Security remediation from full adversarial audit

.env.example

@@ -0,0 +1,19 @@
+# RavenTag deployment environment template — no secret values are stored here.
+NODE_ENV=production
+ALLOWED_ORIGINS=https://raventag.com
+
+# Ravencoin RPC
+RVN_RPC_HOST=localhost
+RVN_RPC_PORT=8766
+RVN_PUBLIC_RPC_URL=https://rvn-rpc.publicnode.com
+
+# Docker backup sidecar: point to a local file containing a strong random secret.
+# Generate the file yourself, e.g. with: openssl rand -hex 32 > secrets/backup_encryption_key.txt
+# NEVER point this setting at admin_key/operator_key/brand key material.
+BACKUP_ENCRYPTION_KEY_FILE=./secrets/backup_encryption_key.txt
+
+# The normal Docker deployment already has a backup sidecar. Leave the optional
+# in-process scheduler disabled unless you deliberately deploy without that sidecar.
+ENABLE_INTERNAL_BACKUP=false
+# When ENABLE_INTERNAL_BACKUP=true, this path must exist inside the backend container/process.
+# INTERNAL_BACKUP_ENCRYPTION_KEY_FILE=/run/secrets/backup_encryption_key

.github/workflows/qwen-dispatch.yml

@@ -2,30 +2,23 @@ name: '🔀 Qwen Code Dispatch'
 
 on:
   pull_request_review_comment:
-    types:
-      - 'created'
+    types: ['created']
   pull_request_review:
-    types:
-      - 'submitted'
+    types: ['submitted']
   pull_request:
-    types:
-      - 'opened'
+    types: ['opened']
   issues:
-    types:
-      - 'opened'
-      - 'reopened'
+    types: ['opened', 'reopened']
   issue_comment:
-    types:
-      - 'created'
+    types: ['created']
 
 defaults:
   run:
     shell: 'bash'
 
 jobs:
   debugger:
-    if: |-
-     ${{ fromJSON(vars.DEBUG || vars.ACTIONS_STEP_DEBUG || false) }}
+    if: ${{ fromJSON(vars.DEBUG || vars.ACTIONS_STEP_DEBUG || false) }}
     runs-on: 'ubuntu-latest'
     permissions:
       contents: 'read'
@@ -39,13 +32,9 @@ jobs:
           DEBUG_event__pull_request__author_association: '${{ github.event.pull_request.author_association }}'
           DEBUG_event__review__author_association: '${{ github.event.review.author_association }}'
           DEBUG_event: '${{ toJSON(github.event) }}'
-        run: |-
-          env | grep '^DEBUG_'
+        run: env | grep '^DEBUG_'
 
   dispatch:
-    # For PRs: only if not from a fork
-    # For issues: only on open/reopen
-    # For comments: only if user types @gemini-cli and is OWNER/MEMBER/COLLABORATOR
     if: |-
       (
         github.event_name == 'pull_request' &&
@@ -71,9 +60,8 @@ jobs:
     steps:
       - name: 'Mint identity token'
         id: 'mint_identity_token'
-        if: |-
-          ${{ vars.APP_ID }}
-        uses: 'actions/create-github-app-token@a8d616148505b5069dccd32f177bb87d7f39123b' # ratchet:actions/create-github-app-token@v2
+        if: ${{ vars.APP_ID }}
+        uses: 'actions/create-github-app-token@a8d616148505b5069dccd32f177bb87d7f39123b'
         with:
           app-id: '${{ vars.APP_ID }}'
           private-key: '${{ secrets.APP_PRIVATE_KEY }}'
@@ -83,54 +71,39 @@ jobs:
 
       - name: 'Extract command'
         id: 'extract_command'
-        uses: 'actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea' # ratchet:actions/github-script@v7
+        uses: 'actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea'
         env:
           EVENT_TYPE: '${{ github.event_name }}.${{ github.event.action }}'
           REQUEST: '${{ github.event.comment.body || github.event.review.body || github.event.issue.body }}'
         with:
           script: |
             const eventType = process.env.EVENT_TYPE;
-            const request = process.env.REQUEST;
+            const request = process.env.REQUEST || '';
             core.setOutput('request', request);
-
-            if (eventType === 'pull_request.opened') {
+            if (eventType === 'pull_request.opened') core.setOutput('command', 'review');
+            else if (['issues.opened', 'issues.reopened'].includes(eventType)) core.setOutput('command', 'triage');
+            else if (request.startsWith('@qwen-code /review')) {
               core.setOutput('command', 'review');
-            } else if (['issues.opened', 'issues.reopened'].includes(eventType)) {
-              core.setOutput('command', 'triage');
-            } else if (request.startsWith("@qwen-code /review")) {
-              core.setOutput('command', 'review');
-              const additionalContext = request.replace(/^@qwen-code \/review/, '').trim();
-              core.setOutput('additional_context', additionalContext);
-            } else if (request.startsWith("@qwen-code /triage")) {
-              core.setOutput('command', 'triage');
-            } else if (request.startsWith("@qwen-code")) {
-              const additionalContext = request.replace(/^@qwen-code/, '').trim();
+              core.setOutput('additional_context', request.replace(/^@qwen-code \/review/, '').trim());
+            } else if (request.startsWith('@qwen-code /triage')) core.setOutput('command', 'triage');
+            else if (request.startsWith('@qwen-code')) {
               core.setOutput('command', 'invoke');
-              core.setOutput('additional_context', additionalContext);
-            } else {
-              core.setOutput('command', 'fallthrough');
-            }
+              core.setOutput('additional_context', request.replace(/^@qwen-code/, '').trim());
+            } else core.setOutput('command', 'fallthrough');
 
       - name: 'Acknowledge request'
         env:
-          GITHUB_TOKEN: '${{ steps.mint_identity_token.outputs.token || secrets.GITHUB_TOKEN || github.token }}'
+          GITHUB_TOKEN: '${{ steps.mint_identity_token.outputs.token || github.token }}'
           ISSUE_NUMBER: '${{ github.event.pull_request.number || github.event.issue.number }}'
-          MESSAGE: |-
-            🤖 Hi @${{ github.actor }}, I've received your request, and I'm working on it now! You can track my progress [in the logs](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}) for more details.
           REPOSITORY: '${{ github.repository }}'
-        run: |-
-          gh issue comment "${ISSUE_NUMBER}" \
-            --body "${MESSAGE}" \
-            --repo "${REPOSITORY}"
+        run: gh issue comment "${ISSUE_NUMBER}" --body "🤖 Request received. Track progress in ${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}" --repo "${REPOSITORY}"
 
   review:
     needs: 'dispatch'
-    if: |-
-      ${{ needs.dispatch.outputs.command == 'review' }}
+    if: ${{ needs.dispatch.outputs.command == 'review' }}
     uses: './.github/workflows/qwen-review.yml'
     permissions:
       contents: 'read'
-      id-token: 'write'
       issues: 'write'
       pull-requests: 'write'
     with:
@@ -139,12 +112,10 @@ jobs:
 
   triage:
     needs: 'dispatch'
-    if: |-
-      ${{ needs.dispatch.outputs.command == 'triage' }}
+    if: ${{ needs.dispatch.outputs.command == 'triage' }}
     uses: './.github/workflows/qwen-triage.yml'
     permissions:
       contents: 'read'
-      id-token: 'write'
       issues: 'write'
       pull-requests: 'write'
     with:
@@ -153,26 +124,19 @@ jobs:
 
   invoke:
     needs: 'dispatch'
-    if: |-
-      ${{ needs.dispatch.outputs.command == 'invoke' }}
+    if: ${{ needs.dispatch.outputs.command == 'invoke' }}
     uses: './.github/workflows/qwen-invoke.yml'
     permissions:
       contents: 'read'
-      id-token: 'write'
       issues: 'write'
       pull-requests: 'write'
     with:
       additional_context: '${{ needs.dispatch.outputs.additional_context }}'
     secrets: 'inherit'
 
   fallthrough:
-    needs:
-      - 'dispatch'
-      - 'review'
-      - 'triage'
-      - 'invoke'
-    if: |-
-      ${{ always() && !cancelled() && (failure() || needs.dispatch.outputs.command == 'fallthrough') }}
+    needs: ['dispatch', 'review', 'triage', 'invoke']
+    if: ${{ always() && !cancelled() && (failure() || needs.dispatch.outputs.command == 'fallthrough') }}
     runs-on: 'ubuntu-latest'
     permissions:
       contents: 'read'
@@ -181,24 +145,17 @@ jobs:
     steps:
       - name: 'Mint identity token'
         id: 'mint_identity_token'
-        if: |-
-          ${{ vars.APP_ID }}
-        uses: 'actions/create-github-app-token@a8d616148505b5069dccd32f177bb87d7f39123b' # ratchet:actions/create-github-app-token@v2
+        if: ${{ vars.APP_ID }}
+        uses: 'actions/create-github-app-token@a8d616148505b5069dccd32f177bb87d7f39123b'
         with:
           app-id: '${{ vars.APP_ID }}'
           private-key: '${{ secrets.APP_PRIVATE_KEY }}'
           permission-contents: 'read'
           permission-issues: 'write'
           permission-pull-requests: 'write'
-
       - name: 'Send failure comment'
         env:
-          GITHUB_TOKEN: '${{ steps.mint_identity_token.outputs.token || secrets.GITHUB_TOKEN || github.token }}'
+          GITHUB_TOKEN: '${{ steps.mint_identity_token.outputs.token || github.token }}'
           ISSUE_NUMBER: '${{ github.event.pull_request.number || github.event.issue.number }}'
-          MESSAGE: |-
-            🤖 I'm sorry @${{ github.actor }}, but I was unable to process your request. Please [see the logs](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}) for more details.
           REPOSITORY: '${{ github.repository }}'
-        run: |-
-          gh issue comment "${ISSUE_NUMBER}" \
-            --body "${MESSAGE}" \
-            --repo "${REPOSITORY}"
+        run: gh issue comment "${ISSUE_NUMBER}" --body "🤖 Unable to process the request. See ${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}" --repo "${REPOSITORY}"

.github/workflows/qwen-invoke.yml

@@ -21,15 +21,14 @@ jobs:
     runs-on: 'ubuntu-latest'
     permissions:
       contents: 'read'
-      id-token: 'write'
       issues: 'write'
       pull-requests: 'write'
     steps:
       - name: 'Mint identity token'
         id: 'mint_identity_token'
         if: |-
           ${{ vars.APP_ID }}
-        uses: 'actions/create-github-app-token@a8d616148505b5069dccd32f177bb87d7f39123b' # ratchet:actions/create-github-app-token@v2
+        uses: 'actions/create-github-app-token@a8d616148505b5069dccd32f177bb87d7f39123b' # immutable upstream commit
         with:
           app-id: '${{ vars.APP_ID }}'
           private-key: '${{ secrets.APP_PRIVATE_KEY }}'
@@ -39,7 +38,7 @@ jobs:
 
       - name: 'Run Qwen Code CLI'
         id: 'run_qwen'
-        uses: 'QwenLM/qwen-code-action@v1' # ratchet:exclude
+        uses: 'QwenLM/qwen-code-action@05f81718976f3b7da657422e6e8e4d372b8621d7'
         env:
           TITLE: '${{ github.event.pull_request.title || github.event.issue.title }}'
           DESCRIPTION: '${{ github.event.pull_request.body || github.event.issue.body }}'
@@ -76,7 +75,7 @@ jobs:
                     "--rm",
                     "-e",
                     "GITHUB_PERSONAL_ACCESS_TOKEN",
-                    "ghcr.io/github/github-mcp-server:v0.18.0"
+                    "ghcr.io/github/github-mcp-server@sha256:6aa543f565bc98d96106fdd80a0abdc0c7147c8ca7f4663a814ceecef1ccc6d3"
                   ],
                   "includeTools": [
                     "add_issue_comment",

.github/workflows/qwen-review.yml

@@ -22,15 +22,14 @@ jobs:
     timeout-minutes: 7
     permissions:
       contents: 'read'
-      id-token: 'write'
       issues: 'write'
       pull-requests: 'write'
     steps:
       - name: 'Mint identity token'
         id: 'mint_identity_token'
         if: |-
           ${{ vars.APP_ID }}
-        uses: 'actions/create-github-app-token@a8d616148505b5069dccd32f177bb87d7f39123b' # ratchet:actions/create-github-app-token@v2
+        uses: 'actions/create-github-app-token@a8d616148505b5069dccd32f177bb87d7f39123b'
         with:
           app-id: '${{ vars.APP_ID }}'
           private-key: '${{ secrets.APP_PRIVATE_KEY }}'
@@ -39,10 +38,10 @@ jobs:
           permission-pull-requests: 'write'
 
       - name: 'Checkout repository'
-        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
+        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8'
 
       - name: 'Run Qwen Code pull request review'
-        uses: 'QwenLM/qwen-code-action@v1' # ratchet:exclude
+        uses: 'QwenLM/qwen-code-action@05f81718976f3b7da657422e6e8e4d372b8621d7'
         id: 'qwen_pr_review'
         env:
           GITHUB_TOKEN: '${{ steps.mint_identity_token.outputs.token || secrets.GITHUB_TOKEN || github.token }}'
@@ -61,44 +60,16 @@ jobs:
           workflow_name: 'qwen-review'
           settings: |-
             {
-              "model": {
-                "maxSessionTurns": 25
-              },
-              "telemetry": {
-                "enabled": true,
-                "target": "local",
-                "outfile": ".qwen/telemetry.log"
-              },
+              "model": { "maxSessionTurns": 25 },
+              "telemetry": { "enabled": true, "target": "local", "outfile": ".qwen/telemetry.log" },
               "mcpServers": {
                 "github": {
                   "command": "docker",
-                  "args": [
-                    "run",
-                    "-i",
-                    "--rm",
-                    "-e",
-                    "GITHUB_PERSONAL_ACCESS_TOKEN",
-                    "ghcr.io/github/github-mcp-server:v0.18.0"
-                  ],
-                  "includeTools": [
-                    "add_comment_to_pending_review",
-                    "create_pending_pull_request_review",
-                    "pull_request_read",
-                    "submit_pending_pull_request_review"
-                  ],
-                  "env": {
-                    "GITHUB_PERSONAL_ACCESS_TOKEN": "${GITHUB_TOKEN}"
-                  }
+                  "args": ["run", "-i", "--rm", "-e", "GITHUB_PERSONAL_ACCESS_TOKEN", "ghcr.io/github/github-mcp-server@sha256:6aa543f565bc98d96106fdd80a0abdc0c7147c8ca7f4663a814ceecef1ccc6d3"],
+                  "includeTools": ["add_comment_to_pending_review", "create_pending_pull_request_review", "pull_request_read", "submit_pending_pull_request_review"],
+                  "env": { "GITHUB_PERSONAL_ACCESS_TOKEN": "${GITHUB_TOKEN}" }
                 }
               },
-              "tools": {
-                "core": [
-                  "run_shell_command(cat)",
-                  "run_shell_command(echo)",
-                  "run_shell_command(grep)",
-                  "run_shell_command(head)",
-                  "run_shell_command(tail)"
-                ]
-              }
+              "tools": { "core": ["run_shell_command(cat)", "run_shell_command(echo)", "run_shell_command(grep)", "run_shell_command(head)", "run_shell_command(tail)"] }
             }
           prompt: '/qwen-review'