Repository navigation
Release workflow, Dependabot and CodeQL - #2
Open
ravimehra9911 wants to merge 2 commits into
Open
ravimehra9911 wants to merge 2 commits into
ravimehra9911 wants to merge 2 commits into
Conversation
Bump next to 15.5.28 and vitest to 5, apply npm audit fix (electron, fast-uri), and override Next's nested postcss to ^8.5.30. npm audit --audit-level=high now reports 0 vulnerabilities.
- release.yml: on v* tags, check the tag matches electron/package.json, run typecheck/lint/test, build the mac (arm64+x64), Windows and Linux installers on their own runners, scan the unpacked apps for secrets, and attach the four installers to a draft release. Optional signing/notarization steps run only when their secrets exist. PRs touching packaging run the build and scan. - scripts/check-release.mjs: the secret scan (env files, OAuth client files, databases, encryption keys, non-empty resources/config.json, key strings). - ci.yml: npm audit --audit-level=high. - Dependabot (npm, github-actions; weekly, grouped minor/patch) and CodeQL. - SECURITY.md and a Releasing section in CONTRIBUTING and README.
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| if (!entry.isFile()) continue; | ||
| if (entry.name === "config.json" && /^resources$/i.test(path.basename(dir))) checkConfig(full, where); | ||
| if (fs.statSync(full).size > MAX_SCAN_BYTES) continue; | ||
| const buf = fs.readFileSync(full); |
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Moves desktop releases off the maintainer's laptop and adds basic supply-chain hygiene.
Release workflow (
.github/workflows/release.yml)v*tag. Fails if the tag doesn't matchelectron/package.json's version.macos-latest(arm64 + x64 dmg),windows-latest(exe) andubuntu-latest(AppImage) withMAILCLEAN_BUNDLE_OAUTH=0, and checksbuild/config.jsonis{}.scripts/check-release.mjsscans every unpacked app (including file names insideapp.asar) for.env*,client_secret*,*.db/*.sqlite,encryption.key,.data/,*.pem/*.p12/*.pfx, a non-emptyresources/config.json, and Google OAuth secrets, private keys, AWS keys and GitHub tokens. It prints the file and rule, never the value, and fails the job on a hit.MailClean-mac-arm64.dmg,MailClean-mac-x64.dmg,MailClean-windows-x64.exeandMailClean-linux-x86_64.AppImageto a draft release. Re-runs replace files only while the release is still a draft. Publishing stays manual.MAC_CSC_LINK/WIN_CSC_LINKsecrets exist.Supply chain
.github/dependabot.yml: npm and github-actions, weekly, minor/patch grouped..github/workflows/codeql.yml: CodeQL for JavaScript/TypeScript (security-extended) on push, PR and weekly.ci.yml:npm audit --audit-level=high. To make it pass: next 15.5.27 → 15.5.28, vitest 3 → 5,npm audit fix(electron, fast-uri), and an override pinning Next's nested postcss to^8.5.30. Now 0 vulnerabilities; typecheck, lint, 37 tests andnext buildpass locally.Docs
SECURITY.md(report to support@mailclean.app or a private advisory).Notes
dist-desktopbuild (clean) and against a folder with planted fakes (all 7 caught). The first version flagged OpenSSL's bareBEGIN PRIVATE KEYconstant in libvips, so the rule now requires a key body.