From 52bdb791c57c55a255e460dcb0192915c8074adf Mon Sep 17 00:00:00 2001 From: Corey Leath Date: Thu, 23 Jul 2026 19:35:11 -0400 Subject: [PATCH 01/10] ci: add enterprise automation baseline --- .github/workflows/ci.yml | 33 +++++++++++++++++++++++++++++++++ 1 file changed, 33 insertions(+) create mode 100644 .github/workflows/ci.yml diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml new file mode 100644 index 0000000..4f8f035 --- /dev/null +++ b/.github/workflows/ci.yml @@ -0,0 +1,33 @@ +name: CI +on: [push, pull_request] +permissions: {contents: read} +concurrency: {group: ci, cancel-in-progress: true} +jobs: + verify: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + - uses: actions/cache@v4 + with: + path: ~/.cache/pip + key: deps-${{ github.sha }} + - name: Detect stack and verify + shell: bash + run: | + set -euo pipefail + if find . -name '*.py' -print -quit | grep -q .; then + python -m pip install --upgrade pip + for f in requirements.txt requirements-dev.txt requirements/dev.txt; do [ -f "$f" ] && python -m pip install -r "$f"; done + python -m pip install pytest pytest-cov ruff black + python -m compileall -q . + if [ -d tests ]; then python -m pytest --cov=. --cov-report=xml; fi + if [ -f pyproject.toml ] && grep -qE 'ruff|black' pyproject.toml; then python -m ruff check .; python -m ruff format --check .; fi + elif [ -f package.json ]; then [ -f package-lock.json ] && npm ci || npm install; npm run lint --if-present; npm test --if-present; npm run build --if-present + elif [ -f go.mod ]; then gofmt -l . | tee /tmp/gofmt.out; test ! -s /tmp/gofmt.out; go test ./... + elif [ -f Cargo.toml ]; then cargo fmt --all -- --check; cargo clippy --all-targets --all-features -- -D warnings; cargo test --all + elif [ -f pom.xml ]; then (./mvnw -B verify || mvn -B verify) + elif [ -f CMakeLists.txt ]; then cmake -S . -B build; cmake --build build --parallel; ctest --test-dir build --output-on-failure + else echo 'No supported build manifest detected.'; fi + - uses: actions/upload-artifact@v4 + if: always() + with: {name: coverage, path: coverage.xml, if-no-files-found: ignore} From 0da776ce60d4d2132ec308ed6beddcc667998067 Mon Sep 17 00:00:00 2001 From: Corey Leath Date: Thu, 23 Jul 2026 19:35:22 -0400 Subject: [PATCH 02/10] ci: add enterprise automation baseline --- .github/workflows/security.yml | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) create mode 100644 .github/workflows/security.yml diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml new file mode 100644 index 0000000..1e0dcaa --- /dev/null +++ b/.github/workflows/security.yml @@ -0,0 +1,18 @@ +name: Security +on: + push: + pull_request: + schedule: [{cron: '41 4 * * 1'}] +permissions: {contents: read, security-events: write} +jobs: + scan: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + with: {fetch-depth: 0} + - uses: gitleaks/gitleaks-action@v2 + - uses: aquasecurity/trivy-action@master + with: {scan-type: fs, scan-ref: ., format: sarif, output: trivy-results.sarif, ignore-unfixed: true, severity: HIGH,CRITICAL, exit-code: '1'} + - uses: github/codeql-action/upload-sarif@v3 + if: always() + with: {sarif_file: trivy-results.sarif} From 33708c2a884cddd161d0bc18c305453c9ed73b31 Mon Sep 17 00:00:00 2001 From: Corey Leath Date: Thu, 23 Jul 2026 19:35:29 -0400 Subject: [PATCH 03/10] ci: add enterprise automation baseline --- .github/workflows/codeql.yml | 15 +++++++++++++++ 1 file changed, 15 insertions(+) create mode 100644 .github/workflows/codeql.yml diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml new file mode 100644 index 0000000..44228ac --- /dev/null +++ b/.github/workflows/codeql.yml @@ -0,0 +1,15 @@ +name: CodeQL +on: + push: + pull_request: + schedule: [{cron: '23 3 * * 1'}] +permissions: {contents: read, security-events: write} +jobs: + analyze: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + - uses: github/codeql-action/init@v3 + with: {languages: python, javascript-typescript, go, rust, java-kotlin, c-cpp} + - uses: github/codeql-action/autobuild@v3 + - uses: github/codeql-action/analyze@v3 From c48f7ad44c44d48de8b6f146a5f59d54bfca6241 Mon Sep 17 00:00:00 2001 From: Corey Leath Date: Thu, 23 Jul 2026 19:35:41 -0400 Subject: [PATCH 04/10] ci: add enterprise automation baseline --- .github/workflows/dependency-review.yml | 9 +++++++++ 1 file changed, 9 insertions(+) create mode 100644 .github/workflows/dependency-review.yml diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml new file mode 100644 index 0000000..52a13f9 --- /dev/null +++ b/.github/workflows/dependency-review.yml @@ -0,0 +1,9 @@ +name: Dependency Review +on: {pull_request:} +permissions: {contents: read, pull-requests: read} +jobs: + review: + runs-on: ubuntu-latest + steps: + - uses: actions/dependency-review-action@v4 + with: {fail-on-severity: high} From 77104f547a9974f5bcf52823077b53dca15130d4 Mon Sep 17 00:00:00 2001 From: Corey Leath Date: Thu, 23 Jul 2026 20:07:55 -0400 Subject: [PATCH 05/10] ci: validate CodeQL language YAML --- .github/workflows/codeql.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 44228ac..ad868d5 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -10,6 +10,6 @@ jobs: steps: - uses: actions/checkout@v4 - uses: github/codeql-action/init@v3 - with: {languages: python, javascript-typescript, go, rust, java-kotlin, c-cpp} + with: {languages: 'python,javascript-typescript,go,rust,java-kotlin,c-cpp'} - uses: github/codeql-action/autobuild@v3 - uses: github/codeql-action/analyze@v3 From 0b104937003238d94a316740a52f5965492642e0 Mon Sep 17 00:00:00 2001 From: Corey Leath Date: Thu, 23 Jul 2026 20:08:36 -0400 Subject: [PATCH 06/10] ci: validate Trivy severity YAML --- .github/workflows/security.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index 1e0dcaa..a05394f 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -12,7 +12,7 @@ jobs: with: {fetch-depth: 0} - uses: gitleaks/gitleaks-action@v2 - uses: aquasecurity/trivy-action@master - with: {scan-type: fs, scan-ref: ., format: sarif, output: trivy-results.sarif, ignore-unfixed: true, severity: HIGH,CRITICAL, exit-code: '1'} + with: {scan-type: fs, scan-ref: ., format: sarif, output: trivy-results.sarif, ignore-unfixed: true, severity: 'HIGH,CRITICAL', exit-code: '1'} - uses: github/codeql-action/upload-sarif@v3 if: always() with: {sarif_file: trivy-results.sarif} From 82be19fc1e5f43eca96fad03c397271da03d9d65 Mon Sep 17 00:00:00 2001 From: Corey Leath Date: Fri, 24 Jul 2026 09:16:56 -0400 Subject: [PATCH 07/10] ci: detect CodeQL languages per repository --- .github/workflows/codeql.yml | 38 +++++++++++++++++++++++++++++++++--- 1 file changed, 35 insertions(+), 3 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index ad868d5..2d650a1 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -2,14 +2,46 @@ name: CodeQL on: push: pull_request: - schedule: [{cron: '23 3 * * 1'}] -permissions: {contents: read, security-events: write} + schedule: + - cron: '23 3 * * 1' +permissions: + contents: read + security-events: write jobs: + detect: + runs-on: ubuntu-latest + outputs: + languages: ${{ steps.lang.outputs.languages }} + steps: + - uses: actions/checkout@v4 + - id: lang + shell: bash + run: | + set -euo pipefail + langs='' + find . -name '*.py' -print -quit | grep -q . && langs="$langs python" + find . ( -name '*.js' -o -name '*.ts' -o -name '*.tsx' ) -print -quit | grep -q . && langs="$langs javascript-typescript" + [ -f go.mod ] && langs="$langs go" + [ -f Cargo.toml ] && langs="$langs rust" + [ -f pom.xml ] || [ -f build.gradle ] && langs="$langs java-kotlin" + find . ( -name '*.c' -o -name '*.cpp' -o -name '*.h' ) -print -quit | grep -q . && langs="$langs c-cpp" + [ -n "$langs" ] || langs=' python' + langs="${langs# }" + json="$(printf '%s +' $langs | jq -Rsc 'split(" +")[:-1]')" + echo "languages=$json" >> "$GITHUB_OUTPUT" analyze: + needs: detect + strategy: + fail-fast: false + matrix: + language: ${{ fromJSON(needs.detect.outputs.languages) }} runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - uses: github/codeql-action/init@v3 - with: {languages: 'python,javascript-typescript,go,rust,java-kotlin,c-cpp'} + with: + languages: ${{ matrix.language }} - uses: github/codeql-action/autobuild@v3 - uses: github/codeql-action/analyze@v3 From e67ff44c2df4380491c4cb8b3b7e1203ed775f19 Mon Sep 17 00:00:00 2001 From: Corey Leath Date: Fri, 24 Jul 2026 09:21:44 -0400 Subject: [PATCH 08/10] ci: harden CodeQL language detection --- .github/workflows/codeql.yml | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 2d650a1..b3f48b1 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -19,17 +19,15 @@ jobs: run: | set -euo pipefail langs='' - find . -name '*.py' -print -quit | grep -q . && langs="$langs python" - find . ( -name '*.js' -o -name '*.ts' -o -name '*.tsx' ) -print -quit | grep -q . && langs="$langs javascript-typescript" + [ -n "$(find . -name '*.py' -print -quit)" ] && langs="$langs python" + [ -n "$(find . -name '*.js' -print -quit)" ] || [ -n "$(find . -name '*.ts' -print -quit)" ] && langs="$langs javascript-typescript" [ -f go.mod ] && langs="$langs go" [ -f Cargo.toml ] && langs="$langs rust" [ -f pom.xml ] || [ -f build.gradle ] && langs="$langs java-kotlin" - find . ( -name '*.c' -o -name '*.cpp' -o -name '*.h' ) -print -quit | grep -q . && langs="$langs c-cpp" + [ -n "$(find . -name '*.c' -print -quit)" ] || [ -n "$(find . -name '*.cpp' -print -quit)" ] && langs="$langs c-cpp" [ -n "$langs" ] || langs=' python' - langs="${langs# }" - json="$(printf '%s -' $langs | jq -Rsc 'split(" -")[:-1]')" + json="$(printf '%s\n' $langs | jq -Rsc 'split(" +") | map(select(length > 0))')" echo "languages=$json" >> "$GITHUB_OUTPUT" analyze: needs: detect From 59ff1481156414d17672a5754748e235e7eafc65 Mon Sep 17 00:00:00 2001 From: Corey Leath Date: Fri, 24 Jul 2026 09:27:19 -0400 Subject: [PATCH 09/10] ci: fix CodeQL language JSON generation --- .github/workflows/codeql.yml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index b3f48b1..f6a1ed3 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -26,8 +26,7 @@ jobs: [ -f pom.xml ] || [ -f build.gradle ] && langs="$langs java-kotlin" [ -n "$(find . -name '*.c' -print -quit)" ] || [ -n "$(find . -name '*.cpp' -print -quit)" ] && langs="$langs c-cpp" [ -n "$langs" ] || langs=' python' - json="$(printf '%s\n' $langs | jq -Rsc 'split(" -") | map(select(length > 0))')" + json="$(jq -cn --arg l "$langs" '$l | split(" ") | map(select(length > 0))')" echo "languages=$json" >> "$GITHUB_OUTPUT" analyze: needs: detect From e3de00d324ec67e8c69c9528e24715d740e48496 Mon Sep 17 00:00:00 2001 From: Corey Leath Date: Fri, 24 Jul 2026 09:41:49 -0400 Subject: [PATCH 10/10] ci: use CodeQL no-build mode for mixed TrojanChat sources --- .github/workflows/codeql.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index f6a1ed3..f5f690d 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -40,5 +40,6 @@ jobs: - uses: github/codeql-action/init@v3 with: languages: ${{ matrix.language }} - - uses: github/codeql-action/autobuild@v3 + build-mode: none + - uses: github/codeql-action/analyze@v3