fix(tasks): return 403 instead of 500 for unauthorised submission access

.ci-setup/pdfGen/crontab → .ci-setup/crontab

@@ -3,7 +3,8 @@ BASH_ENV=/container.env
 PATH=/tmp/texlive/bin/x86_64-linux:/tmp/texlive/bin/aarch64-linux:/usr/local/bundle/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/local/bundle/bin
 
 10,15,20,25,30,35,40,45,50,55 * * * * /doubtfire/lib/shell/generate_pdfs.sh
-0 5 * * 1,3,5 /doubtfire/lib/shell/check_plagiarism.sh
+0,10,20,30,40,50 * * * * /doubtfire/lib/shell/send_overseer_notifications.sh
+0 5 * * * /doubtfire/lib/shell/check_plagiarism.sh
 0 8 * * * /doubtfire/lib/shell/portfolio_autogen_check.sh
 0 7 * * 1 /doubtfire/lib/shell/send_weekly_emails.sh
 0 1 * * * /doubtfire/lib/shell/sync_enrolments.sh

.dockerignore

@@ -1,7 +1,30 @@
 Dockerfile
 .git
+.github
+.docker
+.bundle
+.env
+.env.*
+!.env.example
+.npmrc
+.gem/credentials
+.ssh
+.aws
+.config/gcloud
 build
+coverage
 dist
+log
 node_modules
+tmp
 vendor
 student-work
+config/master.key
+config/credentials
+config/credentials.yml.enc
+**/*.key
+**/*.pem
+**/*.p12
+**/*.pfx
+**/*.jks
+**/*.keystore

.env.example

@@ -0,0 +1,11 @@
+# Optional values for development through the legacy root docker-compose.yml.
+# Copy to .env. Database authentication remains the safe default. Never commit
+# an institution credential or reuse a production registration.
+DF_AUTH_METHOD=database
+DF_AAF_ISSUER_URL=
+DF_AAF_AUDIENCE_URL=http://localhost:3000
+DF_AAF_CALLBACK_URL=http://localhost:3000/api/auth/jwt
+DF_AAF_IDENTITY_PROVIDER_URL=
+DF_AAF_UNIQUE_URL=
+DF_AAF_AUTH_SIGNOUT_URL=
+DF_SECRET_KEY_AAF=

.git-blame-ignore-revs

@@ -0,0 +1,2 @@
+# Jan 11 2022: Repository wide format (support zeitwerk mode loader)
+f4050e826af83166e45b0b4f2af14179b40305dd

.gitattributes

@@ -1,2 +1,5 @@
 # Set the default behavior, in case people don't have core.autocrlf set.
 * text=auto eol=lf
+
+# Exclude test files from GitHub language statistics
+test_files/** linguist-vendored

.github/CODEOWNERS

@@ -0,0 +1,5 @@
+# The App key is available only to the default-branch policy job. Keep every
+# workflow and the evaluator itself under lead review.
+/.github/workflows/ @ontrack-features-t2-2026/ontrack-leads
+/.github/review-policy/ @ontrack-features-t2-2026/ontrack-leads
+/.github/CODEOWNERS @ontrack-features-t2-2026/ontrack-leads

.github/review-policy/README.md

@@ -0,0 +1,51 @@
+# OnTrack pull-request review policy
+
+The required status context `ontrack/review-policy` passes when the current pull
+request head has either:
+
+- one approval from a current `ontrack-leads` member; or
+- two approvals from distinct current `ontrack-contributors` members.
+
+Approvals from the pull-request author, bots, stale commits, dismissed reviews,
+or reviewers whose latest actionable review requests changes do not count.
+
+## Security model
+
+`ontrack-review-policy-signal.yml` is unprivileged and never checks out pull-request
+code. A completed signal wakes `ontrack-review-policy.yml` through `workflow_run`.
+The evaluator workflow checks out only this directory from the protected default
+branch, then mints a short-lived token for the organization-owned GitHub App.
+
+The App is installed only on the three OnTrack Doubtfire repositories and has:
+
+- organization Members: read;
+- repository Metadata: read (mandatory);
+- repository Pull requests: read; and
+- repository Commit statuses: write.
+
+The App has no contents, workflow, administration, merge, or webhook permission.
+Its private key is held in `ONTRACK_REVIEW_APP_PRIVATE_KEY` in the
+`ontrack-review-policy` environment, which only permits the protected `11.0.x`
+branch. Its numeric App ID is held in `ONTRACK_REVIEW_APP_ID`.
+
+The evaluator reports on the pull-request head commit. GitHub gates on the test merge
+commit whenever that commit carries a status and only falls back to the head when it
+carries none, so reporting on the test merge commit would move the merge gate onto a
+commit that carries none of this repository's other checks. The head is also stable,
+where the test merge commit is recomputed every time the base branch moves.
+A five-minute reconciliation covers team membership and base-branch changes that
+do not emit a pull-request review event. Unchanged results are not republished,
+which avoids GitHub's per-commit status limit.
+
+## Ruleset integration
+
+Keep the native one-overall-approval rule, stale-review dismissal, and conversation
+resolution. Require `ontrack/review-policy` with the OnTrack Review Policy App as
+its expected source. Remove the native `ontrack-leads` required-reviewer entry only
+after the App status has been observed and made required; otherwise GitHub combines
+the native team rules with AND semantics.
+
+Changes to any workflow, the evaluator, or CODEOWNERS should continue to require
+one `ontrack-leads` approval through a path-specific native reviewer rule. This is
+necessary because any default-branch workflow could otherwise reference the App's
+environment secret.