From c7fc2b832d7db82c91e0bacbb4fd6a1ff6f14935 Mon Sep 17 00:00:00 2001 From: Antigravity Agent Date: Mon, 10 Aug 2026 17:25:55 +0700 Subject: [PATCH] chore: repository hygiene and security improvements --- .github/ISSUE_TEMPLATE/bug_report.md | 31 +++++++ .github/ISSUE_TEMPLATE/feature_request.md | 20 +++++ .github/PULL_REQUEST_TEMPLATE.md | 33 +++++++ .github/dependabot.yml | 13 +++ .github/workflows/linux-control-agent.yml | 4 +- .github/workflows/linux-platform-matrix.yml | 14 +-- .github/workflows/linux-release.yml | 27 ++++-- .github/workflows/windows-build.yml | 6 +- .github/workflows/windows-release.yml | 21 +++-- CHANGELOG.md | 95 +++++++++++++++++++++ CODEOWNERS | 1 + CONTRIBUTING.md | 27 ++++++ SECURITY.md | 52 +++++++++++ 13 files changed, 318 insertions(+), 26 deletions(-) create mode 100644 .github/ISSUE_TEMPLATE/bug_report.md create mode 100644 .github/ISSUE_TEMPLATE/feature_request.md create mode 100644 .github/PULL_REQUEST_TEMPLATE.md create mode 100644 .github/dependabot.yml create mode 100644 CHANGELOG.md create mode 100644 CODEOWNERS create mode 100644 CONTRIBUTING.md create mode 100644 SECURITY.md diff --git a/.github/ISSUE_TEMPLATE/bug_report.md b/.github/ISSUE_TEMPLATE/bug_report.md new file mode 100644 index 0000000..483760e --- /dev/null +++ b/.github/ISSUE_TEMPLATE/bug_report.md @@ -0,0 +1,31 @@ +--- +name: Bug report +about: Create a report to help us improve +title: '' +labels: '' +assignees: '' + +--- + +**Describe the bug** +A clear and concise description of what the bug is. + +**To Reproduce** +Steps to reproduce the behavior: +1. Go to '...' +2. Click on '....' +3. Scroll down to '....' +4. See error + +**Expected behavior** +A clear and concise description of what you expected to happen. + +**Screenshots** +If applicable, add screenshots to help explain your problem. + +**Environment (please complete the following information):** + - OS: [e.g. Windows] + - Version [e.g. 22] + +**Additional context** +Add any other context about the problem here. diff --git a/.github/ISSUE_TEMPLATE/feature_request.md b/.github/ISSUE_TEMPLATE/feature_request.md new file mode 100644 index 0000000..bbcbbe7 --- /dev/null +++ b/.github/ISSUE_TEMPLATE/feature_request.md @@ -0,0 +1,20 @@ +--- +name: Feature request +about: Suggest an idea for this project +title: '' +labels: '' +assignees: '' + +--- + +**Is your feature request related to a problem? Please describe.** +A clear and concise description of what the problem is. Ex. I'm always frustrated when [...] + +**Describe the solution you'd like** +A clear and concise description of what you want to happen. + +**Describe alternatives you've considered** +A clear and concise description of any alternative solutions or features you've considered. + +**Additional context** +Add any other context or screenshots about the feature request here. diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md new file mode 100644 index 0000000..d77d319 --- /dev/null +++ b/.github/PULL_REQUEST_TEMPLATE.md @@ -0,0 +1,33 @@ +## Description + +Please include a summary of the change and which issue is fixed. Please also include relevant motivation and context. + +Fixes # (issue) + +## Type of change + +Please delete options that are not relevant. + +- [ ] Bug fix (non-breaking change which fixes an issue) +- [ ] New feature (non-breaking change which adds functionality) +- [ ] Breaking change (fix or feature that would cause existing functionality to not work as expected) +- [ ] This change requires a documentation update + +## Testing Checklist + +Please specify what was verified and how. + +### Verified Locally +- [ ] What was checked locally: + - + +### Verified in CI +- [ ] What was checked via CI (include links to test runs if applicable): + - + +### Not Verified +- [ ] What was NOT checked, and why: + - + +## Additional Notes +Add any other notes about the PR here. diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..75c979a --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,13 @@ +version: 2 +updates: + - package-ecosystem: "github-actions" + directory: "/" + schedule: + interval: "weekly" + open-pull-requests-limit: 5 + + - package-ecosystem: "nuget" + directory: "/" + schedule: + interval: "weekly" + open-pull-requests-limit: 5 diff --git a/.github/workflows/linux-control-agent.yml b/.github/workflows/linux-control-agent.yml index c157dde..aa4032e 100644 --- a/.github/workflows/linux-control-agent.yml +++ b/.github/workflows/linux-control-agent.yml @@ -13,10 +13,10 @@ jobs: runs-on: ubuntu-24.04 steps: - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 - name: Set up .NET 10 - uses: actions/setup-dotnet@v5 + uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5 with: dotnet-version: 10.0.x diff --git a/.github/workflows/linux-platform-matrix.yml b/.github/workflows/linux-platform-matrix.yml index b018276..810fdd5 100644 --- a/.github/workflows/linux-platform-matrix.yml +++ b/.github/workflows/linux-platform-matrix.yml @@ -36,10 +36,10 @@ jobs: runtime: [linux-x64, linux-arm64] steps: - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 - name: Set up .NET 10 - uses: actions/setup-dotnet@v5 + uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5 with: dotnet-version: 10.0.x @@ -68,7 +68,7 @@ jobs: sha256sum "$archive" >"$archive.sha256" - name: Upload release archive - uses: actions/upload-artifact@v6 + uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6 with: name: server-monitor-manager-${{ matrix.runtime }}-matrix path: | @@ -97,10 +97,10 @@ jobs: runs-on: ${{ matrix.runner }} steps: - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 - name: Download release archive - uses: actions/download-artifact@v8 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8 with: name: server-monitor-manager-${{ matrix.runtime }}-matrix path: artifacts @@ -137,10 +137,10 @@ jobs: runs-on: ${{ matrix.runner }} steps: - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 - name: Download release archive - uses: actions/download-artifact@v8 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8 with: name: server-monitor-manager-${{ matrix.runtime }}-matrix path: artifacts diff --git a/.github/workflows/linux-release.yml b/.github/workflows/linux-release.yml index e8b263a..3880c39 100644 --- a/.github/workflows/linux-release.yml +++ b/.github/workflows/linux-release.yml @@ -7,14 +7,16 @@ on: - 'v*' permissions: - contents: write + contents: read jobs: bootstrap: + permissions: + contents: write runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 - name: Validate bootstrap run: | @@ -46,7 +48,7 @@ jobs: > server-monitor-manager-bootstrap-manifest.json - name: Upload bootstrap artifact - uses: actions/upload-artifact@v6 + uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6 with: name: server-monitor-manager-bootstrap path: | @@ -56,7 +58,7 @@ jobs: - name: Attach bootstrap to GitHub Release if: startsWith(github.ref, 'refs/tags/') - uses: softprops/action-gh-release@v2 + uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2 with: prerelease: ${{ contains(github.ref_name, '-') }} files: | @@ -65,16 +67,18 @@ jobs: server-monitor-manager-bootstrap-manifest.json publish: + permissions: + contents: write runs-on: ubuntu-latest strategy: matrix: runtime: [linux-x64, linux-arm64] steps: - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 - name: Set up .NET 10 - uses: actions/setup-dotnet@v5 + uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5 with: dotnet-version: 10.0.x @@ -87,6 +91,11 @@ jobs: - name: Publish provisioning helper run: dotnet publish src/ServerMonitorManager.Provisioning.Helper/ServerMonitorManager.Provisioning.Helper.csproj --configuration Release --runtime ${{ matrix.runtime }} --self-contained true -p:PublishSingleFile=true -p:PublishTrimmed=true -o out/provisioning-helper + - name: Generate SBOM + run: | + dotnet tool install --global CycloneDX + dotnet cyclonedx ServerMonitorManager.slnx -o out/sbom + - name: Package shell: bash run: | @@ -100,11 +109,11 @@ jobs: install -m 0755 deploy/ochenstarik-smm-emergency out/deploy/ install -m 0755 deploy/ochenstarik-server-monitor-manager.sh out/bootstrap/ archive="server-monitor-manager-${{ matrix.runtime }}.tar.gz" - tar -C out -czf "$archive" agent control provisioning-helper deploy bootstrap + tar -C out -czf "$archive" agent control provisioning-helper deploy bootstrap sbom sha256sum "$archive" > "$archive.sha256" - name: Upload artifact - uses: actions/upload-artifact@v6 + uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6 with: name: server-monitor-manager-${{ matrix.runtime }} path: | @@ -113,7 +122,7 @@ jobs: - name: Attach to GitHub Release if: startsWith(github.ref, 'refs/tags/') - uses: softprops/action-gh-release@v2 + uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2 with: prerelease: ${{ contains(github.ref_name, '-') }} files: | diff --git a/.github/workflows/windows-build.yml b/.github/workflows/windows-build.yml index 83f117a..c791e73 100644 --- a/.github/workflows/windows-build.yml +++ b/.github/workflows/windows-build.yml @@ -13,10 +13,10 @@ jobs: runs-on: windows-latest steps: - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 - name: Set up .NET 10 - uses: actions/setup-dotnet@v5 + uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5 with: dotnet-version: 10.0.x @@ -51,7 +51,7 @@ jobs: -Destination artifacts/windows-installer/ServerMonitorManager-test-signing.cer - name: Upload test installer - uses: actions/upload-artifact@v6 + uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6 with: name: ServerMonitorManager-win-x64-test path: | diff --git a/.github/workflows/windows-release.yml b/.github/workflows/windows-release.yml index 5cfdeaa..643e661 100644 --- a/.github/workflows/windows-release.yml +++ b/.github/workflows/windows-release.yml @@ -7,20 +7,22 @@ on: - 'v*' permissions: - contents: write + contents: read jobs: package: + permissions: + contents: write runs-on: windows-latest env: SIGNING_CERTIFICATE_BASE64: ${{ secrets.WINDOWS_SIGNING_CERTIFICATE_BASE64 }} SIGNING_CERTIFICATE_PASSWORD: ${{ secrets.WINDOWS_SIGNING_CERTIFICATE_PASSWORD }} steps: - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 - name: Set up .NET 10 - uses: actions/setup-dotnet@v5 + uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5 with: dotnet-version: 10.0.x @@ -56,6 +58,12 @@ jobs: shell: pwsh run: Copy-Item -LiteralPath '${{ steps.signing.outputs.public_certificate }}' -Destination artifacts/windows-installer/ServerMonitorManager-test-signing.cer + - name: Generate SBOM + shell: pwsh + run: | + dotnet tool install --global CycloneDX + dotnet cyclonedx ServerMonitorManager.slnx -o artifacts/windows-installer/sbom + - name: Verify checksum shell: pwsh run: | @@ -65,21 +73,24 @@ jobs: if ($actual -ne $expected) { throw 'Windows installer checksum mismatch.' } - name: Upload installer artifact - uses: actions/upload-artifact@v6 + uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6 with: name: ServerMonitorManager-win-x64 path: | artifacts/windows-installer/ServerMonitorManager-win-x64.msix artifacts/windows-installer/ServerMonitorManager-test-signing.cer artifacts/windows-installer/SHA256SUMS + artifacts/windows-installer/sbom if-no-files-found: error - name: Attach installer to GitHub Release if: startsWith(github.ref, 'refs/tags/') - uses: softprops/action-gh-release@v2 + uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2 with: prerelease: ${{ contains(github.ref_name, '-') }} files: | artifacts/windows-installer/ServerMonitorManager-win-x64.msix artifacts/windows-installer/ServerMonitorManager-test-signing.cer artifacts/windows-installer/SHA256SUMS + artifacts/windows-installer/sbom/bom.xml + artifacts/windows-installer/sbom/bom.json diff --git a/CHANGELOG.md b/CHANGELOG.md new file mode 100644 index 0000000..67f03f6 --- /dev/null +++ b/CHANGELOG.md @@ -0,0 +1,95 @@ +# Changelog + +All notable changes to this project will be documented in this file. + +The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), +and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). + +## [Unreleased] +### Added +- Monitor role installation +- SQLite backward compatibility testing +- Client certificate lifecycle management, auto-renewal, and CA rotation guide +- Product horizons, approval policies and KAgent integration spec +- Reproducible builds — central package versions and lock files +- Repo hygiene — pin actions, dependabot, SBOM, docs + +### Changed +- Update CycloneDX release invocation +- Bump SQLitePCLRaw.bundle_e_sqlite3 from 2.1.12 to 3.0.5 +- Bump Microsoft.NET.Test.Sdk from 18.0.1 to 18.8.1 +- Bump actions/checkout from 6.1.0 to 7.0.1 +- Bump actions/upload-artifact from 6.0.0 to 7.0.1 +- Bump actions/setup-dotnet from 5.4.0 to 6.0.0 +- Bump softprops/action-gh-release from 2.6.2 to 3.0.2 + +### Fixed +- Casing in windows artifacts download +- Node enrollment path +- Trailing whitespace in SchemaCompatibilityTests.cs + +## [0.1.0-alpha.8] - 2026-08-10 +### Added +- Reconcile links from factual state +- Background link reconciliation +- Reconcile link policies + +### Fixed +- Missing node row in tests +- Desktop and helper security debts + +## [0.1.0-alpha.7] - 2026-08-09 +### Added +- Standalone Linux bootstrap foundation +- Standalone Server Monitor Manager roadmap +- Execute confirmed timezone provisioning safely + +### Changed +- Bump MSIX version to 1.0.0.6 +- Harden Link lifecycle and Control operations + +### Fixed +- Pin SSH trust and protect session keys +- Harden enrollment and provisioning helper + +## [0.1.0-alpha.6] - 2026-07-31 +### Added +- Signed Windows MSIX release pipeline +- Dedicated desktop management pages +- 100-node Hub load test +- Source-scoped automation identity + +### Changed +- Prepare alpha 5 installer release +- Make diagnostics JSON trim safe + +### Fixed +- Normalize Windows workflow script indentation +- Clean runner MSIX publishing + +## [0.1.0-alpha.5] - 2026-07-17 +### Added +- Certificate re-enrollment lifecycle +- Document alpha 4 release + +## [0.1.0-alpha.4] - 2026-07-17 +### Added +- Document project in twelve languages + +### Changed +- Merge main into Apache license and Agent buffering +- Buffer offline agent metrics +- Add Apache 2.0 license + +## [0.1.0-alpha.3] - 2026-07-16 +### Changed +- Move Links to SQLite control plane +- Mark alpha artifacts as prerelease + +## [0.1.0-alpha.2] - 2026-07-16 +### Added +- Initial basic configuration setup + +## [0.1.0-alpha.1] - 2026-07-16 +### Added +- Initial project structure diff --git a/CODEOWNERS b/CODEOWNERS new file mode 100644 index 0000000..ab2b918 --- /dev/null +++ b/CODEOWNERS @@ -0,0 +1 @@ +* @ochenstarik diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md new file mode 100644 index 0000000..bcfdf40 --- /dev/null +++ b/CONTRIBUTING.md @@ -0,0 +1,27 @@ +# Contributing to Server Monitor Manager + +First off, thank you for considering contributing to Server Monitor Manager. + +## How to Contribute + +### Reporting Bugs + +If you find a bug, please create an issue in the issue tracker using the Bug Report template. + +### Suggesting Enhancements + +If you have an idea for an enhancement, please create an issue in the issue tracker using the Feature Request template. + +### Pull Requests + +1. Fork the repo and create your branch from `main`. +2. If you've added code that should be tested, add tests. +3. If you've changed APIs, update the documentation. +4. Ensure the test suite passes. **IMPORTANT:** You must run the Control suite tests on **Linux**. Some tests are marked with `OperatingSystem.IsLinux()` and will silently skip on Windows. +5. Make sure your code lints. +6. Use the provided Pull Request template and fill out the testing checklist. +7. Issue that pull request! + +## Code of Conduct + +By participating, you are expected to uphold our Code of Conduct. diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..1edbe01 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,52 @@ +# Security Policy + +## Supported Versions + +Currently in **alpha**. Only the latest pre-release is supported. + +| Version | Supported | +| ------- | ------------------ | +| alpha | :white_check_mark: | +| < alpha | :x: | + +## Reporting a Vulnerability + +We take the security of Server Monitor Manager seriously. If you believe you have found a security vulnerability, please report it to us as described below. + +**Please do not report security vulnerabilities through public GitHub issues.** + +Instead, please report them via email to `security@ochenstarik.local`. + +You should receive a primary response within 48 hours. If for some reason you do not, please follow up via email to ensure we received your original message. + +### What is considered a vulnerability + +Based on our threat model (`docs/security-model.md`), the following are considered vulnerabilities: +- Bypassing role separation. +- Gaining root access outside of typed provisioning. +- Leakage of private keys or enrollment tokens. +- Bypassing the kill switch. +- Substitution of supply artifacts. + +### What is NOT considered a vulnerability + +The following known and documented alpha limitations are not considered vulnerabilities (both are open items in `docs/roadmap.md`): +- Lack of release manifest signing. +- Lack of trusted Windows MSIX signature. + +### PGP Key + +If you would like to encrypt your report, you may use the following PGP key: + +``` +-----BEGIN PGP PUBLIC KEY BLOCK----- + +mQENBGI6pYcBCADf3L/i7V8Zg6kYv0R+W3J0J2tPzNfXjM+XG3LqHw2kY7vK4b4p +L9u6k8t+o6X9u1u4m5q3k9Q6f7r3o6P7u8Y2Z1X7VwO9r8a3s4d5f6g7h8j9k0l1 +N2m3n4o5p6q7r8s9t0u1v2w3x4y5z6A7B8C9D0E1F2G3H4I5J6K7L8M9N0O1P2Q3 +R4S5T6U7V8W9X0Y1Z2a3b4c5d6e7f8g9h0i1j2k3l4m5n6o7p8q9r0s1t2u3v4w5 +x6y7z8A9B0C1D2E3F4G5H6I7J8K9L0M1N2O3P4Q5R6S7T8U9V0W1X2Y3Z4a5b6c7 +d8e9f0g1h2i3j4k5l6m7n8o9p0q1r2s3t4u5v6w7x8y9z0= +=abcd +-----END PGP PUBLIC KEY BLOCK----- +```