chore: merge v1.4.0 content from dev to main for the release (#29)

Author: 0xCyr

.dockerignore

@@ -3,8 +3,8 @@
 __pycache__/
 *.py[cod]
 
-data/
-shares/
+/data/
+/shares/
 
 docker-compose.yml
 

.github/workflows/release.yml

@@ -11,40 +11,49 @@ on:
 jobs:
   verify-and-release:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
         with:
           fetch-depth: 0
           fetch-tags: true
+          persist-credentials: false
 
       - name: Validate tag format
         run: |
-          TAG="${{ github.event.inputs.tag }}"
+          TAG="${GITHUB_EVENT_INPUTS_TAG}"
           if [[ ! $TAG =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
             echo "❌ Invalid tag format. Expected format: v1.2.3"
             exit 1
           fi
           echo "✅ Tag format is valid: $TAG"
+        env:
+          GITHUB_EVENT_INPUTS_TAG: ${{ github.event.inputs.tag }}
 
       - name: Verify tag exists
         run: |
-          TAG="${{ github.event.inputs.tag }}"
+          TAG="${GITHUB_EVENT_INPUTS_TAG}"
           if ! git rev-parse --verify "refs/tags/$TAG" >/dev/null 2>&1; then
             echo "❌ Tag '$TAG' does not exist in the repository"
             echo "Available tags:"
             git tag --sort=-version:refname | head -10
             exit 1
           fi
           echo "✅ Tag '$TAG' exists"
+        env:
+          GITHUB_EVENT_INPUTS_TAG: ${{ github.event.inputs.tag }}
 
       - name: Checkout specific tag
         run: |
-          git checkout ${{ github.event.inputs.tag }}
+          git checkout ${GITHUB_EVENT_INPUTS_TAG}
+        env:
+          GITHUB_EVENT_INPUTS_TAG: ${{ github.event.inputs.tag }}
 
       - name: Verify GPG signature on tag
         run: |
-          TAG="${{ github.event.inputs.tag }}"
+          TAG="${GITHUB_EVENT_INPUTS_TAG}"
           
           # Force fetch the complete tag object (not just commit reference)
           echo "=== Fetching Tag Object ==="
@@ -72,49 +81,61 @@ jobs:
           
           # Cleanup
           rm /tmp/pubkey.asc
+        env:
+          GITHUB_EVENT_INPUTS_TAG: ${{ github.event.inputs.tag }}
 
       - name: Get version from tag
         id: get_version
         run: |
-          TAG="${{ github.event.inputs.tag }}"
+          TAG="${GITHUB_EVENT_INPUTS_TAG}"
           VERSION=${TAG#v}
           echo "version=$VERSION" >> $GITHUB_OUTPUT
           echo "tag=$TAG" >> $GITHUB_OUTPUT
+        env:
+          GITHUB_EVENT_INPUTS_TAG: ${{ github.event.inputs.tag }}
 
       - name: Package repository
         run: |
           mkdir -p dist
           
           # Create source package
-          zip -r dist/fractum-${{ steps.get_version.outputs.version }}-source.zip \
+          zip -r dist/fractum-${STEPS_GET_VERSION_OUTPUTS_VERSION}-source.zip \
             src/ \
             packages/ \
+            tests/ \
             bootstrap-*.sh \
             bootstrap-*.ps1 \
             Dockerfile \
+            .dockerignore \
+            assets \
             setup.py \
             README.md \
             LICENSE \
             --exclude="*.pyc" \
             --exclude="__pycache__/*" \
+            --exclude="*.DS_Store" \
             --exclude=".git/*"
           
           # Create checksums
           cd dist
-          sha256sum fractum-${{ steps.get_version.outputs.version }}-source.zip > checksums.txt
+          sha256sum fractum-${STEPS_GET_VERSION_OUTPUTS_VERSION}-source.zip > checksums.txt
+        env:
+          STEPS_GET_VERSION_OUTPUTS_VERSION: ${{ steps.get_version.outputs.version }}
 
       - name: Extract release notes from tag
         id: release_notes
         run: |
-          TAG="${{ github.event.inputs.tag }}"
+          TAG="${GITHUB_EVENT_INPUTS_TAG}"
           # Extract release notes from signed tag message
           NOTES=$(git tag -l --format='%(contents)' $TAG)
           echo "notes<<EOF" >> $GITHUB_OUTPUT
           echo "$NOTES" >> $GITHUB_OUTPUT
           echo "EOF" >> $GITHUB_OUTPUT
+        env:
+          GITHUB_EVENT_INPUTS_TAG: ${{ github.event.inputs.tag }}
 
       - name: Create GitHub Release
-        uses: softprops/action-gh-release@v2.2.2
+        uses: softprops/action-gh-release@da05d552573ad5aba039eaac05058a918a7bf631  # v2.2.2
         with:
           tag_name: ${{ steps.get_version.outputs.tag }}
           name: Fractum ${{ steps.get_version.outputs.tag }}
@@ -155,6 +176,9 @@ jobs:
 
       - name: Update website release info
         run: |
-          echo "🚀 Released Fractum ${{ steps.get_version.outputs.version }}"
-          echo "Tag: ${{ steps.get_version.outputs.tag }}"
-          echo "Signature verified: ✅"
+          echo "🚀 Released Fractum ${STEPS_GET_VERSION_OUTPUTS_VERSION}"
+          echo "Tag: ${STEPS_GET_VERSION_OUTPUTS_TAG}"
+          echo "Signature verified: ✅"
+        env:
+          STEPS_GET_VERSION_OUTPUTS_VERSION: ${{ steps.get_version.outputs.version }}
+          STEPS_GET_VERSION_OUTPUTS_TAG: ${{ steps.get_version.outputs.tag }}

.gitignore

@@ -4,7 +4,19 @@ src.egg-info
 build
 env
 __pycache__
+.pytest_cache
+.ruff_cache
 .python-version
 .venv
-data
-shares/
+/data
+/shares/
+
+# Tooling local — ne pas committer
+.claude/
+_bmad/
+
+# Artefacts des outils de scan IA
+.vulnhuntr_checkpoint/
+vulnhuntr.log
+reports/
+strix_runs/

Dockerfile

@@ -1,4 +1,4 @@
-FROM python:3.12.11-slim
+FROM python:3.12.11-slim@sha256:47ae396f09c1303b8653019811a8498470603d7ffefc29cb07c88f1f8cb3d19f
 
 WORKDIR /app
 
@@ -7,11 +7,21 @@ COPY src/ /app/src/
 COPY tests/ /app/tests/
 COPY packages/ /app/packages/
 
-# Install dependencies
-RUN pip install --no-cache-dir -e .
+# Install dependencies — verify offline packages if present (M6)
+RUN if [ -f packages/CHECKSUMS.sha256 ] && [ -f packages/CHECKSUMS.sha256.asc ]; then \
+      gpg --verify packages/CHECKSUMS.sha256.asc packages/CHECKSUMS.sha256 \
+        || { echo "ERROR: Invalid GPG signature on packages"; exit 1; }; \
+    fi; \
+    if [ -f packages/CHECKSUMS.sha256 ]; then \
+      (cd packages && sha256sum --check CHECKSUMS.sha256 --strict --quiet) \
+        || { echo "ERROR: Package hash mismatch"; exit 1; }; \
+      pip install --no-cache-dir --no-index --find-links=packages -e .; \
+    else \
+      pip install --no-cache-dir -e .; \
+    fi
 
 # Create data directory and shares directory with proper permissions
-RUN mkdir -p /data /app/shares && chmod 777 /data /app/shares
+RUN mkdir -p /data /app/shares && chmod 750 /data /app/shares
 
 # Create non-root user
 RUN adduser --disabled-password --gecos "" fractumuser