6e78011 fix(security): harden reviewed remediation paths · gordon

M .github/actions/deploy/README.md +10 -10


@@ -27,10 +27,10 @@ jobs:
27	27		deploy:
28	28		runs-on: ubuntu-latest
29	29		steps:
30		-	- uses: actions/checkout@v6
	30	+	- uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
31	31
32	32		- name: Deploy to Gordon
33		-	uses: bnema/gordon/.github/actions/deploy@main
	33	+	uses: bnema/gordon/.github/actions/deploy@271c36a4cc32fabd91b20f93cd006bdd2a01b181
34	34		with:
35	35		registry: registry.mydomain.com
36	36		username: ${{ secrets.GORDON_USERNAME }}

@@ -52,11 +52,11 @@ jobs:
52	52		deploy:
53	53		runs-on: ubuntu-latest
54	54		steps:
55		-	- uses: actions/checkout@v6
	55	+	- uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
56	56
57	57		- name: Deploy to Gordon
58	58		id: deploy
59		-	uses: bnema/gordon/.github/actions/deploy@main
	59	+	uses: bnema/gordon/.github/actions/deploy@271c36a4cc32fabd91b20f93cd006bdd2a01b181
60	60		with:
61	61		registry: registry.mydomain.com
62	62		username: ${{ secrets.GORDON_USERNAME }}

@@ -148,11 +148,11 @@ jobs:
148	148		deploy:
149	149		runs-on: ubuntu-latest
150	150		steps:
151		-	- uses: actions/checkout@v6
	151	+	- uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
152	152		with:
153	153		ref: ${{ github.event.inputs.tag \|\| github.ref }}
154	154
155		-	- uses: bnema/gordon/.github/actions/deploy@main
	155	+	- uses: bnema/gordon/.github/actions/deploy@271c36a4cc32fabd91b20f93cd006bdd2a01b181
156	156		with:
157	157		registry: registry.mydomain.com
158	158		username: ${{ secrets.GORDON_USERNAME }}

@@ -174,8 +174,8 @@ jobs:
174	174		deploy-api:
175	175		runs-on: ubuntu-latest
176	176		steps:
177		-	- uses: actions/checkout@v6
178		-	- uses: bnema/gordon/.github/actions/deploy@main
	177	+	- uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
	178	+	- uses: bnema/gordon/.github/actions/deploy@271c36a4cc32fabd91b20f93cd006bdd2a01b181
179	179		with:
180	180		registry: registry.mydomain.com
181	181		username: ${{ secrets.GORDON_USERNAME }}

@@ -187,8 +187,8 @@ jobs:
187	187		deploy-web:
188	188		runs-on: ubuntu-latest
189	189		steps:
190		-	- uses: actions/checkout@v6
191		-	- uses: bnema/gordon/.github/actions/deploy@main
	190	+	- uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
	191	+	- uses: bnema/gordon/.github/actions/deploy@271c36a4cc32fabd91b20f93cd006bdd2a01b181
192	192		with:
193	193		registry: registry.mydomain.com
194	194		username: ${{ secrets.GORDON_USERNAME }}


@@ -27,10 +27,10 @@ jobs:
27		deploy:	27		deploy:
28		runs-on: ubuntu-latest	28		runs-on: ubuntu-latest
29		steps:	29		steps:
30	-	- uses: actions/checkout@v6	30	+	- uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
31			31
32		- name: Deploy to Gordon	32		- name: Deploy to Gordon
33	-	uses: bnema/gordon/.github/actions/deploy@main	33	+	uses: bnema/gordon/.github/actions/deploy@271c36a4cc32fabd91b20f93cd006bdd2a01b181
34		with:	34		with:
35		registry: registry.mydomain.com	35		registry: registry.mydomain.com
36		username: ${{ secrets.GORDON_USERNAME }}	36		username: ${{ secrets.GORDON_USERNAME }}

@@ -52,11 +52,11 @@ jobs:
52		deploy:	52		deploy:
53		runs-on: ubuntu-latest	53		runs-on: ubuntu-latest
54		steps:	54		steps:
55	-	- uses: actions/checkout@v6	55	+	- uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
56			56
57		- name: Deploy to Gordon	57		- name: Deploy to Gordon
58		id: deploy	58		id: deploy
59	-	uses: bnema/gordon/.github/actions/deploy@main	59	+	uses: bnema/gordon/.github/actions/deploy@271c36a4cc32fabd91b20f93cd006bdd2a01b181
60		with:	60		with:
61		registry: registry.mydomain.com	61		registry: registry.mydomain.com
62		username: ${{ secrets.GORDON_USERNAME }}	62		username: ${{ secrets.GORDON_USERNAME }}

@@ -148,11 +148,11 @@ jobs:
148		deploy:	148		deploy:
149		runs-on: ubuntu-latest	149		runs-on: ubuntu-latest
150		steps:	150		steps:
151	-	- uses: actions/checkout@v6	151	+	- uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
152		with:	152		with:
153		ref: ${{ github.event.inputs.tag \|\| github.ref }}	153		ref: ${{ github.event.inputs.tag \|\| github.ref }}
154			154
155	-	- uses: bnema/gordon/.github/actions/deploy@main	155	+	- uses: bnema/gordon/.github/actions/deploy@271c36a4cc32fabd91b20f93cd006bdd2a01b181
156		with:	156		with:
157		registry: registry.mydomain.com	157		registry: registry.mydomain.com
158		username: ${{ secrets.GORDON_USERNAME }}	158		username: ${{ secrets.GORDON_USERNAME }}

@@ -174,8 +174,8 @@ jobs:
174		deploy-api:	174		deploy-api:
175		runs-on: ubuntu-latest	175		runs-on: ubuntu-latest
176		steps:	176		steps:
177	-	- uses: actions/checkout@v6	177	+	- uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
178	-	- uses: bnema/gordon/.github/actions/deploy@main	178	+	- uses: bnema/gordon/.github/actions/deploy@271c36a4cc32fabd91b20f93cd006bdd2a01b181
179		with:	179		with:
180		registry: registry.mydomain.com	180		registry: registry.mydomain.com
181		username: ${{ secrets.GORDON_USERNAME }}	181		username: ${{ secrets.GORDON_USERNAME }}

@@ -187,8 +187,8 @@ jobs:
187		deploy-web:	187		deploy-web:
188		runs-on: ubuntu-latest	188		runs-on: ubuntu-latest
189		steps:	189		steps:
190	-	- uses: actions/checkout@v6	190	+	- uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
191	-	- uses: bnema/gordon/.github/actions/deploy@main	191	+	- uses: bnema/gordon/.github/actions/deploy@271c36a4cc32fabd91b20f93cd006bdd2a01b181
192		with:	192		with:
193		registry: registry.mydomain.com	193		registry: registry.mydomain.com
194		username: ${{ secrets.GORDON_USERNAME }}	194		username: ${{ secrets.GORDON_USERNAME }}

M docs/installation.md +8 -4


@@ -33,7 +33,8 @@ Manual archive installation requires downloading the matching `checksums.txt` re
33	33
34	34		Linux (x86_64)
35	35		```bash
36		-	wget https://github.com/bnema/gordon/releases/latest/download/gordon_linux_amd64.tar.gz
	36	+	wget https://github.com/bnema/gordon/releases/latest/download/{gordon_linux_amd64.tar.gz,checksums.txt}
	37	+	grep ' gordon_linux_amd64.tar.gz$' checksums.txt \| sha256sum --check --strict
37	38		tar -xzf gordon_linux_amd64.tar.gz
38	39		chmod +x gordon
39	40		sudo mv gordon /usr/local/bin/

@@ -41,7 +42,8 @@ sudo mv gordon /usr/local/bin/
41	42
42	43		Linux (ARM64) - for Raspberry Pi 4, AWS Graviton, Oracle Ampere, etc.
43	44		```bash
44		-	wget https://github.com/bnema/gordon/releases/latest/download/gordon_linux_arm64.tar.gz
	45	+	wget https://github.com/bnema/gordon/releases/latest/download/{gordon_linux_arm64.tar.gz,checksums.txt}
	46	+	grep ' gordon_linux_arm64.tar.gz$' checksums.txt \| sha256sum --check --strict
45	47		tar -xzf gordon_linux_arm64.tar.gz
46	48		chmod +x gordon
47	49		sudo mv gordon /usr/local/bin/

@@ -49,7 +51,8 @@ sudo mv gordon /usr/local/bin/
49	51
50	52		macOS (Apple Silicon)
51	53		```bash
52		-	curl -LO https://github.com/bnema/gordon/releases/latest/download/gordon_darwin_arm64.tar.gz
	54	+	curl -LO https://github.com/bnema/gordon/releases/latest/download/{gordon_darwin_arm64.tar.gz,checksums.txt}
	55	+	grep ' gordon_darwin_arm64.tar.gz$' checksums.txt \| shasum -a 256 --check
53	56		tar -xzf gordon_darwin_arm64.tar.gz
54	57		chmod +x gordon
55	58		sudo mv gordon /usr/local/bin/

@@ -57,7 +60,8 @@ sudo mv gordon /usr/local/bin/
57	60
58	61		macOS (Intel)
59	62		```bash
60		-	curl -LO https://github.com/bnema/gordon/releases/latest/download/gordon_darwin_amd64.tar.gz
	63	+	curl -LO https://github.com/bnema/gordon/releases/latest/download/{gordon_darwin_amd64.tar.gz,checksums.txt}
	64	+	grep ' gordon_darwin_amd64.tar.gz$' checksums.txt \| shasum -a 256 --check
61	65		tar -xzf gordon_darwin_amd64.tar.gz
62	66		chmod +x gordon
63	67		sudo mv gordon /usr/local/bin/

 **Linux (x86_64)**
 ```bash
-wget https://github.com/bnema/gordon/releases/latest/download/gordon_linux_amd64.tar.gz
+wget https://github.com/bnema/gordon/releases/latest/download/{gordon_linux_amd64.tar.gz,checksums.txt}
+grep ' gordon_linux_amd64.tar.gz$' checksums.txt | sha256sum --check --strict
 tar -xzf gordon_linux_amd64.tar.gz
 chmod +x gordon
 sudo mv gordon /usr/local/bin/
 **Linux (ARM64)** - for Raspberry Pi 4, AWS Graviton, Oracle Ampere, etc.
 ```bash
-wget https://github.com/bnema/gordon/releases/latest/download/gordon_linux_arm64.tar.gz
+wget https://github.com/bnema/gordon/releases/latest/download/{gordon_linux_arm64.tar.gz,checksums.txt}
+grep ' gordon_linux_arm64.tar.gz$' checksums.txt | sha256sum --check --strict
 tar -xzf gordon_linux_arm64.tar.gz
 chmod +x gordon
 sudo mv gordon /usr/local/bin/
 **macOS (Apple Silicon)**
 ```bash
-curl -LO https://github.com/bnema/gordon/releases/latest/download/gordon_darwin_arm64.tar.gz
+curl -LO https://github.com/bnema/gordon/releases/latest/download/{gordon_darwin_arm64.tar.gz,checksums.txt}
+grep ' gordon_darwin_arm64.tar.gz$' checksums.txt | shasum -a 256 --check
 tar -xzf gordon_darwin_arm64.tar.gz
 chmod +x gordon
 sudo mv gordon /usr/local/bin/
 **macOS (Intel)**
 ```bash
-curl -LO https://github.com/bnema/gordon/releases/latest/download/gordon_darwin_amd64.tar.gz
+curl -LO https://github.com/bnema/gordon/releases/latest/download/{gordon_darwin_amd64.tar.gz,checksums.txt}
+grep ' gordon_darwin_amd64.tar.gz$' checksums.txt | shasum -a 256 --check
 tar -xzf gordon_darwin_amd64.tar.gz
 chmod +x gordon
 sudo mv gordon /usr/local/bin/

M internal/adapters/in/cli/secret_input.go +18 -4


@@ -2,14 +2,28 @@ package cli
2	2
3	3		import (
4	4		"fmt"
	5	+	"io"
5	6		"os"
6	7		"strings"
	8	+
	9	+	"golang.org/x/sys/unix"
7	10		)
8	11
9	12		func readProtectedSecretFile(path string) (string, error) {
10		-	info, err := os.Stat(path)
	13	+	fd, err := unix.Open(path, unix.O_RDONLY\|unix.O_CLOEXEC\|unix.O_NOFOLLOW, 0)
	14	+	if err != nil {
	15	+	return "", fmt.Errorf("open secret file %s: %w", path, err)
	16	+	}
	17	+	file := os.NewFile(uintptr(fd), path)
	18	+	if file == nil {
	19	+	_ = unix.Close(fd)
	20	+	return "", fmt.Errorf("open secret file %s: invalid file descriptor", path)
	21	+	}
	22	+	defer file.Close()
	23	+
	24	+	info, err := file.Stat()
11	25		if err != nil {
12		-	return "", err
	26	+	return "", fmt.Errorf("stat secret file %s: %w", path, err)
13	27		}
14	28		if !info.Mode().IsRegular() {
15	29		return "", fmt.Errorf("%s is not a regular file", path)

@@ -17,9 +31,9 @@ func readProtectedSecretFile(path string) (string, error) {
17	31		if info.Mode().Perm()&0o077 != 0 {
18	32		return "", fmt.Errorf("%s must not be accessible by group or others (use chmod 600)", path)
19	33		}
20		-	data, err := os.ReadFile(path)
	34	+	data, err := io.ReadAll(file)
21	35		if err != nil {
22		-	return "", err
	36	+	return "", fmt.Errorf("read secret file %s: %w", path, err)
23	37		}
24	38		value := strings.TrimSpace(string(data))
25	39		if value == "" {

 import (
 	"fmt"
+	"io"
 	"os"
 	"strings"
+	"golang.org/x/sys/unix"
 )
 func readProtectedSecretFile(path string) (string, error) {
-	info, err := os.Stat(path)
+	fd, err := unix.Open(path, unix.O_RDONLY|unix.O_CLOEXEC|unix.O_NOFOLLOW, 0)
+	if err != nil {
+		return "", fmt.Errorf("open secret file %s: %w", path, err)
+	}
+	file := os.NewFile(uintptr(fd), path)
+	if file == nil {
+		_ = unix.Close(fd)
+		return "", fmt.Errorf("open secret file %s: invalid file descriptor", path)
+	}
+	defer file.Close()
+	info, err := file.Stat()
 	if err != nil {
-		return "", err
+		return "", fmt.Errorf("stat secret file %s: %w", path, err)
 	}
 	if !info.Mode().IsRegular() {
 		return "", fmt.Errorf("%s is not a regular file", path)
 	if info.Mode().Perm()&0o077 != 0 {
 		return "", fmt.Errorf("%s must not be accessible by group or others (use chmod 600)", path)
 	}
-	data, err := os.ReadFile(path)
+	data, err := io.ReadAll(file)
 	if err != nil {
-		return "", err
+		return "", fmt.Errorf("read secret file %s: %w", path, err)
 	}
 	value := strings.TrimSpace(string(data))
 	if value == "" {

M internal/adapters/out/ratelimit/memory.go +28 -23


@@ -2,6 +2,7 @@
2	2		package ratelimit
3	3
4	4		import (
	5	+	"container/list"
5	6		"context"
6	7		"sync"
7	8		"time"

@@ -18,6 +19,7 @@ var _ out.RateLimiter = (*MemoryStore)(nil)
18	19		// MemoryStore is an in-memory rate limiter implementation using golang.org/x/time/rate.
19	20		// Each unique key gets its own independent rate limiter.
20	21		type limiterEntry struct {
	22	+	key string
21	23		limiter *rate.Limiter
22	24		lastSeen time.Time
23	25		}

@@ -28,8 +30,9 @@ const (
28	30		)
29	31
30	32		type MemoryStore struct {
31		-	limiters map[string]limiterEntry
32		-	mu sync.RWMutex
	33	+	limiters map[string]*list.Element
	34	+	lru *list.List
	35	+	mu sync.Mutex
33	36		rps float64
34	37		burst int
35	38		log zerowrap.Logger

@@ -38,7 +41,8 @@ type MemoryStore struct {
38	41		// NewMemoryStore creates a new in-memory rate limiter store.
39	42		func NewMemoryStore(rps float64, burst int, log zerowrap.Logger) *MemoryStore {
40	43		return &MemoryStore{
41		-	limiters: make(map[string]limiterEntry),
	44	+	limiters: make(map[string]*list.Element),
	45	+	lru: list.New(),
42	46		rps: rps,
43	47		burst: burst,
44	48		log: log,

@@ -62,39 +66,40 @@ func (s MemoryStore) getLimiter(key string) rate.Limiter {
62	66		s.mu.Lock()
63	67		defer s.mu.Unlock()
64	68
65		-	if entry, exists := s.limiters[key]; exists {
	69	+	if element, exists := s.limiters[key]; exists {
	70	+	entry := element.Value.(*limiterEntry)
66	71		entry.lastSeen = now
67		-	s.limiters[key] = entry
	72	+	s.lru.MoveToFront(element)
68	73		return entry.limiter
69	74		}
70	75
71	76		s.evictExpiredOrOldest(now)
72	77		limiter := rate.NewLimiter(rate.Limit(s.rps), s.burst)
73		-	s.limiters[key] = limiterEntry{limiter: limiter, lastSeen: now}
	78	+	entry := &limiterEntry{key: key, limiter: limiter, lastSeen: now}
	79	+	s.limiters[key] = s.lru.PushFront(entry)
74	80		return limiter
75	81		}
76	82
77	83		func (s *MemoryStore) evictExpiredOrOldest(now time.Time) {
78		-	for key, entry := range s.limiters {
79		-	if now.Sub(entry.lastSeen) > limiterIdleTTL {
80		-	delete(s.limiters, key)
	84	+	for element := s.lru.Back(); element != nil; {
	85	+	entry := element.Value.(*limiterEntry)
	86	+	if now.Sub(entry.lastSeen) <= limiterIdleTTL {
	87	+	break
81	88		}
	89	+	previous := element.Prev()
	90	+	s.removeElement(element)
	91	+	element = previous
82	92		}
83		-	if len(s.limiters) < maxLimiterEntries {
84		-	return
	93	+	if len(s.limiters) >= maxLimiterEntries {
	94	+	s.removeElement(s.lru.Back())
85	95		}
	96	+	}
86	97
87		-	var oldestKey string
88		-	var oldest time.Time
89		-	found := false
90		-	for key, entry := range s.limiters {
91		-	if !found \|\| entry.lastSeen.Before(oldest) {
92		-	oldestKey = key
93		-	oldest = entry.lastSeen
94		-	found = true
95		-	}
96		-	}
97		-	if found {
98		-	delete(s.limiters, oldestKey)
	98	+	func (s MemoryStore) removeElement(element list.Element) {
	99	+	if element == nil {
	100	+	return
99	101		}
	102	+	entry := element.Value.(*limiterEntry)
	103	+	delete(s.limiters, entry.key)
	104	+	s.lru.Remove(element)
100	105		}

 package ratelimit
 import (
+	"container/list"
 	"context"
 	"sync"
 	"time"
 // MemoryStore is an in-memory rate limiter implementation using golang.org/x/time/rate.
 // Each unique key gets its own independent rate limiter.
 type limiterEntry struct {
+	key      string
 	limiter  *rate.Limiter
 	lastSeen time.Time
 }
 )
 type MemoryStore struct {
-	limiters map[string]limiterEntry
+	limiters map[string]*list.Element
-	mu       sync.RWMutex
+	lru      *list.List
+	mu       sync.Mutex
 	rps      float64
 	burst    int
 	log      zerowrap.Logger
 // NewMemoryStore creates a new in-memory rate limiter store.
 func NewMemoryStore(rps float64, burst int, log zerowrap.Logger) *MemoryStore {
 	return &MemoryStore{
-		limiters: make(map[string]limiterEntry),
+		limiters: make(map[string]*list.Element),
+		lru:      list.New(),
 		rps:      rps,
 		burst:    burst,
 		log:      log,
 	s.mu.Lock()
 	defer s.mu.Unlock()
-	if entry, exists := s.limiters[key]; exists {
+	if element, exists := s.limiters[key]; exists {
+		entry := element.Value.(*limiterEntry)
 		entry.lastSeen = now
-		s.limiters[key] = entry
+		s.lru.MoveToFront(element)
 		return entry.limiter
 	}
 	s.evictExpiredOrOldest(now)
 	limiter := rate.NewLimiter(rate.Limit(s.rps), s.burst)
-	s.limiters[key] = limiterEntry{limiter: limiter, lastSeen: now}
+	entry := &limiterEntry{key: key, limiter: limiter, lastSeen: now}
+	s.limiters[key] = s.lru.PushFront(entry)
 	return limiter
 }
 func (s *MemoryStore) evictExpiredOrOldest(now time.Time) {
-	for key, entry := range s.limiters {
+	for element := s.lru.Back(); element != nil; {
-		if now.Sub(entry.lastSeen) > limiterIdleTTL {
+		entry := element.Value.(*limiterEntry)
-			delete(s.limiters, key)
+		if now.Sub(entry.lastSeen) <= limiterIdleTTL {
+			break
 		}
+		previous := element.Prev()
+		s.removeElement(element)
+		element = previous
 	}
-	if len(s.limiters) < maxLimiterEntries {
+	if len(s.limiters) >= maxLimiterEntries {
-		return
+		s.removeElement(s.lru.Back())
 	}
+}
-	var oldestKey string
+func (s *MemoryStore) removeElement(element *list.Element) {
-	var oldest time.Time
+	if element == nil {
-	found := false
+		return
-	for key, entry := range s.limiters {
-		if !found || entry.lastSeen.Before(oldest) {
-			oldestKey = key
-			oldest = entry.lastSeen
-			found = true
-		}
-	}
-	if found {
-		delete(s.limiters, oldestKey)
 	}
+	entry := element.Value.(*limiterEntry)
+	delete(s.limiters, entry.key)
+	s.lru.Remove(element)
 }

M internal/usecase/auto/preview/handler.go +2 -3


@@ -79,11 +79,10 @@ func (h *AutoPreviewHandler) Handle(ctx context.Context, event domain.Event) err
79	79		// semaphore prevents a push burst from creating an unbounded goroutine backlog.
80	80		select {
81	81		case h.jobs <- struct{}{}:
	82	+	case <-ctx.Done():
	83	+	return fmt.Errorf("schedule preview %s for %s: %w", previewName, baseRoute.Domain, ctx.Err())
82	84		case <-h.serviceCtx.Done():
83	85		return h.serviceCtx.Err()
84		-	default:
85		-	log.Warn().Str("preview", previewName).Str("base_route", baseRoute.Domain).Msg("preview worker queue is full, skipping event")
86		-	continue
87	86		}
88	87		go func(baseRoute baseRouteInfo, previewDomain string) {
89	88		defer func() { <-h.jobs }()

 		// semaphore prevents a push burst from creating an unbounded goroutine backlog.
 		select {
 		case h.jobs <- struct{}{}:
+		case <-ctx.Done():
+			return fmt.Errorf("schedule preview %s for %s: %w", previewName, baseRoute.Domain, ctx.Err())
 		case <-h.serviceCtx.Done():
 			return h.serviceCtx.Err()
-		default:
-			log.Warn().Str("preview", previewName).Str("base_route", baseRoute.Domain).Msg("preview worker queue is full, skipping event")
-			continue
 		}
 		go func(baseRoute baseRouteInfo, previewDomain string) {
 			defer func() { <-h.jobs }()

M internal/usecase/auto/preview/service.go +5 -1


@@ -339,6 +339,7 @@ func (s *Service) cloneBaseRouteVolumes(ctx context.Context, baseRoute, previewD
339	339
340	340		log := zerowrap.FromCtx(ctx)
341	341		basePrefix := prefix + "-" + domain.StableResourceName(baseRoute) + "-"
	342	+	legacyBasePrefix := prefix + "-" + strings.ReplaceAll(baseRoute, ".", "-") + "-"
342	343
343	344		vols, err := s.volumeCloner.ListVolumes(ctx)
344	345		if err != nil {

@@ -347,7 +348,7 @@ func (s *Service) cloneBaseRouteVolumes(ctx context.Context, baseRoute, previewD
347	348
348	349		var sourceVols []string
349	350		for _, v := range vols {
350		-	if strings.HasPrefix(v.Name, basePrefix) {
	351	+	if strings.HasPrefix(v.Name, basePrefix) \|\| strings.HasPrefix(v.Name, legacyBasePrefix) {
351	352		sourceVols = append(sourceVols, v.Name)
352	353		}
353	354		}

@@ -358,6 +359,9 @@ func (s *Service) cloneBaseRouteVolumes(ctx context.Context, baseRoute, previewD
358	359
359	360		namer := func(sourceVolName string) string {
360	361		pathSuffix := strings.TrimPrefix(sourceVolName, basePrefix)
	362	+	if pathSuffix == sourceVolName {
	363	+	pathSuffix = strings.TrimPrefix(sourceVolName, legacyBasePrefix)
	364	+	}
361	365		return generateVolumeName(prefix, previewDomain, pathSuffix)
362	366		}
363	367

 	log := zerowrap.FromCtx(ctx)
 	basePrefix := prefix + "-" + domain.StableResourceName(baseRoute) + "-"
+	legacyBasePrefix := prefix + "-" + strings.ReplaceAll(baseRoute, ".", "-") + "-"
 	vols, err := s.volumeCloner.ListVolumes(ctx)
 	if err != nil {
 	var sourceVols []string
 	for _, v := range vols {
-		if strings.HasPrefix(v.Name, basePrefix) {
+		if strings.HasPrefix(v.Name, basePrefix) || strings.HasPrefix(v.Name, legacyBasePrefix) {
 			sourceVols = append(sourceVols, v.Name)
 		}
 	}
 	namer := func(sourceVolName string) string {
 		pathSuffix := strings.TrimPrefix(sourceVolName, basePrefix)
+		if pathSuffix == sourceVolName {
+			pathSuffix = strings.TrimPrefix(sourceVolName, legacyBasePrefix)
+		}
 		return generateVolumeName(prefix, previewDomain, pathSuffix)
 	}

M internal/usecase/registry/service.go +6 -3


@@ -191,7 +191,7 @@ func (s Service) PutManifest(ctx context.Context, manifest domain.Manifest) (s
191	191		if validation.IsDigest(manifest.Reference) {
192	192		matches, err := manifestDigestMatches(manifest.Reference, manifest.Data)
193	193		if err != nil {
194		-	return "", err
	194	+	return "", fmt.Errorf("validate manifest digest: %w", err)
195	195		}
196	196		if !matches {
197	197		return "", fmt.Errorf("%w: manifest content does not match %s", domain.ErrDigestMismatch, manifest.Reference)

@@ -237,6 +237,9 @@ func (s Service) PutManifest(ctx context.Context, manifest domain.Manifest) (s
237	237
238	238		// DeleteManifest removes a manifest.
239	239		func (s *Service) DeleteManifest(ctx context.Context, name, reference string) error {
	240	+	s.mutationMu.RLock()
	241	+	defer s.mutationMu.RUnlock()
	242	+
240	243		ctx = zerowrap.CtxWithFields(ctx, map[string]any{
241	244		zerowrap.FieldLayer: "usecase",
242	245		zerowrap.FieldUseCase: "DeleteManifest",

@@ -315,7 +318,7 @@ func (s *Service) repositoryReferencesDigest(name, target string) (bool, error)
315	318		if errors.Is(err, domain.ErrManifestNotFound) {
316	319		return false, nil
317	320		}
318		-	return false, err
	321	+	return false, fmt.Errorf("list tags for repository %s: %w", name, err)
319	322		}
320	323
321	324		queue := append([]string(nil), tags...)

@@ -330,7 +333,7 @@ func (s *Service) repositoryReferencesDigest(name, target string) (bool, error)
330	333
331	334		data, _, err := s.manifestStorage.GetManifest(name, reference)
332	335		if err != nil {
333		-	return false, err
	336	+	return false, fmt.Errorf("get manifest %s for repository %s: %w", reference, name, err)
334	337		}
335	338		var refs manifestReferences
336	339		if err := json.Unmarshal(data, &refs); err != nil {

 	if validation.IsDigest(manifest.Reference) {
 		matches, err := manifestDigestMatches(manifest.Reference, manifest.Data)
 		if err != nil {
-			return "", err
+			return "", fmt.Errorf("validate manifest digest: %w", err)
 		}
 		if !matches {
 			return "", fmt.Errorf("%w: manifest content does not match %s", domain.ErrDigestMismatch, manifest.Reference)
 // DeleteManifest removes a manifest.
 func (s *Service) DeleteManifest(ctx context.Context, name, reference string) error {
+	s.mutationMu.RLock()
+	defer s.mutationMu.RUnlock()
 	ctx = zerowrap.CtxWithFields(ctx, map[string]any{
 		zerowrap.FieldLayer:   "usecase",
 		zerowrap.FieldUseCase: "DeleteManifest",
 		if errors.Is(err, domain.ErrManifestNotFound) {
 			return false, nil
 		}
-		return false, err
+		return false, fmt.Errorf("list tags for repository %s: %w", name, err)
 	}
 	queue := append([]string(nil), tags...)
 		data, _, err := s.manifestStorage.GetManifest(name, reference)
 		if err != nil {
-			return false, err
+			return false, fmt.Errorf("get manifest %s for repository %s: %w", reference, name, err)
 		}
 		var refs manifestReferences
 		if err := json.Unmarshal(data, &refs); err != nil {