From dc64045c1d353f82f7e26df9c0e3bc95d8d63fd5 Mon Sep 17 00:00:00 2001 From: Tiffany D Atkins Date: Mon, 5 May 2025 22:45:34 -0400 Subject: [PATCH 01/17] Create blank.yml --- .github/workflows/blank.yml | 36 ++++++++++++++++++++++++++++++++++++ 1 file changed, 36 insertions(+) create mode 100644 .github/workflows/blank.yml diff --git a/.github/workflows/blank.yml b/.github/workflows/blank.yml new file mode 100644 index 00000000..01502b13 --- /dev/null +++ b/.github/workflows/blank.yml @@ -0,0 +1,36 @@ +# This is a basic workflow to help you get started with Actions + +name: CI + +# Controls when the workflow will run +on: + # Triggers the workflow on push or pull request events but only for the "main" branch + push: + branches: [ "main" ] + pull_request: + branches: [ "main" ] + + # Allows you to run this workflow manually from the Actions tab + workflow_dispatch: + +# A workflow run is made up of one or more jobs that can run sequentially or in parallel +jobs: + # This workflow contains a single job called "build" + build: + # The type of runner that the job will run on + runs-on: ubuntu-latest + + # Steps represent a sequence of tasks that will be executed as part of the job + steps: + # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it + - uses: actions/checkout@v4 + + # Runs a single command using the runners shell + - name: Run a one-line script + run: echo Hello, world! + + # Runs a set of commands using the runners shell + - name: Run a multi-line script + run: | + echo Add other actions to build, + echo test, and deploy your project. From 5f5d0e7bce1756c9477b05d5dc0801d29f68d811 Mon Sep 17 00:00:00 2001 From: Tiffany D Atkins Date: Sun, 8 Jun 2025 23:41:27 -0400 Subject: [PATCH 02/17] Update SECURITY.md --- SECURITY.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/SECURITY.md b/SECURITY.md index d9a8762b..090713b7 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -4,7 +4,7 @@ Thanks for helping make GitHub safe for everyone. GitHub takes the security of our software products and services seriously, including all of the open source code repositories managed through our GitHub organizations, such as [GitHub](https://github.com/GitHub). -Even though [open source repositories are outside of the scope of our bug bounty program](https://bounty.github.com/index.html#scope) and therefore not eligible for bounty rewards, we will ensure that your finding gets passed along to the appropriate maintainers for remediation. +Even though [open source repositories are outside of the scope of our bug bounty program](https://bounty.github.com/index.html#scope) and therefore not eligible for bounty rewards,we will ensure that your finding gets passed along to the appropriate maintainers for remediation. ## Reporting Security Issues From b80dad4259c0ca9a0a6bdd37198c46f6559f12fd Mon Sep 17 00:00:00 2001 From: Tiffany D Atkins Date: Sun, 8 Jun 2025 23:45:18 -0400 Subject: [PATCH 03/17] Update blank.yml --- .github/workflows/blank.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/blank.yml b/.github/workflows/blank.yml index 01502b13..a792db87 100644 --- a/.github/workflows/blank.yml +++ b/.github/workflows/blank.yml @@ -1,6 +1,6 @@ # This is a basic workflow to help you get started with Actions -name: CI +name:CI # Controls when the workflow will run on: From 972fd106b2c89e438a579b96f2a7efab784c3867 Mon Sep 17 00:00:00 2001 From: Tiffany D Atkins Date: Sun, 15 Jun 2025 17:52:52 -0400 Subject: [PATCH 04/17] Update SECURITY.md --- SECURITY.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/SECURITY.md b/SECURITY.md index d9a8762b..8c5556ae 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -1,4 +1,4 @@ -Thanks for helping make GitHub safe for everyone. +Thanks for helping make GitHub safe for everyone ## Security From 3a399e378e60bb8e3ff36740e3f99b22c32a1680 Mon Sep 17 00:00:00 2001 From: Tiffany D Atkins Date: Sun, 15 Jun 2025 17:53:48 -0400 Subject: [PATCH 05/17] Create codeql.yml --- .github/workflows/codeql.yml | 98 ++++++++++++++++++++++++++++++++++++ 1 file changed, 98 insertions(+) create mode 100644 .github/workflows/codeql.yml diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml new file mode 100644 index 00000000..23331b26 --- /dev/null +++ b/.github/workflows/codeql.yml @@ -0,0 +1,98 @@ +# For most projects, this workflow file will not need changing; you simply need +# to commit it to your repository. +# +# You may wish to alter this file to override the set of languages analyzed, +# or to provide custom queries or build logic. +# +# ******** NOTE ******** +# We have attempted to detect the languages in your repository. Please check +# the `language` matrix defined below to confirm you have the correct set of +# supported CodeQL languages. +# +name: "CodeQL Advanced" + +on: + push: + branches: [ "main" ] + pull_request: + branches: [ "main" ] + schedule: + - cron: '27 3 * * 5' + +jobs: + analyze: + name: Analyze (${{ matrix.language }}) + # Runner size impacts CodeQL analysis time. To learn more, please see: + # - https://gh.io/recommended-hardware-resources-for-running-codeql + # - https://gh.io/supported-runners-and-hardware-resources + # - https://gh.io/using-larger-runners (GitHub.com only) + # Consider using larger runners or machines with greater resources for possible analysis time improvements. + runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }} + permissions: + # required for all workflows + security-events: write + + # required to fetch internal or private CodeQL packs + packages: read + + # only required for workflows in private repositories + actions: read + contents: read + + strategy: + fail-fast: false + matrix: + include: + - language: actions + build-mode: none + # CodeQL supports the following values keywords for 'language': 'actions', 'c-cpp', 'csharp', 'go', 'java-kotlin', 'javascript-typescript', 'python', 'ruby', 'swift' + # Use `c-cpp` to analyze code written in C, C++ or both + # Use 'java-kotlin' to analyze code written in Java, Kotlin or both + # Use 'javascript-typescript' to analyze code written in JavaScript, TypeScript or both + # To learn more about changing the languages that are analyzed or customizing the build mode for your analysis, + # see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning. + # If you are analyzing a compiled language, you can modify the 'build-mode' for that language to customize how + # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages + steps: + - name: Checkout repository + uses: actions/checkout@v4 + + # Add any setup steps before running the `github/codeql-action/init` action. + # This includes steps like installing compilers or runtimes (`actions/setup-node` + # or others). This is typically only required for manual builds. + # - name: Setup runtime (example) + # uses: actions/setup-example@v1 + + # Initializes the CodeQL tools for scanning. + - name: Initialize CodeQL + uses: github/codeql-action/init@v3 + with: + languages: ${{ matrix.language }} + build-mode: ${{ matrix.build-mode }} + # If you wish to specify custom queries, you can do so here or in a config file. + # By default, queries listed here will override any specified in a config file. + # Prefix the list here with "+" to use these queries and those in the config file. + + # For more details on CodeQL's query packs, refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs + # queries: security-extended,security-and-quality + + # If the analyze step fails for one of the languages you are analyzing with + # "We were unable to automatically build your code", modify the matrix above + # to set the build mode to "manual" for that language. Then modify this step + # to build your code. + # ℹī¸ Command-line programs to run using the OS shell. + # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun + - if: matrix.build-mode == 'manual' + shell: bash + run: | + echo 'If you are using a "manual" build mode for one or more of the' \ + 'languages you are analyzing, replace this with the commands to build' \ + 'your code, for example:' + echo ' make bootstrap' + echo ' make release' + exit 1 + + - name: Perform CodeQL Analysis + uses: github/codeql-action/analyze@v3 + with: + category: "/language:${{matrix.language}}" From e338e79c7aedbb1ae79245629903bf7491b7d235 Mon Sep 17 00:00:00 2001 From: Tiffany D Atkins Date: Tue, 24 Jun 2025 23:38:39 -0400 Subject: [PATCH 06/17] Update SECURITY.md --- SECURITY.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/SECURITY.md b/SECURITY.md index 090713b7..d9a8762b 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -4,7 +4,7 @@ Thanks for helping make GitHub safe for everyone. GitHub takes the security of our software products and services seriously, including all of the open source code repositories managed through our GitHub organizations, such as [GitHub](https://github.com/GitHub). -Even though [open source repositories are outside of the scope of our bug bounty program](https://bounty.github.com/index.html#scope) and therefore not eligible for bounty rewards,we will ensure that your finding gets passed along to the appropriate maintainers for remediation. +Even though [open source repositories are outside of the scope of our bug bounty program](https://bounty.github.com/index.html#scope) and therefore not eligible for bounty rewards, we will ensure that your finding gets passed along to the appropriate maintainers for remediation. ## Reporting Security Issues From ebdc44be3d1a8f9f01aae53af7b338862af7aa33 Mon Sep 17 00:00:00 2001 From: Tiffany D Atkins Date: Thu, 3 Jul 2025 05:22:31 -0400 Subject: [PATCH 07/17] Update SECURITY.md --- SECURITY.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/SECURITY.md b/SECURITY.md index 8c5556ae..020fb001 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -1,6 +1,6 @@ Thanks for helping make GitHub safe for everyone -## Security +## Security ## GitHub takes the security of our software products and services seriously, including all of the open source code repositories managed through our GitHub organizations, such as [GitHub](https://github.com/GitHub). From 54ba32dee65c290aab10f3e7532abb357181d4ba Mon Sep 17 00:00:00 2001 From: Tiffany D Atkins Date: Sun, 13 Jul 2025 01:00:01 -0400 Subject: [PATCH 08/17] Update SECURITY.md --- SECURITY.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/SECURITY.md b/SECURITY.md index 020fb001..698d2618 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -1,4 +1,4 @@ -Thanks for helping make GitHub safe for everyone +Thanks for helping make GitHub safe for everyone. ## Security ## From 188364b6a9990f3fed7d0080715846d6074a7f67 Mon Sep 17 00:00:00 2001 From: Tiffany D Atkins Date: Tue, 5 Aug 2025 04:46:30 -0400 Subject: [PATCH 09/17] Update SECURITY.md Signed-off-by: Tiffany D Atkins --- SECURITY.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/SECURITY.md b/SECURITY.md index 698d2618..27489695 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -1,6 +1,6 @@ Thanks for helping make GitHub safe for everyone. -## Security ## +# Security # GitHub takes the security of our software products and services seriously, including all of the open source code repositories managed through our GitHub organizations, such as [GitHub](https://github.com/GitHub). From bad7aa66777142c6c125f8eafe91ed7a5e04adaf Mon Sep 17 00:00:00 2001 From: Tiffany D Atkins Date: Tue, 19 Aug 2025 18:41:49 -0400 Subject: [PATCH 10/17] Update blank.yml Signed-off-by: Tiffany D Atkins --- .github/workflows/blank.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/blank.yml b/.github/workflows/blank.yml index 01502b13..9410403b 100644 --- a/.github/workflows/blank.yml +++ b/.github/workflows/blank.yml @@ -34,3 +34,4 @@ jobs: run: | echo Add other actions to build, echo test, and deploy your project. +# From 69ee54e36e4794975f4b55b676e10bc3ec4f3ed9 Mon Sep 17 00:00:00 2001 From: Tiffany D Atkins Date: Thu, 21 Aug 2025 02:20:44 -0400 Subject: [PATCH 11/17] Update SECURITY.md Signed-off-by: Tiffany D Atkins --- SECURITY.md | 1 + 1 file changed, 1 insertion(+) diff --git a/SECURITY.md b/SECURITY.md index 27489695..ebc8768f 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -29,3 +29,4 @@ This information will help us triage your report more quickly. ## Policy See [GitHub's Safe Harbor Policy](https://docs.github.com/en/site-policy/security-policies/github-bug-bounty-program-legal-safe-harbor) +# From c22048b8a503e949915c927e6edf6d45dfedeeef Mon Sep 17 00:00:00 2001 From: Tiffany D Atkins Date: Wed, 27 Aug 2025 23:54:02 -0400 Subject: [PATCH 12/17] Update SECURITY.md Signed-off-by: Tiffany D Atkins --- SECURITY.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/SECURITY.md b/SECURITY.md index ebc8768f..0f431927 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -29,4 +29,4 @@ This information will help us triage your report more quickly. ## Policy See [GitHub's Safe Harbor Policy](https://docs.github.com/en/site-policy/security-policies/github-bug-bounty-program-legal-safe-harbor) -# + From 4e4b5ac9e84a9a6738d08a6a06d00b0c0339a0bc Mon Sep 17 00:00:00 2001 From: Tiffany D Atkins Date: Sat, 30 Aug 2025 01:55:20 -0400 Subject: [PATCH 13/17] Update SECURITY.md Signed-off-by: Tiffany D Atkins --- SECURITY.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/SECURITY.md b/SECURITY.md index 0f431927..ebc8768f 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -29,4 +29,4 @@ This information will help us triage your report more quickly. ## Policy See [GitHub's Safe Harbor Policy](https://docs.github.com/en/site-policy/security-policies/github-bug-bounty-program-legal-safe-harbor) - +# From 53d73764a31c70a09c68859e3b60de1660e55af9 Mon Sep 17 00:00:00 2001 From: Tiffany D Atkins Date: Sat, 30 Aug 2025 02:23:56 -0400 Subject: [PATCH 14/17] Update SECURITY.md Signed-off-by: Tiffany D Atkins --- SECURITY.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/SECURITY.md b/SECURITY.md index ebc8768f..0f431927 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -29,4 +29,4 @@ This information will help us triage your report more quickly. ## Policy See [GitHub's Safe Harbor Policy](https://docs.github.com/en/site-policy/security-policies/github-bug-bounty-program-legal-safe-harbor) -# + From 1db9d432c858110bb2e9174118b37ce000509928 Mon Sep 17 00:00:00 2001 From: Tiffany D Atkins Date: Mon, 8 Sep 2025 00:39:54 -0400 Subject: [PATCH 15/17] Update SECURITY.md Signed-off-by: Tiffany D Atkins --- SECURITY.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/SECURITY.md b/SECURITY.md index 0f431927..49555897 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -1,6 +1,6 @@ Thanks for helping make GitHub safe for everyone. -# Security # +Security GitHub takes the security of our software products and services seriously, including all of the open source code repositories managed through our GitHub organizations, such as [GitHub](https://github.com/GitHub). From 5d31ef6665258053964f1228079199db199498c7 Mon Sep 17 00:00:00 2001 From: Tiffany D Atkins Date: Sat, 11 Oct 2025 02:16:50 -0400 Subject: [PATCH 16/17] Update SECURITY.md Signed-off-by: Tiffany D Atkins --- SECURITY.md | 1 + 1 file changed, 1 insertion(+) diff --git a/SECURITY.md b/SECURITY.md index 49555897..ddeba0b2 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -1,3 +1,4 @@ +# Thanks for helping make GitHub safe for everyone. Security From 9f9cf4dcaebeea02135f62fc1719c4141ee5e951 Mon Sep 17 00:00:00 2001 From: Tiffany D Atkins Date: Sun, 19 Oct 2025 23:45:03 -0400 Subject: [PATCH 17/17] Remove comment from SECURITY.md Signed-off-by: Tiffany D Atkins --- SECURITY.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/SECURITY.md b/SECURITY.md index ddeba0b2..84efae0d 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -30,4 +30,4 @@ This information will help us triage your report more quickly. ## Policy See [GitHub's Safe Harbor Policy](https://docs.github.com/en/site-policy/security-policies/github-bug-bounty-program-legal-safe-harbor) - +#