diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml new file mode 100644 index 0000000..0250b50 --- /dev/null +++ b/.github/workflows/codeql.yml @@ -0,0 +1,41 @@ +name: CodeQL SAST Security Analysis + +on: + push: + branches: [main] + pull_request: + branches: [main] + schedule: + - cron: '0 6 * * 1' + workflow_dispatch: + +permissions: read-all + +jobs: + analyze: + name: CodeQL Static Application Security Testing (SAST) + runs-on: ubuntu-latest + permissions: + security-events: write + contents: read + actions: read + + strategy: + fail-fast: false + matrix: + language: ['javascript-typescript'] + + steps: + - name: Checkout repository + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + + - name: Initialize CodeQL + uses: github/codeql-action/init@b56ba49b26e50535fa1e7f7db0f4f7b4bf65d80d # v3.28.10 + with: + languages: ${{ matrix.language }} + build-mode: 'none' + + - name: Perform CodeQL Analysis + uses: github/codeql-action/analyze@b56ba49b26e50535fa1e7f7db0f4f7b4bf65d80d # v3.28.10 + with: + category: "/language:${{ matrix.language }}" diff --git a/.github/workflows/generator-generic-ossf-slsa3-publish.yml b/.github/workflows/generator-generic-ossf-slsa3-publish.yml index ccf0cd8..1d44b83 100644 --- a/.github/workflows/generator-generic-ossf-slsa3-publish.yml +++ b/.github/workflows/generator-generic-ossf-slsa3-publish.yml @@ -16,14 +16,18 @@ on: release: types: [created] +permissions: read-all + jobs: build: runs-on: ubuntu-latest + permissions: + contents: read outputs: digests: ${{ steps.hash.outputs.digests }} steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 # ======================================================== # diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml index 6e5439d..d9bebc4 100644 --- a/.github/workflows/pages.yml +++ b/.github/workflows/pages.yml @@ -8,10 +8,7 @@ on: - 'docs/**' workflow_dispatch: -permissions: - contents: read - pages: write - id-token: write +permissions: read-all concurrency: group: 'pages' @@ -23,18 +20,22 @@ jobs: name: github-pages url: ${{ steps.deployment.outputs.page_url }} runs-on: ubuntu-latest + permissions: + contents: read + pages: write + id-token: write steps: - name: Checkout Repository - uses: actions/checkout@v4 + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - name: Setup Pages - uses: actions/configure-pages@v5 + uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b # v5.0.0 - name: Upload artifact - uses: actions/upload-pages-artifact@v3 + uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3.0.1 with: path: 'docs' - name: Deploy to GitHub Pages id: deployment - uses: actions/deploy-pages@v4 + uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4.0.5 diff --git a/.github/workflows/publish-package.yml b/.github/workflows/publish-package.yml index cdad17a..ff2c50c 100644 --- a/.github/workflows/publish-package.yml +++ b/.github/workflows/publish-package.yml @@ -8,6 +8,8 @@ on: - "v[0-9]+.[0-9]+.[0-9]+*" workflow_dispatch: +permissions: read-all + jobs: publish-gpr: name: Publish to GitHub Packages @@ -16,23 +18,29 @@ jobs: contents: read packages: write steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + + - name: Install pnpm + uses: pnpm/action-setup@fe02b34f77f8bc703788d5817da081398fad5dd2 # v4.0.0 + with: + version: 9 - name: Setup Node.js - uses: actions/setup-node@v4 + uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a # v4.2.0 with: node-version: 22 registry-url: "https://npm.pkg.github.com" scope: "@ritualdev-lab" + cache: "pnpm" - name: Install dependencies - run: npm ci || npm install + run: pnpm install --frozen-lockfile - name: Run Tests - run: npm test + run: pnpm test - name: Build mcp-builder-kit - run: npm run build + run: pnpm run build - name: Publish to GitHub Packages continue-on-error: true @@ -53,25 +61,31 @@ jobs: id-token: write attestations: write steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + + - name: Install pnpm + uses: pnpm/action-setup@fe02b34f77f8bc703788d5817da081398fad5dd2 # v4.0.0 + with: + version: 9 - name: Setup Node.js - uses: actions/setup-node@v4 + uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a # v4.2.0 with: node-version: 22 registry-url: "https://registry.npmjs.org" + cache: "pnpm" - name: Install dependencies - run: npm ci || npm install + run: pnpm install --frozen-lockfile - name: Run Test Suite - run: npm test + run: pnpm test - name: Build mcp-builder-kit - run: npm run build + run: pnpm run build - name: Generate SLSA Build Provenance Attestation - uses: actions/attest-build-provenance@v1 + uses: actions/attest-build-provenance@c074443f1aee8d4aeeae555aebba3282517141b2 # v2.2.3 with: subject-path: 'dist/**' diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index b3f24c1..ad02354 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -19,18 +19,24 @@ jobs: matrix: node-version: [20, 22, 24] steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + + - name: Install pnpm + uses: pnpm/action-setup@fe02b34f77f8bc703788d5817da081398fad5dd2 # v4.0.0 + with: + version: 9 - name: Setup Node.js ${{ matrix.node-version }} - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.0.0 + uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a # v4.2.0 with: node-version: ${{ matrix.node-version }} + cache: "pnpm" - name: Install dependencies - run: npm ci || npm install + run: pnpm install --frozen-lockfile - name: Run Test Suite - run: npm test + run: pnpm test build-and-attest: name: Build, SLSA Provenance & SBOM @@ -41,21 +47,27 @@ jobs: id-token: write attestations: write steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + + - name: Install pnpm + uses: pnpm/action-setup@fe02b34f77f8bc703788d5817da081398fad5dd2 # v4.0.0 + with: + version: 9 - name: Setup Node.js 22 - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.0.0 + uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a # v4.2.0 with: node-version: 22 + cache: "pnpm" - name: Install dependencies - run: npm ci || npm install + run: pnpm install --frozen-lockfile - name: Build Package - run: npm run build + run: pnpm run build - name: Generate SLSA Build Provenance Attestation - uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.0.0 + uses: actions/attest-build-provenance@c074443f1aee8d4aeeae555aebba3282517141b2 # v2.2.3 with: subject-path: 'dist/**' @@ -80,7 +92,7 @@ jobs: upload-release-assets: false - name: Upload Build & SBOM Artifacts - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.0 + uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1 with: name: dist-artifacts path: dist/ @@ -91,21 +103,21 @@ jobs: needs: [build-and-attest] runs-on: ubuntu-latest permissions: - contents: write + contents: read packages: write id-token: write attestations: write steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - name: Setup Node.js 22 - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.0.0 + uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a # v4.2.0 with: node-version: 22 registry-url: 'https://registry.npmjs.org' - name: Download Build Artifacts - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.0 + uses: actions/download-artifact@cc203385981b70ca67e1cc392babf9cc229d5806 # v4.1.9 with: name: dist-artifacts path: dist/ @@ -122,14 +134,3 @@ jobs: npm publish --provenance=false env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - - - name: Attach SBOM Assets to GitHub Release - if: startsWith(github.ref, 'refs/tags/v') - uses: softprops/action-gh-release@c062e08bd5328157348241fa0833b7d8b97943b7 # v2.0.8 - with: - generate_release_notes: true - files: | - dist/mcp-builder-kit-cyclonedx.sbom.json - dist/mcp-builder-kit-spdx.sbom.json - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index ef6a040..653234a 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -22,18 +22,18 @@ jobs: steps: - name: Checkout Code - uses: actions/checkout@v4 + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 with: persist-credentials: false - name: Run OpenSSF Scorecard - uses: ossf/scorecard-action@v2.4.1 + uses: ossf/scorecard-action@f49aabe0b5af0936a0987cfb85d86b75731b0186 # v2.4.1 with: results_file: results.sarif results_format: sarif publish_results: true - name: Upload SARIF to GitHub Code Scanning - uses: github/codeql-action/upload-sarif@v3 + uses: github/codeql-action/upload-sarif@b56ba49b26e50535fa1e7f7db0f4f7b4bf65d80d # v3.28.10 with: sarif_file: results.sarif diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index d6aacf4..6652c2f 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -6,13 +6,14 @@ on: pull_request: branches: [main] -permissions: - contents: read +permissions: read-all jobs: test: name: Test (Node ${{ matrix.node }} on ${{ matrix.os }}) runs-on: ${{ matrix.os }} + permissions: + contents: read strategy: fail-fast: false matrix: @@ -23,21 +24,21 @@ jobs: - name: Configure Git line endings run: git config --global core.autocrlf false - - uses: actions/checkout@v4 + - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - name: Install pnpm - uses: pnpm/action-setup@v4 + uses: pnpm/action-setup@fe02b34f77f8bc703788d5817da081398fad5dd2 # v4.0.0 with: version: 9 - name: Setup Node.js ${{ matrix.node }} - uses: actions/setup-node@v4 + uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a # v4.2.0 with: node-version: ${{ matrix.node }} cache: "pnpm" - name: Setup Python - uses: actions/setup-python@v5 + uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0 with: python-version: "3.12" diff --git a/.github/workflows/welcome-contributor.yml b/.github/workflows/welcome-contributor.yml index a051fbe..d82f90e 100644 --- a/.github/workflows/welcome-contributor.yml +++ b/.github/workflows/welcome-contributor.yml @@ -6,18 +6,19 @@ on: issues: types: [opened] -permissions: - pull-requests: write - issues: write +permissions: read-all jobs: welcome-contributor: name: Welcome Contributor & Triage runs-on: ubuntu-latest + permissions: + pull-requests: write + issues: write steps: - name: Welcome Pull Request Contributor if: github.event_name == 'pull_request_target' - uses: actions/github-script@v7 + uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1 with: script: | const pr = context.payload.pull_request; @@ -47,7 +48,7 @@ jobs: - name: Welcome Issue Author if: github.event_name == 'issues' - uses: actions/github-script@v7 + uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1 with: script: | const issue = context.payload.issue; diff --git a/osv-scanner.toml b/osv-scanner.toml new file mode 100644 index 0000000..f10f84d --- /dev/null +++ b/osv-scanner.toml @@ -0,0 +1,10 @@ +# OpenSSF OSV-Scanner Configuration for mcp-builder-kit +# See: https://google.github.io/osv-scanner/configuration/ + +[[IgnoredVulns]] +id = "GHSA-g7r4-m6w7-qqqr" +reason = "Dev dependency esbuild (bundled with tsup) is used exclusively during offline build/transpilation, not as a Windows development HTTP file server with servedir." + +[[IgnoredVulns]] +id = "GHSA-mrhx-c7xc-m3w5" +reason = "Zod unbounded error accumulation vulnerability is not applicable to local CLI scaffolding inputs where array schemas have bounded inputs."