Security and Testing infrastructure Remediation

[Wikid82]

placeholder....

Chores of this PR:

1. Migrate base image to Alpine to fix known Debian CVEs.

2. Make sure testing infrastructure has no regression and passes all green. Includes local and CI E2E, Integrations, Frontend and Backend Coverage.

DoD Checklist:

• Dockerfile updates and rebuild successful
• Confirm Integration Tests
  • Cerberus
  • CrowdSec
  • Rate Limiter
  • WAF
• E2E Runs Green
  • Security Shard
    • Chromium
    • Firefox
    • Wibkit
  • Chromium
    • Shard 1
    • Shard 2
    • Shard 3
    • Shard 4
  • Firefox
    • Shard 1
    • Shard 2
    • Shard 3
    • Shard4
  • Webkit
    • Shard 1
    • Shard 2
    • Shard 3
    • Shard 4
• Frontend runs green and meets Coverage goal
• Backend runs green and meets coverage goal
• All CI/CD are running green

Closes Issues: #40, #587, #589, #592, #610, #618, #638, #664, #665, #631

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[github-actions]

✅ Supply Chain Verification Results

✅ PASSED

📦 SBOM Summary

• Components: 1674

🔍 Vulnerability Scan

Severity	Count
🔴 Critical	0
🟠 High	0
🟡 Medium	0
🟢 Low	0
Total	0

📎 Artifacts

• SBOM (CycloneDX JSON) and Grype results available in workflow artifacts

---

_{Generated by Supply Chain Verification workflow • View Details}

[Copilot]

Pull request overview

This PR focuses on strengthening security posture and keeping test/CI infrastructure stable while upgrading core dependencies and workflows.

Changes:

• Upgraded Go/tooling dependencies and adjusted docs to reflect the new baseline.
• Hardened/expanded backend handler behavior and tests (admin context, logs WS tests, emergency reset behavior).
• Reworked CI/workflows and local “skills” scripts to improve reliability and reduce redundant runs.

Reviewed changes

Copilot reviewed 146 out of 523 changed files in this pull request and generated 8 comments.

Show a summary per file

File	Description
backend/internal/api/handlers/notification_template_handler_test.go	Sets admin context in handler tests to match new auth expectations
backend/internal/api/handlers/notification_template_handler.go	Adds admin enforcement + permission-error handling hooks in CRUD
backend/internal/api/handlers/notification_provider_handler_test.go	Adds SSRF-style Discord URL validation tests
backend/internal/api/handlers/manual_challenge_handler.go	Renames bind error var for clarity/shadow avoidance
backend/internal/api/handlers/logs_ws_test.go	Adds WebSocket log streaming tests with filters/tracker
backend/internal/api/handlers/logs_handler_test.go	Makes log listing assertions less brittle + checks key logs exist
backend/internal/api/handlers/logs_handler.go	Avoids err shadowing in deferred cleanup
backend/internal/api/handlers/import_handler_sanitize_test.go	Adds admin context to import upload sanitization test
backend/internal/api/handlers/import_handler_coverage_test.go	Adds admin context to import multi-upload coverage tests
backend/internal/api/handlers/encryption_handler.go	Removes duplicate local isAdmin helper (centralize auth logic)
backend/internal/api/handlers/emergency_handler_test.go	Expands emergency reset assertions (whitelist, decisions)
backend/internal/api/handlers/emergency_handler.go	Clears admin whitelist + block decisions; adds SQLite retry upsert
backend/internal/api/handlers/dns_provider_handler.go	Standardizes bind error handling variable naming
backend/internal/api/handlers/crowdsec_handler_comprehensive_test.go	Makes getLAPIKey behavior deterministic via env setup
backend/internal/api/handlers/crowdsec_bouncer_test.go	Avoids err shadowing in test
backend/internal/api/handlers/credential_handler_test.go	Adds timing workaround for SQLite locks in tests
backend/internal/api/handlers/credential_handler.go	Standardizes bind error handling variable naming
backend/internal/api/handlers/coverage_quick_test.go	Adds admin context to quick coverage handler test
backend/internal/api/handlers/certificate_handler.go	Avoids err shadowing in deferred closes
backend/internal/api/handlers/backup_handler_test.go	Adds transient error tests + restore response assertions + admin context
backend/internal/api/handlers/backup_handler_sanitize_test.go	Adds admin context to direct handler test
backend/internal/api/handlers/access_list_handler.go	Returns persisted/updated records and tightens error handling
backend/go.mod	Bumps Go version and upgrades dependencies
backend/cmd/seed/main_test.go	Cleans up malformed/duplicated package/import blocks
backend/cmd/api/main_parse_plugin_signatures_test.go	Adds unit tests for plugin signature parsing
backend/.golangci.yml	Refactors golangci-lint config structure
backend/.golangci-fast.yml	Refactors golangci-lint fast config structure
SECURITY.md	Updates Go version reference for upstream CVE note
README.md	Updates Go version docs and adds GHCR pulls badge
Makefile	Updates install-go target to new Go version script
CONTRIBUTING.md	Updates Go version + adds Go upgrade workflow guidance
CHANGELOG.md	Adds CI/security changelog entries
ARCHITECTURE.md	Updates Go version + documents new env vars
.version	Bumps project version
.trivyignore	Ignores cache/auth paths during Trivy scans
.pre-commit-config.yaml	Adds shellcheck + actionlint hooks
.github/workflows/update-geolite2.yml	Quotes outputs safely in shell
.github/workflows/repo-health.yml	Adjusts concurrency + triggers
.github/workflows/renovate_prune.yml	Quotes $GITHUB_ENV writes; adjusts triggers
.github/workflows/renovate.yml	Renovate action version bump
.github/workflows/release-goreleaser.yml	Updates GO_VERSION + quotes env file writes
.github/workflows/pr-checklist.yml	Switches to workflow_dispatch + explicit PR number input
.github/workflows/history-rewrite-tests.yml	Switches to workflow_run gating on Docker workflow success
.github/workflows/gh_cache_cleanup.yml	Adds manual cache cleanup workflow for PR refs
.github/workflows/dry-run-history-rewrite.yml	Gates on Docker workflow success; updates concurrency/checkout ref
.github/workflows/docker-lint.yml	Moves to workflow_dispatch; relaxes hadolint threshold
.github/workflows/codecov-upload.yml	Enables PR coverage uploads + inputs to control which jobs run
.github/workflows/benchmark.yml	Gates on Docker workflow success; updates GO_VERSION
.github/workflows/badge-ghcr-downloads.yml	Adds scheduled workflow to update GHCR pulls badge JSON
.github/workflows/auto-versioning.yml	Gates versioning on Docker workflow success for main
.github/workflows/auto-changelog.yml	Gates on Docker workflow success; keeps release trigger
.github/workflows/auto-add-to-project.yml	Adjusts triggers + token fallback behavior
.github/skills/utility-update-go-version-scripts/run.sh	Rebuilds key Go tools after Go upgrade
.github/skills/test-e2e-playwright.SKILL.md	Updates guidance/default browser + rebuild guidance
.github/skills/test-e2e-playwright-scripts/run.sh	Changes default browser/base URL + coverage/security env defaults
.github/skills/test-e2e-playwright-debug.SKILL.md	Clarifies rebuild guidance
.github/skills/test-e2e-playwright-debug-scripts/run.sh	Changes default browser/base URL + coverage/security env defaults
.github/skills/test-e2e-playwright-coverage.SKILL.md	Updates default browser + rebuild guidance
.github/skills/test-e2e-playwright-coverage-scripts/run.sh	Changes default browser + coverage/security env defaults
.github/skills/integration-test-waf.SKILL.md	Adds skill definition doc for WAF integration wrapper
.github/skills/integration-test-waf-scripts/run.sh	Adds wrapper script for existing WAF integration script
.github/skills/integration-test-rate-limit-scripts/run.sh	Adds wrapper script for existing rate limit integration script
.github/skills/integration-test-cerberus-scripts/run.sh	Adds wrapper script for existing Cerberus integration script
.github/skills/integration-test-all-scripts/run.sh	Points wrapper at canonical integration-test-all entrypoint
.github/renovate.json	Adds regex manager to track GO_VERSION in workflows
.github/instructions/testing.instructions.md	Updates test protocols (rebuild conditions, default browser, patch coverage stance)
.github/instructions/markdown.instructions.md	Adjusts required front matter guidance
.github/instructions/github-actions-ci-cd-best-practices.instructions.md	Notes gh CLI fallback when MCP fetch lacks auth
.github/instructions/copilot-instructions.md	Updates default E2E command + patch coverage guidance
.github/instructions/ARCHITECTURE.instructions.md	Updates Go version + E2E command snippet
.github/badges/ghcr-downloads.json	Adds badge endpoint JSON (generated/updated by workflow)
.github/agents/Supervisor.agent.md	Updates agent tool configuration/instructions
.github/agents/QA_Security.agent.md	Updates agent tool configuration + rebuild guidance text
.github/agents/Frontend_Dev.agent.md	Updates agent tool configuration
.github/agents/DevOps.agent.md	Updates agent tool configuration + guidance
.github/agents/Backend_Dev.agent.md	Updates agent tool configuration + guidance
.docker/compose/docker-compose.playwright-ci.yml	Clarifies CI image tag comment
.docker/README.md	Documents new env vars for runtime paths/mode
.codecov.yml	Configures PR comment behavior/layout