fortify: harden repo for public release

senet · senet · commit 898e0c3ebb16 · 2026-04-12T09:30:38.000+05:30
- Simplify install.sh: remove all auth/private-repo code, use direct URL download with SHA-256 checksum verification and source-build fallback - Pin CI action versions to commit SHAs (supply-chain security) - Add CODEOWNERS (all files require @senet review) - Add SECURITY.md (responsible disclosure policy) - Add dependabot.yml (weekly Go modules + GitHub Actions updates) - Add PR template and issue templates (bug report, feature request) - Update README: add status badges, simplify install instructions, remove --verify=false references, add contributing/security links - Update CONTRIBUTING.md: add branch protection notes, CODEOWNERS reference, security reporting guidance
diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
@@ -0,0 +1,2 @@
+# All files require review from the repository owner.
+* @senet
diff --git a/.github/ISSUE_TEMPLATE/bug_report.md b/.github/ISSUE_TEMPLATE/bug_report.md
@@ -0,0 +1,29 @@
+---
+name: Bug Report
+about: Report a bug in helm-map
+labels: bug
+---
+
+## Description
+
+<!-- A clear description of the bug. -->
+
+## Steps to Reproduce
+
+1.
+2.
+3.
+
+## Expected Behaviour
+
+<!-- What should happen? -->
+
+## Actual Behaviour
+
+<!-- What actually happens? -->
+
+## Environment
+
+- OS:
+- Helm version (`helm version`):
+- helm-map version (`helm map version`):
diff --git a/.github/ISSUE_TEMPLATE/feature_request.md b/.github/ISSUE_TEMPLATE/feature_request.md
@@ -0,0 +1,17 @@
+---
+name: Feature Request
+about: Suggest a new feature for helm-map
+labels: enhancement
+---
+
+## Problem
+
+<!-- What problem does this solve? -->
+
+## Proposed Solution
+
+<!-- How should it work? -->
+
+## Alternatives Considered
+
+<!-- Any other approaches you've thought of? -->
diff --git a/.github/SECURITY.md b/.github/SECURITY.md
@@ -0,0 +1,27 @@
+# Security Policy
+
+## Supported Versions
+
+| Version | Supported          |
+|---------|--------------------|
+| 0.1.x   | :white_check_mark: |
+
+## Reporting a Vulnerability
+
+If you discover a security vulnerability in helm-map, please report it responsibly.
+
+**Do NOT open a public issue.**
+
+Instead, email **sen.net@hotmail.com** with:
+
+1. A clear description of the vulnerability
+2. Steps to reproduce
+3. Potential impact
+4. Suggested fix (if any)
+
+You should receive an acknowledgement within **48 hours**. A fix will be prioritised and a patched release published as soon as possible.
+
+## Disclosure Policy
+
+- Vulnerabilities will be disclosed publicly once a fix is available.
+- Credit will be given to the reporter (unless they request anonymity).
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
@@ -0,0 +1,15 @@
+version: 2
+updates:
+  - package-ecosystem: gomod
+    directory: /
+    schedule:
+      interval: weekly
+    commit-message:
+      prefix: "deps"
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    commit-message:
+      prefix: "ci"
diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md
@@ -0,0 +1,10 @@
+## Description
+
+<!-- What does this PR do? -->
+
+## Checklist
+
+- [ ] Tests added / updated
+- [ ] `make test` passes
+- [ ] `make lint` passes
+- [ ] Documentation updated (if applicable)
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -13,8 +13,8 @@ jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-go@v5
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
         with:
           go-version: "1.25"
       - name: Install golangci-lint
@@ -25,8 +25,8 @@ jobs:
   test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-go@v5
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
         with:
           go-version: "1.25"
       - name: Run tests
@@ -42,8 +42,8 @@ jobs:
     runs-on: ubuntu-latest
     needs: [lint, test]
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-go@v5
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
         with:
           go-version: "1.25"
       - name: Build
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -11,8 +11,8 @@ jobs:
   test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-go@v5
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
         with:
           go-version: "1.25"
       - name: Run tests
@@ -24,11 +24,11 @@ jobs:
     runs-on: ubuntu-latest
     needs: [test]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           fetch-depth: 0
 
-      - uses: actions/setup-go@v5
+      - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
         with:
           go-version: "1.25"
 
@@ -39,7 +39,7 @@ jobs:
           GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
 
       - name: Run GoReleaser
-        uses: goreleaser/goreleaser-action@v6
+        uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a # v6.4.0
         with:
           version: latest
           args: release --clean
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
@@ -33,10 +33,28 @@ Thank you for your interest in contributing to helm-map!
 4. Ensure `make test` and `make lint` pass
 5. Submit a PR with a clear description
 
+All PRs require:
+- Passing CI (lint + test + build)
+- Approval from the repository owner ([@senet](https://github.com/senet))
+- Review from a [CODEOWNER](/.github/CODEOWNERS)
+
+## Branch Protection
+
+The `main` branch is protected:
+- Direct pushes are not allowed
+- All changes must go through a pull request
+- CI status checks must pass before merging
+- Force pushes and branch deletion are blocked
+
 ## Reporting Issues
 
 Open an issue on GitHub with:
 - A clear description of the problem
 - Steps to reproduce
 - Expected vs actual behaviour
 - helm-map version (`helm map version`)
+
+## Security
+
+To report a security vulnerability, see [SECURITY.md](/.github/SECURITY.md).
+**Do not open a public issue for security vulnerabilities.**
diff --git a/README.md b/README.md
@@ -1,5 +1,10 @@
 # helm-map
 
+[![CI](https://github.com/senet/helm-map/actions/workflows/ci.yml/badge.svg)](https://github.com/senet/helm-map/actions/workflows/ci.yml)
+[![Release](https://github.com/senet/helm-map/actions/workflows/release.yml/badge.svg)](https://github.com/senet/helm-map/actions/workflows/release.yml)
+[![Go Report Card](https://goreportcard.com/badge/github.com/senet/helm-map)](https://goreportcard.com/report/github.com/senet/helm-map)
+[![License](https://img.shields.io/github/license/senet/helm-map)](LICENSE)
+
 A Helm plugin that visualises chart dependency trees and release resource maps.
 
 ## Architecture
@@ -18,22 +23,12 @@ See [ARCHITECTURE.md](ARCHITECTURE.md) for full design details.
 
 ## Installation
 
-### Helm v3
-
 ```bash
 helm plugin install https://github.com/senet/helm-map
 ```
 
-### Helm v4
-
-```bash
-helm plugin install --verify=false https://github.com/senet/helm-map
-```
-
-> **Note:** Helm v4 enforces plugin signature verification by default. Once a signed
-> release is published (with `.prov` files), `--verify=false` will no longer be needed.
-> To verify manually, import the [public key](helm-map.pub) and check the `.prov` files
-> attached to each GitHub Release.
+Pre-built binaries are downloaded automatically for Linux, macOS, and Windows (amd64/arm64).
+If no binary is available for your platform, the installer falls back to building from source (requires Go 1.22+).
 
 ### Build from source
 
@@ -49,7 +44,7 @@ make install-local
 | Helm Version | Status | Notes |
 |---|---|---|
 | v3.18+ | Tested | Full support |
-| v4.1+ | Tested | Requires `--verify=false` until signed releases are published |
+| v4.1+ | Tested | Full support |
 
 ## Usage
 
@@ -139,18 +134,23 @@ make cover
 
 ## Release Signing
 
-Releases are signed with GPG. Each `.tar.gz` archive has a corresponding `.prov` signature file.
+All release archives are signed with GPG. Each `.tar.gz` has a corresponding `.prov` signature file and SHA-256 checksums are verified automatically by the install script.
 
 To verify a release manually:
 
 ```bash
-# Import the public key
 gpg --import helm-map.pub
-
-# Verify an archive
 gpg --verify helm-map_linux_amd64.tar.gz.prov helm-map_linux_amd64.tar.gz
 ```
 
+## Contributing
+
+See [CONTRIBUTING.md](CONTRIBUTING.md) for development setup and guidelines.
+
+## Security
+
+To report a vulnerability, see [SECURITY.md](.github/SECURITY.md).
+
 ## License
 
 Apache License 2.0 — see [LICENSE](LICENSE) for details.
diff --git a/scripts/install.sh b/scripts/install.sh
@@ -24,58 +24,47 @@ esac
 DOWNLOAD_URL="https://github.com/${GITHUB_REPO}/releases/download/v${PLUGIN_VERSION}/${PROJECT_NAME}_${OS}_${ARCH}.tar.gz"
 CHECKSUM_URL="https://github.com/${GITHUB_REPO}/releases/download/v${PLUGIN_VERSION}/checksums.txt"
 
-# Build auth header for private repos. Checks GITHUB_TOKEN, GH_TOKEN, or gh CLI.
-AUTH_HEADER=""
-if [ -n "${GITHUB_TOKEN:-}" ]; then
-  AUTH_HEADER="Authorization: token ${GITHUB_TOKEN}"
-elif [ -n "${GH_TOKEN:-}" ]; then
-  AUTH_HEADER="Authorization: token ${GH_TOKEN}"
-elif command -v gh >/dev/null 2>&1; then
-  GH_AUTH_TOKEN="$(gh auth token 2>/dev/null || true)"
-  if [ -n "${GH_AUTH_TOKEN:-}" ]; then
-    AUTH_HEADER="Authorization: token ${GH_AUTH_TOKEN}"
-  fi
-fi
-
 echo "Installing helm-map v${PLUGIN_VERSION} for ${OS}/${ARCH}..."
 
 install_from_release() {
   TMPDIR="$(mktemp -d)"
   trap 'rm -rf "$TMPDIR"' EXIT
 
-  CURL_ARGS=(-sSL)
-  if [ -n "$AUTH_HEADER" ]; then
-    CURL_ARGS+=(-H "$AUTH_HEADER")
-  fi
+  ARCHIVE_NAME="${PROJECT_NAME}_${OS}_${ARCH}.tar.gz"
 
-  # Download the binary archive.
-  HTTP_CODE="$(curl "${CURL_ARGS[@]}" -w '%{http_code}' "$DOWNLOAD_URL" -o "${TMPDIR}/${PROJECT_NAME}.tar.gz")"
+  echo "Downloading pre-built binary..."
+  HTTP_CODE="$(curl -sSL -w '%{http_code}' -o "${TMPDIR}/${ARCHIVE_NAME}" "$DOWNLOAD_URL")"
   if [ "$HTTP_CODE" != "200" ]; then
-    echo "Release download returned HTTP ${HTTP_CODE}." >&2
+    echo "Download failed (HTTP ${HTTP_CODE})." >&2
     return 1
   fi
 
-  # Download checksums.
-  curl "${CURL_ARGS[@]}" "$CHECKSUM_URL" -o "${TMPDIR}/checksums.txt" || true
-
-  # Verify checksum if available.
+  # Download checksums and verify.
+  curl -sSL -o "${TMPDIR}/checksums.txt" "$CHECKSUM_URL" 2>/dev/null || true
   if [ -f "${TMPDIR}/checksums.txt" ]; then
-    EXPECTED_HASH="$(grep "${PROJECT_NAME}_${OS}_${ARCH}.tar.gz" "${TMPDIR}/checksums.txt" | awk '{print $1}')"
+    EXPECTED_HASH="$(grep "${ARCHIVE_NAME}" "${TMPDIR}/checksums.txt" | awk '{print $1}')"
     if [ -n "$EXPECTED_HASH" ]; then
-      ACTUAL_HASH="$(sha256sum "${TMPDIR}/${PROJECT_NAME}.tar.gz" | awk '{print $1}')"
-      if [ "$EXPECTED_HASH" != "$ACTUAL_HASH" ]; then
+      if command -v sha256sum >/dev/null 2>&1; then
+        ACTUAL_HASH="$(sha256sum "${TMPDIR}/${ARCHIVE_NAME}" | awk '{print $1}')"
+      elif command -v shasum >/dev/null 2>&1; then
+        ACTUAL_HASH="$(shasum -a 256 "${TMPDIR}/${ARCHIVE_NAME}" | awk '{print $1}')"
+      else
+        echo "Warning: no sha256sum or shasum found, skipping checksum verification." >&2
+        ACTUAL_HASH=""
+      fi
+      if [ -n "$ACTUAL_HASH" ] && [ "$EXPECTED_HASH" != "$ACTUAL_HASH" ]; then
         echo "Checksum verification failed!" >&2
         echo "  Expected: $EXPECTED_HASH" >&2
         echo "  Actual:   $ACTUAL_HASH" >&2
         exit 1
       fi
-      echo "Checksum verified."
+      [ -n "$ACTUAL_HASH" ] && echo "Checksum verified."
     fi
   fi
 
   # Extract and install.
   mkdir -p "${HELM_PLUGIN_DIR}/bin"
-  tar -xzf "${TMPDIR}/${PROJECT_NAME}.tar.gz" -C "${HELM_PLUGIN_DIR}/bin"
+  tar -xzf "${TMPDIR}/${ARCHIVE_NAME}" -C "${HELM_PLUGIN_DIR}/bin"
   chmod +x "${HELM_PLUGIN_DIR}/bin/${PROJECT_NAME}"
 }
 
@@ -94,7 +83,7 @@ build_from_source() {
 }
 
 if ! install_from_release; then
-  echo "No pre-built release found, falling back to source build..."
+  echo "Pre-built binary not available, falling back to source build..."
   build_from_source
 fi
 

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,2 @@`
	`1`	`+# All files require review from the repository owner.`
	`2`	`+* @senet`