aboutsummaryrefslogtreecommitdiffstats
path: root/.github
Commit message (Collapse)AuthorAgeFilesLines
* Merge pull request #24246 from LukasReschke/add-taint-flow-analysisMorris Jobke2020-11-211-0/+26
|\ | | | | Add Psalm Security Analysis
| * Add Psalm Taint Flow AnalysisLukas Reschke2020-11-201-0/+26
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This adds the Psalm Security Analysis, as described at https://psalm.dev/docs/security_analysis/ It also adds a plugin for adding input into AppFramework. The results can be viewed in the GitHub Security tab at https://github.com/nextcloud/server/security/code-scanning **Q&A:** Q: Why do you not use the shipped Psalm version? A: I do a lot of changes to the Psalm Taint behaviour. Using released versions is not gonna get us the results we want. Q: How do I improve false positives? A: https://psalm.dev/docs/security_analysis/avoiding_false_positives/ Q: How do I add custom sources? A: https://psalm.dev/docs/security_analysis/custom_taint_sources/ Q: We should run this on apps! A: Yes. Q: What will change in Psalm? A: Quite some of the PHP core functions are not yet marked to propagate the taint. This leads to results where the taint flow is lost. That's something that I am currently working on. Q: Why is the plugin MIT licensed? A: Because its the first of its kind (based on GitHub Code Search) and I want other people to copy it if they want to. Security is for all :) Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
* | Also lint php8Roeland Jago Douma2020-11-201-1/+1
|/ | | | Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
* Fix naming of jobs and stepsJoas Schilling2020-11-101-17/+20
| | | | Signed-off-by: Joas Schilling <coding@schilljs.com>
* Add github action for oci8Julius Härtl2020-11-101-0/+53
| | | | Signed-off-by: Julius Härtl <jus@bitgrid.net>
* Fix php lint actionJohn Molakvoæ2020-11-051-2/+2
|
* Do not commit updated composer dependencies in psalm baseline updateMorris Jobke2020-10-301-1/+2
| | | | Signed-off-by: Morris Jobke <hey@morrisjobke.de>
* Update daily "update psalm baseline" job to composer psalmMorris Jobke2020-10-291-6/+8
| | | | Signed-off-by: Morris Jobke <hey@morrisjobke.de>
* Do not fail on changes to baseline.xml Morris Jobke2020-10-131-1/+1
| | | Signed-off-by: Morris Jobke <hey@morrisjobke.de>
* Use own psalm instead of a global oneChristoph Wurst2020-10-131-6/+10
| | | | Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
* Delete dependabot.ymlJohn Molakvoæ2020-09-081-142/+0
|
* Split target-branch between stablexx branches until it supports ArraysJohn Molakvoæ (skjnldsv)2020-09-081-8/+58
| | | | Signed-off-by: John Molakvoæ (skjnldsv) <skjnldsv@protonmail.com>
* Move to automated dependabot mergingJohn Molakvoæ (skjnldsv)2020-09-072-0/+111
| | | | Signed-off-by: John Molakvoæ (skjnldsv) <skjnldsv@protonmail.com>
* Run psalm-baseline.xml update once a dayMorris Jobke2020-08-201-1/+1
| | | | Signed-off-by: Morris Jobke <hey@morrisjobke.de>
* Revert "This is just to trigger the GitHub scheduled actions registration"Morris Jobke2020-08-201-17/+0
| | | | This reverts commit 2e912990ff63ca364a070243594b174e0ec9868b.
* This is just to trigger the GitHub scheduled actions registrationMorris Jobke2020-08-201-0/+17
| | | | | | | It is needed for #22314 and I will revert it right away afterwards. Sorry for the trouble. See the answer in https://stackoverflow.com/questions/59560214/github-action-works-on-push-but-not-scheduled
* Run update-psalm-baseline action every 5 minutesMorris Jobke2020-08-201-1/+1
| | | | | | | For debugging purposed due to a GitHub bug. See #22325 Signed-off-by: Morris Jobke <hey@morrisjobke.de>
* Revert "This is just to trigger the GitHub scheduled actions registration"Morris Jobke2020-08-201-16/+0
|
* This is just to trigger the GitHub scheduled actionsMorris Jobke2020-08-201-0/+16
| | | | | It is needed for https://github.com/nextcloud/server/pull/22314 and I will revert it right away afterwards. Sorry for the trouble.
* Generate psalm-baseline.xml PR instead of requiring this from the PR author ↵Morris Jobke2020-08-202-2/+45
| | | | | | itself Signed-off-by: Morris Jobke <hey@morrisjobke.de>
* Better psalm CI outputMorris Jobke2020-08-191-2/+2
| | | | Signed-off-by: Morris Jobke <hey@morrisjobke.de>
* Check only the baseline.xml and exclude the psalm.xml from the file checkMorris Jobke2020-08-181-1/+1
| | | | Signed-off-by: Morris Jobke <hey@morrisjobke.de>
* Add a check for fixes in the psalm baselineMorris Jobke2020-08-181-1/+4
| | | | Signed-off-by: Morris Jobke <hey@morrisjobke.de>
* Hello psalmDaniel Kesselberg2020-08-181-0/+22
| | | | Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de>
* Run cs:check a second time to show diffDaniel Kesselberg2020-07-151-1/+4
| | | | Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de>
* Report php-cs-fixer errors to GitHubDaniel Kesselberg2020-07-131-1/+2
| | | | Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de>
* Delete FUNDING.ymlJoas Schilling2020-06-171-2/+0
|
* Show a hint for the php-cs fix when the check failsChristoph Wurst2020-04-141-1/+1
| | | | Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
* Add php-cs check actionChristoph Wurst2020-04-141-0/+16
| | | | Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
* Merge pull request #19965 from nextcloud/enh/noid/how-to-use-githubRoeland Jago Douma2020-03-232-7/+21
|\ | | | | Add text about subscribing issues and sync introduction to feature request
| * Add text about subscribing issues and sync introduction to feature requestDaniel Kesselberg2020-03-152-7/+21
| | | | | | | | Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de>
* | We don't use IRC anymoreChristoph Wurst2020-03-201-2/+0
|/ | | | Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
* Change Portalm to PortalDaniel Kesselberg2020-03-121-1/+1
| | | | Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de>
* Add a link to the portal directlyJoas Schilling2020-03-122-4/+3
| | | | Signed-off-by: Joas Schilling <coding@schilljs.com>
* Let people know that the logs not optionalDaniel Kesselberg2020-02-241-0/+3
| | | | Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de>
* Add short explanation how to use the organization search to find issues with ↵Daniel Kesselberg2020-02-241-1/+1
| | | | | | all nextcloud repos. Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de>
* Add guidelines for submitting issues to templateDaniel Kesselberg2020-02-242-10/+25
| | | | Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de>
* Move Compile Handlebars CI to GitHub ActionsGary Kim2020-02-231-0/+17
| | | | Signed-off-by: Gary Kim <gary@garykim.dev>
* Merge pull request #19384 from nextcloud/enh/actions/lintRoeland Jago Douma2020-02-101-0/+20
|\ | | | | Lint on github actions
| * Lint on github actionsRoeland Jago Douma2020-02-101-0/+20
| | | | | | | | Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
* | Lets just use the fixup botRoeland Jago Douma2020-02-101-13/+0
|/ | | | | | The action is slower plus we can use more actions this way ;) Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
* Add webpack-based js testsChristoph Wurst2020-02-071-0/+17
| | | | Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
* Use checkout v2 for npm build actionRoeland Jago Douma2020-02-031-1/+1
| | | | | | Saves checking out the whole tree. Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
* Move npm build to github actionsRoeland Jago Douma2020-02-031-0/+33
| | | | Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
* Use proper ellipsis and replace sparkle with rocketDaniel Kesselberg2020-01-212-2/+2
| | | | | | Thanks to nextcloud/calendar Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de>
* Add link to help.nextcloud.com and bugbountyDaniel Kesselberg2020-01-203-36/+44
| | | | Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de>
* Move away from fixupbotRoeland Jago Douma2019-12-061-0/+13
| | | | Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
* Minor typoRillian Grant2019-12-011-1/+1
| | | | | | Colon outside of italics in the bug report issue template when in every similar instance of this in this file it is inside. Signed-off-by: Rillian Grant <rillian.grant@hotmail.com>
* Merge pull request #17958 from nextcloud/docs/remove-security-mailRoeland Jago Douma2019-11-181-1/+1
|\ | | | | security@nextcloud.com is not being monitored and mails are being dro…
| * security@nextcloud.com is not being monitored and mails are being dropped.Daniel Kesselberg2019-11-151-1/+1
| | | | | | | | Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de>
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-29 17:11:55 +0000