devantler · Nov 4, 2026 · Nov 3, 2026 · Nov 3, 2026 · Nov 3, 2026 · Nov 3, 2026
@@ -0,0 +1,32 @@
+# Betterleaks configuration. MegaLinter's REPOSITORY_BETTERLEAKS extends this file, and this file
+# extends the upstream default ruleset. Each allowlist below sits on one rule and names one shape
+# that is not secret material, so a real credential anywhere else, or of another shape, still fails.
+# Test fixtures that can carry a comment use an inline `betterleaks:allow` instead.
+#
+# The allowlists are rule-level ([[rules.allowlists]]), not global [[allowlists]] with targetRules:
+# Betterleaks 1.7 attaches targetRules only in the top-level config, and MegaLinter's generated
+# config extends this one, so targeted global allowlists here are silently dropped.
+
+[extend]
+useDefault = true
+
+[[rules]]
+id = "curl-auth-user"
+
+[[rules.allowlists]]
+description = "Container identities: `docker run --user <uid>:<gid>` near a curl call is a numeric user, not a curl credential."
+regexes = ['''^[0-9]+:[0-9]+$''']
+
+[[rules.allowlists]]
+description = "Disposable test accounts: the mail-server tests sign in as `fixture` to a throwaway local container."
+regexes = ['''^fixture:[a-z-]+$''']
+
+[[rules]]
+id = "generic-api-key"
+
+[[rules.allowlists]]
+description = "Go module checksums: an `h1:` go.sum line, as quoted in a vendored go.sum diff, is a public hash."
+regexTarget = "line"
+# The reported line can begin with the preceding newline, so allow leading whitespace before the
+# optional diff marker.
+regexes = ['''^\s*[+ -]?\S+ v\S+ h1:[A-Za-z0-9+/]{43}=\s*$''']
@@ -1,3 +1,4 @@
+---
 # yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json
 #
 # CodeRabbit configuration. Only the settings that differ from CodeRabbit's defaults are

@@ -1,3 +1,4 @@
+---
 # actionlint configuration.
 #
 # `concurrency.queue` is a real, documented GitHub Actions key — SchemaStore's

@@ -1,3 +1,4 @@
+---
 name: Deploy to Production
 description: >-
   Deploy the platform's GitOps manifests to the production Talos + Hetzner
@@ -58,7 +59,7 @@ runs:
     - name: 🔐 Enforce approved publication signers
       shell: bash
       env:
-        APPROVED_REVISIONS_ENFORCE: '1'
+        APPROVED_REVISIONS_ENFORCE: "1"
       run: ./scripts/guard-publish-workflow-approved-revisions.sh
 
     # Keep signer approval ahead of credentials, then refuse stale recovery
@@ -176,7 +177,11 @@ runs:
           sleep 10
         done
         last_err=$(printf '%s' "$last_err" | tr '\n' ' ')
-        echo "::error::Prod Kubernetes API (context admin@prod) failed its readiness probe after stable endpoint selection (last kubectl error: ${last_err}). Inspect the selected endpoint, network reachability, and API readiness, then diagnose any reported TLS, authentication, or authorization failure. Recover kubeconfig credentials only if that diagnosis confirms a credential failure; this Kubernetes probe does not test Talos credentials. See docs/dr/runbook.md → 'Endpoint selection during ordinary deployments' and, for confirmed credential failures, 'Credential refresh after a full rebuild'."
+        # echo joins its arguments with single spaces: the annotation is still one line.
+        echo "::error::Prod Kubernetes API (context admin@prod) failed its readiness probe after stable endpoint selection (last kubectl error: ${last_err})." \
+          "Inspect the selected endpoint, network reachability, and API readiness, then diagnose any reported TLS, authentication, or authorization failure." \
+          "Recover kubeconfig credentials only if that diagnosis confirms a credential failure; this Kubernetes probe does not test Talos credentials." \
+          "See docs/dr/runbook.md → 'Endpoint selection during ordinary deployments' and, for confirmed credential failures, 'Credential refresh after a full rebuild'."
         exit 1
 
     - name: 🧱 Register and verify the Talos Image Factory schematic

@@ -1,3 +1,4 @@
+---
 name: Publish Platform Manifests
 description: >-
   Publish platform manifests through a unique staging reference, attach the

@@ -1,3 +1,4 @@
+---
 version: 2
 updates:
   - package-ecosystem: "github-actions"

@@ -1,3 +1,4 @@
+---
 version: 1
 resource-roots: [k8s]
 patch-roots: ["talos*"]

@@ -249,7 +249,9 @@
     },
     {
       "description": "The flux-operator chart (dedicated regex manager above) installs and upgrades Flux itself. Its chart lives on ghcr.io, which gives Renovate no release date for it, and a release with no date never clears the repository-wide wait, so no update was proposed after 0.50.0 (#4985, the same cause as #4754). minimumReleaseAge is therefore 0 days. Raising the PR adopts nothing: automerge is off whatever the update type, so every update is reviewed against the operator's release notes and the HelmRelease post-renderers before merge. Placed after the broad automerge rules so none of them can turn automerge back on.",
-      "matchPackageNames": ["ghcr.io/controlplaneio-fluxcd/charts/flux-operator"],
+      "matchPackageNames": [
+        "ghcr.io/controlplaneio-fluxcd/charts/flux-operator"
+      ],
       "minimumReleaseAge": "0 days",
       "automerge": false
     },
@@ -393,7 +395,10 @@
     {
       "description": "The Kopia reader (internal/backupcatalogue) replaces github.com/kopia/kopia with the exact project-velero/kopia commit the deployed Velero's own go.mod pins, so it reads the backup format production writes. That fork is pinned by pseudo-version, and semver ranks every v0.0.0 pseudo-version below every tag, so Renovate offers the older v0.19.0-velero.1 (February 2025, 390 commits behind the pin, December 2025) as a minor update with automerge on. Only a compile error stops that downgrade. github.com/kopia/kopia is covered too: the replacement means its require version is never the code we build, and Velero carries v0.16.0 beside this same replacement, so a bump would change nothing we run and make go.mod say something untrue. The pin moves with Velero instead: when a Velero bump changes the fork commit in its go.mod, change it here in one reviewed change. scripts/tests/test-velero-kopia-renovate-pin.sh fails once the replacement is no longer a pseudo-version, which is when this rule can go.",
       "matchManagers": ["gomod"],
-      "matchPackageNames": ["github.com/kopia/kopia", "github.com/project-velero/kopia"],
+      "matchPackageNames": [
+        "github.com/kopia/kopia",
+        "github.com/project-velero/kopia"
+      ],
       "enabled": false
     }
   ],

@@ -3,7 +3,10 @@
 # Candidate scripts, workflows and checkout code are never executed.
 set -euo pipefail
 umask 077
-fail() { printf 'FAIL: %s\n' "$*" >&2; exit 1; }
+fail() {
+  printf 'FAIL: %s\n' "$*" >&2
+  exit 1
+}
 [[ "${CANDIDATE_PR:-}" =~ ^[1-9][0-9]*$ && "${CANDIDATE_HEAD:-}" =~ ^[0-9a-f]{40}$ ]] || fail 'candidate PR and exact SHA required'
 [[ "${RUNNER_TEMP:-}" == /* && -d "$RUNNER_TEMP" ]] || fail 'absolute runner scratch directory required'
 readonly candidate="${RUNNER_TEMP}/cilium-deny-candidate"

@@ -6,4 +6,4 @@ set -euo pipefail
 KYVERNO_VERSION="1.19.2"
 
 : "${GITHUB_OUTPUT:?GitHub Actions output file required}"
-printf 'release=v%s\n' "$KYVERNO_VERSION" >> "$GITHUB_OUTPUT"
+printf 'release=v%s\n' "$KYVERNO_VERSION" >>"$GITHUB_OUTPUT"
@@ -1,11 +1,12 @@
+---
 name: CD
 
 # Manual-only. Production deploys happen automatically in the CI merge queue
 # (ci.yaml deploy-prod on merge_group); this workflow covers the rare
 # direct-push-to-main case, which has no merge_group event to deploy. Run it
 # by hand from the Actions tab. (Dropped the 'v*' release-tag trigger — it
 # re-deployed what the merge queue had already shipped.)
-on:
+"on":
   workflow_dispatch:
     inputs:
       verify-wedding-backup-staging:
@@ -149,7 +150,7 @@ jobs:
 
       - name: 🔐 Enforce approved publication signers
         env:
-          APPROVED_REVISIONS_ENFORCE: '1'
+          APPROVED_REVISIONS_ENFORCE: "1"
         run: ./scripts/guard-publish-workflow-approved-revisions.sh
 
       - name: ⚙️ Setup Go

@@ -1,5 +1,6 @@
+---
 name: CI
-on:
+"on":
   pull_request:
     branches: [main]
   merge_group:
@@ -459,6 +460,9 @@ jobs:
               # The vault-backup KSV-0020 disposition rests on the same per-container identity,
               # and its guard also asserts that KSV-0021 stays UNdispositioned there.
               - 'scripts/tests/test-trivyignore-vault-backup-identity-boundary.sh'
+              # The private-mail KSV-0020/KSV-0021 disposition rests on Stalwart's image-baked
+              # identity per container, so the entry and its premises test move together.
+              - 'scripts/tests/test-trivyignore-private-mail-identity-boundary.sh'
               # The first-party RBAC dispositions and the roles they describe are one
               # contract: the disposition is only valid while the role stays bound and
               # scoped the way it was reviewed. The roles themselves are already covered
@@ -2020,7 +2024,7 @@ jobs:
         if: matrix.suite == 'services'
         timeout-minutes: 5
         env:
-          CONTRACT_PROBE_IMAGE_NATIVE_TEST: '1'
+          CONTRACT_PROBE_IMAGE_NATIVE_TEST: "1"
         run: |
           set -euo pipefail
           go test -count=1 -timeout 4m -json ./scripts/tests/contract-probe-image |
@@ -2279,6 +2283,17 @@ jobs:
           shellcheck scripts/tests/test-trivyignore-vault-backup-identity-boundary.sh
           bash scripts/tests/test-trivyignore-vault-backup-identity-boundary.sh
 
+      - name: 🧱 Validate private-mail identity disposition boundary
+        if: needs.changes.outputs.k8s == 'true'
+        # Every private-mail container runs at uid/gid 2000, the stalwart identity the pinned
+        # Stalwart digest defines and the bootstrap image restates. The path-scoped entry would
+        # also hide a container added later at another low identity, so the guard asserts the
+        # identity and image of every container. Its identical-probe trivy control runs only
+        # where trivy is installed, which this job is not yet (#5864).
+        run: |
+          shellcheck scripts/tests/test-trivyignore-private-mail-identity-boundary.sh
+          bash scripts/tests/test-trivyignore-private-mail-identity-boundary.sh
+
       - name: 🧱 Validate first-party RBAC disposition premises
         if: needs.changes.outputs.k8s == 'true'
         # The four first-party RBAC dispositions rest on facts trivy cannot see: the tenant
@@ -3557,13 +3572,13 @@ jobs:
         if: matrix.suite == 'native'
         timeout-minutes: 5
         env:
-          VAULT_BACKUP_TOOLING_NATIVE_TEST: '1'
+          VAULT_BACKUP_TOOLING_NATIVE_TEST: "1"
         run: go test -count=1 -v ./scripts/tests/vault-backup-recovery
       - name: 🔒 Prove Longhorn dashboard read-only routing
         if: matrix.suite == 'native'
         timeout-minutes: 5
         env:
-          LONGHORN_UI_NATIVE_TEST: '1'
+          LONGHORN_UI_NATIVE_TEST: "1"
         run: go test -race -count=1 -v ./scripts/tests/longhorn-ui-readonly
       - name: 🐤 Validate staged OpenBao standby repair
         if: matrix.suite == 'contracts'

@@ -1,5 +1,6 @@
+---
 name: Clean Up Orphan Generated VPAs
-on:
+"on":
   workflow_dispatch:
     inputs:
       mode:

@@ -1,6 +1,7 @@
+---
 name: "Copilot Setup Steps"
 
-on:
+"on":
   workflow_dispatch:
   push:
     paths:

@@ -1,3 +1,4 @@
+---
 name: Copy Email Credential Custody
 
 "on":

@@ -1,3 +1,4 @@
+---
 name: Diagnose Cilium ExternalAuth ipcache
 
 # Obtain the ONE read #2284 needs: on a node running no oauth2-proxy replica, is the host-sourced
@@ -50,7 +51,7 @@ name: Diagnose Cilium ExternalAuth ipcache
 # The script's own test needs no cluster and no secrets, so it runs in ci.yaml's required
 # `validate` job rather than here.
 
-on:
+"on":
   workflow_dispatch:
     inputs:
       confirm:

@@ -1,6 +1,7 @@
+---
 name: Diagnose Wedding Pause
 
-on:
+"on":
   pull_request:
     branches: [main]
     paths:

@@ -1,3 +1,4 @@
+---
 # DR — Rebuild Prod: the executable form of docs/dr/runbook.md Scenario 4
 # ("full cluster rebuild from zero"), runnable as one button press when the
 # production cluster is gone.
@@ -37,7 +38,7 @@ name: DR - Rebuild Prod
 # safe (nothing supersedes) but silently gives up the coalescing.
 run-name: DR - Rebuild Prod (restore=${{ inputs.restore }})
 
-on:
+"on":
   # checkov:skip=CKV_GHA_7:The `confirm` input IS the safety interlock — an operator must type
   # REBUILD-PROD before this workflow will destroy and rebuild the production cluster. Removing
   # the inputs to satisfy the check would delete that guard and make an accidental dispatch
@@ -111,7 +112,7 @@ jobs:
 
       - name: 🔐 Enforce approved publication signers
         env:
-          APPROVED_REVISIONS_ENFORCE: '1'
+          APPROVED_REVISIONS_ENFORCE: "1"
         run: ./scripts/guard-publish-workflow-approved-revisions.sh
 
       - name: 🛡️ Protect the nested RGD deployment gate

@@ -1,6 +1,7 @@
+---
 name: Expand OpenBao Audit Capacity
 
-on:
+"on":
   workflow_dispatch:
     inputs:
       mode:
@@ -79,7 +80,7 @@ jobs:
 
       - name: Require offline preservation and real patch transport controls
         env:
-          AUDIT_REQUIRE_NATIVE_CONTROL: '1'
+          AUDIT_REQUIRE_NATIVE_CONTROL: "1"
         run: go test -race -count=1 ./scripts/expand-openbao-audit
 
       - name: Restore the established protected production kubeconfig

@@ -1,5 +1,6 @@
+---
 name: Measure CI Runtime
-on:
+"on":
   pull_request:
     branches: [main]
     paths: [.github/workflows/measure-ci-runtime.yaml]

@@ -1,3 +1,4 @@
+---
 name: Measure Datapath CPU Throttling
 
 # Record the throttled share of CFS periods for the datapath DaemonSets (#3790), before and after
@@ -31,7 +32,7 @@ name: Measure Datapath CPU Throttling
 # scripts/tests/test-measure-datapath-cpu-throttling.sh pins the script's behaviour and the shape of
 # this workflow. It needs no cluster and no secrets, so it runs in ci.yaml's required `validate` job.
 
-on:
+"on":
   workflow_dispatch:
     inputs:
       confirm:

@@ -1,3 +1,4 @@
+---
 name: Observe Retained Email Recovery
 
 "on":

@@ -1,6 +1,7 @@
+---
 name: Observe Historical Longhorn Backups
 
-on:
+"on":
   pull_request:
     branches: [main]
     paths:

@@ -1,6 +1,7 @@
+---
 name: Observe Longhorn Migration Headroom
 
-on:
+"on":
   workflow_dispatch:
     inputs:
       confirm:

@@ -1,6 +1,7 @@
+---
 name: Observe Longhorn Namespace Inventory
 
-on:
+"on":
   workflow_dispatch:
     inputs:
       confirm:

@@ -1,7 +1,8 @@
+---
 name: Observe Runtime Health Read Only
 
 # Observation only: no object, alert, exception or configuration is changed.
-on:
+"on":
   workflow_dispatch:
     inputs:
       confirm:

@@ -1,3 +1,4 @@
+---
 name: Prepare Email Storage Key
 
 "on":
-Original file line number
+Diff line change
@@ -1,3 +1,4 @@
+    ---
     name: Copy Email Credential Custody
     "on":
@@ Expand Down @@