antirez · fabriciofx · Aug 29, 2025 · Aug 29, 2025 · Aug 29, 2025 · Aug 29, 2025
diff --git a/.github/workflows/action-lint.yml b/.github/workflows/action-lint.yml
@@ -0,0 +1,35 @@
+# SPDX-FileCopyrightText: Copyright (C) 2025 Fabrício Barros Cabral
+# SPDX-License-Identifier: MIT
+---
+name: action-lint
+'on':
+  push:
+    branches:
+      - main
+      - master
+  pull_request:
+    branches:
+      - main
+      - master
+defaults:
+  run:
+    shell: bash -xeuo pipefail {0}
+permissions:
+  contents: read
+jobs:
+  action-lint:
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v5
+        with:
+          persist-credentials: false
+      - name: Download and installs actionlint
+        # yamllint disable rule:line-length
+        run: |
+          curl -sS -L --retry 3 -o /tmp/download-actionlint.bash \
+            https://raw.githubusercontent.com/rhysd/actionlint/main/scripts/download-actionlint.bash
+          bash /tmp/download-actionlint.bash latest /tmp
+        # yamllint enable rule:line-length
+      - name: Check workflow files
+        run: /tmp/actionlint -color
diff --git a/.github/workflows/action-security.yml b/.github/workflows/action-security.yml
@@ -0,0 +1,48 @@
+# SPDX-FileCopyrightText: Copyright (C) 2025 Fabrício Barros Cabral
+# SPDX-License-Identifier: MIT
+---
+name: action-security
+'on':
+  push:
+    branches:
+      - main
+      - master
+  pull_request:
+    branches:
+      - main
+      - master
+defaults:
+  run:
+    shell: bash -xeuo pipefail {0}
+jobs:
+  action-security:
+    runs-on: ubuntu-24.04
+    permissions:
+      security-events: write
+      contents: read
+      actions: read
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v5
+        with:
+          persist-credentials: false
+      - name: Download and installs zizmor
+        run: |
+          site="https://github.com/zizmorcore/zizmor/releases/latest/download"
+          file="zizmor-x86_64-unknown-linux-gnu.tar.gz"
+          curl -sS -L --retry 3 -o /tmp/${file} ${site}/${file}
+          mkdir /tmp/as
+          tar xfz /tmp/${file} -C /tmp/as --no-same-owner --no-same-permissions
+          chmod +x /tmp/as/zizmor
+      - name: Check security in workflow files
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          /tmp/as/zizmor .github/workflows --config .github/zizmor.yml
+      - name: Stop pipeline if issues are found
+        run: |
+          if grep -q "error" zizmor.log; then
+            echo "Zizmor found some security issues:"
+            cat zizmor.log
+            exit 1
+          fi
diff --git a/.github/workflows/action-update.yml b/.github/workflows/action-update.yml
@@ -0,0 +1,29 @@
+# SPDX-FileCopyrightText: Copyright (C) 2025 Fabrício Barros Cabral
+# SPDX-License-Identifier: MIT
+---
+name: action-update
+'on':
+  schedule:
+    - cron: '0 2 * * *'
+  workflow_dispatch:
+defaults:
+  run:
+    shell: bash -xeuo pipefail {0}
+permissions:
+  contents: read
+jobs:
+  action-update:
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v5
+        with:
+          persist-credentials: false
+      - name: Setup node.js
+        uses: actions/setup-node@v5
+        with:
+          node-version: '22'
+      - name: Run renovate
+        uses: renovatebot/github-action@7876d7a812254599d262d62b6b2c2706018258a2
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/c-cpp-build.yml b/.github/workflows/c-cpp-build.yml
@@ -0,0 +1,204 @@
+# SPDX-FileCopyrightText: Copyright (C) 2025 Fabrício Barros Cabral
+# SPDX-License-Identifier: MIT
+---
+name: c-cpp-build
+'on':
+  push:
+    branches:
+      - main
+      - master
+  pull_request:
+    branches:
+      - main
+      - master
+defaults:
+  run:
+    shell: bash -xeuo pipefail {0}
+permissions:
+  contents: read
+jobs:
+  c-cpp-linux-build:
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v5
+        with:
+          persist-credentials: false
+      - name: Configure apt cache
+        uses: actions/cache@v4
+        with:
+          path: /var/cache/apt/archives
+          key: ${{ runner.os }}-apt-${{ hashFiles('**/apt-packages.txt') }}
+          restore-keys: ${{ runner.os }}-apt-
+      - name: Install dependencies
+        run: |
+          sudo apt-get update
+          if [ -s apt-packages.txt ]; then
+            xargs -a apt-packages.txt sudo apt-get install \
+              -y --no-install-recommends
+          fi
+      - name: Configure and build
+        run: |
+          [ -x ./autogen.sh ] && ./autogen.sh
+          [ -x ./configure ] && ./configure
+          [ -s Makefile ] || {
+            echo "I couldn't find an autogen.sh, configure, or Makefile."
+            echo "Please check your files."
+            exit 1
+          }
+          make
+      - name: Get properties from configure.ac
+        id: props
+        # yamllint disable rule:line-length
+        run: |
+          name="$(sed -n 's/AC_INIT(\[\([^]]*\)\],.*/\1/p' configure.ac)"
+          echo "name=${name}" >> "${GITHUB_OUTPUT}"
+          version="$(sed -n 's/AC_INIT(\[[^]]*\], \[\([^]]*\)\], \[[^]]*\])/\1/p' configure.ac)"
+          echo "version=${version}" >> "${GITHUB_OUTPUT}"
+        # yamllint enable rule:line-length
+      - name: Create source package
+        run: |
+          make dist
+      - name: Create Linux binary package
+        run: |
+          make binary-dist
+      - name: Prepare packages to distribution
+        env:
+          NAME: ${{ steps.props.outputs.name }}
+          VERSION: ${{ steps.props.outputs.version }}
+        run: |
+          # Sanitize variables for security purposes
+          safe_name="$(echo "${NAME}" | tr -cd '[:alnum:]._-' )"
+          safe_version="$(echo "${VERSION}" | tr -cd '[:alnum:]._-' )"
+
+          # Check if variables are empty
+          [ -z "$safe_name" ] && { echo "Invalid name"; exit 1; }
+          [ -z "$safe_version" ] && { echo "Invalid version"; exit 1; }
+
+          # Check if files exists
+          src="${safe_name}-${safe_version}.tar.gz"
+          bin="${safe_name}-${safe_version}-bin.tar.gz"
+          [ -f "$src" ] || { echo "File '${src}' not found"; exit 1; }
+          [ -f "$bin" ] || { echo "File '${bin}' not found"; exit 1; }
+
+          # Move files
+          mkdir -p dist
+          mv "${src}" dist/
+          mv "${bin}" "dist/${safe_name}-${safe_version}-linux.tar.gz"
+  c-cpp-macos-build:
+    runs-on: macos-15
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v5
+        with:
+          persist-credentials: false
+      - name: Install dependencies
+        run: |
+          brew update
+          if [ -s brew-packages.txt ]; then
+            xargs brew install < brew-packages.txt
+          fi
+      - name: Configure and build
+        run: |
+          [ -x ./autogen.sh ] && ./autogen.sh
+          [ -x ./configure ] && ./configure
+          [ -s Makefile ] || {
+            echo "I couldn't find an autogen.sh, configure, or Makefile."
+            echo "Please check your files."
+            exit 1
+          }
+          make
+      - name: Get properties from configure.ac
+        id: props
+        # yamllint disable rule:line-length
+        run: |
+          name="$(sed -n 's/AC_INIT(\[\([^]]*\)\],.*/\1/p' configure.ac)"
+          echo "name=${name}" >> "${GITHUB_OUTPUT}"
+          version="$(sed -n 's/AC_INIT(\[[^]]*\], \[\([^]]*\)\], \[[^]]*\])/\1/p' configure.ac)"
+          echo "version=${version}" >> "${GITHUB_OUTPUT}"
+        # yamllint enable rule:line-length
+      - name: Create macOS binary package
+        run: |
+          make binary-dist
+      - name: Prepare package to distribution
+        env:
+          NAME: ${{ steps.props.outputs.name }}
+          VERSION: ${{ steps.props.outputs.version }}
+        run: |
+          # Sanitize variables for security purposes
+          safe_name="$(echo "${NAME}" | tr -cd '[:alnum:]._-' )"
+          safe_version="$(echo "${VERSION}" | tr -cd '[:alnum:]._-' )"
+
+          # Check if variables are empty
+          [ -z "$safe_name" ] && { echo "Invalid name"; exit 1; }
+          [ -z "$safe_version" ] && { echo "Invalid version"; exit 1; }
+
+          # Check if file exist
+          bin="${safe_name}-${safe_version}-bin.tar.gz"
+          [ -f "$bin" ] || { echo "File '${bin}' not found"; exit 1; }
+
+          # Move file
+          mkdir -p dist
+          mv "${bin}" dist/"${safe_name}-${safe_version}-macos.tar.gz"
+  c-cpp-windows-build:
+    runs-on: windows-2025
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v5
+        with:
+          persist-credentials: false
+      - name: Install and setup MSYS2 with MinGW64
+        uses: msys2/setup-msys2@fb197b72ce45fb24f17bf3f807a388985654d1f2
+        with:
+          msystem: MINGW64
+          update: true
+          install: >-
+            base-devel
+            autoconf
+            automake
+            libtool
+            mingw-w64-x86_64-toolchain
+            mingw-w64-x86_64-make
+            mingw-w64-x86_64-pkgconf
+            mingw-w64-x86_64-libpcap
+            mingw-w64-x86_64-tcl
+      - name: Configure and build
+        shell: msys2 {0}
+        run: |
+          [ -x ./autogen.sh ] && ./autogen.sh
+          [ -x ./configure ] && ./configure --host=x86_64-w64-mingw64
+          [ -s Makefile ] || {
+            echo "I couldn't find an autogen.sh, configure, or Makefile."
+            echo "Please check your files."
+            exit 1
+          }
+          make
+      - name: Get properties from configure.ac
+        id: props
+        # yamllint disable rule:line-length
+        run: |
+          name="$(sed -n 's/AC_INIT(\[\([^]]*\)\],.*/\1/p' configure.ac)"
+          echo "name=${name}" >> "${GITHUB_OUTPUT}"
+          version="$(sed -n 's/AC_INIT(\[[^]]*\], \[\([^]]*\)\], \[[^]]*\])/\1/p' configure.ac)"
+          echo "version=${version}" >> "${GITHUB_OUTPUT}"
+        # yamllint enable rule:line-length
+      - name: Create source package
+        run: |
+          make dist
+      - name: Create Windows binary package
+        run: |
+          make binary-dist
+      - name: Prepare packages to distribution
+        env:
+          NAME: ${{ steps.props.outputs.name }}
+          VERSION: ${{ steps.props.outputs.version }}
+        # yamllint disable rule:line-length
+        run: |
+          md dist
+          move "${NAME}-${VERSION}-bin.zip" "dist/${NAME}-${VERSION}-windows.zip"
+        # yamllint enable rule:line-length
+      - name: Upload Windows artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: windows-dist
+          path: dist/*.zip