feat!: invert ssl_verify_certificate default from false to true (#44)

BREAKING CHANGE: the default of `ssl_verify_certificate` is
flipped from `false` to `true`. This is the v2.0.0 cut the audit
(PROPOSAL.md §3.1 #1, MP-1) called for, after a long discussion of
the trade-off: the old default made MITM trivial, the new default
breaks every existing user that connected to a self-signed or
direct-IP server.

The change is one line in action.yml plus a matching default in
the FTP_SETTINGS block of init.sh (the latter only matters when
the action is run outside the GitHub Actions defaulting
mechanism, e.g. for local smoke tests). The README's 'Security
and SSL' section is rewritten to document the new default and
the explicit opt-out path. The CHANGELOG gets a new
`## [2.0.0] - TBD` section that calls out the breaking change
and the compat-preserving nature of the v1.4 / v1.5 work that
preceded it.

Migration for existing users:

```yaml
- uses: airvzxf/ftp-deployment-action@v1   # still on the old default
- uses: airvzxf/ftp-deployment-action@v2   # will fail on self-signed
  with:
    server: ${{ secrets.FTP_SERVER }}
    user:   ${{ secrets.FTP_USERNAME }}
    password: ${{ secrets.FTP_PASSWORD }}
    ssl_verify_certificate: 'false'        # opt back into v1.x behaviour
```

Validation:
* shellcheck, actionlint, hadolint (error threshold), contract test
  and smoke test all green — the change is a one-line default flip,
  no other code paths are affected.
* Verified the new default reaches lftp by inspecting
  `FTP_SETTINGS` in the smoke-test output: it now contains
  `set ssl:verify-certificate true;` when no input override is
  provided.

Recommended next steps for the maintainer (out of scope for this
PR):
* Tag this commit as v2.0.0 after merge.
* Cut a v1.3.4 release off master ~at v1.3.3 (no behaviour change)
  for users who want to pin to the last v1.x line and never see
  this default flip.
* Add a `v1` major-version ref pointing at the v1.3.x series so
  `@v1` resolves to the last v1.x release.

Author: airvzxf

CHANGELOG.md

@@ -5,6 +5,31 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [2.0.0] - TBD
+
+### Breaking
+
+- `ssl_verify_certificate` default changed from `"false"` to `"true"`.
+  This is a behaviour change for every existing v1.x user that relied
+  on the lax default to connect to a self-signed or direct-IP
+  server. With v2.0.0, the action refuses to connect to a server
+  with an invalid, expired, or hostname-mismatched certificate.
+  To opt back into the v1.x behaviour, set
+  `ssl_verify_certificate: "false"` explicitly in your workflow.
+
+  This is the breaking change promised in the original audit
+  (PROPOSAL.md §3.1 #1 and the MP-1 entry). All other v1.x→v2.0.0
+  changes are behaviour-preserving (the security hardening and
+  validation work in v1.4.0 and v1.5.0 is compatible with the
+  v1.x contract).
+
+### Changed
+
+- README: the "Security and SSL" section now documents the new
+  default and the opt-out path; the warning is no longer about a
+  known-insecure default but about the rare case of a user
+  explicitly opting back into the v1.x lax behaviour.
+
 ## [Unreleased]
 
 ### Added
@@ -81,5 +106,6 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 Historical. See git history for changes prior to `CHANGELOG.md` adoption.
 
-[Unreleased]: https://github.com/airvzxf/ftp-deployment-action/compare/v1.3.3...HEAD
+[Unreleased]: https://github.com/airvzxf/ftp-deployment-action/compare/v2.0.0...HEAD
+[2.0.0]: https://github.com/airvzxf/ftp-deployment-action/compare/v1.3.3...v2.0.0
 [1.3.3]: https://github.com/airvzxf/ftp-deployment-action/releases/tag/v1.3.3

README.md

@@ -4,9 +4,9 @@ This GitHub action copies the files via FTP from your Git project to your server
 
 ## Security and SSL
 
-By default, `ftp_ssl_allow` is set to `true` to ensure your connection is encrypted. However, `ssl_verify_certificate` is set to `false` by default. This means your data is encrypted during transfer, but the Action does not verify if the server's certificate is valid or matches the hostname. This prevents connection errors with self-signed certificates or direct IP connections but leaves you vulnerable to Man-in-the-Middle (MITM) attacks if someone spoofs your DNS.
+By default, `ftp_ssl_allow` is set to `true` to ensure your connection is encrypted, and `ssl_verify_certificate` is also set to `true`, so the action refuses to connect to a server with an invalid, expired, or hostname-mismatched certificate. **This is a breaking change from v1.x**: if you connect to a server with a self-signed certificate or a direct IP, the action will now fail with a TLS error. To opt back into the v1.x behaviour, set `ssl_verify_certificate: false` explicitly in your workflow.
 
-If you require strict security, set `ssl_verify_certificate: true` and ensure your server has a valid certificate matching the hostname used.
+> **Note on direct-IP connections**: lftp cannot validate a hostname against an IP-address certificate, so `ssl_verify_certificate: true` requires both a valid certificate and a hostname (not a bare IP) in the `server` input.
 
 ## Usage Example
 

action.yml

@@ -44,7 +44,7 @@ inputs:
   ssl_verify_certificate:
     description: 'Verify SSL certificate.'
     required: false
-    default: 'false'
+    default: 'true'
   ssl_check_hostname:
     description: 'Check certificate hostname.'
     required: false

init.sh

@@ -189,7 +189,7 @@ fi
 if [ -n "${INPUT_SSL_VERIFY_CERTIFICATE}" ]; then
   FTP_SETTINGS="${FTP_SETTINGS}set ssl:verify-certificate ${INPUT_SSL_VERIFY_CERTIFICATE};"
 else
-  FTP_SETTINGS="${FTP_SETTINGS}set ssl:verify-certificate false;"
+  FTP_SETTINGS="${FTP_SETTINGS}set ssl:verify-certificate true;"
 fi
 
 # ssl:check-hostname