GA readiness
Groundwork before calling Externa GA (post-beta): security walkthrough, light performance smoke, and support/upgrade expectations.
Related
Security checklist · Threat model · AuthZ map · Upgrade · Packagist · Releasing · Website ↔ docs messaging · Marketing: externa.qiick.io
Security checklist (staging pass)
Walk Security checklist and Threat model against a staging deploy before GA:
| Area | Expectation |
|---|---|
APP_DEBUG | false in production |
APP_KEY | Unique; never shared across envs |
| Headers / HTTPS | Prefer TLS; TRUSTED_PROXIES when behind a proxy |
| File downloads | AuthZ on private disks; denylist for dangerous uploads |
| Public CMS API | Keys + origin allowlist; no unintended public role grants |
| GraphQL | Depth / complexity limits as documented |
| AI tools | Permission gates (ChecksAiPermissions) on mutating tools |
Record findings in the milestone issue or fix before GA cut. Host reporting: repo SECURITY.md.
Performance smoke
Not a full load test. On a reference box (Compose prod or comparable VPS):
- Login
- List collections; open one item
- Public CMS API list + show (Bruno or curl)
- Optional GraphQL introspection / one query
Note rough p95 latency for those paths. Flag obvious N+1 or filter costs (especially MySQL vs Postgres) if seen. Optional helper: scripts/perf-smoke.sh in externa-core when present.
Support window (beta → GA)
| Topic | Expectation |
|---|---|
| Upgrade path | Follow Upgrade; backup first (Backup) |
| Install | Packagist create-project (qiick/externa-core); Docker / Herd remain supported |
| Databases | Supported databases — Postgres recommended |
| Issues | GitHub Issues |
| Post-1.0 | Public API follows API 1.x compatibility; maintainers ship tags (Releasing #92) |
Evidence for this milestone
Beta.4 closed security/install/Docker groundwork (#84–#86, #88, #93, #94). GA (1.0.0) adds AuthZ map docs (#90), outbound empty-secret refuse (#88), Docker deploy DX (#56), and a dated staging pass on the GA issue (#24). Docs site for the cut: 1.1.1.