Политика уязвимостей, Dependabot и CodeQL

.github/dependabot.yml

@@ -0,0 +1,160 @@
+# Weekly dependency updates. Monday 09:00 Europe/Moscow.
+# Minor and patch version updates share one group. Security updates share another (applies-to).
+# version-update:semver-major is ignored. That filter applies to version updates, not security updates.
+# Actions are pinned to a commit SHA with a version comment. Dependabot replaces the SHA and the
+# comment, and does not switch the pin to a tag. Digest-pinned Dockerfiles stay digest-pinned.
+# open-pull-requests-limit caps version-update pull requests. npm is 5 and docker is 3, one slot
+# per manifest directory. The other ecosystems are a single directory and use 2.
+# Security updates use GitHub's own cap and are collapsed by the security group.
+version: 2
+updates:
+  - package-ecosystem: npm
+    directories:
+      - /
+      - /desktop
+      - /ops/billing
+      - /ops/billing/admin
+      - /ops/vps/dht-peers
+    schedule:
+      interval: weekly
+      day: monday
+      time: "09:00"
+      timezone: Europe/Moscow
+    open-pull-requests-limit: 5
+    ignore:
+      - dependency-name: "*"
+        update-types:
+          - version-update:semver-major
+    groups:
+      version-updates:
+        applies-to: version-updates
+        patterns:
+          - "*"
+        update-types:
+          - minor
+          - patch
+      security-updates:
+        applies-to: security-updates
+        patterns:
+          - "*"
+
+  - package-ecosystem: gradle
+    directory: /android
+    schedule:
+      interval: weekly
+      day: monday
+      time: "09:00"
+      timezone: Europe/Moscow
+    open-pull-requests-limit: 2
+    ignore:
+      - dependency-name: "*"
+        update-types:
+          - version-update:semver-major
+    groups:
+      version-updates:
+        applies-to: version-updates
+        patterns:
+          - "*"
+        update-types:
+          - minor
+          - patch
+      security-updates:
+        applies-to: security-updates
+        patterns:
+          - "*"
+
+  - package-ecosystem: cargo
+    directory: /desktop/src-tauri
+    schedule:
+      interval: weekly
+      day: monday
+      time: "09:00"
+      timezone: Europe/Moscow
+    open-pull-requests-limit: 2
+    ignore:
+      - dependency-name: "*"
+        update-types:
+          - version-update:semver-major
+    groups:
+      version-updates:
+        applies-to: version-updates
+        patterns:
+          - "*"
+        update-types:
+          - minor
+          - patch
+      security-updates:
+        applies-to: security-updates
+        patterns:
+          - "*"
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+      time: "09:00"
+      timezone: Europe/Moscow
+    open-pull-requests-limit: 2
+    ignore:
+      - dependency-name: "*"
+        update-types:
+          - version-update:semver-major
+    groups:
+      version-updates:
+        applies-to: version-updates
+        patterns:
+          - "*"
+        update-types:
+          - minor
+          - patch
+      security-updates:
+        applies-to: security-updates
+        patterns:
+          - "*"
+
+  - package-ecosystem: docker
+    directories:
+      - /ops/vps
+      - /ops/vps/dht-peers
+      - /ops/cache-node
+    schedule:
+      interval: weekly
+      day: monday
+      time: "09:00"
+      timezone: Europe/Moscow
+    open-pull-requests-limit: 3
+    ignore:
+      - dependency-name: "*"
+        update-types:
+          - version-update:semver-major
+    groups:
+      version-updates:
+        applies-to: version-updates
+        patterns:
+          - "*"
+        update-types:
+          - minor
+          - patch
+      security-updates:
+        applies-to: security-updates
+        patterns:
+          - "*"
+
+  - package-ecosystem: gitsubmodule
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+      time: "09:00"
+      timezone: Europe/Moscow
+    open-pull-requests-limit: 2
+    groups:
+      version-updates:
+        applies-to: version-updates
+        patterns:
+          - "*"
+      security-updates:
+        applies-to: security-updates
+        patterns:
+          - "*"

.github/workflows/codeql.yml

@@ -0,0 +1,119 @@
+name: CodeQL
+
+# Separate from CI. Not a required check. Docs-only and wiki-only changes skip push and pull_request.
+# Monday 09:00 Europe/Moscow (UTC+3, no daylight saving).
+
+permissions:
+  contents: read
+  security-events: write
+
+on:
+  push:
+    branches: [main]
+    paths-ignore:
+      - docs/**
+      - wiki/**
+  pull_request:
+    branches: [main]
+    paths-ignore:
+      - docs/**
+      - wiki/**
+  schedule:
+    - cron: '0 6 * * 1'
+
+concurrency:
+  group: codeql-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  analyze:
+    name: Analyze ${{ matrix.language }}
+    runs-on: ubuntu-latest
+    timeout-minutes: ${{ matrix.timeout }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - language: javascript-typescript
+            build-mode: none
+            timeout: 45
+          # Android sources are Kotlin. build-mode none does not extract Kotlin.
+          # Autobuild runs gradle assemble, and release tasks throw without the release keystore.
+          # assembleDebug is the CI debug task, one ABI, and does not run those release tasks.
+          - language: java-kotlin
+            build-mode: manual
+            timeout: 60
+          - language: rust
+            build-mode: none
+            timeout: 45
+          - language: actions
+            build-mode: none
+            timeout: 20
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      - name: Checkout 2160 Player submodule
+        if: matrix.language == 'java-kotlin'
+        run: git submodule update --init --recursive
+
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        if: matrix.language == 'java-kotlin'
+        with:
+          node-version: 24
+
+      - name: Install root dependencies
+        if: matrix.language == 'java-kotlin'
+        run: npm ci --no-audit --no-fund
+
+      - name: Prepare the Capacitor Android project
+        if: matrix.language == 'java-kotlin'
+        run: |
+          set -eu
+          mkdir -p dist-mobile
+          printf '%s\n' '<!doctype html><html><head><meta charset="utf-8"><title>OMP</title></head><body></body></html>' > dist-mobile/index.html
+          npx cap sync android
+          node scripts/strip-flatdir.mjs
+
+      - uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
+        if: matrix.language == 'java-kotlin'
+        with:
+          distribution: temurin
+          # 17 for the player-core toolchain, 21 (last = default) for Gradle.
+          java-version: |
+            17
+            21
+
+      - uses: android-actions/setup-android@9fc6c4e9069bf8d3d10b2204b1fb8f6ef7065407 # v3.2.2
+        if: matrix.language == 'java-kotlin'
+        with:
+          packages: 'platform-tools platforms;android-37.0 build-tools;36.0.0'
+
+      - name: Ensure Rust for CodeQL
+        if: matrix.language == 'rust'
+        run: |
+          set -eu
+          if ! command -v rustup >/dev/null 2>&1 || ! command -v cargo >/dev/null 2>&1; then
+            curl --proto '=https' --tlsv1.2 -fsSL https://sh.rustup.rs | sh -s -- -y --profile minimal --default-toolchain stable
+            echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
+          fi
+          rustup --version
+          cargo --version
+          rustc --version
+          mkdir -p desktop/dist
+          printf '%s\n' '<!doctype html><title>OMP</title>' > desktop/dist/index.html
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@33d7b85da1a04171e211befe2c739303b9a4c066 # v4.39.3
+        with:
+          languages: ${{ matrix.language }}
+          build-mode: ${{ matrix.build-mode }}
+
+      - name: Build Android debug
+        if: matrix.language == 'java-kotlin'
+        working-directory: android
+        run: ./gradlew --no-daemon -PompAbi=arm64-v8a -Porg.gradle.java.installations.fromEnv=JAVA_HOME_17_X64 assembleDebug
+
+      - name: Perform CodeQL analysis
+        uses: github/codeql-action/analyze@33d7b85da1a04171e211befe2c739303b9a4c066 # v4.39.3
+        with:
+          category: /language:${{ matrix.language }}

SECURITY.md

@@ -0,0 +1,32 @@
+# Сообщения об уязвимостях
+
+## Поддерживаемые версии
+
+Поддерживаются только два выпуска:
+
+- последний стабильный релиз, сейчас [v0.30.0](https://github.com/spacesarmat/omp/releases/tag/v0.30.0)
+- текущая бета, сейчас [v0.30.1-beta.3](https://github.com/spacesarmat/omp/releases/tag/v0.30.1-beta.3)
+
+Более ранние релизы и предыдущие беты не поддерживаются. Когда выходит новый стабильный релиз или более новая бета, поддержка переходит на них.
+
+## Куда писать
+
+Уязвимость сообщается через закрытую форму GitHub Private vulnerability reporting:
+
+https://github.com/spacesarmat/omp/security/advisories/new
+
+Публичный issue, обсуждение, pull request и коммит для этого не используются. В сообщении достаточно версии, шагов воспроизведения и эффекта. Готовый публичный пример эксплуатации не нужен.
+
+## Срок ответа
+
+Обычный ориентир: подтверждение получения в течение нескольких дней и первая оценка в течение примерно недели. Это ожидание, а не обязательство по сроку. Исправление зависит от серьезности и объема правки. Критичные сообщения разбираются раньше остальных. Точный день исправления заранее не назначается.
+
+## English
+
+Supported releases are the latest stable (currently v0.30.0) and the current beta (currently v0.30.1-beta.3). Older releases are not supported. Support moves on when a newer stable or beta tag is published.
+
+Report a vulnerability through GitHub private vulnerability reporting:
+
+https://github.com/spacesarmat/omp/security/advisories/new
+
+Do not open a public issue. A typical report is acknowledged within a few days, with a first assessment within about a week. That is an expectation, not a commitment. Fix time depends on severity and is not scheduled in advance.