EPOMAKER EK21 Configurator

Desktop configurator for the EPOMAKER EK21 (Tauri v2 + React + Rust), including keymap, macros, encoder, and lighting controls over HID/VIA protocol.

Tech Stack

• Frontend: React + TypeScript + Vite
• Desktop shell: Tauri v2
• Backend: Rust (hidapi)

Local Development

Install dependencies:

npm ci

Run frontend dev server:

npm run dev

Build frontend:

npm run build

Run Tauri commands:

npm run tauri -- info

Security And CI Gates

This repository now includes security-focused CI workflows:

• PR security checks: .github/workflows/pr-security.yml
• Release security checks + SBOM + signing readiness: .github/workflows/release-security.yml
• CodeQL (Rust + JavaScript/TypeScript): .github/workflows/codeql.yml
• Dependabot weekly updates (npm + cargo): .github/dependabot.yml

Detailed process docs:

• docs/security/ci-security-gates.md
• docs/security/pre-release-checklist.md

Release Security Behavior

PR Path

• Builds and tests frontend + Rust backend.
• Runs npm audit --omit=dev --audit-level=high.
• Runs cargo audit and blocks on RustSec vulnerabilities.
• Uploads audit artifacts:
  • cargo-audit.json
  • npm-audit-summary.txt

Release Path (workflow_dispatch or v* tags)

• Runs stricter dependency scan including dev dependencies.
• Runs Rust checks/tests and cargo audit.
• Generates SBOM artifacts:
  • sbom-npm.json
  • sbom-cargo.json
• Validates signing/notarization secret placeholders.
• If a GitHub Release already exists for the tag, security artifacts are attached to it.

Required Secrets (Signing Readiness)

The release workflow checks for the presence of:

• APPLE_SIGNING_CERT_BASE64
• APPLE_SIGNING_CERT_PASSWORD
• APPLE_SIGNING_IDENTITY
• APPLE_TEAM_ID
• APPLE_ID
• APPLE_APP_SPECIFIC_PASSWORD

Note: This phase validates readiness only. It does not yet automate signed/notarized artifact publishing.

Branch Protection (Main)

Configure repository branch protection for main to require:

• PR Security / build-and-test
• PR Security / dependency-scan
• CodeQL / Analyze (javascript-typescript)
• CodeQL / Analyze (rust)

Also require up-to-date branches and disable direct pushes to main.