V2.0.0/service update

.dockerignore

@@ -1,25 +1,17 @@
-**/.classpath
-**/.dockerignore
-**/.env
-**/.git
-**/.gitignore
-**/.project
-**/.settings
-**/.toolstarget
+# Docker build context is the repository root. Keep it small and free of build artifacts.
+**/bin
+**/obj
 **/.vs
 **/.vscode
-**/*.*proj.user
-**/*.dbmdl
-**/*.jfm
-**/azds.yaml
-**/bin
-**/charts
-**/docker-compose*
+.git
+.github
+.bot
+test
+docs
+**/*.user
+**/.dockerignore
 **/Dockerfile*
-**/node_modules
-**/npm-debug.log
-**/obj
-**/secrets.dev.yaml
-**/values.dev.yaml
-LICENSE
-README.md
+**/docker-compose*
+**/coverage*
+**/*.md
+LICENSE.md

.editorconfig

@@ -0,0 +1,92 @@
+# Remove the line below if you want to inherit .editorconfig settings from higher directories
+root = true
+
+#### Core EditorConfig Options ####
+
+[*]
+charset = utf-8
+end_of_line = lf
+indent_style = space
+insert_final_newline = true
+trim_trailing_whitespace = true
+
+[*.{cs,csx,vb,vbx}]
+indent_size = 4
+tab_width = 4
+
+[*.{xml,csproj,props,targets,config,nuspec,slnx}]
+indent_size = 2
+tab_width = 2
+
+[*.{json,yml,yaml}]
+indent_size = 2
+tab_width = 2
+
+[*.md]
+trim_trailing_whitespace = false
+
+#### .NET Coding Conventions ####
+
+[*.cs]
+
+# Organize usings
+dotnet_sort_system_directives_first = true
+dotnet_separate_import_directive_groups = false
+
+# File-scoped namespaces (required)
+csharp_style_namespace_declarations = file_scoped:error
+
+# No top-level statements (required)
+csharp_style_prefer_top_level_statements = false:error
+
+# this. and Me. preferences
+dotnet_style_qualification_for_field = false:suggestion
+dotnet_style_qualification_for_property = false:suggestion
+dotnet_style_qualification_for_method = false:suggestion
+dotnet_style_qualification_for_event = false:suggestion
+
+# Language keywords vs BCL types preferences
+dotnet_style_predefined_type_for_locals_parameters_members = true:suggestion
+dotnet_style_predefined_type_for_member_access = true:suggestion
+
+# var preferences
+csharp_style_var_for_built_in_types = false:suggestion
+csharp_style_var_when_type_is_apparent = true:suggestion
+csharp_style_var_elsewhere = false:suggestion
+
+# Expression-bodied members
+csharp_style_expression_bodied_methods = when_on_single_line:suggestion
+csharp_style_expression_bodied_constructors = false:suggestion
+csharp_style_expression_bodied_properties = true:suggestion
+csharp_style_expression_bodied_accessors = true:suggestion
+csharp_style_expression_bodied_lambdas = true:suggestion
+
+# Null-checking preferences
+csharp_style_throw_expression = true:suggestion
+csharp_style_conditional_delegate_call = true:suggestion
+
+# Prefer explicit guard clauses over conditional expressions in returns and assignments
+dotnet_style_prefer_conditional_expression_over_return = false
+dotnet_style_prefer_conditional_expression_over_assignment = false
+
+# Pattern matching
+csharp_style_prefer_pattern_matching = true:suggestion
+csharp_style_prefer_not_pattern = true:suggestion
+csharp_style_prefer_switch_expression = true:suggestion
+
+# Code block preferences
+csharp_prefer_braces = true:suggestion
+
+# New line preferences
+csharp_new_line_before_open_brace = all
+csharp_new_line_before_else = true
+csharp_new_line_before_catch = true
+csharp_new_line_before_finally = true
+
+# Indentation preferences
+csharp_indent_case_contents = true
+csharp_indent_switch_labels = true
+
+# Space preferences
+csharp_space_after_cast = false
+csharp_space_after_keywords_in_control_flow_statements = true

.github/CONTRIBUTING.md

@@ -0,0 +1,33 @@
+# Contributing to Static Content Provider
+
+Thank you for your interest in contributing!
+
+## How to Contribute
+
+1. Fork the repository.
+2. Create a feature branch.
+3. Commit your changes following the project's commit conventions.
+4. Push to your branch and open a pull request against `main`.
+
+## Development Setup
+
+```bash
+dotnet restore Codebelt.Cdn.Origin.slnx
+dotnet build Codebelt.Cdn.Origin.slnx
+dotnet test Codebelt.Cdn.Origin.slnx
+```
+
+## Code Standards
+
+- Target `net10.0` and use modern minimal hosting.
+- Prefer ASP.NET Core and the BCL over new dependencies. New dependencies require justification (see `AGENTS.md`).
+- Use file-scoped namespaces and follow the existing code style (enforced via `.editorconfig`; verify with `dotnet format --severity info --verify-no-changes`).
+- All public APIs must have XML documentation comments.
+- Behavioural changes to the HTTP contract require functional tests and a `README.md` update.
+
+## Pull Request Guidelines
+
+- Keep pull requests focused on a single concern.
+- Maintain 100% line and branch coverage for application-owned decision logic.
+- Update `CHANGELOG.md`.
+- Ensure all CI checks pass before requesting review.

.github/actions/container-attest-provenance/action.yml

@@ -0,0 +1,20 @@
+name: Attest container provenance
+description: Create and registry-publish a GitHub build-provenance attestation for a container image.
+
+inputs:
+  subject-name:
+    description: Fully qualified image repository without a tag.
+    required: true
+  subject-digest:
+    description: Immutable image digest in sha256 form.
+    required: true
+
+runs:
+  using: composite
+  steps:
+    - name: Attest image provenance
+      uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
+      with:
+        subject-name: ${{ inputs.subject-name }}
+        subject-digest: ${{ inputs.subject-digest }}
+        push-to-registry: true

.github/actions/container-attest-sbom/action.yml

@@ -0,0 +1,24 @@
+name: Attest container SBOM
+description: Create and registry-publish a GitHub SBOM attestation for a container image.
+
+inputs:
+  subject-name:
+    description: Fully qualified image repository without a tag.
+    required: true
+  subject-digest:
+    description: Immutable image digest in sha256 form.
+    required: true
+  sbom-path:
+    description: SPDX JSON SBOM path.
+    required: true
+
+runs:
+  using: composite
+  steps:
+    - name: Attest image SBOM
+      uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
+      with:
+        subject-name: ${{ inputs.subject-name }}
+        subject-digest: ${{ inputs.subject-digest }}
+        sbom-path: ${{ inputs.sbom-path }}
+        push-to-registry: true

.github/actions/container-sbom/action.yml

@@ -0,0 +1,28 @@
+name: Generate container SBOM
+description: Generate an SPDX JSON SBOM for a local Docker image.
+
+inputs:
+  image:
+    description: Fully qualified local image reference, including its tag.
+    required: true
+  sbom-path:
+    description: Output path for the SPDX JSON SBOM.
+    required: true
+
+outputs:
+  sbom-path:
+    description: The generated SBOM path.
+    value: ${{ inputs.sbom-path }}
+
+runs:
+  using: composite
+  steps:
+    - name: Generate SPDX JSON SBOM
+      uses: anchore/sbom-action@e11c554f704a0b820cbf8c51673f6945e0731532 # v0.20.0
+      with:
+        image: ${{ inputs.image }}
+        format: spdx-json
+        output-file: ${{ inputs.sbom-path }}
+        upload-artifact: false
+        upload-release-assets: false
+        dependency-snapshot: false

.github/actions/docker-build/action.yml

@@ -0,0 +1,39 @@
+name: Build Docker image
+description: Build a Docker image into the local Docker daemon without pushing it.
+
+inputs:
+  context:
+    description: Docker build context.
+    required: false
+    default: .
+  file:
+    description: Dockerfile path.
+    required: false
+    default: src/Codebelt.Cdn.Origin/Dockerfile
+  image:
+    description: Fully qualified local image reference, including its tag.
+    required: true
+
+outputs:
+  image-id:
+    description: The local Docker image ID.
+    value: ${{ steps.build.outputs.image-id }}
+
+runs:
+  using: composite
+  steps:
+    - id: build
+      name: Build image
+      shell: bash
+      env:
+        BUILD_CONTEXT: ${{ inputs.context }}
+        DOCKERFILE: ${{ inputs.file }}
+        IMAGE: ${{ inputs.image }}
+      run: |
+        set -euo pipefail
+
+        test -n "$IMAGE"
+        docker build --pull --file "$DOCKERFILE" --tag "$IMAGE" "$BUILD_CONTEXT"
+
+        image_id="$(docker image inspect --format '{{.Id}}' "$IMAGE")"
+        printf 'image-id=%s\n' "$image_id" >> "$GITHUB_OUTPUT"

.github/actions/docker-load/action.yml

@@ -0,0 +1,34 @@
+name: Load Docker image
+description: Load a Docker image tar archive into the local Docker daemon.
+
+inputs:
+  image:
+    description: Fully qualified image reference expected after loading.
+    required: true
+  tarball:
+    description: Docker image tar archive path.
+    required: true
+
+outputs:
+  image-id:
+    description: The loaded Docker image ID.
+    value: ${{ steps.load.outputs.image-id }}
+
+runs:
+  using: composite
+  steps:
+    - id: load
+      name: Load image archive
+      shell: bash
+      env:
+        IMAGE: ${{ inputs.image }}
+        TARBALL: ${{ inputs.tarball }}
+      run: |
+        set -euo pipefail
+
+        test -n "$IMAGE"
+        test -f "$TARBALL"
+        docker image load --input "$TARBALL"
+
+        image_id="$(docker image inspect --format '{{.Id}}' "$IMAGE")"
+        printf 'image-id=%s\n' "$image_id" >> "$GITHUB_OUTPUT"

.github/actions/docker-login/action.yml

@@ -0,0 +1,30 @@
+name: Log in to Docker registry
+description: Authenticate the local Docker daemon to one registry using password-stdin.
+
+inputs:
+  registry:
+    description: Registry host, without a repository path.
+    required: true
+  username:
+    description: Registry username.
+    required: true
+  password:
+    description: Registry password or token.
+    required: true
+
+runs:
+  using: composite
+  steps:
+    - name: Authenticate Docker daemon
+      shell: bash
+      env:
+        REGISTRY: ${{ inputs.registry }}
+        USERNAME: ${{ inputs.username }}
+        PASSWORD: ${{ inputs.password }}
+      run: |
+        set -euo pipefail
+
+        test -n "$REGISTRY"
+        test -n "$USERNAME"
+        test -n "$PASSWORD"
+        printf '%s' "$PASSWORD" | docker login "$REGISTRY" --username "$USERNAME" --password-stdin

.github/actions/docker-push/action.yml

@@ -0,0 +1,47 @@
+name: Push Docker image
+description: Push a loaded Docker image and expose the registry digest.
+
+inputs:
+  image:
+    description: Fully qualified image reference, including its tag.
+    required: true
+
+outputs:
+  image-digest:
+    description: Immutable registry digest returned by Docker after the push.
+    value: ${{ steps.push.outputs.image-digest }}
+
+runs:
+  using: composite
+  steps:
+    - id: push
+      name: Push image
+      shell: bash
+      env:
+        IMAGE: ${{ inputs.image }}
+        PUSH_LOG: ${{ runner.temp }}/codebelt-docker-push.log
+      run: |
+        set -euo pipefail
+
+        test -n "$IMAGE"
+        docker image inspect "$IMAGE" >/dev/null
+
+        set +e
+        docker image push "$IMAGE" 2>&1 | tee "$PUSH_LOG"
+        push_status=${PIPESTATUS[0]}
+        set -e
+
+        if [[ "$push_status" -ne 0 ]]; then
+          exit "$push_status"
+        fi
+
+        image_digest="$(grep -oE 'digest: sha256:[0-9a-f]{64}' "$PUSH_LOG" | tail -n 1 | sed 's/.*digest: //')"
+        if [[ -z "$image_digest" ]]; then
+          repository_digest="$(docker image inspect --format '{{index .RepoDigests 0}}' "$IMAGE" 2>/dev/null || true)"
+          if [[ "$repository_digest" == *@* ]]; then
+            image_digest="${repository_digest##*@}"
+          fi
+        fi
+
+        test -n "$image_digest"
+        printf 'image-digest=%s\n' "$image_digest" >> "$GITHUB_OUTPUT"