From 390ff1cad90b684e929d2099633ffc28bc691ba6 Mon Sep 17 00:00:00 2001 From: hideouts-io <83608068+hideouts-io@users.noreply.github.com> Date: Thu, 8 Oct 2026 20:35:46 -0700 Subject: [PATCH 1/4] Establish reviewed GitHub workflow and publication rules --- .github/dependabot.yml | 7 +++++++ AGENTS.md | 13 +++++++++++++ 2 files changed, 20 insertions(+) create mode 100644 .github/dependabot.yml create mode 100644 AGENTS.md diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..9a350e5 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,7 @@ +version: 2 +updates: + - package-ecosystem: github-actions + directory: / + schedule: + interval: monthly + open-pull-requests-limit: 5 diff --git a/AGENTS.md b/AGENTS.md new file mode 100644 index 0000000..ca8046e --- /dev/null +++ b/AGENTS.md @@ -0,0 +1,13 @@ +# System Profiler Explorer + +## Validation and evidence + +- Read `CONTRIBUTING.md` and `SECURITY.md`. Run `./scripts/check-publication-boundary.sh`, then `xcodebuild -project SystemProfilerExplorer.xcodeproj -scheme SystemProfilerExplorer -destination 'platform=macOS' CODE_SIGNING_ALLOWED=NO build test` before a PR. +- Keep the checked-in Xcode project; regenerate it with XcodeGen only when `project.yml` changes. Preserve the publication-boundary gate and native build/test CI. +- Keep collection read-only and separate reported values from interpretation. Tests and CodeQL do not establish live collection on every supported Mac or compromise. +- Never include raw profiler reports, private snapshots, identifiers, installed-software inventories, host timestamps, or screenshots with private values in Git or PRs. Use synthetic fixtures; review the documented anonymized-sample exception before sharing. +- Verify successful Swift, JavaScript/TypeScript, and GitHub Actions CodeQL analyses at the candidate revision; scanner configuration or an older run does not establish current coverage. + +## Publication + +- `scripts/build-release.sh` builds a local distribution candidate. Tags and CI do not publish a product release; distribution signing, notarization, tagging, and publication require authorization covering those actions. From f61cb5629588defef49e38a1bd0f49a00bdade10 Mon Sep 17 00:00:00 2001 From: hideouts-io <83608068+hideouts-io@users.noreply.github.com> Date: Thu, 8 Oct 2026 20:42:15 -0700 Subject: [PATCH 2/4] Maintain the existing branding npm dependencies --- .github/dependabot.yml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 9a350e5..20a1986 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -5,3 +5,8 @@ updates: schedule: interval: monthly open-pull-requests-limit: 5 + - package-ecosystem: npm + directory: /scripts/branding + schedule: + interval: monthly + open-pull-requests-limit: 5 From a8f8b0c8398becd594b3384ed012dc60184e9d32 Mon Sep 17 00:00:00 2001 From: hideouts-io <83608068+hideouts-io@users.noreply.github.com> Date: Thu, 8 Oct 2026 20:43:39 -0700 Subject: [PATCH 3/4] Check branding TypeScript in pull request CI --- .github/workflows/ci.yml | 21 +++++++++++++++++++++ AGENTS.md | 1 + 2 files changed, 22 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 4c0c90a..31862db 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -12,6 +12,27 @@ concurrency: cancel-in-progress: true jobs: + branding-type-check: + name: Branding TypeScript check + runs-on: ubuntu-latest + timeout-minutes: 10 + defaults: + run: + working-directory: scripts/branding + steps: + - name: Check out repository + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false + - name: Set up Node + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7 + with: + node-version: '24' + - name: Install locked branding dependencies + run: npm ci --ignore-scripts + - name: Check branding TypeScript + run: npm run check + build-and-test: runs-on: macos-26 timeout-minutes: 20 diff --git a/AGENTS.md b/AGENTS.md index ca8046e..672c3ab 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -4,6 +4,7 @@ - Read `CONTRIBUTING.md` and `SECURITY.md`. Run `./scripts/check-publication-boundary.sh`, then `xcodebuild -project SystemProfilerExplorer.xcodeproj -scheme SystemProfilerExplorer -destination 'platform=macOS' CODE_SIGNING_ALLOWED=NO build test` before a PR. - Keep the checked-in Xcode project; regenerate it with XcodeGen only when `project.yml` changes. Preserve the publication-boundary gate and native build/test CI. +- Branding dependencies live in `scripts/branding`; use its lockfile and run `npm ci --ignore-scripts` followed by `npm run check` there. Type checks do not regenerate or validate rendered artwork. - Keep collection read-only and separate reported values from interpretation. Tests and CodeQL do not establish live collection on every supported Mac or compromise. - Never include raw profiler reports, private snapshots, identifiers, installed-software inventories, host timestamps, or screenshots with private values in Git or PRs. Use synthetic fixtures; review the documented anonymized-sample exception before sharing. - Verify successful Swift, JavaScript/TypeScript, and GitHub Actions CodeQL analyses at the candidate revision; scanner configuration or an older run does not establish current coverage. From 9941a53efc45e96b7b0fa7f2295ef9a96d47d4c1 Mon Sep 17 00:00:00 2001 From: hideouts-io <83608068+hideouts-io@users.noreply.github.com> Date: Thu, 8 Oct 2026 20:57:45 -0700 Subject: [PATCH 4/4] Separate CodeQL source execution from result upload permissions --- .github/workflows/codeql.yml | 111 +++++++++++++++++++++++++++++++++++ AGENTS.md | 1 + 2 files changed, 112 insertions(+) create mode 100644 .github/workflows/codeql.yml diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml new file mode 100644 index 0000000..922611a --- /dev/null +++ b/.github/workflows/codeql.yml @@ -0,0 +1,111 @@ +name: CodeQL + +on: + push: + branches: [main] + pull_request: + branches: [main] + schedule: + - cron: '17 6 * * 1' + workflow_dispatch: + +permissions: + contents: read + +concurrency: + group: codeql-${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + +jobs: + analyze: + name: Analyze (${{ matrix.language }}) + runs-on: ${{ matrix.os }} + timeout-minutes: 45 + permissions: + contents: read + strategy: + fail-fast: false + matrix: + include: + - language: swift + os: macos-26 + build-mode: manual + - language: javascript-typescript + os: ubuntu-latest + build-mode: none + - language: actions + os: ubuntu-latest + build-mode: none + env: + DEVELOPER_DIR: ${{ matrix.language == 'swift' && '/Applications/Xcode_26.4.1.app/Contents/Developer' || '' }} + steps: + - name: Check out source + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false + - name: Initialize CodeQL + uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d # v4 + with: + languages: ${{ matrix.language }} + build-mode: ${{ matrix.build-mode }} + - name: Build Swift source for extraction + if: matrix.language == 'swift' + run: xcodebuild -project SystemProfilerExplorer.xcodeproj -scheme SystemProfilerExplorer -destination 'platform=macOS' CODE_SIGNING_ALLOWED=NO build test + - name: Analyze source without upload permissions + uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d # v4 + with: + category: /language:${{ matrix.language }} + output: results + upload: never + upload-database: false + - name: Retain analysis results for the upload job + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 + with: + name: codeql-results-${{ matrix.language }} + path: results/*.sarif + if-no-files-found: error + retention-days: 7 + + upload: + name: Upload CodeQL (${{ matrix.language }}) + needs: analyze + runs-on: ubuntu-latest + timeout-minutes: 10 + permissions: + security-events: write + strategy: + fail-fast: false + matrix: + language: [swift, javascript-typescript, actions] + steps: + - name: Download this run's analysis results + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8 + with: + name: codeql-results-${{ matrix.language }} + path: results + - name: Upload SARIF without checking out or running repository code + uses: github/codeql-action/upload-sarif@24c54180a607b1449ed407dd24f251e4e9147c8d # v4 + with: + sarif_file: results + category: /language:${{ matrix.language }} + ref: ${{ github.ref }} + sha: ${{ github.sha }} + wait-for-processing: true + + results: + name: CodeQL results + needs: [analyze, upload] + if: always() + runs-on: ubuntu-latest + timeout-minutes: 5 + permissions: {} + steps: + - name: Require completed analysis and processed uploads + env: + ANALYSIS_RESULT: ${{ needs.analyze.result }} + UPLOAD_RESULT: ${{ needs.upload.result }} + run: | + if [[ "$ANALYSIS_RESULT" != success || "$UPLOAD_RESULT" != success ]]; then + printf 'CodeQL did not complete: analysis=%s upload=%s\n' "$ANALYSIS_RESULT" "$UPLOAD_RESULT" >&2 + exit 1 + fi diff --git a/AGENTS.md b/AGENTS.md index 672c3ab..a594b7b 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -8,6 +8,7 @@ - Keep collection read-only and separate reported values from interpretation. Tests and CodeQL do not establish live collection on every supported Mac or compromise. - Never include raw profiler reports, private snapshots, identifiers, installed-software inventories, host timestamps, or screenshots with private values in Git or PRs. Use synthetic fixtures; review the documented anonymized-sample exception before sharing. - Verify successful Swift, JavaScript/TypeScript, and GitHub Actions CodeQL analyses at the candidate revision; scanner configuration or an older run does not establish current coverage. +- Keep CodeQL extraction/build jobs read-only. Upload SARIF in a separate job that runs no repository code, and preserve the strict `CodeQL results` gate across every language. ## Publication