security: enforce HTTPS on curl downloads (SonarCloud S6506)

Add --proto '=https' to curl invocations so redirects cannot downgrade to plaintext HTTP. Resolves SonarCloud S6506 (shell/docker/githubactions).
ci: add sonar-project.properties for CI-based analysis
2026-10-22 02:04:01 -04:00 · 2026-10-21 17:06:31 -04:00 · 2026-10-21 16:00:22 -04:00 · 2026-10-21 15:46:46 -04:00 · 2026-10-21 13:57:30 -04:00 · 2026-10-21 13:57:10 -04:00
6 changed files with 35 additions and 14 deletions
@@ -0,0 +1,6 @@
+# yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json
+reviews:
+  auto_review:
+    # Dependabot bumps are checked by CI; skip CodeRabbit reviews on them.
+    ignore_usernames:
+      - "dependabot[bot]"
@@ -18,16 +18,6 @@ concurrency:
  cancel-in-progress: true

 jobs:
-  eval:
-    runs-on: ubuntu-latest
-    timeout-minutes: 15
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31.11.1
-      - name: nix flake check --no-build
-        run: |
-          if [ -f flake.nix ]; then
-            nix flake check --no-build --all-systems
-          else
-            echo "No flake.nix present in this repository; skipping check."
-          fi
+  nix:
+    # Intentionally tracked at @main (not SHA-pinned) so org-wide CI improvements, security fixes, and build optimizations propagate without PR churn across all craftapp repos.
+    uses: storytold/craft-common-actions/.github/workflows/nix.yml@main
@@ -0,0 +1,20 @@
+name: SonarCloud
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    types: [opened, synchronize, reopened]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: sonarcloud-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  sonarcloud:
+    # Tracked at @main so org-wide CI improvements propagate without PR churn.
+    uses: storytold/craft-common-actions/.github/workflows/sonarcloud.yml@main
+    secrets: inherit
@@ -26,6 +26,9 @@
  <img alt="License: MIT OR Apache-2.0" src="https://img.shields.io/badge/license-MIT%20%2F%20Apache--2.0-0b6f88?style=flat-square">
  <img alt="Agent-drivable over MCP" src="https://img.shields.io/badge/agents-MCP-14a3c7?style=flat-square">
  <img alt="Status: early development" src="https://img.shields.io/badge/status-early%20development-f07a3a?style=flat-square">
+  <br>
+  <a href="https://sonarcloud.io/project/overview?id=storytold_cadcraft"><img alt="Scanned by SonarCloud" src="https://img.shields.io/badge/Scanned_by-SonarCloud-4b9fd5?style=flat-square&logo=sonarqubecloud&logoColor=white"></a>
+  <a href="https://coderabbit.ai"><img alt="Reviewed by CodeRabbit" src="https://img.shields.io/coderabbit/prs/github/storytold/cadcraft?style=flat-square&label=Reviewed%20by%20CodeRabbit&logo=coderabbit"></a>
 </p>

 <p align="center">
@@ -113,7 +113,7 @@ if has appimage; then
  if [ -z "$TOOL" ]; then
    TOOL="$CARGO_TARGET_DIR/appimagetool-$ARCH.AppImage"
    if [ ! -x "$TOOL" ]; then
-      curl -fsSL -o "$TOOL" "https://github.com/AppImage/appimagetool/releases/download/continuous/appimagetool-$ARCH.AppImage"
+      curl --proto '=https' -fsSL -o "$TOOL" "https://github.com/AppImage/appimagetool/releases/download/continuous/appimagetool-$ARCH.AppImage"
      chmod +x "$TOOL"
    fi
  fi
@@ -0,0 +1,2 @@
+sonar.projectKey=storytold_cadcraft
+sonar.organization=storytold
Author	SHA1	Message	Date
Dylan M. Taylor	fdcd9610f2	security: enforce HTTPS on curl downloads (SonarCloud S6506) Add --proto '=https' to curl invocations so redirects cannot downgrade to plaintext HTTP. Resolves SonarCloud S6506 (shell/docker/githubactions).	2026-10-21 17:06:31 -04:00
Dylan M. Taylor	54d96834d5	ci: add sonar-project.properties for CI-based analysis Marks the project ineligible for SonarCloud Automatic Analysis, resolving the CI-vs-automatic-analysis conflict so the SonarCloud workflow succeeds.	2026-10-21 16:00:22 -04:00
Dylan M. Taylor	47a8fb02e7	ci: add SonarCloud scan via shared reusable workflow Calls storytold/craft-common-actions/.github/workflows/sonarcloud.yml@main with secrets: inherit. Adds SonarCloud badge to README where missing and removes the redundant sonar-project.properties (config now passed by the reusable workflow).	2026-10-21 15:46:46 -04:00
Dylan M. Taylor	896a390b42	ci: add SonarCloud scan workflow and config	2026-10-21 13:57:30 -04:00
Dylan M. Taylor	345eb60ef3	test	2026-10-21 13:57:10 -04:00
Dylan M. Taylor	0cf3bdea83	Merge pull request #1398 from dylanmtaylor/ci/shared-nix-workflow ci: switch to shared nix workflow from craft-common-actions	2026-10-21 03:40:18 -04:00
Brandon ThomasandClaude Opus 5.5	7fef8cbe2f	Skip CodeRabbit reviews on Dependabot PRs (#1727 ) Adds .coderabbit.yaml so CodeRabbit no longer reviews or comments on PRs opened by dependabot[bot]. Co-authored-by: Claude Opus 5.5 <[email protected]>	2026-10-20 11:39:39 -04:00
Dylan M. Taylor	f2b473dc51	docs: add SonarCloud and CodeRabbit badges to README (#1566 ) * docs: add SonarCloud and CodeRabbit badges to README * docs: put SonarCloud and CodeRabbit badges on their own line	2026-10-20 11:32:50 -04:00
Dylan M. Taylor	ea6d7beca2	ci: switch to shared nix workflow from craft-common-actions	2026-10-15 23:58:01 -04:00