scttbnsn · Sep 6, 2026 · Sep 3, 2026 · Sep 4, 2026 · Sep 4, 2026 · Sep 4, 2026
@@ -74,7 +74,7 @@ reviews:
     - path: "app/internal/**"
       instructions: |
         Request-filtering engine with a default-deny posture. Any change to rule matching, path parsing, or method filtering is security-sensitive — flag anything that could widen what reaches the Docker socket.
-    - path: "app/differential/**"
+    - path: "app/internal/differential/**"
       instructions: |
         Differential test harness comparing behavior against Tecnativa. Don't suggest refactors here.
     - path: "app/integration/**"

@@ -1,8 +1,8 @@
-name: "Quality: Engine API Version Watch (monthly)"
+name: "Quality: Upstream API Watch (monthly)"
 run-name: >-
   ${{
-    github.event_name == 'schedule' && 'Quality: Engine API Version Watch — Monthly schedule' ||
-    format('Quality: Engine API Version Watch — Manual by {0}', github.actor)
+    github.event_name == 'schedule' && 'Quality: Upstream API Watch — Monthly schedule' ||
+    format('Quality: Upstream API Watch — Manual by {0}', github.actor)
   }}
 
 # Sockguard's request/response inspectors are validated against a specific
@@ -23,6 +23,17 @@ run-name: >-
 # that number moves past the pinned ceiling. A maintainer then reviews the
 # new API's changelog entry, updates the pin, and files any follow-up
 # filter work the release needs.
+#
+# The second job watches the other daemon the same way. Podman's native
+# POST /libpod/containers/{name}/update decodes handlers.UpdateEntities, and
+# sockguard's inspector allows an UpdateEntities root key it does not
+# recognize on purpose (deny-on-unknown would refuse working requests on
+# every Podman minor that adds a field, including fields Podman itself
+# discards). That posture is only safe if somebody notices when the upstream
+# body grows, so app/testdata/podman-api/update-entities-root-fields.json
+# pins the field set the inspector was reviewed against and this job
+# re-derives it from Podman's source at `main`. A new field lands as a red
+# monthly check instead of as an uninspected key nobody is looking for.
 
 on:
   workflow_dispatch: {}
@@ -47,7 +58,7 @@ jobs:
       # this job makes is curl against docs.docker.com — a single, stable
       # vendor host.
       - name: Harden Runner
-        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40  # v2.20.1
+        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c  # v2.21.0
         with:
           egress-policy: block
           allowed-endpoints: >
@@ -129,3 +140,62 @@ jobs:
 
           echo "Engine API ceiling ${PINNED} still covers the latest documented version ${LATEST}."
           echo "**Result: within pinned ceiling.**" >> "$GITHUB_STEP_SUMMARY"
+
+  check-libpod-update-fields:
+    name: "Check libpod UpdateEntities root fields"
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+
+    steps:
+      # Audit rather than block, unlike the job above: this one needs the Go
+      # toolchain, the module proxy and the Actions cache on top of
+      # raw.githubusercontent.com, and that endpoint set has not been
+      # enumerated for the egress rollout yet. Same posture the other Go jobs
+      # in this repo hold at stage 1.
+      - name: Harden Runner
+        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c  # v2.21.0
+        with:
+          egress-policy: audit
+
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Setup Go
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e  # v7.0.0
+        with:
+          go-version-file: go.mod
+          cache-dependency-path: go.sum
+
+      # The test parses Podman's own declarations with go/ast and diffs the
+      # flattened root key set against the committed snapshot, so a moved
+      # embedded struct or a changed json tag is resolved the way
+      # encoding/json resolves it rather than grepped for. It skips itself
+      # without the ref, which is how the rest of the suite stays offline.
+      - name: Compare snapshot against Podman main
+        id: drift
+        working-directory: app
+        env:
+          SOCKGUARD_TEST_PODMAN_UPSTREAM_REF: main
+        run: go test ./internal/filter/ -run TestLibpodContainerUpdateSnapshotMatchesUpstreamPodman -count=1 -v
+
+      - name: Summarize
+        if: always()
+        env:
+          STATUS: ${{ steps.drift.outcome }}
+        run: |
+          {
+            echo "### libpod UpdateEntities root fields"
+            echo ""
+            echo "- Pinned set: \`app/testdata/podman-api/update-entities-root-fields.json\`"
+            echo "- Checked against: \`containers/podman@main\`"
+            echo "- Result: ${STATUS}"
+            if [ "${STATUS}" != "success" ]; then
+              echo ""
+              echo "Podman's update body no longer matches the pinned field set."
+              echo "The step log names every field that moved. Add each new one to a"
+              echo "gate list in \`app/internal/filter/libpod_container_update.go\`,"
+              echo "refresh the snapshot, and re-run the offline drift test."
+            fi
+          } >> "$GITHUB_STEP_SUMMARY"
@@ -93,7 +93,7 @@ jobs:
           - { name: FuzzProxyHeadersAndBody,       pkg: ./internal/proxy/ }
           - { name: FuzzHijackHeadersAndBody,      pkg: ./internal/proxy/ }
           - { name: FuzzHijackBidirectionalStream, pkg: ./internal/proxy/ }
-          - { name: FuzzPathRoutingDifferential,   pkg: ./differential/ }
+          - { name: FuzzPathRoutingDifferential,   pkg: ./internal/differential/ }
           - { name: FuzzVisibilityFilter,          pkg: ./internal/visibility/ }
           - { name: FuzzOwnershipMutateBody,       pkg: ./internal/ownership/ }
           - { name: FuzzOwnershipMutateServiceBody, pkg: ./internal/ownership/ }
@@ -105,6 +105,8 @@ jobs:
           - { name: FuzzClassify,                  pkg: ./internal/upstreamflavor/ }
           - { name: FuzzConfigured,                pkg: ./internal/upstreamflavor/ }
           - { name: FuzzPodmanEventLabelFilter,    pkg: ./internal/visibility/ }
+          - { name: FuzzCatalogReachability,       pkg: ./internal/cmd/ }
+          - { name: FuzzValidateServerShutdownGrace, pkg: ./internal/config/ }
 
     steps:
       # Stays audit for stage 1: this job already has an open, in-repo
@@ -115,7 +117,7 @@ jobs:
       # with the otherwise-identical quality-fuzz-nightly.yml job.
       - name: Harden Runner
         if: ${{ inputs.skip_harden_runner != true }}
-        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40  # v2.20.1
+        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c  # v2.21.0
         with:
           egress-policy: audit
 

@@ -8,10 +8,14 @@ run-name: >-
 # Tier 2 of the fuzz strategy. Tier 1 lives in `ci-verify.yml`'s reusable
 # `go-ci` fuzz matrix and gives most fuzzers a 60-second budget on every
 # PR/push to main so obvious regressions fail fast, except FuzzLoadYAML,
-# FuzzHijackBidirectionalStream, and FuzzValidateUpstreamHijackInactivityTimeout,
-# which are heavy enough that they reach hosted CI only in this nightly tier
-# and the monthly tier below (FuzzLoadYAML and FuzzHijackBidirectionalStream
-# also run in the local pre-push smoke test in `lefthook.yml`). This workflow is
+# FuzzHijackBidirectionalStream, FuzzValidateUpstreamHijackInactivityTimeout,
+# and FuzzValidateServerShutdownGrace, which are heavy enough that they reach
+# hosted CI only in this nightly tier and the monthly tier below (FuzzLoadYAML
+# and FuzzHijackBidirectionalStream also run in the local pre-push smoke test
+# in `lefthook.yml`), and
+# FuzzCatalogReachability, whose value is in long coverage-guided runs against
+# the startup validator's bounded route search rather than in a 60-second
+# regression smoke. This workflow is
 # where the deep coverage work
 # happens: 15 minutes per fuzzer by default (overridable via
 # `workflow_dispatch` input up to the job `timeout-minutes` cap), every
@@ -62,18 +66,19 @@ jobs:
     strategy:
       fail-fast: false
       # The org is on the Free plan: 20 concurrent jobs across every repo.
-      # This matrix is 22 on its own, and portwing's Deep Fuzz is also
-      # `30 9 * * *` and asks for 7 at the same minute, so 29 jobs contend
+      # This matrix is 28 on its own, and portwing's Deep Fuzz is also
+      # `30 9 * * *` and asks for 7 at the same minute, so 35 jobs contend
       # for 20 slots. Jobs admitted over the ceiling get starved (`execs`
       # flatlining at 0/sec) and then reclaimed with
       # "The runner has received a shutdown signal", exit 143, which reads
       # as a fuzz failure but is an instrument failure: no `--- FAIL`, no
       # crasher written to testdata. That killed 8, 2 and 7 jobs on the
       # nights of 2026-08-24/25/26 and 4 on 08-27. The one night it went
-      # 22/22 (08-28) was the night GitHub deferred the schedule to 20:56
-      # UTC, clear of the collision. 12 leaves portwing's 7 intact inside
-      # the ceiling with a slot to spare. Do not raise this past 13 while
-      # the plan is Free and portwing shares the minute.
+      # green end to end (08-28, when the matrix was 22) was the night
+      # GitHub deferred the schedule to 20:56 UTC, clear of the collision.
+      # 12 leaves portwing's 7 intact inside the ceiling with a slot to
+      # spare. Do not raise this past 13 while the plan is Free and
+      # portwing shares the minute.
       max-parallel: 12
       matrix:
         fuzzer:
@@ -98,11 +103,13 @@ jobs:
           - { name: FuzzProxyHeadersAndBody,       pkg: ./internal/proxy/ }
           - { name: FuzzHijackHeadersAndBody,      pkg: ./internal/proxy/ }
           - { name: FuzzHijackBidirectionalStream, pkg: ./internal/proxy/ }
-          - { name: FuzzPathRoutingDifferential,   pkg: ./differential/ }
+          - { name: FuzzPathRoutingDifferential,   pkg: ./internal/differential/ }
           - { name: FuzzVisibilityFilter,          pkg: ./internal/visibility/ }
           - { name: FuzzClassify,                  pkg: ./internal/upstreamflavor/ }
           - { name: FuzzConfigured,                pkg: ./internal/upstreamflavor/ }
           - { name: FuzzPodmanEventLabelFilter,    pkg: ./internal/visibility/ }
+          - { name: FuzzCatalogReachability,       pkg: ./internal/cmd/ }
+          - { name: FuzzValidateServerShutdownGrace, pkg: ./internal/config/ }
 
     steps:
       # Stage 1 of the harden-runner egress rollout: pure Go build/fuzz, no
@@ -113,7 +120,7 @@ jobs:
       # the extra defensive hosts rather than a minimal guess). proxy.golang.org
       # serves module zips via signed redirects to storage.googleapis.com.
       - name: Harden Runner
-        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40  # v2.20.1
+        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c  # v2.21.0
         with:
           egress-policy: block
           allowed-endpoints: >

@@ -37,7 +37,7 @@ jobs:
       # Docker. Same endpoint set as quality-fuzz-nightly.yml — see that
       # file's comment for the reasoning on each host.
       - name: Harden Runner
-        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40  # v2.20.1
+        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c  # v2.21.0
         with:
           egress-policy: block
           allowed-endpoints: >

@@ -60,7 +60,7 @@ jobs:
       # the busybox sentinel image from Docker Hub — same variable-CDN
       # reasoning as quality-integration.yml. Revisit in stage 2.
       - name: Harden Runner
-        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40  # v2.20.1
+        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c  # v2.21.0
         with:
           egress-policy: audit
 

@@ -64,7 +64,7 @@ jobs:
       # whichever Ubuntu archive mirror the runner region picks — not a
       # fixed, documented endpoint set. Revisit in stage 2.
       - name: Harden Runner
-        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40  # v2.20.1
+        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c  # v2.21.0
         with:
           egress-policy: audit
 
@@ -235,7 +235,7 @@ jobs:
       # Stays audit for stage 1: same apt-get/mirror reasoning as the
       # rootful leg above. Revisit in stage 2.
       - name: Harden Runner
-        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40  # v2.20.1
+        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c  # v2.21.0
         with:
           egress-policy: audit
 

@@ -46,7 +46,7 @@ jobs:
       # Docker Hub, whose CDN endpoints (production.cloudflare.docker.com
       # and friends) aren't a fixed, documented set. Revisit in stage 2.
       - name: Harden Runner
-        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40  # v2.20.1
+        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c  # v2.21.0
         with:
           egress-policy: audit
 

@@ -48,7 +48,7 @@ jobs:
       count: ${{ steps.matrix.outputs.count }}
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40  # v2.20.1
+        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c  # v2.21.0
         with:
           egress-policy: block
           allowed-endpoints: >
@@ -100,7 +100,7 @@ jobs:
       # This job holds contents: read and no persisted credential; the
       # write-capable update-badge job stays on block.
       - name: Harden Runner
-        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40  # v2.20.1
+        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c  # v2.21.0
         with:
           egress-policy: audit
           disable-sudo: true
@@ -187,7 +187,7 @@ jobs:
       # Stage 1 of the harden-runner egress rollout: only downloads
       # artifacts — all GitHub-internal traffic.
       - name: Harden Runner
-        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40  # v2.20.1
+        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c  # v2.21.0
         with:
           egress-policy: block
           allowed-endpoints: >
@@ -390,7 +390,7 @@ jobs:
     steps:
       # Pushes one commit back to origin — GitHub-internal traffic only.
       - name: Harden Runner
-        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40  # v2.20.1
+        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c  # v2.21.0
         with:
           egress-policy: block
           allowed-endpoints: >

@@ -59,7 +59,7 @@ jobs:
       # 10–24 minutes (step-security/harden-runner#679). Audit mode retains
       # runtime telemetry while allowing the four-hour gate to finish.
       - name: Harden Runner
-        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40  # v2.20.1; step-security/harden-runner#679
+        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c  # v2.21.0; step-security/harden-runner#679
         with:
           egress-policy: audit
           disable-sudo: true

@@ -61,7 +61,7 @@ jobs:
       # Stage 1 of the harden-runner egress rollout: no Docker in this leg,
       # just the route-normalizer self-test against the checked-out repo.
       - name: Harden Runner
-        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40  # v2.20.1
+        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c  # v2.21.0
         with:
           egress-policy: block
           allowed-endpoints: >
@@ -99,7 +99,7 @@ jobs:
       # current-standard rows can each resolve to different registry hosts —
       # not a fixed endpoint set. Revisit in stage 2.
       - name: Harden Runner
-        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40  # v2.20.1
+        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c  # v2.21.0
         with:
           egress-policy: audit
 
@@ -166,7 +166,7 @@ jobs:
       # artifacts and aggregates JSON locally — all GitHub-internal traffic,
       # no checkout even needed.
       - name: Harden Runner
-        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40  # v2.20.1
+        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c  # v2.21.0
         with:
           egress-policy: block
           allowed-endpoints: >

@@ -30,10 +30,28 @@ jobs:
       actions: read
       contents: write  # Push the annotated release tag
     steps:
+      # PKG-1: block mode. Every host here showed up in this job's harden-runner
+      # audit log for the v2.1.0, v2.1.0-rc.2 and v2.1.0-rc.1 cuts, except the
+      # two Node download hosts, which a warm tool cache hides until the day
+      # the runner image stops shipping Node 24.
+      #   github.com: Checkout, and Create and push release tag
+      #   api.github.com: the curl loop in ./.github/actions/verify-ci-success
+      #   raw.githubusercontent.com: Setup Node's actions/node-versions manifest
+      #   objects.githubusercontent.com: Setup Node's toolchain tarball on a cold
+      #     tool cache, the legacy redirect twin of the host below
+      #   release-assets.githubusercontent.com: that same tarball, current host
+      #   *.actions.githubusercontent.com: Actions runtime and log upload
       - name: Harden Runner
-        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40  # v2.20.1
+        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c  # v2.21.0
         with:
-          egress-policy: audit
+          egress-policy: block
+          allowed-endpoints: >
+            github.com:443
+            api.github.com:443
+            raw.githubusercontent.com:443
+            objects.githubusercontent.com:443
+            release-assets.githubusercontent.com:443
+            *.actions.githubusercontent.com:443
 
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1