[yahia008]

Summary

Harden CI, add e2e dependency updates, remove stale dead_code allows, and stop proxy header override

What was solved

#899 — Harden CI workflows: no permissions block, no concurrency, actions on mutable tags, Node 20 (EOL), and uncached tool installs

Harden .github/workflows/ci.yml per the issue: add least-privilege top-level permissions (with checks: write scoped to the audit job), add a concurrency group that cancels superseded non-main runs, pin third-party actions to full commit SHAs with version comments, bump the openapi job from Node 20 to Node 22, and pin/cache the cargo-tarpaulin install (via --version and/or taiki-e/install-action). The Dockerfile's cargo-chef install is mentioned but is outside the workflow file; keep changes focused on ci.yml unless a minimal Dockerfile pin is clearly warranted.

Addressed:

• Changed: .github/workflows/ci.yml, Dockerfile, .github/workflows/ci.yml
• ci.yml declares least-privilege permissions (top-level contents: read, with checks: write only on the audit job for rustsec/audit-check)
• Add concurrency: { group: ci-${{ github.ref }}, cancel-in-progress: true } so superseded PR runs are cancelled (non-main refs)
• Pin every third-party action in ci.yml to a full commit SHA with a version comment (checkout, rust-toolchain, cache, audit-check, install-action, etc.)

#900 — Dependabot doesn't cover the npm lockfile in e2e/, so Playwright and its transitive dependencies never get updates

Add an npm Dependabot ecosystem entry for the e2e/ Playwright project so its lockfile gets grouped weekly updates, and optionally add an npm audit step to the supply-chain workflow.

Addressed:

• Changed: .github/dependabot.yml, .github/workflows/supply-chain.yml
• Add an npm package-ecosystem entry to .github/dependabot.yml targeting directory: "/e2e" with a weekly Monday 07:00 schedule and open-pull-requests-limit: 5.
• Configure groups: a playwright group matching @playwright/* and playwright*, and a patch-and-minor group for minor/patch updates.
• Set labels: ["dependencies"] and commit-message.prefix: "chore(deps-e2e)" on the npm entry.

#901 — Remove stale #[allow(dead_code)] attributes whose comments say the code is unused when it is used

Remove the two stale #[allow(dead_code)] attributes and their misleading comments from reset_secs in src/api/mod.rs and delivery_to_json in src/api/payments.rs, since both functions are now called in production paths. Optionally scan other allow(dead_code) occurrences in src/ and remove any that are similarly stale, but keep edits surgical and limited to the issue's stated goal.

Addressed:

• Changed: README.md
• Delete #[allow(dead_code)] and the misleading comment above reset_secs in src/api/mod.rs
• Delete #[allow(dead_code)] and the misleading comment above delivery_to_json in src/api/payments.rs
• Do not change function signatures, bodies, or callers

#902 — The Caddy reverse-proxy config overwrites the app's Referrer-Policy: no-referrer with a weaker policy

Fix the production Caddy reverse-proxy config so it no longer overrides the app's stricter Referrer-Policy: no-referrer (and redundant X-Content-Type-Options), extend scripts/check-deploy-consistency.sh to catch regressions where the Caddyfile sets an app-owned security header with a different value, and document in DEPLOYMENT.md that the app owns its security headers and the proxy must not override them.

Addressed:

• Changed: deploy/Caddyfile, scripts/check-deploy-consistency.sh, scripts/check-deploy-consistency.sh
• Remove Referrer-Policy and X-Content-Type-Options from the deploy/Caddyfile header block (or use Caddy's ?Header value fallback form) so responses through production Caddy carry Referrer-Policy: no-referrer as set by the app.
• Extend scripts/check-deploy-consistency.sh to fail if the Caddyfile sets an app-owned security header with a value differing from what the app sets.
• Add a sentence to DEPLOYMENT.md stating the app owns its security headers and the proxy must not override them.

Changes

• Dockerfile (modify)
• README.md (modify)
• .github/workflows/ci.yml (modify)
• .github/workflows/supply-chain.yml (modify)
• scripts/check-deploy-consistency.sh (modify)
• .github/dependabot.yml (modify)
• deploy/Caddyfile (modify)

Approach

1. Harden CI workflows: no permissions block, no concurrency, actions on mutable tags, Node 20 (EOL), and uncached tool installs #899 — Harden CI workflows: no permissions block, no concurrency, actions on mutable tags, Node 20 (EOL), and uncached tool installs (Changed: .github/workflows/ci.yml, Dockerfile, .github/workflows/ci.yml)
2. Dependabot doesn't cover the npm lockfile in e2e/, so Playwright and its transitive dependencies never get updates #900 — Dependabot doesn't cover the npm lockfile in e2e/, so Playwright and its transitive dependencies never get updates (Changed: .github/dependabot.yml, .github/workflows/supply-chain.yml)
3. Remove stale #[allow(dead_code)] attributes whose comments say the code is unused when it is used #901 — Remove stale #[allow(dead_code)] attributes whose comments say the code is unused when it is used (Changed: README.md)
4. The Caddy reverse-proxy config overwrites the app's Referrer-Policy: no-referrer with a weaker policy #902 — The Caddy reverse-proxy config overwrites the app's Referrer-Policy: no-referrer with a weaker policy (Changed: deploy/Caddyfile, scripts/check-deploy-consistency.sh, scripts/check-deploy-consistency.sh)

Issues

Closes #899
Closes #900
Closes #901
Closes #902

[drips-wave]

@yahia008 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits