github-featured/deusdata--codebase-memory-mcp
2
0
Fork 0
Code Issues Pull Requests Deployments Models Agent Notes Packages Projects Releases Wiki Activity
2,440 Commits 300 Branches 52 Tags
fix/java-enum-methods
Commit Graph

304 Commits

Author SHA1 Message Date
DeusData 148d951e1a Merge pull request #167 from DeusData/dependabot/github_actions/actions/cache-5.0.4 
Bump actions/cache from 4.3.0 to 5.0.4
 2026-03-29 11:56:32 +02:00
DeusData 7bc109ee78 Merge pull request #166 from DeusData/dependabot/github_actions/actions/checkout-6.0.2 
Bump actions/checkout from 4.2.2 to 6.0.2
 2026-03-29 11:56:27 +02:00
DeusData 6d33c10912 Merge pull request #165 from DeusData/dependabot/github_actions/actions/upload-artifact-7.0.0 
Bump actions/upload-artifact from 4.6.2 to 7.0.0
 2026-03-29 11:56:21 +02:00
DeusData 469ef4e0f5 Merge pull request #164 from DeusData/dependabot/github_actions/actions/attest-build-provenance-4.1.0 
Bump actions/attest-build-provenance from 2.4.0 to 4.1.0
 2026-03-29 11:56:16 +02:00
dependabot[bot] f71ea61b18 Bump actions/cache from 4.3.0 to 5.0.4 
Bumps [actions/cache](https://github.com/actions/cache) from 4.3.0 to 5.0.4.
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](https://github.com/actions/cache/compare/0057852bfaa89a56745cba8c7296529d2fc39830...668228422ae6a00e4ad889ee87cd7109ec5666a7)

---
updated-dependencies:
- dependency-name: actions/cache
  dependency-version: 5.0.4
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-03-28 05:43:16 +00:00
dependabot[bot] 10eb56900a Bump actions/checkout from 4.2.2 to 6.0.2 
Bumps [actions/checkout](https://github.com/actions/checkout) from 4.2.2 to 6.0.2.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/v4.2.2...de0fac2e4500dabe0009e67214ff5f5447ce83dd)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 6.0.2
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-03-28 05:43:09 +00:00
dependabot[bot] e3ee39f1ec Bump actions/upload-artifact from 4.6.2 to 7.0.0 
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 4.6.2 to 7.0.0.
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](https://github.com/actions/upload-artifact/compare/ea165f8d65b6e75b540449e92b4886f43607fa02...bbbca2ddaa5d8feaa63e36b76fdaad77386f024f)

---
updated-dependencies:
- dependency-name: actions/upload-artifact
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-03-28 05:42:56 +00:00
dependabot[bot] 1f8df9d02d Bump actions/attest-build-provenance from 2.4.0 to 4.1.0 
Bumps [actions/attest-build-provenance](https://github.com/actions/attest-build-provenance) from 2.4.0 to 4.1.0.
- [Release notes](https://github.com/actions/attest-build-provenance/releases)
- [Changelog](https://github.com/actions/attest-build-provenance/blob/main/RELEASE.md)
- [Commits](https://github.com/actions/attest-build-provenance/compare/e8998f949152b193b063cb0ec769d69d929409be...a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32)

---
updated-dependencies:
- dependency-name: actions/attest-build-provenance
  dependency-version: 4.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-03-28 05:42:49 +00:00
dependabot[bot] c86b7864f0 Bump github/codeql-action from 4.34.1 to 4.35.1 
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.34.1 to 4.35.1.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/38697555549f1db7851b81482ff19f1fa5c4fedc...c10b8064de6f491fea524254123dbe5e09572f13)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 4.35.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-03-28 05:42:45 +00:00
Martin Vogel b31d177089 VT gate: all files block equally, no warnings — scripts can contain harmful code too 2026-03-26 13:26:57 +01:00
Martin Vogel 4aa1690022 VT gate: increase timeout to 120 min (was 20 min) 2026-03-26 13:24:53 +01:00
Martin Vogel 3087c2ab27 VT gate: warn (not block) when script files timeout (low VT priority) 2026-03-26 13:21:05 +01:00
Martin Vogel 061ec32fe3 Fix: normalize path separators on ALL platforms + require soak-asan for release 2026-03-26 12:13:48 +01:00
Martin Vogel c0de9ff5a4 Weekly soak: run Sunday 2am UTC instead of nightly 2026-03-25 22:58:05 +01:00
Martin Vogel 38f699b72e Add nightly 4h soak test (scheduled 2am UTC, manual trigger) 2026-03-25 22:09:49 +01:00
Martin Vogel 7074dc2f1b Fix Windows: taskkill self-kill + soak missing build deps 
1. taskkill /IM killed the install process itself — now uses
   /FI "PID ne <self>" to exclude own process
2. Windows soak jobs missing clang, zlib, make packages — added
   to all soak-quick-windows and soak-asan-windows MSYS2 installs
3. Both dry-run.yml and release.yml fixed
 2026-03-25 21:53:58 +01:00
Martin Vogel 5f9da0ee4a Fix 3 CI failures: Windows .exe path, tre ssize_t, UI archive name 
1. Windows install/update: append .exe to binary path on _WIN32
   (was writing empty command to .claude.json)
2. Vendored tre: add ssize_t typedef for Windows (basetsd.h SSIZE_T)
3. Smoke server: copy UI archive under standard name too, so
   install.sh and update --standard work in UI variant smoke tests
 2026-03-25 21:33:01 +01:00
Martin Vogel 0d4aa3fc19 Fix skip cascade: add !cancelled() to all smoke/soak job conditions 2026-03-25 16:52:41 +01:00
Martin Vogel 6a26f52e23 Fix workflow: use explicit != true for boolean inputs (unset != false) 2026-03-25 16:38:23 +01:00
Martin Vogel 6ab88f9cc3 Add Windows ASan soak (no LeakSan, catches buffer overflows + UAF) 2026-03-25 16:10:06 +01:00
Martin Vogel 817a1fc3ce Fix soak CI: parallel with smoke, all platforms, ASan on macOS 
- soak-quick + soak-asan now need build-* (not smoke-*) — parallel
- Added macOS Intel (amd64) to both soak-quick and soak-asan matrices
- Added macOS arm64 + Intel to soak-asan (was Linux-only)
- Windows soak: separate job (matrix.shell not supported)
- ASan not on Windows (LeakSanitizer unsupported there)
 2026-03-25 16:06:07 +01:00
Martin Vogel 4a49097ba9 Fix workflow: split Windows soak into own job (matrix.shell not supported) 2026-03-25 15:58:50 +01:00
Martin Vogel aa25f73adb Soak test gaps: 200-file fixture, Windows, snapshots, ASan build 
- Test project: 377 files (80 Python + 40 Go + 40 TSX + configs)
  instead of 5 files. RSS baseline now ~47MB (real workload).
- Snapshots every 10s (was 30s) — 7+ data points in 1-min run.
- Reindex every 2min compressed (was 5min) — more cycles per run.
- heap_committed fallback: use RSS when mimalloc reports 0.
- Windows soak: added to quick soak matrix (MSYS2 + python3 + git).
- ASan soak: builds with -fsanitize=address (was building release).
- Collect snapshot with single python3 call (was 6 separate calls).
 2026-03-25 15:52:28 +01:00
Martin Vogel dbd543a966 Add soak test suite: diagnostics + compressed workload + CI jobs 
CBM_DIAGNOSTICS=1 writes /tmp/cbm-diagnostics-<pid>.json every 5s.
scripts/soak-test.sh: compressed workload + crash recovery + analysis.
CI: soak_level input (full/quick/none) on dry-run + release.
MCP query timing via cbm_diag_record_query().
 2026-03-25 12:38:01 +01:00
Martin Vogel 6300feb70c Fix smoke tests: variant detection, Windows deps, UI reachability 
- Phase 14: detect UI vs standard variant from HTTP server contents
  instead of hardcoding --standard (fixes UI smoke failure)
- Windows smoke: install zip + coreutils (sha256sum) in MSYS2
  (fixes exit code 127)
- Phase 15: UI HTTP server reachability test — verifies root returns
  200 and /rpc accepts POST (skips gracefully for non-UI builds)
- Fix switch fallthrough in release.yml (same MSYS2 deps)
 2026-03-25 10:45:58 +01:00
Martin Vogel aa5237b43b Include install scripts in release archives + VirusTotal scan 
tar.gz archives now contain install.sh alongside the binary.
zip archives now contain install.ps1.

Users who download an archive get everything needed to install
without fetching scripts separately from the repo.

VirusTotal scan also covers the scripts since they're extracted
from archives into the scan directory.
 2026-03-24 23:55:49 +01:00
Martin Vogel 006e6dbf20 Add install scripts, CI pre-signing, download E2E smoke tests 
install.sh: one-liner for macOS/Linux — detects OS/arch (Rosetta-
aware), downloads release, verifies checksum, extracts, signs on
macOS, runs install -y for all 10 agents. Supports --ui flag and
CBM_DOWNLOAD_URL env var for testing.

install.ps1: one-liner for Windows — Invoke-WebRequest + Expand-
Archive + Unblock-File (strips MOTW), installs to %LOCALAPPDATA%,
adds to user PATH via [Environment]::SetEnvironmentVariable.

CI pre-signing: add codesign --sign - step for macOS builds in
both dry-run.yml and release.yml, before archiving. Release
binaries now ship pre-signed.

Phase 12 smoke tests: real HTTP download via local artifact server,
checksum verification, archive extraction, binary verification.
Runs only when SMOKE_DOWNLOAD_URL is set (CI provides it).

Phase 13 smoke tests: install.sh E2E — runs full script with local
URL + isolated HOME, verifies binary placed, signed, runs, and
agent configs created.

CI HTTP server: smoke jobs start python3 HTTP server serving the
built binary as a tar.gz/zip archive + checksums.txt. Enables
Phases 12-13 in CI on all platforms.

Update security allowlist: remove system() entry (eliminated),
add cbm_popen for pgrep. Update README with one-liner Quick Start.
 2026-03-24 23:14:33 +01:00
Martin Vogel 7e78e302f2 Fix Windows UI zip filename + clang-format store.c 
- release.yml: UI zip now contains codebase-memory-mcp.exe (not -ui.exe),
  matching the Unix tar.gz convention (Fixes #110)
- store.c: clang-format fix from PR #124 merge
 2026-03-23 15:33:35 +01:00
DeusData df58fc94f4 Merge pull request #92 from DeusData/dependabot/github_actions/crazy-max/ghaction-virustotal-5.0.0 
Bump crazy-max/ghaction-virustotal from 4.2.0 to 5.0.0
 2026-03-22 00:32:49 +01:00
DeusData 9961b5db33 Merge pull request #93 from DeusData/dependabot/github_actions/actions/setup-node-6.3.0 
Bump actions/setup-node from 4.4.0 to 6.3.0
 2026-03-22 00:32:46 +01:00
DeusData f98c996634 Merge pull request #94 from DeusData/dependabot/github_actions/sigstore/cosign-installer-398d4b0eeef1380460a10c8013a76f728fb906ac 
Bump sigstore/cosign-installer from f713795cb21599bc4e5c4b58cbad1da852d7eeb9 to 398d4b0eeef1380460a10c8013a76f728fb906ac
 2026-03-22 00:32:40 +01:00
DeusData 2f0ce8c7cf Merge pull request #95 from DeusData/dependabot/github_actions/actions/attest-build-provenance-e8998f949152b193b063cb0ec769d69d929409be 
Bump actions/attest-build-provenance from 96b4a1ef7235a096b17240c259729fdd70c83d45 to e8998f949152b193b063cb0ec769d69d929409be
 2026-03-22 00:32:37 +01:00
Martin Vogel 0888726073 Add security defense tests + eliminate system() command injection 
TDD: 31 security tests covering shell injection prevention, SQLite
authorizer (ATTACH/DETACH blocked), SQL injection via Cypher, path
containment, and shell-free subprocess execution.

- Add cbm_exec_no_shell() in compat_fs: fork+execvp (POSIX), _spawnvp
  (Windows) — executes commands without shell interpretation
- Replace system() with cbm_exec_no_shell() for unzip extraction and
  version verification in update command — eliminates CodeQL
  command-line-injection alerts
- CodeQL: switch to build-mode manual for 100% source file coverage
- CodeQL gate: fix race condition between scan completion and alert API
  propagation (60s settle + double-check polling)
- Dismiss TOCTOU in pass_envscan.c (benign read-only directory walk)
 2026-03-21 23:02:34 +01:00
Martin Vogel aa2b60be7d Fix 29 CodeQL alerts: command injection, snprintf overflow, TOCTOU races 
- Command injection (CRITICAL): validate shell args before system() in
  update command's unzip and version-check calls
- TOCTOU cli.c: use open(O_CREAT, 0755) + fdopen() to set permissions
  atomically instead of fopen() + chmod() after close
- TOCTOU pass_envscan.c: open file first, then fstat() on fd to check
  size, eliminating stat-then-open race window
- Overflowing snprintf (11 locations): clamp offset after each append
  to prevent unsigned underflow on truncation in cypher.c, store.c,
  http_server.c, test_c_lsp.c
- Add CBM_SNPRINTF_APPEND macro in str_util.h for future safe appends
- CodeQL: remove pull_request trigger (only scan push to main)
- CodeQL gate: increase timeout from 30 to 45 minutes
- Add fuzz testing script (random JSON-RPC + Cypher mutations)
- 12 Scorecard governance alerts dismissed (not code vulnerabilities)
 2026-03-21 22:18:31 +01:00
Martin Vogel 4322116349 CodeQL gate: wait for scan on current commit (max 30 min) 2026-03-21 20:51:35 +01:00
Martin Vogel f3e4eeafb1 Add CodeQL SAST + Scorecard + badges + LICENSE in archives 2026-03-21 20:44:31 +01:00
Martin Vogel 6bc40c42e3 Include LICENSE file in all release archives 2026-03-21 20:23:42 +01:00
Martin Vogel 785748cbdb Add OpenSSF Scorecard workflow (weekly + push to main) 2026-03-21 20:14:55 +01:00
Martin Vogel 6e0ad6bc61 Scorecard: threshold gate (>=4.0) instead of inline report 2026-03-21 20:11:02 +01:00
dependabot[bot] 7f984ced61 Bump crazy-max/ghaction-virustotal from 4.2.0 to 5.0.0 
Bumps [crazy-max/ghaction-virustotal](https://github.com/crazy-max/ghaction-virustotal) from 4.2.0 to 5.0.0.
- [Release notes](https://github.com/crazy-max/ghaction-virustotal/releases)
- [Commits](https://github.com/crazy-max/ghaction-virustotal/compare/d34968c958ae283fe976efed637081b9f9dcf74f...936d8c5c00afe97d3d9a1af26d017cfdf26800a2)

---
updated-dependencies:
- dependency-name: crazy-max/ghaction-virustotal
  dependency-version: 5.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-03-21 17:51:30 +00:00
Martin Vogel d974b50304 VirusTotal: scan extracted binaries, not archives 
Archives >3MB may not be unpacked by VirusTotal, meaning only the
container gets scanned (meaningless). Now extracts the actual
executables from tar.gz/zip before uploading to VirusTotal.
Users still download archives (preserves Unix permissions).
Also fixes analysis ID parsing (base64 format, not SHA256).
Also fixes SBOM format (SPDX 2.3 instead of CycloneDX).
 2026-03-21 18:48:51 +01:00
Martin Vogel 88f8908c41 Fix VirusTotal: use /analyses/ endpoint with base64 analysis ID 2026-03-21 18:44:37 +01:00
Martin Vogel 1d0889e5f9 Fix SBOM: use SPDX 2.3 format (CycloneDX failed schema validation) 2026-03-21 18:15:42 +01:00
Martin Vogel b6c32a4f13 Skip SBOM attestation (schema validation fails), keep as release asset 2026-03-21 18:10:55 +01:00
Martin Vogel 77b9e7def7 Fix SBOM: use python3 for valid JSON (heredoc indentation broke format) 2026-03-21 17:46:08 +01:00
Martin Vogel e2b7797d47 Fix ClamAV macOS: suppress X509 SSL errors in freshclam 2026-03-21 17:18:35 +01:00
dependabot[bot] 876ba6508c Bump actions/attest-build-provenance 
Bumps [actions/attest-build-provenance](https://github.com/actions/attest-build-provenance) from 96b4a1ef7235a096b17240c259729fdd70c83d45 to e8998f949152b193b063cb0ec769d69d929409be.
- [Release notes](https://github.com/actions/attest-build-provenance/releases)
- [Changelog](https://github.com/actions/attest-build-provenance/blob/main/RELEASE.md)
- [Commits](https://github.com/actions/attest-build-provenance/compare/96b4a1ef7235a096b17240c259729fdd70c83d45...e8998f949152b193b063cb0ec769d69d929409be)

---
updated-dependencies:
- dependency-name: actions/attest-build-provenance
  dependency-version: e8998f949152b193b063cb0ec769d69d929409be
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-03-21 15:59:54 +00:00
dependabot[bot] b1297f0a9c Bump sigstore/cosign-installer 
Bumps [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer) from f713795cb21599bc4e5c4b58cbad1da852d7eeb9 to 398d4b0eeef1380460a10c8013a76f728fb906ac.
- [Release notes](https://github.com/sigstore/cosign-installer/releases)
- [Commits](https://github.com/sigstore/cosign-installer/compare/f713795cb21599bc4e5c4b58cbad1da852d7eeb9...398d4b0eeef1380460a10c8013a76f728fb906ac)

---
updated-dependencies:
- dependency-name: sigstore/cosign-installer
  dependency-version: 398d4b0eeef1380460a10c8013a76f728fb906ac
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-03-21 15:59:50 +00:00
dependabot[bot] aac0fec568 Bump actions/setup-node from 4.4.0 to 6.3.0 
Bumps [actions/setup-node](https://github.com/actions/setup-node) from 4.4.0 to 6.3.0.
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](https://github.com/actions/setup-node/compare/49933ea5288caeca8642d1e84afbd3f7d6820020...53b83947a5a98c8d113130e565377fae1a50d02f)

---
updated-dependencies:
- dependency-name: actions/setup-node
  dependency-version: 6.3.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-03-21 15:59:44 +00:00
Martin Vogel dd30132e2d Pin Actions to SHA + enforce via security audit + Dependabot 
- All GitHub Actions pinned to immutable commit SHAs (prevents
  tag-poisoning attacks like tj-actions/changed-files incident)
- Security audit (Layer 1) now blocks unpinned Actions in CI
- Dependabot configured to auto-propose SHA updates weekly
- Pre-commit hooks tracked in scripts/hooks/ for contributors
- Time-bomb detection + MCP file read audit added to Layer 1
 2026-03-21 16:57:17 +01:00