feat: secure image admission — Trust Policy + digest/cosign foundation (1/3, #4638)#4656

Draft

alxwlw wants to merge 14 commits into

Dokploy:canaryfrom

alxwlw:feat/secure-admission-foundation

Commits on Jun 17, 2026

feat(admission): shared digest-aware image-ref util
alxwlw
committed
feat(admission): repo-matched RepoDigests selection + resolveDigest

alxwlw
and
claude
committed
fix(admission): move local-only guard to docker pull; selectRepoDigest no longer over-rejects bare Hub refs
alxwlw
committed
feat(admission): cosign argv construction + verifySignature

alxwlw
and
claude
committed
fix(admission): validate cosign argv inputs (flag-smuggling) + forward onLog streaming

alxwlw
and
claude
committed
feat(admission): admitImage orchestration + pinned cosign image

alxwlw
and
claude
committed
feat(trust-policy): drizzle schema + zod validators

alxwlw
and
claude
committed
feat(trust-policy): migration for trustPolicy table
alxwlw
committed
feat(trust-policy): CRUD service

alxwlw
and
claude
committed
feat(trust-policy): tRPC router (admin-gated) + registration

alxwlw
and
claude
committed
feat(trust-policy): organization settings UI

alxwlw
and
claude
committed
fix(trust-policy): invalidate trustPolicy.all cache after delete
alxwlw
committed
style(admission): biome line-wrap in image-ref parseImageRef

alxwlw
and
claude
committed
fix(admission): scope DOCKER_CONFIG to login pipeline, block org reassignment on update, parse numeric tags

alxwlw
and
claude
committed