chore(deploy): T2 2026 deploy and dev stack updates

Brings the T2 2026 deploy work from ontrack-features-t2-2026 11.0.x (reviewed and merged work) onto thoth-tech 11.0.x.

Co-authored-by: maplefoxgit <s223932052@deakin.edu.au>
Co-authored-by: UmedaRanuluge <umedakr@gmail.com>
Co-authored-by: Maple 'Ryan' Fox <s223932052@deakin.edu.au>
Co-authored-by: jerickson <joshuae.data@gmail.com>

Author: 4 people

.github/workflows/build-dev-container.yml

@@ -25,44 +25,44 @@ jobs:
             context: ./doubtfire-api/
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
           submodules: recursive
       - name: Setup meta for development image
         id: docker_meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5
         with:
           images: ${{ matrix.image }}
           tags: |
             type=semver,pattern={{major}}.{{minor}}
       - name: Login to DockerHub
-        uses: docker/login-action@v3
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
         if: github.event_name != 'pull_request'
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3
       - name: Set up Docker
         id: buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
       - name: Cache Docker layers
-        uses: actions/cache@v3
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         with:
           path: /tmp/.buildx-cache-app
           key: ${{ runner.os }}-buildx-app-${{ github.sha }}
           restore-keys: |
             ${{ runner.os }}-buildx-app
       - name: Build and push dev container image
         id: docker_build
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
         with:
           file: ${{ matrix.dockerfile }}
           context: ${{ matrix.context }}
           builder: ${{ steps.buildx.outputs.name }}
           push: ${{ github.event_name != 'pull_request' }}
           tags: ${{ steps.docker_meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
+          labels: ${{ steps.docker_meta.outputs.labels }}
           platforms: linux/amd64,linux/arm64
           cache-from: type=local,src=/tmp/.buildx-cache-app  # Reuse cached layers from previous builds.
           cache-to: type=local,dest=/tmp/.buildx-cache-app-new,mode=max  # Save new cache layers after the build.

.github/workflows/validate-production-compose.yml

@@ -0,0 +1,57 @@
+name: validate-production-compose
+
+on:
+  pull_request:
+    paths:
+      - ".github/workflows/validate-production-compose.yml"
+      - ".gitmodules"
+      - ".devcontainer/**"
+      - "development/**"
+      - "HANDOVER.md"
+      - "MIGRATING.md"
+      - "RELEASING.md"
+      - "DEPLOYING.md"
+      - "DESKTOP-PWA.md"
+      - "doubtfire-api"
+      - "doubtfire-web"
+      - "production/**"
+  push:
+    branches:
+      - 11.0.x
+    paths:
+      - ".github/workflows/validate-production-compose.yml"
+      - ".gitmodules"
+      - ".devcontainer/**"
+      - "development/**"
+      - "HANDOVER.md"
+      - "MIGRATING.md"
+      - "RELEASING.md"
+      - "DEPLOYING.md"
+      - "DESKTOP-PWA.md"
+      - "doubtfire-api"
+      - "doubtfire-web"
+      - "production/**"
+
+permissions:
+  contents: read
+
+jobs:
+  validate:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+
+      - name: Test desktop PWA public-asset verification
+        run: python3 -B production/tests/verify_pwa_test.py
+
+      - name: Test release publication and recovery cache controls
+        run: python3 -B production/tests/publish_release_test.py
+
+      - name: Validate production configuration
+        run: production/tests/validate_test.sh
+
+      - name: Verify upload boundaries through the production Nginx template
+        run: python3 -B production/tests/nginx_upload_test.py

.github/workflows/validate-secret-audit.yml

@@ -0,0 +1,22 @@
+name: Validate secret audit tool
+on:
+  pull_request:
+    paths:
+      - tools/audit-vapid-secret.py
+      - tools/tests/test_audit_vapid_secret.py
+      - .github/workflows/validate-secret-audit.yml
+  push:
+    branches: ["11.0.x"]
+    paths:
+      - tools/audit-vapid-secret.py
+      - tools/tests/test_audit_vapid_secret.py
+      - .github/workflows/validate-secret-audit.yml
+permissions:
+  contents: read
+jobs:
+  synthetic-fixtures:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - run: python3 -B -m unittest discover -s tools/tests -p 'test_audit_vapid_secret.py'

.gitignore

@@ -3,6 +3,16 @@
 !/data/**/
 !/data/**/.gitkeep
 /node_modules/
+/.devcontainer/.env
+/development/.env
+
+# Production runtime configuration, credentials, and local TLS material.
+/production/.env.production
+/production/secrets/*
+!/production/secrets/.gitkeep
+/production/shared-files/aliases
+/production/shared-files/msmtprc
+/production/*.sql
 
 # Created by https://www.toptal.com/developers/gitignore/api/macos
 # Edit at https://www.toptal.com/developers/gitignore?templates=macos

CONTRIBUTING.md

@@ -1,7 +1,12 @@
-![Doubtfire Logo](http://puu.sh/lyClF/fde5bfbbe7.png)
 
 # Contributing to Doubtfire
 
+> **Legacy general guide.** For the current 11.0.x combined checkout, source
+> revisions and local runtime, follow `RUNNING-LOCALLY.md` and `HANDOVER.md`.
+> Do not use `run-api-web.sh`, the bind-mount assumptions, or the
+> `development`-branch examples below for this release; they are retained only
+> as upstream historical guidance.
+
 We welcome additions and extensions to Doubtfire that help progress our goal of supporting student learning through frequent formative feedback and delayed summative assessment.
 
 This guide provides high-level details on how to contribute to the Doubtfire repositories.