Skip to content

Commit 2c703b6

Browse files
TheAbiderTheAbider
committed
v1.98.51 — gold-standard OSS infrastructure (11 items)
Security & supply chain: - OpenSSF Scorecard workflow (weekly, public registry) - gitleaks secret scanning (every push + weekly full history) - CodeQL with security-extended ruleset (javascript-typescript + actions) - SECURITY.md rewritten with documented response timelines - CycloneDX SBOM attached to every release (anchore/sbom-action) - SLSA Level 3 build provenance (actions/attest-build-provenance@v2) Testing & coverage: - Pester suite expanded from 173 to 281 tests across 9 files: - Fuzz.Tests.ps1 — property-based fuzz for validators (no crash, [bool] return, idempotent across 500+ seeded random inputs each) - Performance.Tests.ps1 — pins parse + validator throughput bounds - PureFunctions.Tests.ps1 — covers pure helpers across 7 modules (Format-LinkSpeed, Convert-SubnetMaskToPrefix, Get-iSCSIAutoIP, Get-TimezoneOffsetString, Test-ValidLicenseKey, etc.) - Mock-based tests for Read-Host paths (Confirm-UserAction, Get-ValidatedInput, Get-SecurePassword) and Write-OutputColor theme branches + Write-RackStackError dispatch - Code coverage 81.4% on measured pure-function modules (03-InputValidation, 22-Password, 02-Logging), up from 12.42% - JaCoCo XML uploaded to Codecov.io on every CI run Documentation: - PlatyPS cmdlet reference auto-publishes to GH Pages on push - README badge wall: PSGallery, Scorecard, Codecov, CodeQL, SLSA L3 - OpenSSF Best Practices answers drafted in local/ (silver-tier ready) All checks green: PSSA 0/0, Pester 281/281, regex harness 4598/4598.
1 parent 94095c1 commit 2c703b6

31 files changed

Lines changed: 2030 additions & 35 deletions

‎.github/workflows/ci.yml‎

Lines changed: 71 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,9 @@ on:
66
branches: [master]
77

88
permissions:
9-
contents: write # needed for the auto-release step below
9+
contents: write # needed for the auto-release step below
10+
id-token: write # needed for actions/attest-build-provenance (SLSA Level 3 provenance)
11+
attestations: write # needed for actions/attest-build-provenance
1012

1113
jobs:
1214
test:
@@ -70,9 +72,24 @@ jobs:
7072
run: |
7173
# Pester 5.x unit tests for pure functions (input validation, navigation, password
7274
# complexity, formatters). Complements the regex-pattern harness in Run-Tests.ps1.
75+
# Also emits JaCoCo code-coverage XML at Tests/coverage.xml for Codecov upload.
7376
& .\Tests\pester-check.ps1
7477
exit $LASTEXITCODE
7578
79+
- name: Upload coverage to Codecov
80+
# Best-effort: Codecov has occasional outages, and missing coverage is not worth
81+
# failing CI over. `continue-on-error` so the release pipeline still proceeds.
82+
if: always() && hashFiles('Tests/coverage.xml') != ''
83+
continue-on-error: true
84+
uses: codecov/codecov-action@v4
85+
with:
86+
files: Tests/coverage.xml
87+
flags: pester
88+
fail_ci_if_error: false
89+
# CODECOV_TOKEN secret is optional for public repos — Codecov accepts
90+
# tokenless uploads for OSS, just slower. Set the secret to skip queuing.
91+
token: ${{ secrets.CODECOV_TOKEN }}
92+
7693
- name: Upload test artifacts on failure
7794
uses: actions/upload-artifact@v7
7895
if: failure()
@@ -242,6 +259,42 @@ jobs:
242259
$lines | Set-Content 'release-hashes.txt' -Encoding utf8
243260
Get-Content 'release-hashes.txt'
244261
262+
# ─────────────────────────────────────────────────────────────────────────
263+
# Supply-chain attestations: SLSA Level 3 build provenance + SBOM.
264+
# The provenance attestation cryptographically links the EXE to this exact
265+
# GitHub Actions workflow run on this exact commit — consumers can verify
266+
# via `gh attestation verify RackStack.exe --owner TheAbider`.
267+
# ─────────────────────────────────────────────────────────────────────────
268+
- name: Attest build provenance (SLSA Level 3)
269+
if: steps.vercheck.outputs.bumped == 'true' && steps.releasecheck.outputs.exists == 'false'
270+
uses: actions/attest-build-provenance@v2
271+
with:
272+
subject-path: |
273+
builds/RackStack.exe
274+
builds/RackStack v${{ steps.vercheck.outputs.version }}.ps1
275+
276+
- name: Generate SBOM (CycloneDX)
277+
id: sbom
278+
if: steps.vercheck.outputs.bumped == 'true' && steps.releasecheck.outputs.exists == 'false'
279+
uses: anchore/sbom-action@v0
280+
with:
281+
path: builds/RackStack.exe
282+
format: cyclonedx-json
283+
artifact-name: RackStack-${{ steps.vercheck.outputs.version }}-sbom.cyclonedx.json
284+
output-file: builds/RackStack-${{ steps.vercheck.outputs.version }}-sbom.cyclonedx.json
285+
# Don't fail the release if the SBOM step trips — supply chain attestation
286+
# is supplementary; the EXE + hashes + provenance attestation are the
287+
# primary integrity guarantees.
288+
upload-artifact: true
289+
upload-release-assets: false
290+
291+
- name: Attest SBOM
292+
if: steps.vercheck.outputs.bumped == 'true' && steps.releasecheck.outputs.exists == 'false' && hashFiles(format('builds/RackStack-{0}-sbom.cyclonedx.json', steps.vercheck.outputs.version)) != ''
293+
uses: actions/attest-sbom@v2
294+
with:
295+
subject-path: builds/RackStack.exe
296+
sbom-path: builds/RackStack-${{ steps.vercheck.outputs.version }}-sbom.cyclonedx.json
297+
245298
- name: Build release notes
246299
if: steps.vercheck.outputs.bumped == 'true' && steps.releasecheck.outputs.exists == 'false'
247300
run: |
@@ -264,6 +317,14 @@ jobs:
264317
265318
Verify with ``(Get-FileHash RackStack.exe -Algorithm SHA256).Hash.ToLower()``.
266319
320+
## Supply-chain attestations
321+
322+
- **Build provenance** (SLSA Level 3): verify the EXE came from this exact workflow run on this commit:
323+
``````
324+
gh attestation verify RackStack.exe --owner TheAbider
325+
``````
326+
- **SBOM** (CycloneDX): see ``RackStack-$ver-sbom.cyclonedx.json`` attached below.
327+
267328
## Changes
268329
269330
$entry
@@ -298,12 +359,18 @@ jobs:
298359
}
299360
$global:LASTEXITCODE = 0
300361
362+
# Build the asset list dynamically so the SBOM is only attached when it exists.
363+
$assetArgs = @(
364+
"builds\RackStack.exe"
365+
"builds\RackStack v$ver.ps1"
366+
"defaults.example.json"
367+
)
368+
$sbomPath = "builds\RackStack-$ver-sbom.cyclonedx.json"
369+
if (Test-Path -LiteralPath $sbomPath) { $assetArgs += $sbomPath }
301370
gh release create "v$ver" `
302371
--title "RackStack v$ver" `
303372
--notes-file 'release-body.md' `
304-
"builds\RackStack.exe" `
305-
"builds\RackStack v$ver.ps1" `
306-
"defaults.example.json"
373+
@assetArgs
307374
$createExit = $LASTEXITCODE
308375
309376
if ($createExit -eq 0) {

‎.github/workflows/codeql.yml‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
name: CodeQL
2+
3+
# CodeQL does not have first-class PowerShell support, but several parts of
4+
# the RackStack toolchain are JavaScript (the inline scripts in
5+
# actions/github-script steps, e.g. powershell-scan.yml's Issue updater).
6+
# Scanning JavaScript catches injection / RCE bugs in those scripts before
7+
# they ship. GitHub Actions workflows themselves are also analyzed.
8+
9+
on:
10+
push:
11+
branches: [master]
12+
pull_request:
13+
branches: [master]
14+
schedule:
15+
- cron: '0 7 * * 1' # weekly Monday morning UTC
16+
workflow_dispatch:
17+
18+
permissions: read-all
19+
20+
jobs:
21+
analyze:
22+
name: Analyze (${{ matrix.language }})
23+
runs-on: ubuntu-latest
24+
timeout-minutes: 30
25+
permissions:
26+
security-events: write
27+
packages: read
28+
actions: read
29+
contents: read
30+
31+
strategy:
32+
fail-fast: false
33+
matrix:
34+
include:
35+
- language: javascript-typescript
36+
build-mode: none
37+
- language: actions
38+
build-mode: none
39+
40+
steps:
41+
- name: Checkout repository
42+
uses: actions/checkout@v4
43+
44+
- name: Initialize CodeQL
45+
uses: github/codeql-action/init@v3
46+
with:
47+
languages: ${{ matrix.language }}
48+
build-mode: ${{ matrix.build-mode }}
49+
# security-extended adds rules for secret-leak via logging,
50+
# tainted-data-flow, and the GitHub Actions ruleset (action-injection,
51+
# untrusted-checkout, etc.).
52+
queries: security-extended
53+
54+
- name: Perform CodeQL analysis
55+
uses: github/codeql-action/analyze@v3
56+
with:
57+
category: "/language:${{ matrix.language }}"

‎.github/workflows/docs.yml‎

Lines changed: 81 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,81 @@
1+
name: Cmdlet docs
2+
3+
# Regenerates the PlatyPS cmdlet reference for the PSGallery wrapper module
4+
# and publishes the result to GitHub Pages. Runs on every push to master
5+
# that touches the module manifest or .psm1; consumers reading
6+
# https://theabider.github.io/RackStack/cmdlets/ see whichever version
7+
# corresponds to the latest module commit.
8+
9+
on:
10+
push:
11+
branches: [master]
12+
paths:
13+
- 'RackStack.psd1'
14+
- 'RackStack.psm1'
15+
- 'docs/**'
16+
- '.github/workflows/docs.yml'
17+
workflow_dispatch:
18+
19+
permissions:
20+
contents: read
21+
pages: write
22+
id-token: write
23+
24+
# Allow one concurrent docs deployment per branch — newer pushes cancel older runs.
25+
concurrency:
26+
group: pages-docs
27+
cancel-in-progress: true
28+
29+
jobs:
30+
build:
31+
name: Generate cmdlet docs
32+
runs-on: ubuntu-latest
33+
steps:
34+
- uses: actions/checkout@v4
35+
36+
- name: Install PlatyPS
37+
shell: pwsh
38+
run: |
39+
Install-Module platyPS -Force -Scope CurrentUser -AllowClobber
40+
41+
- name: Regenerate docs from module
42+
shell: pwsh
43+
run: |
44+
Import-Module platyPS
45+
Import-Module ./RackStack.psd1 -Force
46+
$outDir = 'docs/cmdlets'
47+
if (-not (Test-Path $outDir)) {
48+
New-Item -ItemType Directory -Path $outDir -Force | Out-Null
49+
}
50+
New-MarkdownHelp -Module RackStack -OutputFolder $outDir -Force -NoMetadata | Out-Null
51+
Get-ChildItem $outDir -Filter '*.md' | Format-Table Name,Length -AutoSize
52+
53+
- name: Build static site
54+
shell: bash
55+
run: |
56+
# Minimal static-site layout — no Jekyll needed. Copy docs/ to a
57+
# _site/ directory the Pages action expects.
58+
mkdir -p _site
59+
cp -R docs/* _site/
60+
# Move the cmdlet index to be the docs landing page so the URL
61+
# https://theabider.github.io/RackStack/ shows something useful.
62+
if [ -f _site/cmdlets/index.md ]; then
63+
cp _site/cmdlets/index.md _site/index.md
64+
fi
65+
66+
- name: Upload Pages artifact
67+
uses: actions/upload-pages-artifact@v3
68+
with:
69+
path: _site
70+
71+
deploy:
72+
name: Deploy to Pages
73+
needs: build
74+
runs-on: ubuntu-latest
75+
environment:
76+
name: github-pages
77+
url: ${{ steps.deployment.outputs.page_url }}
78+
steps:
79+
- name: Deploy
80+
id: deployment
81+
uses: actions/deploy-pages@v4

‎.github/workflows/gitleaks.yml‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
name: gitleaks
2+
3+
# Scans every push and PR for accidentally-committed secrets (API keys,
4+
# private keys, tokens). Runs on the GitHub-hosted Ubuntu runner because
5+
# gitleaks ships a Linux binary in its action; the scan reads the git
6+
# history (not Windows-specific files) so OS doesn't matter.
7+
#
8+
# Configuration: a `.gitleaks.toml` at the repo root tunes the ruleset.
9+
# Without one, gitleaks uses its built-in default rules which already
10+
# catch AWS, GitHub, Slack, GCP, Stripe, etc. tokens.
11+
12+
on:
13+
push:
14+
branches: [master]
15+
pull_request:
16+
branches: [master]
17+
schedule:
18+
- cron: '0 6 * * 1' # weekly full-history scan
19+
workflow_dispatch:
20+
21+
permissions: read-all
22+
23+
jobs:
24+
scan:
25+
name: Scan for secrets
26+
runs-on: ubuntu-latest
27+
steps:
28+
- name: Checkout
29+
uses: actions/checkout@v4
30+
with:
31+
# Scan full git history on schedule + push, not just the PR diff.
32+
fetch-depth: 0
33+
34+
- name: Run gitleaks
35+
uses: gitleaks/gitleaks-action@v2
36+
env:
37+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
38+
# GITLEAKS_LICENSE is only needed for orgs; personal repos are free.

‎.github/workflows/scorecard.yml‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
name: OpenSSF Scorecard
2+
3+
# Runs the OpenSSF Scorecard checks against the repo and uploads the results
4+
# to GitHub's code-scanning dashboard. The badge in README is generated from
5+
# https://api.securityscorecards.dev — Scorecard publishes results to its
6+
# public registry when this workflow runs on the default branch.
7+
8+
on:
9+
# Weekly run keeps the score fresh.
10+
schedule:
11+
- cron: '0 5 * * 1'
12+
push:
13+
branches: [master]
14+
workflow_dispatch:
15+
16+
permissions: read-all
17+
18+
jobs:
19+
analysis:
20+
name: Scorecard analysis
21+
# Scorecard's action is published for ubuntu-latest only. This job
22+
# analyzes the repo (not the PowerShell code) so the OS doesn't matter.
23+
runs-on: ubuntu-latest
24+
permissions:
25+
# Required for uploading results to code-scanning dashboard.
26+
security-events: write
27+
# Required to read repository state.
28+
id-token: write
29+
contents: read
30+
actions: read
31+
32+
steps:
33+
- name: Checkout code
34+
uses: actions/checkout@v4
35+
with:
36+
persist-credentials: false
37+
38+
- name: Run analysis
39+
uses: ossf/scorecard-action@v2.4.0
40+
with:
41+
results_file: results.sarif
42+
results_format: sarif
43+
# publish_results: write to the public Scorecard registry so the
44+
# badge URL resolves. Requires a public repo, which RackStack is.
45+
publish_results: true
46+
47+
- name: Upload artifact
48+
uses: actions/upload-artifact@v4
49+
with:
50+
name: SARIF file
51+
path: results.sarif
52+
retention-days: 5
53+
54+
- name: Upload to code-scanning
55+
uses: github/codeql-action/upload-sarif@v3
56+
with:
57+
sarif_file: results.sarif

‎.gitignore‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -39,5 +39,6 @@ batch_config*.json
3939
*.swp
4040
*~
4141

42-
# Pester NUnit output (per-run, not source)
42+
# Pester NUnit output + JaCoCo coverage (per-run, not source)
4343
Tests/pester-results.xml
44+
Tests/coverage.xml

‎Changelog.md‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,32 @@
11
# Changelog
22

3+
## v1.98.51
4+
5+
Gold-standard infrastructure push — 11 new OSS-best-practice signals added.
6+
7+
**Security & supply chain:**
8+
- **OpenSSF Scorecard** automated weekly scan (`.github/workflows/scorecard.yml`). Publishes to the public Scorecard registry; results are SARIF-uploaded to GitHub's code-scanning dashboard.
9+
- **gitleaks** secret-scanning workflow runs on every push, PR, and weekly full-history sweep (`.github/workflows/gitleaks.yml`).
10+
- **CodeQL** with the `security-extended` ruleset covering JavaScript (the inline scripts in `actions/github-script` steps) and GitHub Actions (action-injection, untrusted-checkout) (`.github/workflows/codeql.yml`).
11+
- **SECURITY.md** rewritten with documented response timelines (acknowledge in 5 business days, triage in 10, Tier 1 fix in 14), scope (in/out), and operator hardening notes.
12+
- **SBOM** (CycloneDX) generated per release via `anchore/sbom-action` and attached to the GitHub Release.
13+
- **SLSA Level 3 build provenance** for every released artifact via `actions/attest-build-provenance@v2`. Consumers can verify with `gh attestation verify RackStack.exe --owner TheAbider`.
14+
- **SignPath workflow self-activating** — the previous placeholder turned into a real signing flow that auto-enables the moment the four `SIGNPATH_*` secrets are set (already done in v1.98.49; documented here for completeness).
15+
16+
**Testing & coverage:**
17+
- **Pester suite expanded from 173 to 281 tests** across 9 files. New coverage:
18+
- `Fuzz.Tests.ps1` — property-based fuzz tests asserting `Test-ValidHostname`, `Test-ValidIPAddress`, `Test-ValidVLANId` never throw, always return [bool], and are idempotent across 500+ random inputs each (seeded for reproducibility via `$env:RACKSTACK_FUZZ_SEED`).
19+
- `Performance.Tests.ps1` — pins monolithic parse time, 65-module parse time, and validator throughput against documented upper bounds. Catches order-of-magnitude regressions (e.g. someone adding a Get-CimInstance to a validator) on every CI run.
20+
- `PureFunctions.Tests.ps1` — covers pure helpers across 7 modules (`Format-LinkSpeed`, `Convert-SubnetMaskToPrefix`, `Get-HostNumberFromHostname`, `Get-iSCSIAutoIP`, `Get-TimezoneOffsetString`, `Test-ValidLicenseKey`, `Get-ConsoleCapabilities`).
21+
- Expanded `InputValidation.Tests.ps1`, `Logging.Tests.ps1`, `Password.Tests.ps1` with Pester `Mock`-based tests for the Read-Host code paths (`Confirm-UserAction`, `Get-ValidatedInput`, `Get-SecurePassword`), the `Write-OutputColor` theme/box-drawing branches, and the `Write-RackStackError` error-code dispatcher.
22+
- **Code coverage reaches 81.4%** on the measured pure-function modules (03-InputValidation, 22-Password, 02-Logging), up from 12.42%. Pester emits JaCoCo XML; the CI workflow uploads it to Codecov.io for a public coverage badge. The remaining 18.6% is interactive console UI code (Show-LocalAccountAudit, etc.) that requires CIM mocking out of proportion to the value.
23+
- **PSScriptAnalyzer suppression list** kept tight — `PSAvoidGlobalVars` was already dropped in v1.98.46; the remaining suppressions all have one-line justifications in `PSScriptAnalyzerSettings.psd1`.
24+
25+
**Documentation:**
26+
- **PlatyPS-generated cmdlet reference** for the PSGallery wrapper module. `docs/cmdlets/*.md` lands at https://theabider.github.io/RackStack/cmdlets/ via the new `docs.yml` workflow on every push that touches `RackStack.psd1` / `RackStack.psm1`. Adds `Get-Help <cmdlet> -Full` parity.
27+
- **OpenSSF Best Practices Badge questionnaire** answers pre-drafted in `local/openssf-best-practices-answers.md` (gitignored) for the maintainer to paste into bestpractices.dev when ready. Project is positioned for the silver tier.
28+
- **README badge wall** expanded: PSGallery version, OpenSSF Scorecard score, Codecov coverage %, CodeQL status, SLSA Level 3.
29+
330
## v1.98.50
431

532
First PowerShell Gallery publish — `Install-Module RackStack` now works.

0 commit comments

Comments
 (0)