release-train: staging -> main

.github/pull_request_template.md

@@ -2,21 +2,31 @@
 <!-- 1–3 sentences. What does this PR do and why? -->
 
 ## Related
-<!-- Same repo: Closes #123 · Cross-repo: Fixes tracebloc/backend#456 (owner-qualified — a bare backend#456 closes nothing). PRs land on develop, not the default branch, so confirm the issue actually closed. -->
+<!-- Same repo: Closes #123 · Cross-repo: Fixes tracebloc/client-runtime#456 (owner-qualified — a bare client-runtime#456 closes nothing). PRs land on develop, not the default branch, so closing keywords do not fire on merge — confirm the issue actually closed. -->
 
 ## Type of change
 - [ ] Feature
 - [ ] Bug fix
 - [ ] Tech-debt / refactor
 - [ ] Docs
 - [ ] Security / hardening
+- [ ] Breaking change
 
 ## Test plan
-<!-- Commands run, manual steps. -->
+<!-- What did you test? Commands run? Manual steps? -->
+
+## Screenshots / recordings
+<!-- For UI changes. Remove if N/A. -->
+
+## Deployment notes
+<!-- Env vars, migrations, rollout order, feature flags. Remove if N/A. -->
 
 ## Checklist
 - [ ] Tests added / updated and passing locally
-- [ ] `go build ./...`, `go vet`, and the Lint job's checks pass locally
-- [ ] Terminal output follows [STYLE.md](../STYLE.md) — Printer tones (no hardcoded colour/emoji), "secure environment" not "workspace"; `bash scripts/check-style.sh` passes
+- [ ] Docs updated if behavior or config changed
 - [ ] No secrets / credentials in the diff
+- [ ] For security-sensitive paths: appropriate reviewer requested
 - [ ] Cross-repo issues use `Fixes tracebloc/<repo>#N` — a bare `repo#N` closes nothing
+- [ ] If this depends on a change in another repo: shipped **expand-then-contract** (additive first, consumers adopt later), or **Breaking change** ticked above with the rollout order in *Deployment notes* — repos promote independently, so the other change may not ship with this one
+- [ ] `go build ./...`, `go vet`, and the Lint job's checks pass locally
+- [ ] Terminal output follows [STYLE.md](../STYLE.md) — Printer tones (no hardcoded colour/emoji), "secure environment" not "workspace"; `bash scripts/check-style.sh` passes

.github/workflows/code-quality-caller.yml

@@ -3,6 +3,14 @@ name: Code quality
 on:
  pull_request:
  types: [opened, reopened, synchronize, ready_for_review]
+ # Manual whole-tree scan (gitleaks baseline etc.) -- runs every enabled
+ # job in all-files mode instead of a PR diff.
+ workflow_dispatch:
+ inputs:
+ all-files:
+ description: "Scan the whole repo, not a diff"
+ type: boolean
+ default: true
 
 # Supersede the previous run when a branch is pushed again. Measured:
 # workflows missing this stack ~10-minute duplicate runs per push.
@@ -19,4 +27,8 @@ jobs:
  with:
  python: true # repos with Python
  shell: true # repos with shell scripts
- # soft-fail: false # flip once the backlog is clear
+ # The gate is armed: findings fail the job. Backlog cleared to zero
+ # fleet-wide + advisory soak done (backend#1303).
+ soft-fail: false
+ all-files: ${{ inputs.all-files || false }}
+ gitleaks-baseline: .gitleaks-baseline.json

.github/workflows/release.yml

@@ -31,12 +31,12 @@ on:
  push:
  tags:
  - 'v*.*.*'
-workflow_dispatch:
- inputs:
- ref:
- description: 'Tag to build (e.g. v0.1.0). Must already exist on origin.'
- required: true
- type: string
+# Rebuilds: dispatch the workflow AT the tag ref (Actions -> Run workflow ->
+# pick the v* tag), or gh run rerun a previous tag run. Cosign embeds the
+# RUN's ref in the keyless identity; the installers only trust
+# @refs/tags/v.*, so a branch-dispatched "rebuild of a tag" would publish
+# signatures every customer install rejects (Bugbot on promotion #428).
+workflow_dispatch: {}
 
 permissions:
  contents: write # create / update the GitHub Release
@@ -47,9 +47,27 @@ concurrency:
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
+ # Pre-flight: reject a branch-misdispatch ONCE, in seconds, before the 8-way
+ # matrix spins up (review nit on #429). Ref passed via env, never inline.
+ guard:
+ name: Ref guard
+ runs-on: ubuntu-latest
+ env:
+ REF_FULL: ${{ github.ref }}
+ EVENT_NAME: ${{ github.event_name }}
+ steps:
+ - name: Dispatch rebuilds must run at a v* tag ref
+ run: |
+ if [ "$EVENT_NAME" = "workflow_dispatch" ] && ! printf '%s' "$REF_FULL" | grep -qE '^refs/tags/v'; then
+ echo "::error::rebuilds must be dispatched from the v* tag itself (Actions -> Run workflow -> select the tag), not a branch -- signatures would embed $REF_FULL and fail every customer verification."
+ exit 1
+ fi
+ echo "ref ok: $REF_FULL"
+
  release:
  timeout-minutes: 20
  name: Build + sign + publish
+ needs: guard
  runs-on: ubuntu-latest
  strategy:
  fail-fast: false
@@ -78,7 +96,7 @@ jobs:
  - name: Checkout
  uses: actions/checkout@v7
  with:
- ref: ${{ inputs.ref || github.ref }}
+ ref: ${{ github.ref }}
  fetch-depth: 0
 
  - name: Set up Go
@@ -94,10 +112,14 @@ jobs:
 
  - name: Determine release version
  id: version
+ env:
+ # Passed via env, never interpolated into the script: git permits $/
+ # backticks in tag names and a crafted v* tag would otherwise execute
+ # on the runner (R8; same rule as the client installer workflows).
+ REF_NAME: ${{ github.ref_name }}
  run: |
- # On a tag push: github.ref_name = "v0.1.0"
- # On workflow_dispatch: inputs.ref = "v0.1.0"
- REF="${{ inputs.ref || github.ref_name }}"
+ # github.ref_name = "v0.1.0" (tag push, or dispatch AT the tag ref)
+ REF="$REF_NAME"
  # Strip the leading v for use in -X main.version
  VERSION="${REF#v}"
  # The VERSION file declares the next release (read by the release
@@ -186,7 +208,7 @@ jobs:
  - name: Checkout
  uses: actions/checkout@v7
  with:
- ref: ${{ inputs.ref || github.ref }}
+ ref: ${{ github.ref }}
 
  - name: Download all matrix artifacts
  uses: actions/download-artifact@v7
@@ -215,8 +237,15 @@ jobs:
 
  - name: Determine release tag
  id: tag
+ env:
+ # Pass the ref through the environment, never interpolate it into the
+ # script. A tag name is attacker-controllable, so a crafted v* tag
+ # carrying backticks or $() would otherwise execute on the publish
+ # runner before the release is even created (R8). Same treatment the
+ # guard and version steps above already got.
+ REF_NAME: ${{ github.ref_name }}
  run: |
- REF="${{ inputs.ref || github.ref_name }}"
+ REF="$REF_NAME"
  # STRICT stability rule: only a plain vX.Y.Z tag is a stable release.
  # Anything else (v1.2.3-rc.1, and typos like v1.2.3rc1) is marked
  # prerelease, so it can never become 'latest' -- which is what the

.gitleaks-baseline.json

@@ -0,0 +1,23 @@
+[
+ {
+ "RuleID": "generic-api-key",
+ "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.",
+ "StartLine": 212,
+ "EndLine": 212,
+ "StartColumn": 4,
+ "EndColumn": 45,
+ "Match": "IdempotencyKey: \"REDACTED\"",
+ "Secret": "REDACTED",
+ "File": "internal/submit/submit_test.go",
+ "SymlinkFile": "",
+ "Commit": "d2754bd0e71bd5363b7c7f51a286b7d705e7928d",
+ "Link": "https://github.com/tracebloc/cli/blob/d2754bd0e71bd5363b7c7f51a286b7d705e7928d/internal/submit/submit_test.go#L212",
+ "Entropy": 4.004886,
+ "Author": "lukasWuttke",
+ "Email": "54042461+LukasWodka@users.noreply.github.com",
+ "Date": "2026-07-13T11:27:35Z",
+ "Message": "feat(push): print the run's correlation id on submit (backend#1028 item 3) (#245)\n\nThe idempotency key the CLI already sends is becoming the end-to-end\ningest correlation id: jobs-manager derives the Job name from it, labels\nevery spawned resource with it, and (client-runtime) stamps it into the\ningestor container as TRACEBLOC_INGEST_CORRELATION_ID, where the\ningestor (data-ingestors) logs it and carries it into the backend\nregistration payload.\n\nThe CLI was the only layer that never showed the key, so the customer\nhad no copy of the one string that threads all layers together. Print\nit as a hint line on every submit path — fresh and replay (a replayed\nrun is exactly when you reach for the id to find the already-running\nJob).\n\nNo wire change: the key was already in the POST body.\n\nCo-authored-by: Claude Fable 5 \u003cnoreply@anthropic.com\u003e",
+ "Tags": [],
+ "Fingerprint": "d2754bd0e71bd5363b7c7f51a286b7d705e7928d:internal/submit/submit_test.go:generic-api-key:212"
+ }
+]

VERSION

@@ -1 +1 @@
-0.10.1
+0.10.2