Andrew Dunn
2026-04-10T03:20:06Z

docs: rewrite README for container-first sysadmin audience

Top-to-bottom rewrite. Container is the only distribution path.
Walks through pull, config, validate, run, dry-run, k8s deployment.
Documents /healthz and /status observability endpoints with example
JSON. Covers GitLab project setup (trigger token, restrict variables,
workflow rules). Prescriptive error examples. Security model table.

AI-Assisted: yes
AI-Tools: Claude Code

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

postern v0.1.0

Cross-platform event-to-pipeline multiplexer for GitLab.

Translates cloud storage events (Azure Event Grid, GCP Pub/Sub, CloudEvents v1.0) into GitLab pipeline triggers. Config-driven YAML routing with gjson dot-path variable extraction.

Adapters:

Azure Event Grid: shared-secret auth, native + CloudEvents schema detection, SubscriptionValidation/Deletion handling, batch cap

GCP Pub/Sub: OIDC JWT verification (idtoken.Validator), email_verified

CloudEvents v1.0: bearer token auth, structured + binary mode via SDK

Security:

Auth on all endpoints (constant-time comparison)

gjson @-modifier injection blocked at config validation

Body size limits on all adapters (1MB)

GITLAB_URL required (no default, prevents token exfiltration)

Bounded trigger concurrency (semaphore, default 10)

Prescriptive errors (every failure names what to fix)

Container:

UBI10-micro base (FedRAMP, Iron Bank compatible)

Built with buildah (no Docker daemon)

Cosign keyless signed via GitLab OIDC

CycloneDX SBOM via container scanning

Non-root (UID 1001)

CI via public-sector-tools/pipeline catalog v1.0.0

37 tests with race detector. 6 rounds of adversarial review.