From 6fb2d36d7e326e4717e40125b9fe4ed5ddac16b9 Mon Sep 17 00:00:00 2001 From: Renzo F <45401804+rennf93@users.noreply.github.com> Date: Wed, 7 Oct 2026 19:42:39 +0200 Subject: [PATCH 1/5] chore: point workflow at Guard-Core org post-transfer --- .github/workflows/upstream-drift.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/upstream-drift.yml b/.github/workflows/upstream-drift.yml index ab523321..bb8e5a2d 100644 --- a/.github/workflows/upstream-drift.yml +++ b/.github/workflows/upstream-drift.yml @@ -33,7 +33,7 @@ jobs: - name: Checkout guard-core@master uses: actions/checkout@v7.0.1 with: - repository: rennf93/guard-core + repository: Guard-Core/guard-core ref: master path: guard-core-upstream From cef122cca865895cd013dc454479839774af9936 Mon Sep 17 00:00:00 2001 From: Renzo F <45401804+rennf93@users.noreply.github.com> Date: Wed, 7 Oct 2026 19:42:42 +0200 Subject: [PATCH 2/5] chore: point workflow at Guard-Core org post-transfer --- .github/workflows/container-release.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/container-release.yml b/.github/workflows/container-release.yml index 110221bd..5e111b93 100644 --- a/.github/workflows/container-release.yml +++ b/.github/workflows/container-release.yml @@ -65,11 +65,11 @@ jobs: IMAGE_NAME=$(docker images --format "{{.Repository}}:{{.Tag}}" | grep "fastapi-guard-example" | head -n 1) echo "Using image: ${IMAGE_NAME}" - docker tag ${IMAGE_NAME} ghcr.io/${{ github.repository_owner }}/fastapi-guard-example:latest - docker push ghcr.io/${{ github.repository_owner }}/fastapi-guard-example:latest + docker tag ${IMAGE_NAME} ghcr.io/guard-core/fastapi-guard-example:latest + docker push ghcr.io/guard-core/fastapi-guard-example:latest if [[ "${{ env.IS_RELEASE }}" == "true" ]]; then - docker tag ${IMAGE_NAME} ghcr.io/${{ github.repository_owner }}/fastapi-guard-example:${{ env.VERSION }} - docker push ghcr.io/${{ github.repository_owner }}/fastapi-guard-example:${{ env.VERSION }} + docker tag ${IMAGE_NAME} ghcr.io/guard-core/fastapi-guard-example:${{ env.VERSION }} + docker push ghcr.io/guard-core/fastapi-guard-example:${{ env.VERSION }} fi From 24be9c72dd260c984ca71c1e168d08a7a707f8dd Mon Sep 17 00:00:00 2001 From: Renzo F <45401804+rennf93@users.noreply.github.com> Date: Wed, 7 Oct 2026 19:44:10 +0200 Subject: [PATCH 3/5] ci: publish to PyPI via OIDC trusted publishing --- .github/workflows/release.yml | 12 +++--------- 1 file changed, 3 insertions(+), 9 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 2688a6ec..9c491ef9 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -8,7 +8,7 @@ on: jobs: publish: runs-on: ubuntu-latest - # environment: pypi + environment: pypi permissions: id-token: write contents: read @@ -25,20 +25,14 @@ jobs: - name: Install dependencies run: | python -m pip install --upgrade pip - pip install build twine + pip install build - name: Build package run: | python -m build - name: Publish package - env: - TWINE_USERNAME: ${{ secrets.TWINE_USERNAME }} - TWINE_PASSWORD: ${{ secrets.TWINE_PASSWORD }} - run: | - twine upload dist/* - echo "VERSION=${{ github.event.release.tag_name }}" >> $GITHUB_ENV - + uses: pypa/gh-action-pypi-publish@release/v1 - name: Get and Update Version id: get_version run: | From 331d0baee0edd3d13274e0645f841ba413e035a0 Mon Sep 17 00:00:00 2001 From: Renzo F <45401804+rennf93@users.noreply.github.com> Date: Wed, 7 Oct 2026 20:32:06 +0200 Subject: [PATCH 4/5] test: cover detection_pattern_validation_cache_path in live-smoke --- .../scenarios/detection_pattern_cache.py | 43 +++++++++++++++++++ 1 file changed, 43 insertions(+) create mode 100644 tests/live_smoke/scenarios/detection_pattern_cache.py diff --git a/tests/live_smoke/scenarios/detection_pattern_cache.py b/tests/live_smoke/scenarios/detection_pattern_cache.py new file mode 100644 index 00000000..9c9decff --- /dev/null +++ b/tests/live_smoke/scenarios/detection_pattern_cache.py @@ -0,0 +1,43 @@ +import httpx + +from tests.live_smoke.driver import ScenarioContext +from tests.live_smoke.registry import scenario + +_BASE = { + "auto_ban_threshold": 1000, + "rate_limit": 1000, + "excluded_detection_headers": ["x-real-ip", "x-forwarded-for"], +} + +_XSS = "" +_SQLI = "' UNION SELECT password FROM admin--" + +_CACHE_PATH = "/tmp/guard-core-pattern-validation-cache.json" + + +def _echo(client: httpx.Client, body: dict[str, object]) -> httpx.Response: + return client.post("/basic/echo", json=body) + + +@scenario( + covers={"detection_pattern_validation_cache_path"}, + config={**_BASE, "detection_pattern_validation_cache_path": _CACHE_PATH}, +) +def detection_pattern_validation_cache_path_enabled(ctx: ScenarioContext) -> None: + first = _echo(ctx.client, {"note": "benign payload"}) + assert first.status_code == 200, ( + "detection_pattern_validation_cache_path set still blocked a benign payload: " + f"{first.status_code}" + ) + + attack = _echo(ctx.client, {"note": _XSS, "query": _SQLI}) + assert attack.status_code == 400, ( + "detection_pattern_validation_cache_path set stopped blocking an attack payload: " + f"{attack.status_code}" + ) + + repeat = _echo(ctx.client, {"note": _XSS, "query": _SQLI}) + assert repeat.status_code == 400, ( + "repeated attack payload was not handled consistently with the validation cache on: " + f"{repeat.status_code}" + ) From d860150076cec2c079fabe33f1f0e6f026062572 Mon Sep 17 00:00:00 2001 From: Renzo F <45401804+rennf93@users.noreply.github.com> Date: Wed, 7 Oct 2026 20:47:33 +0200 Subject: [PATCH 5/5] test: shorten scenario assertion messages for ruff line-length --- tests/live_smoke/scenarios/detection_pattern_cache.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tests/live_smoke/scenarios/detection_pattern_cache.py b/tests/live_smoke/scenarios/detection_pattern_cache.py index 9c9decff..7cc28846 100644 --- a/tests/live_smoke/scenarios/detection_pattern_cache.py +++ b/tests/live_smoke/scenarios/detection_pattern_cache.py @@ -32,12 +32,12 @@ def detection_pattern_validation_cache_path_enabled(ctx: ScenarioContext) -> Non attack = _echo(ctx.client, {"note": _XSS, "query": _SQLI}) assert attack.status_code == 400, ( - "detection_pattern_validation_cache_path set stopped blocking an attack payload: " + "detection_pattern_validation_cache_path set but an attack was not blocked: " f"{attack.status_code}" ) repeat = _echo(ctx.client, {"note": _XSS, "query": _SQLI}) assert repeat.status_code == 400, ( - "repeated attack payload was not handled consistently with the validation cache on: " + "repeated attack payload inconsistent with the validation cache on: " f"{repeat.status_code}" )