Merge remote-tracking branch 'origin/main' into feat/goals-v2-architecture

# Conflicts:
#	.github/workflows/preview-deploy.yml
#	app/models/account/provider_import_adapter.rb

.github/workflows/ci.yml

@@ -20,6 +20,9 @@ jobs:
       - name: Scan for security vulnerabilities in Ruby dependencies
         run: bin/brakeman --no-pager
 
+      - name: Validate preview deploy workflow hardening
+        run: ruby bin/preview_deploy_security_check.rb
+
   scan_js:
     runs-on: ubuntu-latest
     timeout-minutes: 10

.github/workflows/label-not-gittensor.yml

@@ -1,60 +0,0 @@
-name: Label non-Gittensor PRs
-
-on:
-  pull_request_target:
-    types:
-      - opened
-      - reopened
-
-permissions:
-  pull-requests: write
-
-jobs:
-  label-pr:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Add not-gittensor label for matched authors
-        uses: actions/github-script@v7
-        env:
-          GITTENSOR_USERS: ${{ vars.GITTENSOR_USERS || '[]' }}
-          GITTENSOR_EXCEPTIONS: ${{ vars.GITTENSOR_EXCEPTIONS || '[]' }}
-          TARGET_LABEL: not-gittensor
-        with:
-          script: |
-            const parseList = (raw, name) => {
-              try {
-                const parsed = JSON.parse(raw || '[]');
-                if (!Array.isArray(parsed)) {
-                  core.setFailed(`${name} must be a JSON array.`);
-                  return [];
-                }
-                return parsed.map((value) => String(value).toLowerCase());
-              } catch (error) {
-                core.setFailed(`Failed to parse ${name}: ${error.message}`);
-                return [];
-              }
-            };
-
-            const author = context.payload.pull_request.user.login.toLowerCase();
-            const users = new Set(parseList(process.env.GITTENSOR_USERS, 'GITTENSOR_USERS'));
-            const exceptions = new Set(parseList(process.env.GITTENSOR_EXCEPTIONS, 'GITTENSOR_EXCEPTIONS'));
-
-            if (users.has(author) || exceptions.has(author)) {
-              core.info(`No label needed for @${author}.`);
-              return;
-            }
-
-            const existingLabels = context.payload.pull_request.labels.map((label) => label.name);
-            if (existingLabels.includes(process.env.TARGET_LABEL)) {
-              core.info(`Label ${process.env.TARGET_LABEL} already present.`);
-              return;
-            }
-
-            await github.rest.issues.addLabels({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              issue_number: context.payload.pull_request.number,
-              labels: [process.env.TARGET_LABEL],
-            });
-
-            core.info(`Added ${process.env.TARGET_LABEL} to PR #${context.payload.pull_request.number}.`);

.github/workflows/preview-deploy.yml

@@ -16,6 +16,11 @@ jobs:
     name: Deploy to Cloudflare Containers
     runs-on: ubuntu-latest
     timeout-minutes: 15
+    concurrency:
+      group: preview-deploy-${{ github.event.pull_request.number }}
+      cancel-in-progress: true
+    environment:
+      name: preview
     permissions:
       actions: read
       contents: read
@@ -32,10 +37,10 @@ jobs:
 
     steps:
       - name: Wait for PR CI to pass
-        uses: actions/github-script@v7
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
         with:
           script: |
-            const headSha = context.payload.pull_request.head.sha;
+            const headSha = process.env.HEAD_SHA;
             const timeoutMs = 10 * 60 * 1000;
             const pollMs = 15 * 1000;
             const startedAt = Date.now();
@@ -73,24 +78,49 @@ jobs:
 
             core.setFailed(`Timed out waiting for Pull Request workflow for ${headSha}. Last state: ${lastState}`);
 
-      - name: Checkout code
-        uses: actions/checkout@v5
+      - name: Checkout PR code
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+        with:
+          path: pr
+          persist-credentials: false
+
+      - name: Checkout trusted preview tooling
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+        with:
+          ref: ${{ github.event.pull_request.base.sha }}
+          path: trusted
+          persist-credentials: false
+          sparse-checkout: |
+            workers/preview
 
       - name: Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: "24"
 
-      - name: Install Wrangler dependencies
-        working-directory: workers/preview
-        run: npm install
-
-      - name: Configure preview files for this PR
-        working-directory: workers/preview
+      - name: Prepare trusted preview deploy workspace
         run: |
-          sed -i "s/\${PR_NUMBER}/${PR_NUMBER}/g" wrangler.toml
-          sed -i "s/\${PR_NUMBER}/${PR_NUMBER}/g" src/index.ts
-          cat wrangler.toml
+          set -euo pipefail
+
+          preview_dir="$RUNNER_TEMP/sure-preview-worker"
+          rm -rf "$preview_dir"
+          mkdir -p "$preview_dir"
+
+          cp trusted/workers/preview/package.json "$preview_dir/package.json"
+          cp trusted/workers/preview/package-lock.json "$preview_dir/package-lock.json"
+          cp trusted/workers/preview/tsconfig.json "$preview_dir/tsconfig.json"
+          cp trusted/workers/preview/wrangler.toml "$preview_dir/wrangler.toml"
+          cp -R pr/workers/preview/src "$preview_dir/src"
+
+          sed -i "s/\${PR_NUMBER}/${PR_NUMBER}/g" "$preview_dir/wrangler.toml"
+          sed -i "s/\${PR_NUMBER}/${PR_NUMBER}/g" "$preview_dir/src/index.ts"
+          sed -i \
+            "s#image = \"../../Dockerfile.preview\"#image = \"${GITHUB_WORKSPACE}/pr/Dockerfile.preview\"#" \
+            "$preview_dir/wrangler.toml"
+
+          cat "$preview_dir/wrangler.toml"
+          cd "$preview_dir"
+          npm ci --ignore-scripts --no-audit --no-fund
 
       - name: Delete existing preview container app before redeploy
         env:
@@ -127,14 +157,16 @@ jobs:
 
       - name: Create GitHub Deployment
         id: deployment
-        uses: actions/github-script@v7
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
         with:
           script: |
+            const prNumber = process.env.PR_NUMBER;
+            const headSha = process.env.HEAD_SHA;
             const deployment = await github.rest.repos.createDeployment({
               owner: context.repo.owner,
               repo: context.repo.repo,
-              ref: context.payload.pull_request.head.sha,
-              environment: `preview-pr-${process.env.PR_NUMBER}`,
+              ref: headSha,
+              environment: `preview-pr-${prNumber}`,
               auto_merge: false,
               required_contexts: [],
               description: 'PR Preview Deployment'
@@ -144,13 +176,15 @@ jobs:
 
       - name: Deploy to Cloudflare Containers
         id: deploy
-        working-directory: workers/preview
         env:
           CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
           CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
           CLOUDFLARE_WORKERS_SUBDOMAIN: ${{ secrets.CLOUDFLARE_WORKERS_SUBDOMAIN }}
         run: |
-          npx wrangler deploy --var "PR_NUMBER:${PR_NUMBER}"
+          set -euo pipefail
+
+          cd "$RUNNER_TEMP/sure-preview-worker"
+          ./node_modules/.bin/wrangler deploy --config wrangler.toml --var "PR_NUMBER:${PR_NUMBER}"
 
           # Get the deployment URL
           PREVIEW_URL="https://sure-preview-${PR_NUMBER}.${CLOUDFLARE_WORKERS_SUBDOMAIN}.workers.dev"
@@ -165,22 +199,26 @@ jobs:
 
       - name: Update Deployment Status
         if: always() && steps.deployment.outputs.result
-        uses: actions/github-script@v7
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
+        env:
+          DEPLOYMENT_ID: ${{ steps.deployment.outputs.result }}
+          PREVIEW_URL: ${{ steps.deploy.outputs.preview_url }}
         with:
           script: |
             const state = '${{ job.status }}' === 'success' ? 'success' : 'failure';
+            const previewUrl = process.env.PREVIEW_URL || undefined;
             await github.rest.repos.createDeploymentStatus({
               owner: context.repo.owner,
               repo: context.repo.repo,
-              deployment_id: ${{ steps.deployment.outputs.result }},
+              deployment_id: Number(process.env.DEPLOYMENT_ID),
               state: state,
-              environment_url: state === 'success' ? '${{ steps.deploy.outputs.preview_url }}' : undefined,
+              environment_url: state === 'success' ? previewUrl : undefined,
               description: state === 'success' ? 'Preview deployed successfully' : 'Preview deployment failed'
             });
 
       - name: Comment on PR
         if: success()
-        uses: actions/github-script@v7
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
         env:
           PREVIEW_URL: ${{ steps.deploy.outputs.preview_url }}
         with:
@@ -229,9 +267,8 @@ jobs:
             }
       - name: Store cleanup metadata
         if: success()
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
         with:
           name: preview-cleanup-pr-${{ env.PR_NUMBER }}
-          path: |
-            workers/preview/wrangler.toml
+          path: ${{ runner.temp }}/sure-preview-worker/wrangler.toml
           retention-days: 2