Skip to content

Commit 6ac5359

Browse files
RinziiRinzii
committed
Merge branch 'main' into dev
2 parents dd61e42 + f9d72c2 commit 6ac5359

8 files changed

+208
-15
lines changed

‎.github/workflows/ci-linux.yml

+14-4
Original file line numberDiff line numberDiff line change
@@ -22,10 +22,15 @@ jobs:
2222
cxx_version: [17, 20]
2323
target: [Debug, Release]
2424
steps:
25-
- uses: actions/checkout@v4
25+
- name: Harden Runner
26+
uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde # v2.9.1
27+
with:
28+
egress-policy: audit
29+
30+
- uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
2631

2732
- name: Cache CMake build files
28-
uses: actions/cache@v3
33+
uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2
2934
with:
3035
path: build
3136
key: ${{ runner.os }}-cmake-${{ matrix.compiler }}-${{ matrix.cxx_version }}-${{ matrix.target }}
@@ -52,10 +57,15 @@ jobs:
5257
cxx_version: [17, 20]
5358
target: [Debug, Release]
5459
steps:
55-
- uses: actions/checkout@v4
60+
- name: Harden Runner
61+
uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde # v2.9.1
62+
with:
63+
egress-policy: audit
64+
65+
- uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
5666

5767
- name: Cache CMake build files
58-
uses: actions/cache@v3
68+
uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2
5969
with:
6070
path: build
6171
key: ${{ runner.os }}-cmake-${{ matrix.compiler }}-${{ matrix.cxx_version }}-${{ matrix.target }}

‎.github/workflows/ci-macos.yml

+14-4
Original file line numberDiff line numberDiff line change
@@ -22,10 +22,15 @@ jobs:
2222
cxx_version: [17, 20]
2323
target: [Debug, Release]
2424
steps:
25-
- uses: actions/checkout@v4
25+
- name: Harden Runner
26+
uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde # v2.9.1
27+
with:
28+
egress-policy: audit
29+
30+
- uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
2631

2732
- name: Cache CMake build files
28-
uses: actions/cache@v3
33+
uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2
2934
with:
3035
path: build
3136
key: ${{ runner.os }}-cmake-${{ matrix.compiler }}-${{ matrix.cxx_version }}-${{ matrix.target }}
@@ -58,10 +63,15 @@ jobs:
5863
cxx_version: [17, 20]
5964
target: [Debug, Release]
6065
steps:
61-
- uses: actions/checkout@v4
66+
- name: Harden Runner
67+
uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde # v2.9.1
68+
with:
69+
egress-policy: audit
70+
71+
- uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
6272

6373
- name: Cache CMake build files
64-
uses: actions/cache@v3
74+
uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2
6575
with:
6676
path: build
6777
key: ${{ runner.os }}-cmake-${{ matrix.compiler }}-${{ matrix.cxx_version }}-${{ matrix.target }}

‎.github/workflows/ci-windows.yml

+14-4
Original file line numberDiff line numberDiff line change
@@ -22,10 +22,15 @@ jobs:
2222
cxx_version: [17, 20]
2323
target: [Debug, Release]
2424
steps:
25-
- uses: actions/checkout@v4
25+
- name: Harden Runner
26+
uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde # v2.9.1
27+
with:
28+
egress-policy: audit
29+
30+
- uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
2631

2732
- name: Cache CMake build files
28-
uses: actions/cache@v3
33+
uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2
2934
with:
3035
path: build
3136
key: ${{ runner.os }}-cmake-${{ matrix.compiler }}-${{ matrix.cxx_version }}-${{ matrix.target }}
@@ -49,10 +54,15 @@ jobs:
4954
cxx_version: [17, 20]
5055
target: [Debug, Release]
5156
steps:
52-
- uses: actions/checkout@v4
57+
- name: Harden Runner
58+
uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde # v2.9.1
59+
with:
60+
egress-policy: audit
61+
62+
- uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
5363

5464
- name: Cache CMake build files
55-
uses: actions/cache@v3
65+
uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2
5666
with:
5767
path: build
5868
key: ${{ runner.os }}-cmake-${{ matrix.compiler }}-${{ matrix.cxx_version }}-${{ matrix.target }}

‎.github/workflows/codeql.yml

+78
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
# For most projects, this workflow file will not need changing; you simply need
2+
# to commit it to your repository.
3+
#
4+
# You may wish to alter this file to override the set of languages analyzed,
5+
# or to provide custom queries or build logic.
6+
#
7+
# ******** NOTE ********
8+
# We have attempted to detect the languages in your repository. Please check
9+
# the `language` matrix defined below to confirm you have the correct set of
10+
# supported CodeQL languages.
11+
#
12+
name: "CodeQL"
13+
14+
on:
15+
push:
16+
branches: ["main"]
17+
pull_request:
18+
# The branches below must be a subset of the branches above
19+
branches: ["main"]
20+
schedule:
21+
- cron: "0 0 * * 1"
22+
23+
permissions:
24+
contents: read
25+
26+
jobs:
27+
analyze:
28+
name: Analyze
29+
runs-on: ubuntu-latest
30+
permissions:
31+
actions: read
32+
contents: read
33+
security-events: write
34+
35+
strategy:
36+
fail-fast: false
37+
matrix:
38+
language: ["cpp", "python"]
39+
# CodeQL supports [ $supported-codeql-languages ]
40+
# Learn more about CodeQL language support at https://aka.ms/codeql-docs/language-support
41+
42+
steps:
43+
- name: Harden Runner
44+
uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde # v2.9.1
45+
with:
46+
egress-policy: audit
47+
48+
- name: Checkout repository
49+
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
50+
51+
# Initializes the CodeQL tools for scanning.
52+
- name: Initialize CodeQL
53+
uses: github/codeql-action/init@4dd16135b69a43b6c8efb853346f8437d92d3c93 # v3.26.6
54+
with:
55+
languages: ${{ matrix.language }}
56+
# If you wish to specify custom queries, you can do so here or in a config file.
57+
# By default, queries listed here will override any specified in a config file.
58+
# Prefix the list here with "+" to use these queries and those in the config file.
59+
60+
# Autobuild attempts to build any compiled languages (C/C++, C#, or Java).
61+
# If this step fails, then you should remove it and run the build manually (see below)
62+
- name: Autobuild
63+
uses: github/codeql-action/autobuild@4dd16135b69a43b6c8efb853346f8437d92d3c93 # v3.26.6
64+
65+
# ℹ️ Command-line programs to run using the OS shell.
66+
# 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
67+
68+
# If the Autobuild fails above, remove it and uncomment the following three lines.
69+
# modify them (or add more) to build your code if your project, please refer to the EXAMPLE below for guidance.
70+
71+
# - run: |
72+
# echo "Run, Build Application using script"
73+
# ./location_of_script_within_repo/buildscript.sh
74+
75+
- name: Perform CodeQL Analysis
76+
uses: github/codeql-action/analyze@4dd16135b69a43b6c8efb853346f8437d92d3c93 # v3.26.6
77+
with:
78+
category: "/language:${{matrix.language}}"

‎.github/workflows/dependency-review.yml

+27
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
# Dependency Review Action
2+
#
3+
# This Action will scan dependency manifest files that change as part of a Pull Request,
4+
# surfacing known-vulnerable versions of the packages declared or updated in the PR.
5+
# Once installed, if the workflow run is marked as required,
6+
# PRs introducing known-vulnerable packages will be blocked from merging.
7+
#
8+
# Source repository: https://github.com/actions/dependency-review-action
9+
name: 'Dependency Review'
10+
on: [pull_request]
11+
12+
permissions:
13+
contents: read
14+
15+
jobs:
16+
dependency-review:
17+
runs-on: ubuntu-latest
18+
steps:
19+
- name: Harden Runner
20+
uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde # v2.9.1
21+
with:
22+
egress-policy: audit
23+
24+
- name: 'Checkout Repository'
25+
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
26+
- name: 'Dependency Review'
27+
uses: actions/dependency-review-action@5a2ce3f5b92ee19cbb1541a4984c76d921601d7c # v4.3.4

‎.github/workflows/scorecard.yml

+8-3
Original file line numberDiff line numberDiff line change
@@ -31,14 +31,19 @@ jobs:
3131
# actions: read
3232

3333
steps:
34+
- name: Harden Runner
35+
uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde # v2.9.1
36+
with:
37+
egress-policy: audit
38+
3439
- name: "Checkout code"
3540
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
3641

3742
with:
3843
persist-credentials: false
3944

4045
- name: "Run analysis"
41-
uses: ossf/scorecard-action@0864cf19026789058feabb7e87baa5f140aac736 # v2.3.1
46+
uses: ossf/scorecard-action@62b2cac7ed8198b15735ed49ab1e5cf35480ba46 # v2.4.0
4247
with:
4348
results_file: results.sarif
4449
results_format: sarif
@@ -57,7 +62,7 @@ jobs:
5762
# Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
5863
# format to the repository Actions tab.
5964
- name: "Upload artifact"
60-
uses: actions/upload-artifact@97a0fba1372883ab732affbe8f94b823f91727db # v3.pre.node20
65+
uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4.4.0
6166

6267
with:
6368
name: SARIF file
@@ -67,6 +72,6 @@ jobs:
6772
# Upload the results to GitHub's code scanning dashboard (optional).
6873
# Commenting out will disable upload of results to your repo's Code Scanning dashboard
6974
- name: "Upload to code-scanning"
70-
uses: github/codeql-action/upload-sarif@v3
75+
uses: github/codeql-action/upload-sarif@4dd16135b69a43b6c8efb853346f8437d92d3c93 # v3.26.6
7176
with:
7277
sarif_file: results.sarif

‎.pre-commit-config.yaml

+14
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
repos:
2+
- repo: https://github.com/gitleaks/gitleaks
3+
rev: v8.16.3
4+
hooks:
5+
- id: gitleaks
6+
- repo: https://github.com/pocc/pre-commit-hooks
7+
rev: v1.3.5
8+
hooks:
9+
- id: cpplint
10+
- repo: https://github.com/pre-commit/pre-commit-hooks
11+
rev: v4.4.0
12+
hooks:
13+
- id: end-of-file-fixer
14+
- id: trailing-whitespace

‎SECURITY.md

+39
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
# Security Policy for CCMath
2+
3+
## 1. Introduction
4+
This security policy outlines the procedures and guidelines for reporting vulnerabilities and managing security issues related to the CCMath library. Our commitment is to provide only the essential support necessary to maintain the security of this project.
5+
6+
## 2. Supported Versions
7+
We only support the latest released version of the CCMath library, according to [Semantic Versioning (SemVer)](https://semver.org/). If you are using an older version, we strongly encourage you to upgrade to the latest version to ensure you receive any security updates.
8+
9+
## 3. Reporting a Vulnerability
10+
If you discover a security vulnerability in ccmath, please disclose it responsibly by following these steps:
11+
1. **Contact**: Email the details to ianpike98(at)gmail(dot)com. Please include:
12+
- A detailed description of the vulnerability.
13+
- Steps to reproduce the issue.
14+
- Any potential impact or threat associated with the vulnerability.
15+
2. **Do Not**: Publicly disclose the vulnerability until we have had a chance to address it.
16+
3. **Acknowledgment**: We will acknowledge your report within 7 days and provide an estimated timeline for addressing the vulnerability.
17+
18+
## 4. Response Process
19+
Upon receiving a vulnerability report, we will:
20+
1. **Investigate**: Confirm and reproduce the issue.
21+
2. **Assess**: Evaluate the severity and potential impact.
22+
3. **Mitigate**: Develop and test a fix, if deemed necessary.
23+
4. **Patch**: Release a patch only for the latest version.
24+
5. **Notify**: Inform the reporter once the vulnerability is resolved.
25+
26+
## 5. Public Disclosure
27+
Once the vulnerability is resolved, we will:
28+
- Issue a brief advisory outlining the vulnerability, its impact, and the resolution.
29+
- Credit the individual who reported the vulnerability unless they wish to remain anonymous.
30+
31+
## 6. Security Best Practices
32+
We recommend that users of the CCMath library:
33+
- Keep their CCMath version up to date by always using the latest release.
34+
- Regularly review and apply security patches as they become available.
35+
- Follow secure coding practices when integrating CCMath into their projects.
36+
37+
## 7. Security Contact Information
38+
If you have any questions or need further assistance, please contact us at ianpike98(at)gmail(dot)com.
39+

0 commit comments

Comments
 (0)