Roeland Jago Douma
da652ded26
Move fixup check to action
...
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2021-03-07 19:42:40 +01:00
Roeland Jago Douma
cc18213c98
Have psalm analysis directly on github
...
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2021-02-10 14:57:36 +01:00
Roeland Jago Douma
08cae2ec44
Revert "Pin Psalm version to an older one"
2021-02-02 22:08:01 +01:00
Lukas Reschke
f1d2dcdaa5
Pin Psalm version to an older one
...
Ref https://github.com/vimeo/psalm/issues/5144
Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
2021-02-02 13:54:18 +00:00
Roeland Jago Douma
c96bb21ab9
Merge pull request #24903 from nextcloud/enh/psalm-ocp
...
Add dedicated baseline for OCP
2020-12-30 13:23:25 +01:00
Roeland Jago Douma
fe65f8facf
Add dedicated baseline for OCP
...
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2020-12-30 11:06:00 +01:00
Julius Härtl
c42385ef0f
Cleanup bundle files before checking the rebuild
...
Signed-off-by: Julius Härtl <jus@bitgrid.net>
2020-12-29 12:20:32 +01:00
Julius Härtl
c7a320d880
jsunit: Run jsunit with chromium/puppeteer on github actions
...
Signed-off-by: Julius Härtl <jus@bitgrid.net>
2020-12-29 08:42:27 +01:00
Morris Jobke
6811274cfd
Merge pull request #24246 from LukasReschke/add-taint-flow-analysis
...
Add Psalm Security Analysis
2020-11-21 00:04:37 +01:00
Lukas Reschke
47ac8e0028
Add Psalm Taint Flow Analysis
...
This adds the Psalm Security Analysis, as described at
https://psalm.dev/docs/security_analysis/
It also adds a plugin for adding input into AppFramework.
The results can be viewed in the GitHub Security tab at
https://github.com/nextcloud/server/security/code-scanning
**Q&A:**
Q: Why do you not use the shipped Psalm version?
A: I do a lot of changes to the Psalm Taint behaviour. Using released
versions is not gonna get us the results we want.
Q: How do I improve false positives?
A: https://psalm.dev/docs/security_analysis/avoiding_false_positives/
Q: How do I add custom sources?
A: https://psalm.dev/docs/security_analysis/custom_taint_sources/
Q: We should run this on apps!
A: Yes.
Q: What will change in Psalm?
A: Quite some of the PHP core functions are not yet marked to propagate
the taint. This leads to results where the taint flow is lost. That's
something that I am currently working on.
Q: Why is the plugin MIT licensed?
A: Because its the first of its kind (based on GitHub Code Search) and
I want other people to copy it if they want to. Security is for all :)
Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
2020-11-20 23:12:00 +01:00
Roeland Jago Douma
12f322d804
Also lint php8
...
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2020-11-20 16:49:09 +01:00
Joas Schilling
a524e83be0
Fix naming of jobs and steps
...
Signed-off-by: Joas Schilling <coding@schilljs.com>
2020-11-10 21:39:19 +01:00
Julius Härtl
2050517d44
Add github action for oci8
...
Signed-off-by: Julius Härtl <jus@bitgrid.net>
2020-11-10 15:34:35 +01:00
John Molakvoæ
1e7a82d99e
Fix php lint action
2020-11-05 09:34:04 +01:00
Morris Jobke
bb05f0e4eb
Do not commit updated composer dependencies in psalm baseline update
...
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
2020-10-30 10:48:01 +01:00
Morris Jobke
f18d9cd310
Update daily "update psalm baseline" job to composer psalm
...
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
2020-10-29 09:58:25 +01:00
Morris Jobke
106c8d719c
Do not fail on changes to baseline.xml
...
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
2020-10-13 21:55:37 +02:00
Christoph Wurst
081e9ac47f
Use own psalm instead of a global one
...
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2020-10-13 17:55:37 +02:00
John Molakvoæ
28df9239bb
Delete dependabot.yml
2020-09-08 08:56:33 +02:00
John Molakvoæ (skjnldsv)
d939f2fa5a
Split target-branch between stablexx branches until it supports Arrays
...
Signed-off-by: John Molakvoæ (skjnldsv) <skjnldsv@protonmail.com>
2020-09-08 08:32:14 +02:00
John Molakvoæ (skjnldsv)
91e463ff00
Move to automated dependabot merging
...
Signed-off-by: John Molakvoæ (skjnldsv) <skjnldsv@protonmail.com>
2020-09-07 14:45:53 +02:00
Morris Jobke
886466d510
Run psalm-baseline.xml update once a day
...
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
2020-08-20 12:51:51 +02:00
Morris Jobke
458320e8d7
Revert "This is just to trigger the GitHub scheduled actions registration"
...
This reverts commit 2e912990ff
.
2020-08-20 12:50:57 +02:00
Morris Jobke
2e912990ff
This is just to trigger the GitHub scheduled actions registration
...
It is needed for #22314 and I will revert it right away afterwards.
Sorry for the trouble.
See the answer in https://stackoverflow.com/questions/59560214/github-action-works-on-push-but-not-scheduled
2020-08-20 12:50:27 +02:00
Morris Jobke
ebc80dba78
Run update-psalm-baseline action every 5 minutes
...
For debugging purposed due to a GitHub bug.
See #22325
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
2020-08-20 12:44:03 +02:00
Morris Jobke
27157051aa
Revert "This is just to trigger the GitHub scheduled actions registration"
2020-08-20 12:41:47 +02:00
Morris Jobke
f255f42991
This is just to trigger the GitHub scheduled actions
...
It is needed for https://github.com/nextcloud/server/pull/22314 and I will revert it right away afterwards.
Sorry for the trouble.
2020-08-20 12:40:42 +02:00
Morris Jobke
50784a7c51
Generate psalm-baseline.xml PR instead of requiring this from the PR author itself
...
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
2020-08-20 12:34:29 +02:00
Morris Jobke
4db7829f43
Better psalm CI output
...
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
2020-08-19 18:16:35 +02:00
Morris Jobke
42bb6cd7d7
Check only the baseline.xml and exclude the psalm.xml from the file check
...
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
2020-08-18 13:01:10 +02:00
Morris Jobke
80056e081a
Add a check for fixes in the psalm baseline
...
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
2020-08-18 13:01:05 +02:00
Daniel Kesselberg
7257793fc4
Hello psalm
...
Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de>
2020-08-18 08:58:19 +02:00
Daniel Kesselberg
08cb4b8172
Run cs:check a second time to show diff
...
Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de>
2020-07-15 15:35:58 +02:00
Daniel Kesselberg
f64b47c36a
Report php-cs-fixer errors to GitHub
...
Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de>
2020-07-13 16:04:31 +02:00
Joas Schilling
7f92bd9d71
Delete FUNDING.yml
2020-06-17 12:45:16 +02:00
Christoph Wurst
9e6fcd585b
Show a hint for the php-cs fix when the check fails
...
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2020-04-14 22:11:41 +02:00
Christoph Wurst
c9980ed099
Add php-cs check action
...
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2020-04-14 17:44:08 +02:00
Roeland Jago Douma
1c912f64ad
Merge pull request #19965 from nextcloud/enh/noid/how-to-use-github
...
Add text about subscribing issues and sync introduction to feature request
2020-03-23 22:09:19 +01:00
Christoph Wurst
f88ee3a556
We don't use IRC anymore
...
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2020-03-20 08:47:20 +01:00
Daniel Kesselberg
98a2e3b628
Add text about subscribing issues and sync introduction to feature request
...
Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de>
2020-03-15 12:34:05 +01:00
Daniel Kesselberg
df0131539a
Change Portalm to Portal
...
Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de>
2020-03-12 11:41:19 +01:00
Joas Schilling
190eabf220
Add a link to the portal directly
...
Signed-off-by: Joas Schilling <coding@schilljs.com>
2020-03-12 09:24:24 +01:00
Daniel Kesselberg
feb642d532
Let people know that the logs not optional
...
Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de>
2020-02-24 16:55:12 +01:00
Daniel Kesselberg
3e9bd97ce4
Add short explanation how to use the organization search to find issues with all nextcloud repos.
...
Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de>
2020-02-24 16:55:12 +01:00
Daniel Kesselberg
aaa1506a47
Add guidelines for submitting issues to template
...
Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de>
2020-02-24 16:55:11 +01:00
Gary Kim
907a27897a
Move Compile Handlebars CI to GitHub Actions
...
Signed-off-by: Gary Kim <gary@garykim.dev>
2020-02-23 12:13:48 +08:00
Roeland Jago Douma
df4ca949f5
Merge pull request #19384 from nextcloud/enh/actions/lint
...
Lint on github actions
2020-02-10 11:39:29 +01:00
Roeland Jago Douma
64665c98e1
Lint on github actions
...
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2020-02-10 09:32:45 +01:00
Roeland Jago Douma
ae75e17eff
Lets just use the fixup bot
...
The action is slower plus we can use more actions this way ;)
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2020-02-10 09:20:20 +01:00
Christoph Wurst
b267409d38
Add webpack-based js tests
...
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2020-02-07 16:56:35 +01:00
Roeland Jago Douma
582ab20e9d
Use checkout v2 for npm build action
...
Saves checking out the whole tree.
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2020-02-03 21:55:24 +01:00
Roeland Jago Douma
e639e11de3
Move npm build to github actions
...
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2020-02-03 09:42:23 +01:00
Daniel Kesselberg
fc027ca801
Use proper ellipsis and replace sparkle with rocket
...
Thanks to nextcloud/calendar
Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de>
2020-01-21 17:56:58 +01:00
Daniel Kesselberg
06c20a5138
Add link to help.nextcloud.com and bugbounty
...
Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de>
2020-01-20 22:52:57 +01:00
Roeland Jago Douma
31dfe01d96
Move away from fixupbot
...
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2019-12-06 11:46:10 +01:00
Rillian Grant
c879da4286
Minor typo
...
Colon outside of italics in the bug report issue template when in every similar instance of this in this file it is inside.
Signed-off-by: Rillian Grant <rillian.grant@hotmail.com>
2019-12-01 17:03:33 +00:00
Roeland Jago Douma
497737f28f
Merge pull request #17958 from nextcloud/docs/remove-security-mail
...
security@nextcloud.com is not being monitored and mails are being dro…
2019-11-18 15:29:16 +01:00
Daniel Kesselberg
63062625dd
security@nextcloud.com is not being monitored and mails are being dropped.
...
Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de>
2019-11-15 12:05:00 +01:00
kesselb
577876905a
Update .github/ISSUE_TEMPLATE/Feature_request.md
...
Co-Authored-By: Gary Kim <gary@garykim.dev>
2019-10-20 12:24:41 +02:00
kesselb
5b44cb57a5
Update Feature_request.md
...
Does not fit 100% to feature request but does not hurt.
2019-10-16 12:41:21 +02:00
Jos Poortvliet
43bf633d8a
Update Bug_report.md
2019-09-30 09:15:17 +02:00
Thomas Ebert
865905eb5d
Stale Bot message – Revert to old phrasing. Remove it
.
2019-07-10 12:42:47 +02:00
Thomas Ebert
3a4a462005
Stale bot message – Take into account that stale bot only acts on issues labelled as needs info
.
2019-07-09 16:41:22 +02:00
Thomas Ebert
a56c1d9794
Stale bot message – Fix plural of information. Include that not every stale issue is missing information.
2019-07-09 16:26:22 +02:00
John Molakvoæ
c27a42ff8c
One month is enough
2019-06-16 15:38:32 +02:00
John Molakvoæ
aeedc9d5f1
30 issues per run on stale bot
...
Now that we use a fixed branch for the bot, and since I removed all the untagged stale issues we can go back to full thrust
https://github.com/nextcloud/server/issues?page=1&q=is%3Aissue+sort%3Aupdated-desc+is%3Aopen+label%3Astale+-label%3A%22needs+info%22+-label%3A%220.+Needs+triage%22+-label%3A%221.+to+develop%22+-label%3A%223.+to+review%22&utf8=%E2%9C%93
2019-06-12 12:11:11 +02:00
John Molakvoæ
e54dce950d
Stale bot: only issues
2019-06-05 13:00:34 +02:00
Roeland Jago Douma
0c842827d5
Update stale.yml
...
Limit to 1 until we find out why onlyLabels is not respected...
2019-06-05 12:36:19 +02:00
John Molakvoæ
59b03bd3ce
Update stale.yml
2019-06-05 09:38:25 +02:00
John Molakvoæ
3b2a052eca
Add stale config
2019-06-05 09:30:48 +02:00
Jan-Christoph Borchardt
6f13005a11
Add funding.yml with Bountysource info
...
Signed-off-by: Jan-Christoph Borchardt <hey@jancborchardt.net>
2019-05-23 12:19:03 +02:00
Arthur Schiwon
d7f3ba96e9
fix link to dev documentation
...
Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>
2019-04-12 18:48:50 +02:00
DrRSatzteil
ded65a673c
Update CONTRIBUTING.md
...
Changed text for multiple issue templates
2019-01-25 08:46:43 +01:00
DrRSatzteil
8a146b37d4
Update CONTRIBUTING.md
...
Fixed link to Issue Template
2019-01-25 08:38:48 +01:00
Julius Härtl
f56e7c9afd
Add labels to issue templates
...
Signed-off-by: Julius Härtl <jus@bitgrid.net>
2018-12-07 11:01:03 +01:00
Julius Härtl
3d64b26abd
Add separate issue templates
...
Signed-off-by: Julius Härtl <jus@bitgrid.net>
2018-11-29 23:02:20 +01:00
Morris Jobke
136de1d1ed
Update .github/config.yml
...
Co-Authored-By: rullzer <rullzer@users.noreply.github.com>
2018-11-16 11:00:59 +01:00
Morris Jobke
6a8b994b26
Update .github/config.yml
...
Co-Authored-By: rullzer <rullzer@users.noreply.github.com>
2018-11-16 11:00:49 +01:00
Roeland Jago Douma
34132aae72
Add welcome bot
...
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2018-11-15 23:07:27 +01:00
Christoph Wurst
08b005fb0e
Move GitHub files to .github directory
...
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2018-10-09 11:35:46 +02:00
Joas Schilling
9c3b2a3991
Move mention-bot notifications to code owners
...
Signed-off-by: Joas Schilling <coding@schilljs.com>
2017-07-07 08:44:01 +02:00
Joas Schilling
3011738d47
Revert "Move CONTRIBUTUNG and issue template into .github subfolder"
...
This reverts commit 9ebd8d80ff
.
2016-11-02 10:31:53 +01:00
blizzz
2fa8b7f280
… and the raw version of it
2016-10-26 13:38:26 +02:00
blizzz
b91b6c0136
Fix issue template url
...
Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>
2016-10-26 13:36:23 +02:00
Marius Blüm
9ebd8d80ff
Move CONTRIBUTUNG and issue template into .github subfolder
...
Signed-off-by: Marius Blüm <marius@lineone.io>
2016-10-16 12:21:09 +02:00