WEBDIENSTE/ECC
1
0
Fork 0
mirror of https://github.com/affaan-m/ECC.git synced 2026-08-17 21:15:40 +02:00
Code Issues Packages Projects Releases Wiki Activity
2,353 Commits 71 Branches 16 Tags
28e53a0bc10e286f68b53bb1e3b3f049021e57b9
Commit Graph
85 Commits
Author SHA1 Message Date
haelyraGitHubClaude Fable 5
 		28e53a0bc1 feat(install): add guided multi-harness installer (#2649) 
* feat(install): add guided Claude plugin setup

* fix: support Claude command shims on Windows

* feat: support safe Claude plugin scope migration

* fix(install): preserve interactive setup terminal

* fix(install): auto-migrate setup scope changes

* feat(install): add guided multi-harness installer

* fix(install): sync Yarn binary metadata

* fix(install): handle wizard EOF on Node 18

* ci: allow installer matrix tests to finish

* test(install): allow slower PowerShell delegation

* fix(install): harden guided provider reconciliation

* test(install): harden packaged and local compatibility

* chore: prepare guided installer release 2.2.0

* fix(install): report refreshed Codex marketplace state

* fix(install): verify managed content provenance

* test(install): allow empty Yarn smoke fixture

* test(install): invoke Windows package shims safely

* fix(install): close cross-platform release gaps

* fix(install): require trusted GitHub origins

* fix(install): preserve hook profile precedence

* refactor(install): centralize trusted GitHub origins

* ci: retrigger workflow run after merge of main

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
 2026-08-06 15:39:49 -04:00
Affaan MustafaandClaude edaf6fef94 fix(release): drop the dead OMP adapter verification step 
The step ran node tests/omp/omp-plugin.test.js, which has never existed in
this repository. It was added by #2382 without the test file, so Verify
Release failed on every tag and no release could publish.

The OpenCode payload is already verified by tests/scripts/build-opencode.test.js
in the preceding step, and the plugin and marketplace manifests by
tests/plugin-manifest.test.js in Verify release metadata stays in sync.

Co-Authored-By: Claude <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0149VwNuynam6rvEfcMmiHHa
 2026-07-27 14:07:43 -04:00
dependabot[bot]andGitHub a7996b03f5 chore(deps): update checkout action to v7 (#2456) 
Update the final SLSA workflow checkout step to the same exact v7.0.0 SHA used across the rest of the repository.
 2026-07-26 03:12:29 -07:00
dependabot[bot]andGitHub efc91870c7 chore(deps): update pinned GitHub actions (#2540) 
Update actions/stale to v10.4.0 and softprops/action-gh-release to v3.0.2 while preserving exact SHA pinning.
 2026-07-26 03:11:38 -07:00
dependabot[bot]GitHubdependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 		ad08352f60 chore(deps): bump the actions-minor-and-patch group across 1 directory with 3 updates (#2325) 
Bumps the actions-minor-and-patch group with 3 updates in the / directory: [actions/setup-node](https://github.com/actions/setup-node), [pnpm/action-setup](https://github.com/pnpm/action-setup) and [softprops/action-gh-release](https://github.com/softprops/action-gh-release).


Updates `actions/setup-node` from 6.3.0 to 6.4.0
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](https://github.com/actions/setup-node/compare/v6.3.0...48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e)

Updates `pnpm/action-setup` from 6.0.8 to 6.0.9
- [Release notes](https://github.com/pnpm/action-setup/releases)
- [Commits](https://github.com/pnpm/action-setup/compare/0e279bb959325dab635dd2c09392533439d90093...0ebf47130e4866e96fce0953f49152a61190b271)

Updates `softprops/action-gh-release` from 3.0.0 to 3.0.1
- [Release notes](https://github.com/softprops/action-gh-release/releases)
- [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md)
- [Commits](https://github.com/softprops/action-gh-release/compare/b4309332981a82ec1c5618f44dd2e27cc8bfbfda...718ea10b132b3b2eba29c1007bb80653f286566b)

---
updated-dependencies:
- dependency-name: actions/setup-node
  dependency-version: 6.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions-minor-and-patch
- dependency-name: pnpm/action-setup
  dependency-version: 6.0.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions-minor-and-patch
- dependency-name: softprops/action-gh-release
  dependency-version: 3.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions-minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-29 15:56:09 -07:00
dependabot[bot]GitHubdependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 		891412c126 chore(deps): bump slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml (#2330) 
Bumps [slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml](https://github.com/slsa-framework/slsa-github-generator) from 1.4.0 to 2.1.0.
- [Release notes](https://github.com/slsa-framework/slsa-github-generator/releases)
- [Changelog](https://github.com/slsa-framework/slsa-github-generator/blob/main/CHANGELOG.md)
- [Commits](https://github.com/slsa-framework/slsa-github-generator/compare/68bad40844440577b33778c9f29077a3388838e9...f7dd8c54c2067bafc12ca7a55595d5ee9b75204a)

---
updated-dependencies:
- dependency-name: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml
  dependency-version: 2.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-29 15:55:47 -07:00
dependabot[bot]GitHubdependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 		e676d1da7f chore(deps): bump actions/checkout from 6.0.3 to 7.0.0 (#2328) 
Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.3 to 7.0.0.
- [Release notes](https://github.com/actions/checkout/releases)
- [Commits](https://github.com/actions/checkout/compare/v6.0.3...v7)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-29 15:55:45 -07:00
Yang ChengGitHubjan
 		00b443eddb ci: isolate OMP workflow verification (#2382) 
Co-authored-by: jan <jan@w-saxs001.local>
 2026-06-29 15:51:00 -07:00
Mal-QuGitHubcubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>
 		e53b4d9e39 Finalize and enhance SLSA generic generator workflow (#2197) 
* Add SLSA generic generator workflow

* ci: finalize SLSA generator and fix bun test timeout

- Harden SLSA workflow with persist-credentials: false and pinned actions
- Update SLSA workflow to build real npm artifacts and fix digest outputs
- Increase trae-install test timeout to prevent ETIMEDOUT under Bun
- Fix Validate Components security violation in SLSA workflow

* ci: finalize SLSA generator and fix bun test timeout

- Harden SLSA workflow with persist-credentials: false and pinned actions
- Update SLSA workflow to build real npm artifacts and fix digest outputs
- Rename workflow to "SLSA generic generator workflow #1"
- Increase trae-install test timeout to prevent ETIMEDOUT under Bun
- Fix Validate Components security violation in SLSA workflow

* Update generator-generic-ossf-slsa3-publish.yml

Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>

* generator-generic-ossf-slsa3-publish.yml

* .github/workflows/generator-generic-ossf-slsa3-publish.yml

Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>

* Update .github/workflows/generator-generic-ossf-slsa3-publish.yml

Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>

---------

Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>
Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>
 2026-06-15 14:01:29 -04:00
@aaronjmarsGitHubaeonframework
 		1c3280dc0d fix(security): add host/origin allowlist + validate git refs + quote workflow input (#2185) 
Three defense-in-depth fixes around untrusted input flowing to subprocess execution:

1. **Control-pane HTTP server (scripts/lib/control-pane/server.js)**
   The local control-pane API binds to 127.0.0.1 but had no Host or Origin
   validation, so a DNS-rebinding attack from a malicious website could pivot
   into the loopback endpoints — including POST /api/actions/:id, which spawns
   'cargo run -- graph ...' with caller-supplied query strings. Add a hostname
   allowlist (loopback variants plus the explicitly configured --host) and
   reject mismatched Host (421) or non-loopback Origin (403) before any route
   handler runs.

2. **OpenCode git-summary tool (.opencode/tools/git-summary.ts)**
   The tool was building 'git diff ${baseBranch}...HEAD --stat' with execSync
   and a raw model-supplied baseBranch string. Switch run() to execFileSync
   with an args array (no shell), validate baseBranch against a conservative
   git-ref allowlist (rejects shell metacharacters, leading -, embedded ..),
   and clamp the depth arg to a small positive integer before interpolating
   into 'git log --oneline -<N>'.

3. **Reusable test workflow (.github/workflows/reusable-test.yml)**
   The 'Install dependencies' step interpolated ${{ inputs.package-manager }}
   directly into a bash 'case' and into an echo, so a downstream caller that
   forwarded attacker-controllable input could inject into the runner. Move
   the input into a PACKAGE_MANAGER env var and reference $PACKAGE_MANAGER
   inside the script per the GitHub script-injection guidance.

Detected by Aeon + semgrep p/security-audit (host check via threat-model
manual-review axis; git-summary via detect-child-process; workflow via
run-shell-injection).

Verification: node tests/run-all.js — 2686/2687 pre-existing tests pass; the
one failure (observe.sh legacy output fallback) reproduces on main without
this branch applied. Added 2 new control-pane tests covering the allowlist
classifier and the DNS-rebinding-gate behavior end-to-end.

---
Filed by [Aeon](https://github.com/aaronjmars/aeon-aaron).

Co-authored-by: aeonframework <aeon@aaronjmars.com>
 2026-06-15 13:49:40 -04:00
dependabot[bot]GitHubdependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 		d71ffd56b9 chore(deps): bump actions/setup-node (#2204) 
Bumps the actions-minor-and-patch group with 1 update in the / directory: [actions/setup-node](https://github.com/actions/setup-node).


Updates `actions/setup-node` from 6.3.0 to 6.4.0
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](https://github.com/actions/setup-node/compare/53b83947a5a98c8d113130e565377fae1a50d02f...48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e)

---
updated-dependencies:
- dependency-name: actions/setup-node
  dependency-version: 6.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions-minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-10 23:39:00 -04:00
ECC Test 3e30f1a56a ci: harden workflows and sponsor code review config 2026-06-09 21:20:17 -04:00
ECC Test 10c303e609 ci: harden release announce checkout 2026-06-09 21:03:22 -04:00
Affaan MustafaGitHubECC Test
 		edebcc89ef feat(discord): release -> #announcements auto-post + pin + GitHub Discussions (#2201) 
On a published GitHub release, post the notes to the ECC Discord
#announcements channel (via bot), pin it, and cross-post to GitHub
Discussions (Announcements category). Release data flows through env vars
(no shell interpolation of untrusted input). Secrets: DISCORD_BOT_TOKEN,
DISCORD_ANNOUNCE_CHANNEL_ID (repo secrets), GITHUB_TOKEN.

Ties the 2.0.0/1.11.0 official release to the community launch.

Co-authored-by: ECC Test <ecc@example.test>
 2026-06-08 22:38:03 -04:00
dependabot[bot]GitHubdependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 		09e2bc58d3 chore(deps): bump actions/checkout from 6.0.2 to 6.0.3 (#2183) 
Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.2 to 6.0.3.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/de0fac2e4500dabe0009e67214ff5f5447ce83dd...df4cb1c069e1874edd31b4311f1884172cec0e10)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 6.0.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-07 13:25:31 +08:00
dependabot[bot]andGitHub 870c5eb21b chore(deps): bump actions/stale to 10.3.0 (#2045) 
Bumps actions/stale from 10.2.0 to 10.3.0. Verified by the full CI matrix on the PR.
 2026-05-25 14:06:27 -04:00
Affaan MustafaandAffaan Mustafa 9ee1e15564 docs: define ECC 2.0 hypergrowth release lane 
Refresh the active 2.0 release surface for the affaan-m/ECC repo identity, update package/plugin/workflow launch metadata, and add an operator command center for release video, partner, sponsor, consulting, and social launch execution.
 2026-05-19 05:42:38 -04:00
Affaan Mustafa 7911af4a39 security: scope release oidc publishing 2026-05-18 13:41:10 -04:00
dependabot[bot]andAffaan Mustafa cde0b12180 chore(deps): bump pnpm/action-setup from 6.0.6 to 6.0.8 
Bumps [pnpm/action-setup](https://github.com/pnpm/action-setup) from 6.0.6 to 6.0.8.
- [Release notes](https://github.com/pnpm/action-setup/releases)
- [Commits](https://github.com/pnpm/action-setup/compare/91ab88e2619ed1f46221f0ba42d1492c02baf788...0e279bb959325dab635dd2c09392533439d90093)

---
updated-dependencies:
- dependency-name: pnpm/action-setup
  dependency-version: 6.0.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-05-17 01:33:19 -04:00
Affaan MustafaandAffaan Mustafa a8e3bcb00f Add supply-chain advisory source refresh 2026-05-15 23:09:54 -04:00
Affaan MustafaandAffaan Mustafa f7035b5644 Harden CI installs against supply-chain lifecycle hooks 2026-05-15 17:29:03 -04:00
Affaan MustafaandAffaan Mustafa 6951b8d5d2 Add scheduled supply-chain watch workflow 2026-05-15 16:56:49 -04:00
Affaan MustafaandGitHub c2c54e7c0b ci: restore dependency caches without saving (#1934) 2026-05-15 13:51:51 -04:00
Affaan MustafaandGitHub 13585f1092 feat: add platform and supply-chain audit commands (#1926) 2026-05-15 08:06:26 -04:00
Affaan MustafaGitHubjodunk
 		f7315016c0 feat: add command registry and coverage checks (#1906) 
Salvages the useful parts of #1897 without generated .caliber state or stale counts.

- adds a deterministic command registry generator and drift check
- commits the current command registry for 75 commands
- validates the rc.1 README catalog summary against live counts
- adds a single Ubuntu Node 20 coverage job instead of running coverage in every matrix cell

Co-authored-by: jodunk <jodunk@users.noreply.github.com>
 2026-05-14 22:02:36 -04:00
Affaan MustafaandGitHub 7d15a2282b security: add supply-chain IOC scanner (#1904) 2026-05-14 21:15:35 -04:00
Affaan MustafaandGitHub 209abd403b ci: disable checkout credential persistence in privileged workflows (#1851) 2026-05-13 01:15:49 -04:00
Affaan MustafaandGitHub 797f283036 ci: require npm audit signature checks 
Require npm registry signature verification wherever workflow npm audit checks run.

- add npm audit signatures to CI Security Scan and maintenance security audit jobs
- teach the workflow security validator to reject npm audit without signature verification
- keep the repair and Copilot prompt tests portable across Windows path/case and CRLF frontmatter behavior

Validation:
- node tests/run-all.js (2376 passed, 0 failed)
- CI current-head matrix green on #1846
 2026-05-12 23:48:56 -04:00
Affaan MustafaandGitHub daf0355531 ci: harden workflow install boundaries 
- run non-test workflow installs with npm ci --ignore-scripts where lifecycle scripts are not needed\n- reject plain npm ci in workflows with write permissions\n- reject actions/cache in id-token: write workflows to reduce OIDC publish cache-poisoning risk
 2026-05-12 21:55:36 -04:00
Affaan MustafaandGitHub 33db548be3 ci: ignore install scripts in release workflows (#1839) 2026-05-12 21:36:36 -04:00
Affaan MustafaandAffaan Mustafa 6fbf58d590 ci: keep package manager cache failures non-blocking 2026-05-12 18:03:30 -04:00
Affaan MustafaandGitHub e674a7dbd7 fix: harden CI validators 
Ports personal-path validator hardening and quoted checkout detection onto current main.
 2026-05-11 03:08:43 -04:00
dependabot[bot]GitHubdependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 		c013479019 build(deps): bump pnpm/action-setup from 6.0.0 to 6.0.6 (#1708) 
Bumps [pnpm/action-setup](https://github.com/pnpm/action-setup) from 6.0.0 to 6.0.6.
- [Release notes](https://github.com/pnpm/action-setup/releases)
- [Commits](https://github.com/pnpm/action-setup/compare/08c4be7e2e672a47d11bd04269e27e5f3e8529cb...91ab88e2619ed1f46221f0ba42d1492c02baf788)

---
updated-dependencies:
- dependency-name: pnpm/action-setup
  dependency-version: 6.0.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-05-11 01:12:31 -04:00
dependabot[bot]GitHubdependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 		01b171947c chore(deps): bump actions/cache from 5.0.4 to 5.0.5 (#1497) 
Bumps [actions/cache](https://github.com/actions/cache) from 5.0.4 to 5.0.5.
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](https://github.com/actions/cache/compare/668228422ae6a00e4ad889ee87cd7109ec5666a7...27d5ce7f107fe9357f9df03efb73ab90386fccae)

---
updated-dependencies:
- dependency-name: actions/cache
  dependency-version: 5.0.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-05-11 01:11:50 -04:00
Affaan Mustafa 0a87323eda feat(ecc2): finalize rc1 release surface 2026-04-28 22:10:04 -04:00
Affaan Mustafa 6b7bd7156c fix: relax pnpm strict build checks in CI 2026-04-15 16:44:58 -07:00
Affaan Mustafa 8b5c0c1b07 fix: allow manual release workflow dispatch 2026-04-14 21:02:23 -07:00
Affaan Mustafa b5c4d2beb9 fix: wire npm auth into release publish 2026-04-14 20:43:22 -07:00
Affaan Mustafa 34380326c8 fix: publish npm releases and clarify install identifiers 2026-04-14 20:42:28 -07:00
Affaan MustafaandGitHub 85e331e49a Merge pull request #1369 from affaan-m/dependabot/github_actions/pnpm/action-setup-6.0.0 
build(deps): bump pnpm/action-setup from 5.0.0 to 6.0.0
 2026-04-13 01:05:16 -07:00
Affaan MustafaandGitHub 5c4570baa5 Merge pull request #1370 from affaan-m/dependabot/github_actions/softprops/action-gh-release-3.0.0 
build(deps): bump softprops/action-gh-release from 2.6.1 to 3.0.0
 2026-04-13 00:30:59 -07:00
Affaan Mustafa 1a950e4f83 fix: allow pnpm cache probe under node 18 2026-04-13 00:21:42 -07:00
Affaan Mustafa ef7613c526 fix: use corepack pnpm on node 18 2026-04-13 00:17:17 -07:00
Affaan Mustafa bd207aabe1 fix: use pnpm 9 for node 18 workflow jobs 2026-04-13 00:13:54 -07:00
Affaan Mustafa 6eadf786f5 fix: pin pnpm version for setup action v6 2026-04-13 00:10:39 -07:00
Affaan Mustafa db8247d701 chore: update release action version comments 2026-04-12 23:54:26 -07:00
Affaan Mustafa adb46a95a6 chore: update pnpm action version comments 2026-04-12 23:53:57 -07:00
Affaan MustafaandGitHub 48e5a1fa75 Merge pull request #1371 from affaan-m/dependabot/github_actions/actions/github-script-9.0.0 
build(deps): bump actions/github-script from 8.0.0 to 9.0.0
 2026-04-12 23:53:17 -07:00
Affaan MustafaandGitHub 2fb041c6de Merge pull request #1368 from affaan-m/dependabot/github_actions/actions/upload-artifact-7.0.1 
build(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1
 2026-04-12 23:53:01 -07:00
Affaan Mustafa 3792b69a38 fix: block unsafe privileged workflow checkouts 2026-04-12 23:23:01 -07:00