Harden API security, align frontend contracts, and fix CI gates

.gitattributes

@@ -0,0 +1,2 @@
+* text=auto eol=lf
+*.{cmd,bat,ps1} text eol=crlf

.github/workflows/ci.yml

@@ -33,7 +33,22 @@ jobs:
 
       - name: Check formatting
         run: |
-          dotnet format Sentinel.slnx --verify-no-changes --verbosity diagnostic
+          CHANGED=$(git diff --name-only origin/${{ github.base_ref }}...HEAD -- '*.cs' | tr '\n' ' ')
+          if [ -z "$(echo "$CHANGED" | tr -d ' ')" ]; then
+            echo "No C# files changed; skipping format check."
+            exit 0
+          fi
+          dotnet format Sentinel.slnx --verify-no-changes --include $CHANGED --verbosity diagnostic
+
+      - name: Check for vulnerable NuGet packages
+        run: |
+          dotnet list Sentinel.slnx package --vulnerable --include-transitive 2>&1 | tee vulnerable-packages.txt
+          if grep -q "has the following vulnerable packages" vulnerable-packages.txt; then
+            echo "::error::Vulnerable NuGet packages detected"
+            cat vulnerable-packages.txt
+            exit 1
+          fi
+          echo "No vulnerable NuGet packages found"
 
   frontend-build:
     name: Frontend Build

.github/workflows/codeql.yml

@@ -0,0 +1,63 @@
+name: CodeQL
+
+on:
+  push:
+    branches: [main, develop]
+  pull_request:
+    branches: [main, develop]
+  schedule:
+    - cron: '0 6 * * 1'
+
+permissions:
+  actions: read
+  contents: read
+  security-events: write
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [csharp, javascript-typescript]
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v3
+        with:
+          languages: ${{ matrix.language }}
+          queries: security-and-quality
+
+      - name: Setup .NET
+        if: matrix.language == 'csharp'
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: '10.0.x'
+
+      - name: Build .NET
+        if: matrix.language == 'csharp'
+        run: dotnet build Sentinel.slnx --configuration Release
+
+      - name: Setup Node.js
+        if: matrix.language == 'javascript-typescript'
+        uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+          cache: npm
+          cache-dependency-path: src/sentinel-web/package-lock.json
+
+      - name: Build frontend
+        if: matrix.language == 'javascript-typescript'
+        working-directory: src/sentinel-web
+        run: |
+          npm ci || npm install
+          npm run build
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v3
+        with:
+          category: /language:${{ matrix.language }}

.github/workflows/release.yml

@@ -47,7 +47,6 @@ jobs:
           PostgreSQL__ConnectionString: "Host=localhost;Port=5432;Database=sentinel_test;Username=sentinel;Password=sentinel_test_password"
           Redis__ConnectionString: "localhost:6379"
         run: dotnet test tests/Sentinel.IntegrationTests/Sentinel.IntegrationTests.csproj --configuration Release --no-build --verbosity normal
-        continue-on-error: true
 
     services:
       postgres:
@@ -67,6 +66,11 @@ jobs:
         image: redis:7-alpine
         ports:
           - 6379:6379
+        options: >-
+          --health-cmd "redis-cli ping"
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
 
   publish-images:
     name: Publish Docker Images

CHANGELOG.md

@@ -7,35 +7,37 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.7.0] — 2026-07-09
+
 ### Added
 
-- Initial project scaffolding with .NET 10 API, Workers, Domain, and Infrastructure layers
-- React 19 frontend with Vite, TypeScript, and Tailwind CSS
-- Dark mode UI with sidebar navigation and command palette (Ctrl+K)
-- Pages: Login, Overview, Logs, Metrics, Traces, Alerts, Incidents, Dashboards, Plugins, Settings
-- JWT authentication store with in-memory tokens and refresh flow
-- API client module for `/api/v1` endpoints
-- SignalR integration for live log streaming
-- Virtualized log table with `@tanstack/react-virtual`
-- Metrics charts with Recharts
-- Docker Compose stack: PostgreSQL, ClickHouse, Redis, RabbitMQ, API, Worker, Web
-- Multi-stage Dockerfiles with non-root users and health checks
-- GitHub Actions CI: .NET build/test/format, frontend build, integration tests
-- Governance docs: README, CONTRIBUTING, CODE_OF_CONDUCT, SECURITY, SUPPORT
-- Architecture Decision Records (ADR-001 through ADR-007)
-- Architecture documentation
+- API-key authentication for log/metric/trace ingestion (`X-Api-Key` or `Bearer sent_*`)
+- RBAC permission policies enforced per API feature group
+- Production configuration validation (JWT secrets, CORS, ingestion auth, seeded admin)
+- `POST /api/v1/alerts/executions/{id}/silence` and `GET /api/v1/alerts/executions`
+- `PATCH /api/v1/plugins/{id}` toggle endpoint
+- `PATCH /api/v1/incidents/{id}` partial update endpoint
+- CodeQL security scanning workflow
+- CI gate for vulnerable NuGet packages (`dotnet list package --vulnerable`)
+- Helm chart v0.7.0 and release pipeline
 
 ### Changed
 
-- N/A (initial release)
+- Frontend aligned to backend API contracts (alert rules/executions, plugin status, incident fields)
+- API enums serialized as camelCase strings (integers still accepted on input)
+- CORS restricted to configured origins in production; permissive only in Development
+- Open registration and default admin seeding gated behind `Security` config flags
+- Release workflow integration tests are now blocking
 
 ### Fixed
 
-- N/A (initial release)
+- Frontend/backend mismatches for alerts, plugins, and incidents
+- `release.yml` masking integration test failures with `continue-on-error`
 
-## [0.1.0] — TBD
+## [0.1.0] — 2026-03-01
 
-First public release. See [ROADMAP.md](ROADMAP.md) for planned features.
+Initial public scaffolding: .NET 10 API, React frontend, Docker Compose stack, JWT auth, and CI pipeline.
 
-[Unreleased]: https://github.com/sentinel-observability/sentinel/compare/v0.1.0...HEAD
-[0.1.0]: https://github.com/sentinel-observability/sentinel/releases/tag/v0.1.0
+[Unreleased]: https://github.com/nrzz/Sentinel/compare/v0.7.0...HEAD
+[0.7.0]: https://github.com/nrzz/Sentinel/compare/v0.1.0...v0.7.0
+[0.1.0]: https://github.com/nrzz/Sentinel/releases/tag/v0.1.0

Directory.Build.props

@@ -1,5 +1,6 @@
 <Project>
   <PropertyGroup>
+    <Version>0.7.0</Version>
     <TargetFramework>net10.0</TargetFramework>
     <ImplicitUsings>enable</ImplicitUsings>
     <Nullable>enable</Nullable>

README.md

@@ -57,6 +57,8 @@ docker compose up -d
 | API Docs      | http://localhost:5018/scalar |
 | RabbitMQ Mgmt | http://localhost:15672       |
 
+**Default dev credentials** (when `Security:SeedDefaultAdmin` is true): `admin@sentinel.local` / `Admin123!` — change before any non-local deployment.
+
 ### Local Development
 
 **Backend:**
@@ -98,6 +100,9 @@ Sentinel/
 ## Documentation
 
 - [Architecture](docs/architecture.md)
+- [Deployment](docs/deployment.md)
+- [Operations](docs/operations.md)
+- [Disaster Recovery](docs/disaster-recovery.md)
 - [Contributing](CONTRIBUTING.md)
 - [Roadmap](ROADMAP.md)
 - [Changelog](CHANGELOG.md)

ROADMAP.md

@@ -1,58 +1,50 @@
 # Roadmap
 
-## v0.1.0 — Foundation (Current)
+## v0.7.0 — Current Release
+
+Shipped capabilities:
 
 - [x] Core API with vertical slice architecture
 - [x] PostgreSQL for metadata, ClickHouse for telemetry
 - [x] RabbitMQ message bus for async processing
-- [x] JWT authentication with refresh tokens
-- [x] React frontend with dark mode UI
+- [x] JWT authentication with refresh tokens and RBAC permission policies
+- [x] Tenant API key authentication for ingestion endpoints
+- [x] Log, metric, and trace ingestion via HTTP and gRPC
+- [x] Log search, live streaming (SignalR), and saved searches
+- [x] Metric and trace querying
+- [x] Alert rules, executions, and silencing
+- [x] Incident management with timeline and comments
+- [x] Custom dashboards
+- [x] Plugin install/toggle lifecycle
+- [x] AI-assisted search, summarization, and correlation
+- [x] React 19 frontend with dark mode UI
 - [x] Docker Compose development environment
-- [x] CI pipeline (build, test, format check)
-- [ ] Log ingestion via gRPC and HTTP
-- [ ] Basic log search and live streaming
-- [ ] Metric ingestion and querying
-- [ ] Trace ingestion and visualization
+- [x] Helm chart for Kubernetes (v0.7.0)
+- [x] CI pipeline (build, test, format, CodeQL, vulnerable-package check)
+- [x] Release pipeline (Docker images, Helm package)
+- [x] Operations and disaster recovery documentation
 
-## v0.2.0 — Observability Core
+## v0.8.0 — Reliability & Runtime
 
-- [ ] Alert rule engine with threshold and anomaly detection
-- [ ] Incident management workflow
-- [ ] Custom dashboards with drag-and-drop panels
-- [ ] Saved searches and query history
-- [ ] Service map from trace data
-- [ ] OpenTelemetry collector integration guide
+- [ ] DB-driven alert evaluation worker
+- [ ] Plugin runtime host for custom processors
+- [ ] Redis-backed query result caching
+- [ ] Testcontainers-based integration test suite
+- [ ] Frontend test framework buildout
 
-## v0.3.0 — Scale & Performance
+## v0.9.0 — Scale & Performance
 
 - [ ] Horizontal API scaling with Redis-backed sessions
 - [ ] ClickHouse partitioning and retention policies
 - [ ] Log sampling and rate limiting
-- [ ] Query result caching
-- [ ] Benchmark suite with performance baselines
+- [ ] Benchmark suite with performance baselines and k6 load tests
 
-## v0.4.0 — Extensibility
+## v1.0.0 — Production Hardening
 
-- [ ] Plugin SDK for custom processors and exporters
-- [ ] Webhook notifications (Slack, PagerDuty, Teams)
 - [ ] SSO integration (OIDC, SAML)
-- [ ] Multi-tenant isolation
-- [ ] RBAC with role-based API authorization
-
-## v0.5.0 — AI & Intelligence
-
-- [ ] AI-powered log anomaly detection
-- [ ] Natural language query interface
-- [ ] Automated root-cause analysis
-- [ ] Incident summarization and postmortem drafts
-- [ ] Predictive alerting
-
-## v1.0.0 — Production Ready
-
-- [ ] High-availability deployment guide
-- [ ] Backup and disaster recovery procedures
-- [ ] Comprehensive API documentation
-- [ ] Helm charts for Kubernetes deployment
+- [ ] Webhook notifications (Slack, PagerDuty, Teams)
+- [ ] Service map from trace data
+- [ ] OpenTelemetry collector integration guide
 - [ ] SOC 2 compliance documentation
 - [ ] Performance SLA benchmarks
 

SECURITY.md

@@ -4,7 +4,8 @@
 
 | Version | Supported          |
 | ------- | ------------------ |
-| 0.1.x   | :white_check_mark: |
+| 0.7.x   | :white_check_mark: |
+| 0.1.x   | :x:                |
 
 ## Reporting a Vulnerability
 
@@ -32,7 +33,8 @@ You should receive a response within 48 hours. We will work with you to understa
 
 When deploying Sentinel:
 
-- **Change default credentials** — Update all passwords in `.env` before production use.
+- **Change default credentials** — The dev seeder creates `admin@sentinel.local` / `Admin123!` when `Security:SeedDefaultAdmin` is true. Set `Security:SeedDefaultAdmin` to `false` in production.
+- **Require API keys for ingestion** — Set `Ingestion:RequireApiKey` to `true` and `Ingestion:AllowHeaderOnlyTenant` to `false` in production.
 - **Rotate JWT secrets** — Use a strong, unique `JWT_SECRET_KEY` (minimum 32 characters).
 - **Enable TLS** — Terminate TLS at your reverse proxy or load balancer.
 - **Restrict network access** — Do not expose database ports publicly.