Skip to content

Commit 8a061c4

Browse files
PrimeBuild-pcPrimeBuild-pc
committed
chore: initial enterprise setup - governance, CI/CD, security hardening batch 1
1 parent 4d0642d commit 8a061c4

40 files changed

Lines changed: 3632 additions & 266 deletions

‎.editorconfig‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
root = true
2+
3+
[*]
4+
charset = utf-8
5+
end_of_line = crlf
6+
insert_final_newline = true
7+
trim_trailing_whitespace = true
8+
indent_style = space
9+
indent_size = 4
10+
11+
[*.{cs,csx}]
12+
dotnet_sort_system_directives_first = true
13+
dotnet_separate_import_directive_groups = false
14+
csharp_new_line_before_open_brace = all
15+
csharp_style_var_for_built_in_types = false:suggestion
16+
csharp_style_var_when_type_is_apparent = false:suggestion
17+
csharp_style_var_elsewhere = false:suggestion
18+
csharp_prefer_braces = true:warning
19+
dotnet_style_qualification_for_field = false:suggestion
20+
dotnet_style_qualification_for_property = false:suggestion
21+
dotnet_style_qualification_for_method = false:suggestion
22+
dotnet_style_qualification_for_event = false:suggestion
23+
dotnet_style_object_initializer = true:suggestion
24+
dotnet_style_collection_initializer = true:suggestion
25+
dotnet_style_predefined_type_for_locals_parameters_members = true:suggestion
26+
dotnet_style_predefined_type_for_member_access = true:suggestion
27+
28+
[*.xaml]
29+
indent_size = 2
30+
31+
[*.md]
32+
trim_trailing_whitespace = false

‎.github/CODEOWNERS‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
* @PrimeBuild-pc
2+
3+
# Core system and process management
4+
/Services/ @PrimeBuild-pc
5+
/ViewModels/ @PrimeBuild-pc
6+
/Platforms/ @PrimeBuild-pc
7+
8+
# Build and release
9+
/.github/workflows/ @PrimeBuild-pc
10+
/build-release.ps1 @PrimeBuild-pc
11+
/setup.iss @PrimeBuild-pc

‎.github/ISSUE_TEMPLATE/bug_report.yml‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
name: Bug Report
2+
description: Report a reproducible bug in ThreadPilot
3+
labels: [bug]
4+
body:
5+
- type: markdown
6+
attributes:
7+
value: |
8+
Please include clear reproduction steps and environment details.
9+
- type: input
10+
id: version
11+
attributes:
12+
label: Version
13+
placeholder: 1.1.0
14+
validations:
15+
required: true
16+
- type: dropdown
17+
id: os
18+
attributes:
19+
label: Windows Version
20+
options:
21+
- Windows 11
22+
- Windows 10 22H2+
23+
validations:
24+
required: true
25+
- type: textarea
26+
id: steps
27+
attributes:
28+
label: Reproduction Steps
29+
description: Step-by-step instructions to reproduce the issue
30+
validations:
31+
required: true
32+
- type: textarea
33+
id: expected
34+
attributes:
35+
label: Expected Behavior
36+
validations:
37+
required: true
38+
- type: textarea
39+
id: actual
40+
attributes:
41+
label: Actual Behavior
42+
validations:
43+
required: true
44+
- type: textarea
45+
id: logs
46+
attributes:
47+
label: Logs and Diagnostics
48+
description: Include relevant app logs and stack traces

‎.github/ISSUE_TEMPLATE/config.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
blank_issues_enabled: false
2+
contact_links:
3+
- name: Security Report
4+
url: https://github.com/PrimeBuild-pc/ThreadPilot/security/advisories/new
5+
about: Report vulnerabilities privately using GitHub Security Advisories.

‎.github/ISSUE_TEMPLATE/feature_request.yml‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
name: Feature Request
2+
description: Suggest an improvement for ThreadPilot
3+
labels: [enhancement]
4+
body:
5+
- type: textarea
6+
id: problem
7+
attributes:
8+
label: Problem Statement
9+
description: What problem are you trying to solve?
10+
validations:
11+
required: true
12+
- type: textarea
13+
id: proposal
14+
attributes:
15+
label: Proposed Solution
16+
description: Describe your preferred solution
17+
validations:
18+
required: true
19+
- type: textarea
20+
id: alternatives
21+
attributes:
22+
label: Alternatives Considered
23+
- type: textarea
24+
id: impact
25+
attributes:
26+
label: Impact Areas
27+
description: Process management, affinity, power plans, UI, performance, etc.

‎.github/PULL_REQUEST_TEMPLATE.md‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
## Summary
2+
3+
Describe what changed and why.
4+
5+
## Type of Change
6+
- [ ] Bug fix
7+
- [ ] Feature
8+
- [ ] Refactor
9+
- [ ] Documentation
10+
- [ ] Security hardening
11+
- [ ] Performance improvement
12+
13+
## Validation
14+
- [ ] Built Debug and Release successfully
15+
- [ ] Ran automated tests
16+
- [ ] Verified impacted UI flows
17+
- [ ] Verified no secrets/credentials introduced
18+
19+
## Security and Risk Notes
20+
List any impact on elevation, process control, power plan operations, or persisted configuration.
21+
22+
## Checklist
23+
- [ ] Updated docs where relevant
24+
- [ ] Added or updated tests where relevant
25+
- [ ] Kept changes scoped and backwards compatible where possible

‎.github/dependabot.yml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
version: 2
2+
updates:
3+
- package-ecosystem: nuget
4+
directory: /
5+
schedule:
6+
interval: weekly
7+
open-pull-requests-limit: 10
8+
labels:
9+
- dependencies
10+
- security

‎.github/workflows/ci-devsecops.yml‎

Lines changed: 39 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -4,9 +4,14 @@ on:
44
push:
55
branches: ["main", "master"]
66
pull_request:
7+
workflow_dispatch:
8+
9+
permissions:
10+
contents: read
11+
actions: read
712

813
jobs:
9-
build-and-scan:
14+
build-test-scan:
1015
runs-on: windows-latest
1116

1217
steps:
@@ -19,42 +24,63 @@ jobs:
1924
dotnet-version: "8.0.x"
2025

2126
- name: Restore
22-
run: dotnet restore "ThreadPilot.csproj"
27+
run: dotnet restore "ThreadPilot_1.sln"
28+
29+
- name: Verify formatting
30+
continue-on-error: true
31+
run: dotnet format "ThreadPilot_1.sln" --verify-no-changes --verbosity diagnostic --report dotnet-format-report.json
2332

2433
- name: Build Debug
25-
run: dotnet build "ThreadPilot.csproj" --configuration Debug --no-restore
34+
run: dotnet build "ThreadPilot_1.sln" --configuration Debug --no-restore
2635

2736
- name: Build Release
28-
run: dotnet build "ThreadPilot.csproj" --configuration Release --no-restore
37+
run: dotnet build "ThreadPilot_1.sln" --configuration Release --no-restore
2938

30-
- name: Dependency Audit
31-
run: dotnet list "ThreadPilot.csproj" package --vulnerable --include-transitive
39+
- name: Run tests
40+
run: dotnet test "ThreadPilot_1.sln" --configuration Release --no-build --verbosity normal
3241

33-
- name: Secret Scan (Gitleaks)
42+
- name: Dependency vulnerability audit
3443
shell: pwsh
3544
run: |
3645
$ErrorActionPreference = "Stop"
46+
$audit = dotnet list "ThreadPilot.csproj" package --vulnerable --include-transitive
47+
$audit | Out-String | Write-Host
48+
49+
if ($LASTEXITCODE -ne 0) {
50+
throw "dotnet list package --vulnerable failed."
51+
}
52+
53+
if ($audit -match "has the following vulnerable packages") {
54+
throw "Vulnerable packages detected."
55+
}
3756
57+
- name: Secret scan (Gitleaks)
58+
shell: pwsh
59+
run: |
60+
$ErrorActionPreference = "Stop"
3861
$version = "8.24.3"
3962
$baseUrl = "https://github.com/gitleaks/gitleaks/releases/download/v$version"
4063
$zipAsset = "gitleaks_${version}_windows_x64.zip"
4164
$tarAsset = "gitleaks_${version}_windows_x64.tar.gz"
4265
43-
Write-Host "Installing Gitleaks v$version"
44-
4566
try {
4667
Invoke-WebRequest -Uri "$baseUrl/$zipAsset" -OutFile "gitleaks.zip"
4768
Expand-Archive -Path "gitleaks.zip" -DestinationPath ".\\gitleaks-bin" -Force
4869
}
4970
catch {
50-
Write-Host "ZIP download failed, trying tar.gz fallback"
5171
Invoke-WebRequest -Uri "$baseUrl/$tarAsset" -OutFile "gitleaks.tar.gz"
5272
New-Item -ItemType Directory -Force -Path ".\\gitleaks-bin" | Out-Null
5373
tar -xzf "gitleaks.tar.gz" -C ".\\gitleaks-bin"
5474
}
5575
5676
$gitleaksExe = Resolve-Path ".\\gitleaks-bin\\gitleaks.exe"
57-
& $gitleaksExe version
77+
& $gitleaksExe detect --source "." --redact --verbose --report-format json --report-path gitleaks-report.json
5878
59-
# Scan working tree for hardcoded secrets.
60-
& $gitleaksExe detect --source "." --redact --verbose
79+
- name: Upload security artifacts
80+
if: always()
81+
uses: actions/upload-artifact@v4
82+
with:
83+
name: security-reports
84+
path: |
85+
gitleaks-report.json
86+
dotnet-format-report.json

‎.github/workflows/dotnet-desktop.yml‎

Lines changed: 2 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,7 @@
1-
name: .NET Build
1+
name: .NET Compatibility Build
22

33
on:
4-
push:
5-
branches: [ "main" ]
6-
pull_request:
7-
branches: [ "main" ]
4+
workflow_dispatch:
85

96
jobs:
107
build:

‎.github/workflows/release.yml‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
name: Release
2+
3+
on:
4+
push:
5+
tags:
6+
- "v*.*.*"
7+
workflow_dispatch:
8+
9+
permissions:
10+
contents: write
11+
12+
jobs:
13+
build-and-release:
14+
runs-on: windows-latest
15+
16+
steps:
17+
- name: Checkout
18+
uses: actions/checkout@v4
19+
20+
- name: Setup .NET
21+
uses: actions/setup-dotnet@v4
22+
with:
23+
dotnet-version: "8.0.x"
24+
25+
- name: Restore
26+
run: dotnet restore "ThreadPilot_1.sln"
27+
28+
- name: Build
29+
run: dotnet build "ThreadPilot_1.sln" --configuration Release --no-restore
30+
31+
- name: Publish self-contained app
32+
run: dotnet publish "ThreadPilot.csproj" --configuration Release --runtime win-x64 --self-contained true -o artifacts/release/win-x64
33+
34+
- name: Create release package
35+
shell: pwsh
36+
run: |
37+
$ErrorActionPreference = "Stop"
38+
$version = "${{ github.ref_name }}"
39+
$zipName = "ThreadPilot_$version`_win-x64.zip"
40+
Compress-Archive -Path "artifacts/release/win-x64/*" -DestinationPath "artifacts/release/$zipName" -Force
41+
42+
- name: Generate checksums
43+
shell: pwsh
44+
run: |
45+
$ErrorActionPreference = "Stop"
46+
$hashFile = "artifacts/release/SHA256SUMS.txt"
47+
Get-ChildItem "artifacts/release" -File | ForEach-Object {
48+
$hash = Get-FileHash $_.FullName -Algorithm SHA256
49+
"$($hash.Hash) $($_.Name)" | Out-File -FilePath $hashFile -Append -Encoding utf8
50+
}
51+
52+
- name: Publish GitHub release
53+
uses: softprops/action-gh-release@v2
54+
with:
55+
files: |
56+
artifacts/release/*.zip
57+
artifacts/release/SHA256SUMS.txt
58+
generate_release_notes: true

0 commit comments

Comments
 (0)