Refactor, new structure and validations

.github/CODE_OF_CONDUCT.md

@@ -0,0 +1,3 @@
+This project adheres to **No Code of Conduct**.  We are all adults.  We accept anyone's contributions.  Nothing else matters. 
+
+For more information please visit the [No Code of Conduct](https://github.com/domgetter/NCoC) homepage.

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -42,13 +42,20 @@ body:
 
   - type: dropdown
     attributes:
-      label: SO version
+      label: Platform
+      description: Where does the issue occur?
       options:
-        - Windows 11
-        - Windows 10
-        - Windows 8
-        - Windows 7
-        - Debian
+        - Web — Chrome (Blink)
+        - Web — Firefox (Gecko)
+        - Web — Safari (WebKit)
+        - Web — Other
+        - Desktop — macOS
+        - Desktop — Windows
+        - Desktop — Linux
+        - Desktop — Other
+        - Mobile — iOS
+        - Mobile — Android
+        - Mobile — Other
         - Other
     validations:
       required: true
@@ -57,7 +64,7 @@ body:
     attributes:
       label: Confirmation 
       options:
-        - label: I performed a [search of the issue tracker](https://github.com/segocode/Ramonware/issues) to avoid opening a duplicate issue
+        - label: I performed a [search of the issue tracker](https://github.com/{username}/{reponame}/issues) to avoid opening a duplicate issue
           required: true
         - label: I understand that not filling out this template correctly may lead to the issue being closed
           required: true

.github/ISSUE_TEMPLATE/config.yml

@@ -1,5 +1,5 @@
 blank_issues_enabled: false
 contact_links:
   - name: Contact the developer
-    url: https://segocode.github.io/SegoCode/
+    url: https://{username}.github.io/{username}/
     about: To discuss any type of related topic

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -34,7 +34,7 @@ body:
     attributes:
       label: Confirmation
       options:
-        - label: I performed a [search of the feature requests](https://github.com/segocode/Ramonware/issues) to avoid suggesting a duplicate feature
+        - label: I performed a [search of the feature requests](https://github.com/{username}/{reponame}/issues) to avoid suggesting a duplicate feature
           required: true
         - label: I understand that not filling out this template correctly may lead to the request being closed
-          required: true
+          required: true

.github/SECURITY.md

@@ -0,0 +1 @@
+If you discover a vulnerability in this application, that poses a significant threat to the security of the users, we recommend that you do not open a public issue. Instead, please send your report via [email](https://{username}.github.io/{username}/). Include as much detailed information as possible to help understand the nature of the vulnerability.

.github/workflows/gitleaks.yml

@@ -0,0 +1,64 @@
+name: Gitleaks
+on:
+  push:
+  pull_request:
+  workflow_dispatch:
+
+jobs:
+  scan:
+    name: Gitleaks Scan
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      issues: write
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+
+      - name: Run Gitleaks
+        id: gitleaks
+        uses: gitleaks/gitleaks-action@v3
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+        continue-on-error: true
+
+      - name: Create issue if leaks found
+        if: steps.gitleaks.outcome == 'failure' && (github.ref == 'refs/heads/main' || github.event_name == 'workflow_dispatch')
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          echo "Creating detailed security issue report..."
+
+          TIMESTAMP=$(date -u +"%Y-%m-%d %H:%M:%S UTC")
+
+          ISSUE_BODY="## 🚨 Security Alert: Potential Secrets Detected
+
+          **Detection Time:** ${TIMESTAMP}
+          **Branch:** ${GITHUB_REF#refs/heads/}
+          **Detected by:** Gitleaks Security Scanner
+
+          ### Details
+          Gitleaks has detected one or more potential secrets or credentials in the codebase.
+
+          ### Impact
+          Exposed secrets can lead to unauthorized access, data breaches, or account compromise.
+
+          ### Next Steps
+          1. Review the workflow logs for specific details about the detected secrets: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+          2. Revoke any exposed credentials immediately
+          3. Remove the secrets from the codebase
+          4. Consider using GitHub Secrets or environment variables instead
+
+          ---
+          *This issue was automatically generated by the Gitleaks security scanning workflow.*"
+
+          gh issue create \
+            --repo "${{ github.repository }}" \
+            --title "Security Alert: Potential secrets detected in main branch" \
+            --body "${ISSUE_BODY}"
+
+      - name: Fail if leaks were found
+        if: steps.gitleaks.outcome == 'failure'
+        run: exit 1

.github/workflows/greetings.yml

@@ -1,6 +1,6 @@
 name: Greetings
 
-on: [pull_request_target]
+on: [pull_request_target, issues]
 
 jobs:
   greeting:
@@ -9,7 +9,8 @@ jobs:
       issues: write
       pull-requests: write
     steps:
-    - uses: actions/first-interaction@v1
+    - uses: actions/first-interaction@v3.1.0
       with:
-        repo-token: ${{ secrets.GITHUB_TOKEN }}
-        pr-message: "🎉 Thank you for your first pull request to the repository! We're grateful for your contribution and will review it ASAP."
+        repo_token: ${{ secrets.GITHUB_TOKEN }}
+        issue_message: "Thank you for your first issue. To better understand your request or the problem you've encountered, please provide as many details as possible. If the behavior changes or if you have new information about your request, don't hesitate to add it. It will be reviewed ASAP."
+        pr_message: "Thank you for your first pull request to the repository! We're grateful for your contribution and will review it ASAP."

.github/workflows/initializer.yml

@@ -0,0 +1,100 @@
+name: Initialize repository
+
+on:
+  workflow_dispatch:
+
+concurrency:
+  group: initialize-repository
+
+jobs:
+  initialize_repo:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      issues: write
+      pull-requests: write
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v7
+        with:
+          ref: main
+          fetch-depth: 0
+
+      - name: Setup git
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+
+      - name: Extract repository and username
+        id: extract
+        run: |
+          echo "username=${{ github.repository_owner }}" >> "$GITHUB_OUTPUT"
+          echo "reponame=${{ github.event.repository.name }}" >> "$GITHUB_OUTPUT"
+
+      - name: Create develop branch if it doesn't exist
+        run: |
+          if ! git ls-remote --exit-code --heads origin develop; then
+            git push origin HEAD:refs/heads/develop
+          fi
+
+      - name: Replace {reponame} and {username} with actual values in non-workflow files
+        run: |
+          set -o pipefail
+          REPO_NAME_ONLY="${{ steps.extract.outputs.reponame }}"
+          USERNAME="${{ steps.extract.outputs.username }}"
+          git grep -Ilz '{reponame}' -- ':!.github/workflows/*' | xargs -0r sed -i "s/{reponame}/$REPO_NAME_ONLY/g"
+          git grep -Ilz '{username}' -- ':!.github/workflows/*' | xargs -0r sed -i "s/{username}/$USERNAME/g"
+
+      - name: Remove initializer workflow
+        run: |
+          rm -f .github/workflows/initializer.yml
+
+      - name: Commit changes
+        run: |
+          git checkout -B chore/initialize-repository
+          git add --all -- ':!.github/workflows'
+          git add .github/workflows/initializer.yml
+          git commit -m "chore: initialize repository"
+          git fetch origin chore/initialize-repository:refs/remotes/origin/chore/initialize-repository 2>/dev/null || true
+          git push --force-with-lease origin HEAD:chore/initialize-repository
+
+      - name: Create pull request
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          PR_URL=$(gh pr list --repo "${{ github.repository }}" --base main --head chore/initialize-repository \
+            --state open --json url --jq '.[0].url')
+          if [ -z "$PR_URL" ]; then
+            if ! PR_URL=$(gh pr create --repo "${{ github.repository }}" --base main --head chore/initialize-repository \
+              --title "chore: initialize repository" \
+              --body "Replace template placeholders, create the develop branch, and remove the one-time initializer." 2>&1); then
+              if [[ "$PR_URL" != *"not permitted to create or approve pull requests"* ]]; then
+                echo "$PR_URL" >&2
+                exit 1
+              fi
+
+              ISSUE_TITLE="Action required: allow workflows to create pull requests"
+              ISSUE_BODY=$(printf '%s\n' \
+                "The repository initializer could not create its pull request because GitHub Actions does not have permission." \
+                "" \
+                "To fix it:" \
+                "" \
+                "1. Open [Settings > Actions > General](https://github.com/${{ github.repository }}/settings/actions)." \
+                "2. Under **Workflow permissions**, select **Read and write permissions**." \
+                "3. Enable **Allow GitHub Actions to create and approve pull requests**." \
+                "4. Save the changes." \
+                "5. Run the [Initialize repository workflow](https://github.com/${{ github.repository }}/actions/workflows/initializer.yml) again.")
+
+              EXISTING_ISSUE=$(gh issue list --repo "${{ github.repository }}" --state open --limit 100 \
+                --json title,url --jq '.[] | select(.title == "Action required: allow workflows to create pull requests") | .url')
+              if [ -n "$EXISTING_ISSUE" ]; then
+                echo "Permission issue already exists: $EXISTING_ISSUE"
+              else
+                gh issue create --repo "${{ github.repository }}" --title "$ISSUE_TITLE" --body "$ISSUE_BODY"
+              fi
+              echo "$PR_URL" >&2
+              exit 1
+            fi
+          fi
+          echo "$PR_URL"

.github/workflows/verify.yml

@@ -0,0 +1,64 @@
+name: Verify
+
+on:
+  push:
+    branches:
+      - '**'
+
+jobs:
+  roundtrip:
+    name: Encryption roundtrip
+    runs-on: windows-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@v7.0.1
+
+      - name: Run prototype and assert encrypt roundtrip
+        shell: pwsh
+        run: |
+          $ErrorActionPreference = 'Stop'
+          $sandbox = Join-Path $env:RUNNER_TEMP 'ramonware-ci'
+          $probe = Join-Path $sandbox 'probe.txt'
+          $aes = "$probe.aes"
+          $log = 'C:\Original.txt'
+          $plain = [Text.Encoding]::UTF8.GetBytes('ramonware-integrity')
+          $pass = [guid]::NewGuid().ToString('N')
+
+          if (Test-Path $sandbox) { Remove-Item $sandbox -Recurse -Force }
+          New-Item -ItemType Directory -Path $sandbox -Force | Out-Null
+          [IO.File]::WriteAllBytes($probe, $plain)
+          if (Test-Path $log) { Remove-Item $log -Force }
+
+          function Replace-Exact($text, $old, $new, $expected = 1) {
+            $actual = [regex]::Matches($text, [regex]::Escape($old)).Count
+            if ($actual -ne $expected) {
+              throw "Expected $expected occurrence(s) of '$old', found $actual"
+            }
+            $text.Replace($old, $new)
+          }
+
+          $sourcePath = Join-Path $env:GITHUB_WORKSPACE 'code\Ramonware.bat'
+          $batPath = Join-Path $sandbox 'RamonWare-ci.bat'
+          $utf8 = New-Object Text.UTF8Encoding $false
+          $bat = [IO.File]::ReadAllText($sourcePath)
+          $bat = Replace-Exact $bat 'set ROOT_PATH=%homedrive%\' "set pass=$pass`r`nset ROOT_PATH=$sandbox"
+          $bat = Replace-Exact $bat '*.labasset' '*.txt'
+          $bat = Replace-Exact $bat 'REM powershell -NoProfile' 'powershell -NoProfile' 2
+          $bat = Replace-Exact $bat 'REM del "%%X"' 'del "%%X"'
+          $bat = Replace-Exact $bat 'cls' 'exit /b'
+          [IO.File]::WriteAllText($batPath, $bat, $utf8)
+
+          $process = Start-Process -FilePath $env:ComSpec -ArgumentList '/d', '/c', "`"$batPath`"" -Wait -PassThru
+          if ($process.ExitCode -ne 0) { throw "RamonWare-ci.bat exited with $($process.ExitCode)" }
+
+          if (-not (Test-Path $log) -or -not (Select-String -Path $log -Pattern 'probe.txt' -SimpleMatch -Quiet)) {
+            if (Test-Path $log) { Get-Content $log }
+            throw "Original.txt does not contain probe.txt"
+          }
+
+          if (-not (Test-Path $aes)) { throw "missing $aes" }
+
+          $restored = [IO.File]::ReadAllBytes($probe)
+          if ([Convert]::ToBase64String($plain) -ne [Convert]::ToBase64String($restored)) {
+            throw 'encrypt roundtrip failed'
+          }