Filter cached packages by ecosystem using pills

.github/workflows/ci.yml

@@ -43,8 +43,11 @@ jobs:
         with:
           go-version-file: go.mod
 
+      - name: Install golangci-lint
+        run: go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.13.1
+
       - name: golangci-lint
-        run: go tool golangci-lint run ./...
+        run: golangci-lint run ./...
 
   helm:
     name: Helm chart
@@ -54,7 +57,7 @@ jobs:
         with:
           persist-credentials: false
 
-      - uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4 # v4.3.1
+      - uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1
         with:
           version: v3.18.6
 

.github/workflows/publish.yml

@@ -26,12 +26,12 @@ jobs:
           persist-credentials: false
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
+        uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # v4.4.0
         with:
           platforms: linux/amd64,linux/arm64
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
+        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
 
       - name: Log in to the Container registry
         uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f
@@ -50,7 +50,7 @@ jobs:
 
       - name: Build and push Docker image
         id: build
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc
         with:
           context: .
           platforms: linux/amd64,linux/arm64
@@ -112,7 +112,7 @@ jobs:
           persist-credentials: false
           ref: ${{ github.sha }}
 
-      - uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4 # v4.3.1
+      - uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1
         with:
           version: v3.18.6
 

.github/workflows/swagger.yml

@@ -22,7 +22,7 @@ jobs:
           go-version-file: go.mod
 
       - name: Install swag
-        run: go install github.com/swaggo/swag/cmd/swag@latest
+        run: go install github.com/swaggo/swag/cmd/swag@v1.16.6
 
       - name: Generate swagger
         run: go generate ./internal/server

.github/workflows/zizmor.yml

@@ -5,14 +5,22 @@ on:
     branches:
       - main
     paths:
-      - '.github/workflows/**'
+      - '.github/**'
+      - '**/action.yml'
+      - '**/action.yaml'
+      - 'zizmor.yml'
+      - 'zizmor.yaml'
   pull_request:
-    branches:
-      - main
     paths:
-      - '.github/workflows/**'
+      - '.github/**'
+      - '**/action.yml'
+      - '**/action.yaml'
+      - 'zizmor.yml'
+      - 'zizmor.yaml'
   workflow_dispatch:
 
+permissions: {}
+
 jobs:
   zizmor:
     runs-on: ubuntu-latest
@@ -26,4 +34,4 @@ jobs:
           persist-credentials: false
 
       - name: Run zizmor
-        uses: zizmorcore/zizmor-action@3dc1ecc9bcb9e94e9b2c709687979e1298497054 # v0.6.2
+        uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4

CONTRIBUTING.md

@@ -160,6 +160,7 @@ mux.Handle("/newregistry/", http.StripPrefix("/newregistry", newHandler.Routes()
 - Keep functions short and focused
 - Write tests for new functionality
 - Document exported types and functions
+- A new Prometheus metric needs a tile on `/ui/analytics` and an entry in `metricSurface` (`internal/server/analytics_coverage_test.go`). The page is meant to be a complete view of `/metrics`, so `TestEveryMetricIsSurfaced` fails until both exist.
 
 ## Testing
 

Dockerfile

@@ -16,7 +16,7 @@ COPY . .
 ARG TARGETARCH
 RUN CGO_ENABLED=0 GOOS=linux GOARCH=${TARGETARCH} go build -ldflags="-s -w" -o /proxy ./cmd/proxy
 
-FROM alpine:3.24.1
+FROM alpine:3.24.2
 
 RUN apk add --no-cache ca-certificates
 

cmd/proxy/main.go

@@ -106,11 +106,13 @@ import (
 	"log/slog"
 	"os"
 	"os/signal"
+	"runtime/debug"
 	"strings"
 	"syscall"
 
 	"github.com/git-pkgs/proxy/internal/config"
 	"github.com/git-pkgs/proxy/internal/database"
+	"github.com/git-pkgs/proxy/internal/denylist"
 	"github.com/git-pkgs/proxy/internal/handler"
 	"github.com/git-pkgs/proxy/internal/mirror"
 	"github.com/git-pkgs/proxy/internal/server"
@@ -128,6 +130,15 @@ var (
 	Commit = "unknown"
 )
 
+func init() {
+	if Version != "dev" {
+		return
+	}
+	if bi, ok := debug.ReadBuildInfo(); ok && bi.Main.Version != "" && bi.Main.Version != "(devel)" {
+		Version = bi.Main.Version
+	}
+}
+
 func main() {
 	if len(os.Args) > 1 {
 		switch os.Args[1] {
@@ -468,6 +479,10 @@ func runMirror() {
 		fmt.Fprintf(os.Stderr, "invalid configuration: %v\n", err)
 		os.Exit(1)
 	}
+	if !cfg.Storage.CacheArtifacts {
+		fmt.Fprintf(os.Stderr, "error: mirror is not available with storage.cache_artifacts: false: mirrored artifacts would never be served\n")
+		os.Exit(1)
+	}
 
 	logger := setupLogger("info", "text")
 
@@ -507,6 +522,12 @@ func runMirror() {
 	fetcher := fetch.NewFetcher()
 	resolver := fetch.NewResolver()
 	proxy := handler.NewProxy(db, store, fetcher, resolver, logger)
+	proxy.Denylist, err = denylist.New(cfg.Denylist.Packages)
+	if err != nil {
+		_ = db.Close()
+		fmt.Fprintf(os.Stderr, "invalid denylist: %v\n", err)
+		os.Exit(1) //nolint:gocritic // db closed above
+	}
 	proxy.CacheMetadata = true // mirror always caches metadata
 	proxy.MetadataTTL = cfg.ParseMetadataTTL()
 	proxy.MetadataMaxSize = cfg.ParseMetadataMaxSize()

config.example.yaml

@@ -14,12 +14,34 @@ base_url: "http://localhost:8080"
 # Set to "0" to disable the timeout. Default: "30s".
 # http_timeout: "30s"
 
+# Memory for rewritten npm and Composer metadata, so each upstream document is
+# rewritten once rather than on every request. Set to "0" to rewrite on every
+# request. Default: "256MB".
+# metadata_rewrite_cache_size: "256MB"
+
 # Public URL where the web UI is reached. Defaults to base_url when unset.
 # Set this separately when the UI is served on a different hostname than the
 # package endpoints — for example, the UI on a public domain behind auth while
 # build machines hit a Docker network alias for the package endpoints.
 # ui_base_url: "https://proxy.example.com/ui"
 
+# Attribute requests to the leftmost X-Forwarded-For entry rather than the TCP
+# peer address, in the structured log, the access log and the request-source
+# table on /ui/analytics.
+#
+# Enable this only when the proxy sits behind a load balancer or ingress that
+# sets the header. Any client can send it: behind one it is the only way to see
+# past the hop, in front of one it lets a caller forge its own address.
+# trust_forwarded_for: false
+
+# Show the request-source table on /ui/analytics: caller addresses, the tool
+# each ran and how much each pulled.
+#
+# Off by default. The proxy has no authentication of its own, so leave this off
+# unless /ui is gated by a reverse proxy; anyone who can reach the page can
+# otherwise read the addresses of your build fleet.
+# ui_request_sources: false
+
 # Artifact storage configuration
 storage:
   # Storage backend URL
@@ -52,6 +74,12 @@ storage:
   # Empty or "0" means unlimited
   max_size: ""
 
+  # Store fetched artifacts. Set to false to stream every download from
+  # upstream without storing it; metadata filtering, cooldown and the
+  # denylist still apply. Useful when another cache sits in front of the
+  # proxy. false is incompatible with direct_serve, scanning and mirror_api.
+  cache_artifacts: true
+
   # Redirect cached artifact downloads to presigned storage URLs (HTTP 302)
   # instead of streaming through the proxy. Only effective for S3, GCS, and Azure.
   # Leave disabled if clients reach the proxy through an authenticating gateway,
@@ -81,6 +109,10 @@ database:
   # Example: "postgres://user:password@localhost:5432/proxy?sslmode=disable"
   url: ""
 
+  # How often cache hit counts and last-access times are written, batched in
+  # one transaction. "0" writes each hit as it happens.
+  hit_flush_interval: "1s"
+
 # Logging configuration
 log:
   # Minimum log level: "debug", "info", "warn", "error"
@@ -174,6 +206,11 @@ upstream:
   # Debian/APT repository URL (used by /debian endpoint)
   debian: "http://deb.debian.org/debian"
 
+  # Additional Debian/APT archives, served at /debian/{name}/.
+  # The names "pool" and "dists" are reserved for the main archive's own paths.
+  debian_repositories:
+    security: "https://security.debian.org/debian-security"
+
   # RPM repository URL (used by /rpm endpoint)
   rpm: "https://dl.fedoraproject.org/pub/fedora/linux"
 
@@ -295,6 +332,20 @@ cooldown:
   #   "pkg:npm/lodash": "0"
   #   "pkg:npm/@babel/core": "14d"
 
+  # Per-package glob overrides, after exact packages and before ecosystems.
+  # package_patterns:
+  #   "pkg:npm/@example/*": "0"
+
+# Exact versions to deny, independently of cooldown and scanning.
+# Metadata filtering: npm, PyPI and Cargo. Shared artifact downloads, including
+# cache hits, are blocked with 403; signed APT metadata is left unchanged.
+# Use versioned PURLs without qualifiers/subpaths. Restart after changes.
+# denylist:
+#   packages:
+#     - "pkg:pypi/requests@2.31.0"
+#     - "pkg:cargo/some-crate@1.2.3"
+#     - "pkg:npm/%40scope/example@4.5.6"
+
 # Pre-cache artifact scanning. When enabled, every artifact is staged into
 # storage and scanned by the configured scanners before it is committed to
 # the cache and served to clients. Scanners never receive artifact bytes