Skip to content

Commit 74d6bc2

Browse files
hyperpolymathclaude
hyperpolymath
and
claude
committed
feat: mass-panic imaging/temporal modules, Chapel integration, 4 RSR workflows
- Add src/mass_panic/ with imaging.rs (SystemImage) and temporal.rs (TemporalDiff) - Add Chapel Imaging.chpl and Temporal.chpl for distributed analysis - Wire mass-panic subcommands into CLI (image, temporal, mass-panic) - Add guix-nix-policy, release, secret-scanner, workflow-linter workflows - Update STATE.scm, TOPOLOGY.md, ROADMAP.md, README.md with new modules - Add egui/eframe 0.27 dependency for GUI report viewer Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
1 parent 62e5acc commit 74d6bc2

22 files changed

Lines changed: 2661 additions & 56 deletions

‎.github/workflows/guix-nix-policy.yml‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
# SPDX-License-Identifier: PMPL-1.0-or-later
2+
name: Guix/Nix Package Policy
3+
on: [push, pull_request]
4+
5+
permissions: read-all
6+
7+
jobs:
8+
check:
9+
runs-on: ubuntu-latest
10+
permissions:
11+
contents: read
12+
steps:
13+
- uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
14+
- name: Enforce Guix primary / Nix fallback
15+
run: |
16+
HAS_GUIX=$(find . -name "*.scm" -o -name ".guix-channel" -o -name "guix.scm" 2>/dev/null | head -1)
17+
HAS_NIX=$(find . -name "*.nix" 2>/dev/null | head -1)
18+
19+
NEW_LOCKS=$(git diff --name-only --diff-filter=A HEAD~1 2>/dev/null | grep -E 'package-lock\.json|yarn\.lock|Gemfile\.lock|Pipfile\.lock|poetry\.lock|cargo\.lock' || true)
20+
if [ -n "$NEW_LOCKS" ]; then
21+
echo "Lock files detected. Prefer Guix manifests for reproducibility."
22+
fi
23+
24+
if [ -n "$HAS_GUIX" ]; then
25+
echo "Guix package management detected (primary)"
26+
elif [ -n "$HAS_NIX" ]; then
27+
echo "Nix package management detected (fallback)"
28+
else
29+
echo "Consider adding guix.scm or flake.nix for reproducible builds"
30+
fi
31+
32+
echo "Package policy check passed"

‎.github/workflows/release.yml‎

Lines changed: 148 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,148 @@
1+
# SPDX-License-Identifier: PMPL-1.0-or-later
2+
# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
3+
#
4+
# Release workflow — triggered by version tags (v*).
5+
# Builds release binary for Linux x86_64, generates changelog via git-cliff,
6+
# creates a GitHub Release with the binary attached, and produces SLSA provenance.
7+
name: Release
8+
9+
on:
10+
push:
11+
tags:
12+
- 'v*'
13+
14+
permissions: read-all
15+
16+
jobs:
17+
build:
18+
name: Build Release Binary
19+
runs-on: ubuntu-latest
20+
permissions:
21+
contents: read
22+
outputs:
23+
hashes: ${{ steps.hash.outputs.hashes }}
24+
steps:
25+
- uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
26+
27+
- name: Install Rust toolchain
28+
uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7 # stable
29+
with:
30+
toolchain: stable
31+
32+
- name: Cache cargo registry
33+
uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2
34+
35+
- name: Run tests
36+
run: cargo test --verbose
37+
38+
- name: Build release binary
39+
run: cargo build --release --verbose
40+
41+
- name: Build release binary with http feature
42+
run: cargo build --release --features http --verbose
43+
44+
- name: Package release artifacts
45+
run: |
46+
mkdir -p dist
47+
cp target/release/panic-attack dist/panic-attack-linux-x86_64
48+
strip dist/panic-attack-linux-x86_64
49+
chmod +x dist/panic-attack-linux-x86_64
50+
# Create tarball
51+
tar -czf dist/panic-attack-${GITHUB_REF_NAME}-linux-x86_64.tar.gz \
52+
-C dist panic-attack-linux-x86_64 \
53+
-C "${GITHUB_WORKSPACE}" LICENSE README.md ROADMAP.md SECURITY.md
54+
55+
- name: Generate artifact hashes
56+
id: hash
57+
run: |
58+
cd dist
59+
HASHES=$(sha256sum panic-attack-*.tar.gz | base64 -w0)
60+
echo "hashes=$HASHES" >> "$GITHUB_OUTPUT"
61+
62+
- name: Upload build artifacts
63+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
64+
with:
65+
name: release-artifacts
66+
path: dist/panic-attack-*.tar.gz
67+
retention-days: 5
68+
69+
changelog:
70+
name: Generate Changelog
71+
runs-on: ubuntu-latest
72+
permissions:
73+
contents: read
74+
outputs:
75+
changelog: ${{ steps.cliff.outputs.content }}
76+
version: ${{ steps.version.outputs.version }}
77+
steps:
78+
- uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
79+
with:
80+
fetch-depth: 0
81+
82+
- name: Extract version from tag
83+
id: version
84+
run: echo "version=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT"
85+
86+
- name: Install git-cliff
87+
run: |
88+
curl -sSfL https://github.com/orhun/git-cliff/releases/latest/download/git-cliff-$(uname -m)-unknown-linux-gnu.tar.gz \
89+
| tar -xz --strip-components=1 -C /usr/local/bin/ git-cliff-*/git-cliff
90+
91+
- name: Generate changelog for this release
92+
id: cliff
93+
run: |
94+
CHANGELOG=$(git cliff --latest --strip header)
95+
{
96+
echo "content<<CLIFF_EOF"
97+
echo "$CHANGELOG"
98+
echo "CLIFF_EOF"
99+
} >> "$GITHUB_OUTPUT"
100+
101+
- name: Update full CHANGELOG.md
102+
run: |
103+
git cliff --output CHANGELOG.md
104+
105+
- name: Upload updated CHANGELOG.md
106+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
107+
with:
108+
name: changelog
109+
path: CHANGELOG.md
110+
retention-days: 5
111+
112+
release:
113+
name: Create GitHub Release
114+
needs: [build, changelog]
115+
runs-on: ubuntu-latest
116+
permissions:
117+
contents: write
118+
steps:
119+
- uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
120+
121+
- name: Download build artifacts
122+
uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
123+
with:
124+
name: release-artifacts
125+
path: artifacts/
126+
127+
- name: Create GitHub Release
128+
uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b # v2
129+
with:
130+
body: ${{ needs.changelog.outputs.changelog }}
131+
draft: false
132+
prerelease: ${{ contains(github.ref_name, '-rc') || contains(github.ref_name, '-beta') || contains(github.ref_name, '-alpha') }}
133+
generate_release_notes: false
134+
files: |
135+
artifacts/*
136+
env:
137+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
138+
139+
provenance:
140+
name: SLSA Provenance
141+
needs: [build]
142+
permissions:
143+
actions: read
144+
id-token: write
145+
contents: write
146+
uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@f7dd8c54c2067bafc12ca7a55595d5ee9b75204a # v2.1.0
147+
with:
148+
base64-subjects: ${{ needs.build.outputs.hashes }}

‎.github/workflows/secret-scanner.yml‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
# SPDX-License-Identifier: PMPL-1.0-or-later
2+
# Prevention workflow - scans for hardcoded secrets before they reach main
3+
name: Secret Scanner
4+
5+
on:
6+
pull_request:
7+
push:
8+
branches: [main]
9+
10+
permissions: read-all
11+
12+
jobs:
13+
trufflehog:
14+
runs-on: ubuntu-latest
15+
steps:
16+
- uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
17+
with:
18+
fetch-depth: 0
19+
20+
- name: TruffleHog Secret Scan
21+
uses: trufflesecurity/trufflehog@7ee2e0fdffec27d19ccbb8fb3dcf8a83b9d7f9e8 # main
22+
with:
23+
extra_args: --only-verified --fail
24+
25+
rust-secrets:
26+
runs-on: ubuntu-latest
27+
steps:
28+
- uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
29+
30+
- name: Check for hardcoded secrets in Rust
31+
run: |
32+
PATTERNS=(
33+
'const.*SECRET.*=.*"'
34+
'const.*KEY.*=.*"[a-zA-Z0-9]{16,}"'
35+
'const.*TOKEN.*=.*"'
36+
'let.*api_key.*=.*"'
37+
'HMAC.*"[a-fA-F0-9]{32,}"'
38+
'password.*=.*"[^"]+"'
39+
)
40+
41+
found=0
42+
for pattern in "${PATTERNS[@]}"; do
43+
if grep -rn --include="*.rs" -E "$pattern" src/; then
44+
echo "WARNING: Potential hardcoded secret found matching: $pattern"
45+
found=1
46+
fi
47+
done
48+
49+
if [ $found -eq 1 ]; then
50+
echo "::error::Potential hardcoded secrets detected. Use environment variables instead."
51+
exit 1
52+
fi

‎.github/workflows/workflow-linter.yml‎

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
# SPDX-License-Identifier: PMPL-1.0-or-later
2+
# Validates GitHub workflows against RSR security standards
3+
name: Workflow Security Linter
4+
5+
on:
6+
push:
7+
paths:
8+
- '.github/workflows/**'
9+
pull_request:
10+
paths:
11+
- '.github/workflows/**'
12+
workflow_dispatch:
13+
14+
permissions: read-all
15+
16+
jobs:
17+
lint-workflows:
18+
runs-on: ubuntu-latest
19+
permissions:
20+
contents: read
21+
22+
steps:
23+
- name: Checkout
24+
uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
25+
26+
- name: Check SPDX Headers
27+
run: |
28+
echo "=== Checking SPDX License Headers ==="
29+
failed=0
30+
for file in .github/workflows/*.yml .github/workflows/*.yaml; do
31+
[ -f "$file" ] || continue
32+
if ! head -1 "$file" | grep -q "^# SPDX-License-Identifier:"; then
33+
echo "ERROR: $file missing SPDX header"
34+
failed=1
35+
fi
36+
done
37+
if [ $failed -eq 1 ]; then
38+
echo "Add '# SPDX-License-Identifier: PMPL-1.0-or-later' as first line"
39+
exit 1
40+
fi
41+
echo "All workflows have SPDX headers"
42+
43+
- name: Check Permissions Declaration
44+
run: |
45+
echo "=== Checking Permissions ==="
46+
failed=0
47+
for file in .github/workflows/*.yml .github/workflows/*.yaml; do
48+
[ -f "$file" ] || continue
49+
if ! grep -q "^permissions:" "$file"; then
50+
echo "ERROR: $file missing top-level 'permissions:' declaration"
51+
failed=1
52+
fi
53+
done
54+
if [ $failed -eq 1 ]; then
55+
echo "Add 'permissions: read-all' at workflow level"
56+
exit 1
57+
fi
58+
echo "All workflows have permissions declared"
59+
60+
- name: Check SHA-Pinned Actions
61+
run: |
62+
echo "=== Checking Action Pinning ==="
63+
unpinned=$(grep -rn "uses:" .github/workflows/ | \
64+
grep -v "@[a-f0-9]\{40\}" | \
65+
grep -v "uses: \./\|uses: docker://\|uses: actions/github-script" || true)
66+
67+
if [ -n "$unpinned" ]; then
68+
echo "ERROR: Found unpinned actions:"
69+
echo "$unpinned"
70+
exit 1
71+
fi
72+
echo "All actions are SHA-pinned"
73+
74+
- name: Summary
75+
run: |
76+
echo ""
77+
echo "=== Workflow Linter Summary ==="
78+
echo "All critical checks passed."

0 commit comments

Comments
 (0)