Skip to content

Commit 8fb66b8

Browse files
hyperpolymathhyperpolymath
committed
security: standardize secret scanning on TruffleHog
1 parent e4c7fb6 commit 8fb66b8

19 files changed

Lines changed: 184 additions & 497 deletions

‎.github/workflows/boj-build.yml‎

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -6,15 +6,12 @@
66
# To enable: set BOJ_SERVER_URL as a repository secret or variable.
77
# To disable: delete this file or leave BOJ_SERVER_URL unset.
88
name: BoJ Server Build Trigger
9-
109
on:
1110
push:
1211
branches: [main, master]
1312
workflow_dispatch:
14-
1513
permissions:
1614
contents: read
17-
1815
jobs:
1916
trigger-boj:
2017
runs-on: ubuntu-latest
@@ -23,7 +20,6 @@ jobs:
2320
steps:
2421
- name: Checkout
2522
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
26-
2723
- name: Trigger BoJ Server (Casket/ssg-mcp)
2824
env:
2925
BOJ_URL: ${{ secrets.BOJ_SERVER_URL || vars.BOJ_SERVER_URL }}

‎.github/workflows/codeql.yml‎

Lines changed: 0 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,25 +1,21 @@
11
# SPDX-License-Identifier: MPL-2.0
22
name: CodeQL Security Analysis
3-
43
on:
54
push:
65
branches: [main, master]
76
pull_request:
87
branches: [main, master]
98
schedule:
109
- cron: '0 6 * * 1'
11-
1210
# Estate guardrail: cancel superseded runs so re-pushes / rebased PR
1311
# updates do not pile up queued runs against the shared account-wide
1412
# Actions concurrency pool. Applied only to read-only check workflows
1513
# (no publish/mutation), so cancelling a superseded run is always safe.
1614
concurrency:
1715
group: ${{ github.workflow }}-${{ github.ref }}
1816
cancel-in-progress: true
19-
2017
permissions:
2118
contents: read
22-
2319
jobs:
2420
analyze:
2521
runs-on: ubuntu-latest
@@ -33,17 +29,14 @@ jobs:
3329
include:
3430
- language: javascript-typescript
3531
build-mode: none
36-
3732
steps:
3833
- name: Checkout
3934
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
40-
4135
- name: Initialize CodeQL
4236
uses: github/codeql-action/init@c6f931105cb2c34c8f901cc885ba1e2e259cf745 # v3
4337
with:
4438
languages: ${{ matrix.language }}
4539
build-mode: ${{ matrix.build-mode }}
46-
4740
- name: Perform CodeQL Analysis
4841
uses: github/codeql-action/analyze@c6f931105cb2c34c8f901cc885ba1e2e259cf745 # v3
4942
with:

‎.github/workflows/e2e.yml‎

Lines changed: 151 additions & 155 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,6 @@
1313
# Delete sections that don't apply. See examples in each job.
1414

1515
name: E2E + Aspect + Bench
16-
1716
on:
1817
push:
1918
branches: [main, master, develop]
@@ -29,162 +28,159 @@ on:
2928
- 'ffi/**'
3029
- 'tests/**'
3130
workflow_dispatch:
32-
3331
permissions: read-all
34-
3532
concurrency:
3633
group: e2e-${{ github.ref }}
3734
cancel-in-progress: true
38-
3935
jobs:
40-
# ─── End-to-End Tests ──────────────────────────────────────────────
41-
# Uncomment ONE of the following e2e job blocks matching your stack.
42-
43-
## === RUST E2E ===
44-
# e2e:
45-
# name: E2E — Full Pipeline
46-
# runs-on: ubuntu-latest
47-
# timeout-minutes: 15
48-
# steps:
49-
# - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
50-
# - uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7 # stable
51-
# - uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2
52-
# - run: cargo build --release
53-
# - run: bash tests/e2e.sh
54-
# # OR: cargo test --test end_to_end -- --nocapture
55-
56-
## === ZIG FFI E2E ===
57-
# e2e:
58-
# name: E2E — FFI Pipeline
59-
# runs-on: ubuntu-latest
60-
# timeout-minutes: 15
61-
# steps:
62-
# - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
63-
# - uses: goto-bus-stop/setup-zig@7ab2955eb728f5440978d7b4f723a50dea1f3608 # v2
64-
# with:
65-
# version: 0.15.0
66-
# - run: cd ffi/zig && zig build test
67-
# - run: bash tests/e2e.sh
68-
69-
## === ELIXIR E2E ===
70-
# e2e:
71-
# name: E2E — Full Pipeline
72-
# runs-on: ubuntu-latest
73-
# timeout-minutes: 15
74-
# steps:
75-
# - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
76-
# - uses: erlef/setup-beam@5a67e1a1dd86cae5e5bef84e2da5060406a66c07 # v1
77-
# with:
78-
# otp-version: '27.0'
79-
# elixir-version: '1.17'
80-
# - run: mix deps.get && mix compile --warnings-as-errors
81-
# - run: mix test test/integration/e2e_test.exs --trace
82-
83-
## === DENO/RESCRIPT E2E ===
84-
# e2e:
85-
# name: E2E — Full Pipeline
86-
# runs-on: ubuntu-latest
87-
# timeout-minutes: 15
88-
# steps:
89-
# - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
90-
# - uses: denoland/setup-deno@5fae568d37c3b73e0e4ca63d4e2c4e324a2b3497 # v2
91-
# with:
92-
# deno-version: v2.x
93-
# - run: deno install --node-modules-dir=auto
94-
# - run: deno task res:build # ReScript compile
95-
# - run: deno test tests/e2e/
96-
97-
## === PLAYWRIGHT (Browser E2E) ===
98-
# e2e-playwright:
99-
# name: Playwright — ${{ matrix.project }}
100-
# runs-on: ubuntu-latest
101-
# timeout-minutes: 20
102-
# strategy:
103-
# fail-fast: false
104-
# matrix:
105-
# project: [chromium-1080p, firefox-1080p, webkit-1080p]
106-
# steps:
107-
# - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
108-
# - uses: denoland/setup-deno@5fae568d37c3b73e0e4ca63d4e2c4e324a2b3497 # v2
109-
# with:
110-
# deno-version: v2.x
111-
# - run: deno install --node-modules-dir=auto
112-
# - run: npx playwright install --with-deps
113-
# - run: npx playwright test --project=${{ matrix.project }}
114-
# - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
115-
# if: failure()
116-
# with:
117-
# name: playwright-traces-${{ matrix.project }}
118-
# path: test-results/**/trace.zip
119-
# retention-days: 7
120-
121-
## === HASKELL E2E ===
122-
# e2e:
123-
# name: E2E — Full Pipeline
124-
# runs-on: ubuntu-latest
125-
# timeout-minutes: 15
126-
# steps:
127-
# - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
128-
# - uses: haskell-actions/setup@dd344bc1cec854a9b55c2b857c28b688010e4fce # v2
129-
# with:
130-
# ghc-version: '9.6'
131-
# cabal-version: '3.10'
132-
# - run: cabal build all
133-
# - run: bash tests/integration-test.sh
134-
135-
# ─── Aspect Tests ──────────────────────────────────────────────────
136-
# Cross-cutting concerns: thread safety, ABI contracts, SPDX, dangerous patterns
137-
# Uncomment and customise:
138-
139-
# aspect-tests:
140-
# name: Aspect — Architectural Invariants
141-
# runs-on: ubuntu-latest
142-
# timeout-minutes: 10
143-
# steps:
144-
# - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
145-
# - run: bash tests/aspect_tests.sh
146-
147-
# ─── Benchmarks ────────────────────────────────────────────────────
148-
# Performance regression detection. Uncomment matching stack:
149-
150-
## === RUST BENCH ===
151-
# benchmarks:
152-
# name: Bench — Performance Regression
153-
# runs-on: ubuntu-latest
154-
# timeout-minutes: 15
155-
# steps:
156-
# - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
157-
# - uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7 # stable
158-
# - uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2
159-
# - run: cargo bench 2>&1 | tee /tmp/bench-results.txt
160-
# - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
161-
# if: always()
162-
# with:
163-
# name: benchmark-results
164-
# path: /tmp/bench-results.txt
165-
# retention-days: 30
166-
167-
## === ZIG BENCH ===
168-
# benchmarks:
169-
# name: Bench — Performance Regression
170-
# runs-on: ubuntu-latest
171-
# timeout-minutes: 15
172-
# steps:
173-
# - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
174-
# - uses: goto-bus-stop/setup-zig@7ab2955eb728f5440978d7b4f723a50dea1f3608 # v2
175-
# with:
176-
# version: 0.15.0
177-
# - run: cd ffi/zig && zig build bench
178-
179-
# ─── Readiness (CRG) ──────────────────────────────────────────────
180-
# Component Readiness Grade: D (runs) → C (correct) → B (edge cases)
181-
182-
# readiness:
183-
# name: Readiness — Grade D/C/B
184-
# runs-on: ubuntu-latest
185-
# timeout-minutes: 10
186-
# steps:
187-
# - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
188-
# - uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7 # stable
189-
# - uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2
190-
# - run: cargo test --test readiness -- --nocapture
36+
# ─── End-to-End Tests ──────────────────────────────────────────────
37+
# Uncomment ONE of the following e2e job blocks matching your stack.
38+
39+
## === RUST E2E ===
40+
# e2e:
41+
# name: E2E — Full Pipeline
42+
# runs-on: ubuntu-latest
43+
# timeout-minutes: 15
44+
# steps:
45+
# - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
46+
# - uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7 # stable
47+
# - uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2
48+
# - run: cargo build --release
49+
# - run: bash tests/e2e.sh
50+
# # OR: cargo test --test end_to_end -- --nocapture
51+
52+
## === ZIG FFI E2E ===
53+
# e2e:
54+
# name: E2E — FFI Pipeline
55+
# runs-on: ubuntu-latest
56+
# timeout-minutes: 15
57+
# steps:
58+
# - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
59+
# - uses: goto-bus-stop/setup-zig@7ab2955eb728f5440978d7b4f723a50dea1f3608 # v2
60+
# with:
61+
# version: 0.15.0
62+
# - run: cd ffi/zig && zig build test
63+
# - run: bash tests/e2e.sh
64+
65+
## === ELIXIR E2E ===
66+
# e2e:
67+
# name: E2E — Full Pipeline
68+
# runs-on: ubuntu-latest
69+
# timeout-minutes: 15
70+
# steps:
71+
# - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
72+
# - uses: erlef/setup-beam@5a67e1a1dd86cae5e5bef84e2da5060406a66c07 # v1
73+
# with:
74+
# otp-version: '27.0'
75+
# elixir-version: '1.17'
76+
# - run: mix deps.get && mix compile --warnings-as-errors
77+
# - run: mix test test/integration/e2e_test.exs --trace
78+
79+
## === DENO/RESCRIPT E2E ===
80+
# e2e:
81+
# name: E2E — Full Pipeline
82+
# runs-on: ubuntu-latest
83+
# timeout-minutes: 15
84+
# steps:
85+
# - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
86+
# - uses: denoland/setup-deno@5fae568d37c3b73e0e4ca63d4e2c4e324a2b3497 # v2
87+
# with:
88+
# deno-version: v2.x
89+
# - run: deno install --node-modules-dir=auto
90+
# - run: deno task res:build # ReScript compile
91+
# - run: deno test tests/e2e/
92+
93+
## === PLAYWRIGHT (Browser E2E) ===
94+
# e2e-playwright:
95+
# name: Playwright — ${{ matrix.project }}
96+
# runs-on: ubuntu-latest
97+
# timeout-minutes: 20
98+
# strategy:
99+
# fail-fast: false
100+
# matrix:
101+
# project: [chromium-1080p, firefox-1080p, webkit-1080p]
102+
# steps:
103+
# - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
104+
# - uses: denoland/setup-deno@5fae568d37c3b73e0e4ca63d4e2c4e324a2b3497 # v2
105+
# with:
106+
# deno-version: v2.x
107+
# - run: deno install --node-modules-dir=auto
108+
# - run: npx playwright install --with-deps
109+
# - run: npx playwright test --project=${{ matrix.project }}
110+
# - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
111+
# if: failure()
112+
# with:
113+
# name: playwright-traces-${{ matrix.project }}
114+
# path: test-results/**/trace.zip
115+
# retention-days: 7
116+
117+
## === HASKELL E2E ===
118+
# e2e:
119+
# name: E2E — Full Pipeline
120+
# runs-on: ubuntu-latest
121+
# timeout-minutes: 15
122+
# steps:
123+
# - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
124+
# - uses: haskell-actions/setup@dd344bc1cec854a9b55c2b857c28b688010e4fce # v2
125+
# with:
126+
# ghc-version: '9.6'
127+
# cabal-version: '3.10'
128+
# - run: cabal build all
129+
# - run: bash tests/integration-test.sh
130+
131+
# ─── Aspect Tests ──────────────────────────────────────────────────
132+
# Cross-cutting concerns: thread safety, ABI contracts, SPDX, dangerous patterns
133+
# Uncomment and customise:
134+
135+
# aspect-tests:
136+
# name: Aspect — Architectural Invariants
137+
# runs-on: ubuntu-latest
138+
# timeout-minutes: 10
139+
# steps:
140+
# - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
141+
# - run: bash tests/aspect_tests.sh
142+
143+
# ─── Benchmarks ────────────────────────────────────────────────────
144+
# Performance regression detection. Uncomment matching stack:
145+
146+
## === RUST BENCH ===
147+
# benchmarks:
148+
# name: Bench — Performance Regression
149+
# runs-on: ubuntu-latest
150+
# timeout-minutes: 15
151+
# steps:
152+
# - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
153+
# - uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7 # stable
154+
# - uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2
155+
# - run: cargo bench 2>&1 | tee /tmp/bench-results.txt
156+
# - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
157+
# if: always()
158+
# with:
159+
# name: benchmark-results
160+
# path: /tmp/bench-results.txt
161+
# retention-days: 30
162+
163+
## === ZIG BENCH ===
164+
# benchmarks:
165+
# name: Bench — Performance Regression
166+
# runs-on: ubuntu-latest
167+
# timeout-minutes: 15
168+
# steps:
169+
# - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
170+
# - uses: goto-bus-stop/setup-zig@7ab2955eb728f5440978d7b4f723a50dea1f3608 # v2
171+
# with:
172+
# version: 0.15.0
173+
# - run: cd ffi/zig && zig build bench
174+
175+
# ─── Readiness (CRG) ──────────────────────────────────────────────
176+
# Component Readiness Grade: D (runs) → C (correct) → B (edge cases)
177+
178+
# readiness:
179+
# name: Readiness — Grade D/C/B
180+
# runs-on: ubuntu-latest
181+
# timeout-minutes: 10
182+
# steps:
183+
# - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
184+
# - uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7 # stable
185+
# - uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2
186+
# - run: cargo test --test readiness -- --nocapture

0 commit comments

Comments
 (0)