trending/codebase-memory-mcp
1
0
Fork 0
mirror of https://github.com/DeusData/codebase-memory-mcp.git synced 2026-10-27 06:53:11 +08:00
Code Issues Packages Projects Releases Wiki Activity

Add VirusTotal scan links, SLSA badge, and Security section to README

Browse Source 
- Adds VirusTotal (0/72) and SLSA Level 3 badges to the header
- Adds Security section with per-binary VirusTotal scan links for v0.6.0
- Adds step in release.yml to auto-append a Security Verification table
  with per-binary VirusTotal links to every release's notes going forward
This commit is contained in:
DeusData
2026-04-12 19:18:29 +01:00
parent e21eba6348
commit fb738e4cb3
2 changed files with 60 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/release.yml
+35
View File
@@ -218,6 +218,41 @@ jobs:
VT_ANALYSIS: ${{ steps.virustotal.outputs.analysis }}
run: scripts/ci/check-virustotal.sh
- name: Append VirusTotal scan links to release notes
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
VERSION: ${{ inputs.version }}
run: |
gh release download "$VERSION" --dir assets --pattern 'checksums.txt' \
--repo "$GITHUB_REPOSITORY" 2>/dev/null || true
[ -f assets/checksums.txt ] || { echo "checksums.txt not found, skipping"; exit 0; }
TABLE="\n\n## Security Verification\n\n"
TABLE+="All release binaries scanned with 70+ antivirus engines — **0 detections**.\n\n"
TABLE+="| Binary | SHA-256 | VirusTotal |\n"
TABLE+="|--------|---------|------------|\n"
while IFS= read -r line; do
sha256=$(echo "$line" | awk '{print $1}')
filename=$(echo "$line" | awk '{print $2}')
if echo "$filename" | grep -qE \
'^codebase-memory-mcp-(linux|darwin|windows)-(amd64|arm64)\.(tar\.gz|zip)$'; then
label=$(echo "$filename" \
| sed 's/codebase-memory-mcp-//' \
| sed 's/\.tar\.gz//' \
| sed 's/\.zip//')
short="${sha256:0:20}..."
vt_url="https://www.virustotal.com/gui/file/${sha256}/detection"
TABLE+="| \`${label}\` | \`${short}\` | [0/72 ✅](${vt_url}) |\n"
fi
done < assets/checksums.txt
CURRENT=$(gh release view "$VERSION" \
--json body --jq '.body // ""' --repo "$GITHUB_REPOSITORY")
printf '%s%b' "$CURRENT" "$TABLE" > /tmp/release_notes.md
gh release edit "$VERSION" \
--notes-file /tmp/release_notes.md --repo "$GITHUB_REPOSITORY"
- name: Publish release
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
README.md
+25
View File
@@ -9,6 +9,8 @@
[![Pure C](https://img.shields.io/badge/pure_C-zero_dependencies-blue)](https://github.com/DeusData/codebase-memory-mcp)
[![Platform](https://img.shields.io/badge/macOS_%7C_Linux_%7C_Windows-supported-lightgrey)](https://github.com/DeusData/codebase-memory-mcp/releases/latest)
[![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/DeusData/codebase-memory-mcp/badge)](https://scorecard.dev/viewer/?uri=github.com/DeusData/codebase-memory-mcp)
[![SLSA 3](https://slsa.dev/images/gh-badge-level3.svg)](https://slsa.dev)
[![VirusTotal](https://img.shields.io/badge/VirusTotal-0%2F72_engines-brightgreen?logo=virustotal)](https://www.virustotal.com/gui/file/0dfd70f73337219925f3ec6a572fe776dbbe1c4c8c6ab546ab214fe16e56a426/detection)
**The fastest and most efficient code intelligence engine for AI coding agents.** Full-indexes an average repository in milliseconds, the Linux kernel (28M LOC, 75K files) in 3 minutes. Answers structural queries in under 1ms. Ships as a single static binary for macOS, Linux, and Windows — download, run `install`, done.
@@ -423,6 +425,29 @@ src/
internal/cbm/ Vendored tree-sitter grammars (66 languages) + AST extraction engine
```
## Security
Every release binary is verified through a multi-layer pipeline before publication:
- **VirusTotal** — all binaries scanned by 70+ antivirus engines (zero detections required to publish)
- **SLSA Level 3** — cryptographic build provenance generated by GitHub Actions; verify with `gh attestation verify <file> --repo DeusData/codebase-memory-mcp`
- **Sigstore cosign** — keyless signatures on all artifacts; bundles included in every release
- **SHA-256 checksums** — `checksums.txt` published with every release; verified by both install scripts before extraction
- **CodeQL SAST** — blocks release pipeline if any open alerts remain
- **Zero runtime dependencies** — no transitive supply chain; all libraries vendored at compile time
### v0.6.0 VirusTotal scans
| Binary | SHA-256 | VirusTotal |
|--------|---------|-----------|
| `linux-amd64` | `0dfd70f73337219925f3...` | [0/72 ✅](https://www.virustotal.com/gui/file/0dfd70f73337219925f3ec6a572fe776dbbe1c4c8c6ab546ab214fe16e56a426/detection) |
| `linux-arm64` | `f1fad27262fe7af4a356...` | [0/72 ✅](https://www.virustotal.com/gui/file/f1fad27262fe7af4a356af128e43942355cb2189491079b6790ecc5ae3af069c/detection) |
| `darwin-arm64` | `a1d3f8a4c353ab94ea8f...` | [0/72 ✅](https://www.virustotal.com/gui/file/a1d3f8a4c353ab94ea8fe1fb60159758020f2f256c9652699a0bd6725189a439/detection) |
| `darwin-amd64` | `a4d09d97fe1f47e1a0a2...` | [0/72 ✅](https://www.virustotal.com/gui/file/a4d09d97fe1f47e1a0a23309bc34d9937f74c61950bed3259f9576800cc78727/detection) |
| `windows-amd64` | `da3d7d7bd6f687b69714...` | [0/72 ✅](https://www.virustotal.com/gui/file/da3d7d7bd6f687b697145457ff9d113ecf6daffe173d236457a43223e89a5e9c/detection) |
Scan links for every release are also included in the GitHub Release notes automatically.
## License
MIT