Harden Coding PR Delivery production profile

.github/workflows/container-security.yml

@@ -73,23 +73,43 @@ jobs:
         run: bash -n scripts/container-security-scan.sh
 
       - name: Build ${{ matrix.target }} image
+        id: build-image
         run: |
           set -euo pipefail
           mkdir -p "$REPORT_DIR"
-          DOCKER_BUILDKIT=1 docker build \
-            -f docker/app/Dockerfile \
-            --target "${{ matrix.target }}" \
-            --build-arg "OPENCODE_VERSION=${OPENCODE_VERSION}" \
-            --build-arg "CODEX_VERSION=${CODEX_VERSION}" \
-            --build-arg "CLAUDE_CODE_VERSION=${CLAUDE_CODE_VERSION}" \
-            --build-arg "CODEBUDDY_VERSION=${CODEBUDDY_VERSION}" \
-            --build-arg "SYMPHONY_UID=${SYMPHONY_UID}" \
-            --build-arg "SYMPHONY_GID=${SYMPHONY_GID}" \
-            -t "$IMAGE_NAME" \
-            .
+
+          build_succeeded=false
+          for attempt in 1 2 3; do
+            echo "Docker build attempt ${attempt}/3"
+            if DOCKER_BUILDKIT=1 docker build \
+              -f docker/app/Dockerfile \
+              --target "${{ matrix.target }}" \
+              --build-arg "OPENCODE_VERSION=${OPENCODE_VERSION}" \
+              --build-arg "CODEX_VERSION=${CODEX_VERSION}" \
+              --build-arg "CLAUDE_CODE_VERSION=${CLAUDE_CODE_VERSION}" \
+              --build-arg "CODEBUDDY_VERSION=${CODEBUDDY_VERSION}" \
+              --build-arg "SYMPHONY_UID=${SYMPHONY_UID}" \
+              --build-arg "SYMPHONY_GID=${SYMPHONY_GID}" \
+              -t "$IMAGE_NAME" \
+              .; then
+              build_succeeded=true
+              break
+            fi
+
+            if [ "$attempt" -lt 3 ]; then
+              sleep $((attempt * 15))
+            fi
+          done
+
+          if [ "$build_succeeded" != "true" ]; then
+            exit 1
+          fi
+
+          echo "built=true" >> "$GITHUB_OUTPUT"
 
       - name: Trivy vulnerability gate
-        uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # v0.35.0
+        if: steps.build-image.outputs.built == 'true'
+        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
         with:
           image-ref: ${{ env.IMAGE_NAME }}
           format: table
@@ -98,8 +118,8 @@ jobs:
           exit-code: "1"
 
       - name: Trivy JSON report
-        if: always()
-        uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # v0.35.0
+        if: steps.build-image.outputs.built == 'true'
+        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
         with:
           image-ref: ${{ env.IMAGE_NAME }}
           format: json
@@ -109,17 +129,17 @@ jobs:
           exit-code: "0"
 
       - name: Generate SPDX SBOM
-        if: always()
-        uses: anchore/sbom-action@f8bdd1d8ac5e901a77a92f111440fdb1b593736b # v0.20.6
+        if: steps.build-image.outputs.built == 'true'
+        uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0
         with:
           image: ${{ env.IMAGE_NAME }}
           format: spdx-json
           output-file: ${{ env.REPORT_DIR }}/sbom.spdx.json
           dependency-snapshot: false
 
       - name: Generate CycloneDX SBOM
-        if: always()
-        uses: anchore/sbom-action@f8bdd1d8ac5e901a77a92f111440fdb1b593736b # v0.20.6
+        if: steps.build-image.outputs.built == 'true'
+        uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0
         with:
           image: ${{ env.IMAGE_NAME }}
           format: cyclonedx-json
@@ -128,7 +148,7 @@ jobs:
 
       - name: Upload container security reports
         if: always()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: container-security-${{ matrix.target }}
           path: ${{ env.REPORT_DIR }}

.gitignore

@@ -42,4 +42,6 @@ Thumbs.db
 # Local runtime logs and specs (Existing)
 # ==========================================
 /log/
-specs/
+specs/
+
+maestro-book

elixir/lib/symphony_elixir/platform/priv_assets.ex

@@ -0,0 +1,200 @@
+defmodule SymphonyElixir.Platform.PrivAssets do
+  @moduledoc false
+
+  @default_otp_app :symphony_elixir
+  @cache_rootname "symphony-elixir-priv-assets"
+
+  @spec app_priv_root!(Path.t(), keyword()) :: Path.t()
+  def app_priv_root!(relative_dir, opts \\ []) when is_binary(relative_dir) and is_list(opts) do
+    otp_app = Keyword.get(opts, :otp_app, @default_otp_app)
+    relative_dir = validate_relative_dir!(relative_dir)
+
+    otp_app
+    |> priv_dir!()
+    |> real_priv_dir!()
+    |> Path.join(relative_dir)
+    |> Path.expand()
+  end
+
+  defp priv_dir!(otp_app) when is_atom(otp_app) and not is_nil(otp_app) do
+    case :code.priv_dir(otp_app) do
+      path when is_list(path) ->
+        to_string(path)
+
+      {:error, reason} ->
+        raise ArgumentError,
+              "could not resolve priv directory for otp_app #{inspect(otp_app)}: #{inspect(reason)}"
+    end
+  end
+
+  defp priv_dir!(otp_app) do
+    raise ArgumentError, "application priv asset otp_app must be an atom, got #{inspect(otp_app)}"
+  end
+
+  defp real_priv_dir!(priv_dir) when is_binary(priv_dir) do
+    if File.dir?(priv_dir) do
+      priv_dir
+    else
+      extracted_priv_dir!(priv_dir)
+    end
+  end
+
+  defp extracted_priv_dir!(expected_priv_dir) do
+    script_path = escript_path!()
+    cache_root = extraction_cache_root!(script_path)
+    priv_dir = ensure_extracted_priv_dir!(script_path, cache_root, expected_priv_dir)
+    add_extracted_code_paths(cache_root)
+
+    if File.dir?(priv_dir) do
+      priv_dir
+    else
+      raise ArgumentError,
+            "could not resolve extracted application priv directory: #{inspect(priv_dir)}"
+    end
+  end
+
+  defp add_extracted_code_paths(cache_root) do
+    [cache_root, "*", "ebin"]
+    |> Path.join()
+    |> Path.wildcard()
+    |> Enum.sort()
+    |> Enum.each(&:code.add_patha(String.to_charlist(&1)))
+  end
+
+  defp escript_path! do
+    script_path =
+      :escript.script_name()
+      |> List.to_string()
+      |> Path.expand()
+
+    cond do
+      script_path in ["", Path.expand("-e")] ->
+        raise ArgumentError, "could not resolve escript path for application priv assets"
+
+      File.regular?(script_path) ->
+        script_path
+
+      true ->
+        raise ArgumentError,
+              "could not resolve escript path for application priv assets: #{inspect(script_path)}"
+    end
+  end
+
+  defp extraction_cache_root!(script_path) do
+    case File.stat(script_path) do
+      {:ok, %File.Stat{size: size, mtime: mtime}} ->
+        cache_key = :erlang.phash2({script_path, size, mtime}) |> Integer.to_string(36)
+        Path.join([System.tmp_dir!(), @cache_rootname, cache_key])
+
+      {:error, reason} ->
+        raise ArgumentError,
+              "could not stat escript for application priv assets: #{inspect(script_path)} reason=#{inspect(reason)}"
+    end
+  end
+
+  defp ensure_extracted_priv_dir!(script_path, cache_root, expected_priv_dir) do
+    expected_priv_dir = Path.expand(expected_priv_dir)
+
+    case find_extracted_priv_dir(cache_root, script_path, expected_priv_dir) do
+      {:ok, priv_dir} ->
+        priv_dir
+
+      :error ->
+        File.rm_rf!(cache_root)
+        File.mkdir_p!(cache_root)
+
+        script_path
+        |> escript_archive!()
+        |> unzip_archive!(cache_root)
+
+        case find_extracted_priv_dir(cache_root, script_path, expected_priv_dir) do
+          {:ok, priv_dir} ->
+            priv_dir
+
+          :error ->
+            raise ArgumentError,
+                  "could not find bundled application priv directory after extracting #{inspect(script_path)}"
+        end
+    end
+  end
+
+  defp find_extracted_priv_dir(cache_root, script_path, expected_priv_dir) do
+    direct_candidate =
+      expected_priv_dir
+      |> Path.relative_to(script_path)
+      |> direct_candidate(cache_root)
+
+    cond do
+      is_binary(direct_candidate) and File.dir?(direct_candidate) ->
+        {:ok, direct_candidate}
+
+      true ->
+        [cache_root, "**", "priv"]
+        |> Path.join()
+        |> Path.wildcard()
+        |> Enum.find(&File.dir?/1)
+        |> case do
+          nil -> :error
+          priv_dir -> {:ok, priv_dir}
+        end
+    end
+  end
+
+  defp direct_candidate(relative_path, cache_root) do
+    if Path.type(relative_path) == :relative do
+      Path.join(cache_root, relative_path)
+    end
+  end
+
+  defp escript_archive!(script_path) do
+    case :escript.extract(String.to_charlist(script_path), []) do
+      {:ok, sections} ->
+        case Keyword.fetch(sections, :archive) do
+          {:ok, archive_bin} when is_binary(archive_bin) ->
+            archive_bin
+
+          {:ok, _section} ->
+            raise ArgumentError, "invalid escript archive for application priv assets"
+
+          :error ->
+            raise ArgumentError, "missing escript archive for application priv assets"
+        end
+
+      {:error, reason} ->
+        raise ArgumentError, "could not extract escript archive for application priv assets: #{inspect(reason)}"
+    end
+  end
+
+  defp unzip_archive!(archive_bin, cache_root) do
+    case :zip.extract(archive_bin, [{:cwd, String.to_charlist(cache_root)}]) do
+      {:ok, _paths} ->
+        cache_root
+
+      {:error, reason} ->
+        raise ArgumentError, "could not unzip escript archive for application priv assets: #{inspect(reason)}"
+    end
+  end
+
+  defp validate_relative_dir!(relative_dir) do
+    relative_dir = String.trim(relative_dir)
+    segments = Path.split(relative_dir)
+
+    cond do
+      relative_dir == "" ->
+        raise ArgumentError, "application priv asset root must be non-empty"
+
+      Path.type(relative_dir) == :absolute ->
+        raise ArgumentError, "application priv asset root must be relative"
+
+      contains_forbidden_relative_segment?(segments) ->
+        raise ArgumentError, "application priv asset root must stay under the application priv directory"
+
+      true ->
+        Path.join(segments)
+    end
+  end
+
+  defp contains_forbidden_relative_segment?(segments) do
+    Enum.any?(segments, &(&1 in [".", ".."]))
+  end
+end

elixir/lib/symphony_elixir/storage/migrator.ex

@@ -7,6 +7,7 @@ defmodule SymphonyElixir.Storage.Migrator do
   for the local service profile.
   """
 
+  alias SymphonyElixir.Platform.PrivAssets
   alias SymphonyElixir.Storage.{ErrorCodes, Repo}
 
   @spec child_spec(keyword()) :: Supervisor.child_spec()
@@ -31,7 +32,7 @@ defmodule SymphonyElixir.Storage.Migrator do
 
   @spec migrate(module()) :: :ok | {:error, map()}
   def migrate(repo \\ Repo) do
-    path = Ecto.Migrator.migrations_path(repo)
+    path = migrations_path(repo)
     compiler_options = Code.compiler_options()
 
     try do
@@ -54,4 +55,36 @@ defmodule SymphonyElixir.Storage.Migrator do
       reason: reason
     }
   end
+
+  defp migrations_path(repo) do
+    repo
+    |> repo_priv_root()
+    |> Path.join("migrations")
+    |> PrivAssets.app_priv_root!(otp_app: repo_otp_app(repo))
+  end
+
+  defp repo_priv_root(repo) do
+    repo
+    |> repo_config()
+    |> Keyword.get(:priv, "priv/storage_repo")
+    |> strip_priv_prefix()
+  end
+
+  defp repo_otp_app(repo) do
+    repo
+    |> repo_config()
+    |> Keyword.get(:otp_app, :symphony_elixir)
+  end
+
+  defp repo_config(repo) do
+    if function_exported?(repo, :config, 0) do
+      repo.config()
+    else
+      []
+    end
+  end
+
+  defp strip_priv_prefix("priv/" <> rest), do: rest
+  defp strip_priv_prefix("priv"), do: ""
+  defp strip_priv_prefix(priv) when is_binary(priv), do: priv
 end

elixir/lib/symphony_elixir/storage/redaction/default_backend.ex

@@ -3,6 +3,8 @@ defmodule SymphonyElixir.Storage.Redaction.DefaultBackend do
 
   @behaviour SymphonyElixir.Storage.Redaction
 
+  alias SymphonyElixir.Observability.Redaction, as: ObservabilityRedaction
+
   @redacted "[REDACTED]"
   @sensitive_key_patterns [
     ~r/password/i,
@@ -49,6 +51,7 @@ defmodule SymphonyElixir.Storage.Redaction.DefaultBackend do
   end
 
   defp redact_value(tuple) when is_tuple(tuple), do: tuple |> Tuple.to_list() |> redact_value() |> List.to_tuple()
+  defp redact_value(value) when is_binary(value), do: ObservabilityRedaction.redact_string(value)
   defp redact_value(value), do: value
 
   defp sensitive_key?(key) when is_atom(key), do: key |> Atom.to_string() |> sensitive_key?()