From b50ee117f05baf3e62d849de696fdceca227173c Mon Sep 17 00:00:00 2001 From: jliddev Date: Mon, 24 Aug 2020 22:06:08 -0500 Subject: [PATCH 1/8] Create SECURITY.md --- SECURITY.md | 13 +++++++++++++ 1 file changed, 13 insertions(+) create mode 100644 SECURITY.md diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 00000000..5cd3f191 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,13 @@ +# Security Policy + +## Supported Versions + +Currently the only version available is being supported. Once we have newer once this will be updated. + +| Version | Supported | +| ------- | ------------------ | +| 1.x.x | :white_check_mark: | + +## Reporting a Vulnerability + +If you find a security issue, please create an issue and we will get to ASAP. From fc06fe2827ee7e6311ef8a5ab77ec05f09ae3d24 Mon Sep 17 00:00:00 2001 From: jliddev Date: Mon, 24 Aug 2020 22:07:02 -0500 Subject: [PATCH 2/8] Create codeql-analysis.yml --- .github/workflows/codeql-analysis.yml | 54 +++++++++++++++++++++++++++ 1 file changed, 54 insertions(+) create mode 100644 .github/workflows/codeql-analysis.yml diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml new file mode 100644 index 00000000..b6e8f951 --- /dev/null +++ b/.github/workflows/codeql-analysis.yml @@ -0,0 +1,54 @@ +name: "CodeQL" + +on: + push: + branches: [master, ] + pull_request: + # The branches below must be a subset of the branches above + branches: [master] + schedule: + - cron: '0 9 * * 1' + +jobs: + analyze: + name: Analyze + runs-on: ubuntu-latest + + steps: + - name: Checkout repository + uses: actions/checkout@v2 + with: + # We must fetch at least the immediate parents so that if this is + # a pull request then we can checkout the head. + fetch-depth: 2 + + # If this run was triggered by a pull request event, then checkout + # the head of the pull request instead of the merge commit. + - run: git checkout HEAD^2 + if: ${{ github.event_name == 'pull_request' }} + + # Initializes the CodeQL tools for scanning. + - name: Initialize CodeQL + uses: github/codeql-action/init@v1 + # Override language selection by uncommenting this and choosing your languages + # with: + # languages: go, javascript, csharp, python, cpp, java + + # Autobuild attempts to build any compiled languages (C/C++, C#, or Java). + # If this step fails, then you should remove it and run the build manually (see below) + - name: Autobuild + uses: github/codeql-action/autobuild@v1 + + # ℹī¸ Command-line programs to run using the OS shell. + # 📚 https://git.io/JvXDl + + # ✏ī¸ If the Autobuild fails above, remove it and uncomment the following three lines + # and modify them (or add more) to build your code if your project + # uses a compiled language + + #- run: | + # make bootstrap + # make release + + - name: Perform CodeQL Analysis + uses: github/codeql-action/analyze@v1 From 018e779d3bca35dcc60ae360b086c3a28c67f52d Mon Sep 17 00:00:00 2001 From: jliddev Date: Mon, 24 Aug 2020 22:07:23 -0500 Subject: [PATCH 3/8] Create ossar-analysis.yml --- .github/workflows/ossar-analysis.yml | 45 ++++++++++++++++++++++++++++ 1 file changed, 45 insertions(+) create mode 100644 .github/workflows/ossar-analysis.yml diff --git a/.github/workflows/ossar-analysis.yml b/.github/workflows/ossar-analysis.yml new file mode 100644 index 00000000..e047f4c9 --- /dev/null +++ b/.github/workflows/ossar-analysis.yml @@ -0,0 +1,45 @@ +# This workflow integrates a collection of open source static analysis tools +# with GitHub code scanning. For documentation, or to provide feedback, visit +# https://github.com/github/ossar-action +name: OSSAR + +on: + push: + pull_request: + +jobs: + OSSAR-Scan: + # OSSAR runs on windows-latest. + # ubuntu-latest and macos-latest support coming soon + runs-on: windows-latest + + steps: + # Checkout your code repository to scan + - name: Checkout repository + uses: actions/checkout@v2 + with: + # We must fetch at least the immediate parents so that if this is + # a pull request then we can checkout the head. + fetch-depth: 2 + + # If this run was triggered by a pull request event, then checkout + # the head of the pull request instead of the merge commit. + - run: git checkout HEAD^2 + if: ${{ github.event_name == 'pull_request' }} + + # Install dotnet, used by OSSAR + - name: Install .NET + uses: actions/setup-dotnet@v1 + with: + dotnet-version: '3.1.201' + + # Run open source static analysis tools + - name: Run OSSAR + uses: github/ossar-action@v1 + id: ossar + + # Upload results to the Security tab + - name: Upload OSSAR results + uses: github/codeql-action/upload-sarif@v1 + with: + sarif_file: ${{ steps.ossar.outputs.sarifFile }} From 557b79ea2127502c1ee7ce212d41298a7a73fd15 Mon Sep 17 00:00:00 2001 From: jliddev Date: Mon, 24 Aug 2020 22:10:58 -0500 Subject: [PATCH 4/8] Update codeql-analysis.yml --- .github/workflows/codeql-analysis.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml index b6e8f951..931e3193 100644 --- a/.github/workflows/codeql-analysis.yml +++ b/.github/workflows/codeql-analysis.yml @@ -12,7 +12,7 @@ on: jobs: analyze: name: Analyze - runs-on: ubuntu-latest + runs-on: windows-latest steps: - name: Checkout repository From 2c300c3efec10e86d7192731f952370720346b2c Mon Sep 17 00:00:00 2001 From: jliddev Date: Mon, 24 Aug 2020 22:11:26 -0500 Subject: [PATCH 5/8] Delete ossar-analysis.yml --- .github/workflows/ossar-analysis.yml | 45 ---------------------------- 1 file changed, 45 deletions(-) delete mode 100644 .github/workflows/ossar-analysis.yml diff --git a/.github/workflows/ossar-analysis.yml b/.github/workflows/ossar-analysis.yml deleted file mode 100644 index e047f4c9..00000000 --- a/.github/workflows/ossar-analysis.yml +++ /dev/null @@ -1,45 +0,0 @@ -# This workflow integrates a collection of open source static analysis tools -# with GitHub code scanning. For documentation, or to provide feedback, visit -# https://github.com/github/ossar-action -name: OSSAR - -on: - push: - pull_request: - -jobs: - OSSAR-Scan: - # OSSAR runs on windows-latest. - # ubuntu-latest and macos-latest support coming soon - runs-on: windows-latest - - steps: - # Checkout your code repository to scan - - name: Checkout repository - uses: actions/checkout@v2 - with: - # We must fetch at least the immediate parents so that if this is - # a pull request then we can checkout the head. - fetch-depth: 2 - - # If this run was triggered by a pull request event, then checkout - # the head of the pull request instead of the merge commit. - - run: git checkout HEAD^2 - if: ${{ github.event_name == 'pull_request' }} - - # Install dotnet, used by OSSAR - - name: Install .NET - uses: actions/setup-dotnet@v1 - with: - dotnet-version: '3.1.201' - - # Run open source static analysis tools - - name: Run OSSAR - uses: github/ossar-action@v1 - id: ossar - - # Upload results to the Security tab - - name: Upload OSSAR results - uses: github/codeql-action/upload-sarif@v1 - with: - sarif_file: ${{ steps.ossar.outputs.sarifFile }} From ab7b4c4a91ae1d24af09d11c8e55cc0a085a5120 Mon Sep 17 00:00:00 2001 From: jliddev Date: Mon, 24 Aug 2020 22:26:31 -0500 Subject: [PATCH 6/8] Update codeql-analysis.yml --- .github/workflows/codeql-analysis.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml index 931e3193..491e5a66 100644 --- a/.github/workflows/codeql-analysis.yml +++ b/.github/workflows/codeql-analysis.yml @@ -31,8 +31,8 @@ jobs: - name: Initialize CodeQL uses: github/codeql-action/init@v1 # Override language selection by uncommenting this and choosing your languages - # with: - # languages: go, javascript, csharp, python, cpp, java + with: + languages: csharp # Autobuild attempts to build any compiled languages (C/C++, C#, or Java). # If this step fails, then you should remove it and run the build manually (see below) From 2160d1af4dd9dd0da901e085a8e3560cd57c54ad Mon Sep 17 00:00:00 2001 From: jliddev Date: Tue, 25 Aug 2020 12:23:04 -0500 Subject: [PATCH 7/8] Update README.md --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 31039507..c3848210 100644 --- a/README.md +++ b/README.md @@ -1,5 +1,5 @@

- +

[![WowUp on Discord](https://img.shields.io/static/v1?label=Discord&message=WowUp&color=7289DA)](https://discord.gg/rk4F5aD) From e5c15700250936306a08cd3ccac766f822fede3e Mon Sep 17 00:00:00 2001 From: jliddev Date: Sun, 30 Aug 2020 19:57:30 -0500 Subject: [PATCH 8/8] Update FUNDING.yml --- .github/FUNDING.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/FUNDING.yml b/.github/FUNDING.yml index eadc9b69..63288f4f 100644 --- a/.github/FUNDING.yml +++ b/.github/FUNDING.yml @@ -1 +1,2 @@ -patreon: jliddev \ No newline at end of file +github: [jliddev] +patreon: jliddev