Skip to content

Commit 99f163a

Browse files
OnlineFixOnlineFix
committed
[verified] harden CI and contributor workflow
1 parent 25c8dc4 commit 99f163a

10 files changed

Lines changed: 679 additions & 5 deletions

File tree

‎.github/ISSUE_TEMPLATE/bug_report.yml‎

Lines changed: 133 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,133 @@
1+
name: Bug report
2+
description: Report a reproducible Pearipherals problem without exposing private device data
3+
title: "[Bug]: "
4+
body:
5+
- type: markdown
6+
attributes:
7+
value: |
8+
Thanks for helping improve Pearipherals. Search existing issues first and describe only behavior you can reproduce.
9+
10+
**Privacy:** remove usernames, device identifiers, Bluetooth addresses, serial numbers, full local paths, registry exports, credentials and other sensitive information. Do not attach raw HID traces; collecting or sharing them requires explicit maintainer coordination. Do not upload a complete configuration, error log, crash dump or registry export.
11+
12+
Suspected security vulnerabilities belong in a private GitHub Security Advisory, not this form.
13+
14+
- type: input
15+
id: pearipherals-version
16+
attributes:
17+
label: Pearipherals version
18+
description: Use the About/version information, release name or source commit. State whether the EXE is an unsigned prerelease.
19+
placeholder: "1.2.0 unsigned prerelease"
20+
validations:
21+
required: true
22+
23+
- type: input
24+
id: windows-version
25+
attributes:
26+
label: Windows version
27+
description: Include Windows 10/11, release and OS build; do not include a username or device name.
28+
placeholder: "Windows 11 24H2, OS build 26100.x"
29+
validations:
30+
required: true
31+
32+
- type: input
33+
id: device-model-revision
34+
attributes:
35+
label: Apple device model and revision
36+
description: Identify the product family and visible revision only. Do not include serial numbers, device identifiers or Bluetooth addresses.
37+
placeholder: "Magic Trackpad 2, model A1535"
38+
validations:
39+
required: true
40+
41+
- type: dropdown
42+
id: connection
43+
attributes:
44+
label: Connection or display data path
45+
description: Select the path relevant to the failure.
46+
options:
47+
- Bluetooth
48+
- USB data
49+
- USB-C to DisplayPort video-only
50+
- Other or unknown
51+
validations:
52+
required: true
53+
54+
- type: input
55+
id: driver-version
56+
attributes:
57+
label: Driver and version
58+
description: For trackpad reports, include the mac-precision-touchpad/AmtPtpHidFilter version. Otherwise enter "Not applicable".
59+
placeholder: "mac-precision-touchpad version or Not applicable"
60+
validations:
61+
required: true
62+
63+
- type: textarea
64+
id: reproduction-steps
65+
attributes:
66+
label: Reproduction steps
67+
description: Give the smallest repeatable sequence. Avoid repetitive hardware stress testing.
68+
placeholder: |
69+
1. Start Pearipherals...
70+
2. Select...
71+
3. Observe...
72+
validations:
73+
required: true
74+
75+
- type: textarea
76+
id: expected-behavior
77+
attributes:
78+
label: Expected behavior
79+
description: What should have happened?
80+
validations:
81+
required: true
82+
83+
- type: textarea
84+
id: actual-behavior
85+
attributes:
86+
label: Actual behavior
87+
description: What happened instead? Include exact redacted error text only when useful.
88+
validations:
89+
required: true
90+
91+
- type: dropdown
92+
id: sleep-wake
93+
attributes:
94+
label: Sleep/wake or reconnect relevance
95+
options:
96+
- Not involved
97+
- Happens after Windows sleep/wake
98+
- Happens after the Apple device sleeps/wakes
99+
- Happens after Bluetooth reconnect
100+
- Happens after reboot or sign-in
101+
- Unknown
102+
validations:
103+
required: true
104+
105+
- type: dropdown
106+
id: regression-status
107+
attributes:
108+
label: Regression status
109+
description: State whether the same setup worked in an earlier Pearipherals version.
110+
options:
111+
- New regression from an earlier working version
112+
- Never worked on this setup
113+
- Intermittent or unknown
114+
validations:
115+
required: true
116+
117+
- type: textarea
118+
id: redacted-context
119+
attributes:
120+
label: Additional redacted context
121+
description: Optional. Paste only the smallest relevant, privacy-reviewed excerpt. Do not attach raw HID traces, complete logs/configuration, full local paths or registry exports.
122+
123+
- type: checkboxes
124+
id: privacy-confirmation
125+
attributes:
126+
label: Privacy and safety confirmation
127+
options:
128+
- label: I removed usernames, device identifiers, Bluetooth addresses, serial numbers, full local paths, registry exports and credentials.
129+
required: true
130+
- label: I did not attach raw HID traces, complete logs/configuration or crash dumps; those require explicit maintainer coordination.
131+
required: true
132+
- label: I did not disable or recommend disabling Windows security protections to reproduce this report.
133+
required: true

‎.github/ISSUE_TEMPLATE/config.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
blank_issues_enabled: false
2+
contact_links:
3+
- name: Report a security vulnerability privately
4+
url: https://github.com/OnlineFix/Pearipherals/security/advisories/new
5+
about: Do not disclose security details in a public issue; send a private GitHub Security Advisory instead.

‎.github/ISSUE_TEMPLATE/feature_request.yml‎

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
name: Feature request
2+
description: Propose a focused, safe improvement to Pearipherals
3+
title: "[Feature]: "
4+
body:
5+
- type: markdown
6+
attributes:
7+
value: |
8+
Describe the user problem before proposing an implementation. Search existing issues first.
9+
10+
Remove sensitive information such as usernames, device identifiers, Bluetooth addresses, serial numbers, full local paths, configuration, logs, registry exports and credentials. Do not attach raw HID traces. Report security-sensitive ideas privately through GitHub Security Advisories.
11+
12+
- type: textarea
13+
id: user-problem
14+
attributes:
15+
label: User problem
16+
description: What cannot be done reliably today, and who encounters the problem?
17+
placeholder: "When I use ... I cannot ... because ..."
18+
validations:
19+
required: true
20+
21+
- type: textarea
22+
id: proposed-behavior
23+
attributes:
24+
label: Proposed behavior
25+
description: Describe the observable result, not only a preferred implementation.
26+
validations:
27+
required: true
28+
29+
- type: textarea
30+
id: alternatives
31+
attributes:
32+
label: Alternatives considered
33+
description: What workarounds or narrower approaches have you tried or considered?
34+
validations:
35+
required: true
36+
37+
- type: textarea
38+
id: hardware-scope
39+
attributes:
40+
label: Hardware and Windows scope
41+
description: Identify relevant Apple product families/revisions, connection paths, Windows releases and driver families without serial numbers or identifiers.
42+
placeholder: "Magic Trackpad 2 over Bluetooth on Windows 11 with mac-precision-touchpad ..."
43+
validations:
44+
required: true
45+
46+
- type: textarea
47+
id: safety-impact
48+
attributes:
49+
label: Safety, privacy and lifecycle impact
50+
description: Explain effects on input handling, synthetic events, registry or autostart state, device access, diagnostics/privacy, setup, upgrades and uninstall/rollback.
51+
placeholder: "Input handling: ...; registry: ...; privacy: ...; rollback: ..."
52+
validations:
53+
required: true
54+
55+
- type: checkboxes
56+
id: boundaries
57+
attributes:
58+
label: Project boundaries
59+
options:
60+
- label: The request does not require disabling Windows security protections.
61+
required: true
62+
- label: I removed sensitive information and did not attach raw traces, full logs/configuration or registry exports.
63+
required: true
64+
- label: I understand that hardware compatibility claims require real, accurately scoped evidence.
65+
required: true

‎.github/dependabot.yml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
version: 2
2+
updates:
3+
- package-ecosystem: "github-actions"
4+
directory: "/"
5+
schedule:
6+
interval: "weekly"
7+
day: "monday"
8+
time: "06:00"
9+
timezone: "Etc/UTC"
10+
open-pull-requests-limit: 3
11+
commit-message:
12+
prefix: "chore(actions)"

‎.github/pull_request_template.md‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
## Behavior summary
2+
3+
<!-- What user-visible or internal behavior changes? Keep refactors separate from behavior changes. -->
4+
5+
## Test-driven evidence
6+
7+
### RED evidence
8+
9+
<!-- Name the focused test and paste the expected failure reason observed before production code changed. -->
10+
11+
### GREEN evidence
12+
13+
<!-- Name the focused test and result after the minimum implementation. -->
14+
15+
### Complete test gate
16+
17+
- [ ] `python -m unittest discover -s tests -p "test_*.py" -v`
18+
- [ ] `python -m py_compile pearipherals.py pearipherals_core.py scripts/write_version_info.py tests/test_core.py tests/test_release.py`
19+
- [ ] `git diff --check`
20+
21+
## Manual hardware scope
22+
23+
- [ ] Not tested on hardware
24+
- [ ] Tested only the hardware/scenarios listed below
25+
26+
<!-- List Windows version, Apple device model/revision, connection, driver version and exact scenarios. Remove usernames, identifiers and Bluetooth addresses. Do not claim broader compatibility. -->
27+
28+
## Input and registry risk
29+
30+
- [ ] No input-hook, Raw Input, synthetic-event, autostart or registry behavior changes
31+
- [ ] Safety-sensitive behavior changed and failure/cleanup/restore tests are identified below
32+
33+
<!-- Explain fail-open behavior, held-input cleanup, backup/restore semantics and whether reconnect/restart could be required. -->
34+
35+
## Rollback
36+
37+
<!-- Explain how to reverse the source, persistent settings and deployed artifact safely. State what was preserved before any physical test. -->
38+
39+
## Security and privacy
40+
41+
- [ ] No credentials, local planning files, full paths, device identifiers, raw traces, complete logs/configuration or registry exports are included
42+
- [ ] Security-sensitive findings were reported privately rather than in this pull request
43+
- [ ] Documentation does not weaken Windows security guidance or overstate signing/trust
44+
45+
<!-- Describe any remaining security or privacy impact. -->
46+
47+
## Release impact
48+
49+
- [ ] No release/tag/asset impact
50+
- [ ] Release documentation or workflow review is required
51+
- [ ] This must not be published until trusted signing succeeds
52+
53+
<!-- Identify versioning, packaging, provenance, signing or compatibility-matrix effects. Pull requests do not publish releases. -->

‎.github/workflows/build-sign-release.yml‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -53,10 +53,11 @@ jobs:
5353
- name: Install hash-locked build dependencies without cache
5454
run: python -m pip install --disable-pip-version-check --no-cache-dir --require-hashes -r requirements-build.txt
5555

56-
- name: Run source verification
57-
run: |
58-
python -m unittest discover -s tests -p "test_*.py" -v
59-
python -m py_compile pearipherals.py pearipherals_core.py scripts/write_version_info.py tests/test_core.py tests/test_release.py
56+
- name: Run complete unit test gate
57+
run: python -m unittest discover -s tests -p "test_*.py" -v
58+
59+
- name: Run byte-compilation gate
60+
run: python -m py_compile pearipherals.py pearipherals_core.py scripts/write_version_info.py tests/test_core.py tests/test_release.py
6061

6162
- name: Generate version resource
6263
run: python scripts/write_version_info.py $env:PEARIPHERALS_VERSION build/pearipherals-version-info.txt
@@ -110,7 +111,7 @@ jobs:
110111
- name: Submit to SignPath
111112
id: sign
112113
if: github.ref_type == 'tag' || inputs.submit_for_signing
113-
uses: signpath/github-action-submit-signing-request@b9d91eadd323de506c0c81cf0c7fe7438f3360fd # v2
114+
uses: signpath/github-action-submit-signing-request@b9d91eadd323de506c0c81cf0c7fe7438f3360fd # v2.2
114115
with:
115116
api-token: ${{ secrets.SIGNPATH_API_TOKEN }}
116117
organization-id: ${{ vars.SIGNPATH_ORGANIZATION_ID }}

‎.github/workflows/ci.yml‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
name: CI
2+
3+
on:
4+
push:
5+
branches:
6+
- main
7+
pull_request:
8+
branches:
9+
- main
10+
11+
permissions:
12+
contents: read
13+
14+
concurrency:
15+
group: ${{ github.workflow }}-${{ github.ref }}
16+
cancel-in-progress: true
17+
18+
jobs:
19+
verify:
20+
runs-on: windows-2022
21+
steps:
22+
- name: Check out source without persisted credentials
23+
uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
24+
with:
25+
persist-credentials: false
26+
27+
- name: Set up Python
28+
uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
29+
with:
30+
python-version: "3.11.9"
31+
32+
- name: Install hash-locked dependencies without cache
33+
run: python -m pip install --disable-pip-version-check --no-cache-dir --require-hashes -r requirements-build.txt
34+
35+
- name: Run complete unit test gate
36+
run: python -m unittest discover -s tests -p "test_*.py" -v
37+
38+
- name: Run byte-compilation gate
39+
run: python -m py_compile pearipherals.py pearipherals_core.py scripts/write_version_info.py tests/test_core.py tests/test_release.py

0 commit comments

Comments
 (0)