From bc2aebe83ab896ee6bc767029fcb6acd20d71f2f Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Thu, 12 Nov 2026 00:17:17 +0000 Subject: [PATCH 1/3] =?UTF-8?q?=D0=9F=D0=BE=D0=BB=D0=B8=D1=82=D0=B8=D0=BA?= =?UTF-8?q?=D0=B0=20=D1=81=D0=BE=D0=BE=D0=B1=D1=89=D0=B5=D0=BD=D0=B8=D0=B9?= =?UTF-8?q?=20=D0=BE=D0=B1=20=D1=83=D1=8F=D0=B7=D0=B2=D0=B8=D0=BC=D0=BE?= =?UTF-8?q?=D1=81=D1=82=D1=8F=D1=85.?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Поддерживаются последний стабильный релиз и текущая бета. Сообщения идут в закрытую форму GitHub, без публичного issue и без обещания точного срока. Co-authored-by: ANDY BUM --- SECURITY.md | 32 ++++++++++++++++++++++++++++++++ 1 file changed, 32 insertions(+) create mode 100644 SECURITY.md diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 00000000..5c860ba2 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,32 @@ +# Сообщения об уязвимостях + +## Поддерживаемые версии + +Поддерживаются только два выпуска: + +- последний стабильный релиз, сейчас [v0.30.0](https://github.com/spacesarmat/omp/releases/tag/v0.30.0) +- текущая бета, сейчас [v0.30.1-beta.3](https://github.com/spacesarmat/omp/releases/tag/v0.30.1-beta.3) + +Более ранние релизы и предыдущие беты не поддерживаются. Когда выходит новый стабильный релиз или более новая бета, поддержка переходит на них. + +## Куда писать + +Уязвимость сообщается через закрытую форму GitHub Private vulnerability reporting: + +https://github.com/spacesarmat/omp/security/advisories/new + +Публичный issue, обсуждение, pull request и коммит для этого не используются. В сообщении достаточно версии, шагов воспроизведения и эффекта. Готовый публичный пример эксплуатации не нужен. + +## Срок ответа + +Обычный ориентир: подтверждение получения в течение нескольких дней и первая оценка в течение примерно недели. Это ожидание, а не обязательство по сроку. Исправление зависит от серьезности и объема правки. Критичные сообщения разбираются раньше остальных. Точный день исправления заранее не назначается. + +## English + +Supported releases are the latest stable (currently v0.30.0) and the current beta (currently v0.30.1-beta.3). Older releases are not supported. Support moves on when a newer stable or beta tag is published. + +Report a vulnerability through GitHub private vulnerability reporting: + +https://github.com/spacesarmat/omp/security/advisories/new + +Do not open a public issue. A typical report is acknowledged within a few days, with a first assessment within about a week. That is an expectation, not a commitment. Fix time depends on severity and is not scheduled in advance. From 9e67cbae9d7518c59c034cbedc68a97a3c9e61f3 Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Thu, 12 Nov 2026 00:17:18 +0000 Subject: [PATCH 2/3] =?UTF-8?q?Dependabot:=20=D0=B5=D0=B6=D0=B5=D0=BD?= =?UTF-8?q?=D0=B5=D0=B4=D0=B5=D0=BB=D1=8C=D0=BD=D1=8B=D0=B5=20=D0=B3=D1=80?= =?UTF-8?q?=D1=83=D0=BF=D0=BF=D1=8B=20=D0=BE=D0=B1=D0=BD=D0=BE=D0=B2=D0=BB?= =?UTF-8?q?=D0=B5=D0=BD=D0=B8=D0=B9.?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit npm, Gradle, Cargo, Actions, Docker и сабмодуль проверяются по понедельникам, 09:00 МСК. Minor и patch сведены в одну группу, security-updates в другую, semver-major для version updates игнорируется. Co-authored-by: ANDY BUM --- .github/dependabot.yml | 160 +++++++++++++++++++++++++++++++++++++++++ 1 file changed, 160 insertions(+) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 00000000..87b4cf53 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,160 @@ +# Weekly dependency updates. Monday 09:00 Europe/Moscow. +# Minor and patch version updates share one group. Security updates share another (applies-to). +# version-update:semver-major is ignored. That filter applies to version updates, not security updates. +# Actions are pinned to a commit SHA with a version comment. Dependabot replaces the SHA and the +# comment, and does not switch the pin to a tag. Digest-pinned Dockerfiles stay digest-pinned. +# open-pull-requests-limit caps version-update pull requests. npm is 5 and docker is 3, one slot +# per manifest directory. The other ecosystems are a single directory and use 2. +# Security updates use GitHub's own cap and are collapsed by the security group. +version: 2 +updates: + - package-ecosystem: npm + directories: + - / + - /desktop + - /ops/billing + - /ops/billing/admin + - /ops/vps/dht-peers + schedule: + interval: weekly + day: monday + time: "09:00" + timezone: Europe/Moscow + open-pull-requests-limit: 5 + ignore: + - dependency-name: "*" + update-types: + - version-update:semver-major + groups: + version-updates: + applies-to: version-updates + patterns: + - "*" + update-types: + - minor + - patch + security-updates: + applies-to: security-updates + patterns: + - "*" + + - package-ecosystem: gradle + directory: /android + schedule: + interval: weekly + day: monday + time: "09:00" + timezone: Europe/Moscow + open-pull-requests-limit: 2 + ignore: + - dependency-name: "*" + update-types: + - version-update:semver-major + groups: + version-updates: + applies-to: version-updates + patterns: + - "*" + update-types: + - minor + - patch + security-updates: + applies-to: security-updates + patterns: + - "*" + + - package-ecosystem: cargo + directory: /desktop/src-tauri + schedule: + interval: weekly + day: monday + time: "09:00" + timezone: Europe/Moscow + open-pull-requests-limit: 2 + ignore: + - dependency-name: "*" + update-types: + - version-update:semver-major + groups: + version-updates: + applies-to: version-updates + patterns: + - "*" + update-types: + - minor + - patch + security-updates: + applies-to: security-updates + patterns: + - "*" + + - package-ecosystem: github-actions + directory: / + schedule: + interval: weekly + day: monday + time: "09:00" + timezone: Europe/Moscow + open-pull-requests-limit: 2 + ignore: + - dependency-name: "*" + update-types: + - version-update:semver-major + groups: + version-updates: + applies-to: version-updates + patterns: + - "*" + update-types: + - minor + - patch + security-updates: + applies-to: security-updates + patterns: + - "*" + + - package-ecosystem: docker + directories: + - /ops/vps + - /ops/vps/dht-peers + - /ops/cache-node + schedule: + interval: weekly + day: monday + time: "09:00" + timezone: Europe/Moscow + open-pull-requests-limit: 3 + ignore: + - dependency-name: "*" + update-types: + - version-update:semver-major + groups: + version-updates: + applies-to: version-updates + patterns: + - "*" + update-types: + - minor + - patch + security-updates: + applies-to: security-updates + patterns: + - "*" + + - package-ecosystem: gitsubmodule + directory: / + schedule: + interval: weekly + day: monday + time: "09:00" + timezone: Europe/Moscow + open-pull-requests-limit: 2 + groups: + version-updates: + applies-to: version-updates + patterns: + - "*" + security-updates: + applies-to: security-updates + patterns: + - "*" From e356f58ccaa8fa379353e2d22b34e4051f4603b7 Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Thu, 12 Nov 2026 00:17:18 +0000 Subject: [PATCH 3/3] =?UTF-8?q?CodeQL=20=D0=BE=D1=82=D0=B4=D0=B5=D0=BB?= =?UTF-8?q?=D1=8C=D0=BD=D1=8B=D0=BC=20workflow,=20=D0=BD=D0=B5=20=D0=B2=20?= =?UTF-8?q?=D0=BE=D1=81=D0=BD=D0=BE=D0=B2=D0=BD=D0=BE=D0=BC=20CI.?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit javascript-typescript, java-kotlin, rust и actions. Push и pull request в main, плюс понедельник 09:00 МСК. Документация и wiki не запускают анализ. Права: contents read и security-events write. Co-authored-by: ANDY BUM --- .github/workflows/codeql.yml | 119 +++++++++++++++++++++++++++++++++++ 1 file changed, 119 insertions(+) create mode 100644 .github/workflows/codeql.yml diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml new file mode 100644 index 00000000..d8214f41 --- /dev/null +++ b/.github/workflows/codeql.yml @@ -0,0 +1,119 @@ +name: CodeQL + +# Separate from CI. Not a required check. Docs-only and wiki-only changes skip push and pull_request. +# Monday 09:00 Europe/Moscow (UTC+3, no daylight saving). + +permissions: + contents: read + security-events: write + +on: + push: + branches: [main] + paths-ignore: + - docs/** + - wiki/** + pull_request: + branches: [main] + paths-ignore: + - docs/** + - wiki/** + schedule: + - cron: '0 6 * * 1' + +concurrency: + group: codeql-${{ github.ref }} + cancel-in-progress: true + +jobs: + analyze: + name: Analyze ${{ matrix.language }} + runs-on: ubuntu-latest + timeout-minutes: ${{ matrix.timeout }} + strategy: + fail-fast: false + matrix: + include: + - language: javascript-typescript + build-mode: none + timeout: 45 + # Android sources are Kotlin. build-mode none does not extract Kotlin. + # Autobuild runs gradle assemble, and release tasks throw without the release keystore. + # assembleDebug is the CI debug task, one ABI, and does not run those release tasks. + - language: java-kotlin + build-mode: manual + timeout: 60 + - language: rust + build-mode: none + timeout: 45 + - language: actions + build-mode: none + timeout: 20 + steps: + - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + + - name: Checkout 2160 Player submodule + if: matrix.language == 'java-kotlin' + run: git submodule update --init --recursive + + - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 + if: matrix.language == 'java-kotlin' + with: + node-version: 24 + + - name: Install root dependencies + if: matrix.language == 'java-kotlin' + run: npm ci --no-audit --no-fund + + - name: Prepare the Capacitor Android project + if: matrix.language == 'java-kotlin' + run: | + set -eu + mkdir -p dist-mobile + printf '%s\n' 'OMP' > dist-mobile/index.html + npx cap sync android + node scripts/strip-flatdir.mjs + + - uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1 + if: matrix.language == 'java-kotlin' + with: + distribution: temurin + # 17 for the player-core toolchain, 21 (last = default) for Gradle. + java-version: | + 17 + 21 + + - uses: android-actions/setup-android@9fc6c4e9069bf8d3d10b2204b1fb8f6ef7065407 # v3.2.2 + if: matrix.language == 'java-kotlin' + with: + packages: 'platform-tools platforms;android-37.0 build-tools;36.0.0' + + - name: Ensure Rust for CodeQL + if: matrix.language == 'rust' + run: | + set -eu + if ! command -v rustup >/dev/null 2>&1 || ! command -v cargo >/dev/null 2>&1; then + curl --proto '=https' --tlsv1.2 -fsSL https://sh.rustup.rs | sh -s -- -y --profile minimal --default-toolchain stable + echo "$HOME/.cargo/bin" >> "$GITHUB_PATH" + fi + rustup --version + cargo --version + rustc --version + mkdir -p desktop/dist + printf '%s\n' 'OMP' > desktop/dist/index.html + + - name: Initialize CodeQL + uses: github/codeql-action/init@33d7b85da1a04171e211befe2c739303b9a4c066 # v4.39.3 + with: + languages: ${{ matrix.language }} + build-mode: ${{ matrix.build-mode }} + + - name: Build Android debug + if: matrix.language == 'java-kotlin' + working-directory: android + run: ./gradlew --no-daemon -PompAbi=arm64-v8a -Porg.gradle.java.installations.fromEnv=JAVA_HOME_17_X64 assembleDebug + + - name: Perform CodeQL analysis + uses: github/codeql-action/analyze@33d7b85da1a04171e211befe2c739303b9a4c066 # v4.39.3 + with: + category: /language:${{ matrix.language }}