chore(deploy): T2 2026 deploy and dev stack updates

.devcontainer/.env.example

@@ -0,0 +1,12 @@
+# Optional non-production AAF configuration for the development container.
+# Copy to .devcontainer/.env and obtain a dedicated registration from the
+# identity owner. Never reuse or commit a production/institution shared secret.
+# Keep database unless every AAF value below is complete; then set this to aaf.
+DF_AUTH_METHOD=database
+DF_AAF_ISSUER_URL=
+DF_AAF_AUDIENCE_URL=http://localhost:3000
+DF_AAF_CALLBACK_URL=http://localhost:3000/api/auth/jwt
+DF_AAF_IDENTITY_PROVIDER_URL=
+DF_AAF_UNIQUE_URL=
+DF_AAF_AUTH_SIGNOUT_URL=
+DF_SECRET_KEY_AAF=

.devcontainer/devcontainer.env

@@ -12,6 +12,9 @@ DF_JPLAG_REPORT_DIR=/jplag/results
 DF_JPLAG_SKIP_CLUSTER_CHECK=true
 DF_JPLAG_MAX_SHOWN_COMPARISONS=-1
 
+# Peer Progress Indicator local development defaults
+DF_PPI_MINIMUM_COHORT_SIZE=21
+DF_PPI_STALE_AFTER_HOURS=48
 
 # Overseer - enabled!
 OVERSEER_ENABLED=1
@@ -43,14 +46,15 @@ DF_ACCESS_TOKEN_EXPIRY_SECONDS=3600
 # 7 Days
 DF_REFRESH_TOKEN_EXPIRY_SECONDS=604800
 
-# AAF settings - for testing on local host
-DF_AAF_ISSUER_URL=https://rapid.test.aaf.edu.au
-DF_AAF_AUDIENCE_URL=http://localhost:3000
-DF_AAF_CALLBACK_URL=http://localhost:3000/api/auth/jwt
-DF_AAF_IDENTITY_PROVIDER_URL=https://signon-uat.deakin.edu.au/idp/shibboleth
-DF_AAF_UNIQUE_URL=https://rapid.test.aaf.edu.au/jwt/authnrequest/research/Ag4EJJhjf0zXHqlKvKZEbg
-DF_AAF_AUTH_SIGNOUT_URL=https://sync-uat.deakin.edu.au/auth/logout
-DF_SECRET_KEY_AAF=v4~LMFLzzwRGZdju\5QBa@FiHIN9
+# Optional AAF development settings are deliberately blank. Supply a dedicated
+# non-production registration through .devcontainer/.env; never commit it.
+DF_AAF_ISSUER_URL=
+DF_AAF_AUDIENCE_URL=
+DF_AAF_CALLBACK_URL=
+DF_AAF_IDENTITY_PROVIDER_URL=
+DF_AAF_UNIQUE_URL=
+DF_AAF_AUTH_SIGNOUT_URL=
+DF_SECRET_KEY_AAF=
 
 # Database settings
 DF_DEV_DB_ADAPTER=mysql2

.devcontainer/docker-compose.yml

@@ -48,6 +48,17 @@ services:
     environment:
       LATEX_CONTAINER_NAME: 1-formatif-texlive-container
       LATEX_BUILD_PATH: /texlive/shell/latex_build.sh
+      # Optional AAF development uses a dedicated registration supplied from
+      # an ignored .devcontainer/.env file. Database auth remains the default.
+      DF_AUTH_METHOD: ${DF_AUTH_METHOD:-database}
+      TUTORIAL_ENABLED: ${TUTORIAL_ENABLED:-0}
+      DF_AAF_ISSUER_URL: ${DF_AAF_ISSUER_URL:-}
+      DF_AAF_AUDIENCE_URL: ${DF_AAF_AUDIENCE_URL:-}
+      DF_AAF_CALLBACK_URL: ${DF_AAF_CALLBACK_URL:-}
+      DF_AAF_IDENTITY_PROVIDER_URL: ${DF_AAF_IDENTITY_PROVIDER_URL:-}
+      DF_AAF_UNIQUE_URL: ${DF_AAF_UNIQUE_URL:-}
+      DF_AAF_AUTH_SIGNOUT_URL: ${DF_AAF_AUTH_SIGNOUT_URL:-}
+      DF_SECRET_KEY_AAF: ${DF_SECRET_KEY_AAF:-}
     depends_on:
       - dev-db
 

.github/workflows/build-dev-container.yml

@@ -25,44 +25,44 @@ jobs:
             context: ./doubtfire-api/
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
           submodules: recursive
       - name: Setup meta for development image
         id: docker_meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5
         with:
           images: ${{ matrix.image }}
           tags: |
             type=semver,pattern={{major}}.{{minor}}
       - name: Login to DockerHub
-        uses: docker/login-action@v3
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
         if: github.event_name != 'pull_request'
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3
       - name: Set up Docker
         id: buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
       - name: Cache Docker layers
-        uses: actions/cache@v3
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         with:
           path: /tmp/.buildx-cache-app
           key: ${{ runner.os }}-buildx-app-${{ github.sha }}
           restore-keys: |
             ${{ runner.os }}-buildx-app
       - name: Build and push dev container image
         id: docker_build
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
         with:
           file: ${{ matrix.dockerfile }}
           context: ${{ matrix.context }}
           builder: ${{ steps.buildx.outputs.name }}
           push: ${{ github.event_name != 'pull_request' }}
           tags: ${{ steps.docker_meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
+          labels: ${{ steps.docker_meta.outputs.labels }}
           platforms: linux/amd64,linux/arm64
           cache-from: type=local,src=/tmp/.buildx-cache-app  # Reuse cached layers from previous builds.
           cache-to: type=local,dest=/tmp/.buildx-cache-app-new,mode=max  # Save new cache layers after the build.

.github/workflows/validate-production-compose.yml

@@ -0,0 +1,57 @@
+name: validate-production-compose
+
+on:
+  pull_request:
+    paths:
+      - ".github/workflows/validate-production-compose.yml"
+      - ".gitmodules"
+      - ".devcontainer/**"
+      - "development/**"
+      - "HANDOVER.md"
+      - "MIGRATING.md"
+      - "RELEASING.md"
+      - "DEPLOYING.md"
+      - "DESKTOP-PWA.md"
+      - "doubtfire-api"
+      - "doubtfire-web"
+      - "production/**"
+  push:
+    branches:
+      - 11.0.x
+    paths:
+      - ".github/workflows/validate-production-compose.yml"
+      - ".gitmodules"
+      - ".devcontainer/**"
+      - "development/**"
+      - "HANDOVER.md"
+      - "MIGRATING.md"
+      - "RELEASING.md"
+      - "DEPLOYING.md"
+      - "DESKTOP-PWA.md"
+      - "doubtfire-api"
+      - "doubtfire-web"
+      - "production/**"
+
+permissions:
+  contents: read
+
+jobs:
+  validate:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+
+      - name: Test desktop PWA public-asset verification
+        run: python3 -B production/tests/verify_pwa_test.py
+
+      - name: Test release publication and recovery cache controls
+        run: python3 -B production/tests/publish_release_test.py
+
+      - name: Validate production configuration
+        run: production/tests/validate_test.sh
+
+      - name: Verify upload boundaries through the production Nginx template
+        run: python3 -B production/tests/nginx_upload_test.py

.github/workflows/validate-secret-audit.yml

@@ -0,0 +1,22 @@
+name: Validate secret audit tool
+on:
+  pull_request:
+    paths:
+      - tools/audit-vapid-secret.py
+      - tools/tests/test_audit_vapid_secret.py
+      - .github/workflows/validate-secret-audit.yml
+  push:
+    branches: ["11.0.x"]
+    paths:
+      - tools/audit-vapid-secret.py
+      - tools/tests/test_audit_vapid_secret.py
+      - .github/workflows/validate-secret-audit.yml
+permissions:
+  contents: read
+jobs:
+  synthetic-fixtures:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - run: python3 -B -m unittest discover -s tools/tests -p 'test_audit_vapid_secret.py'

.gitignore

@@ -3,6 +3,16 @@
 !/data/**/
 !/data/**/.gitkeep
 /node_modules/
+/.devcontainer/.env
+/development/.env
+
+# Production runtime configuration, credentials, and local TLS material.
+/production/.env.production
+/production/secrets/*
+!/production/secrets/.gitkeep
+/production/shared-files/aliases
+/production/shared-files/msmtprc
+/production/*.sql
 
 # Created by https://www.toptal.com/developers/gitignore/api/macos
 # Edit at https://www.toptal.com/developers/gitignore?templates=macos