Goliat - Nexus

Pipelines and pre-publication review

Workflows validate source, dependencies and the website. Local review commands neither publish code nor deploy Azure or synchronize the wiki; publishing uses manual workflows.

File	Trigger	Purpose
`.github/workflows/validate.yml`	PR, main push, manual, reusable	Source/history scanning, workflow and shell validation, Python/Node tests, Next.js build, npm audits, mocked Terraform security plans, inventory/wiki, images and website.
`.github/workflows/security.yml`	PR, main, weekly, manual	CodeQL for Actions, Python and JavaScript/TypeScript; dependency review on PRs.
`.github/dependabot.yml`	Weekly	Action, five npm package and Terraform provider update proposals.
`.github/workflows/release.yml`	Manual, main only	Rerun CI and create an audited draft release with source hashes and commit provenance, without ZIP assets.
`.github/workflows/pages.yml`	Manual, main only	Build, audit and publish the static product website to GitHub Pages.
`.github/workflows/stars.yml`	Daily and manual, main only	Update `stars.json` on the data-only `github-stats` branch; no website build or Pages deployment.

Actions use full commit SHAs verified in their official repositories. Gitleaks and actionlint downloads use fixed versions and versioned SHA-256 values in scripts/security-tools.json. CI runs on GitHub-hosted runners with read-only repository access, timeouts and a final CI passed gate covering every job/matrix. Pull requests never run on the private Azure agent. No pull_request_target, Azure sessions, SPNs, PATs or cloud secrets are required.

GitHub-hosted jobs explicitly use ubuntu-24.04. This prevents the operating system from switching automatically when GitHub moves the ubuntu-latest alias. The runner image still receives updates within Ubuntu 24.04; upgrades to another OS release should be tested deliberately.

Only CodeQL writes security results; the draft-release and scheduled public-stars jobs have repository write permission. Only Pages deployment has Pages and OIDC write permissions. The upstream repository protects main with PRs, CI passed, the three CodeQL jobs, dependency review and resolved conversations. External workflow runs require maintainer approval. See Contributing. Fork owners must configure these settings themselves; workflows do not apply them automatically. Configure release and github-pages environments for your team and select GitHub Actions in Settings → Pages.

Publication boundary

Source scanning includes non-ignored working files and all local Git refs. CI and the clean checkout use --strict-tracked to reject tracked files outside the export allowlist. Public tfvars retain fictional Azure identifiers; real values stay in ignored .local/ files. Use strict mode in the prepared public checkout.

Generated artifacts are inspected before upload: archives (including ZIPs), symlinks and private file names are rejected, then Gitleaks scans the contents. All code and tfvars remain regular files in Git. Only audited static output from main is retained for seven days. Deployment states, plans, journals, authentication caches and logs are never uploaded.

python3 scripts/install_gitleaks.py
python3 scripts/install_actionlint.py
make workflows-check
make fmt check test validate
make inventory docs wiki-check
make site site-check artifacts-check

Terraform uses mock providers without Azure login. Providers are downloaded from the registry and npm audits query public advisories. make images-check requires a Linux Docker engine, available on the pipeline's Ubuntu runner. Run make prepare-github to create .local/github-ready/goliat-nexus/ with fresh history, a remote and a pre-push hook, without committing or pushing. Existing destinations are preserved; use python3 scripts/prepare_github.py --output <ANOTHER-DIRECTORY> for another copy. Inside that checkout, install the scanner with python3 scripts/install_gitleaks.py, then run python3 scripts/check_publication.py --history --strict-tracked. Hooks complement review and GitHub controls.

Releases, Pages and Azure

The manual release version must match VERSION. A release reruns CI, rescans the full checkout and requires clean source. It creates per-file SOURCE_SHA256SUMS, commit provenance and draft notes without packaging code or tfvars. Existing releases are preserved. The owner reviews notes, hashes and evidence before publishing. Pages is a separate manual action; it neither provisions Azure nor deploys Alba.

GitHub environments separate these operations. github-pages records the website deployment and its URL. release uses deployment: false: branch restrictions, secrets and required reviewers can apply without recording draft preparation as a deployment. Restrict both environments to the main branch; configure reviewers for your team if needed. Do not add GitHub App deployment protection rules to release, because those require a deployment object. Published versions belong under Releases, and website deployments under Deployments. Deployment counts reflect each repository's history, not its release count.

Azure deployment keeps using the CLI and a private executor. The optional OIDC publisher's limited image/group/identity roles do not provide all state, secret, RBAC-assignment and directory permissions needed for a full platform deployment. Azure CD needs a deliberate permissions, private connectivity/DNS and environment-approval design. Never put personal credentials or real tfvars in the public repository.

Actions logs and artifacts are public when executed in this public repository. Validation uses fictional values and avoids printing secret material. Automated scanning cannot guarantee the absence of every sensitive value.

The daily public-stars job updates only github-stats/stars.json on its data-only branch. It does not compile the website or application, change main, or deploy Pages. See website metadata.