chore: merge stable into dev (#323 workflows, signature data)

.github/workflows/daily-update.yml

@@ -15,16 +15,25 @@ concurrency:
 jobs:
   update:
     runs-on: ubuntu-24.04
+    # The bot's key and BBOT_IO_API_KEY live only in this environment, which
+    # accepts the stable branch only, so no other branch, pull request or
+    # dispatched copy of this workflow can read them.
+    environment: data-update
+    # The push uses the App token below, not GITHUB_TOKEN.
     permissions:
-      contents: write
+      contents: read
 
     steps:
     - name: Generate app token
       id: app-token
       uses: actions/create-github-app-token@v3
       with:
-        app-id: ${{ secrets.CLOUDCHECK_APP_ID }}
+        app-id: ${{ vars.CLOUDCHECK_APP_ID }}
         private-key: ${{ secrets.CLOUDCHECK_APP_PRIVATE_KEY }}
+        # Only contents write: the most the bot needs. With no owner or
+        # repositories input, the token covers only this repository; setting
+        # owner alone would widen it to every repository in the installation.
+        permission-contents: write
 
     - name: Checkout stable branch
       uses: actions/checkout@v7

.github/workflows/python-tests.yml

@@ -47,19 +47,17 @@ jobs:
     runs-on: ubuntu-24.04
     needs: test
     if: github.event_name == 'push' && github.ref == 'refs/heads/stable'
+    # The tag push uses GITHUB_TOKEN, not the bot's key: the PR rule on stable
+    # applies to GITHUB_TOKEN, so this job can't push to stable.
     permissions:
       contents: write
     steps:
-      - name: Generate app token
-        id: app-token
-        uses: actions/create-github-app-token@v3
-        with:
-          app-id: ${{ secrets.CLOUDCHECK_APP_ID }}
-          private-key: ${{ secrets.CLOUDCHECK_APP_PRIVATE_KEY }}
+      # No credentials left in .git/config, so the build steps below (third-party
+      # build code) can't push. Only the tag step gets the token.
       - uses: actions/checkout@v7
         with:
           fetch-depth: 0
-          token: ${{ steps.app-token.outputs.token }}
+          persist-credentials: false
       - name: Set up Python
         uses: actions/setup-python@v7
         with:
@@ -90,11 +88,13 @@ jobs:
         run: uv run maturin publish --skip-existing --username __token__ --password ${{ secrets.PYPI_TOKEN }}
       - name: Tag release
         if: steps.version_check.outputs.changed == 'true'
+        env:
+          GH_TOKEN: ${{ github.token }}
         run: |
           git config user.name "github-actions[bot]"
           git config user.email "github-actions[bot]@users.noreply.github.com"
           git tag -a "${{ steps.get_version.outputs.VERSION }}" -m "Release ${{ steps.get_version.outputs.VERSION }}"
-          git push origin "refs/tags/${{ steps.get_version.outputs.VERSION }}"
+          git push "https://x-access-token:${GH_TOKEN}@github.com/${GITHUB_REPOSITORY}.git" "refs/tags/${{ steps.get_version.outputs.VERSION }}"
   linux:
     runs-on: ${{ matrix.platform.runner }}
     needs: publish

README.md

@@ -224,66 +224,66 @@ When adding a new cloud provider:
 
 | Name | Description | Tags | Domains | Subnets |
 |------|-------------|------|---------|----------|
-| Akamai | A content delivery network and cloud services provider that delivers web and internet security services. | cloud | 81 | 6088 |
-| Alibaba Cloud | A Chinese cloud computing company and subsidiary of Alibaba Group, providing cloud services and infrastructure. | cloud | 464 | 86 |
-| Amazon Web Services | A comprehensive cloud computing platform provided by Amazon, offering infrastructure services, storage, and computing power. | cloud | 249 | 15061 |
+| Akamai | A content delivery network and cloud services provider that delivers web and internet security services. | cloud | 81 | 6078 |
+| Alibaba Cloud | A Chinese cloud computing company and subsidiary of Alibaba Group, providing cloud services and infrastructure. | cloud | 464 | 88 |
+| Amazon Web Services | A comprehensive cloud computing platform provided by Amazon, offering infrastructure services, storage, and computing power. | cloud | 250 | 15239 |
 | Arvancloud | An Iranian cloud computing and content delivery network provider offering cloud infrastructure and CDN services. | cdn | 1 | 25 |
-| Backblaze | A cloud storage and backup service provider offering data backup and cloud storage solutions. | cloud | 2 | 48 |
+| Backblaze | A cloud storage and backup service provider offering data backup and cloud storage solutions. | cloud | 2 | 45 |
 | Baidu Cloud Acceleration (百度云加速) | A Chinese content delivery network and cloud acceleration service provided by Baidu. | cdn | 132 | 0 |
 | Bunny CDN | A global content delivery network and edge platform. | cdn | 0 | 27 |
 | CacheFly | A content delivery network provider offering global CDN services. | cdn | 0 | 76 |
 | CDNetworks (씨디네트웍스) | A Korean content delivery network provider offering CDN and cloud services. | cdn | 0 | 3 |
-| Cisco | A multinational technology corporation that designs, manufactures, and sells networking hardware, software, and telecommunications equipment. | cloud | 121 | 671 |
-| Cloudflare | A web infrastructure and security company providing content delivery network services, DDoS mitigation, and web security solutions. | waf | 76 | 2760 |
-| Amazon CloudFront | A content delivery network service provided by Amazon Web Services that delivers data, videos, applications, and APIs to customers globally. | cdn | 0 | 180 |
-| DDoS Guard | A DDoS protection and content delivery network service provider. | cdn | 0 | 19 |
-| Dell | A multinational technology company that develops, sells, repairs, and supports computers and related products and services. | cloud | 210 | 121 |
-| DigitalOcean | A cloud infrastructure provider offering virtual private servers, managed databases, and other cloud services for developers and businesses. | cloud | 6 | 303 |
-| Department of Defense | A U.S. government agency responsible for coordinating and supervising all agencies and functions of the government directly related to national security and the United States Armed Forces. | gov | 3 | 8901 |
+| Cisco | A multinational technology corporation that designs, manufactures, and sells networking hardware, software, and telecommunications equipment. | cloud | 121 | 680 |
+| Cloudflare | A web infrastructure and security company providing content delivery network services, DDoS mitigation, and web security solutions. | waf | 76 | 2841 |
+| Amazon CloudFront | A content delivery network service provided by Amazon Web Services that delivers data, videos, applications, and APIs to customers globally. | cdn | 0 | 182 |
+| DDoS Guard | A DDoS protection and content delivery network service provider. | cdn | 0 | 18 |
+| Dell | A multinational technology company that develops, sells, repairs, and supports computers and related products and services. | cloud | 210 | 122 |
+| DigitalOcean | A cloud infrastructure provider offering virtual private servers, managed databases, and other cloud services for developers and businesses. | cloud | 6 | 304 |
+| Department of Defense | A U.S. government agency responsible for coordinating and supervising all agencies and functions of the government directly related to national security and the United States Armed Forces. | gov | 3 | 8662 |
 | Federal Bureau of Investigation | A U.S. government agency that serves as the domestic intelligence and security service, responsible for investigating federal crimes and protecting national security. | gov | 3 | 23 |
 | Fastly | A content delivery network and edge cloud platform that provides edge computing, security, and performance services. | cdn | 7 | 1191 |
-| Gabia (가비아) | A Korean cloud hosting and infrastructure provider. | cloud | 0 | 58 |
-| G-Core Labs | A content delivery network and cloud infrastructure provider offering CDN, cloud computing, and edge services. | cdn | 0 | 1448 |
-| GitHub | A web-based platform for version control and collaboration using Git, providing hosting for software development and code repositories. | cdn | 64 | 5429 |
+| Gabia (가비아) | A Korean cloud hosting and infrastructure provider. | cloud | 0 | 59 |
+| G-Core Labs | A content delivery network and cloud infrastructure provider offering CDN, cloud computing, and edge services. | cdn | 0 | 1451 |
+| GitHub | A web-based platform for version control and collaboration using Git, providing hosting for software development and code repositories. | cdn | 65 | 5423 |
 | GoCache | A Brazilian content delivery network provider offering CDN services. | cdn | 0 | 25 |
-| Google Cloud | A suite of cloud computing services provided by Google, including infrastructure, platform, and software services for businesses and developers. | cloud | 1094 | 1978 |
+| Google Cloud | A suite of cloud computing services provided by Google, including infrastructure, platform, and software services for businesses and developers. | cloud | 1094 | 1986 |
 | Hewlett Packard Enterprise | A multinational enterprise information technology company that provides servers, storage, networking, and cloud services. | cloud | 16 | 41 |
 | Heroku | A cloud platform as a service that enables developers to build, run, and operate applications entirely in the cloud. | cloud | 12 | 0 |
 | Hetzner | A German cloud hosting provider offering dedicated servers, cloud instances, and storage solutions. | cloud | 15 | 120 |
 | Hostway (호스트웨이) | A Korean cloud hosting and infrastructure provider. | cloud | 0 | 59 |
-| Huawei | A Chinese multinational technology corporation that designs, develops, and sells telecommunications equipment, consumer electronics, and cloud services. | cloud | 345 | 271 |
-| IBM | A multinational technology corporation that provides hardware, software, cloud computing, and consulting services. | cloud | 20 | 399 |
+| Huawei | A Chinese multinational technology corporation that designs, develops, and sells telecommunications equipment, consumer electronics, and cloud services. | cloud | 345 | 272 |
+| IBM | A multinational technology corporation that provides hardware, software, cloud computing, and consulting services. | cloud | 20 | 396 |
 | iboss | A cloud security company providing secure web gateway, CASB, and zero trust network access services. | security | 0 | 75 |
-| Imperva | A cybersecurity company that provides web application firewall, DDoS protection, and data security solutions. | waf | 1 | 394 |
-| Kamatera | A cloud infrastructure provider offering virtual private servers, cloud servers, and managed cloud services. | cloud | 1 | 187 |
+| Imperva | A cybersecurity company that provides web application firewall, DDoS protection, and data security solutions. | waf | 1 | 391 |
+| Kamatera | A cloud infrastructure provider offering virtual private servers, cloud servers, and managed cloud services. | cloud | 1 | 199 |
 | KINX (한국인터넷인프라) | A Korean content delivery network and cloud infrastructure provider. | cdn | 0 | 126 |
 | KT Cloud (KT클라우드) | A Korean cloud computing service provided by KT Corporation. | cloud | 0 | 18 |
 | Leaseweb | A global hosting and cloud infrastructure provider offering dedicated servers, cloud hosting, and CDN services. | cloud | 0 | 1492 |
-| LG U+ (LG유플러스) | A Korean telecommunications company offering CDN services. | cdn | 0 | 207 |
-| Microsoft | A multinational technology corporation that develops, manufactures, licenses, supports and sells computer software, consumer electronics and personal computers. Known for products like Windows, Office, Azure cloud services, and Xbox. | cloud | 753 | 42020 |
+| LG U+ (LG유플러스) | A Korean telecommunications company offering CDN services. | cdn | 0 | 209 |
+| Microsoft | A multinational technology corporation that develops, manufactures, licenses, supports and sells computer software, consumer electronics and personal computers. Known for products like Windows, Office, Azure cloud services, and Xbox. | cloud | 751 | 49253 |
 | Microsoft 365 | A cloud-based productivity suite provided by Microsoft, including Office applications and cloud services. | cloud | 184 | 82 |
 | Naver Cloud Platform (네이버 클라우드 플랫폼) | A Korean cloud computing platform provided by Naver Corporation. | cloud | 0 | 76 |
 | NHN Cloud (NHN클라우드) | A Korean cloud computing platform provided by NHN Corporation. | cloud | 0 | 127 |
-| OVHcloud | A French cloud computing company that provides web hosting, dedicated servers, and cloud infrastructure services. | cloud | 3 | 638 |
-| Oracle | A multinational technology corporation that provides database software, cloud engineering systems, and enterprise software products. | cloud | 19 | 2819 |
+| OVHcloud | A French cloud computing company that provides web hosting, dedicated servers, and cloud infrastructure services. | cloud | 3 | 665 |
+| Oracle | A multinational technology corporation that provides database software, cloud engineering systems, and enterprise software products. | cloud | 19 | 2844 |
 | Qrator | A DDoS protection and content delivery network service provider. | cdn | 0 | 23 |
 | Quic.cloud | A content delivery network and edge computing platform providing CDN services. | cdn | 0 | 153 |
 | Russian Federal Security Service | A Russian federal executive body responsible for counterintelligence, internal and border security, counterterrorism, and surveillance. | gov | 0 | 15 |
 | Rackspace | A managed cloud computing company that provides hosting, cloud services, and managed infrastructure solutions. | cloud | 1 | 216 |
 | Salesforce | A cloud-based software company that provides customer relationship management services and enterprise cloud computing solutions. | cloud | 41 | 45 |
 | Scaleway | A French cloud computing company that provides virtual private servers, bare metal servers, and cloud infrastructure services. | cloud | 1 | 48 |
 | SK Broadband (SK브로드밴드) | A Korean telecommunications company offering CDN services. | cdn | 0 | 17 |
-| StormWall | A DDoS protection and web application firewall service provider. | cdn | 0 | 16 |
-| Sucuri | A website security and web application firewall service provider. | waf | 0 | 19 |
-| Tencent Cloud (腾讯云) | A Chinese cloud computing service provider and subsidiary of Tencent, offering cloud infrastructure and platform services. | cloud | 700 | 399 |
+| StormWall | A DDoS protection and web application firewall service provider. | cdn | 0 | 15 |
+| Sucuri | A website security and web application firewall service provider. | waf | 0 | 18 |
+| Tencent Cloud (腾讯云) | A Chinese cloud computing service provider and subsidiary of Tencent, offering cloud infrastructure and platform services. | cloud | 700 | 407 |
 | United Kingdom Ministry of Defence | A U.K. government department responsible for implementing the defence policy of the United Kingdom and managing the British Armed Forces. | gov | 1 | 0 |
 | UpCloud | A Finnish cloud infrastructure provider offering high-performance cloud servers. | cloud | 0 | 54 |
-| Vultr | A global cloud hosting provider offering SSD-based cloud compute, bare metal, and managed Kubernetes. | cloud | 0 | 991 |
+| Vultr | A global cloud hosting provider offering SSD-based cloud compute, bare metal, and managed Kubernetes. | cloud | 0 | 975 |
 | Wasabi | A cloud storage provider offering hot cloud storage services with high performance and low cost. | cloud | 1 | 19 |
 | X4B | A DDoS protection and content delivery network service provider. | cdn | 0 | 3 |
-| Yandex Cloud | Russian cloud computing and internet services provider, offering infrastructure, storage, and various digital services. | cloud | 133 | 102 |
+| Yandex Cloud | Russian cloud computing and internet services provider, offering infrastructure, storage, and various digital services. | cloud | 157 | 100 |
 | Zoho | An Indian software company that provides cloud-based business software and productivity tools including CRM, email, and office suites. | cloud | 13 | 91 |
-| Zscaler | A cloud security company providing secure internet access, cloud security, and zero trust network access services. | cloud | 0 | 0 |
+| Zscaler | A cloud security company providing secure internet access, cloud security, and zero trust network access services. | cloud | 0 | 302 |
 <!--ENDPROVIDERTABLE-->
 
 ## Development