Skip to content

Commit 5a5df0d

Browse files
meherpangulurimeherpanguluri
committed
cleanup: remove stale compat files, update workflows, add .gitignore for build
1 parent 3a49ff2 commit 5a5df0d

19 files changed

Lines changed: 115 additions & 725 deletions

File tree

‎.github/workflows/ci.yml‎

Lines changed: 8 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -2,13 +2,16 @@ name: CI
22

33
on: [push, pull_request]
44

5+
permissions:
6+
contents: read
7+
58
jobs:
69
test-macos:
710
runs-on: macos-latest
811
steps:
9-
- uses: actions/checkout@v4
12+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
1013

11-
- uses: actions/setup-go@v5
14+
- uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
1215
with:
1316
go-version: '1.23'
1417

@@ -32,17 +35,17 @@ jobs:
3235
3336
- name: Upload coverage
3437
if: github.event_name == 'push' && github.ref == 'refs/heads/main'
35-
uses: actions/upload-artifact@v4
38+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
3639
with:
3740
name: coverage-macos
3841
path: coverage.out
3942

4043
test-linux:
4144
runs-on: ubuntu-latest
4245
steps:
43-
- uses: actions/checkout@v4
46+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
4447

45-
- uses: actions/setup-go@v5
48+
- uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
4649
with:
4750
go-version: '1.23'
4851

‎.github/workflows/codeql.yml‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -21,9 +21,9 @@ jobs:
2121
matrix:
2222
language: ['go', 'javascript']
2323
steps:
24-
- uses: actions/checkout@v4
24+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
2525

26-
- uses: actions/setup-go@v5
26+
- uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
2727
if: matrix.language == 'go'
2828
with:
2929
go-version: '1.23'
@@ -32,10 +32,10 @@ jobs:
3232
if: matrix.language == 'go'
3333
run: sudo apt-get update && sudo apt-get install -y libgtk-3-dev libwebkit2gtk-4.1-dev
3434

35-
- uses: github/codeql-action/init@v3
35+
- uses: github/codeql-action/init@ff0a06e83cb2de871e5a09832bc6a81e7276941f # v3.28.18
3636
with:
3737
languages: ${{ matrix.language }}
3838

39-
- uses: github/codeql-action/autobuild@v3
39+
- uses: github/codeql-action/autobuild@ff0a06e83cb2de871e5a09832bc6a81e7276941f # v3.28.18
4040

41-
- uses: github/codeql-action/analyze@v3
41+
- uses: github/codeql-action/analyze@ff0a06e83cb2de871e5a09832bc6a81e7276941f # v3.28.18

‎.github/workflows/deploy.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -18,9 +18,9 @@ jobs:
1818
build:
1919
runs-on: ubuntu-latest
2020
steps:
21-
- uses: actions/checkout@v4
21+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
2222

23-
- uses: actions/setup-node@v4
23+
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
2424
with:
2525
node-version: 20
2626

@@ -43,7 +43,7 @@ jobs:
4343
cp -r docs/dist/* _site/docs/ 2>/dev/null || mkdir -p _site/docs && cp -r docs/dist/* _site/docs/
4444
4545
- name: Upload Pages artifact
46-
uses: actions/upload-pages-artifact@v3
46+
uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3.0.1
4747
with:
4848
path: _site
4949

@@ -56,4 +56,4 @@ jobs:
5656
steps:
5757
- name: Deploy to GitHub Pages
5858
id: deployment
59-
uses: actions/deploy-pages@v4
59+
uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4.0.5

‎.github/workflows/govulncheck.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -16,9 +16,9 @@ jobs:
1616
name: Go Vulnerability Check
1717
runs-on: ubuntu-latest
1818
steps:
19-
- uses: actions/checkout@v4
19+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
2020

21-
- uses: actions/setup-go@v5
21+
- uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
2222
with:
2323
go-version: '1.23'
2424

‎.github/workflows/release.yml‎

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -12,8 +12,8 @@ jobs:
1212
test:
1313
runs-on: macos-latest
1414
steps:
15-
- uses: actions/checkout@v4
16-
- uses: actions/setup-go@v5
15+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
16+
- uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
1717
with:
1818
go-version: '1.23'
1919
- name: Test with coverage
@@ -58,9 +58,9 @@ jobs:
5858
runs-on: ${{ matrix.os }}
5959

6060
steps:
61-
- uses: actions/checkout@v4
61+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
6262

63-
- uses: actions/setup-go@v5
63+
- uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
6464
with:
6565
go-version: '1.23'
6666

@@ -91,7 +91,7 @@ jobs:
9191
go build -ldflags="-s -w" -o ${{ matrix.artifact }} ./cmd/lightshell
9292
9393
- name: Upload artifact
94-
uses: actions/upload-artifact@v4
94+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
9595
with:
9696
name: ${{ matrix.artifact }}
9797
path: ${{ matrix.artifact }}
@@ -101,10 +101,10 @@ jobs:
101101
runs-on: ubuntu-latest
102102

103103
steps:
104-
- uses: actions/checkout@v4
104+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
105105

106106
- name: Download all artifacts
107-
uses: actions/download-artifact@v4
107+
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
108108
with:
109109
path: artifacts
110110

@@ -119,7 +119,7 @@ jobs:
119119
done
120120
121121
- name: Create GitHub Release
122-
uses: softprops/action-gh-release@v2
122+
uses: softprops/action-gh-release@da05d552573ad5aba039eaac05058a918a7bf631 # v2.2.2
123123
with:
124124
generate_release_notes: true
125125
files: release/*.tar.gz
@@ -129,15 +129,15 @@ jobs:
129129
runs-on: ubuntu-latest
130130

131131
steps:
132-
- uses: actions/checkout@v4
132+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
133133

134-
- uses: actions/setup-node@v4
134+
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
135135
with:
136136
node-version: 20
137137
registry-url: https://registry.npmjs.org
138138

139139
- name: Download all artifacts
140-
uses: actions/download-artifact@v4
140+
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
141141
with:
142142
path: artifacts
143143

‎.github/workflows/scorecard.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -19,22 +19,22 @@ jobs:
1919
contents: read
2020
actions: read
2121
steps:
22-
- uses: actions/checkout@v4
22+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
2323
with:
2424
persist-credentials: false
2525

26-
- uses: ossf/scorecard-action@v2.4.0
26+
- uses: ossf/scorecard-action@05b42c624433fc40578a4c7a362e21f42750e7eb # v2.4.1
2727
with:
2828
results_file: results.sarif
2929
results_format: sarif
3030
publish_results: true
3131

32-
- uses: actions/upload-artifact@v4
32+
- uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
3333
with:
3434
name: SARIF file
3535
path: results.sarif
3636
retention-days: 5
3737

38-
- uses: github/codeql-action/upload-sarif@v3
38+
- uses: github/codeql-action/upload-sarif@ff0a06e83cb2de871e5a09832bc6a81e7276941f # v3.28.18
3939
with:
4040
sarif_file: results.sarif

‎.gitignore‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,3 +31,4 @@ claude.md
3131
CLAUDE.md
3232
private.pem
3333
public.pem
34+
build/

‎SECURITY.md‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
# Security Policy
2+
3+
## Supported Versions
4+
5+
| Version | Supported |
6+
| ------- | ------------------ |
7+
| latest | Yes |
8+
9+
## Reporting a Vulnerability
10+
11+
If you discover a security vulnerability in LightShell, please report it responsibly.
12+
13+
**Do not open a public GitHub issue for security vulnerabilities.**
14+
15+
Instead, please send an email to **security@lightshell.dev** with:
16+
17+
1. A description of the vulnerability
18+
2. Steps to reproduce the issue
19+
3. The potential impact
20+
4. Any suggested fixes (optional)
21+
22+
### What to expect
23+
24+
- **Acknowledgment**: We will acknowledge receipt of your report within 48 hours.
25+
- **Assessment**: We will assess the vulnerability and determine its severity within 5 business days.
26+
- **Fix timeline**: Critical vulnerabilities will be patched within 7 days. Other issues will be addressed in the next scheduled release.
27+
- **Disclosure**: We will coordinate with you on public disclosure timing. We ask that you allow us a reasonable window to release a fix before any public disclosure.
28+
29+
## Security Practices
30+
31+
- All GitHub Actions workflows use pinned SHA references to prevent supply-chain attacks.
32+
- Dependencies are regularly audited with `govulncheck` and GitHub's Dependabot.
33+
- CodeQL static analysis runs on every push and pull request.
34+
- The OpenSSF Scorecard is monitored to maintain supply-chain security best practices.
35+
36+
## Scope
37+
38+
This security policy applies to the LightShell project repository and its official npm packages (`lightshell`, `create-lightshell`, and `@lightshell/*` platform packages).

0 commit comments

Comments
 (0)