From 37ad78c30a237e4951c61382adea5710ae89b305 Mon Sep 17 00:00:00 2001 From: Kenji TAKIGUCHI Date: Tue, 27 Oct 2026 13:02:41 +0900 Subject: [PATCH 1/4] chore: configure free repository security automation --- .github/dependabot.yml | 75 +++++++++++++++++++ .github/workflows/dependency-review.yml | 22 ++++++ .../upload-dlls-older-visual-studio.yml | 14 ++++ .github/workflows/upload-dlls.yml | 14 ++++ SECURITY.md | 7 ++ 5 files changed, 132 insertions(+) create mode 100644 .github/dependabot.yml create mode 100644 .github/workflows/dependency-review.yml create mode 100644 SECURITY.md diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 00000000..d6a13416 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,75 @@ +version: 2 +updates: +- package-ecosystem: bundler + directory: / + schedule: + interval: weekly + day: monday + time: '10:00' + timezone: Asia/Tokyo + open-pull-requests-limit: 3 + groups: + routine-updates: + patterns: + - '*' + update-types: + - minor + - patch + security-updates: + applies-to: security-updates + patterns: + - '*' +- package-ecosystem: github-actions + directory: / + schedule: + interval: weekly + day: monday + time: '10:00' + timezone: Asia/Tokyo + open-pull-requests-limit: 3 + groups: + routine-updates: + patterns: + - '*' + update-types: + - minor + - patch + security-updates: + applies-to: security-updates + patterns: + - '*' +- package-ecosystem: gitsubmodule + directory: / + schedule: + interval: weekly + day: monday + time: '10:00' + timezone: Asia/Tokyo + open-pull-requests-limit: 3 + groups: + routine-updates: + patterns: + - '*' + security-updates: + applies-to: security-updates + patterns: + - '*' +- package-ecosystem: nuget + directory: /wrappers/csharp/LibPLATEAU.NET/CSharpPLATEAU.Test + schedule: + interval: weekly + day: monday + time: '10:00' + timezone: Asia/Tokyo + open-pull-requests-limit: 3 + groups: + routine-updates: + patterns: + - '*' + update-types: + - minor + - patch + security-updates: + applies-to: security-updates + patterns: + - '*' diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml new file mode 100644 index 00000000..4f8ebb63 --- /dev/null +++ b/.github/workflows/dependency-review.yml @@ -0,0 +1,22 @@ +name: Dependency review +'on': + pull_request: + types: + - opened + - synchronize + - reopened +permissions: + contents: read +jobs: + dependency-review: + runs-on: ubuntu-latest + steps: + - name: Checkout repository configuration + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 + with: + persist-credentials: false + sparse-checkout: .github + - name: Review dependency changes + uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 + with: + fail-on-severity: high diff --git a/.github/workflows/upload-dlls-older-visual-studio.yml b/.github/workflows/upload-dlls-older-visual-studio.yml index 3cd808a0..105b5662 100644 --- a/.github/workflows/upload-dlls-older-visual-studio.yml +++ b/.github/workflows/upload-dlls-older-visual-studio.yml @@ -81,6 +81,12 @@ jobs: runs-on: ubuntu-latest needs: [upload-dlls, upload_mobile_dlls] + permissions: + contents: read + actions: read + id-token: write + attestations: write + steps: - name: download-all-artifacts uses: actions/download-artifact@v4 @@ -114,6 +120,14 @@ jobs: cp ~/a/libplateau-macos-14-x86_64/*.a ~/a/plateau-plugins/static-libs/macos/x86_64 cp ~/a/libplateau-macos-14-arm64/*.a ~/a/plateau-plugins/static-libs/macos/arm64 + - name: Locate the attestation subjects + run: echo "ATTEST_SUBJECT_DIR=$HOME/a/plateau-plugins" >> "$GITHUB_ENV" + + - name: Attest the compiled libraries + uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2 + with: + subject-path: "${{ env.ATTEST_SUBJECT_DIR }}/**/*" + - name: upload artifact uses: actions/upload-artifact@v4 with: diff --git a/.github/workflows/upload-dlls.yml b/.github/workflows/upload-dlls.yml index 298ae21a..07fa4aa4 100644 --- a/.github/workflows/upload-dlls.yml +++ b/.github/workflows/upload-dlls.yml @@ -84,6 +84,12 @@ jobs: runs-on: ubuntu-latest needs: [upload-dlls, upload_mobile_dlls] + permissions: + contents: read + actions: read + id-token: write + attestations: write + steps: - name: download-all-artifacts uses: actions/download-artifact@v4 @@ -118,6 +124,14 @@ jobs: cp ~/a/libplateau-macos-14-x86_64/*.a ~/a/plateau-plugins/static-libs/macos/x86_64 cp ~/a/libplateau-macos-14-arm64/*.a ~/a/plateau-plugins/static-libs/macos/arm64 + - name: Locate the attestation subjects + run: echo "ATTEST_SUBJECT_DIR=$HOME/a/plateau-plugins" >> "$GITHUB_ENV" + + - name: Attest the compiled libraries + uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2 + with: + subject-path: "${{ env.ATTEST_SUBJECT_DIR }}/**/*" + - name: upload artifact uses: actions/upload-artifact@v4 with: diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 00000000..bcb30c73 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,7 @@ +# セキュリティ上の問題の報告 + +脆弱性や認証情報の漏えいが疑われる場合は、公開のIssueやPRに詳細・秘密情報を書き込まず、 +このリポジトリの **Security → Advisories → Report a vulnerability** から非公開で報告してください。 + +再現手順、影響するバージョン、影響範囲を、秘密情報の値を含めずに記載してください。 +対応時期やサポート対象についての個別の約束は、この文書では定めません。 From ff13f616b8b8f4620f20b364b06977f29124d898 Mon Sep 17 00:00:00 2001 From: Kenji TAKIGUCHI <96907439+waterfallmouse@users.noreply.github.com> Date: Tue, 27 Oct 2026 13:58:21 +0900 Subject: [PATCH 2/4] ci: repair validation compatibility --- .github/workflows/check-submodule-license.yml | 14 ++++++++++++++ .licensed.yml | 1 + 2 files changed, 15 insertions(+) diff --git a/.github/workflows/check-submodule-license.yml b/.github/workflows/check-submodule-license.yml index fe8048c7..4ac7df70 100644 --- a/.github/workflows/check-submodule-license.yml +++ b/.github/workflows/check-submodule-license.yml @@ -33,5 +33,19 @@ jobs: with: version: '4.x' + # licensed が other と判定する json は、確認済みコミットと MIT 本文を固定して照合します。 + # submodule を更新した場合は、ライセンス本文を再確認して両方の値を更新してください。 + - name: Verify reviewed JSON license + shell: bash + run: | + set -euo pipefail + expected_commit=a3e6e26dc83a726b292f5be0492fcc408663ce55 + actual_commit=$(git -C 3rdparty/json rev-parse HEAD) + if [ "$actual_commit" != "$expected_commit" ]; then + echo "::error::JSON submodule changed; review its license before updating the approved commit." + exit 1 + fi + echo '86b998c792894ccb911a1cb7994f7a9652894e7a094c0b5e45be2f553f45cf14 3rdparty/json/LICENSE.MIT' | sha256sum --check --strict + - run: licensed cache - run: licensed status diff --git a/.licensed.yml b/.licensed.yml index a02cf3c3..da441106 100644 --- a/.licensed.yml +++ b/.licensed.yml @@ -9,6 +9,7 @@ allowed: reviewed: git_submodule: + - json # MIT。CI で確認済みコミット・ライセンス本文のハッシュを照合 - libxml2 # MITライセンスなのでOK - openssl-cmake # 再配布可能、要著作権表示 - pybind11 # BSD-3ライセンスなのでOK From f3090fded5a669181136a8772f0c0e548292fc82 Mon Sep 17 00:00:00 2001 From: Kenji TAKIGUCHI <96907439+waterfallmouse@users.noreply.github.com> Date: Tue, 27 Oct 2026 14:11:54 +0900 Subject: [PATCH 3/4] ci: repair validation compatibility --- .../Backup/{LibPLATEAU.NET.sln => LibPLATEAU.NET.sln.backup} | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename wrappers/csharp/LibPLATEAU.NET/Backup/{LibPLATEAU.NET.sln => LibPLATEAU.NET.sln.backup} (100%) diff --git a/wrappers/csharp/LibPLATEAU.NET/Backup/LibPLATEAU.NET.sln b/wrappers/csharp/LibPLATEAU.NET/Backup/LibPLATEAU.NET.sln.backup similarity index 100% rename from wrappers/csharp/LibPLATEAU.NET/Backup/LibPLATEAU.NET.sln rename to wrappers/csharp/LibPLATEAU.NET/Backup/LibPLATEAU.NET.sln.backup From cb346f6e20455783ce35c55146c57a5310ef02ba Mon Sep 17 00:00:00 2001 From: Kenji TAKIGUCHI <96907439+waterfallmouse@users.noreply.github.com> Date: Tue, 27 Oct 2026 14:17:00 +0900 Subject: [PATCH 4/4] ci: repair validation compatibility --- .github/workflows/dependency-review.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml index 4f8ebb63..3a955e0a 100644 --- a/.github/workflows/dependency-review.yml +++ b/.github/workflows/dependency-review.yml @@ -20,3 +20,4 @@ jobs: uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 with: fail-on-severity: high + fail-on-scopes: runtime, development, unknown