From a9f42e32c503521c5cd87670e877d784ea74a4a7 Mon Sep 17 00:00:00 2001 From: Forge Bot Date: Mon, 1 Jun 2026 00:32:04 +0000 Subject: [PATCH 1/4] chore(deps): update actions/setup-dotnet digest to 9a946fd --- .gitea/workflows/build.yml | 2 +- .gitea/workflows/release.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.gitea/workflows/build.yml b/.gitea/workflows/build.yml index acedfca..91e6f21 100644 --- a/.gitea/workflows/build.yml +++ b/.gitea/workflows/build.yml @@ -35,7 +35,7 @@ jobs: uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 - name: Setup .NET 10 - uses: actions/setup-dotnet@c2fa09f4bde5ebb9d1777cf28262a3eb3db3ced7 # v5 + uses: actions/setup-dotnet@9a946fdbd5fb07b82b2f5a4466058b876ab72bb2 # v5 with: dotnet-version: 10.0.x diff --git a/.gitea/workflows/release.yml b/.gitea/workflows/release.yml index 7920761..cb62ee5 100644 --- a/.gitea/workflows/release.yml +++ b/.gitea/workflows/release.yml @@ -54,7 +54,7 @@ jobs: uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 - name: Setup .NET 10 - uses: actions/setup-dotnet@c2fa09f4bde5ebb9d1777cf28262a3eb3db3ced7 # v5 + uses: actions/setup-dotnet@9a946fdbd5fb07b82b2f5a4466058b876ab72bb2 # v5 with: dotnet-version: 10.0.x From 7ef1337ea0285a1741b25a2f98e23175cd396906 Mon Sep 17 00:00:00 2001 From: Forge Bot Date: Sat, 23 May 2026 12:33:12 +0000 Subject: [PATCH 2/4] chore(deps): update minor and patch updates (nuget) --- HellionChat/HellionChat.csproj | 4 ++-- HellionChat/packages.lock.json | 24 ++++++++++++------------ 2 files changed, 14 insertions(+), 14 deletions(-) diff --git a/HellionChat/HellionChat.csproj b/HellionChat/HellionChat.csproj index 208b462..036ed4f 100644 --- a/HellionChat/HellionChat.csproj +++ b/HellionChat/HellionChat.csproj @@ -14,7 +14,7 @@ - + - + diff --git a/HellionChat/packages.lock.json b/HellionChat/packages.lock.json index acf75ef..3240abf 100644 --- a/HellionChat/packages.lock.json +++ b/HellionChat/packages.lock.json @@ -27,11 +27,11 @@ }, "Microsoft.Data.Sqlite": { "type": "Direct", - "requested": "[10.0.7, )", - "resolved": "10.0.7", - "contentHash": "DZ6G2QuyPrsh5VS+wfiZbNBtYT6p+CkxXjD0aZHF04xso7QsG/uk0JpG30hzYlK6u/wtTzta1Dqfgbc/Sl2sDA==", + "requested": "[10.0.8, )", + "resolved": "10.0.8", + "contentHash": "iyDWyD6r/SnqgoYYQIlLhxL1ZIGZr+SByMXrJKSA1w7sOt7bPMJmN3h2laqwKqyQkjh/lUPJ7LTXwpvqzhggOQ==", "dependencies": { - "Microsoft.Data.Sqlite.Core": "10.0.7", + "Microsoft.Data.Sqlite.Core": "10.0.8", "SQLitePCLRaw.bundle_e_sqlite3": "2.1.11", "SQLitePCLRaw.core": "2.1.11" } @@ -104,11 +104,11 @@ }, "NAudio.WinMM": { "type": "Direct", - "requested": "[2.2.1, )", - "resolved": "2.2.1", - "contentHash": "xFHRFwH4x6aq3IxRbewvO33ugJRvZFEOfO62i7uQJRUNW2cnu6BeBTHUS0JD5KBucZbHZaYqxQG8dwZ47ezQuQ==", + "requested": "[2.3.0, )", + "resolved": "2.3.0", + "contentHash": "5G1dRjsZm50T3luyuqcmI2BSvj3K4ZJaD/x776/0Epj88qOsOryDZG40+MufwIk1UFJSFWhRobBqtJYFc8Ss4g==", "dependencies": { - "NAudio.Core": "2.2.1" + "NAudio.Core": "2.3.0" } }, "Pidgin": { @@ -141,8 +141,8 @@ }, "Microsoft.Data.Sqlite.Core": { "type": "Transitive", - "resolved": "10.0.7", - "contentHash": "xVrtBg3M1wJlBDkoT0dXEYB/wSc8bIHJPYtw/bu1AqpWgF79uPSs87DAhERR/Ilumre6TKZa1cjMg3VUUObVLA==", + "resolved": "10.0.8", + "contentHash": "26t7WDiEjjAls/sFpWvVEFDxt+7Q5VPt6+blU2Lafuj9L8PzAv/GtGV4cqVPtrhWbfD2BX/z2v8hD1qXYtK6Aw==", "dependencies": { "SQLitePCLRaw.core": "2.1.11" } @@ -377,8 +377,8 @@ }, "NAudio.Core": { "type": "Transitive", - "resolved": "2.2.1", - "contentHash": "GgkdP6K/7FqXFo7uHvoqGZTJvW4z8g2IffhOO4JHaLzKCdDOUEzVKtveoZkCuUX8eV2HAINqi7VFqlFndrnz/g==" + "resolved": "2.3.0", + "contentHash": "jMd7r6dB6tAtXhOYL58ntPqwERNm1/Rhw5MKOIYvsnXzuX+PTGsa2VMam6n0npZYSwlSidKa4GAm4bFcXFUlcg==" }, "SQLitePCLRaw.bundle_e_sqlite3": { "type": "Transitive", From d50f2cea901e64866df9782a31af2b486efda265 Mon Sep 17 00:00:00 2001 From: Jon Kazama <1+jonkazama-hellion@noreply.gitea.hellion-forge.cloud> Date: Sat, 15 Aug 2026 17:26:51 +0000 Subject: [PATCH 3/4] fix(ci): security-scan inline statt reusable workflow act_runner laedt reusable workflows per git-clone ueber HTTPS. Dieser Pfad ist auf der Forge seit 2026-08-12 defekt (git upload-pack --stateless-rpc bricht mit BUG "packfile_uris requires sideband-all" ab). Die Scans liefen bisher nur ueber eine im Juni gecachte Kopie im Runner. Der Scan steht jetzt vollstaendig in dieser Datei, der Quellstand kommt als tar-Archiv statt ueber actions/checkout. Zurueckbauen, sobald git fetch ueber HTTPS wieder funktioniert. --- .gitea/workflows/security.yml | 81 +++++++++++++++++++++++++++++++---- 1 file changed, 72 insertions(+), 9 deletions(-) diff --git a/.gitea/workflows/security.yml b/.gitea/workflows/security.yml index 0f484d0..2c95d47 100644 --- a/.gitea/workflows/security.yml +++ b/.gitea/workflows/security.yml @@ -1,4 +1,21 @@ name: Security + +# Self-contained security scan: Semgrep SAST + Trivy filesystem scan. +# +# Deliberately NOT calling the reusable workflow in security-workflows: +# act_runner fetches reusable workflows by cloning them over HTTPS, and git +# fetch over HTTPS is broken on this Gitea instance since 2026-08-12 +# (`git upload-pack --stateless-rpc` aborts with +# BUG("packfile_uris requires sideband-all") and dumps core). The runner only +# kept working because it still had a June copy in its action cache. Inlining +# removes that dependency entirely. +# +# For the same reason the sources are pulled as a tar archive instead of via +# actions/checkout. Restore the reusable call once the fetch path is fixed. +# +# Why one job, not two parallel jobs: act_runner v0.6.1 has a race when two +# jobs in the same task share a workspace and chown it in parallel. + on: push: branches: [main, master] @@ -7,14 +24,60 @@ on: - cron: '0 6 * * 1' workflow_dispatch: +env: + TRIVY_SEVERITY: 'CRITICAL,HIGH' + # MessageStore.cs interpoliert SQL-Strings, die plugin-lokal sicher sind; + # Semgrep matcht das Pattern, CodeQL mit Datenflussanalyse nicht. + SEMGREP_EXCLUDE_RULES: 'csharp.lang.security.sqli.csharp-sqli.csharp-sqli' + jobs: scan: - uses: JonKazama-Hellion/security-workflows/.gitea/workflows/security-scan.yml@main - with: - # MessageStore.cs uses string-interpolation in CommandText for table - # names and clause-joins that come from internal code constants, not - # user input. Values are bound via SqlParameter, the SQL surface is - # local-only inside a Dalamud plugin. Semgrep matches the pattern - # without dataflow, so it flags those eight call sites; CodeQL - # would not. Suppressed for this repo only. - semgrep-exclude-rules: 'csharp.lang.security.sqli.csharp-sqli.csharp-sqli' + name: Security Scan + runs-on: ubuntu-latest + steps: + - name: Checkout sources + env: + TOKEN: ${{ github.token }} + # On pull_request the merge SHA may not be archivable, use the head. + REF: ${{ github.event.pull_request.head.sha || github.sha }} + SERVER: ${{ github.server_url }} + REPO: ${{ github.repository }} + run: | + set -eu + echo "Fetching archive for $REPO @ $REF" + curl -sfL --retry 3 --retry-delay 5 \ + -H "Authorization: token $TOKEN" \ + "$SERVER/$REPO/archive/$REF.tar.gz" -o /tmp/source.tar.gz + tar xzf /tmp/source.tar.gz --strip-components=1 + rm -f /tmp/source.tar.gz + echo "Extracted $(find . -type f | wc -l) files" + + - name: Set up Python + uses: actions/setup-python@v6 + with: + python-version: '3.x' + + - name: Install Semgrep + run: pip install --no-cache-dir semgrep + + - name: Install Trivy + # Version pinned so the install script does not hit api.github.com to + # resolve "latest", which burns the runner's unauthenticated rate limit. + # renovate: datasource=github-releases depName=aquasecurity/trivy + run: curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sudo sh -s -- -b /usr/local/bin v0.70.0 + + - name: Run Semgrep SAST + run: | + args="--config=auto --error --severity=ERROR" + if [ -n "$SEMGREP_EXCLUDE_RULES" ]; then + for rule in $(echo "$SEMGREP_EXCLUDE_RULES" | tr ',' ' '); do + args="$args --exclude-rule=$rule" + done + fi + echo "Running: semgrep scan $args" + semgrep scan $args + + - name: Run Trivy filesystem scan + # if: always() — surface Trivy findings even when Semgrep fails first. + if: always() + run: trivy fs --severity "$TRIVY_SEVERITY" --exit-code 1 --ignore-unfixed . From fd8e5a1a17ba52f4aee5c915791a7da061958123 Mon Sep 17 00:00:00 2001 From: Jon Kazama <1+jonkazama-hellion@noreply.gitea.hellion-forge.cloud> Date: Sat, 15 Aug 2026 21:17:43 +0000 Subject: [PATCH 4/4] revert(ci): security-scan wieder ueber den reusable workflow Rueckbau des Inline-Workarounds. Der Runner konnte den reusable workflow nicht mehr laden, weil git fetch gegen die Forge crashte. Ursache war kein Bug, sondern eine Kompromittierung ueber CVE-2026-59774: ein injizierter packObjectsHook ersetzte git pack-objects durch einen Malware-Dropper. Gitea laeuft jetzt auf 1.27.2, der Hook ist entfernt, fetch funktioniert wieder. Die Scan-Definition liegt damit wieder an einer Stelle statt in sieben Dateien. Details: Obsidian "Projekte/Hellion Forge/Forge Security-Incident 2026-08-15.md". --- .gitea/workflows/security.yml | 77 ++++------------------------------- 1 file changed, 7 insertions(+), 70 deletions(-) diff --git a/.gitea/workflows/security.yml b/.gitea/workflows/security.yml index 2c95d47..b37901a 100644 --- a/.gitea/workflows/security.yml +++ b/.gitea/workflows/security.yml @@ -1,20 +1,7 @@ name: Security -# Self-contained security scan: Semgrep SAST + Trivy filesystem scan. -# -# Deliberately NOT calling the reusable workflow in security-workflows: -# act_runner fetches reusable workflows by cloning them over HTTPS, and git -# fetch over HTTPS is broken on this Gitea instance since 2026-08-12 -# (`git upload-pack --stateless-rpc` aborts with -# BUG("packfile_uris requires sideband-all") and dumps core). The runner only -# kept working because it still had a June copy in its action cache. Inlining -# removes that dependency entirely. -# -# For the same reason the sources are pulled as a tar archive instead of via -# actions/checkout. Restore the reusable call once the fetch path is fixed. -# -# Why one job, not two parallel jobs: act_runner v0.6.1 has a race when two -# jobs in the same task share a workspace and chown it in parallel. +# Ruft den zentralen Scan-Workflow in security-workflows auf +# (Semgrep SAST + Trivy filesystem scan). on: push: @@ -24,60 +11,10 @@ on: - cron: '0 6 * * 1' workflow_dispatch: -env: - TRIVY_SEVERITY: 'CRITICAL,HIGH' - # MessageStore.cs interpoliert SQL-Strings, die plugin-lokal sicher sind; - # Semgrep matcht das Pattern, CodeQL mit Datenflussanalyse nicht. - SEMGREP_EXCLUDE_RULES: 'csharp.lang.security.sqli.csharp-sqli.csharp-sqli' - jobs: scan: - name: Security Scan - runs-on: ubuntu-latest - steps: - - name: Checkout sources - env: - TOKEN: ${{ github.token }} - # On pull_request the merge SHA may not be archivable, use the head. - REF: ${{ github.event.pull_request.head.sha || github.sha }} - SERVER: ${{ github.server_url }} - REPO: ${{ github.repository }} - run: | - set -eu - echo "Fetching archive for $REPO @ $REF" - curl -sfL --retry 3 --retry-delay 5 \ - -H "Authorization: token $TOKEN" \ - "$SERVER/$REPO/archive/$REF.tar.gz" -o /tmp/source.tar.gz - tar xzf /tmp/source.tar.gz --strip-components=1 - rm -f /tmp/source.tar.gz - echo "Extracted $(find . -type f | wc -l) files" - - - name: Set up Python - uses: actions/setup-python@v6 - with: - python-version: '3.x' - - - name: Install Semgrep - run: pip install --no-cache-dir semgrep - - - name: Install Trivy - # Version pinned so the install script does not hit api.github.com to - # resolve "latest", which burns the runner's unauthenticated rate limit. - # renovate: datasource=github-releases depName=aquasecurity/trivy - run: curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sudo sh -s -- -b /usr/local/bin v0.70.0 - - - name: Run Semgrep SAST - run: | - args="--config=auto --error --severity=ERROR" - if [ -n "$SEMGREP_EXCLUDE_RULES" ]; then - for rule in $(echo "$SEMGREP_EXCLUDE_RULES" | tr ',' ' '); do - args="$args --exclude-rule=$rule" - done - fi - echo "Running: semgrep scan $args" - semgrep scan $args - - - name: Run Trivy filesystem scan - # if: always() — surface Trivy findings even when Semgrep fails first. - if: always() - run: trivy fs --severity "$TRIVY_SEVERITY" --exit-code 1 --ignore-unfixed . + uses: JonKazama-Hellion/security-workflows/.gitea/workflows/security-scan.yml@main + with: + # MessageStore.cs interpoliert SQL-Strings, die plugin-lokal sicher sind; + # Semgrep matcht das Pattern, CodeQL mit Datenflussanalyse nicht. + semgrep-exclude-rules: 'csharp.lang.security.sqli.csharp-sqli.csharp-sqli'