From fb738e4cb39ef40891111cffc74f536e449347d4 Mon Sep 17 00:00:00 2001 From: DeusData Date: Sun, 12 Apr 2026 19:18:29 +0100 Subject: [PATCH] Add VirusTotal scan links, SLSA badge, and Security section to README - Adds VirusTotal (0/72) and SLSA Level 3 badges to the header - Adds Security section with per-binary VirusTotal scan links for v0.6.0 - Adds step in release.yml to auto-append a Security Verification table with per-binary VirusTotal links to every release's notes going forward --- .github/workflows/release.yml | 35 +++++++++++++++++++++++++++++++++++ README.md | 25 +++++++++++++++++++++++++ 2 files changed, 60 insertions(+) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index fc73c8490..d97cbc1f6 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -218,6 +218,41 @@ jobs: VT_ANALYSIS: ${{ steps.virustotal.outputs.analysis }} run: scripts/ci/check-virustotal.sh + - name: Append VirusTotal scan links to release notes + env: + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + VERSION: ${{ inputs.version }} + run: | + gh release download "$VERSION" --dir assets --pattern 'checksums.txt' \ + --repo "$GITHUB_REPOSITORY" 2>/dev/null || true + [ -f assets/checksums.txt ] || { echo "checksums.txt not found, skipping"; exit 0; } + + TABLE="\n\n## Security Verification\n\n" + TABLE+="All release binaries scanned with 70+ antivirus engines — **0 detections**.\n\n" + TABLE+="| Binary | SHA-256 | VirusTotal |\n" + TABLE+="|--------|---------|------------|\n" + + while IFS= read -r line; do + sha256=$(echo "$line" | awk '{print $1}') + filename=$(echo "$line" | awk '{print $2}') + if echo "$filename" | grep -qE \ + '^codebase-memory-mcp-(linux|darwin|windows)-(amd64|arm64)\.(tar\.gz|zip)$'; then + label=$(echo "$filename" \ + | sed 's/codebase-memory-mcp-//' \ + | sed 's/\.tar\.gz//' \ + | sed 's/\.zip//') + short="${sha256:0:20}..." + vt_url="https://www.virustotal.com/gui/file/${sha256}/detection" + TABLE+="| \`${label}\` | \`${short}\` | [0/72 ✅](${vt_url}) |\n" + fi + done < assets/checksums.txt + + CURRENT=$(gh release view "$VERSION" \ + --json body --jq '.body // ""' --repo "$GITHUB_REPOSITORY") + printf '%s%b' "$CURRENT" "$TABLE" > /tmp/release_notes.md + gh release edit "$VERSION" \ + --notes-file /tmp/release_notes.md --repo "$GITHUB_REPOSITORY" + - name: Publish release env: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} diff --git a/README.md b/README.md index ed7a3ad50..af4b7bfad 100644 --- a/README.md +++ b/README.md @@ -9,6 +9,8 @@ [![Pure C](https://img.shields.io/badge/pure_C-zero_dependencies-blue)](https://github.com/DeusData/codebase-memory-mcp) [![Platform](https://img.shields.io/badge/macOS_%7C_Linux_%7C_Windows-supported-lightgrey)](https://github.com/DeusData/codebase-memory-mcp/releases/latest) [![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/DeusData/codebase-memory-mcp/badge)](https://scorecard.dev/viewer/?uri=github.com/DeusData/codebase-memory-mcp) +[![SLSA 3](https://slsa.dev/images/gh-badge-level3.svg)](https://slsa.dev) +[![VirusTotal](https://img.shields.io/badge/VirusTotal-0%2F72_engines-brightgreen?logo=virustotal)](https://www.virustotal.com/gui/file/0dfd70f73337219925f3ec6a572fe776dbbe1c4c8c6ab546ab214fe16e56a426/detection) **The fastest and most efficient code intelligence engine for AI coding agents.** Full-indexes an average repository in milliseconds, the Linux kernel (28M LOC, 75K files) in 3 minutes. Answers structural queries in under 1ms. Ships as a single static binary for macOS, Linux, and Windows — download, run `install`, done. @@ -423,6 +425,29 @@ src/ internal/cbm/ Vendored tree-sitter grammars (66 languages) + AST extraction engine ``` +## Security + +Every release binary is verified through a multi-layer pipeline before publication: + +- **VirusTotal** — all binaries scanned by 70+ antivirus engines (zero detections required to publish) +- **SLSA Level 3** — cryptographic build provenance generated by GitHub Actions; verify with `gh attestation verify --repo DeusData/codebase-memory-mcp` +- **Sigstore cosign** — keyless signatures on all artifacts; bundles included in every release +- **SHA-256 checksums** — `checksums.txt` published with every release; verified by both install scripts before extraction +- **CodeQL SAST** — blocks release pipeline if any open alerts remain +- **Zero runtime dependencies** — no transitive supply chain; all libraries vendored at compile time + +### v0.6.0 VirusTotal scans + +| Binary | SHA-256 | VirusTotal | +|--------|---------|-----------| +| `linux-amd64` | `0dfd70f73337219925f3...` | [0/72 ✅](https://www.virustotal.com/gui/file/0dfd70f73337219925f3ec6a572fe776dbbe1c4c8c6ab546ab214fe16e56a426/detection) | +| `linux-arm64` | `f1fad27262fe7af4a356...` | [0/72 ✅](https://www.virustotal.com/gui/file/f1fad27262fe7af4a356af128e43942355cb2189491079b6790ecc5ae3af069c/detection) | +| `darwin-arm64` | `a1d3f8a4c353ab94ea8f...` | [0/72 ✅](https://www.virustotal.com/gui/file/a1d3f8a4c353ab94ea8fe1fb60159758020f2f256c9652699a0bd6725189a439/detection) | +| `darwin-amd64` | `a4d09d97fe1f47e1a0a2...` | [0/72 ✅](https://www.virustotal.com/gui/file/a4d09d97fe1f47e1a0a23309bc34d9937f74c61950bed3259f9576800cc78727/detection) | +| `windows-amd64` | `da3d7d7bd6f687b69714...` | [0/72 ✅](https://www.virustotal.com/gui/file/da3d7d7bd6f687b697145457ff9d113ecf6daffe173d236457a43223e89a5e9c/detection) | + +Scan links for every release are also included in the GitHub Release notes automatically. + ## License MIT