From 425a3b7809ecb6d1bd56b7f9c55b0b5a93bccd74 Mon Sep 17 00:00:00 2001
From: Anton Engelhardt <antoncengelhardt@icloud.com>
Date: Sat, 5 Sep 2026 15:13:59 +0200
Subject: [PATCH 1/5] Align CI with wasm-oidc-plugin and add Trivy plus
 Dependabot

Drop rust-docker-tools, use setup-rust-toolchain, add Dependabot (cargo/github-actions/docker) and Trivy scans, and pin current Docker actions.

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 .github/dependabot.yml              |  33 +++
 .github/workflows/build.yml         | 302 +++-------------------------
 .github/workflows/release.yml       |  62 +++---
 .github/workflows/security-scan.yml |  44 ++++
 .github/workflows/test.yml          | 203 +++++++++----------
 rust-toolchain.toml                 |   5 +
 6 files changed, 246 insertions(+), 403 deletions(-)
 create mode 100644 .github/dependabot.yml
 create mode 100644 .github/workflows/security-scan.yml
 create mode 100644 rust-toolchain.toml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..562e5d8
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,33 @@
+version: 2
+
+updates:
+  - package-ecosystem: "cargo"
+    directory: "/"
+    labels:
+      - "dependencies"
+    schedule:
+      interval: "weekly"
+    commit-message:
+      prefix: "chore(deps): "
+    ignore:
+      - dependency-name: "*"
+        update-types:
+          - "version-update:semver-patch"
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    labels:
+      - "dependencies"
+    schedule:
+      interval: "weekly"
+    commit-message:
+      prefix: "chore(deps): "
+
+  - package-ecosystem: "docker"
+    directory: "/"
+    labels:
+      - "dependencies"
+    schedule:
+      interval: "weekly"
+    commit-message:
+      prefix: "chore(deps): "
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 0adeb07..7470769 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -1,4 +1,4 @@
-name: Test, Build and Deploy basic-auth-plugin
+name: Test and Build basic-auth-plugin
 
 on:
   push:
@@ -9,114 +9,21 @@ env:
   CARGO_TERM_COLOR: always
 
 jobs:
-  cargo-deny:
-    runs-on: ubuntu-latest
-    container:
-      image: ghcr.io/antonengelhardt/rust-docker-tools
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-
-      - name: Rust version
-        run: rustc --version && cargo --version
-
-      - name: Cargo Deny
-        uses: EmbarkStudios/cargo-deny-action@v1
-
-  clippy:
-    runs-on: ubuntu-latest
-    container:
-      image: ghcr.io/antonengelhardt/rust-docker-tools
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-
-      - name: Set up cargo cache
-        uses: actions/cache@v4
-        with:
-          path: |
-            ~/.cargo/bin/
-            ~/.cargo/registry/index/
-            ~/.cargo/registry/cache/
-            ~/.cargo/git/db/
-            target/
-          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
-          restore-keys: |
-            ${{ runner.os }}-cargo-
-
-      - name: Rust version
-        run: rustc --version && cargo --version
-
-      - name: Clippy
-        run: cargo clippy --release --all-targets --target=wasm32-wasip1 -- -D warnings
-
-  fmt:
-    runs-on: ubuntu-latest
-    container:
-      image: ghcr.io/antonengelhardt/rust-docker-tools
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-
-      - name: Rust version
-        run: rustc --version && cargo --version
-
-      - name: Fmt
-        run: cargo fmt -- --check
-
-  test:
-    runs-on: ubuntu-latest
-    container:
-      image: ghcr.io/antonengelhardt/rust-docker-tools
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-
-      - name: Set up cargo cache
-        uses: actions/cache@v4
-        with:
-          path: |
-            ~/.cargo/bin/
-            ~/.cargo/registry/index/
-            ~/.cargo/registry/cache/
-            ~/.cargo/git/db/
-            target/
-          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
-          restore-keys: |
-            ${{ runner.os }}-cargo-
-
-      - name: Rust version
-        run: rustc --version && cargo --version
-
-      - name: Test
-        run: cargo test --workspace
-
   build:
     runs-on: ubuntu-latest
-    container:
-      image: ghcr.io/antonengelhardt/rust-docker-tools
-    needs: [cargo-deny, clippy, fmt, test]
-
+    permissions:
+      contents: read
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
 
-      - name: Set up cargo cache
-        uses: actions/cache@v4
+      - name: Setup Rust with wasm32-wasip1
+        uses: actions-rust-lang/setup-rust-toolchain@v1
         with:
-          path: |
-            ~/.cargo/bin/
-            ~/.cargo/registry/index/
-            ~/.cargo/registry/cache/
-            ~/.cargo/git/db/
-            target/
-          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
-          restore-keys: |
-            ${{ runner.os }}-cargo-
+          cache: true
 
       - name: Build basic-auth-plugin
-        run: |
-          cargo build --target wasm32-wasip1 --release
+        run: cargo build --target wasm32-wasip1 --release
 
       - name: Upload plugin as artifact
         uses: actions/upload-artifact@v4
@@ -125,201 +32,56 @@ jobs:
           path: target/wasm32-wasip1/release/basic_auth_plugin.wasm
 
   docker-image:
-    needs: [cargo-deny, clippy, fmt, test]
     runs-on: ubuntu-latest
-
+    permissions:
+      contents: read
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
 
-      - name: Login
-        uses: docker/login-action@v2
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Login to Docker Hub
+        uses: docker/login-action@v3
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_PASSWORD }}
 
-      - name: Pull previous image to cache
-        run: docker pull antonengelhardt/basic-auth-plugin:latest
-
-      - name: Push to Docker Hub
-        uses: docker/build-push-action@v2
+      - name: Build and push
+        uses: docker/build-push-action@v6
         with:
           context: .
           push: true
           tags: antonengelhardt/basic-auth-plugin:latest
+          cache-from: type=registry,ref=antonengelhardt/basic-auth-plugin:latest
+          cache-to: type=inline
 
   ghcr-image:
     runs-on: ubuntu-latest
-    needs: [cargo-deny, clippy, fmt, test]
+    needs: [build]
     permissions:
       contents: read
       packages: write
-
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
 
-      - name: Login
-        uses: docker/login-action@v2
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Login to GHCR
+        uses: docker/login-action@v3
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Push to GHCR
-        run: |
-          docker pull ghcr.io/antonengelhardt/basic-auth-plugin:latest # Pull the image to cache
-          docker build -t ghcr.io/antonengelhardt/basic-auth-plugin:latest .
-          docker push ghcr.io/antonengelhardt/basic-auth-plugin:latest
-
-  # changelog-and-release:
-  #   runs-on: ubuntu-latest
-  #   permissions:
-  #     contents: write
-  #   steps:
-  #     - name: Checkout code
-  #       uses: actions/checkout@v4
-  #       with:
-  #         ssh-key: ${{ secrets.RELEASE_DEPLOY_KEY }}
-
-  #     - name: Exit if latest commit is release commit (to avoid infinite loop)
-  #       run: |
-  #         if git log -1 --pretty=%B | grep -q "chore(release): prepare for"; then
-  #           echo "Latest commit is a release commit, exiting..."
-  #           echo "EXIT=1" >> $GITHUB_ENV
-  #           exit 0
-  #         fi
-
-  #     - name: Get most recent merged PR and calculate the next tag
-  #       if: env.EXIT != '1'
-  #       id: get_pr
-  #       run: |
-  #         MOST_RECENTLY_MERGED_PR=$(curl -s -H 'Accept: application/vnd.github.v3+json' "https://api.github.com/repos/antonengelhardt/basic-auth-plugin/pulls?state=closed" | \
-  #         jq '[.[] | select(.merged_at != null)] | max_by(.merged_at)')
-  #         PR_NUMBER=$(echo $MOST_RECENTLY_MERGED_PR | jq -r '.number')
-
-  #         LABELS=$(curl -s -H 'Accept: application/vnd.github.v3+json' "https://api.github.com/repos/antonengelhardt/basic-auth-plugin/issues/$PR_NUMBER" | jq -r '.labels[].name')
-
-  #         # Set SEMVER_BUMP based on the presence of labels
-  #         if [[ $LABELS == *"major"* ]]; then
-  #           SEMVER_BUMP="major"
-  #         elif [[ $LABELS == *"minor"* ]]; then
-  #           SEMVER_BUMP="minor"
-  #         elif [[ $LABELS == *"bug"* ]]; then
-  #           SEMVER_BUMP="patch"
-  #         elif [[ $LABELS == *"patch"* ]]; then
-  #           SEMVER_BUMP="patch"
-  #         else
-  #           SEMVER_BUMP="none"
-  #           echo "EXIT=1" >> $GITHUB_ENV
-  #           exit 0 # exit if no labels are found, which means no version bump is required
-  #         fi
-
-  #         # Output the SEMVER_BUMP value
-  #         echo "SEMVER_BUMP is set to: $SEMVER_BUMP"
-
-  #         # LATEST_TAG=$(git describe --tags --abbrev=0)
-  #         LATEST_TAG=$(curl "https://api.github.com/repos/antonengelhardt/basic-auth-plugin/tags" | jq -r '.[0].name')
-
-  #         # Function to bump version numbers
-  #         bump_version() {
-  #             local IFS=.
-  #             local -a parts=($1)
-
-  #             case "$2" in
-  #                 major)
-  #                     ((parts[0]++))
-  #                     parts[1]=0
-  #                     parts[2]=0
-  #                     ;;
-  #                 minor)
-  #                     ((parts[1]++))
-  #                     parts[2]=0
-  #                     ;;
-  #                 patch)
-  #                     ((parts[2]++))
-  #                     ;;
-  #                 *)
-  #                     echo "Error: Unknown version bump type '$2'"
-  #                     exit 1
-  #                     ;;
-  #             esac
-
-  #             echo "${parts[0]}.${parts[1]}.${parts[2]}"
-  #         }
-
-  #         current_version=${LATEST_TAG:1}
-
-  #         # Bump the version based on the SEMVER_BUMP
-  #         new_version=$(bump_version "$current_version" "$SEMVER_BUMP")
-  #         echo "VERSION=$new_version" >> $GITHUB_ENV
-
-  #         # Append 'v' prefix if required to maintain the same version format
-  #         NEW_TAG="v$new_version"
-  #         echo "New tag after bump is: $NEW_TAG"
-  #         echo "NEW_TAG=$NEW_TAG" >> $GITHUB_ENV
-
-  #     - name: Bump Version on Cargo.toml
-  #       if: env.EXIT != '1'
-  #       run: sed -i "s/^version = \".*\"/version = \"${{ env.VERSION }}\"/" Cargo.toml
-
-  #     - name: Git Cliff
-  #       if: env.EXIT != '1'
-  #       id: generate_changelog
-  #       uses: orhun/git-cliff-action@v3
-  #       with:
-  #         config: cliff.toml
-  #         args: -l --prepend CHANGELOG.md --strip header
-  #       env:
-  #         GITHUB_REPO: ${{ github.repository }}
-
-  #     - name: sed [unreleased] with new version in CHANGELOG.md
-  #       if: env.EXIT != '1'
-  #       run: sed -i "s/\[unreleased\]/${{ env.NEW_TAG }}/" CHANGELOG.md
-
-  #     - name: sed [unreleased] with new version in RELEASE_NOTES.md
-  #       if: env.EXIT != '1'
-  #       run: |
-  #         cat ${{ steps.generate_changelog.outputs.changelog }} > RELEASE_NOTES.md
-  #         sed -i "s/\[unreleased\]/${{ env.NEW_TAG }}/" RELEASE_NOTES.md
-
-  #     - name: Print Changelog
-  #       if: env.EXIT != '1'
-  #       run: cat ${{ steps.generate_changelog.outputs.changelog }} && echo "##" && cat CHANGELOG.md
-
-  #     - name: Commit Version and CHANGELOG.md
-  #       if: env.EXIT != '1'
-  #       run: |
-  #         git checkout origin/main
-  #         git config user.name "github-actions[bot]"
-  #         git config user.email "github-actions[bot]@users.noreply.github.com"
-  #         set +e
-  #         git add Cargo.toml CHANGELOG.md
-  #         cargo check
-  #         git add Cargo.lock
-  #         git commit -m "chore(release): prepare for ${{ env.NEW_TAG }}"
-  #         git push origin HEAD:main
-
-  #     - name: Create a tag on main
-  #       if: env.EXIT != '1'
-  #       run: |
-  #         git checkout origin/main
-
-  #         git config user.email "github-actions[bot]@users.noreply.github.com"
-  #         git config user.name "github-actions[bot]"
-
-  #         git tag ${{ env.NEW_TAG }}
-
-  #         git push origin ${{ env.NEW_TAG }}
-
-  #     - name: Create Release
-  #       uses: actions/create-release@v1
-  #       if: env.EXIT != '1'
-  #       env:
-  #         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-  #       with:
-  #         tag_name: ${{ env.NEW_TAG }}
-  #         release_name: ${{ env.NEW_TAG }}
-  #         body_path: RELEASE_NOTES.md
-  #         draft: false
-  #         prerelease: false
+      - name: Build and push
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          push: true
+          tags: ghcr.io/antonengelhardt/basic-auth-plugin:latest
+          cache-from: type=registry,ref=ghcr.io/antonengelhardt/basic-auth-plugin:latest
+          cache-to: type=inline
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index afb34fa..ed43490 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -9,28 +9,19 @@ jobs:
   build:
     name: Build and upload artifacts
     runs-on: ubuntu-latest
-    container:
-      image: ghcr.io/antonengelhardt/rust-docker-tools
+    permissions:
+      contents: read
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
 
-      - name: Set up cargo cache
-        uses: actions/cache@v4
+      - name: Setup Rust with wasm32-wasip1
+        uses: actions-rust-lang/setup-rust-toolchain@v1
         with:
-          path: |
-            ~/.cargo/bin/
-            ~/.cargo/registry/index/
-            ~/.cargo/registry/cache/
-            ~/.cargo/git/db/
-            target/
-          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
-          restore-keys: |
-            ${{ runner.os }}-cargo-
+          cache: true
 
       - name: Build
-        run: |
-          cargo build --target wasm32-wasip1 --release
+        run: cargo build --target wasm32-wasip1 --release
 
       - name: Archive production artifacts
         uses: actions/upload-artifact@v4
@@ -41,12 +32,17 @@ jobs:
   docker-image:
     name: Build and push Docker image
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
 
-      - name: Login
-        uses: docker/login-action@v2
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Login to Docker Hub
+        uses: docker/login-action@v3
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_PASSWORD }}
@@ -56,12 +52,16 @@ jobs:
         run: |
           echo VERSION=$(echo ${{ github.ref }} | grep -o "v[0-9]\+\.[0-9]\+\.[0-9]\+") >> $GITHUB_ENV
 
-      - name: Push to Docker Hub
-        uses: docker/build-push-action@v2
+      - name: Build and push
+        uses: docker/build-push-action@v6
         with:
           context: .
           push: true
-          tags: antonengelhardt/basic-auth-plugin:${{ env.VERSION }}
+          tags: |
+            antonengelhardt/basic-auth-plugin:${{ env.VERSION }}
+            antonengelhardt/basic-auth-plugin:latest
+          cache-from: type=registry,ref=antonengelhardt/basic-auth-plugin:latest
+          cache-to: type=inline
 
   ghcr-image:
     name: Build and push GHCR image
@@ -69,13 +69,15 @@ jobs:
     permissions:
       contents: read
       packages: write
-
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
 
-      - name: Login
-        uses: docker/login-action@v2
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Login to GHCR
+        uses: docker/login-action@v3
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -86,7 +88,13 @@ jobs:
         run: |
           echo VERSION=$(echo ${{ github.ref }} | grep -o "v[0-9]\+\.[0-9]\+\.[0-9]\+") >> $GITHUB_ENV
 
-      - name: Push to GHCR
-        run: |
-          docker build -t ghcr.io/antonengelhardt/basic-auth-plugin:${{ env.VERSION }} .
-          docker push ghcr.io/antonengelhardt/basic-auth-plugin:${{ env.VERSION }}
+      - name: Build and push
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          push: true
+          tags: |
+            ghcr.io/antonengelhardt/basic-auth-plugin:${{ env.VERSION }}
+            ghcr.io/antonengelhardt/basic-auth-plugin:latest
+          cache-from: type=registry,ref=ghcr.io/antonengelhardt/basic-auth-plugin:latest
+          cache-to: type=inline
diff --git a/.github/workflows/security-scan.yml b/.github/workflows/security-scan.yml
new file mode 100644
index 0000000..5fb55fe
--- /dev/null
+++ b/.github/workflows/security-scan.yml
@@ -0,0 +1,44 @@
+name: Security Scan
+
+on:
+  pull_request:
+  schedule:
+    - cron: "0 0 * * *"
+      timezone: Europe/Berlin
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  trivy-fs-scan:
+    name: Trivy Filesystem Scan
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Run Trivy filesystem scan
+        uses: aquasecurity/trivy-action@v0.36.0
+        with:
+          scan-type: fs
+          scan-ref: .
+          severity: CRITICAL,HIGH
+          exit-code: "1"
+
+  trivy-image-scan:
+    name: Trivy Image Scan
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Build container image for scanning
+        run: docker build -t scan:pr .
+
+      - name: Run Trivy image scan
+        uses: aquasecurity/trivy-action@v0.36.0
+        with:
+          image-ref: scan:pr
+          severity: CRITICAL,HIGH
+          exit-code: "1"
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index b3cc520..74e4719 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -6,177 +6,146 @@ on:
 jobs:
   cargo-deny:
     runs-on: ubuntu-latest
-    container:
-      image: ghcr.io/antonengelhardt/rust-docker-tools
+    permissions:
+      contents: read
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
 
-      - name: Rust version
-        run: rustc --version && cargo --version
+      - name: Setup Rust
+        uses: actions-rust-lang/setup-rust-toolchain@v1
+        with:
+          cache: true
 
       - name: Cargo Deny
         uses: EmbarkStudios/cargo-deny-action@v2
 
   clippy:
     runs-on: ubuntu-latest
-    container:
-      image: ghcr.io/antonengelhardt/rust-docker-tools
+    permissions:
+      contents: read
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
 
-      - name: Set up cargo cache
-        uses: actions/cache@v4
+      - name: Setup Rust with wasm32-wasip1
+        uses: actions-rust-lang/setup-rust-toolchain@v1
         with:
-          path: |
-            ~/.cargo/bin/
-            ~/.cargo/registry/index/
-            ~/.cargo/registry/cache/
-            ~/.cargo/git/db/
-            target/
-          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
-          restore-keys: |
-            ${{ runner.os }}-cargo-
-
-      - name: Rust version
-        run: rustc --version && cargo --version
+          cache: true
 
       - name: Clippy
-        run: |
-          rustc --version && cargo --version
-          cargo clippy --release --all-targets --target=wasm32-wasip1 -- -D warnings
+        run: cargo clippy --release --all-targets --target=wasm32-wasip1 -- -D warnings
 
   fmt:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
 
-      - name: Rust version
-        run: rustc --version && cargo --version
+      - name: Setup Rust
+        uses: actions-rust-lang/setup-rust-toolchain@v1
+        with:
+          cache: false
 
       - name: Fmt
         run: cargo fmt -- --check
 
   audit:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
 
-      - name: Set up cargo cache
-        uses: actions/cache@v4
+      - name: Setup Rust
+        uses: actions-rust-lang/setup-rust-toolchain@v1
         with:
-          path: |
-            ~/.cargo/bin/
-            ~/.cargo/registry/index/
-            ~/.cargo/registry/cache/
-            ~/.cargo/git/db/
-            target/
-          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
-          restore-keys: |
-            ${{ runner.os }}-cargo-
+          cache: true
 
       - name: Install cargo audit
-        run: cargo install cargo-audit
+        uses: taiki-e/cache-cargo-install-action@v2
+        with:
+          tool: cargo-audit
 
       - name: Audit
         run: cargo audit -f audit.toml
 
   verify-project:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
 
-      - name: Rust version
-        run: rustc --version && cargo --version
+      - name: Setup Rust
+        uses: actions-rust-lang/setup-rust-toolchain@v1
+        with:
+          cache: false
+
+      - name: Verify Rust toolchain
+        run: |
+          rustc --version
+          rustup show active-toolchain
 
       - name: Verify project
         run: cargo verify-project
 
   outdated:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
 
-      - name: Set up cargo cache
-        uses: actions/cache@v4
+      - name: Setup Rust
+        uses: actions-rust-lang/setup-rust-toolchain@v1
         with:
-          path: |
-            ~/.cargo/bin/
-            ~/.cargo/registry/index/
-            ~/.cargo/registry/cache/
-            ~/.cargo/git/db/
-            target/
-          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
-          restore-keys: |
-            ${{ runner.os }}-cargo-
+          cache: true
 
       - name: Install cargo-outdated
-        run: cargo install cargo-outdated
-
-      - name: Rust version
-        run: rustc --version && cargo --version
+        uses: taiki-e/cache-cargo-install-action@v2
+        with:
+          tool: cargo-outdated
 
       - name: Outdated
         run: cargo outdated --root-deps-only --exit-code 1
 
   test:
     runs-on: ubuntu-latest
-    container:
-      image: ghcr.io/antonengelhardt/rust-docker-tools
+    permissions:
+      contents: read
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
 
-      - name: Set up cargo cache
-        uses: actions/cache@v4
+      - name: Setup Rust
+        uses: actions-rust-lang/setup-rust-toolchain@v1
         with:
-          path: |
-            ~/.cargo/bin/
-            ~/.cargo/registry/index/
-            ~/.cargo/registry/cache/
-            ~/.cargo/git/db/
-            target/
-          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
-          restore-keys: |
-            ${{ runner.os }}-cargo-
-
-      - name: Rust version
-        run: rustc --version && cargo --version
+          cache: true
 
       - name: Test
         run: cargo test --workspace
 
   build:
     runs-on: ubuntu-latest
-    container:
-      image: ghcr.io/antonengelhardt/rust-docker-tools
-    needs: [verify-project]
-
+    permissions:
+      contents: read
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
 
-      - name: Set up cargo cache
-        uses: actions/cache@v4
+      - name: Setup Rust with wasm32-wasip1
+        uses: actions-rust-lang/setup-rust-toolchain@v1
         with:
-          path: |
-            ~/.cargo/bin/
-            ~/.cargo/registry/index/
-            ~/.cargo/registry/cache/
-            ~/.cargo/git/db/
-            target/
-          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
-          restore-keys: |
-            ${{ runner.os }}-cargo-
+          cache: true
 
       - name: Build basic-auth-plugin
-        run: |
-          cargo build --target wasm32-wasip1 --release
+        run: cargo build --target wasm32-wasip1 --release
 
       - name: Upload plugin as artifact
         uses: actions/upload-artifact@v4
@@ -185,49 +154,71 @@ jobs:
           path: target/wasm32-wasip1/release/basic_auth_plugin.wasm
 
   docker-image:
-    needs: [verify-project]
     runs-on: ubuntu-latest
-
+    permissions:
+      contents: read
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
 
-      - name: Login
-        uses: docker/login-action@v2
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Sanitize branch name for image tag
+        id: image_tag
+        env:
+          BRANCH_REF: ${{ github.event.pull_request.head.ref }}
+        run: |
+          sanitized="$(printf '%s' "$BRANCH_REF" | tr '[:upper:]' '[:lower:]' | sed 's/[^a-z0-9._-]/-/g')"
+          echo "tag=pr-${sanitized}" >> "$GITHUB_OUTPUT"
+
+      - name: Login to Docker Hub
+        uses: docker/login-action@v3
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_PASSWORD }}
 
-      - name: Pull previous image to cache
-        run: docker pull antonengelhardt/basic-auth-plugin:pr-${{ github.event.pull_request.head.ref }} || true
-
-      - name: Push to Docker Hub
-        uses: docker/build-push-action@v2
+      - name: Build and push
+        uses: docker/build-push-action@v6
         with:
           context: .
           push: true
-          tags: antonengelhardt/basic-auth-plugin:pr-${{ github.event.pull_request.head.ref}}
+          tags: antonengelhardt/basic-auth-plugin:${{ steps.image_tag.outputs.tag }}
+          cache-from: type=registry,ref=antonengelhardt/basic-auth-plugin:${{ steps.image_tag.outputs.tag }}
+          cache-to: type=inline
 
   ghcr-image:
     runs-on: ubuntu-latest
-    needs: [verify-project]
     permissions:
       contents: read
       packages: write
-
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
 
-      - name: Login
-        uses: docker/login-action@v2
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Sanitize branch name for image tag
+        id: image_tag
+        env:
+          BRANCH_REF: ${{ github.event.pull_request.head.ref }}
+        run: |
+          sanitized="$(printf '%s' "$BRANCH_REF" | tr '[:upper:]' '[:lower:]' | sed 's/[^a-z0-9._-]/-/g')"
+          echo "tag=pr-${sanitized}" >> "$GITHUB_OUTPUT"
+
+      - name: Login to GHCR
+        uses: docker/login-action@v3
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Push to GHCR
-        run: |
-          docker pull ghcr.io/antonengelhardt/basic-auth-plugin:pr-${{ github.event.pull_request.head.ref }} || true # Pull the image to cache
-          docker build -t ghcr.io/antonengelhardt/basic-auth-plugin:pr-${{ github.event.pull_request.head.ref }} .
-          docker push ghcr.io/antonengelhardt/basic-auth-plugin:pr-${{ github.event.pull_request.head.ref }}
+      - name: Build and push
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          push: true
+          tags: ghcr.io/antonengelhardt/basic-auth-plugin:${{ steps.image_tag.outputs.tag }}
+          cache-from: type=registry,ref=ghcr.io/antonengelhardt/basic-auth-plugin:${{ steps.image_tag.outputs.tag }}
+          cache-to: type=inline
diff --git a/rust-toolchain.toml b/rust-toolchain.toml
new file mode 100644
index 0000000..a3f4a19
--- /dev/null
+++ b/rust-toolchain.toml
@@ -0,0 +1,5 @@
+[toolchain]
+channel = "1.97.1"
+components = ["rustfmt", "clippy"]
+targets = ["wasm32-wasip1"]
+profile = "minimal"

From 3cbfbad33ff7701566778d577a3e87b7593fcb45 Mon Sep 17 00:00:00 2001
From: Anton Engelhardt <antoncengelhardt@icloud.com>
Date: Sat, 5 Sep 2026 15:35:49 +0200
Subject: [PATCH 2/5] Fix CI: clippy, cargo-deny, aes-gcm 0.11, and Envoy 1.39
 for Trivy.

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 Cargo.lock  | 300 +++++++++++++++++++++++++---------------------------
 Cargo.toml  |  14 +--
 Dockerfile  |   4 +-
 deny.toml   | 102 +++++++-----------
 src/auth.rs |  23 ++--
 5 files changed, 205 insertions(+), 238 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index da164e0..5a691f5 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1,65 +1,53 @@
 # This file is automatically @generated by Cargo.
 # It is not intended for manual editing.
-version = 3
+version = 4
 
 [[package]]
 name = "aead"
-version = "0.5.2"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d122413f284cf2d62fb1b7db97e02edb8cda96d769b16e443a4f6195e35662b0"
+checksum = "1973cfbc1a2daf9cf550e74e1f088c28e7f7d8c1e1418fb6c9dc5184b7e84c99"
 dependencies = [
  "crypto-common",
- "generic-array",
+ "inout",
 ]
 
 [[package]]
 name = "aes"
-version = "0.8.4"
+version = "0.9.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b169f7a6d4742236a0a00c541b845991d0ac43e546831af1249753ab4c3aa3a0"
+checksum = "35f0f96ce78e38c3dc6d8948aa8163d06385be74000f3c7a95bf1eef35d3ea32"
 dependencies = [
- "cfg-if",
  "cipher",
+ "cpubits",
  "cpufeatures",
 ]
 
 [[package]]
 name = "aes-gcm"
-version = "0.10.3"
+version = "0.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "831010a0f742e1209b3bcea8fab6a8e149051ba6099432c8cb2cc117dec3ead1"
+checksum = "7f2b8006a0c83f52b62ba44a97b58bf76fe2f70a329e588f67f89691d93d498f"
 dependencies = [
  "aead",
  "aes",
  "cipher",
  "ctr",
+ "ctutils",
  "ghash",
- "subtle",
-]
-
-[[package]]
-name = "ahash"
-version = "0.8.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e89da841a80418a9b391ebaea17f5c112ffaaa96f621d2c285b5174da76b9011"
-dependencies = [
- "cfg-if",
- "once_cell",
- "version_check",
- "zerocopy",
 ]
 
 [[package]]
 name = "allocator-api2"
-version = "0.2.20"
+version = "0.2.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "45862d1c77f2228b9e10bc609d5bc203d86ebc9b87ad8d5d5167a6c9abf739d9"
+checksum = "683d7910e743518b0e34f1186f92494becacb047c7b6bf616c96772180fef923"
 
 [[package]]
 name = "base64"
-version = "0.22.1"
+version = "0.23.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
+checksum = "ac07cdecf99051d9a5238b80f35af32cdeba5b336e55d957b318b50137e18da5"
 
 [[package]]
 name = "basic-auth-plugin"
@@ -75,213 +63,240 @@ dependencies = [
  "serde_yaml",
 ]
 
+[[package]]
+name = "block-buffer"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d2f6c7dbe95a6ed67ad9f18e57daf93a2f034c524b99fd2b76d18fdfeb6660aa"
+dependencies = [
+ "hybrid-array",
+]
+
 [[package]]
 name = "cfg-if"
-version = "1.0.0"
+version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
+checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
 
 [[package]]
 name = "cipher"
-version = "0.4.4"
+version = "0.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "773f3b9af64447d2ce9850330c473515014aa235e6a783b02db81ff39e4a3dad"
+checksum = "e8cf2a2c93cd704877c0858356ed03480ff301ee950b43f1cbe4573b088bfa6c"
 dependencies = [
+ "block-buffer",
  "crypto-common",
  "inout",
 ]
 
+[[package]]
+name = "cmov"
+version = "0.5.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c9ea0ac24bc397ab3c98583a3c9ba74fa56b09a4449bbe172b9b1ddb016027a"
+
+[[package]]
+name = "cpubits"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "15b85f9c39137c3a891689859392b1bd49812121d0d61c9caf00d46ed5ce06ae"
+
 [[package]]
 name = "cpufeatures"
-version = "0.2.15"
+version = "0.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0ca741a962e1b0bff6d724a1a0958b686406e853bb14061f218562e1896f95e6"
+checksum = "5ca28b0ae3115b884660db4118d803791fd6756b6e88f39c0f3f7859060d7566"
 dependencies = [
  "libc",
 ]
 
 [[package]]
 name = "crypto-common"
-version = "0.1.6"
+version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1bfb12502f3fc46cca1bb51ac28df9d618d813cdc3d2f25b9fe775a34af26bb3"
+checksum = "ce6e4c961d6cd6c9a86db418387425e8bdeaf05b3c8bc1411e6dca4c252f1453"
 dependencies = [
- "generic-array",
+ "getrandom",
+ "hybrid-array",
  "rand_core",
- "typenum",
 ]
 
 [[package]]
 name = "ctr"
-version = "0.9.2"
+version = "0.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0369ee1ad671834580515889b80f2ea915f23b8be8d0daa4bbaf2ac5c7590835"
+checksum = "baaca1c4b237092596f64d571e9db6ce4109c4ef9742e27590f1709594461f21"
 dependencies = [
  "cipher",
 ]
 
+[[package]]
+name = "ctutils"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7d5515a3834141de9eafb9717ad39eea8247b5674e6066c404e8c4b365d2a29e"
+dependencies = [
+ "cmov",
+]
+
 [[package]]
 name = "equivalent"
-version = "1.0.1"
+version = "1.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5443807d6dff69373d433ab9ef5378ad8df50ca6298caf15de6e52e24aaf54d5"
+checksum = "877a4ace8713b0bcf2a4e7eec82529c029f1d0619886d18145fea96c3ffe5c0f"
 
 [[package]]
-name = "generic-array"
-version = "0.14.7"
+name = "foldhash"
+version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a"
-dependencies = [
- "typenum",
- "version_check",
-]
+checksum = "77ce24cb58228fbb8aa041425bb1050850ac19177686ea6e0f41a70416f56fdb"
 
 [[package]]
 name = "getrandom"
-version = "0.2.15"
+version = "0.4.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c4567c8db10ae91089c99af84c68c38da3ec2f087c3f82960bcdbf3656b6f4d7"
+checksum = "300e883d756b2e4ec94e02791f39b04b522276138852cfc41d9fb7e904106099"
 dependencies = [
  "cfg-if",
  "libc",
- "wasi",
+ "r-efi",
+ "rand_core",
 ]
 
 [[package]]
 name = "ghash"
-version = "0.5.1"
+version = "0.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f0d8a4362ccb29cb0b265253fb0a2728f592895ee6854fd9bc13f2ffda266ff1"
+checksum = "2eecf2d5dc9b66b732b97707a0210906b1d30523eb773193ab777c0c84b3e8d5"
 dependencies = [
- "opaque-debug",
  "polyval",
 ]
 
 [[package]]
 name = "hashbrown"
-version = "0.14.5"
+version = "0.16.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e5274423e17b7c9fc20b6e7e208532f9b19825d82dfd615708b70edd83df41f1"
+checksum = "841d1cc9bed7f9236f321df977030373f4a4163ae1a7dbfe1a51a2c1a51d9100"
 dependencies = [
- "ahash",
  "allocator-api2",
+ "equivalent",
+ "foldhash",
 ]
 
 [[package]]
 name = "hashbrown"
-version = "0.15.1"
+version = "0.17.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed5909b6e89a2db4456e54cd5f673791d7eca6732202bbf2a9cc504fe2f9b84a"
+
+[[package]]
+name = "hybrid-array"
+version = "0.4.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3a9bfc1af68b1726ea47d3d5109de126281def866b33970e10fbab11b5dafab3"
+checksum = "707114b52a152fa7bdb290cd7cd5912d9467273b6d74e21b8d81aca1f8533f6b"
+dependencies = [
+ "typenum",
+]
 
 [[package]]
 name = "indexmap"
-version = "2.6.0"
+version = "2.14.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "707907fe3c25f5424cce2cb7e1cbcafee6bdbe735ca90ef77c29e84591e5b9da"
+checksum = "cc4e190f5d26ca7051642629da2c52fc03bde85a03197c99408dcd291734c855"
 dependencies = [
  "equivalent",
- "hashbrown 0.15.1",
+ "hashbrown 0.17.1",
 ]
 
 [[package]]
 name = "inout"
-version = "0.1.3"
+version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a0c10553d664a4d0bcff9f4215d0aac67a639cc68ef660840afe309b807bc9f5"
+checksum = "4250ce6452e92010fdf7268ccc5d14faa80bb12fc741938534c58f16804e03c7"
 dependencies = [
- "generic-array",
+ "hybrid-array",
 ]
 
 [[package]]
 name = "itoa"
-version = "1.0.11"
+version = "1.0.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "49f1f14873335454500d59611f1cf4a4b0f786f9ac11f4312a78e4cf2566695b"
+checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"
 
 [[package]]
 name = "libc"
-version = "0.2.162"
+version = "0.2.189"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "18d287de67fe55fd7e1581fe933d965a5a9477b38e949cfa9f8574ef01506398"
+checksum = "3eaf3ede3fee6db1a4c2ee091bf8a8b4dccdc6d17f656fb07896ee72867612f2"
 
 [[package]]
 name = "log"
-version = "0.4.22"
+version = "0.4.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a7a70ba024b9dc04c27ea2f0c0548feb474ec5c54bba33a7f72f873a39d07b24"
+checksum = "f9f8bd3e56ce4dfc153cf470fffbfa98c7620958b312ca5c3a4b8d5181fd13c6"
 
 [[package]]
 name = "memchr"
-version = "2.7.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "78ca9ab1a0babb1e7d5695e3530886289c18cf2f87ec19a575a0abdce112e3a3"
-
-[[package]]
-name = "once_cell"
-version = "1.20.2"
+version = "2.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1261fe7e33c73b354eab43b1273a57c8f967d0391e80353e51f764ac02cf6775"
-
-[[package]]
-name = "opaque-debug"
-version = "0.3.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c08d65885ee38876c4f86fa503fb49d7b507c2b62552df7c70b2fce627e06381"
+checksum = "cf8baf1c55e62ffcace7a9f06f4bd9cd3f0c4beb022d3b367256b91b87513d98"
 
 [[package]]
 name = "polyval"
-version = "0.6.2"
+version = "0.7.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9d1fe60d06143b2430aa532c94cfe9e29783047f06c0d7fd359a9a51b729fa25"
+checksum = "f0fa31d631f2b2cb2a544d0aa321ce847a94764d701ca2becc411138b93d49cd"
 dependencies = [
- "cfg-if",
+ "cpubits",
  "cpufeatures",
- "opaque-debug",
  "universal-hash",
 ]
 
 [[package]]
 name = "proc-macro2"
-version = "1.0.89"
+version = "1.0.107"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f139b0662de085916d1fb67d2b4169d1addddda1919e696f3252b740b629986e"
+checksum = "985e7ec9bb745e6ce6535b544d84d6cd6f7ad8bd711c398938ae983b91a766d9"
 dependencies = [
  "unicode-ident",
 ]
 
 [[package]]
 name = "proxy-wasm"
-version = "0.2.2"
+version = "0.2.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "14a5a4df5a1ab77235e36a0a0f638687ee1586d21ee9774037693001e94d4e11"
+checksum = "de8f6564bd52c2f4ff79fa5d1bd3bc10d8f822162af8d527e121e46703496aa0"
 dependencies = [
- "hashbrown 0.14.5",
+ "hashbrown 0.16.1",
  "log",
 ]
 
 [[package]]
 name = "quote"
-version = "1.0.37"
+version = "1.0.47"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b5b9d34b8991d19d98081b46eacdd8eb58c6f2b201139f7c5f643cc155a633af"
+checksum = "1fbf4db142a473a8d80c26bbf18454ed458bf8d26c8219c331daecfdbd079001"
 dependencies = [
  "proc-macro2",
 ]
 
+[[package]]
+name = "r-efi"
+version = "6.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf"
+
 [[package]]
 name = "rand_core"
-version = "0.6.4"
+version = "0.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ec0be4795e2f6a28069bec0b5ff3e2ac9bafc99e6a9a7dc3547996c5c816922c"
-dependencies = [
- "getrandom",
-]
+checksum = "63b8176103e19a2643978565ca18b50549f6101881c443590420e4dc998a3c69"
 
 [[package]]
 name = "ryu"
-version = "1.0.18"
+version = "1.0.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f3cb5ba0dc43242ce17de99c180e96db90b235b8a9fdc9543c96d2209116bd9f"
+checksum = "9774ba4a74de5f7b1c1451ed6cd5285a32eddb5cccb8cc655a4e50009e06477f"
 
 [[package]]
 name = "sec"
@@ -294,18 +309,28 @@ dependencies = [
 
 [[package]]
 name = "serde"
-version = "1.0.215"
+version = "1.0.229"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6513c1ad0b11a9376da888e3e0baa0077f1aed55c17f50e7b2397136129fb88f"
+checksum = "4148590afebada386688f18773da617792bf2ef03ffc1e4cbd2b1d45b023e0ba"
+dependencies = [
+ "serde_core",
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_core"
+version = "1.0.229"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "67dca2c9c51e58a4791a4b1ed58308b39c64224d349a935ab5039aa360942a48"
 dependencies = [
  "serde_derive",
 ]
 
 [[package]]
 name = "serde_derive"
-version = "1.0.215"
+version = "1.0.229"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ad1e866f866923f252f05c889987993144fb74e722403468a4ebd70c3cd756c0"
+checksum = "e7a5d71263a5a7d47b41f6b3f06ba276f10cc18b0931f1799f710578e2309348"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -314,14 +339,15 @@ dependencies = [
 
 [[package]]
 name = "serde_json"
-version = "1.0.132"
+version = "1.0.151"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d726bfaff4b320266d395898905d0eba0345aae23b54aee3a737e260fd46db03"
+checksum = "c841b55ecdae098c80dcae9cf767f6f8a0c2cdb3416bbef72181df4d0fe73f14"
 dependencies = [
  "itoa",
  "memchr",
- "ryu",
  "serde",
+ "serde_core",
+ "zmij",
 ]
 
 [[package]]
@@ -337,17 +363,11 @@ dependencies = [
  "unsafe-libyaml",
 ]
 
-[[package]]
-name = "subtle"
-version = "2.6.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292"
-
 [[package]]
 name = "syn"
-version = "2.0.87"
+version = "3.0.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "25aa4ce346d03a6dcd68dd8b4010bcb74e54e62c90c573f394c46eae99aba32d"
+checksum = "12df2e0110f65b775f769bb17ef989067a1d931b2eb822bd4346631eeada89f9"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -356,24 +376,24 @@ dependencies = [
 
 [[package]]
 name = "typenum"
-version = "1.17.0"
+version = "1.20.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "42ff0bf0c66b8238c6f3b578df37d0b7848e55df8577b3f74f92a69acceeb825"
+checksum = "b6f5e870be6c3b371b77fe0ee0bafb859fa4964b4404c27de1d380043c4dda20"
 
 [[package]]
 name = "unicode-ident"
-version = "1.0.13"
+version = "1.0.24"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e91b56cd4cadaeb79bbf1a5645f6b4f8dc5bde8834ad5894a8db35fda9efa1fe"
+checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"
 
 [[package]]
 name = "universal-hash"
-version = "0.5.1"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fc1de2c688dc15305988b563c3854064043356019f97a4b46276fe734c4f07ea"
+checksum = "f4987bdc12753382e0bec4a65c50738ffaabc998b9cdd1f952fb5f39b0048a96"
 dependencies = [
  "crypto-common",
- "subtle",
+ "ctutils",
 ]
 
 [[package]]
@@ -383,33 +403,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "673aac59facbab8a9007c7f6108d11f63b603f7cabff99fabf650fea5c32b861"
 
 [[package]]
-name = "version_check"
-version = "0.9.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a"
-
-[[package]]
-name = "wasi"
-version = "0.11.0+wasi-snapshot-preview1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9c8d87e72b64a3b4db28d11ce29237c246188f4f51057d65a7eab63b7987e423"
-
-[[package]]
-name = "zerocopy"
-version = "0.7.35"
+name = "zmij"
+version = "1.0.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1b9b4fd18abc82b8136838da5d50bae7bdea537c574d8dc1a34ed098d6c166f0"
-dependencies = [
- "zerocopy-derive",
-]
-
-[[package]]
-name = "zerocopy-derive"
-version = "0.7.35"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fa4f8080344d4671fb4e831a13ad1e68092748387dfc4f55e356242fae12ce3e"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
-]
+checksum = "29666d0abbfad1e3dc4dcf6144730dd3a3ab225bbbdac83319345b1b44ccfc1b"
diff --git a/Cargo.toml b/Cargo.toml
index fd399c7..65eea04 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -12,21 +12,21 @@ crate-type = ["cdylib"]
 
 [dependencies]
 # aes256
-aes-gcm = { version = "0.10.3", features = ["std"] }
+aes-gcm = "0.11.1"
 
 # base64
-base64 = "0.22.1"
+base64 = "0.23.1"
 
 # logging
-log = "0.4.22"
+log = "0.4.34"
 
 # proxy-wasm
-proxy-wasm = "0.2.2"
+proxy-wasm = "0.2.5"
 
 # serde
-serde = { version = "1.0.214", features = ["derive"] }
-serde_yaml = "0.9.33"
-serde_json = "1.0.132"
+serde = { version = "1.0.229", features = ["derive"] }
+serde_yaml = "0.9.34"
+serde_json = "1.0.151"
 
 # secret
 sec = { version = "1.0.0", features = ["serde", "deserialize"] }
diff --git a/Dockerfile b/Dockerfile
index 9453e32..9dd0b32 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,4 +1,4 @@
-FROM rust:1.78.0 AS builder
+FROM rust:1.97.1 AS builder
 
 COPY src/ src/
 COPY Cargo.toml Cargo.toml
@@ -10,7 +10,7 @@ RUN cargo build --target=wasm32-wasip1 --release
 
 ##################################################
 
-FROM envoyproxy/envoy:v1.31-latest
+FROM envoyproxy/envoy:v1.39-latest
 
 COPY --from=builder /target/wasm32-wasip1/release/basic_auth_plugin.wasm /etc/envoy/proxy-wasm-plugins/basic_auth_plugin.wasm
 
diff --git a/deny.toml b/deny.toml
index bb944ee..2fe909d 100644
--- a/deny.toml
+++ b/deny.toml
@@ -11,6 +11,9 @@
 
 # Root options
 
+# The graph table configures how the dependency graph is constructed and thus
+# which crates the checks are performed against
+[graph]
 # If 1 or more target triples (and optionally, target_features) are specified,
 # only the specified targets will be checked when running `cargo deny check`.
 # This means, if a particular package is only ever used as a target specific
@@ -22,7 +25,7 @@
 targets = [
     # The triple can be any string, but only the target triples built in to
     # rustc (as of 1.40) can be checked against actual config expressions
-    #{ triple = "x86_64-unknown-linux-musl" },
+    #"x86_64-unknown-linux-musl",
     # You can also specify which target_features you promise are enabled for a
     # particular target. target_features are currently not validated against
     # the actual valid features supported by the target architecture.
@@ -46,6 +49,9 @@ no-default-features = false
 # If set, these feature will be enabled when collecting metadata. If `--features`
 # is specified on the cmd line they will take precedence over this option.
 #features = []
+
+# The output table provides options for how/if diagnostics are outputted
+[output]
 # When outputting inclusion graphs in diagnostics that include features, this
 # option can be used to specify the depth at which feature edges will be added.
 # This option is included since the graphs can be quite large and the addition
@@ -57,25 +63,14 @@ feature-depth = 1
 # More documentation for the advisories section can be found here:
 # https://embarkstudios.github.io/cargo-deny/checks/advisories/cfg.html
 [advisories]
-# The path where the advisory database is cloned/fetched into
-db-path = "~/.cargo/advisory-db"
+# The path where the advisory databases are cloned/fetched into
+#db-path = "$CARGO_HOME/advisory-dbs"
 # The url(s) of the advisory databases to use
-db-urls = ["https://github.com/rustsec/advisory-db"]
-# The lint level for security vulnerabilities
-vulnerability = "deny"
-# The lint level for unmaintained crates
-unmaintained = "warn"
-# The lint level for crates that have been yanked from their source registry
-yanked = "warn"
-# The lint level for crates with security notices. Note that as of
-# 2019-12-17 there are no security notice advisories in
-# https://github.com/rustsec/advisory-db
-notice = "warn"
+#db-urls = ["https://github.com/rustsec/advisory-db"]
 # A list of advisory IDs to ignore. Note that ignored advisories will still
 # output a note when they are encountered.
 ignore = [
     #"RUSTSEC-0000-0000",
-
     # Timing attack on RSA.
     # Delta Chat does not use RSA for new keys
     # and this requires precise measurement of the decryption time by the attacker.
@@ -83,17 +78,10 @@ ignore = [
     # <https://rustsec.org/advisories/RUSTSEC-2023-0071>
     # <https://github.com/RustCrypto/RSA/issues/19#issuecomment-1822995643>
     "RUSTSEC-2023-0071",
+    #{ id = "RUSTSEC-0000-0000", reason = "you can specify a reason the advisory is ignored" },
+    #"a-crate-that-is-yanked@0.1.1", # you can also ignore yanked crate versions if you wish
+    #{ crate = "a-crate-that-is-yanked@0.1.1", reason = "you can specify why you are ignoring the yanked crate" },
 ]
-# Threshold for security vulnerabilities, any vulnerability with a CVSS score
-# lower than the range specified will be ignored. Note that ignored advisories
-# will still output a note when they are encountered.
-# * None - CVSS Score 0.0
-# * Low - CVSS Score 0.1 - 3.9
-# * Medium - CVSS Score 4.0 - 6.9
-# * High - CVSS Score 7.0 - 8.9
-# * Critical - CVSS Score 9.0 - 10.0
-#severity-threshold =
-
 # If this is true, then cargo deny will use the git executable to fetch advisory database.
 # If this is false, then it uses a built-in git library.
 # Setting this to true can be helpful if you have special authentication requirements that cargo-deny does not support.
@@ -104,36 +92,19 @@ ignore = [
 # More documentation for the licenses section can be found here:
 # https://embarkstudios.github.io/cargo-deny/checks/licenses/cfg.html
 [licenses]
-# The lint level for crates which do not have a detectable license
-unlicensed = "deny"
 # List of explicitly allowed licenses
 # See https://spdx.org/licenses/ for list of possible licenses
 # [possible values: any SPDX 3.11 short identifier (+ optional exception)].
 allow = [
-    "MIT",
     "Apache-2.0",
     "Apache-2.0 WITH LLVM-exception",
+    "BSD-2-Clause",
+    "BSD-3-Clause",
+    "ISC",
+    "MIT",
+    "Unicode-3.0",
+    "Zlib",
 ]
-# List of explicitly disallowed licenses
-# See https://spdx.org/licenses/ for list of possible licenses
-# [possible values: any SPDX 3.11 short identifier (+ optional exception)].
-deny = [
-    #"Nokia",
-]
-# Lint level for licenses considered copyleft
-copyleft = "warn"
-# Blanket approval or denial for OSI-approved or FSF Free/Libre licenses
-# * both - The license will be approved if it is both OSI-approved *AND* FSF
-# * either - The license will be approved if it is either OSI-approved *OR* FSF
-# * osi-only - The license will be approved if is OSI-approved *AND NOT* FSF
-# * fsf-only - The license will be approved if is FSF *AND NOT* OSI-approved
-# * neither - This predicate is ignored and the default lint level is used
-allow-osi-fsf-free = "neither"
-# Lint level used when no other predicates are matched
-# 1. License isn't in the allow or deny lists
-# 2. License isn't copyleft
-# 3. License isn't OSI/FSF, or allow-osi-fsf-free = "neither"
-default = "allow"
 # The confidence threshold for detecting a license from license text.
 # The higher the value, the more closely the license text must be to the
 # canonical license text of a valid SPDX license file.
@@ -144,17 +115,15 @@ confidence-threshold = 0.8
 exceptions = [
     # Each entry is the crate and version constraint, and its specific allow
     # list
-    #{ allow = ["Zlib"], name = "adler32", version = "*" },
+    #{ allow = ["Zlib"], crate = "adler32" },
 ]
 
 # Some crates don't have (easily) machine readable licensing information,
 # adding a clarification entry for it allows you to manually specify the
 # licensing information
 #[[licenses.clarify]]
-# The name of the crate the clarification applies to
-#name = "ring"
-# The optional version constraint for the crate
-#version = "*"
+# The package spec the clarification applies to
+#crate = "ring"
 # The SPDX expression for the license requirements of the crate
 #expression = "MIT AND ISC AND OpenSSL"
 # One or more files in the crate's source used as the "source of truth" for
@@ -163,8 +132,8 @@ exceptions = [
 # and the crate will be checked normally, which may produce warnings or errors
 # depending on the rest of your configuration
 #license-files = [
-    # Each entry is a crate relative path, and the (opaque) hash of its contents
-    #{ path = "LICENSE", hash = 0xbd0eed23 }
+# Each entry is a crate relative path, and the (opaque) hash of its contents
+#{ path = "LICENSE", hash = 0xbd0eed23 }
 #]
 
 [licenses.private]
@@ -195,33 +164,32 @@ wildcards = "allow"
 # * all - Both lowest-version and simplest-path are used
 highlight = "all"
 # The default lint level for `default` features for crates that are members of
-# the workspace that is being checked. This can be overriden by allowing/denying
+# the workspace that is being checked. This can be overridden by allowing/denying
 # `default` on a crate-by-crate basis if desired.
 workspace-default-features = "allow"
 # The default lint level for `default` features for external crates that are not
-# members of the workspace. This can be overriden by allowing/denying `default`
+# members of the workspace. This can be overridden by allowing/denying `default`
 # on a crate-by-crate basis if desired.
 external-default-features = "allow"
 # List of crates that are allowed. Use with care!
 allow = [
-    #{ name = "ansi_term", version = "=0.11.0" },
+    #"ansi_term@0.11.0",
+    #{ crate = "ansi_term@0.11.0", reason = "you can specify a reason it is allowed" },
 ]
 # List of crates to deny
 deny = [
-    # Each entry the name of a crate and a version range. If version is
-    # not specified, all versions will be matched.
-    #{ name = "ansi_term", version = "=0.11.0" },
-    #
+    #"ansi_term@0.11.0",
+    #{ crate = "ansi_term@0.11.0", reason = "you can specify a reason it is banned" },
     # Wrapper crates can optionally be specified to allow the crate when it
     # is a direct dependency of the otherwise banned crate
-    #{ name = "ansi_term", version = "=0.11.0", wrappers = [] },
+    #{ crate = "ansi_term@0.11.0", wrappers = ["this-crate-directly-depends-on-ansi_term"] },
 ]
 
 # List of features to allow/deny
 # Each entry the name of a crate and a version range. If version is
 # not specified, all versions will be matched.
 #[[bans.features]]
-#name = "reqwest"
+#crate = "reqwest"
 # Features to not allow
 #deny = ["json"]
 # Features to allow
@@ -242,14 +210,16 @@ deny = [
 
 # Certain crates/versions that will be skipped when doing duplicate detection.
 skip = [
-    #{ name = "ansi_term", version = "=0.11.0" },
+    #"ansi_term@0.11.0",
+    #{ crate = "ansi_term@0.11.0", reason = "you can specify a reason why it can't be updated/removed" },
 ]
 # Similarly to `skip` allows you to skip certain crates during duplicate
 # detection. Unlike skip, it also includes the entire tree of transitive
 # dependencies starting at the specified crate, up to a certain depth, which is
 # by default infinite.
 skip-tree = [
-    #{ name = "ansi_term", version = "=0.11.0", depth = 20 },
+    #"ansi_term@0.11.0", # will be skipped along with _all_ of its direct and transitive dependencies
+    #{ crate = "ansi_term@0.11.0", depth = 20 },
 ]
 
 # This section is considered when running `cargo deny check sources`.
diff --git a/src/auth.rs b/src/auth.rs
index e294723..bca12c1 100644
--- a/src/auth.rs
+++ b/src/auth.rs
@@ -1,7 +1,7 @@
 // aes_gcm
 use aes_gcm::{
-    aead::{AeadMut, OsRng},
-    AeadCore, Aes256Gcm,
+    aead::{Aead, Generate, Nonce},
+    Aes256Gcm,
 };
 
 // base64
@@ -19,6 +19,7 @@ use proxy_wasm::traits::*;
 use proxy_wasm::types::*;
 
 // std
+use std::convert::TryInto;
 use std::sync::Arc;
 
 /// This is the basic auth context
@@ -49,9 +50,8 @@ impl HttpContext for BasicAuthContext {
         let nonce = self.get_nonce();
 
         // If the session cookie and nonce are found, try to get the session from the cookie
-        if session_cookie.is_ok() && nonce.is_ok() {
-            match self
-                .get_session_from_cookie(session_cookie.unwrap().as_str(), nonce.unwrap().as_str())
+        if let (Ok(session_cookie), Ok(nonce)) = (session_cookie, nonce) {
+            match self.get_session_from_cookie(session_cookie.as_str(), nonce.as_str())
             {
                 Ok(username_password_combination) => {
                     // Check if the user is authorized
@@ -107,10 +107,10 @@ impl BasicAuthContext {
         username_password_combination: &UserPasswordCombination,
         redirect_to: Option<String>,
     ) {
-        let nonce = Aes256Gcm::generate_nonce(OsRng);
+        let nonce = Nonce::<Aes256Gcm>::generate();
         let encoded_nonce = BASE64.encode(nonce.as_slice());
 
-        let mut cipher = self.config.aes_key.reveal().clone();
+        let cipher = self.config.aes_key.reveal().clone();
         let encrypted_cookie = cipher
             .encrypt(
                 &nonce,
@@ -162,20 +162,23 @@ impl BasicAuthContext {
         cookie: &str,
         nonce: &str,
     ) -> Result<UserPasswordCombination, String> {
-        let mut cipher = self.config.aes_key.reveal().clone();
+        let cipher = self.config.aes_key.reveal().clone();
 
         let decoded_nonce = match BASE64.decode(nonce) {
             Ok(decoded_nonce) => decoded_nonce,
             Err(e) => return Err(format!("failed to decode nonce: {}", e)),
         };
-        let nonce = aes_gcm::Nonce::from_slice(decoded_nonce.as_slice());
+        let nonce: Nonce<Aes256Gcm> = decoded_nonce
+            .as_slice()
+            .try_into()
+            .map_err(|_| "invalid nonce length".to_string())?;
 
         let decoded_cookie = match BASE64.decode(cookie) {
             Ok(decoded_cookie) => decoded_cookie,
             Err(e) => return Err(format!("failed to decode cookie: {}", e)),
         };
 
-        let decrypted = match cipher.decrypt(nonce, decoded_cookie.as_slice()) {
+        let decrypted = match cipher.decrypt(&nonce, decoded_cookie.as_slice()) {
             Ok(decrypted) => decrypted,
             Err(e) => return Err(format!("failed to decrypt cookie: {}", e)),
         };

From 44738f606d1b5f772f545e488588dcbed93df7dc Mon Sep 17 00:00:00 2001
From: Anton Engelhardt <antoncengelhardt@icloud.com>
Date: Sat, 5 Sep 2026 15:39:12 +0200
Subject: [PATCH 3/5] rustfmt the aes-gcm 0.11 session cookie match so CI fmt
 passes.

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 src/auth.rs | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/src/auth.rs b/src/auth.rs
index bca12c1..e1ebdcc 100644
--- a/src/auth.rs
+++ b/src/auth.rs
@@ -51,8 +51,7 @@ impl HttpContext for BasicAuthContext {
 
         // If the session cookie and nonce are found, try to get the session from the cookie
         if let (Ok(session_cookie), Ok(nonce)) = (session_cookie, nonce) {
-            match self.get_session_from_cookie(session_cookie.as_str(), nonce.as_str())
-            {
+            match self.get_session_from_cookie(session_cookie.as_str(), nonce.as_str()) {
                 Ok(username_password_combination) => {
                     // Check if the user is authorized
                     if self.is_authorized(

From 37f7f0bff4d0f19773933a499fbb5d5f9affdb7c Mon Sep 17 00:00:00 2001
From: Anton Engelhardt <antoncengelhardt@icloud.com>
Date: Sat, 5 Sep 2026 15:48:03 +0200
Subject: [PATCH 4/5] Install cargo-outdated from a prebuilt binary so the
 outdated job is not a source compile.

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 .github/workflows/test.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 74e4719..ebe7b6d 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -105,10 +105,10 @@ jobs:
       - name: Setup Rust
         uses: actions-rust-lang/setup-rust-toolchain@v1
         with:
-          cache: true
+          cache: false
 
       - name: Install cargo-outdated
-        uses: taiki-e/cache-cargo-install-action@v2
+        uses: taiki-e/install-action@v2
         with:
           tool: cargo-outdated
 

From c3359373671336024d1884094971c6411fb7a43a Mon Sep 17 00:00:00 2001
From: Anton Engelhardt <antoncengelhardt@icloud.com>
Date: Sat, 5 Sep 2026 15:52:04 +0200
Subject: [PATCH 5/5] Address Copilot review: rename the build workflow, fix
 the nightly cron, and skip fork image pushes.

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 audit.toml => .cargo/audit.toml     |  0
 .github/workflows/build.yml         |  2 +-
 .github/workflows/security-scan.yml |  4 ++--
 .github/workflows/test.yml          | 14 +++++++++++++-
 4 files changed, 16 insertions(+), 4 deletions(-)
 rename audit.toml => .cargo/audit.toml (100%)

diff --git a/audit.toml b/.cargo/audit.toml
similarity index 100%
rename from audit.toml
rename to .cargo/audit.toml
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 7470769..8146e75 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -1,4 +1,4 @@
-name: Test and Build basic-auth-plugin
+name: Build basic-auth-plugin
 
 on:
   push:
diff --git a/.github/workflows/security-scan.yml b/.github/workflows/security-scan.yml
index 5fb55fe..1ffa3ff 100644
--- a/.github/workflows/security-scan.yml
+++ b/.github/workflows/security-scan.yml
@@ -3,8 +3,8 @@ name: Security Scan
 on:
   pull_request:
   schedule:
-    - cron: "0 0 * * *"
-      timezone: Europe/Berlin
+    # 00:00 Europe/Berlin during CEST (23:00 CET in winter)
+    - cron: "0 22 * * *"
   workflow_dispatch:
 
 permissions:
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index ebe7b6d..052cd42 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -8,6 +8,7 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: read
+      actions: write
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
@@ -24,6 +25,7 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: read
+      actions: write
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
@@ -40,6 +42,7 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: read
+      actions: write
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
@@ -56,6 +59,7 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: read
+      actions: write
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
@@ -71,12 +75,13 @@ jobs:
           tool: cargo-audit
 
       - name: Audit
-        run: cargo audit -f audit.toml
+        run: cargo audit
 
   verify-project:
     runs-on: ubuntu-latest
     permissions:
       contents: read
+      actions: write
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
@@ -98,6 +103,7 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: read
+      actions: write
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
@@ -119,6 +125,7 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: read
+      actions: write
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
@@ -135,6 +142,7 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: read
+      actions: write
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
@@ -155,8 +163,10 @@ jobs:
 
   docker-image:
     runs-on: ubuntu-latest
+    if: github.event.pull_request.head.repo.full_name == github.repository
     permissions:
       contents: read
+      actions: write
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
@@ -189,8 +199,10 @@ jobs:
 
   ghcr-image:
     runs-on: ubuntu-latest
+    if: github.event.pull_request.head.repo.full_name == github.repository
     permissions:
       contents: read
+      actions: write
       packages: write
     steps:
       - name: Checkout code