fix: harden auth, secrets at rest, payments, and webhooks

.cargo/audit.toml

@@ -2,7 +2,10 @@
 # quick-xml <0.41 DoS (RUSTSEC-2026-0194/0195). Only reachable via trusted XML
 # (object_store cloud API responses, typst-bundled themes/CSL styles). No
 # object_store/plist/citationberg release depends on quick-xml >=0.41 yet; drop these when one does.
+# rkyv 0.7 (RUSTSEC-2026-0235) reaches Cargo.lock only through rust_decimal's optional `rkyv`
+# feature, which nothing here enables; `cargo tree -e normal -i rkyv` finds no path to it.
 ignore = [
     "RUSTSEC-2026-0194",
     "RUSTSEC-2026-0195",
+    "RUSTSEC-2026-0235",
 ]

.github/workflows/ci-rust.yaml

@@ -81,11 +81,6 @@ jobs:
           sudo docker builder prune -a
           df -h
       - uses: ./.github/actions/rust-setup
-      - name: Login to Docker Hub
-        uses: docker/login-action@v4
-        with:
-          username: ${{ secrets.DOCKER_HUB_USERNAME }}
-          password: ${{ secrets.DOCKER_HUB_PASSWORD }}
       - name: Install nextest
         uses: taiki-e/install-action@v2
         with:

.github/workflows/docker.yaml

@@ -1,12 +1,14 @@
 name: Docker Build
 
 on:
+  workflow_dispatch:
   release:
     types:
       - published
   push:
     branches:
       - main
+      - triton-main
       - '*docker*'
 
 concurrency:
@@ -54,14 +56,28 @@ jobs:
       - uses: actions/checkout@v7
       - name: Set up Cargo CI config
         run: |
-          mkdir -p .cargo && ln -s ../.cargo-templates/ci.toml $_/config.toml
+          mkdir -p .cargo
+          ln -s ../.cargo-templates/ci.toml .cargo/config.toml
       - name: Prepare env
         run: |
           platform=${{ matrix.platform }}
-          echo "PLATFORM_PAIR=${platform//\//-}" >> $GITHUB_ENV
+          echo "PLATFORM_PAIR=${platform//\//-}" >> "$GITHUB_ENV"
+          echo "IMAGE_PREFIX=ghcr.io/${GITHUB_REPOSITORY_OWNER,,}" >> "$GITHUB_ENV"
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v4
+      - name: Check Docker Hub credentials
+        id: docker-hub
+        env:
+          DOCKER_HUB_USERNAME: ${{ secrets.DOCKER_HUB_USERNAME }}
+          DOCKER_HUB_PASSWORD: ${{ secrets.DOCKER_HUB_PASSWORD }}
+        run: |
+          if [[ -n "$DOCKER_HUB_USERNAME" && -n "$DOCKER_HUB_PASSWORD" ]]; then
+            echo "configured=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "configured=false" >> "$GITHUB_OUTPUT"
+          fi
       - name: Login to Docker Hub
+        if: steps.docker-hub.outputs.configured == 'true'
         uses: docker/login-action@v4
         with:
           username: ${{ secrets.DOCKER_HUB_USERNAME }}
@@ -89,13 +105,13 @@ jobs:
           push: true
           # Layer caching via the registry (no 10GB GHA-cache cap), so the
           # cargo-chef `cook` layer stays warm instead of being evicted and
-          # forcing a ~12min dependency rebuild. Only main writes the cache;
-          # other branches restore it read-only and can't evict it.
+          # forcing a ~12min dependency rebuild. Only deployment branches write
+          # the cache; other branches restore it read-only and can't evict it.
           cache-from: type=registry,ref=ghcr.io/meteroid-oss/${{ matrix.image_type.name }}:buildcache
-          cache-to: ${{ github.ref == 'refs/heads/main' && format('type=registry,ref=ghcr.io/meteroid-oss/{0}:buildcache,mode=max,image-manifest=true,ignore-error=true', matrix.image_type.name) || '' }}
+          cache-to: ${{ (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/triton-main') && format('type=registry,ref={0}/{1}:buildcache,mode=max,image-manifest=true,ignore-error=true', env.IMAGE_PREFIX, matrix.image_type.name) || '' }}
           # https://github.com/docker/build-push-action/issues/900
           provenance: false
-          outputs: type=image,name=ghcr.io/meteroid-oss/${{ matrix.image_type.name }},push-by-digest=true,name-canonical=true,push=true,store=true
+          outputs: type=image,name=${{ env.IMAGE_PREFIX }}/${{ matrix.image_type.name }},push-by-digest=true,name-canonical=true,push=true,store=true
 
       - name: Export digest
         run: |
@@ -121,7 +137,6 @@ jobs:
           - meteroid-web
     runs-on: ubuntu-latest
     steps:
-
       - name: Download digests
         uses: actions/download-artifact@v8
         with:
@@ -132,12 +147,15 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v4
 
+      - name: Prepare registry
+        run: echo "IMAGE_PREFIX=ghcr.io/${GITHUB_REPOSITORY_OWNER,,}" >> "$GITHUB_ENV"
+
       - name: Docker meta
-        id: meteroid-docker # you'll use this in the next step
+        id: meteroid-docker
         uses: docker/metadata-action@v6
         with:
           images: |
-            ghcr.io/meteroid-oss/${{ matrix.image_type }}
+            ${{ env.IMAGE_PREFIX }}/${{ matrix.image_type }}
           tags: |
             type=schedule
             type=ref,event=branch
@@ -146,6 +164,7 @@ jobs:
             type=semver,pattern={{major}}.{{minor}}
             type=semver,pattern={{major}}
             type=sha
+            type=raw,value=sha-${{ github.sha }}
 
       - name: Login to GHCR
         uses: docker/login-action@v4
@@ -157,13 +176,27 @@ jobs:
       - name: Create and push manifest list
         working-directory: /tmp/digests
         run: |
-          docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
-            $(printf 'ghcr.io/meteroid-oss/${{ matrix.image_type }}@sha256:%s ' *)
+          tags=()
+          while IFS= read -r tag; do
+            tags+=("-t" "$tag")
+          done < <(jq -r '.tags[]' <<< "$DOCKER_METADATA_OUTPUT_JSON")
+
+          images=()
+          for digest in *; do
+            images+=("${IMAGE_PREFIX}/${{ matrix.image_type }}@sha256:${digest}")
+          done
+
+          docker buildx imagetools create "${tags[@]}" "${images[@]}"
 
       - name: Push tip tag
         if: github.ref == 'refs/heads/main'
         working-directory: /tmp/digests
         run: |
+          images=()
+          for digest in *; do
+            images+=("${IMAGE_PREFIX}/${{ matrix.image_type }}@sha256:${digest}")
+          done
+
           docker buildx imagetools create \
-            --tag ghcr.io/meteroid-oss/${{ matrix.image_type }}:tip \
-            $(printf 'ghcr.io/meteroid-oss/${{ matrix.image_type }}@sha256:%s ' *)
+            --tag "${IMAGE_PREFIX}/${{ matrix.image_type }}:tip" \
+            "${images[@]}"

.gitignore

@@ -75,3 +75,6 @@ k8s/*/values.*.yaml
 ## Temporary
 sdk
 docs
+
+# Isolated feature worktrees
+.worktrees/