[audit] Harden plugin route patterns, i18n keys, and container user

.claude/hooks/sonar-secrets/build-scripts/pretool-secrets.sh

@@ -0,0 +1,5 @@
+#!/bin/bash
+if ! command -v sonar &> /dev/null; then
+  exit 0
+fi
+sonar hook claude-pre-tool-use

.claude/hooks/sonar-secrets/build-scripts/prompt-secrets.sh

@@ -0,0 +1,5 @@
+#!/bin/bash
+if ! command -v sonar &> /dev/null; then
+  exit 0
+fi
+sonar hook claude-prompt-submit

.claude/settings.json

@@ -0,0 +1,40 @@
+{
+  "hooks": {
+    "PostToolUse": [
+      {
+        "hooks": [
+          {
+            "command": "\"${CLAUDE_PROJECT_DIR}/scripts/agent-quality-hook.sh\"",
+            "timeout": 60,
+            "type": "command"
+          }
+        ],
+        "matcher": "Edit|Write|MultiEdit"
+      }
+    ],
+    "PreToolUse": [
+      {
+        "hooks": [
+          {
+            "command": "\"${CLAUDE_PROJECT_DIR}/.claude/hooks/sonar-secrets/build-scripts/pretool-secrets.sh\"",
+            "timeout": 60,
+            "type": "command"
+          }
+        ],
+        "matcher": "Read"
+      }
+    ],
+    "UserPromptSubmit": [
+      {
+        "hooks": [
+          {
+            "command": "\"${CLAUDE_PROJECT_DIR}/.claude/hooks/sonar-secrets/build-scripts/prompt-secrets.sh\"",
+            "timeout": 60,
+            "type": "command"
+          }
+        ],
+        "matcher": "*"
+      }
+    ]
+  }
+}

.codex/config.toml

@@ -0,0 +1,3 @@
+[mcp_servers.sonarqube]
+command = "sonar"
+args = [ "run", "mcp", "--project", "Heretek-Games_drop" ]

.codex/hooks.json

@@ -0,0 +1,16 @@
+{
+  "hooks": {
+    "UserPromptSubmit": [
+      {
+        "hooks": [
+          {
+            "command": "'.codex/hooks/sonar-secrets/build-scripts/prompt-secrets.sh'",
+            "timeout": 60,
+            "type": "command"
+          }
+        ],
+        "matcher": "*"
+      }
+    ]
+  }
+}

.codex/hooks/sonar-secrets/build-scripts/prompt-secrets.sh

@@ -0,0 +1,5 @@
+#!/bin/bash
+if ! command -v sonar &> /dev/null; then
+  exit 0
+fi
+sonar hook codex-prompt-submit

.cursor/hooks.json

@@ -0,0 +1,29 @@
+{
+  "hooks": {
+    "beforeReadFile": [
+      {
+        "command": "'.cursor/hooks/sonar-secrets/build-scripts/before-read-file-secrets.sh'",
+        "failClosed": false,
+        "matcher": "Read|TabRead",
+        "timeout": 60
+      }
+    ],
+    "beforeSubmitPrompt": [
+      {
+        "command": "'.cursor/hooks/sonar-secrets/build-scripts/prompt-secrets.sh'",
+        "failClosed": false,
+        "matcher": "UserPromptSubmit",
+        "timeout": 60
+      }
+    ],
+    "preToolUse": [
+      {
+        "command": "'.cursor/hooks/sonar-secrets/build-scripts/pre-tool-use-secrets.sh'",
+        "failClosed": false,
+        "matcher": "Read",
+        "timeout": 60
+      }
+    ]
+  },
+  "version": 1
+}

.cursor/hooks/sonar-secrets/build-scripts/before-read-file-secrets.sh

@@ -0,0 +1,5 @@
+#!/bin/bash
+if ! command -v sonar &> /dev/null; then
+  exit 0
+fi
+sonar hook cursor-pre-file-read

.cursor/hooks/sonar-secrets/build-scripts/pre-tool-use-secrets.sh

@@ -0,0 +1,5 @@
+#!/bin/bash
+if ! command -v sonar &> /dev/null; then
+  exit 0
+fi
+sonar hook cursor-pre-tool-use

.cursor/hooks/sonar-secrets/build-scripts/prompt-secrets.sh

@@ -0,0 +1,5 @@
+#!/bin/bash
+if ! command -v sonar &> /dev/null; then
+  exit 0
+fi
+sonar hook cursor-prompt-submit

.cursor/mcp.json

@@ -0,0 +1,8 @@
+{
+  "mcpServers": {
+    "sonarqube": {
+      "args": ["run", "mcp", "--project", "Heretek-Games_drop"],
+      "command": "sonar"
+    }
+  }
+}

.git-blame-ignore-revs

@@ -0,0 +1,2 @@
+# Repository-wide Prettier formatting pass
+ab351bf800feba2e5658c9758fe3f5682a501497

.github/workflows/analysis.yml

@@ -0,0 +1,228 @@
+name: Static analysis
+
+on:
+  push:
+    branches: [develop]
+  pull_request:
+    branches: [develop]
+  schedule:
+    - cron: "17 5 * * 1" # weekly Monday 05:17 UTC
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  actionlint:
+    name: actionlint
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # actions/checkout@v7
+        with:
+          persist-credentials: false
+      - name: Lint workflows
+        run: docker run --rm -v "$PWD:/mnt:ro" -w /mnt rhysd/actionlint:1.7.12 -color
+
+  zizmor:
+    name: zizmor (Actions security)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # actions/checkout@v7
+        with:
+          persist-credentials: false
+      - name: Install zizmor
+        run: pipx install zizmor==1.30.1
+      - name: Audit workflows
+        run: zizmor --format plain .github/workflows
+
+  shellcheck:
+    name: shellcheck
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # actions/checkout@v7
+        with:
+          persist-credentials: false
+      - name: Shellcheck scripts
+        run: |
+          mapfile -t files < <(git ls-files '*.sh')
+          if [ "${#files[@]}" -eq 0 ]; then
+            echo "No shell scripts found."
+            exit 0
+          fi
+          shellcheck "${files[@]}"
+
+  hadolint:
+    name: hadolint
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # actions/checkout@v7
+        with:
+          persist-credentials: false
+      - name: Lint Dockerfile
+        run: docker run --rm -i hadolint/hadolint:v2.15.1 < Dockerfile
+
+  pnpm-audit:
+    name: pnpm audit
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # actions/checkout@v7
+        with:
+          persist-credentials: false
+      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # pnpm/action-setup@v6
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # actions/setup-node@v7
+        with:
+          node-version: lts/*
+          cache: "pnpm"
+      - name: Install dependencies
+        run: pnpm install --ignore-scripts
+      - name: Audit
+        run: pnpm audit --audit-level high
+
+  govulncheck:
+    name: govulncheck
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # actions/checkout@v7
+        with:
+          persist-credentials: false
+      - uses: golang/govulncheck-action@032d45514ae346b1db93c04b0c90b841c370344f # v1.1.0
+        with:
+          repo-checkout: false
+          go-version-file: backend/go.work
+          work-dir: backend
+          go-package: ./core/...
+          cache: false
+
+  cargo-machete:
+    name: cargo-machete (unused Rust deps)
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        crate:
+          - cli
+          - torrential
+          - desktop/src-tauri
+          - libraries/droplet
+          - libraries/droplet_types
+          - libraries/libarchive
+          - libraries/native_model
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # actions/checkout@v7
+        with:
+          persist-credentials: false
+      - uses: dtolnay/rust-toolchain@7c8d7d138f5c09cef361f8214cf96882cd029cdb # dtolnay/rust-toolchain@nightly
+      - uses: taiki-e/install-action@4b8992af23a2be34fd58f8d9b50d3f4939ad1891 # taiki-e/install-action@cargo-machete
+        with:
+          tool: cargo-machete
+      - name: Find unused dependencies
+        working-directory: ${{ matrix.crate }}
+        run: cargo machete
+
+  desktop:
+    name: desktop frontend (typecheck + knip)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # actions/checkout@v7
+        with:
+          persist-credentials: false
+      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # pnpm/action-setup@v6
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # actions/setup-node@v7
+        with:
+          node-version: lts/*
+          cache: "pnpm"
+      - name: Install root dependencies
+        run: pnpm install --ignore-scripts
+      - name: Install desktop/main dependencies
+        run: pnpm -C desktop/main install --ignore-scripts
+      - name: Typecheck desktop/main
+        run: pnpm -C desktop/main run typecheck
+      - name: Knip report (desktop/main)
+        if: always()
+        run: pnpm exec knip --directory desktop/main --reporter json --no-exit-code > desktop-knip-report.json
+      - name: Upload knip report
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # actions/upload-artifact@v7
+        with:
+          name: desktop-knip-report
+          path: desktop-knip-report.json
+
+  frontend-lint:
+    name: frontend lint (${{ matrix.target }})
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        target:
+          - desktop/main
+          - libraries/base
+          - sites/promo
+          - sites/docs
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # actions/checkout@v7
+        with:
+          persist-credentials: false
+      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # pnpm/action-setup@v6
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # actions/setup-node@v7
+        with:
+          node-version: lts/*
+          cache: "pnpm"
+      - name: Install root dependencies
+        run: pnpm install --ignore-scripts
+      - name: Install desktop/main dependencies
+        if: matrix.target == 'desktop/main'
+        run: pnpm -C desktop/main install --ignore-scripts
+      - name: Lint
+        run: pnpm -C ${{ matrix.target }} run lint
+
+  commitlint:
+    name: commitlint
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # actions/checkout@v7
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # pnpm/action-setup@v6
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # actions/setup-node@v7
+        with:
+          node-version: lts/*
+          cache: "pnpm"
+      - name: Install dependencies
+        run: pnpm install --ignore-scripts
+      - name: Lint commit messages
+        env:
+          BASE_REF: ${{ github.base_ref }}
+        run: >-
+          pnpm exec commitlint
+          --from "origin/$BASE_REF"
+          --to HEAD
+
+  ruff:
+    name: ruff (Python dev tools)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # actions/checkout@v7
+        with:
+          persist-credentials: false
+      - name: Install ruff
+        run: pipx install ruff==0.16.7
+      - name: Check
+        working-directory: server
+        run: |
+          ruff check dev-tools
+          ruff format --check dev-tools
+
+  typos:
+    name: typos
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # actions/checkout@v7
+        with:
+          persist-credentials: false
+      - uses: taiki-e/install-action@4b8992af23a2be34fd58f8d9b50d3f4939ad1891 # taiki-e/install-action@typos
+        with:
+          tool: typos@1.50.1
+      - name: Check spelling
+        run: typos