11 Commits
Author SHA1 Message Date
John Smith 9069ae535d fix(distro): persist the RPM version into the spec so COPR builds
COPR re-expands the spec inside the SRPM without the transient
`--define _pkg_version`/`--define _pkg_release` flags, so the spec fell back to
the template default (0.4.0) and Source0 pointed at a tarball name that does
not exist. Every COPR build failed with:
  Bad file: /builddir/build/SOURCES/drop-desktop-client-alpha-0.4.0.tar.gz
Bake the resolved version/release into the generated spec so the SRPM is
self-consistent.

Refs #65 (COPR channel).
2026-09-14 19:55:55 -04:00
John Smith ff3871b4d9 fix: address SonarCloud findings (dist scripts, plugins) 2026-09-13 22:55:18 -04:00
John Smith bdde5f1c40 fix(dist): extract drop-app from Tauri deb without leading ./
Tauri's deb bundler writes data.tar members as usr/bin/drop-app (no ./
prefix), so the PPA/COPR extraction of ./usr/bin/drop-app failed with
"tar: ./usr/bin/drop-app: Not found in archive", failing prepare-ppa-source.sh.

Match the member with --wildcards '*usr/bin/drop-app' (handles both the
Tauri and dpkg ./ layouts) in scripts/distro/common.sh and both workflows.
2026-09-13 22:30:14 -04:00
John Smith bb561ea404 refactor(dist): publish PPA via yuezk/publish-ppa-package
- replace the in-house Debian source builder and gpg-preset signing with
  the pinned yuezk/publish-ppa-package action for both channels
- add scripts/distro/prepare-ppa-source.sh producing the source tarball and
  generated debian/ directory the action consumes
- drop build-deb-source.sh and setup-gpg.sh; PPA_GPG_KEY_ID is no longer
  needed (the action derives the key id) and the key secret is now armored
- update PPA docs/variables to the heretek-games Launchpad team
- keep the COPR SRPM + copr-cli approach unchanged
2026-09-13 22:06:19 -04:00
John Smith 4f33488397 feat(dist): add Ubuntu PPA + Fedora COPR publishing
- add a real Debian source-package tree and an RPM SRPM builder under
  scripts/distro, wrapping the prebuilt Tauri binary
- publish stable channels manually on a release or v* tag (ppa-stable,
  copr-stable) and alpha channels on every develop push (ppa-alpha,
  copr-alpha)
- map alpha semver X.Y.Z-alpha.N.sha to the tilde package version
  X.Y.Z~alpha.N+sha so alphas sort below stable in apt/dnf
- unify all distribution IDs on the Tauri identifier org.droposs.client
  (.Alpha) across Flatpak, AppStream, .desktop and FlatPark
- document setup/secrets and update the Ubuntu/Fedora install guides
2026-09-13 21:42:23 -04:00
John Smith 9af1a385ac fix(quality): address review findings on the tooling overhaul
- Restore the Sonar-preferred <output> elements (with an accessible name) so
  the status-role regression and the 11 new Web:S6819 findings are gone.
- Run `nuxt prepare` before desktop/main eslint so the gitignored generated
  config exists in CI and the pre-push hook.
- Satisfy the Sonar shell rules in scripts/agent-quality*.sh and run-tool.sh
  ([[ ]], explicit return, default case arms).
- Extract the duplicated news query validation into
  server/server/internal/news/query.ts.
- Make the sonar CLI lookup portable and pin typos in CI.
2026-09-13 19:07:14 -04:00
John Smith 356a4cb978 chore: add agent quality integrations and CI lint jobs
- Wire Sonar secrets scanning + MCP for Claude Code (.claude, .mcp.json),
  Cursor (.cursor) and Codex (.codex), and add a PostToolUse editor hook that
  formats through scripts/agent-quality.sh.
- Add the opencode project config, a quality plugin that formats edited files,
  and sonar-triage/quality-gates skills.
- Add CI jobs for ruff, typos, commitlint and a frontend-lint matrix across
  desktop/main, libraries/base, sites/promo and sites/docs.
- Adopt typos repo-wide and fix the real typos it found (recieve, finialise,
  Exipre, applcation, ...), excluding locales, migrations and generated output
  in _typos.toml.
- Give ModalStack an erased callback shape so the typed createModal API still
  typechecks through the shared state.
2026-09-13 18:52:16 -04:00
John Smith 1c3695ea90 chore: add mise toolchain, commitlint, ruff and hardened git hooks
- Pin local toolchain versions in .mise.toml (node, pnpm, python, go, rust,
  shellcheck, shfmt, hadolint, actionlint, ruff, gitleaks, typos).
- Route hook tools through scripts/run-tool.sh so a missing tool fails with an
  actionable 'mise install' message instead of silently skipping.
- Add shellcheck, hadolint, actionlint, ruff (check+format), typos and mandatory
  gitleaks to pre-commit; commitlint to commit-msg; server lint and cargo fmt
  to pre-push.
- Enable gocognit/gocyclo/misspell in golangci-lint.
- Adopt ruff for server/dev-tools Python (formatting + lint).
2026-09-13 18:19:52 -04:00
John Smith c20e1d1473 Merge upstream Drop-OSS/drop develop into fork
Sync Heretek-AI/drop develop with Drop-OSS/drop@344b89c5.

Resolutions:
- CI workflows: take upstream wholesale (checkout v7, pnpm v6,
  setup-node v7, docker action bumps, devcontainer/CI pipeline fixes)
- server/package.json: adopt upstream placement + simplewebauthn ^13.3.2;
  keep Prisma 7.10.0
- server/internal/metadata/steam.ts: keep hardened single-pass entity
  decoder; adopt full_description undefined fix
- .gitignore: union of both sides
- pnpm-lock.yaml regenerated (security overrides preserved via
  pnpm-workspace.yaml)
- scripts/clippy-changed.sh: exclude desktop/src-tauri per documented intent
2026-09-12 21:04:50 -04:00
BillyOutlastandJohn Smith 342d15b949 Remediate all 680 SonarCloud issues for Heretek-AI_drop2 (#5)
* chore: gitignore SonarCloud issue dump and local fix scripts

* fix(sast): remediate SonarCloud mechanical issues (S9011, S6822, S7772, S2933, S1128)

- add explicit type="button" to bare vue/tsx buttons (S9011)
- drop redundant role="list" on ul/ol (Web:S6822)
- prefix node: builtin imports (S7772)
- mark never-modified class members readonly via flows (S2933)
- prune unused named imports (S1128)

Covers 89+25+35+32+30 = 211 of 680 open issues.

* fix(sast): remediate SonarCloud optional-chain/refactor rules

- S6582: nullish-guard -> optional chain (28)
- S6759: React props inline types -> Readonly<Props> (35)
- S7754: findIndex/find-filter .length -> .some (17)
- S3626: remove redundant trailing continue/return (16)
- S7752: .map().flat() -> .flatMap (10)
- S7723: Array() -> new Array (6)
- S7755: [len-1] -> .at(-1) (with non-null assertion in lastItem)
- S7750: .filter().at(0) -> .find (1)

* fix(sast): shell, Docker, and workflow hardening

- shelldre:S7688: if [ .. ] -> [[ .. ]] in clippy-changed.sh + version_update.sh (6)
- docker:S7018: alphabetical apt package sort in Dockerfile (2)
- docker/githubactions:S6505: add --ignore-scripts to pnpm install runs (5 workflow + 1 Dockerfile)

* fix(sast): remediate SonarCloud a11y and small-refactor rules (Phase 3)

* fix(sast): Phase 4 code-able security hardening

- typescript:S4790: md5 -> sha256 in server/internal/library/import tasks + fsBackend object hash (non-cryptographic use, no value dependency)
- swift:S1481: remove unused status local in appletrust/add-certificate.swift
- swift:S1066: merge nested if-let in getCertificateFromString
- javascript:S7767: | 0 -> Math.trunc in base32 pad calc
- javascript:S7751: [].concat(...) -> .flatMap(...) in base32 decoder
- shell:S6506: add --max-redirect=5 to wget in optimize-appimage.sh

Lockfile policy (text:S8570/S8549), prisma migrations (plsql), TODOs (S1135),
SHA-pinning (S7637), regex backtracking (S8786), PATH-taint (S4036), and the
OIDC-Spec URI (S5332) are addressed by SonarCloud-side wontfix accepts in
the following commit.

---------

Co-authored-by: John Smith <[email protected]>
2026-08-27 20:17:39 -04:00
John SmithandClaude Opus 5 4aaf756b47 chore: add lefthook git hooks and polyglot static analysis toolchain
- lefthook (pnpm devDep, auto-installed via prepare script): pre-commit
  runs prettier + eslint --fix on staged files, ast-grep structural scan,
  gitleaks secret scan; pre-push runs server typecheck, per-crate clippy,
  golangci-lint (--new-from-rev rollout mode), knip report-only
- knip.json workspace config; baseline recorded in CLAUDE.md
- sgconfig.yml + starter rules (no-console-log TS/Vue, no-fmt-println Go)
- backend/.golangci.yml v2 with gosec; golangci-lint job added to CI
- security.yml: gitleaks history scan, cargo-audit matrix over all 7 Rust
  crates, weekly scheduled semgrep SARIF upload (semgrep-scheduled.yml)
- root .prettierrc.json shared across the workspace
- server-ci.yml: non-blocking knip report artifact job

Co-Authored-By: Claude Opus 5 <[email protected]>
2026-08-26 01:07:01 -04:00