@serve.zone/gitops 3.1.1 → 32.1.0

package/.smartconfig.json

@@ -1,13 +1,16 @@
 {
   "@git.zone/tsdocker": {
-    "registries": ["code.foss.global"],
+    "registries": [
+      "code.foss.global"
+    ],
     "registryRepoMap": {
       "code.foss.global": "serve.zone/gitops"
     },
     "platforms": [
       "linux/amd64",
       "linux/arm64"
-    ]
+    ],
+    "requireTestFile": true
   },
   "@git.zone/tsbundle": {
     "bundles": [
@@ -30,7 +33,9 @@
         "entryPoint": "binary/gitops.ts",
         "outDir": "dist/binaries",
         "target": "x86_64-unknown-linux-gnu",
-        "permissions": ["--allow-all"],
+        "permissions": [
+          "--allow-all"
+        ],
         "noCheck": true,
         "selfExtracting": true
       },
@@ -39,7 +44,9 @@
         "entryPoint": "binary/gitops.ts",
         "outDir": "dist/binaries",
         "target": "aarch64-unknown-linux-gnu",
-        "permissions": ["--allow-all"],
+        "permissions": [
+          "--allow-all"
+        ],
         "noCheck": true,
         "selfExtracting": true
       }
@@ -53,7 +60,10 @@
         "outputMode": "bundle",
         "bundler": "esbuild",
         "production": true,
-        "watchPatterns": ["./ts_web/**/*", "./html/**/*"],
+        "watchPatterns": [
+          "./ts_web/**/*",
+          "./html/**/*"
+        ],
         "includeFiles": [
           "./html/**/*.html"
         ]
@@ -62,7 +72,11 @@
     "watchers": [
       {
         "name": "backend",
-        "watch": ["./ts/**/*", "./ts_interfaces/**/*", "./dist_serve/**/*"],
+        "watch": [
+          "./ts/**/*",
+          "./ts_interfaces/**/*",
+          "./dist_serve/**/*"
+        ],
         "command": "node ./cli.ts.js server",
         "restart": true,
         "debounce": 500,
@@ -91,6 +105,10 @@
       ]
     },
     "release": {
+      "preflight": {
+        "test": true,
+        "build": true
+      },
       "targets": {
         "git": {
           "enabled": true,
@@ -106,7 +124,8 @@
         },
         "docker": {
           "enabled": true,
-          "engine": "tsdocker"
+          "engine": "tsdocker",
+          "test": true
         }
       }
     }

package/changelog.md

@@ -1,5 +1,47 @@
 # Changelog
 
+## 2026-09-19 - 32.1.0
+
+### Features
+
+- Webhook secrets are managed per connection (webhook)
+  - Every connection carries a webhook secret minted with `crypto.randomBytes(32)`. It is stored through SmartSecret like the provider token, masked as `***` in every connection response, and revealed only through the new identity-guarded TypedRequests `getWebhookSettings`, `rotateWebhookSecret` and `confirmWebhookSecret`.
+  - The connections view gained a **Webhook** action showing the payload URL, the secret, the verification header and the webhook status, with **Rotate Secret** and **Mark Configured**. The table shows the webhook status per connection.
+  - Neither provider implementation nor the Gitea/GitLab clients expose a hooks endpoint, so gitops cannot register the webhook itself: the operator copies the secret into the provider's webhook configuration and confirms it. Connections stored before this release are loaded with a minted secret and the status `unverified`, and their deliveries are refused until that is done.
+
+### Fixes
+
+- Verify the caller of `POST /webhook/:connectionId` (webhook)
+  - The endpoint accepted every POST: it checked neither Gitea's `X-Gitea-Signature` nor GitLab's `X-Gitlab-Token`, so anyone who could reach the ops server could make it fan a webhook event out to every connected dashboard. It now computes HMAC-SHA256 over the raw request bytes and compares with `crypto.timingSafeEqual` (hex length and alphabet checked first), or compares the GitLab token the same way.
+  - The connection is resolved and its webhook state checked before any body is buffered, and a refusal answers 401/404/411/413/503 with a stable name — `webhook-connection-unknown`, `webhook-connection-unverified`, `webhook-secret-missing`, `webhook-secret-unreadable`, `webhook-length-missing`, `webhook-signature-missing`, `webhook-signature-invalid`, `webhook-body-too-large`, `webhook-body-unreadable` — logged in a single line that contains no payload.
+  - The delivery body is read through a bounded reader instead of `ctx.arrayBuffer()`, which buffers whatever an unauthenticated caller sends. Gitea and GitLab always declare a `Content-Length`, so a delivery without a parsable one is refused as `webhook-length-missing` (411) before its body is touched, and the declared length is then verified against a running 1 MiB budget so a forged short `Content-Length` is refused the moment the bound is crossed.
+  - A connection whose webhook secret is stored but unreadable (a secret-store failure such as the SmartSecret keyring quota) is no longer treated as a connection without a secret: it is flagged at load time, its deliveries are refused as `webhook-secret-unreadable` (503), and neither the backfill nor any later persist mints or deletes anything under its keychain id, so a confirmed operator secret survives the outage. Rotating remains the explicit way to replace it.
+  - The broadcast now reports the connection's own provider type instead of the one the caller claimed.
+  - The provider header names are spelled as Gitea and GitLab document them (`X-Gitea-Signature`, `X-Gitlab-Token`, `X-Gitea-Event`, `X-Gitlab-Event`); header lookup is case-insensitive, so the webhook dialog now shows the operator exactly the name the provider uses.
+
+### Maintenance
+
+- Move the Docker release tooling to `@git.zone/tsdocker` 3.6.0 (deps)
+
+## 2026-09-19 - 32.0.0
+
+### Breaking Changes
+
+- Join the serve.zone 32 line; images publish version tags only (release)
+  - @serve.zone/gitops releases as 32.0.0 together with the rest of the serve.zone platform repositories.
+  - The Dockerfile is now `Dockerfile_##version##`, so the image publishes `:32.0.0` only. `code.foss.global/serve.zone/gitops:latest` freezes at the 3.1.1 build and is no longer moved by a release.
+  - Every image is qualified inside the container by `test/test_latest.sh` before it is pushed; a missing test script now fails the release instead of warning. The script compares the versions in package.json, deno.json and the compiled commitinfo, then starts the real `GitopsApp` and requires the route the HEALTHCHECK probes to answer.
+  - Working notes leave the package root: `readme.todo.md` now lives untracked in `.nogit/`. npm force-includes every root `readme.*` regardless of the `files` list, so the published tarball had been shipping the TODO list; `npm pack --dry-run` now lists `readme.md` only.
+
+### Fixes
+
+- Use SmartMongo 9 and TSTest 6 with NoSQLDB, update cache documentation and fixture naming, and rebuild the browser bundle.
+
+### Maintenance
+
+- Bring the build, test and release tooling to the 32-train baseline (deps)
+  - pnpm 12.4.1 (`packageManager`), @git.zone/tsbuild 4.5.0, @git.zone/tsbundle 2.13.0, @git.zone/tsdeno 1.8.0, @git.zone/tsdocker 3.5.9, @git.zone/tsrun 2.0.6, @git.zone/tstest 6.1.1, @types/node 26.5.1.
+
 ## 2026-06-14 - 3.1.1
 
 ### Fixes

package/deno.json

@@ -1,6 +1,6 @@
 {
   "name": "@serve.zone/gitops",
-  "version": "3.1.1",
+  "version": "32.1.0",
   "exports": "./binary/gitops.ts",
   "compile": {
     "include": [