Skip to content

Commit d074c31

Browse files
iamjoemccormickiamjoemccormick
authored
Merge pull request #11 from ThinkParQ/iamjoe/chore/public-repo-updates
2 parents d7beb05 + 76e74e7 commit d074c31

File tree

6 files changed

+181
-20
lines changed

6 files changed

+181
-20
lines changed

‎.github/actions/package/action.yml‎

Lines changed: 1 addition & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,11 @@
11
name: "Build packages"
22
description: "Build RPM and DEB packages for multiple architectures"
33

4-
inputs:
5-
CI_PROTOBUF_ACCESS_TOKEN:
6-
description: "Access token for protobuf repo"
7-
required: true
8-
94
runs:
105
using: "composite"
116
steps:
127
- name: Setup Rust Environment
13-
uses: moonrepo/setup-rust@v1
8+
uses: moonrepo/setup-rust@ede6de059f8046a5e236c94046823e2af11ca670 # v1
149
with:
1510
components: clippy
1611
targets: aarch64-unknown-linux-gnu
@@ -28,10 +23,6 @@ runs:
2823
mkdir -p ${HOME}/zig
2924
tar -xJ -C ${HOME}/zig --strip-components=1 -f zig.tar.xz
3025
echo ${HOME}/zig >> ${GITHUB_PATH}
31-
- name: Configure foreign git repos
32-
# Make sure the runner has access to the protobuf repo using an access token
33-
shell: bash
34-
run: git config --global url."https://${{ inputs.CI_PROTOBUF_ACCESS_TOKEN }}@github.com/thinkparq/protobuf".insteadOf https://github.com/thinkparq/protobuf
3526
- name: Run checks and tests
3627
shell: bash
3728
run: |

‎.github/workflows/checks.yml‎

Lines changed: 8 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,29 +1,32 @@
11
name: Check
22
run-name: Check ${{ github.ref_name }} by @${{ github.actor }}
3-
on: [pull_request, workflow_call]
3+
on:
4+
pull_request:
5+
paths-ignore:
6+
- "**/*.md"
7+
workflow_call:
48
env:
59
# Cargo must use git cli for checkouts instead of builtin functionality to respect the repla
610
CARGO_NET_GIT_FETCH_WITH_CLI: true
711
jobs:
812
checks:
913
runs-on: ubuntu-latest
14+
permissions:
15+
contents: read
1016
env:
1117
CARGO_LOCKED: 1
1218
steps:
1319
- name: Checkout
1420
uses: actions/checkout@v4
1521
- name: Setup Rust
16-
uses: moonrepo/setup-rust@v1
22+
uses: moonrepo/setup-rust@ede6de059f8046a5e236c94046823e2af11ca670 # v1
1723
with:
1824
components: clippy
1925
bins: cargo-deny
2026
- name: Setup nightly toolchain and tools
2127
run: |
2228
rustup toolchain install nightly
2329
rustup component add --toolchain nightly rustfmt
24-
- name: Configure foreign git repos
25-
# Make sure the runner has access to the protobuf repo using an access token
26-
run: git config --global url."https://${{ secrets.CI_PROTOBUF_ACCESS }}@github.com/thinkparq/protobuf".insteadOf https://github.com/thinkparq/protobuf
2730
- name: Checks
2831
run: make check
2932
- name: Run tests

‎.github/workflows/codeql.yml‎

Lines changed: 102 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,102 @@
1+
# For most projects, this workflow file will not need changing; you simply need
2+
# to commit it to your repository.
3+
#
4+
# You may wish to alter this file to override the set of languages analyzed,
5+
# or to provide custom queries or build logic.
6+
#
7+
# ******** NOTE ********
8+
# We have attempted to detect the languages in your repository. Please check
9+
# the `language` matrix defined below to confirm you have the correct set of
10+
# supported CodeQL languages.
11+
#
12+
name: "CodeQL Advanced"
13+
14+
on:
15+
push:
16+
branches: ["main"]
17+
paths-ignore:
18+
- "**/*.md"
19+
pull_request:
20+
branches: ["main"]
21+
paths-ignore:
22+
- "**/*.md"
23+
schedule:
24+
- cron: "30 20 * * 1"
25+
26+
jobs:
27+
analyze:
28+
name: Analyze (${{ matrix.language }})
29+
# Runner size impacts CodeQL analysis time. To learn more, please see:
30+
# - https://gh.io/recommended-hardware-resources-for-running-codeql
31+
# - https://gh.io/supported-runners-and-hardware-resources
32+
# - https://gh.io/using-larger-runners (GitHub.com only)
33+
# Consider using larger runners or machines with greater resources for possible analysis time improvements.
34+
runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }}
35+
permissions:
36+
# required for all workflows
37+
security-events: write
38+
39+
# required to fetch internal or private CodeQL packs
40+
packages: read
41+
42+
# only required for workflows in private repositories
43+
actions: read
44+
contents: read
45+
46+
strategy:
47+
fail-fast: false
48+
matrix:
49+
include:
50+
- language: actions
51+
build-mode: none
52+
# CodeQL supports the following values keywords for 'language': 'actions', 'c-cpp', 'csharp', 'go', 'java-kotlin', 'javascript-typescript', 'python', 'ruby', 'swift'
53+
# Use `c-cpp` to analyze code written in C, C++ or both
54+
# Use 'java-kotlin' to analyze code written in Java, Kotlin or both
55+
# Use 'javascript-typescript' to analyze code written in JavaScript, TypeScript or both
56+
# To learn more about changing the languages that are analyzed or customizing the build mode for your analysis,
57+
# see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning.
58+
# If you are analyzing a compiled language, you can modify the 'build-mode' for that language to customize how
59+
# your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages
60+
steps:
61+
- name: Checkout repository
62+
uses: actions/checkout@v4
63+
64+
# Add any setup steps before running the `github/codeql-action/init` action.
65+
# This includes steps like installing compilers or runtimes (`actions/setup-node`
66+
# or others). This is typically only required for manual builds.
67+
# - name: Setup runtime (example)
68+
# uses: actions/setup-example@v1
69+
70+
# Initializes the CodeQL tools for scanning.
71+
- name: Initialize CodeQL
72+
uses: github/codeql-action/init@v3
73+
with:
74+
languages: ${{ matrix.language }}
75+
build-mode: ${{ matrix.build-mode }}
76+
# If you wish to specify custom queries, you can do so here or in a config file.
77+
# By default, queries listed here will override any specified in a config file.
78+
# Prefix the list here with "+" to use these queries and those in the config file.
79+
80+
# For more details on CodeQL's query packs, refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
81+
# queries: security-extended,security-and-quality
82+
83+
# If the analyze step fails for one of the languages you are analyzing with
84+
# "We were unable to automatically build your code", modify the matrix above
85+
# to set the build mode to "manual" for that language. Then modify this step
86+
# to build your code.
87+
# ℹ️ Command-line programs to run using the OS shell.
88+
# 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
89+
- if: matrix.build-mode == 'manual'
90+
shell: bash
91+
run: |
92+
echo 'If you are using a "manual" build mode for one or more of the' \
93+
'languages you are analyzing, replace this with the commands to build' \
94+
'your code, for example:'
95+
echo ' make bootstrap'
96+
echo ' make release'
97+
exit 1
98+
99+
- name: Perform CodeQL Analysis
100+
uses: github/codeql-action/analyze@v3
101+
with:
102+
category: "/language:${{matrix.language}}"

‎.github/workflows/contributors.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,8 @@ on:
1212
jobs:
1313
verify:
1414
runs-on: ubuntu-latest
15+
permissions:
16+
contents: read
1517
steps:
1618
- name: Check out code
1719
uses: actions/checkout@v3

‎.github/workflows/release.yml‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,9 @@ on:
99
env:
1010
# Cargo must use git cli for checkouts instead of builtin functionality to respect the repla
1111
CARGO_NET_GIT_FETCH_WITH_CLI: true
12+
permissions:
13+
# Required to publish releases.
14+
contents: write
1215
jobs:
1316
release:
1417
runs-on: ubuntu-latest
@@ -22,21 +25,19 @@ jobs:
2225
fetch-depth: 0
2326
- name: Build Packages
2427
uses: ./.github/actions/package
25-
with:
26-
CI_PROTOBUF_ACCESS_TOKEN: ${{ secrets.CI_PROTOBUF_ACCESS }}
2728
- name: Import GPG key
2829
id: import_gpg
29-
uses: crazy-max/ghaction-import-gpg@v6
30+
uses: crazy-max/ghaction-import-gpg@82a020f1f7f605c65dd2449b392a52c3fcfef7ef # v6
3031
with:
3132
gpg_private_key: ${{ secrets.PUBLICREPO_GPGPACKAGEKEY }}
3233
passphrase: ${{ secrets.PUBLICREPO_GPGPACKAGEPASSPHRASE }}
3334
- name: Sign checksums file
3435
run: |
3536
cd target/package
3637
export GPG_TTY=$(tty)
37-
gpg --pinentry-mode loopback --passphrase ${{ secrets.PUBLICREPO_GPGPACKAGEPASSPHRASE }} --trust-model always --detach-sign -o checksums.txt.sig -r [email protected] checksums.txt
38+
gpg --pinentry-mode loopback --passphrase ${{ secrets.PUBLICREPO_GPGPACKAGEPASSPHRASE }} --trust-model always --detach-sign -o checksums.txt.sig -r [email protected] checksums.txt
3839
- name: Create Release
39-
uses: ncipollo/release-action@v1
40+
uses: ncipollo/release-action@440c8c1cb0ed28b9f43e4d1d670870f059653174 # v1
4041
with:
4142
artifacts: "target/package/*.deb,target/package/*.rpm,target/package/checksums*"
4243
allowUpdates: true

‎SECURITY.md‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
# Security Policy <!-- omit in toc -->
2+
3+
## Contents <!-- omit in toc -->
4+
5+
- [How to Report](#how-to-report)
6+
- [Response and Handling](#response-and-handling)
7+
- [Disclosure Policy](#disclosure-policy)
8+
- [Supported Versions](#supported-versions)
9+
- [Prevention](#prevention)
10+
- [Acknowledgments](#acknowledgments)
11+
12+
## How to Report
13+
14+
* Please [report](https://github.com/ThinkParQ/beegfs-rust/security) potential security
15+
vulnerabilities using [GitHub's private vulnerability
16+
reporting](https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing-information-about-vulnerabilities/privately-reporting-a-security-vulnerability).
17+
Make sure to not disclose this information in public.
18+
* Provide a detailed description of the potential vulnerability, ensuring you include steps that can
19+
help in reproducing the issue.
20+
21+
## Response and Handling
22+
23+
We will make every effort to response to and resolve security issues in a timely manner. To that end
24+
our goals when handling security issues are:
25+
26+
* Acknowledge every report within three working days.
27+
* Assess the report, evaluate its impact and severity, and determine its authenticity providing an
28+
new update within five working days.
29+
* Work diligently to address any verified vulnerabilities. While the time to deliver a fix will vary
30+
depending on complexity, throughout this process, we'll provide timely updates on our progress
31+
until resolution.
32+
* Once the vulnerability has been fixed, make a public announcement crediting you for the discovery
33+
(unless you wish to remain anonymous).
34+
35+
## Disclosure Policy
36+
37+
Upon confirmation of a security issue, our approach is:
38+
39+
1. Verify the vulnerability and determine affected versions.
40+
2. Develop a fix or a workaround.
41+
3. Upon a successful fix or workaround, inform the community through a public advisory.
42+
43+
## Supported Versions
44+
45+
Security fixes are made available in the latest major version and backported to older versions per
46+
the [BeeGFS support policy](https://github.com/ThinkParQ/beegfs/blob/master/SUPPORT.md)
47+
48+
## Prevention
49+
50+
To help prevent security vulnerabilities, we:
51+
52+
- Regularly review and update our dependencies using Dependabot and CodeQL.
53+
54+
- Adhere to best coding practices and conduct regular code reviews.
55+
56+
- Actively seek feedback and input from our developer community on security matters.
57+
58+
## Acknowledgments
59+
60+
We're thankful to our community for their active involvement in enhancing the safety of our project.
61+
Those who've identified vulnerabilities are recognized in our release notes, unless they've opted
62+
for anonymity.

0 commit comments

Comments
 (0)