Skip to content

Commit 81871af

Browse files
ashishkurmiashishkurmi
committed
First commit
0 parents  commit 81871af

29 files changed

Lines changed: 6107 additions & 0 deletions

‎.github/ISSUE_TEMPLATE/bug_report.yml‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
name: Bug Report
2+
description: Report a bug in StepSecurity Dev Machine Guard
3+
title: "[Bug]: "
4+
labels: ["bug"]
5+
body:
6+
- type: markdown
7+
attributes:
8+
value: |
9+
Thanks for taking the time to report a bug! Please fill out the information below.
10+
- type: input
11+
id: version
12+
attributes:
13+
label: Script Version
14+
description: "Run: ./stepsecurity-dev-machine-guard.sh --version"
15+
placeholder: "1.8.1"
16+
validations:
17+
required: true
18+
- type: input
19+
id: macos-version
20+
attributes:
21+
label: macOS Version
22+
description: "Run: sw_vers -productVersion"
23+
placeholder: "15.2"
24+
validations:
25+
required: true
26+
- type: input
27+
id: command
28+
attributes:
29+
label: Command Run
30+
description: The exact command you ran
31+
placeholder: "./stepsecurity-dev-machine-guard.sh --json"
32+
validations:
33+
required: true
34+
- type: textarea
35+
id: expected
36+
attributes:
37+
label: Expected Behavior
38+
description: What you expected to happen
39+
validations:
40+
required: true
41+
- type: textarea
42+
id: actual
43+
attributes:
44+
label: Actual Behavior
45+
description: What actually happened
46+
validations:
47+
required: true
48+
- type: textarea
49+
id: output
50+
attributes:
51+
label: Output / Error Messages
52+
description: Paste relevant output (use --verbose for more detail)
53+
render: shell
54+
- type: textarea
55+
id: additional
56+
attributes:
57+
label: Additional Context
58+
description: Any other context about the problem

‎.github/ISSUE_TEMPLATE/feature_request.yml‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
name: Feature Request
2+
description: Suggest a new feature for StepSecurity Dev Machine Guard
3+
title: "[Feature]: "
4+
labels: ["enhancement"]
5+
body:
6+
- type: markdown
7+
attributes:
8+
value: |
9+
Thanks for suggesting a feature! Please describe your idea below.
10+
- type: textarea
11+
id: problem
12+
attributes:
13+
label: Problem Description
14+
description: What problem does this feature solve?
15+
validations:
16+
required: true
17+
- type: textarea
18+
id: solution
19+
attributes:
20+
label: Proposed Solution
21+
description: How would you like this to work?
22+
validations:
23+
required: true
24+
- type: textarea
25+
id: alternatives
26+
attributes:
27+
label: Alternatives Considered
28+
description: Any alternative approaches you've considered?
29+
- type: textarea
30+
id: additional
31+
attributes:
32+
label: Additional Context
33+
description: Any other context, screenshots, or examples

‎.github/pull_request_template.md‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
## What does this PR do?
2+
3+
<!-- Brief description of the changes -->
4+
5+
## Type of change
6+
7+
- [ ] Bug fix
8+
- [ ] Enhancement
9+
- [ ] Documentation
10+
11+
## Testing
12+
13+
- [ ] Tested on macOS (version: ___)
14+
- [ ] Script runs without errors: `./stepsecurity-dev-machine-guard.sh --verbose`
15+
- [ ] JSON output is valid: `./stepsecurity-dev-machine-guard.sh --json | python3 -m json.tool`
16+
- [ ] No secrets or credentials included
17+
- [ ] ShellCheck passes (if script was modified)
18+
19+
## Related Issues
20+
21+
<!-- Link any related issues: Fixes #123, Closes #456 -->

‎.github/workflows/release.yml‎

Lines changed: 91 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,91 @@
1+
name: Release
2+
3+
on:
4+
workflow_dispatch:
5+
6+
permissions: {}
7+
8+
jobs:
9+
release:
10+
name: Build, Sign & Release
11+
runs-on: ubuntu-latest
12+
environment: release
13+
permissions:
14+
contents: write # create tag, release, and upload assets
15+
id-token: write # Sigstore OIDC keyless signing
16+
attestations: write # SLSA build provenance
17+
18+
steps:
19+
- name: Harden the runner (Audit all outbound calls)
20+
uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
21+
with:
22+
egress-policy: audit
23+
24+
- name: Checkout repository
25+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
26+
27+
- name: Extract version from script
28+
id: version
29+
run: |
30+
version=$(grep -m1 '^AGENT_VERSION=' stepsecurity-dev-machine-guard.sh | sed 's/AGENT_VERSION="//;s/"//')
31+
if [ -z "$version" ]; then
32+
echo "::error::Could not extract AGENT_VERSION from script"
33+
exit 1
34+
fi
35+
tag="v${version}"
36+
echo "version=${version}" >> "$GITHUB_OUTPUT"
37+
echo "tag=${tag}" >> "$GITHUB_OUTPUT"
38+
echo "Detected version: ${version} (tag: ${tag})"
39+
40+
- name: Check tag does not already exist
41+
run: |
42+
if git rev-parse "refs/tags/${{ steps.version.outputs.tag }}" >/dev/null 2>&1; then
43+
echo "::error::Tag ${{ steps.version.outputs.tag }} already exists. Bump AGENT_VERSION in the script before releasing."
44+
exit 1
45+
fi
46+
47+
- name: Install cosign
48+
uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0
49+
50+
- name: Sign script with Sigstore (keyless)
51+
run: |
52+
cosign sign-blob stepsecurity-dev-machine-guard.sh \
53+
--bundle stepsecurity-dev-machine-guard.sh.bundle \
54+
--yes
55+
56+
- name: Verify signature
57+
run: |
58+
cosign verify-blob stepsecurity-dev-machine-guard.sh \
59+
--bundle stepsecurity-dev-machine-guard.sh.bundle \
60+
--certificate-identity-regexp "github.com/step-security/dev-machine-guard" \
61+
--certificate-oidc-issuer "https://token.actions.githubusercontent.com"
62+
63+
- name: Generate checksums
64+
run: |
65+
sha256sum stepsecurity-dev-machine-guard.sh > checksums.txt
66+
sha256sum stepsecurity-dev-machine-guard.sh.bundle >> checksums.txt
67+
echo "Checksums:"
68+
cat checksums.txt
69+
70+
- name: Create tag
71+
run: |
72+
git config user.name "github-actions[bot]"
73+
git config user.email "github-actions[bot]@users.noreply.github.com"
74+
git tag -a "${{ steps.version.outputs.tag }}" -m "Release ${{ steps.version.outputs.tag }}"
75+
git push origin "${{ steps.version.outputs.tag }}"
76+
77+
- name: Create GitHub Release
78+
uses: step-security/action-gh-release@d45511d7589f080cf54961ff056b9705a74fd160 # v2.5.0
79+
with:
80+
tag_name: ${{ steps.version.outputs.tag }}
81+
name: ${{ steps.version.outputs.tag }}
82+
generate_release_notes: true
83+
files: |
84+
stepsecurity-dev-machine-guard.sh
85+
stepsecurity-dev-machine-guard.sh.bundle
86+
checksums.txt
87+
88+
- name: Attest build provenance
89+
uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4.1.0
90+
with:
91+
subject-path: stepsecurity-dev-machine-guard.sh

‎.github/workflows/shellcheck.yml‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
name: ShellCheck
2+
3+
on:
4+
push:
5+
branches: [main]
6+
paths:
7+
- '*.sh'
8+
pull_request:
9+
branches: [main]
10+
paths:
11+
- '*.sh'
12+
13+
permissions: {}
14+
15+
jobs:
16+
shellcheck:
17+
permissions:
18+
contents: read # for actions/checkout to fetch code
19+
name: ShellCheck
20+
runs-on: ubuntu-latest
21+
steps:
22+
- name: Harden the runner (Audit all outbound calls)
23+
uses: step-security/harden-runner@a90bcbc6539c36a85cdfeb73f7e2f433735f215b # v2.15.0
24+
with:
25+
egress-policy: audit
26+
27+
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
28+
29+
- name: Run ShellCheck
30+
uses: ludeeus/action-shellcheck@00cae500b08a931fb5698e11e79bfbd38e612a38 # 2.0.0
31+
env:
32+
# SC2155: "Declare and assign separately" - suppressed because the script
33+
# uses `local var=$(...)` extensively for readability. The exit codes from
34+
# these assignments are intentionally not checked (failures are handled
35+
# by downstream empty-string checks instead).
36+
# SC2034: "Variable appears unused" - suppressed because detection arrays
37+
# and config variables are read via IFS splitting and indirect expansion,
38+
# which ShellCheck cannot trace.
39+
SHELLCHECK_OPTS: '--exclude=SC2155,SC2034'
40+
with:
41+
scandir: '.'
42+
severity: warning

‎.github/workflows/test.yml‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
name: Smoke Tests
2+
3+
on:
4+
push:
5+
branches: [main]
6+
paths:
7+
- '*.sh'
8+
- 'tests/**'
9+
pull_request:
10+
branches: [main]
11+
paths:
12+
- '*.sh'
13+
- 'tests/**'
14+
15+
permissions: {}
16+
17+
jobs:
18+
smoke-tests:
19+
permissions:
20+
contents: read # for actions/checkout to fetch code
21+
name: Smoke Tests
22+
runs-on: macos-latest
23+
steps:
24+
- name: Harden the runner (Audit all outbound calls)
25+
uses: step-security/harden-runner@a90bcbc6539c36a85cdfeb73f7e2f433735f215b # v2.15.0
26+
with:
27+
egress-policy: audit
28+
29+
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
30+
31+
- name: Run smoke tests
32+
run: bash tests/test_smoke.sh

‎.gitignore‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
# macOS
2+
.DS_Store
3+
.AppleDouble
4+
.LSOverride
5+
6+
# Editor files
7+
*.swp
8+
*.swo
9+
*~
10+
.vscode/
11+
.idea/
12+
.claude/
13+
14+
# Output files
15+
*.log
16+
*.html
17+
!docs/**/*.html
18+
!images/**/*.html
19+
20+
# Temporary files
21+
todo-remove/

‎CHANGELOG.md‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
# Changelog
2+
3+
All notable changes to this project will be documented in this file.
4+
5+
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
6+
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
7+
8+
See [VERSIONING.md](VERSIONING.md) for why the version starts at 1.8.1.
9+
10+
## [1.8.1] - 2026-03-10
11+
12+
First open-source release. The scanning engine was previously an internal enterprise tool (v1.0.0-v1.8.1) running in production. This release adds community mode for local-only scanning while keeping the enterprise codebase intact.
13+
14+
### Added
15+
- **Community mode** with three output formats: pretty terminal, JSON, and HTML report
16+
- **AI agent and CLI tool detection**: Claude Code, Codex, Gemini CLI, Kiro, Aider, OpenCode, and more
17+
- **General-purpose AI agent detection**: OpenClaw, ClawdBot, GPT-Engineer, Claude Cowork
18+
- **AI framework detection**: Ollama, LM Studio, LocalAI, Text Generation WebUI
19+
- **MCP server config auditing** across Claude Desktop, Claude Code, Cursor, Windsurf, Antigravity, Zed, Open Interpreter, and Codex
20+
- **IDE extension scanning** for VS Code and Cursor (with publisher, version, and install date)
21+
- **Node.js package scanning** for npm, yarn, pnpm, and bun (opt-in in community mode)
22+
- CLI flags: `--pretty`, `--json`, `--html FILE`, `--verbose`, `--enable-npm-scan`, `--color=WHEN`
23+
- Documentation: community mode guide, enterprise mode guide, MCP audit guide, adding detections guide, reading scan results guide
24+
- GitHub issue templates for bugs, feature requests, and new detections
25+
- ShellCheck CI workflow with Harden-Runner
26+
27+
### Changed
28+
- Enterprise config variables are now clearly labeled and placed below the community-facing header
29+
- Progress messages suppressed by default in community mode (enable with `--verbose`)
30+
- Node.js scanning off by default in community mode (enable with `--enable-npm-scan`)
31+
32+
### Enterprise (unchanged from v1.8.1)
33+
- `install`, `uninstall`, and `send-telemetry` commands
34+
- Launchd scheduling (LaunchDaemon for root, LaunchAgent for user)
35+
- S3 presigned URL upload with backend notification
36+
- Execution log capture and base64 encoding
37+
- Instance locking to prevent concurrent runs
38+
39+
[1.8.1]: https://github.com/step-security/dev-machine-guard/releases/tag/v1.8.1

0 commit comments

Comments
 (0)