Review SCM files and security updates

.github/workflows/codeql.yml

@@ -23,6 +23,8 @@ jobs:
         include:
           - language: actions
             build-mode: none
+          - language: javascript-typescript
+            build-mode: none
     steps:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
 
@@ -40,3 +42,55 @@ jobs:
       - name: Perform Analysis
         uses: github/codeql-action/analyze@662472033e021d55d94146f66f6058822b0b39fd # v3.28.1
         continue-on-error: true
+
+  # PHP-specific security analysis (CodeQL doesn't support PHP natively)
+  php-security:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      security-events: write
+    steps:
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+
+      - name: Setup PHP
+        uses: shivammathur/setup-php@c541c155eee45413f5b09a52248675b1a2575231 # v2.31.1
+        with:
+          php-version: '8.1'
+          tools: composer:v2
+
+      - name: Install dependencies
+        run: composer install --prefer-dist --no-progress
+
+      - name: PHPStan Security Analysis
+        run: |
+          vendor/bin/phpstan analyse src --level=max --error-format=github || true
+
+      - name: PHP Security Audit
+        run: |
+          # Check for dangerous functions in src/
+          echo "=== Checking for dangerous PHP functions ==="
+          DANGEROUS=$(grep -rE '\b(eval|create_function|assert|preg_replace.*\/e|call_user_func|call_user_func_array)\s*\(' --include="*.php" src/ 2>/dev/null || true)
+          if [ -n "$DANGEROUS" ]; then
+            echo "::error::Dangerous PHP functions detected in source code"
+            echo "$DANGEROUS"
+            exit 1
+          fi
+
+          # Check for command injection vectors
+          echo "=== Checking for command injection ==="
+          CMD_INJECT=$(grep -rE '\b(exec|system|passthru|shell_exec|popen|proc_open|pcntl_exec)\s*\(' --include="*.php" src/ 2>/dev/null || true)
+          if [ -n "$CMD_INJECT" ]; then
+            echo "::error::Command execution functions detected - review for injection"
+            echo "$CMD_INJECT"
+            exit 1
+          fi
+
+          # Check for unserialize without allowed_classes
+          echo "=== Checking for unsafe unserialize ==="
+          UNSERIALIZE=$(grep -rE 'unserialize\s*\([^)]*\)' --include="*.php" src/ 2>/dev/null | grep -v 'allowed_classes' || true)
+          if [ -n "$UNSERIALIZE" ]; then
+            echo "::warning::Unserialize without allowed_classes restriction detected"
+            echo "$UNSERIALIZE"
+          fi
+
+          echo "✅ PHP security audit passed"

.github/workflows/quality.yml

@@ -28,7 +28,7 @@ jobs:
       - name: Check TODO/FIXME
         run: |
           echo "=== TODOs ==="
-          grep -rn "TODO\|FIXME\|HACK\|XXX" --include="*.rs" --include="*.res" --include="*.py" --include="*.ex" . | head -20 || echo "None found"
+          grep -rn "TODO\|FIXME\|HACK\|XXX" --include="*.rs" --include="*.res" --include="*.py" --include="*.ex" --include="*.php" . | grep -v 'vendor/' | head -20 || echo "None found"
 
       - name: Check for large files
         run: |

.github/workflows/security-policy.yml

@@ -17,21 +17,21 @@ jobs:
           FAILED=false
 
           # Block MD5/SHA1 for security (allow for checksums/caching)
-          WEAK_CRYPTO=$(grep -rE 'md5\(|sha1\(' --include="*.py" --include="*.rb" --include="*.js" --include="*.ts" --include="*.go" --include="*.rs" . 2>/dev/null | grep -v 'checksum\|cache\|test\|spec' | head -5 || true)
+          WEAK_CRYPTO=$(grep -rE 'md5\(|sha1\(' --include="*.py" --include="*.rb" --include="*.js" --include="*.ts" --include="*.go" --include="*.rs" --include="*.php" . 2>/dev/null | grep -v 'checksum\|cache\|test\|spec\|vendor/' | head -5 || true)
           if [ -n "$WEAK_CRYPTO" ]; then
             echo "⚠️ Weak crypto (MD5/SHA1) detected. Use SHA256+ for security:"
             echo "$WEAK_CRYPTO"
           fi
 
           # Block HTTP URLs (except localhost)
-          HTTP_URLS=$(grep -rE 'http://[^l][^o][^c]' --include="*.py" --include="*.js" --include="*.ts" --include="*.go" --include="*.rs" --include="*.yaml" --include="*.yml" . 2>/dev/null | grep -v 'localhost\|127.0.0.1\|example\|test\|spec' | head -5 || true)
+          HTTP_URLS=$(grep -rE 'http://[^l][^o][^c]' --include="*.py" --include="*.js" --include="*.ts" --include="*.go" --include="*.rs" --include="*.php" --include="*.yaml" --include="*.yml" . 2>/dev/null | grep -v 'localhost\|127.0.0.1\|example\|test\|spec\|vendor/' | head -5 || true)
           if [ -n "$HTTP_URLS" ]; then
             echo "⚠️ HTTP URLs found. Use HTTPS:"
             echo "$HTTP_URLS"
           fi
 
           # Block hardcoded secrets patterns
-          SECRETS=$(grep -rEi '(api_key|apikey|secret_key|password)\s*[=:]\s*["\x27][A-Za-z0-9+/=]{20,}' --include="*.py" --include="*.js" --include="*.ts" --include="*.go" --include="*.rs" --include="*.env" . 2>/dev/null | grep -v 'example\|sample\|test\|mock\|placeholder' | head -3 || true)
+          SECRETS=$(grep -rEi '(api_key|apikey|secret_key|password)\s*[=:]\s*["\x27][A-Za-z0-9+/=]{20,}' --include="*.py" --include="*.js" --include="*.ts" --include="*.go" --include="*.rs" --include="*.php" --include="*.env" . 2>/dev/null | grep -v 'example\|sample\|test\|mock\|placeholder\|vendor/' | head -3 || true)
           if [ -n "$SECRETS" ]; then
             echo "❌ Potential hardcoded secrets detected!"
             FAILED=true

ECOSYSTEM.scm

@@ -6,7 +6,7 @@
   (version "1.0.0")
   (name "php-aegis")
   (type "project")
-  (purpose "image:https://img.shields.io/badge/PHP-8.1+-blue.svg[PHP 8.1+]")
+  (purpose "PHP security and hardening toolkit providing input validation, sanitization, and XSS prevention")
 
   (position-in-ecosystem
     "Part of hyperpolymath ecosystem. Follows RSR guidelines.")
@@ -16,5 +16,5 @@
              (url "https://github.com/hyperpolymath/rhodium-standard-repositories")
              (relationship "standard")))
 
-  (what-this-is "image:https://img.shields.io/badge/PHP-8.1+-blue.svg[PHP 8.1+]")
-  (what-this-is-not "- NOT exempt from RSR compliance"))
+  (what-this-is "A security-focused PHP library for input validation and output sanitization")
+  (what-this-is-not "Not a full framework, authentication system, or ORM. PHP exception under RSR for security tooling."))

META.scm

@@ -10,7 +10,7 @@
      (title . "RSR Compliance")
      (status . "accepted")
      (date . "2025-12-15")
-     (context . "image:https://img.shields.io/badge/PHP-8.1+-blue.svg[PHP 8.1+]")
+     (context . "PHP security library requiring standardized repository structure and CI/CD practices")
      (decision . "Follow Rhodium Standard Repository guidelines")
      (consequences . ("RSR Gold target" "SHA-pinned actions" "SPDX headers" "Multi-platform CI")))))
 

README.adoc

@@ -240,9 +240,9 @@ MIT License - See link:LICENSE.txt[LICENSE.txt] for details.
 
 == Contributing
 
-Contributions welcome! Please read link:CONTRIBUTING.adoc[CONTRIBUTING.adoc] first.
+Contributions welcome! Please read link:CONTRIBUTING.md[CONTRIBUTING.md] first.
 
-For security vulnerabilities, see link:SECURITY.adoc[SECURITY.adoc].
+For security vulnerabilities, see link:SECURITY.md[SECURITY.md].
 
 == RSR Compliance
 

STATE.scm

@@ -3,20 +3,27 @@
 ;; SPDX-FileCopyrightText: 2025 Jonathan D.A. Jewell
 
 (define metadata
-  '((version . "0.1.0") (updated . "2025-12-15") (project . "php-aegis")))
+  '((version . "0.1.0") (updated . "2025-12-17") (project . "php-aegis")))
 
 (define current-position
   '((phase . "v0.1 - Initial Setup")
-    (overall-completion . 25)
-    (components ((rsr-compliance ((status . "complete") (completion . 100)))))))
+    (overall-completion . 35)
+    (components
+      ((rsr-compliance ((status . "complete") (completion . 100)))
+       (ci-cd ((status . "complete") (completion . 100)))
+       (core-library ((status . "in-progress") (completion . 20)))
+       (tests ((status . "pending") (completion . 0)))))))
 
 (define blockers-and-issues '((critical ()) (high-priority ())))
 
 (define critical-next-actions
-  '((immediate (("Verify CI/CD" . high))) (this-week (("Expand tests" . medium)))))
+  '((immediate (("Add PHPUnit tests" . high) ("Add more validators" . medium)))
+    (this-week (("Implement v0.2 validators" . medium)))))
 
 (define session-history
-  '((snapshots ((date . "2025-12-15") (session . "initial") (notes . "SCM files added")))))
+  '((snapshots
+     ((date . "2025-12-15") (session . "initial") (notes . "SCM files added"))
+     ((date . "2025-12-17") (session . "security-review") (notes . "Fixed CI/CD security gaps, updated SCM metadata")))))
 
 (define state-summary
-  '((project . "php-aegis") (completion . 25) (blockers . 0) (updated . "2025-12-15")))
+  '((project . "php-aegis") (completion . 35) (blockers . 0) (updated . "2025-12-17")))