feat: Initialize Zastava Webhook service with TLS and Authority authentication

- Added Program.cs to set up the web application with Serilog for logging, health check endpoints, and a placeholder admission endpoint. - Configured Kestrel server to use TLS 1.3 and handle client certificates appropriately. - Created StellaOps.Zastava.Webhook.csproj with necessary dependencies including Serilog and Polly. - Documented tasks in TASKS.md for the Zastava Webhook project, outlining current work and exit criteria for each task.
2025-10-19 18:36:22 +03:00
parent 7e2fa0a42a
commit 5ce40d2eeb
966 changed files with 91038 additions and 1850 deletions
--- a/docs/events/scanner.scan.completed@1.json
+++ b/docs/events/scanner.scan.completed@1.json
@@ -0,0 +1,97 @@
+{
+  "$id": "https://stella-ops.org/schemas/events/scanner.scan.completed@1.json",
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "type": "object",
+  "required": ["eventId", "kind", "tenant", "ts", "scope", "payload"],
+  "properties": {
+    "eventId": {"type": "string", "format": "uuid"},
+    "kind": {"const": "scanner.scan.completed"},
+    "tenant": {"type": "string"},
+    "ts": {"type": "string", "format": "date-time"},
+    "scope": {
+      "type": "object",
+      "required": ["repo", "digest"],
+      "properties": {
+        "namespace": {"type": "string"},
+        "repo": {"type": "string"},
+        "digest": {"type": "string"}
+      }
+    },
+    "payload": {
+      "type": "object",
+      "required": ["reportId", "digest", "verdict", "summary"],
+      "properties": {
+        "reportId": {"type": "string"},
+        "digest": {"type": "string"},
+        "verdict": {"enum": ["pass", "warn", "fail"]},
+        "summary": {
+          "type": "object",
+          "properties": {
+            "total": {"type": "integer", "minimum": 0},
+            "blocked": {"type": "integer", "minimum": 0},
+            "warned": {"type": "integer", "minimum": 0},
+            "ignored": {"type": "integer", "minimum": 0},
+            "quieted": {"type": "integer", "minimum": 0}
+          },
+          "additionalProperties": false
+        },
+        "delta": {
+          "type": "object",
+          "properties": {
+            "newCritical": {"type": "integer", "minimum": 0},
+            "newHigh": {"type": "integer", "minimum": 0},
+            "kev": {"type": "array", "items": {"type": "string"}}
+          },
+          "additionalProperties": false
+        },
+        "policy": {
+          "type": "object",
+          "properties": {
+            "revisionId": {"type": "string"},
+            "digest": {"type": "string"}
+          },
+          "additionalProperties": false
+        },
+        "findings": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "properties": {
+              "id": {"type": "string"},
+              "severity": {"type": "string"},
+              "cve": {"type": "string"},
+              "purl": {"type": "string"},
+              "reachability": {"type": "string"}
+            },
+            "additionalProperties": true
+          }
+        },
+        "report": {"type": "object"},
+        "dsse": {
+          "type": "object",
+          "required": ["payloadType", "payload", "signatures"],
+          "properties": {
+            "payloadType": {"type": "string"},
+            "payload": {"type": "string"},
+            "signatures": {
+              "type": "array",
+              "items": {
+                "type": "object",
+                "required": ["keyId", "algorithm", "signature"],
+                "properties": {
+                  "keyId": {"type": "string"},
+                  "algorithm": {"type": "string"},
+                  "signature": {"type": "string"}
+                },
+                "additionalProperties": false
+              }
+            }
+          },
+          "additionalProperties": false
+        }
+      },
+      "additionalProperties": true
+    }
+  },
+  "additionalProperties": false
+}