Skip to content

Commit f3e4eea

Browse files
DeusDataDeusData
committed
Add CodeQL SAST + Scorecard + badges + LICENSE in archives
1 parent 6bc40c4 commit f3e4eea

5 files changed

Lines changed: 77 additions & 1 deletion

File tree

‎.github/workflows/codeql.yml‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
name: CodeQL SAST
2+
3+
on:
4+
push:
5+
branches: [main]
6+
pull_request:
7+
branches: [main]
8+
9+
permissions:
10+
security-events: write
11+
contents: read
12+
13+
jobs:
14+
analyze:
15+
runs-on: ubuntu-latest
16+
steps:
17+
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
18+
19+
- name: Initialize CodeQL
20+
uses: github/codeql-action/init@38697555549f1db7851b81482ff19f1fa5c4fedc # v4
21+
with:
22+
languages: c-cpp
23+
build-mode: none
24+
25+
- name: Perform CodeQL Analysis
26+
uses: github/codeql-action/analyze@38697555549f1db7851b81482ff19f1fa5c4fedc # v4
27+
with:
28+
category: "/language:c-cpp"

‎.github/workflows/dry-run.yml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -75,6 +75,26 @@ jobs:
7575
- name: "Layer 8: Vendored dependency integrity"
7676
run: scripts/security-vendored.sh
7777

78+
# ── Step 1c: CodeQL SAST gate (checks for open alerts) ──────
79+
# CodeQL runs on push/PR via codeql.yml. This gate checks if
80+
# there are any open critical/high code scanning alerts.
81+
codeql-gate:
82+
if: ${{ !inputs.skip_lint }}
83+
runs-on: ubuntu-latest
84+
steps:
85+
- name: Check for open code scanning alerts
86+
env:
87+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
88+
run: |
89+
ALERTS=$(gh api repos/${{ github.repository }}/code-scanning/alerts?state=open --jq 'length' 2>/dev/null || echo "0")
90+
echo "Open code scanning alerts: $ALERTS"
91+
if [ "$ALERTS" -gt 0 ]; then
92+
echo "BLOCKED: $ALERTS open code scanning alert(s) found."
93+
echo "Fix them before releasing: https://github.com/${{ github.repository }}/security/code-scanning"
94+
exit 1
95+
fi
96+
echo "=== CodeQL gate passed (0 open alerts) ==="
97+
7898
# ── Step 2: Unit tests (ASan + UBSan) ───────────────────────
7999
# macOS: use cc (Apple Clang) — GCC on macOS doesn't ship ASan runtime
80100
# Linux: use system gcc — full ASan/UBSan support

‎.github/workflows/release.yml‎

Lines changed: 18 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -76,6 +76,23 @@ jobs:
7676
- name: "Layer 8: Vendored dependency integrity"
7777
run: scripts/security-vendored.sh
7878

79+
# ── Step 1c: CodeQL SAST gate (checks for open alerts) ──────
80+
codeql-gate:
81+
runs-on: ubuntu-latest
82+
steps:
83+
- name: Check for open code scanning alerts
84+
env:
85+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
86+
run: |
87+
ALERTS=$(gh api repos/${{ github.repository }}/code-scanning/alerts?state=open --jq 'length' 2>/dev/null || echo "0")
88+
echo "Open code scanning alerts: $ALERTS"
89+
if [ "$ALERTS" -gt 0 ]; then
90+
echo "BLOCKED: $ALERTS open code scanning alert(s) found."
91+
echo "Fix them before releasing: https://github.com/${{ github.repository }}/security/code-scanning"
92+
exit 1
93+
fi
94+
echo "=== CodeQL gate passed (0 open alerts) ==="
95+
7996
# ── Step 2: Unit tests (ASan + UBSan) ───────────────────────
8097
# macOS: use cc (Apple Clang) — GCC on macOS doesn't ship ASan runtime
8198
# Linux: use system gcc — full ASan/UBSan support
@@ -391,7 +408,7 @@ jobs:
391408
392409
# ── Step 5: Create DRAFT release (not public yet) ─────────────
393410
release-draft:
394-
needs: [smoke-unix, smoke-windows, security-static]
411+
needs: [smoke-unix, smoke-windows, security-static, codeql-gate]
395412
runs-on: ubuntu-latest
396413
permissions:
397414
contents: write

‎README.md‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,15 @@
11
# codebase-memory-mcp
22

3+
[![GitHub Release](https://img.shields.io/github/v/release/DeusData/codebase-memory-mcp?style=flat&color=blue)](https://github.com/DeusData/codebase-memory-mcp/releases/latest)
4+
[![License](https://img.shields.io/badge/license-MIT-green)](LICENSE)
5+
[![CI](https://img.shields.io/github/actions/workflow/status/DeusData/codebase-memory-mcp/dry-run.yml?label=CI)](https://github.com/DeusData/codebase-memory-mcp/actions/workflows/dry-run.yml)
6+
[![Tests](https://img.shields.io/badge/tests-2042_passing-brightgreen)](https://github.com/DeusData/codebase-memory-mcp)
7+
[![Languages](https://img.shields.io/badge/languages-64-orange)](https://github.com/DeusData/codebase-memory-mcp)
8+
[![Agents](https://img.shields.io/badge/agents-10-purple)](https://github.com/DeusData/codebase-memory-mcp)
9+
[![Pure C](https://img.shields.io/badge/pure_C-zero_dependencies-blue)](https://github.com/DeusData/codebase-memory-mcp)
10+
[![Platform](https://img.shields.io/badge/macOS_%7C_Linux_%7C_Windows-supported-lightgrey)](https://github.com/DeusData/codebase-memory-mcp/releases/latest)
11+
[![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/DeusData/codebase-memory-mcp/badge)](https://scorecard.dev/viewer/?uri=github.com/DeusData/codebase-memory-mcp)
12+
313
**The fastest and most efficient code intelligence engine for AI coding agents.** Full-indexes an average repository in milliseconds, the Linux kernel (28M LOC, 75K files) in 3 minutes. Answers structural queries in under 1ms. Ships as a single static binary for macOS, Linux, and Windows — download, run `install`, done.
414

515
High-quality parsing through [tree-sitter](https://tree-sitter.github.io/tree-sitter/) AST analysis across all 64 languages, enhanced with LSP-style hybrid type resolution for Go, C, and C++ (more languages coming soon) — producing a persistent knowledge graph of functions, classes, call chains, HTTP routes, and cross-service links. 14 MCP tools. Zero dependencies. Plug and play across 10 coding agents.

‎SECURITY.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,7 @@ This project implements multiple layers of security verification. Every release
2828
- **All dangerous function calls** require a reviewed entry in `scripts/security-allowlist.txt`
2929
- **Time-bomb pattern detection** — scans for `time()`/`sleep()` near dangerous calls (could indicate delayed activation)
3030
- **MCP tool handler file read audit** — tracks file read count in `mcp.c` against an expected maximum (detects added file reads that could exfiltrate data through tool responses)
31+
- **CodeQL SAST** — static application security testing on every push (taint analysis, CWE detection, data flow tracking). Any open alert blocks the release.
3132
- **Native antivirus scanning** on every platform (any detection fails the build):
3233
- **Windows**: Windows Defender with ML heuristics — the same engine end users run
3334
- **Linux**: ClamAV with daily signature updates

0 commit comments

Comments
 (0)