release: dependency scanner + CDN release delivery #566

Merged

jmiller merged 6 commits from dev into main 2026-06-07 16:39:31 +00:00

Conversation 0 Commits 6 Files Changed 14

+927 -4

jmiller commented 2026-06-07 16:25:41 +00:00

Owner

Copy Link

Copy Source

Summary

Merge dev to main for production deployment.

New Features

• Dependency vulnerability scanner (#551) - parses go.mod, package.json, composer.json, requirements.txt and checks against OSV.dev API for known CVEs
• Built-in CDN for release assets (#561) - serves release assets via cdn.mokoconsulting.tech with per-asset public/private toggles, IP/referrer allowlists, and aggressive caching headers

Infrastructure

• CDN CNAME configured: cdn.mokoconsulting.tech -> git.mokoconsulting.tech
• TLS cert issued via Let's Encrypt (expires 2026-09-05)
• Nginx reverse proxy configured for CDN hostname
• Production app.ini updated with [cdn] section

## Summary Merge dev to main for production deployment. ### New Features - **Dependency vulnerability scanner** (#551) - parses go.mod, package.json, composer.json, requirements.txt and checks against OSV.dev API for known CVEs - **Built-in CDN for release assets** (#561) - serves release assets via cdn.mokoconsulting.tech with per-asset public/private toggles, IP/referrer allowlists, and aggressive caching headers ### Infrastructure - CDN CNAME configured: cdn.mokoconsulting.tech -> git.mokoconsulting.tech - TLS cert issued via Let's Encrypt (expires 2026-09-05) - Nginx reverse proxy configured for CDN hostname - Production app.ini updated with [cdn] section

jmiller added 4 commits 2026-06-07 16:25:42 +00:00

feat(security): add dependency vulnerability scanner (#551) ... 18fc79fa0a

Add dependency scanner module that parses manifest files (go.mod,
package.json, composer.json, requirements.txt) and checks dependencies
against the OSV.dev API for known CVEs. Implements the existing Scanner
interface and wires into the orchestrator for push-time scanning.

feat(cdn): built-in CDN for release asset delivery (#561) ... 37d59e7b59

Add CDN system that serves release assets via a dedicated hostname
(e.g., cdn.mokoconsulting.tech) with per-asset public/private toggles,
IP/referrer allowlists, and aggressive caching headers.

- Host-based routing intercepts CDN domain before auth middleware
- Per-attachment cdn_public flag controls CDN visibility
- Releases in an update stream are excluded from CDN (update server takes precedence)
- CORS, ETag, Cache-Control headers for downstream CDN compatibility
- IP/CIDR and referrer domain allowlists for abuse prevention

Merge pull request 'feat(security): dependency vulnerability scanner' (#562) from feat/dependency-scanner into dev 75316bf80a

Merge pull request 'feat(cdn): built-in CDN for release asset delivery' (#565) from feat/cdn-release-delivery into dev 78803e60df

jmiller added 2 commits 2026-06-07 16:39:16 +00:00

fix(licensing): hide require-key option for Joomla update servers ... 74279c55e3

Joomla's update system does not support license key authentication,
so hide the "Require license key for update feeds" checkbox when
the platform is set to Joomla or Joomla+Dolibarr.

Merge pull request 'fix(licensing): hide require-key option for Joomla update servers' (#567) from fix/hide-joomla-require-key into dev b6b4d6f525

jmiller merged commit 9adcac546f into main 2026-06-07 16:39:31 +00:00

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

Clear labels

breaking-change

Breaking API or behavior change

ci-cd

CI/CD pipeline changes

config

Configuration changes

dependencies

Dependency updates

deploy-failure

Deployment failed

docker

Docker/container changes

documentation

Documentation changes

good first issue

Good for newcomers

health-check

Repo health check result

help wanted

Extra attention needed

mokostandards

Related to MokoStandards framework

push-failure

Git push operation failed

security

Security vulnerability or hardening

size/l

200-500 lines changed

size/m

50-200 lines changed

size/s

10-50 lines changed

size/xl

500+ lines changed

size/xs

< 10 lines changed

standards-drift

Deviates from MokoStandards

standards-update

MokoStandards compliance update

sync-failure

Sync or mirror failed

tech-debt

Technical debt and TODO/FIXME items

upstream

upstream

Inherited from upstream Gitea

work-in-progress

Draft or incomplete work

No labels

Priority -

Type -

Milestone

No items

No Milestone

Assignees

Clear assignees

jmiller (Jonathan Miller) moko-deploy (Moko Deploy Bot)

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: MokoConsulting/MokoGitea-APP#566