feat: security & limits settings, verified updates, start-up fixes, accessible donut, quality fixes

.github/dependabot.yml

@@ -0,0 +1,21 @@
+# Pull requests for new versions of the GitHub Actions (pinned to commits, so they don't update by themselves) and of
+# the NuGet packages (Directory.Packages.props). Grouped weekly so they arrive as one pull request each.
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    groups:
+      actions:
+        patterns: ['*']
+
+  - package-ecosystem: nuget
+    directory: /
+    schedule:
+      interval: weekly
+    groups:
+      nuget:
+        patterns: ['*']
+        update-types: [minor, patch]
+    open-pull-requests-limit: 5

.github/workflows/ci.yml

@@ -33,7 +33,7 @@ jobs:
       code: ${{ steps.files.outputs.code }}
       macos: ${{ steps.files.outputs.macos }}
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - id: files
         env:
@@ -98,10 +98,11 @@ jobs:
     needs: changes
     if: ${{ !cancelled() && needs.changes.outputs.code != 'false' }}
     runs-on: windows-latest
+    timeout-minutes: 90
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - uses: actions/setup-dotnet@v6
+      - uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
         with:
           global-json-file: global.json
 
@@ -124,7 +125,7 @@ jobs:
       # downloaded once and not on every run. Release builds restore the same cache.
       - name: Restore Zig toolchain
         id: zig
-        uses: actions/cache/restore@v5
+        uses: actions/cache/restore@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
         with:
           path: build/.cache/zig-x86_64-windows-0.16.0
           key: zig-0.16.0-x86_64-windows
@@ -135,7 +136,7 @@ jobs:
 
       - name: Save Zig toolchain
         if: steps.zig.outputs.cache-hit != 'true'
-        uses: actions/cache/save@v5
+        uses: actions/cache/save@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
         with:
           path: build/.cache/zig-x86_64-windows-0.16.0
           key: zig-0.16.0-x86_64-windows
@@ -162,15 +163,15 @@ jobs:
 
       - name: Upload test results
         if: failure()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: test-results-windows
           path: TestResults/
           if-no-files-found: ignore
 
       - name: Upload UI screenshots
         if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: ui-screenshots
           path: |

.github/workflows/codeql.yml

@@ -0,0 +1,42 @@
+# Static analysis of the C# code with GitHub CodeQL: on pushes to main, on pull requests and once a week (new queries
+# find old code too). Findings appear under Security > Code scanning. Built on Windows like CI (Windows-only projects).
+name: CodeQL
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    - cron: '23 4 * * 1'
+
+permissions:
+  contents: read
+
+jobs:
+  analyze:
+    runs-on: windows-latest
+    timeout-minutes: 60
+    permissions:
+      contents: read
+      security-events: write   # upload the results
+      actions: read
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
+        with:
+          global-json-file: global.json
+
+      - uses: github/codeql-action/init@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
+        with:
+          languages: csharp
+          build-mode: manual
+          queries: security-and-quality
+
+      - name: Build
+        run: dotnet build Filee.slnx -c Release
+
+      - uses: github/codeql-action/analyze@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
+        with:
+          category: /language:csharp

.github/workflows/dependency-review.yml

@@ -0,0 +1,20 @@
+# Pull requests that add or update dependencies (NuGet packages, actions): fails on known vulnerabilities of high
+# severity and on licences that don't fit an MIT project's redistribution, before they are merged.
+name: Dependency review
+
+on:
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  review:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    steps:
+      - uses: actions/dependency-review-action@2031cfc080254a8a887f58cffee85186f0e49e48 # v4.9.0
+        with:
+          fail-on-severity: high
+          deny-licenses: AGPL-1.0-only, AGPL-1.0-or-later, AGPL-3.0-only, AGPL-3.0-or-later

.github/workflows/engines-weekly.yml

@@ -0,0 +1,32 @@
+# CI skips the LibreOffice tests to save time (the engine with H2Orestart and Java is ~420 MB). This runs them once a
+# week, and on demand, with every engine fetched, so a LibreOffice route that broke shows up before a release.
+name: Engine tests (weekly)
+
+on:
+  schedule:
+    - cron: '41 3 * * 0'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  engines:
+    runs-on: windows-latest
+    timeout-minutes: 120
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
+        with:
+          global-json-file: global.json
+
+      - name: Fetch every engine
+        shell: pwsh
+        run: ./build/fetch-engines.ps1
+
+      - name: Build
+        run: dotnet build Filee.slnx -c Release
+
+      - name: Engine tests
+        run: dotnet test tests/Filee.Engines.Tests --no-build -c Release --blame-hang-timeout 10m --logger "console;verbosity=normal"

.github/workflows/portable.yml

@@ -51,7 +51,7 @@ jobs:
     env:
       NATIVE_OUT: ${{ github.workspace }}/build/.cache/linux-native/${{ matrix.rid }}
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       # Fails when engines.json moved to another rhwp version while build/build-linux-native.py still builds the old
       # source (also when the build below comes from the cache).
@@ -60,7 +60,7 @@ jobs:
 
       - name: Restore native builds
         id: native-cache
-        uses: actions/cache@v5
+        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
         with:
           path: build/.cache/linux-native/${{ matrix.rid }}
           key: linux-native-${{ matrix.rid }}-ubuntu-22.04-${{ hashFiles('build/build-linux-native.py') }}
@@ -79,7 +79,7 @@ jobs:
 
       - name: Restore cargo downloads
         if: steps.native-cache.outputs.cache-hit != 'true'
-        uses: actions/cache@v5
+        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
         with:
           path: |
             ~/.cargo/registry/index
@@ -96,7 +96,7 @@ jobs:
         run: python3 build/check-elf-glibc.py --max 2.35 --needed "$NATIVE_OUT"
 
       - name: Upload native builds
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: linux-native-${{ matrix.rid }}
           path: build/.cache/linux-native/${{ matrix.rid }}/
@@ -119,16 +119,16 @@ jobs:
       run:
         shell: pwsh
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Download Linux native builds
         if: runner.os == 'Linux'
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: linux-native-${{ matrix.rid }}
           path: ${{ runner.temp }}/linux-native
 
-      - uses: actions/setup-dotnet@v6
+      - uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
         with:
           global-json-file: global.json
 
@@ -144,7 +144,7 @@ jobs:
         run: ./build/fetch-fonts.ps1
 
       - name: Restore engine downloads
-        uses: actions/cache@v5
+        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
         with:
           path: build/.cache/portable-downloads
           key: portable-engines-${{ matrix.rid }}-${{ hashFiles('src/Filee.Engines/Infrastructure/engines.json') }}
@@ -203,7 +203,7 @@ jobs:
           done
 
       - name: Upload packages
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: portable-${{ matrix.rid }}
           path: |
@@ -214,7 +214,7 @@ jobs:
 
       - name: Upload test diagnostics
         if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: unix-test-results-${{ matrix.rid }}
           path: |
@@ -245,7 +245,7 @@ jobs:
       run:
         shell: pwsh
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Linux desktop dependencies (Ubuntu 22.04)
         shell: bash
@@ -255,7 +255,7 @@ jobs:
             libfontconfig1 libfreetype6 libx11-6 libice6 libsm6 libxrandr2 libxkbcommon0 libxi6 libxtst6 libxt6 xvfb fonts-noto-cjk
 
       - name: Download package
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: portable-${{ matrix.rid }}
           path: Releases
@@ -280,7 +280,7 @@ jobs:
 
       - name: Upload diagnostics
         if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: ubuntu-22-04-results-${{ matrix.rid }}
           path: |