From 6eece898fd96c8d8d1f2ee3cb1e7300729bb71b1 Mon Sep 17 00:00:00 2001 From: Claude Date: Tue, 24 Mar 2026 22:17:56 +0000 Subject: [PATCH 1/3] Add GitHub Actions workflow to run xUnit tests on push/PR Runs the 11 xUnit test files (10 unit + 1 auto-skipped Loki integration) on windows-latest with .NET Framework 4.8. PowerShell integration tests are excluded as they require a live SimHub instance. https://claude.ai/code/session_014u8kocknqoGYTFunJaKUJR --- .github/workflows/test.yml | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) create mode 100644 .github/workflows/test.yml diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml new file mode 100644 index 0000000..04016cb --- /dev/null +++ b/.github/workflows/test.yml @@ -0,0 +1,30 @@ +name: Tests + +on: + push: + branches: ["*"] + pull_request: + branches: [main, master] + +jobs: + test: + runs-on: windows-latest + + steps: + - uses: actions/checkout@v4 + + - name: Restore packages + run: dotnet restore + + - name: Build + run: dotnet build -c Release --no-restore + + - name: Run tests + run: dotnet test -c Release --no-build --logger trx --results-directory TestResults + + - name: Upload test results + uses: actions/upload-artifact@v4 + if: always() + with: + name: test-results + path: TestResults/ From 8b2dbf8ad815a3a44523b5b2b6ea4ccfac6e1c90 Mon Sep 17 00:00:00 2001 From: Claude Date: Tue, 24 Mar 2026 22:25:18 +0000 Subject: [PATCH 2/3] Fix test workflow: target test project explicitly with normal verbosity Running `dotnet test` at solution level may not discover all net48 test assemblies correctly. Target the test project explicitly and increase verbosity to diagnose test count issues. https://claude.ai/code/session_014u8kocknqoGYTFunJaKUJR --- .github/workflows/test.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 04016cb..6d71e54 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -20,7 +20,7 @@ jobs: run: dotnet build -c Release --no-restore - name: Run tests - run: dotnet test -c Release --no-build --logger trx --results-directory TestResults + run: dotnet test src/SimSteward.Plugin.Tests/SimSteward.Plugin.Tests.csproj -c Release --no-build --logger trx --results-directory TestResults -v normal - name: Upload test results uses: actions/upload-artifact@v4 From b1b5d1aa3c20f77a0b30e1369115b78febdeab5b Mon Sep 17 00:00:00 2001 From: Claude Date: Tue, 24 Mar 2026 23:12:34 +0000 Subject: [PATCH 3/3] Add security scanning workflows (CodeQL, Semgrep, Gitleaks, Dependabot) - CodeQL: C# SAST with security-extended queries, runs on push/PR/weekly - Semgrep CE: pattern-based SAST (C#, JS, secrets, OWASP Top 10) - Gitleaks: full git history secret scanning - Dependabot: weekly NuGet, npm, and GitHub Actions version monitoring - All actions SHA-pinned for supply chain safety Excluded Trivy (March 2026 supply chain breach) and Snyk (Jan 2025 incident). https://claude.ai/code/session_014u8kocknqoGYTFunJaKUJR --- .github/dependabot.yml | 32 ++++++++++++++++++ .github/workflows/codeql.yml | 39 ++++++++++++++++++++++ .github/workflows/security-scan.yml | 50 +++++++++++++++++++++++++++++ 3 files changed, 121 insertions(+) create mode 100644 .github/dependabot.yml create mode 100644 .github/workflows/codeql.yml create mode 100644 .github/workflows/security-scan.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..915cd9a --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,32 @@ +version: 2 + +updates: + - package-ecosystem: nuget + directory: / + schedule: + interval: weekly + day: monday + open-pull-requests-limit: 10 + labels: + - dependencies + - security + + - package-ecosystem: npm + directory: / + schedule: + interval: weekly + day: monday + open-pull-requests-limit: 5 + labels: + - dependencies + - security + + - package-ecosystem: github-actions + directory: / + schedule: + interval: weekly + day: monday + open-pull-requests-limit: 5 + labels: + - dependencies + - ci diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml new file mode 100644 index 0000000..dbad03e --- /dev/null +++ b/.github/workflows/codeql.yml @@ -0,0 +1,39 @@ +name: CodeQL + +on: + push: + branches: [main] + pull_request: + branches: [main] + schedule: + - cron: "0 6 * * 1" + +permissions: + security-events: write + contents: read + +jobs: + analyze: + name: CodeQL Analysis + runs-on: windows-latest + + steps: + # actions/checkout@v4 + - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 + + # github/codeql-action/init@v3 + - name: Initialize CodeQL + uses: github/codeql-action/init@480db559a14342288b67e54bd959dd52dc3ee68f + with: + languages: csharp + queries: security-extended + + # github/codeql-action/autobuild@v3 + - name: Autobuild + uses: github/codeql-action/autobuild@480db559a14342288b67e54bd959dd52dc3ee68f + + # github/codeql-action/analyze@v3 + - name: Perform CodeQL Analysis + uses: github/codeql-action/analyze@480db559a14342288b67e54bd959dd52dc3ee68f + with: + category: "/language:csharp" diff --git a/.github/workflows/security-scan.yml b/.github/workflows/security-scan.yml new file mode 100644 index 0000000..0c020f2 --- /dev/null +++ b/.github/workflows/security-scan.yml @@ -0,0 +1,50 @@ +name: Security Scan + +on: + push: + branches: [main] + pull_request: + branches: [main] + +permissions: + contents: read + security-events: write + +jobs: + gitleaks: + name: Secret Scanning + runs-on: ubuntu-latest + + steps: + # actions/checkout@v4 + - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 + with: + fetch-depth: 0 + + # gitleaks/gitleaks-action@v2 + - name: Run Gitleaks + uses: gitleaks/gitleaks-action@dcedce43c6f43de0b836d1fe38946645c9c638dc + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + + semgrep: + name: Semgrep SAST + runs-on: ubuntu-latest + + container: + image: semgrep/semgrep + + steps: + # actions/checkout@v4 + - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 + + - name: Run Semgrep + run: semgrep scan --config "p/csharp" --config "p/secrets" --config "p/owasp-top-ten" --config "p/javascript" --sarif --output semgrep-results.sarif + + # github/codeql-action/upload-sarif@v3 + - name: Upload Semgrep SARIF + uses: github/codeql-action/upload-sarif@480db559a14342288b67e54bd959dd52dc3ee68f + if: always() + with: + sarif_file: semgrep-results.sarif + category: semgrep