Feature/add branch protection

.github/dependabot.yml

@@ -0,0 +1,34 @@
+# To get started with Dependabot version updates, you'll need to specify which
+# package ecosystems to update and where the package manifests are located.
+# Please see the documentation for all configuration options:
+# https://docs.github.com/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
+
+#Add Dependabot configuration for automated dependency management.
+
+version: 2
+updates:
+  - package-ecosystem: "dotnet-sdk"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    ignore:
+      - dependency-name: "*"
+        update-types: 
+          - "version-update:semver-major"
+          - "version-update:semver-minor"
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: daily
+
+  - package-ecosystem: docker
+    directory: /
+    schedule:
+      interval: daily
+
+  - package-ecosystem: nuget
+    directory: /WebGoat.NET
+    schedule:
+      interval: daily

.github/protector.yml

@@ -0,0 +1,25 @@
+patterns:
+  - master
+
+# Tier 1
+allowsDeletions: false
+allowsForcePushes: false
+
+# Tier 2 + Tier 4 + Tier 5
+requiresApprovingReviews: true
+requiredApprovingReviewCount: 2          # Tier 4 (covers Tier 2’s “at least 1”)
+requiresCodeOwnerReviews: true           # Tier 4
+dismissesStaleReviews: true              # Tier 5
+isAdminEnforced: true                    # Tier 5 – administrators cannot bypass
+
+# Tier 2 + Tier 3
+requiresStatusChecks: true
+requiresStrictStatusChecks: true         # “Require branch to be up to date”
+requiredStatusCheckContexts:
+  - ci / build                           # ← change to your actual status check name(s)
+
+# Optional but recommended
+requiresLinearHistory: true
+requiresCommitSignatures: false          # set to true if you want signed commits
+restrictsPushes: false
+restrictsReviewDismissals: false

.github/workflows/codeql.yml

@@ -0,0 +1,68 @@
+name: "CodeQL"
+
+on:
+  # Makes this workflow callable from other workflows (e.g. pipeline.yml)
+  workflow_call:
+
+  # Still allows it to run on its own if needed
+  push:
+    branches: [ "master", "main" ]
+  pull_request:
+    branches: [ "master", "main" ]
+  schedule:
+    - cron: '0 6 * * 1'          # Every Monday 06:00 UTC
+  workflow_dispatch:              # Manual trigger
+
+permissions:
+  contents: read
+
+jobs:
+  analyze:
+    name: Analyze (csharp)
+    runs-on: ubuntu-latest
+    timeout-minutes: 360
+
+    permissions:
+      security-events: write      # Required to upload SARIF → Security tab
+      contents: read
+      actions: read
+      packages: read
+
+    steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+        with:
+          egress-policy: audit
+
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Setup .NET
+        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
+        with:
+          dotnet-version: |
+            8.0.x
+            9.0.x
+
+      # 1. Initialize CodeQL
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
+        with:
+          languages: csharp
+          queries: security-and-quality
+
+      # 2. Build (creates the database)
+      - name: Autobuild
+        uses: github/codeql-action/autobuild@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
+
+      # If Autobuild fails, replace the step above with this:
+      # - name: Manual build
+      #   run: |
+      #     dotnet restore
+      #     dotnet build --configuration Release --no-restore
+
+      # 3. Analyze + Upload SARIF to GitHub Security tab
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
+        with:
+          category: "/language:csharp"

.github/workflows/cosign.yml

@@ -0,0 +1,78 @@
+name: Cosign
+
+on:
+  workflow_call:
+    inputs:
+      image-ref:
+        description: "Image reference to sign (e.g. ghcr.io/owner/repo:tag)"
+        required: true
+        type: string
+      image-digest:
+        description: "Image digest (ghcr.io/owner/repo@sha256:...)"
+        required: false
+        type: string
+        default: ""
+
+  workflow_dispatch:
+    inputs:
+      image-ref:
+        description: "Image reference to sign"
+        required: true
+        type: string
+      image-digest:
+        description: "Image digest (optional)"
+        required: false
+        type: string
+        default: ""
+
+permissions:
+  contents: read
+
+jobs:
+  sign:
+    name: Sign Image (keyless)
+    runs-on: ubuntu-24.04
+    # Only sign on main/master (image must exist in registry)
+    if: github.ref == 'refs/heads/master' || github.ref == 'refs/heads/main'
+    permissions:
+      contents: read
+      packages: write
+      id-token: write          # required for Cosign keyless (OIDC)
+
+    steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+        with:
+          egress-policy: audit
+
+      - name: Install Cosign
+        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
+
+      - name: Login to GHCR
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Sign image with Cosign (keyless)
+        run: |
+          if [ -n "${{ inputs.image-digest }}" ]; then
+            echo "Signing by digest: ${{ inputs.image-digest }}"
+            cosign sign --yes "${{ inputs.image-digest }}"
+          else
+            echo "Signing by tag: ${{ inputs.image-ref }}"
+            cosign sign --yes "${{ inputs.image-ref }}"
+          fi
+
+      - name: Verify signature
+        run: |
+          TARGET="${{ inputs.image-digest }}"
+          if [ -z "$TARGET" ]; then
+            TARGET="${{ inputs.image-ref }}"
+          fi
+
+          cosign verify \
+            --certificate-identity-regexp="https://github.com/${{ github.repository }}/.github/workflows/" \
+            --certificate-oidc-issuer="https://token.actions.githubusercontent.com" \
+            "$TARGET"

.github/workflows/dependency-review.yml

@@ -0,0 +1,27 @@
+# Dependency Review Action
+#
+# This Action will scan dependency manifest files that change as part of a Pull Request,
+# surfacing known-vulnerable versions of the packages declared or updated in the PR.
+# Once installed, if the workflow run is marked as required,
+# PRs introducing known-vulnerable packages will be blocked from merging.
+#
+# Source repository: https://github.com/actions/dependency-review-action
+name: 'Dependency Review'
+on: [pull_request]
+
+permissions:
+  contents: read
+
+jobs:
+  dependency-review:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+        with:
+          egress-policy: audit
+
+      - name: 'Checkout Repository'
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: 'Dependency Review'
+        uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0

.github/workflows/docker-cis-harden.yml

@@ -0,0 +1,146 @@
+name: Docker CIS Harden / Patch
+
+on:
+  workflow_dispatch:
+    inputs:
+      ENABLE_USERNS_REMAP:
+        description: "Enable userns-remap (true/false)"
+        required: false
+        default: "false"
+      RUN_INSPEC:
+        description: "Run InSpec CIS scan after hardening (true/false)"
+        required: false
+        default: "true"
+
+  workflow_call:
+    inputs:
+      ENABLE_USERNS_REMAP:
+        description: "Enable userns-remap (true/false)"
+        required: false
+        type: string
+        default: "false"
+      RUN_INSPEC:
+        description: "Run InSpec CIS scan after hardening (true/false)"
+        required: false
+        type: string
+        default: "true"
+    secrets:
+      DEPLOYMENT_SERVER:
+        description: "Server IP or hostname"
+        required: true
+      DEPLOY_USER:
+        description: "SSH user"
+        required: true
+      DEPLOY_SSH_KEY:
+        description: "Private SSH key (no passphrase)"
+        required: true
+      CHEF_LICENSE_KEY:
+        description: "Chef license key for InSpec"
+        required: false
+
+permissions:
+  contents: read
+
+jobs:
+  harden-docker:
+    name: Docker CIS Harden + InSpec
+    runs-on: ubuntu-latest
+    if: github.ref == 'refs/heads/master' || github.ref == 'refs/heads/main'
+    environment: deployment
+    continue-on-error: true
+    env:
+      ENABLE_USERNS_REMAP: ${{ inputs.ENABLE_USERNS_REMAP || github.event.inputs.ENABLE_USERNS_REMAP || 'false' }}
+      RUN_INSPEC: ${{ inputs.RUN_INSPEC || github.event.inputs.RUN_INSPEC || 'true' }}
+
+    steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+        with:
+          egress-policy: audit
+
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Check deploy secrets are present
+        env:
+          KEY: ${{ secrets.DEPLOY_SSH_KEY }}
+          HOST: ${{ secrets.DEPLOYMENT_SERVER }}
+          USER: ${{ secrets.DEPLOY_USER }}
+        run: |
+          if [ -z "$HOST" ] || [ -z "$USER" ] || [ -z "$KEY" ]; then
+            echo "❌ DEPLOYMENT_SERVER / DEPLOY_USER / DEPLOY_SSH_KEY is empty"
+            echo "Add them under Settings → Environments → deployment"
+            exit 1
+          fi
+          echo "✅ Deploy secrets present (key length ${#KEY})"
+
+      - name: Setup SSH agent
+        uses: webfactory/ssh-agent@a6f90b1f127823b31d4d4a8d96047790581349bd # v0.9.1
+        with:
+          ssh-private-key: ${{ secrets.DEPLOY_SSH_KEY }}
+
+      - name: Add host to known_hosts
+        run: |
+          mkdir -p ~/.ssh
+          ssh-keyscan -H "${{ secrets.DEPLOYMENT_SERVER }}" >> ~/.ssh/known_hosts
+
+      - name: Install Ansible
+        run: |
+          sudo apt-get update -qq
+          sudo apt-get install -y -qq ansible
+
+      - name: Create inventory
+        run: |
+          cat > inventory.ini << EOF
+          [prod]
+          ${{ secrets.DEPLOYMENT_SERVER }} ansible_user=${{ secrets.DEPLOY_USER }} ansible_ssh_common_args='-o StrictHostKeyChecking=yes' ansible_python_interpreter=/usr/bin/python3
+          EOF
+          cat inventory.ini
+
+      - name: Harden Docker to CIS controls
+        run: |
+          ansible-playbook -i inventory.ini Infrastructure/Ansible/harden-docker-cis.yml \
+            -e "{\"trusted_docker_users\": [\"${{ secrets.DEPLOY_USER }}\"]}" \
+            -e "enable_userns_remap=${ENABLE_USERNS_REMAP}"
+
+      - name: Install InSpec
+        if: env.RUN_INSPEC == 'true'
+        env:
+          CHEF_LICENSE_KEY: ${{ secrets.CHEF_LICENSE_KEY }}
+        run: |
+          curl -fsSL https://omnitruck.chef.io/install.sh | sudo bash -s -- -P inspec
+          inspec version
+
+      - name: Clone custom compliance profile
+        if: env.RUN_INSPEC == 'true'
+        run: |
+          git clone --depth 1 https://github.com/StevenKitavi/compliance-as-code.git /tmp/compliance-as-code
+
+      - name: Run Docker InSpec profiles in parallel
+        if: env.RUN_INSPEC == 'true'
+        env:
+          CHEF_LICENSE_KEY: ${{ secrets.CHEF_LICENSE_KEY }}
+        run: |
+          cat > inspec-multiprofile.txt << EOF
+          /tmp/compliance-as-code/docker --reporter html:cis-docker-custom-results.html
+          https://github.com/dev-sec/cis-docker-benchmark.git --reporter html:cis-docker-benchmark-results.html json:cis-docker-benchmark-results.json
+          EOF
+          cat inspec-multiprofile.txt
+
+          inspec parallel exec multiprofile \
+            -o inspec-multiprofile.txt \
+            -t "ssh://${{ secrets.DEPLOY_USER }}@${{ secrets.DEPLOYMENT_SERVER }}" \
+            --chef-license accept \
+            || true
+
+      - name: Upload InSpec reports
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: inspec-docker-harden-reports
+          path: |
+            cis-docker-custom-results.html
+            cis-docker-benchmark-results.html
+            cis-docker-benchmark-results.json
+          retention-days: 30
+          if-no-files-found: ignore