Skip to content

Commit 05d4cd8

Browse files
AlphaOne1AlphaOne1
authored
Merge pull request #155 from AlphaOne1/add_compliance
Add compliance
2 parents ceb196f + 74d4026 commit 05d4cd8

89 files changed

Lines changed: 3482 additions & 1397 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/CODEOWNERS‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
# Copyright the midgard contributors.
1+
# SPDX-FileCopyrightText: 2025 The midgard contributors.
22
# SPDX-License-Identifier: MPL-2.0
33

44
/.github/ @AlphaOne1

‎.github/FUNDING.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,6 @@
1+
# SPDX-FileCopyrightText: 2025 The midgard contributors.
2+
# SPDX-License-Identifier: MPL-2.0
3+
14
# These are supported funding model platforms
25

36
github: [AlphaOne1] # Replace with up to 4 GitHub Sponsors-enabled usernames e.g., [user1, user2]

‎.github/ISSUE_TEMPLATE/bug_report.md‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,7 @@
1+
<!-- SPDX-FileCopyrightText: 2025 The midgard contributors.
2+
SPDX-License-Identifier: MPL-2.0
3+
-->
4+
15
---
26
name: Bug report
37
about: Create a report to help us improve
@@ -14,8 +18,8 @@ A clear and concise description of what the bug is.
1418
Steps to reproduce the behavior:
1519

1620
1. Go to '...'
17-
2. Click on '....'
18-
3. Scroll down to '....'
21+
2. Click on '...'
22+
3. Scroll down to '...'
1923
4. See error
2024

2125
**Expected behavior**

‎.github/ISSUE_TEMPLATE/feature_request.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,7 @@
1+
<!-- SPDX-FileCopyrightText: 2025 The midgard contributors.
2+
SPDX-License-Identifier: MPL-2.0
3+
-->
4+
15
---
26
name: Feature request
37
about: Suggest an idea for this project

‎.github/PULL_REQUEST_TEMPLATE.md‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,7 @@
1+
<!-- SPDX-FileCopyrightText: 2025 The midgard contributors.
2+
SPDX-License-Identifier: MPL-2.0
3+
-->
4+
15
### All Submissions:
26

37
* [ ] Have you followed the guidelines in our Contributing document?
@@ -13,7 +17,7 @@ You can erase any parts of this template not applicable to your Pull Request.
1317

1418
1. [ ] Did you add tests for the new features that cover all major code paths?
1519
2. [ ] Does your submission pass tests?
16-
3. [ ] Have you lint your code locally before submission?
20+
3. [ ] Have you linted your code locally before submission?
1721

1822
**What is the new behavior (if this is a feature change)?**
1923

‎.github/dependabot.yml‎

Lines changed: 1 addition & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,5 @@
1-
# Copyright the midgard contributors.
1+
# SPDX-FileCopyrightText: 2025 The midgard contributors.
22
# SPDX-License-Identifier: MPL-2.0
3-
#
4-
# To get started with Dependabot version updates, you'll need to specify which
5-
# package ecosystems to update and where the package manifests are located.
6-
# Please see the documentation for all configuration options:
7-
# https://help.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
83

94
version: 2
105
updates:

‎.github/workflows/codeql.yml‎

Lines changed: 3 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,17 +1,6 @@
1-
# Copyright the midgard contributors.
1+
# SPDX-FileCopyrightText: 2025 The midgard contributors.
22
# SPDX-License-Identifier: MPL-2.0
3-
#
4-
# For most projects, this workflow file will not need changing; you simply need
5-
# to commit it to your repository.
6-
#
7-
# You may wish to alter this file to override the set of languages analyzed,
8-
# or to provide custom queries or build logic.
9-
#
10-
# ******** NOTE ********
11-
# We have attempted to detect the languages in your repository. Please check
12-
# the `language` matrix defined below to confirm you have the correct set of
13-
# supported CodeQL languages.
14-
#
3+
154
name: "CodeQL"
165

176
on:
@@ -82,7 +71,7 @@ jobs:
8271
# For more details on CodeQL's query packs, refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
8372
# queries: security-extended,security-and-quality
8473

85-
# If the analyze step fails for one of the languages you are analyzing with
74+
# If the analyze-step fails for one of the languages you are analyzing with
8675
# "We were unable to automatically build your code", modify the matrix above
8776
# to set the build mode to "manual" for that language. Then modify this step
8877
# to build your code.

‎.github/workflows/compliance.yml‎

Lines changed: 153 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,153 @@
1+
# SPDX-FileCopyrightText: 2025 The midgard contributors.
2+
# SPDX-License-Identifier: MPL-2.0
3+
4+
name: Compliance Checks
5+
6+
on:
7+
push:
8+
branches:
9+
- master
10+
pull_request:
11+
branches:
12+
- master
13+
14+
concurrency:
15+
group: ${{ github.workflow }}-${{ github.ref }}
16+
cancel-in-progress: true
17+
18+
permissions:
19+
contents: read
20+
21+
jobs:
22+
REUSE:
23+
runs-on: ubuntu-latest
24+
steps:
25+
- name: Harden Runner
26+
uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
27+
with:
28+
egress-policy: audit
29+
30+
- name: Checkout
31+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
32+
with:
33+
fetch-depth: 1
34+
35+
- name: REUSE Compliance Check
36+
uses: fsfe/reuse-action@bb774aa972c2a89ff34781233d275075cbddf542 #v5.0.0
37+
38+
CheckSignedOffCommit:
39+
if: >
40+
github.event_name == 'push' &&
41+
!startsWith(github.actor, 'dependabot') &&
42+
github.event.pusher.name != 'web-flow' &&
43+
github.event.pusher.name != 'github-actions[bot]' &&
44+
github.event.pusher.name != 'github-merge-queue[bot]'
45+
runs-on: ubuntu-latest
46+
permissions:
47+
contents: read
48+
steps:
49+
- name: Harden Runner
50+
uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
51+
with:
52+
egress-policy: audit
53+
54+
- name: Checkout
55+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
56+
with:
57+
fetch-depth: 0
58+
59+
- name: Determine pushed commits
60+
id: range
61+
run: |
62+
set -euo pipefail
63+
64+
# Use GitHub-provided SHAs to build the range for this push
65+
BEFORE="${{ github.event.before }}"
66+
AFTER="${{ github.sha }}"
67+
68+
if [ "$BEFORE" = "0000000000000000000000000000000000000000" ]
69+
then
70+
# New branch or force push without previous SHA
71+
git rev-list --no-merges "$AFTER" > shas.txt
72+
else
73+
git rev-list --no-merges "$BEFORE".."$AFTER" > shas.txt
74+
fi
75+
76+
- name: Check for Signed-off-by
77+
run: |
78+
set -euo pipefail
79+
missing=""
80+
81+
while read -r sha
82+
do
83+
[ -n "$sha" ] || continue
84+
msg=`git log --format=%B -n 1 "$sha"`
85+
86+
if ! printf '%s' "$msg" | grep -Eqi '^[[:space:]]*Signed[- ]off[- ]by:'
87+
then
88+
echo "Commit $sha missing Signed-off-by"
89+
missing="true"
90+
fi
91+
done < shas.txt
92+
93+
if [ "$missing" = "true" ]
94+
then
95+
echo "DCO check failed on push"
96+
exit 1
97+
fi
98+
99+
echo "All pushed commits are signed"
100+
101+
CheckSignedOffPullRequest:
102+
if: github.event_name == 'pull_request' && !contains(github.event.pull_request.labels.*.name, 'bypass-dco')
103+
runs-on: ubuntu-latest
104+
permissions:
105+
contents: read
106+
pull-requests: read
107+
steps:
108+
- name: Harden Runner
109+
uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
110+
with:
111+
egress-policy: audit
112+
113+
- name: Checkout
114+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
115+
with:
116+
fetch-depth: 0
117+
118+
- name: Get PR commits
119+
env:
120+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
121+
run: |
122+
set -euo pipefail
123+
gh --version
124+
jq --version
125+
126+
# Fetch all commits of the PR with pagination and extract SHAs
127+
gh api -H "Accept: application/vnd.github+json" --paginate \
128+
repos/${{ github.repository }}/pulls/${{ github.event.pull_request.number }}/commits \
129+
| jq -r '.[].sha' > shas.txt
130+
131+
- name: Check for Signed-off-by
132+
run: |
133+
set -euo pipefail
134+
missing=""
135+
136+
while read -r sha
137+
do
138+
[ -n "$sha" ] || continue
139+
msg=`git log --format=%B -n 1 "$sha"`
140+
141+
if ! printf '%s' "$msg" | grep -Eqi '^[[:space:]]*Signed[- ]off[- ]by:'
142+
then
143+
echo "Commit $sha missing Signed-off-by"
144+
missing="true"
145+
fi
146+
done < shas.txt
147+
148+
if [ "$missing" = "true" ]
149+
then
150+
echo "DCO check failed"; exit 1
151+
fi
152+
153+
echo "All commits are signed"

‎.github/workflows/dependency-review.yml‎

Lines changed: 3 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,6 @@
1-
# Copyright the midgard contributors.
1+
# SPDX-FileCopyrightText: 2025 The midgard contributors.
22
# SPDX-License-Identifier: MPL-2.0
3-
#
4-
# Dependency Review Action
5-
#
6-
# This Action will scan dependency manifest files that change as part of a Pull Request,
7-
# surfacing known-vulnerable versions of the packages declared or updated in the PR.
8-
# Once installed, if the workflow run is marked as required,
9-
# PRs introducing known-vulnerable packages will be blocked from merging.
10-
#
11-
# Source repository: https://github.com/actions/dependency-review-action
3+
124
name: 'Dependency Review'
135
on: [pull_request]
146

@@ -26,5 +18,6 @@ jobs:
2618

2719
- name: 'Checkout Repository'
2820
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
21+
2922
- name: 'Dependency Review'
3023
uses: actions/dependency-review-action@56339e523c0409420f6c2c9a2f4292bbb3c07dd3 # v4.8.0

‎.github/workflows/release.yml‎

Lines changed: 113 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,113 @@
1+
# SPDX-FileCopyrightText: 2025 The midgard contributors.
2+
# SPDX-License-Identifier: MPL-2.0
3+
4+
name: Release
5+
6+
on:
7+
release:
8+
types:
9+
- published
10+
11+
permissions: read-all
12+
13+
concurrency:
14+
group: release-${{ github.event.release.tag_name }}
15+
cancel-in-progress: true
16+
17+
jobs:
18+
Build:
19+
permissions:
20+
contents: write
21+
runs-on: ubuntu-latest
22+
steps:
23+
- name: Harden Runner
24+
uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
25+
with:
26+
egress-policy: audit
27+
28+
- name: Checkout
29+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
30+
with:
31+
fetch-depth: 0
32+
ref: ${{ github.event.release.tag_name }}
33+
34+
- name: Generate source archive
35+
shell: bash
36+
run: |
37+
set -euo pipefail
38+
39+
TAG=`echo "${{ github.event.release.tag_name }}" | sed 's/\//-/g'`
40+
git archive \
41+
--format=tar.gz \
42+
--prefix="midgard-src-${TAG}/" \
43+
--output="midgard-src-${TAG}.tar.gz" \
44+
"${{ github.event.release.tag_name }}"
45+
46+
- name: Upload Release (via GitHub CLI)
47+
env:
48+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
49+
shell: bash
50+
run: |
51+
set -euo pipefail
52+
gh release upload "${{ github.event.release.tag_name }}" midgard-src-*.tar.gz --clobber
53+
54+
ChecksumReleaseAssets:
55+
needs: Build
56+
runs-on: ubuntu-latest
57+
name: Checksum Release Assets
58+
outputs:
59+
hashBase64File: ${{ steps.hashes.outputs.handle }}
60+
steps:
61+
- name: Harden Runner
62+
uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
63+
with:
64+
egress-policy: audit
65+
66+
- name: Checkout
67+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
68+
with:
69+
fetch-depth: 1
70+
71+
- name: Download all release assets via GitHub CLI
72+
env:
73+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
74+
run: |
75+
set -euo pipefail
76+
77+
mkdir -p release-assets
78+
cd release-assets
79+
# gets all assets of the release
80+
gh release download "${{ github.event.release.tag_name }}" --clobber
81+
echo "Downloaded assets:"
82+
ls -lah
83+
84+
- name: Generate Checksums
85+
working-directory: release-assets
86+
run: |
87+
set -euo pipefail
88+
89+
# Robustly hash all regular files in this directory, then base64 and write via tee.
90+
LC_ALL=C find . -maxdepth 1 -type f -printf '%P\0' \
91+
| sort -z \
92+
| xargs -0 sha256sum -- \
93+
| base64 -w0 \
94+
> check.sha256
95+
96+
- name: Upload Checksums
97+
id: hashes
98+
uses: slsa-framework/slsa-github-generator/actions/generator/generic/create-base64-subjects-from-file@f7dd8c54c2067bafc12ca7a55595d5ee9b75204a # 2.1.0
99+
with:
100+
path: release-assets/check.sha256
101+
102+
AssetProvenance:
103+
permissions:
104+
actions: read # Needed for detection of GitHub Actions environment.
105+
id-token: write # Needed for provenance signing and ID
106+
contents: write # Needed for release uploads
107+
needs: ChecksumReleaseAssets
108+
uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.1.0 #must have semver!
109+
with:
110+
base64-subjects-as-file: |
111+
${{ needs.ChecksumReleaseAssets.outputs.hashBase64File }}
112+
upload-assets: true
113+
upload-tag-name: "${{ github.event.release.tag_name }}"

0 commit comments

Comments
 (0)