From c09e4b61e756f8257ff10e47b6a12f74fdf33b27 Mon Sep 17 00:00:00 2001 From: Renn F Date: Mon, 28 Sep 2026 23:32:04 +0200 Subject: [PATCH 1/2] chore(scaffold): add community health files, phpstan static analysis, and advanced app smoke - security policy, contributing guide, code of conduct, funding, pull request template, and issue template set (fastapi-guard baseline) - static analysis workflow: phpstan via docker (ghcr.io/phpstan/phpstan) on push/pr to master plus weekly cron, level 3, zero findings - live smoke: dockerized advanced_app job (port 8081), assertions: / and /health 200 plus the /admin x-admin-token gate 400 block --- .github/FUNDING.yml | 14 +++ .github/ISSUE_TEMPLATE/bug.yml | 53 +++++++++ .github/ISSUE_TEMPLATE/config.yml | 11 ++ .github/ISSUE_TEMPLATE/docs.yml | 31 +++++ .github/ISSUE_TEMPLATE/feature.yml | 35 ++++++ .github/PULL_REQUEST_TEMPLATE.md | 61 ++++++++++ .github/workflows/live-smoke.yml | 67 +++++++++++ .github/workflows/static-analysis.yml | 93 +++++++++++++++ CODE_OF_CONDUCT.md | 162 ++++++++++++++++++++++++++ CONTRIBUTING.md | 39 +++++++ SECURITY.md | 36 ++++++ 11 files changed, 602 insertions(+) create mode 100644 .github/FUNDING.yml create mode 100644 .github/ISSUE_TEMPLATE/bug.yml create mode 100644 .github/ISSUE_TEMPLATE/config.yml create mode 100644 .github/ISSUE_TEMPLATE/docs.yml create mode 100644 .github/ISSUE_TEMPLATE/feature.yml create mode 100644 .github/PULL_REQUEST_TEMPLATE.md create mode 100644 .github/workflows/static-analysis.yml create mode 100644 CODE_OF_CONDUCT.md create mode 100644 CONTRIBUTING.md create mode 100644 SECURITY.md diff --git a/.github/FUNDING.yml b/.github/FUNDING.yml new file mode 100644 index 0000000..f02f17a --- /dev/null +++ b/.github/FUNDING.yml @@ -0,0 +1,14 @@ +# These are supported funding model platforms + +github: rennf93 +# patreon: # Replace with a single Patreon username +# open_collective: # Replace with a single Open Collective username +# ko_fi: # Replace with a single Ko-fi username +# tidelift: # not applicable for this ecosystem +# community_bridge: # Replace with a single Community Bridge project-name e.g., cloud-foundry +# liberapay: # Replace with a single Liberapay username +# issuehunt: # Replace with a single IssueHunt username +# lfx_crowdfunding: # Replace with a single LFX Crowdfunding project-name e.g., cloud-foundry +# polar: # Replace with a single Polar username +# buy_me_a_coffee: # Replace with a single Buy Me a Coffee username +custom: ['https://paypal.me/renzof93'] diff --git a/.github/ISSUE_TEMPLATE/bug.yml b/.github/ISSUE_TEMPLATE/bug.yml new file mode 100644 index 0000000..d86e1db --- /dev/null +++ b/.github/ISSUE_TEMPLATE/bug.yml @@ -0,0 +1,53 @@ +name: Bug report +description: Symfony Guard does not behave as documented +title: "[BUG] " +labels: [bug] +body: + - type: input + id: value + attributes: + label: Value this delivers + description: One sentence a user could witness once this is fixed. + placeholder: "Requests whose JSON body contains a URL are no longer flagged on endpoints that disable suspicious-pattern detection." + validations: + required: true + - type: textarea + id: what + attributes: + label: What happened + description: What you did, what you expected, what you got. Error messages, tracebacks and logs go here. + validations: + required: true + - type: textarea + id: steps + attributes: + label: Steps to reproduce + placeholder: | + 1. Configure Symfony Guard with '...' + 2. Send a request to '...' + 3. See error + validations: + required: true + - type: input + id: versions + attributes: + label: Versions + description: symfony-guard version, PHP version, Symfony version, OS. + placeholder: "symfony-guard 1.2.0, PHP 8.3.14, Symfony 7.3.0, Ubuntu 24.04" + validations: + required: true + - type: textarea + id: config + attributes: + label: Configuration + description: Your config with secrets masked. + render: php + placeholder: | + use RenzoFranceschini\GuardCore\Config\SecurityConfig; + + $config = new SecurityConfig(...); + - type: textarea + id: context + attributes: + label: Additional context + description: Production or development, consistent or intermittent, workarounds tried. diff --git a/.github/ISSUE_TEMPLATE/config.yml b/.github/ISSUE_TEMPLATE/config.yml new file mode 100644 index 0000000..37bf6a1 --- /dev/null +++ b/.github/ISSUE_TEMPLATE/config.yml @@ -0,0 +1,11 @@ +blank_issues_enabled: false +contact_links: + - name: Symfony Guard Documentation + url: https://rennf93.github.io/symfony-guard/ + about: Check the documentation for usage information and tutorials + - name: Usage Questions + url: https://github.com/rennf93/symfony-guard/discussions + about: Please ask and answer questions in GitHub Discussions + - name: Discord + url: https://discord.gg/ZW7ZJbjMkK + about: Questions and support in #help, new versions in #releases, development stream in #dev-feed \ No newline at end of file diff --git a/.github/ISSUE_TEMPLATE/docs.yml b/.github/ISSUE_TEMPLATE/docs.yml new file mode 100644 index 0000000..544ab23 --- /dev/null +++ b/.github/ISSUE_TEMPLATE/docs.yml @@ -0,0 +1,31 @@ +name: Documentation +description: Wrong, missing or unclear Symfony Guard documentation +title: "[DOCS] " +labels: [documentation] +body: + - type: input + id: value + attributes: + label: Value this delivers + description: One sentence a reader could witness once this is fixed. + placeholder: "The Redis page shows the exact config for a TLS connection." + validations: + required: true + - type: input + id: page + attributes: + label: Page + description: URL of the page or section. + validations: + required: true + - type: textarea + id: problem + attributes: + label: What is wrong or missing + validations: + required: true + - type: textarea + id: proposal + attributes: + label: Proposed text + render: markdown diff --git a/.github/ISSUE_TEMPLATE/feature.yml b/.github/ISSUE_TEMPLATE/feature.yml new file mode 100644 index 0000000..96dd70f --- /dev/null +++ b/.github/ISSUE_TEMPLATE/feature.yml @@ -0,0 +1,35 @@ +name: Feature request +description: Suggest an improvement to Symfony Guard +title: "[FEATURE] " +labels: [enhancement] +body: + - type: input + id: value + attributes: + label: Value this delivers + description: One sentence a user could witness once this exists. + placeholder: "A single decorator disables all detection for one endpoint." + validations: + required: true + - type: textarea + id: job + attributes: + label: The job you are trying to get done + description: The outcome you need, not the mechanism you imagine. + validations: + required: true + - type: textarea + id: workaround + attributes: + label: How you work around it today + - type: textarea + id: example + attributes: + label: Example usage + description: Pseudocode of how you would like to use it. + render: php + - type: textarea + id: context + attributes: + label: Additional context + description: Similar features in other libraries, constraints, API implications. diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md new file mode 100644 index 0000000..f2b5e09 --- /dev/null +++ b/.github/PULL_REQUEST_TEMPLATE.md @@ -0,0 +1,61 @@ +Delivers issue: # + + + +Description +=========== + + + +___ + +Motivation and Context +---------------------- + + + + +___ + +Type of change +-------------- + + + +- [ ] Bug fix (non-breaking change which fixes an issue) +- [ ] New feature (non-breaking change which adds functionality) +- [ ] Breaking change (fix or feature that would cause existing functionality to change) +- [ ] Documentation change +- [ ] Performance improvement +- [ ] Code cleanup or refactoring + +___ + +How Has This Been Tested +------------------------- + + + + + +___ + +Screenshots (if appropriate) +----------------------------- + +___ + +Checklist +--------- + + + + +- [ ] My code follows the code style of this project (Mypy, Ruff) +- [ ] I have added tests to cover my changes +- [ ] All new and existing tests passed +- [ ] My change requires a change to the documentation +- [ ] I have updated the documentation accordingly +- [ ] I have checked that my changes don't introduce any new warnings or errors +- [ ] I have updated the version number if necessary +- [ ] I have added any new dependencies to the appropriate requirements file diff --git a/.github/workflows/live-smoke.yml b/.github/workflows/live-smoke.yml index 7a6a3f5..b66a00e 100644 --- a/.github/workflows/live-smoke.yml +++ b/.github/workflows/live-smoke.yml @@ -99,3 +99,70 @@ jobs: if: always() run: | docker compose -p "$LIVE_SMOKE_PROJECT" -f examples/simple_app/docker-compose.yml down -v --remove-orphans + + live-smoke-advanced: + name: Dockerized smoke run (advanced_app) + runs-on: ubuntu-latest + timeout-minutes: 20 + permissions: + contents: read + + env: + LIVE_SMOKE_PROJECT: symfony-guard-live-smoke-advanced + + steps: + - name: Checkout code + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + + - name: Bring the smoke stack up (guarded app + redis) + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + run: | + docker compose -p "$LIVE_SMOKE_PROJECT" -f examples/advanced_app/docker-compose.yml up --build -d --wait + + - name: Run smoke assertions + run: | + set -euo pipefail + base="http://localhost:8081" + + check() { + local name="$1" expected="$2"; shift 2 + local code body + body=$(curl -sS --max-time 10 -o /tmp/smoke_body_adv -w '%{http_code}' "$@") || { + echo "FAIL: $name (curl error)"; exit 1 + } + code="$body" + if [ "$code" != "$expected" ]; then + echo "FAIL: $name (expected $expected, got $code)" + echo "body: $(cat /tmp/smoke_body_adv)" + exit 1 + fi + echo "ok: $name -> $code" + } + + check "GET / serves" 200 "$base/" + check "GET /health (excluded path)" 200 "$base/health" + + # Admin gate: /admin/* requires X-Admin-Token; the example's + # custom_request check rejects a missing header with 400 before + # the handler runs. + code=$(curl -sS --max-time 10 -o /tmp/smoke_body_adv -w '%{http_code}' "$base/admin/check?ip=203.0.113.9") + if [ "$code" != "400" ]; then + echo "FAIL: /admin/check without token (expected 400, got $code)"; exit 1 + fi + grep -q "Missing required header: X-Admin-Token" /tmp/smoke_body_adv || { + echo "FAIL: missing-token body"; exit 1 + } + echo "ok: /admin/check without token -> 400 missing required header" + + - name: Dump container logs on failure + if: failure() + run: | + docker compose -p "$LIVE_SMOKE_PROJECT" -f examples/advanced_app/docker-compose.yml logs --no-color + + - name: Bring the smoke stack down + if: always() + run: | + docker compose -p "$LIVE_SMOKE_PROJECT" -f examples/advanced_app/docker-compose.yml down -v --remove-orphans diff --git a/.github/workflows/static-analysis.yml b/.github/workflows/static-analysis.yml new file mode 100644 index 0000000..b2a02aa --- /dev/null +++ b/.github/workflows/static-analysis.yml @@ -0,0 +1,93 @@ +name: Static Analysis + +on: + push: + branches: + - master + pull_request: + branches: + - master + schedule: + - cron: '0 5 * * 1' + workflow_dispatch: + +permissions: {} + +concurrency: + group: static-analysis-${{ github.ref }} + cancel-in-progress: true + +jobs: + phpstan: + name: PHPStan (level 3) + runs-on: ubuntu-latest + timeout-minutes: 15 + permissions: + contents: read + + steps: + - name: Checkout code + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + + - name: Checkout guard-core-php (path repository) + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + repository: rennf93/guard-core-php + ref: master + path: core-checkout + persist-credentials: false + + - name: Place guard-core-php at the path repository location + run: mv core-checkout ../guard-core-php + + # Same CI-only patch as ci.yml: stamp a version onto the engine + # checkout's composer.json and drop the engine VCS repo entry, so the + # path repository resolves without git. Published files are untouched. + - name: Resolve guard-core-php from the path repository (CI-only patch) + run: | + python3 - <<'EOF' + import json + + engine = "../guard-core-php/composer.json" + with open(engine) as f: + d = json.load(f) + d["version"] = "4.2.99" + with open(engine, "w") as f: + json.dump(d, f, indent=4) + f.write("\n") + + with open("composer.json") as f: + d = json.load(f) + d["repositories"] = [ + repo + for repo in d.get("repositories", []) + if not ( + repo.get("type") == "vcs" + and "guard-core-php" in repo.get("url", "") + ) + ] + with open("composer.json", "w") as f: + json.dump(d, f, indent=4) + f.write("\n") + EOF + + # No host PHP toolchain: composer:2 installs the suite (the parent + # workspace mount carries the ../guard-core-php path repository), then + # the phpstan image analyses src/ against the installed autoload. + - name: Install dependencies (composer:2) + run: | + docker run --rm \ + -v "$(dirname "$GITHUB_WORKSPACE")":/work \ + -w "/work/$(basename "$GITHUB_WORKSPACE")" \ + composer:2 sh -c 'composer install --no-interaction --no-progress && composer update rennf93/guard-core-php --no-interaction' + + # Level 3 is the highest level with zero findings on master; the + # ceiling was probed with this exact image before adopting the job. + - name: PHPStan analyse (level 3) + run: | + docker run --rm \ + -v "$(dirname "$GITHUB_WORKSPACE")":/work \ + -w "/work/$(basename "$GITHUB_WORKSPACE")" \ + ghcr.io/phpstan/phpstan:latest analyse src --level=3 --no-progress diff --git a/CODE_OF_CONDUCT.md b/CODE_OF_CONDUCT.md new file mode 100644 index 0000000..a733ba2 --- /dev/null +++ b/CODE_OF_CONDUCT.md @@ -0,0 +1,162 @@ +Contributor Covenant Code of Conduct +==================================== + +___ + +Our Pledge +----------- + +We as members, contributors, and leaders pledge to make participation in our +community a harassment-free experience for everyone, regardless of age, body +size, visible or invisible disability, ethnicity, sex characteristics, gender +identity and expression, level of experience, education, socio-economic status, +nationality, personal appearance, race, religion, or sexual identity +and orientation. + +We pledge to act and interact in ways that contribute to an open, welcoming, +diverse, inclusive, and healthy community. + +___ + +Our Standards +------------- + +Examples of behavior that contributes to a positive environment for our +community include: + +* Demonstrating empathy and kindness toward other people +* Being respectful of differing opinions, viewpoints, and experiences +* Giving and gracefully accepting constructive feedback +* Accepting responsibility and apologizing to those affected by our mistakes, + and learning from the experience +* Focusing on what is best not just for us as individuals, but for the + overall community + +Examples of unacceptable behavior include: + +* The use of sexualized language or imagery, and sexual attention or + advances of any kind +* Trolling, insulting or derogatory comments, and personal or political attacks +* Public or private harassment +* Publishing others' private information, such as a physical or email + address, without their explicit permission +* Other conduct which could reasonably be considered inappropriate in a + professional setting + +___ + +Enforcement Responsibilities +---------------------------- + +Community leaders are responsible for clarifying and enforcing our standards of +acceptable behavior and will take appropriate and fair corrective action in +response to any behavior that they deem inappropriate, threatening, offensive, +or harmful. + +Community leaders have the right and responsibility to remove, edit, or reject +comments, commits, code, wiki edits, issues, and other contributions that are +not aligned to this Code of Conduct, and will communicate reasons for moderation +decisions when appropriate. + +___ + +Scope +----- + +This Code of Conduct applies within all community spaces, and also applies when +an individual is officially representing the community in public spaces. +Examples of representing our community include using an official e-mail address, +posting via an official social media account, or acting as an appointed +representative at an online or offline event. + +___ + +Enforcement +----------- + +Instances of abusive, harassing, or otherwise unacceptable behavior may be +reported to the community leaders responsible for enforcement at +@rennf93. +All complaints will be reviewed and investigated promptly and fairly. + +All community leaders are obligated to respect the privacy and security of the +reporter of any incident. + +___ + +Enforcement Guidelines +---------------------- + +Community leaders will follow these Community Impact Guidelines in determining +the consequences for any action they deem in violation of this Code of Conduct: + +___ + +Correction +---------- + +**Community Impact**: Use of inappropriate language or other behavior deemed +unprofessional or unwelcome in the community. + +**Consequence**: A private, written warning from community leaders, providing +clarity around the nature of the violation and an explanation of why the +behavior was inappropriate. A public apology may be requested. + +___ + +Warning +------- + +**Community Impact**: A violation through a single incident or series +of actions. + +**Consequence**: A warning with consequences for continued behavior. No +interaction with the people involved, including unsolicited interaction with +those enforcing the Code of Conduct, for a specified period of time. This +includes avoiding interactions in community spaces as well as external channels +like social media. Violating these terms may lead to a temporary or +permanent ban. + +___ + +Temporary Ban +------------- + +**Community Impact**: A serious violation of community standards, including +sustained inappropriate behavior. + +**Consequence**: A temporary ban from any sort of interaction or public +communication with the community for a specified period of time. No public or +private interaction with the people involved, including unsolicited interaction +with those enforcing the Code of Conduct, is allowed during this period. +Violating these terms may lead to a permanent ban. + +___ + +Permanent Ban +------------- + +**Community Impact**: Demonstrating a pattern of violation of community +standards, including sustained inappropriate behavior, harassment of an +individual, or aggression toward or disparagement of classes of individuals. + +**Consequence**: A permanent ban from any sort of public interaction within +the community. + +___ + +Attribution +----------- + +This Code of Conduct is adapted from the [Contributor Covenant][homepage], +version 2.0, available at +. + +Community Impact Guidelines were inspired by [Mozilla's code of conduct +enforcement ladder](https://github.com/mozilla/diversity). + +[homepage]: https://www.contributor-covenant.org + +For answers to common questions about this code of conduct, see the FAQ at +. Translations are available at +. diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md new file mode 100644 index 0000000..a7ef036 --- /dev/null +++ b/CONTRIBUTING.md @@ -0,0 +1,39 @@ +# Contributing to Symfony Guard + +Thanks for considering a contribution to Symfony Guard, part of the Guard ecosystem (this repo follows the conventions of the Python baseline: guard-core and fastapi-guard). + +## Development Setup + +Requirements: + +- PHP ^8.2 (the library supports 8.2, 8.3, and 8.4) +- Composer 2 +- Docker (Redis runs as a CI service locally too, via `docker run -p 6379:6379 redis:7-alpine`; hosts without a PHP toolchain run everything through the `php:8.3-cli` and `composer:2` images, see the Makefile) + +```bash +composer install +composer test # the repo's test suite (bin/test_*.php) +composer lint # syntax sweep over src/ and bin/ +``` + +## Quality Gates + +Run before pushing (CI enforces the same checks): + +- `composer lint` (php -l sweep over src and bin) +- the test suite (`composer test`, Redis needed for the guard suites) +- `composer audit` (dependency vulnerability check, also on the weekly schedule) + +## Pull Requests + +- Every PR closes an open issue ("Delivers issue: #N") or carries the `no-issue` label (chores and dependency bumps). +- Keep the CI green; one clean push per PR is preferred. +- Commit messages: lowercase, imperative, conventional style (`fix(scope): ...`, `feat(scope): ...`, `ci(scope): ...`). No attribution trailers. + +## Security + +Never open public issues for security vulnerabilities. Follow SECURITY.md and report via GitHub security advisories. + +## Questions + +Open a GitHub Discussion in this repository or ask in the Guard Discord (#help). diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..46c0282 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,36 @@ +# Security Policy for Symfony Guard + +## Supported Versions + +We currently provide security updates for the following versions of Symfony Guard: + +| Version | Supported | +| ------- | ------------------ | +| 1.2.x | :white_check_mark: | +| 1.1.x | :white_check_mark: | +| < 1.1.0 | :x: | + +## Reporting a Vulnerability + +We take the security of Symfony Guard seriously. If you believe you've found a security vulnerability, please follow these steps: + +1. **Do not disclose the vulnerability publicly** until it has been addressed by the maintainers. +2. **Report the vulnerability through GitHub's security advisory feature**: + - Go to the [Security tab](https://github.com/rennf93/symfony-guard/security/advisories) of the Symfony Guard repository + - Click on "New draft security advisory" + - Fill in the details of the vulnerability + - Submit the advisory + + Alternatively, you can report vulnerabilities through [GitHub's private vulnerability reporting feature](https://github.com/rennf93/symfony-guard/security/advisories/new). + +3. Include the following information in your report: + - A description of the vulnerability and its potential impact + - Steps to reproduce the issue + - Affected versions + - Any potential mitigations or workarounds + +The maintainers will acknowledge your report within 48 hours and provide a detailed response within 7 days, including the next steps in handling the vulnerability. + +## Security Considerations + +Symfony Guard is a security library: report anything that weakens detection, bypasses rate limiting, leaks secrets into logs, or trusts unvalidated input. From 4b5910243623c12f72f691ad7bc50360a5986fb1 Mon Sep 17 00:00:00 2001 From: Renn F Date: Tue, 29 Sep 2026 00:45:18 +0200 Subject: [PATCH 2/2] ci(security): add the semgrep security-audit and secrets gate --- .github/workflows/semgrep.yml | 38 +++++++++++++++++++++++++++++++++++ 1 file changed, 38 insertions(+) create mode 100644 .github/workflows/semgrep.yml diff --git a/.github/workflows/semgrep.yml b/.github/workflows/semgrep.yml new file mode 100644 index 0000000..6dde008 --- /dev/null +++ b/.github/workflows/semgrep.yml @@ -0,0 +1,38 @@ +name: Semgrep + +on: + push: + branches: + - master + paths: + - 'src/**' + - '.github/workflows/semgrep.yml' + pull_request: + paths: + - 'src/**' + - '.github/workflows/semgrep.yml' + schedule: + - cron: '0 7 * * 1' + +permissions: + contents: read + +jobs: + semgrep: + name: Security audit (semgrep) + runs-on: ubuntu-latest + timeout-minutes: 15 + permissions: + contents: read + container: + image: semgrep/semgrep:1.177.0 + env: + SEMGREP_SEND_METRICS: off + steps: + - name: Checkout + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + + - name: Scan src with the security-audit and secrets rulesets + run: semgrep scan --config p/security-audit --config p/secrets --metrics=off --error --quiet src