[major] Harden the Vault proxy boundary

.dockerignore

@@ -0,0 +1,5 @@
+.git
+.github
+config.yaml
+coverage.out
+vault-proxy

.github/workflows/github-release.yaml

@@ -1,15 +1,18 @@
 name: Create release
+
 on:
   pull_request_target:
     branches:
       - main
     types:
       - closed
+
 jobs:
   release:
     if: github.event.pull_request.merged == true && !contains(github.event.pull_request.title, 'skip-release')
-    uses: libops/.github/.github/workflows/bump-release.yaml@d7f0ba06b4c8a1f8559892ea65a0b1af4d024dd3 # main
+    uses: libops/.github/.github/workflows/bump-release.yaml@578137212ead4ab4059e95df17fa30e9b7ac4aed
+    with:
+      workflow_file: goreleaser.yaml
     permissions:
       contents: write
       actions: write
-    secrets: inherit

.github/workflows/goreleaser.yaml

@@ -1,32 +1,60 @@
 name: goreleaser
+
 on:
   workflow_dispatch:
   push:
     tags:
       - "*"
 
 permissions:
-  contents: write
+  contents: read
 
 jobs:
+  test:
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false
+      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
+        with:
+          go-version-file: go.mod
+      - run: |
+          go mod download
+          go mod verify
+          go mod tidy -diff
+          go test -race ./...
+
   goreleaser:
+    needs: [test]
     runs-on: ubuntu-24.04
+    permissions:
+      contents: write
     steps:
-      - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           fetch-depth: 0
-
-      - name: Set up Go
-        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
+          persist-credentials: false
+      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
         with:
-          go-version: ">=1.25.6"
-
-      - name: Run GoReleaser
-        uses: goreleaser/goreleaser-action@5daf1e915a5f0af01ddbcd89a43b8061ff4f1a89 # v7
+          go-version-file: go.mod
+      - uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7
         with:
           distribution: goreleaser
-          version: latest
+          version: v2.17.0
           args: release --clean
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+  publish-images:
+    if: github.ref_type == 'tag'
+    needs: [test, goreleaser]
+    permissions:
+      contents: read
+      id-token: write
+      packages: write
+    uses: ./.github/workflows/lint-test-build-push.yaml
+    secrets:
+      CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
+      GCLOUD_OIDC_POOL: ${{ secrets.GCLOUD_OIDC_POOL }}
+      GSA: ${{ secrets.GSA }}

.github/workflows/lint-test-build-push.yaml

@@ -1,45 +1,136 @@
-name: lint-test-build-push
+name: build-push
+
 on:
+  workflow_call:
+    secrets:
+      CODECOV_TOKEN:
+        required: false
+      GCLOUD_OIDC_POOL:
+        required: false
+      GSA:
+        required: false
+  pull_request:
   push:
+    branches:
+      - main
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
 jobs:
-  test:
-    permissions:
-      contents: read
+  lint-test:
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
-          go-version: ">=1.25.0"
+          fetch-depth: 0
+          persist-credentials: false
 
-      - name: golangci-lint
-        uses: golangci/golangci-lint-action@82606bf257cbaff209d206a39f5134f0cfbfd2ee # v9
+      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
         with:
-          version: latest
+          go-version-file: go.mod
 
-      - name: Install dependencies
-        run: go get .
+      - name: Download and verify modules
+        run: |
+          go mod download
+          go mod verify
+          go mod tidy -diff
+
+      - name: Lint
+        uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9
+        with:
+          version: v2.12.2
+
+      - name: Test
+        run: go test -race -coverprofile=coverage.out -covermode=atomic ./...
 
       - name: Build
-        run: go build -v
+        run: go build -trimpath ./...
+
+      - name: Validate release configuration
+        uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7
+        with:
+          distribution: goreleaser
+          version: v2.17.0
+          args: check
 
-      - name: Test with the Go CLI
-        run: go test -v -race -coverprofile=coverage.out -covermode=atomic .
+      - name: Exercise snapshot release
+        uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7
+        with:
+          distribution: goreleaser
+          version: v2.17.0
+          args: release --snapshot --clean
 
-      - name: upload coverage to codecov
-        uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 # v6
+      - name: Upload coverage
+        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v6
         with:
           files: ./coverage.out
           fail_ci_if_error: false
         env:
           CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
 
-  build-push:
-    needs: [test]
-    uses: libops/.github/.github/workflows/build-push.yaml@d7f0ba06b4c8a1f8559892ea65a0b1af4d024dd3 # main
+  image-check:
+    if: github.event_name == 'pull_request'
+    strategy:
+      matrix:
+        runner:
+          - ubuntu-24.04
+          - ubuntu-24.04-arm
+    runs-on: ${{ matrix.runner }}
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false
+
+      - uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3
+
+      - name: Resolve native platform
+        id: platform
+        run: |
+          set -euo pipefail
+          case "$RUNNER_ARCH" in
+            X64) platform=amd64 ;;
+            ARM64) platform=arm64 ;;
+            *) echo "Unsupported runner architecture: $RUNNER_ARCH" >&2; exit 1 ;;
+          esac
+          echo "name=$platform" >> "$GITHUB_OUTPUT"
+
+      - name: Build native image without credentials
+        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6
+        with:
+          context: .
+          load: true
+          platforms: linux/${{ steps.platform.outputs.name }}
+          provenance: false
+          push: false
+          tags: vault-proxy:ci-${{ steps.platform.outputs.name }}
+
+      - name: Scan native image
+        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
+        with:
+          image-ref: vault-proxy:ci-${{ steps.platform.outputs.name }}
+          format: table
+          exit-code: "1"
+          ignore-unfixed: true
+          severity: HIGH,CRITICAL
+          vuln-type: os,library
+
+  publish:
+    if: github.event_name != 'pull_request'
+    needs: [lint-test]
+    uses: libops/.github/.github/workflows/build-push.yaml@578137212ead4ab4059e95df17fa30e9b7ac4aed # guarded-signed-image-publisher
     with:
-      docker-registry: "libops"
+      ref: ${{ github.sha }}
+      expected-main-sha: ${{ github.ref == 'refs/heads/main' && github.sha || '' }}
+      additional-gar-registry: us-docker.pkg.dev/libops-images/public
+      scan: true
+      sign: true
+      certificate-identity: https://github.com/libops/.github/.github/workflows/build-push.yaml@578137212ead4ab4059e95df17fa30e9b7ac4aed
     permissions:
       contents: read
       packages: write
-    secrets: inherit
+      id-token: write
+    secrets:
+      GCLOUD_OIDC_POOL: ${{ secrets.GCLOUD_OIDC_POOL }}
+      GSA: ${{ secrets.GSA }}

.goreleaser.yml

@@ -1,6 +1,5 @@
-before:
-  hooks:
-    - go mod tidy
+version: 2
+
 builds:
   - binary: vault-proxy
     env:
@@ -11,7 +10,8 @@ builds:
       - darwin
 
 archives:
-  - format: tar.gz
+  - formats:
+      - tar.gz
     # this name template makes the OS and Arch compatible with the results of uname.
     name_template: >-
       {{ .ProjectName }}_
@@ -23,11 +23,12 @@ archives:
     # use zip for windows archives
     format_overrides:
       - goos: windows
-        format: zip
+        formats:
+          - zip
 checksum:
   name_template: "checksums.txt"
 snapshot:
-  name_template: "{{ incpatch .Version }}-next"
+  version_template: "{{ incpatch .Version }}-next"
 changelog:
   sort: asc
   filters:

Dockerfile

@@ -1,69 +1,26 @@
-FROM golang:1.25-alpine3.22@sha256:d3f0cf7723f3429e3f9ed846243970b20a2de7bae6a5b66fc5914e228d831bbb AS builder
+FROM ghcr.io/libops/go:1.26.5@sha256:ea764e85e42a243217c621891123b3fda9374674c29d59785414fc6b15815b3d AS builder
 
-SHELL ["/bin/ash", "-o", "pipefail", "-ex", "-c"]
-
-WORKDIR /app
-
-ARG \
-    # renovate: datasource=repology depName=alpine_3_22/ca-certificates
-    CA_CERTIFICATES_VERSION=20250911-r0 \
-    # renovate: datasource=repology depName=alpine_3_22/dpkg
-    DPKG_VERSION=1.22.15-r0 \
-    # renovate: datasource=repology depName=alpine_3_22/gnupg
-    GNUPG_VERSION=2.4.9-r0 \
-    # renovate: datasource=github-releases depName=gosu packageName=tianon/gosu
-    GOSU_VERSION=1.19
-
-RUN apk add --no-cache --virtual .gosu-deps \
-    ca-certificates=="${CA_CERTIFICATES_VERSION}" \
-    dpkg=="${DPKG_VERSION}" \
-    gnupg=="${GNUPG_VERSION}" && \
-    dpkgArch="$(dpkg --print-architecture | awk -F- '{ print $NF }')" && \
-    wget -q -O /usr/local/bin/gosu "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-$dpkgArch" && \
-    wget -q -O /usr/local/bin/gosu.asc "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-$dpkgArch.asc" && \
-    GNUPGHOME="$(mktemp -d)" && \
-    export GNUPGHOME && \
-    gpg --batch --keyserver hkps://keys.openpgp.org --recv-keys B42F6819007F00F88E364FD4036A9C25BF357DD4 && \
-    gpg --batch --verify /usr/local/bin/gosu.asc /usr/local/bin/gosu && \
-    gpgconf --kill all && \
-    rm -rf "$GNUPGHOME" /usr/local/bin/gosu.asc && \
-    apk del --no-network .gosu-deps && \
-    chmod +x /usr/local/bin/gosu && \
-    echo "gosu install complete."
+WORKDIR /src
 
 COPY go.mod go.sum ./
 RUN --mount=type=cache,target=/go/pkg/mod \
-    go mod download
+    go mod download && \
+    go mod verify
 
 COPY main.go ./
 
+ARG TARGETOS=linux
+ARG TARGETARCH
 RUN --mount=type=cache,target=/root/.cache/go-build \
-    CGO_ENABLED=0 go build -ldflags="-s -w" -o /app/vault-proxy .
-
-FROM alpine:3.22@sha256:4b7ce07002c69e8f3d704a9c5d6fd3053be500b7f1c69fc0d80990c2ad8dd412
-
-SHELL ["/bin/ash", "-o", "pipefail", "-c"]
+    CGO_ENABLED=0 GOOS="${TARGETOS}" GOARCH="${TARGETARCH}" \
+    go build -buildvcs=false -trimpath -ldflags="-s -w" -o /out/vault-proxy .
 
-ARG \
-    # renovate: datasource=repology depName=alpine_3_22/curl
-    CURL_VERSION=8.14.1-r2 \
-    # renovate: datasource=repology depName=alpine_3_22/jq
-    JQ_VERSION=1.8.1-r0
+FROM scratch
 
+COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
+COPY --from=builder /out/vault-proxy /vault-proxy
 
-RUN apk add --no-cache \
-    curl=="${CURL_VERSION}" \
-    jq=="${JQ_VERSION}"
-
-RUN adduser -S -G nobody -u 8080 vault-proxy
-
-WORKDIR /app
-
-COPY --from=builder /app/vault-proxy /app/vault-proxy
-COPY --from=builder /usr/local/bin/gosu /usr/local/bin/gosu
-
+USER 65532:65532
 EXPOSE 8080
 
-ENTRYPOINT ["gosu", "vault-proxy", "/app/vault-proxy", "-config", "/app/config.yaml"]
-
-HEALTHCHECK CMD curl -sf http://localhost:8080/v1/sys/health | jq .sealed | grep -q false
+ENTRYPOINT ["/vault-proxy"]