Harden LLMHarbor for production

.env.example

@@ -29,3 +29,9 @@ HOST=127.0.0.1
 # Vite dev dashboard. Only set this if you serve the dashboard from a
 # different host than the API (e.g. http://my-server.local).
 # DASHBOARD_ORIGINS=http://my-server.local,http://192.168.1.50
+
+# Optional request and backup ceilings. The public OpenAI-compatible JSON body
+# limit defaults to 16mb. Streamed database export/import defaults to 4 GiB;
+# legacy base64 JSON backups retain a 128 MiB binary compatibility ceiling.
+# LLMHARBOR_API_BODY_LIMIT=16mb
+# LLMHARBOR_MAX_BACKUP_BYTES=4294967296

.github/workflows/ci.yml

@@ -1,28 +1,115 @@
 name: CI
 
+permissions:
+  contents: read
+
 on:
   push:
     branches: [main]
   pull_request:
     branches: [main]
 
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
+  scripts:
+    name: Validate command-line scripts
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Validate Bash scripts
+        run: |
+          bash -n bin/llmharbor install.sh install-macos.sh
+          shellcheck bin/llmharbor install.sh install-macos.sh
+
+      - name: Parse PowerShell scripts
+        shell: pwsh
+        run: |
+          $ErrorActionPreference = 'Stop'
+          foreach ($file in @('bin/llmharbor.ps1', 'install.ps1')) {
+            [void][scriptblock]::Create((Get-Content -LiteralPath $file -Raw))
+          }
+
+  scripts-native:
+    name: Native CLI (${{ matrix.os }})
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 10
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [macos-latest, windows-latest]
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Check macOS Bash entry points
+        if: runner.os == 'macOS'
+        shell: bash
+        run: |
+          /bin/bash -n bin/llmharbor install.sh install-macos.sh
+          /bin/bash bin/llmharbor help >/dev/null
+
+      - name: Check Windows PowerShell entry point
+        if: runner.os == 'Windows'
+        shell: powershell
+        run: |
+          $ErrorActionPreference = 'Stop'
+          foreach ($file in @('bin/llmharbor.ps1', 'install.ps1')) {
+            [void][scriptblock]::Create((Get-Content -LiteralPath $file -Raw))
+          }
+          & powershell.exe -NoProfile -ExecutionPolicy Bypass -File bin/llmharbor.ps1 help *> $null
+          if ($LASTEXITCODE -ne 0) { throw "llmharbor help exited with $LASTEXITCODE" }
+          # Windows PowerShell 5.1 promotes native stderr to NativeCommandError
+          # under Stop. This command is expected to write an error and fail, so
+          # capture its process exit code without weakening the other checks.
+          $ErrorActionPreference = 'SilentlyContinue'
+          & powershell.exe -NoProfile -ExecutionPolicy Bypass -File bin/llmharbor.ps1 definitely-not-a-command *> $null
+          $unknownCommandExit = $LASTEXITCODE
+          $ErrorActionPreference = 'Stop'
+          if ($unknownCommandExit -eq 0) { throw 'An unknown command must return a non-zero exit code' }
+          exit 0 # Do not propagate the intentionally failing child process code.
+
   test:
-    name: Test & build
+    name: Node ${{ matrix.node-version }}
     runs-on: ubuntu-latest
+    timeout-minutes: 20
+    strategy:
+      fail-fast: false
+      matrix:
+        node-version: ['22.12.0', '24']
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: '20'
+          node-version: ${{ matrix.node-version }}
           cache: 'npm'
 
       - name: Install dependencies
-        run: npm install
+        run: npm ci
+
+      - name: Lint dashboard
+        run: npm run lint
 
       - name: Run tests
         run: npm test
 
       - name: Build workspaces
         run: npm run build
+
+      - name: Validate static website script
+        if: matrix.node-version == '24'
+        run: node --check website/script.js
+
+      - name: Audit production dependencies
+        if: matrix.node-version == '24'
+        run: npm audit --omit=dev --audit-level=high

.github/workflows/pages.yml

@@ -23,18 +23,21 @@ jobs:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Setup Pages
-        uses: actions/configure-pages@v5
+        uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0
 
       - name: Upload static site
-        uses: actions/upload-pages-artifact@v3
+        uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
         with:
           path: website
 
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0