chore: Guard-Core org transfer - workflow updates and OIDC publishing

.github/workflows/container-release.yml

@@ -65,11 +65,11 @@ jobs:
           IMAGE_NAME=$(docker images --format "{{.Repository}}:{{.Tag}}" | grep "fastapi-guard-example" | head -n 1)
           echo "Using image: ${IMAGE_NAME}"
 
-          docker tag ${IMAGE_NAME} ghcr.io/${{ github.repository_owner }}/fastapi-guard-example:latest
-          docker push ghcr.io/${{ github.repository_owner }}/fastapi-guard-example:latest
+          docker tag ${IMAGE_NAME} ghcr.io/guard-core/fastapi-guard-example:latest
+          docker push ghcr.io/guard-core/fastapi-guard-example:latest
 
           if [[ "${{ env.IS_RELEASE }}" == "true" ]]; then
-            docker tag ${IMAGE_NAME} ghcr.io/${{ github.repository_owner }}/fastapi-guard-example:${{ env.VERSION }}
-            docker push ghcr.io/${{ github.repository_owner }}/fastapi-guard-example:${{ env.VERSION }}
+            docker tag ${IMAGE_NAME} ghcr.io/guard-core/fastapi-guard-example:${{ env.VERSION }}
+            docker push ghcr.io/guard-core/fastapi-guard-example:${{ env.VERSION }}
           fi
 

.github/workflows/release.yml

@@ -8,7 +8,7 @@ on:
 jobs:
   publish:
     runs-on: ubuntu-latest
-    # environment: pypi
+    environment: pypi
     permissions:
       id-token: write
       contents: read
@@ -25,20 +25,14 @@ jobs:
       - name: Install dependencies
         run: |
           python -m pip install --upgrade pip
-          pip install build twine
+          pip install build
 
       - name: Build package
         run: |
           python -m build
 
       - name: Publish package
-        env:
-          TWINE_USERNAME: ${{ secrets.TWINE_USERNAME }}
-          TWINE_PASSWORD: ${{ secrets.TWINE_PASSWORD }}
-        run: |
-          twine upload dist/*
-          echo "VERSION=${{ github.event.release.tag_name }}" >> $GITHUB_ENV
-
+        uses: pypa/gh-action-pypi-publish@release/v1
       - name: Get and Update Version
         id: get_version
         run: |

.github/workflows/upstream-drift.yml

@@ -33,7 +33,7 @@ jobs:
       - name: Checkout guard-core@master
         uses: actions/checkout@v7.0.1
         with:
-          repository: rennf93/guard-core
+          repository: Guard-Core/guard-core
           ref: master
           path: guard-core-upstream
 

tests/live_smoke/scenarios/detection_pattern_cache.py

@@ -0,0 +1,43 @@
+import httpx
+
+from tests.live_smoke.driver import ScenarioContext
+from tests.live_smoke.registry import scenario
+
+_BASE = {
+    "auto_ban_threshold": 1000,
+    "rate_limit": 1000,
+    "excluded_detection_headers": ["x-real-ip", "x-forwarded-for"],
+}
+
+_XSS = "<script>alert(1)</script>"
+_SQLI = "' UNION SELECT password FROM admin--"
+
+_CACHE_PATH = "/tmp/guard-core-pattern-validation-cache.json"
+
+
+def _echo(client: httpx.Client, body: dict[str, object]) -> httpx.Response:
+    return client.post("/basic/echo", json=body)
+
+
+@scenario(
+    covers={"detection_pattern_validation_cache_path"},
+    config={**_BASE, "detection_pattern_validation_cache_path": _CACHE_PATH},
+)
+def detection_pattern_validation_cache_path_enabled(ctx: ScenarioContext) -> None:
+    first = _echo(ctx.client, {"note": "benign payload"})
+    assert first.status_code == 200, (
+        "detection_pattern_validation_cache_path set still blocked a benign payload: "
+        f"{first.status_code}"
+    )
+
+    attack = _echo(ctx.client, {"note": _XSS, "query": _SQLI})
+    assert attack.status_code == 400, (
+        "detection_pattern_validation_cache_path set but an attack was not blocked: "
+        f"{attack.status_code}"
+    )
+
+    repeat = _echo(ctx.client, {"note": _XSS, "query": _SQLI})
+    assert repeat.status_code == 400, (
+        "repeated attack payload inconsistent with the validation cache on: "
+        f"{repeat.status_code}"
+    )