on incoming calls and routes each tool to the caller's tenant DB. Closes the cross-tenant data leak in the MCP path identified in M7.3.	2026-06-30 15:27:21 +00:00
sharang	ac24ca766a	feat(m7.3): cross-tenant admin HTTP endpoints (#95) ... GET /api/admin/tenants lists tenant DBs; DELETE /api/admin/tenants/{tenant_id} drops them (GDPR). Behind a separate auth path that rejects customer realm tokens.	2026-06-30 15:23:39 +00:00
sharang	485c3ff45e	chore(agent): remove stale unscoped webhook routes from API router (#93) ... Webhook routes live on the separate webhook server (port 3002). M7.2-C URL form is /webhook/{tenant_id}/{platform}/{repo_id}; mounting unscoped variants on the API router would mismatch handler signatures.	2026-06-30 15:18:31 +00:00
sharang	69c4f7bb78	feat(dashboard): proactively refresh expired Keycloak tokens (#91)	2026-06-17 20:01:37 +00:00
sharang	56482911b8	fix(dashboard): attach Keycloak token on agent API calls (#90)	2026-06-17 18:35:59 +00:00
sharang	183234f9af	feat(m7.1): wire compliance-agent to compliance-core auth + status gate (#85)	2026-06-17 09:36:52 +00:00
sharang	dbadff0aac	fix(m7.1): JWKS refresh-on-failure in auth middleware (#84)	2026-06-04 14:46:14 +00:00