v0.4.0 - AKS security rules, CBOM, PQC expansion, OpenSSF compliance and docs

.github/ISSUE_TEMPLATE/new_rule.md

@@ -9,7 +9,7 @@ assignees: ''
 ## Rule Details
 - Rule ID: AZ-XXX-000
 - Severity: HIGH / MEDIUM / LOW
-- Category: Storage / Network / Identity / Database / Compute / Key Vault / PostQuantum
+- Category: Storage / Network / Identity / Database / Compute / Key Vault / Kubernetes / PostQuantum
 - Frameworks: CIS / NIST / ISO 27001 / SOC 2
 
 ## What does it detect?

.github/PULL_REQUEST_TEMPLATE.md

@@ -13,7 +13,7 @@
 ## Rule details (if applicable)
 - Rule ID: AZ-XXX-000
 - Severity: HIGH / MEDIUM / LOW
-- Category: Storage / Network / Identity / Database / Compute / Key Vault
+- Category: Storage / Network / Identity / Database / Compute / Key Vault / Kubernetes
 - Frameworks mapped: CIS / NIST / ISO 27001 / SOC 2
 
 ## Testing

.github/dependabot.yml

@@ -5,16 +5,22 @@ updates:
     directory: "/"
     schedule:
       interval: "weekly"
+    cooldown:
+      default-days: 7
     open-pull-requests-limit: 0
 
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
       interval: "weekly"
+    cooldown:
+      default-days: 7
     open-pull-requests-limit: 0
 
   - package-ecosystem: "npm"
     directory: "/frontend"
     schedule:
       interval: "weekly"
+    cooldown:
+      default-days: 7
     open-pull-requests-limit: 0

.github/workflows/ci.yml

@@ -431,7 +431,16 @@ jobs:
         uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
 
       - name: Install syft
-        run: curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b /usr/local/bin v1.46.0
+        env:
+          SYFT_VERSION: "1.46.0"
+          SYFT_SHA256: d654f678b709eb53c393d38519d5ed7d2e57205529404018614cfefa0fb2b5ca
+        run: |
+          SYFT_ARCHIVE="syft_${SYFT_VERSION}_linux_amd64.tar.gz"
+          curl --fail --silent --show-error --location \
+            --output "$SYFT_ARCHIVE" \
+            "https://github.com/anchore/syft/releases/download/v${SYFT_VERSION}/${SYFT_ARCHIVE}"
+          echo "${SYFT_SHA256}  ${SYFT_ARCHIVE}" | sha256sum --check --strict
+          sudo tar --extract --gzip --file "$SYFT_ARCHIVE" --directory /usr/local/bin syft
 
       - name: Generate SBOM
         run: syft dir:. --source-name openshield --source-version "${{ github.sha }}" -o cyclonedx-json=sbom.cyclonedx.json
@@ -548,9 +557,27 @@ jobs:
       - name: Lint
         run: npm run lint
 
+      - name: Run aiSettings tests
+        run: node src/utils/aiApi.test.mjs
+
       - name: Build
         run: npm run build
 
+  website:
+    name: Website (script tests)
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+
+      - name: Set up Node.js
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version: "22"
+
+      - name: Run website script tests
+        run: node website/test_toEmbedUrl.mjs
+
   # ── Enforce branch flow: main may only receive PRs from dev ───────────────
   # No-op on dev PRs (step skipped -> job succeeds). To allow hotfixes straight
   # to main, widen the condition below to also accept a 'hotfix/*' head branch.
@@ -575,7 +602,7 @@ jobs:
     name: CI Summary
     runs-on: ubuntu-latest
     needs:
-      [lint, rule-validation, secret-scan, sast-bandit, sca-pip-audit, sbom, container-scan, backend-tests, frontend, enforce-source-branch]
+      [lint, rule-validation, secret-scan, sast-bandit, sca-pip-audit, sbom, container-scan, backend-tests, frontend, website, enforce-source-branch]
     if: always()
     steps:
       - name: Build summary
@@ -589,6 +616,7 @@ jobs:
           CONTAINER_SCAN: ${{ needs.container-scan.result }}
           BACKEND_TESTS: ${{ needs.backend-tests.result }}
           FRONTEND: ${{ needs.frontend.result }}
+          WEBSITE: ${{ needs.website.result }}
           ENFORCE_SOURCE: ${{ needs.enforce-source-branch.result }}
         run: |
           python3 - <<'PYEOF'
@@ -604,6 +632,7 @@ jobs:
               ("Container Scan (Trivy, INFRA 1 pending)", os.environ["CONTAINER_SCAN"]),
               ("Backend Tests (pytest + coverage)",  os.environ["BACKEND_TESTS"]),
               ("Frontend (lint + build)",            os.environ["FRONTEND"]),
+              ("Website (script tests)",             os.environ["WEBSITE"]),
               ("Enforce dev to main source",        os.environ["ENFORCE_SOURCE"]),
           ]
 
@@ -654,5 +683,6 @@ jobs:
           needs.sbom.result != 'success' ||
           needs.backend-tests.result != 'success' ||
           needs.frontend.result != 'success' ||
+          needs.website.result != 'success' ||
           needs.enforce-source-branch.result != 'success'
         run: exit 1

.github/workflows/dependency-review.yml

@@ -12,8 +12,12 @@ jobs:
   dependency-review:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/dependency-review-action@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      - uses: actions/dependency-review-action@2031cfc080254a8a887f58cffee85186f0e49e48 # v4
         with:
           fail-on-severity: high
+          # The wheel omits license metadata, but Microsoft's upstream Azure
+          # SDK repository licenses this package under MIT:
+          # https://github.com/Azure/azure-sdk-for-python/blob/main/LICENSE
+          allow-dependencies-licenses: pkg:pypi/azure-mgmt-containerservice@41.3.0
           comment-summary-in-pr: always

.github/workflows/deploy.yml

@@ -20,9 +20,6 @@ concurrency:
   group: deploy-${{ inputs.environment }}
   cancel-in-progress: false
 
-permissions:
-  contents: read
-
 permissions:
   id-token: write
   contents: read
@@ -35,15 +32,15 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
 
       - name: Set up Python 3.11
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: "3.11"
 
       - name: Cache pip dependencies
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         with:
           path: ~/.cache/pip
           key: ${{ runner.os }}-pip-${{ hashFiles('requirements.txt') }}
@@ -135,6 +132,8 @@ jobs:
           echo "API deploy $API_DEPLOY_ID and worker deploy $WORKER_DEPLOY_ID are live at SHA $GITHUB_SHA."
 
       - name: Health gate check
+        env:
+          DEPLOY_ENVIRONMENT: ${{ inputs.environment }}
         run: |
           MAX_RETRIES=5
           RETRY_DELAY=15
@@ -151,7 +150,7 @@ jobs:
             echo "Got HTTP $HTTP_STATUS; retrying in ${RETRY_DELAY}s..."
             sleep $RETRY_DELAY
           done
-          echo "ERROR: Health gate failed after $MAX_RETRIES attempts on ${{ inputs.environment }}."
+          echo "ERROR: Health gate failed after $MAX_RETRIES attempts on $DEPLOY_ENVIRONMENT."
           exit 1
 
       - name: Run smoke tests against live deployment

.github/workflows/docker.yml

@@ -14,18 +14,18 @@ jobs:
   docker:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
 
       - name: Log in to GitHub Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Extract metadata
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5
         with:
           images: ghcr.io/openshield-org/openshield
           tags: |
@@ -34,7 +34,7 @@ jobs:
             type=raw,value=latest,enable={{is_default_branch}}
 
       - name: Build and push
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5
         with:
           context: .
           push: true

.github/workflows/release.yml

@@ -12,10 +12,10 @@ jobs:
   release:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           fetch-depth: 0
-      - uses: softprops/action-gh-release@v2
+      - uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2
         with:
           generate_release_notes: true
           make_latest: true

.github/workflows/sbom-release.yml

@@ -17,7 +17,16 @@ jobs:
         uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
 
       - name: Install syft
-        run: curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b /usr/local/bin v1.46.0
+        env:
+          SYFT_VERSION: "1.46.0"
+          SYFT_SHA256: d654f678b709eb53c393d38519d5ed7d2e57205529404018614cfefa0fb2b5ca
+        run: |
+          SYFT_ARCHIVE="syft_${SYFT_VERSION}_linux_amd64.tar.gz"
+          curl --fail --silent --show-error --location \
+            --output "$SYFT_ARCHIVE" \
+            "https://github.com/anchore/syft/releases/download/v${SYFT_VERSION}/${SYFT_ARCHIVE}"
+          echo "${SYFT_SHA256}  ${SYFT_ARCHIVE}" | sha256sum --check --strict
+          sudo tar --extract --gzip --file "$SYFT_ARCHIVE" --directory /usr/local/bin syft
 
       - name: Generate SBOM
         env:

.github/workflows/stale.yml

@@ -9,7 +9,7 @@ jobs:
   stale:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/stale@v9
+      - uses: actions/stale@5bef64f19d7facfb25b37b414482c7164d639639 # v9.1.0
         with:
           stale-issue-message: 'This issue has been inactive for 30 days and will be closed in 7 days unless there is activity.'
           stale-pr-message: 'This PR has been inactive for 14 days. Please update or it will be closed in 7 days.'

CHANGELOG.md

@@ -0,0 +1,116 @@
+# Changelog
+
+All notable changes to OpenShield are documented in this file.
+
+The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
+OpenShield uses [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+### Added
+
+- CBOM endpoints with per-asset quantum risk scoring and migration guidance
+- NCSC UK and ENISA post-quantum compliance framework mappings
+- Harvest Now Decrypt Later exposure window calculation per cryptographic asset
+- Deterministic Render deployment workflow for separate API and worker services
+- Terraform configuration for Render, Vercel, and GitHub OIDC
+
+### Fixed
+
+- High-severity CodeQL findings in Python and JavaScript code
+- Security findings identified during Semgrep analysis
+- Sensitive identity metadata removed from scanner debug logging
+
+### Security
+
+- AI provider errors no longer expose upstream response details
+- Request body limits, AI rate limiting, and playbook path validation added
+- GitHub Actions dependencies pinned to immutable commit SHAs
+
+## [0.3.0] - 2026-07-08
+
+### Added
+
+- Async scan execution with a background worker and PostgreSQL-backed job queue
+- Scan state persistence and Render restart recovery with retry logic
+- Structured JSON logging with request correlation via `X-Request-ID`
+- Prometheus metrics for HTTP, scan, NVD, and LLM latency
+- Separate `/health` liveness and `/ready` readiness probes
+- Optional Sentry integration configured through `SENTRY_DSN`
+- AZ-IDN-005 to AZ-IDN-009 Entra ID identity scanner rules
+- AZ-PQC-001 to AZ-PQC-003 post-quantum cryptography scanner rules
+- MockAzureClient offline rule regression test harness
+- Azure scanner validation documentation framework
+- CODEOWNERS with domain-based reviewer assignment
+- Issue templates for bugs, features, and scanner rules
+- Docker and Docker Compose support for self-hosted deployment
+- Stale issue and pull request management workflow
+- Dependency review workflow for high-severity vulnerabilities
+- Release workflow triggered by version tags
+- Docker image publishing to GHCR on release tags
+
+### Fixed
+
+- Duplicate CIS benchmark mappings across rules that shared control IDs
+- TLS version comparison changed from lexicographic to numeric comparison
+- Microsoft Graph pagination now follows `nextLink`
+- Render automatic deployment replaced with a manual workflow dispatch
+
+### Security
+
+- Unsafe HTML rendering removed from website content updates
+- Clear-text logging removed from identity scanner rules
+- Vulnerable dependencies upgraded, including cryptography and wheel
+
+## [0.2.3] - 2026-06-28
+
+### Added
+
+- CVE enrichment decoupled from the scan lifecycle into an on-demand endpoint
+- OpenShield Learn portal updated with current architecture and rule coverage
+- React Router dependency updated to 7.18.0
+
+## [0.2.2] - 2026-06-15
+
+### Added
+
+- Live data wiring between the frontend and backend API
+- Seven-page React dashboard for monitoring, discovery, prioritization, scanning, compliance, drift, and AI
+- Project website at `openshield-website.vercel.app`
+- JWT authentication production hardening
+
+### Fixed
+
+- Mock and demonstration data removed from the frontend
+- Dashboard updated to serve persisted scan data end to end
+
+## [0.2.0] - 2026-05-20
+
+### Added
+
+- RAG pipeline with ChromaDB and Azure security knowledge skills
+- AI executive summary, prioritization, question answering, and remediation endpoints
+- CVE correlation through NVD with CVSS scoring and CISA KEV exploit signals
+- AZ-NET-012 to AZ-NET-016 network scanner rules
+- AZ-IDN-004 privileged identity management scanner rule
+- PostgreSQL-backed asynchronous scan persistence
+
+## [0.1.0] - 2026-05-09
+
+### Added
+
+- Initial OpenShield release
+- 20 Azure scanner rules across Storage, Network, Identity, Database, Compute, and Key Vault
+- CIS Azure Benchmark, NIST CSF, ISO 27001, and SOC 2 mappings
+- Flask REST API with JWT authentication
+- CLI remediation playbooks for scanner rules
+- Microsoft Sentinel integration with Log Analytics ingestion and KQL rules
+- GitHub Actions continuous integration pipeline
+- SBOM generation with Syft
+
+[Unreleased]: https://github.com/openshield-org/openshield/compare/v0.3.0...HEAD
+[0.3.0]: https://github.com/openshield-org/openshield/releases/tag/v0.3.0
+[0.2.3]: https://github.com/openshield-org/openshield/commit/3d6d7cc
+[0.2.2]: https://github.com/openshield-org/openshield/commit/9575a33
+[0.2.0]: https://github.com/openshield-org/openshield/commit/484eb9b
+[0.1.0]: https://github.com/openshield-org/openshield/releases/tag/v0.1.0