release: prepare v5.0.3 security fixes and verified deployment

.github/workflows/master-auto-deploy.yml

@@ -4,6 +4,11 @@ on:
   push:
     branches: [ master ]
   workflow_dispatch:
+    inputs:
+      harden_actuator:
+        description: Apply v5.0.3 monitoring defaults to the active external config
+        type: boolean
+        default: false
 
 concurrency:
   group: master-auto-deploy-production
@@ -29,6 +34,8 @@ jobs:
       KK_DEPLOY_GIT_EXE: ${{ vars.KK_DEPLOY_GIT_EXE }}
       KK_DEPLOY_MVN_CMD: ${{ vars.KK_DEPLOY_MVN_CMD }}
       KK_DEPLOY_MAVEN_SETTINGS: ${{ vars.KK_DEPLOY_MAVEN_SETTINGS }}
+      KK_DEPLOY_REVISION: ${{ github.sha }}
+      KK_DEPLOY_HARDEN_ACTUATOR: ${{ inputs.harden_actuator || 'false' }}
 
     steps:
       - name: Checkout repository

.github/workflows/maven.yml

@@ -35,6 +35,18 @@ jobs:
     - name: Build with Maven
       run: mvn -B package "-Dmaven.test.skip=true" --file pom.xml
 
+    - name: Security regression tests
+      if: runner.os == 'Linux'
+      run: >-
+        mvn -B -pl server
+        -Dtest=FtpCommandSecurityTests,UploadPathSecurityTests,PreviewSourceSecurityTests,PreviewParameterSecurityTests,ArchiveDirectorySecurityTests,ActuatorExposureSecurityTests,ArchiveTraversalSecurityTests,FileControllerPathSecurityTests,FileControllerDeleteSecurityTests
+        test
+
+    - name: Validate Windows deployment
+      if: runner.os == 'Windows'
+      shell: powershell
+      run: .github/scripts/test_windows_deploy.ps1
+
     - name: Upload Linux distribution package
       if: success() && runner.os == 'Linux'
       uses: actions/upload-artifact@v4