Skip to content

Commit fa6f0ab

Browse files
master3395master3395
committed
Refactor build process and update dependencies for improved functionality
- Refactored the `build.rs` file to conditionally build the plugin based on the availability of the "roblox-integration" feature, enhancing flexibility. - Updated `Cargo.lock` and `Cargo.toml` to reflect new dependency versions, including `tokio`, `clap`, and others, ensuring compatibility and access to the latest features. - Enhanced GitHub Actions workflows by adding caching for cargo registry and tools, optimizing build times and resource usage. - Removed outdated `.cargo/config.toml` and documentation files that are no longer relevant, streamlining the project structure. These changes improve the build process, enhance dependency management, and optimize CI/CD workflows, contributing to a more efficient development environment.
1 parent 8203600 commit fa6f0ab

23 files changed

+2237
-655
lines changed

‎.cargo/audit.toml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
# Cargo audit configuration to allow specific warnings
2+
[advisory]
3+
# Allow warnings for unmaintained crates that are build dependencies only
4+
allow = [
5+
# atty is only used in build dependencies and has no runtime impact
6+
"RUSTSEC-2024-0375", # atty unmaintained
7+
"RUSTSEC-2021-0145", # atty unsound (potential unaligned read)
8+
# net2 is only used in build dependencies and has no runtime impact
9+
"RUSTSEC-2020-0016", # net2 deprecated
10+
# paste is only used in build dependencies and has no runtime impact
11+
"RUSTSEC-2024-0436", # paste unmaintained
12+
# proc-macro-error is only used in build dependencies and has no runtime impact
13+
"RUSTSEC-2024-0370", # proc-macro-error unmaintained
14+
]
15+
16+
[advisory]
17+
# These are all build-time dependencies with no runtime security impact
18+
ignore = [
19+
"atty",
20+
"net2",
21+
"paste",
22+
"proc-macro-error"
23+
]

‎.cargo/config.toml‎

Lines changed: 0 additions & 2 deletions
This file was deleted.

‎.github/ISSUE_TEMPLATE/bug_report.yml‎

Lines changed: 90 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,90 @@
1+
name: 🐛 Bug Report
2+
description: Report a bug or unexpected behavior
3+
title: "[BUG] "
4+
labels: ["bug", "needs-triage"]
5+
assignees: []
6+
7+
body:
8+
- type: markdown
9+
attributes:
10+
value: |
11+
## 🐛 Bug Report
12+
13+
Please provide as much information as possible to help us reproduce and fix this issue.
14+
15+
- type: textarea
16+
id: bug-description
17+
attributes:
18+
label: Bug Description
19+
description: A clear and concise description of what the bug is
20+
placeholder: Describe the bug...
21+
validations:
22+
required: true
23+
24+
- type: textarea
25+
id: reproduction-steps
26+
attributes:
27+
label: Steps to Reproduce
28+
description: Steps to reproduce the behavior
29+
placeholder: |
30+
1. Go to '...'
31+
2. Click on '....'
32+
3. Scroll down to '....'
33+
4. See error
34+
validations:
35+
required: true
36+
37+
- type: textarea
38+
id: expected-behavior
39+
attributes:
40+
label: Expected Behavior
41+
description: What you expected to happen
42+
placeholder: Describe what should happen...
43+
validations:
44+
required: true
45+
46+
- type: textarea
47+
id: actual-behavior
48+
attributes:
49+
label: Actual Behavior
50+
description: What actually happened
51+
placeholder: Describe what actually happened...
52+
validations:
53+
required: true
54+
55+
- type: dropdown
56+
id: environment
57+
attributes:
58+
label: Environment
59+
description: What environment are you running?
60+
options:
61+
- Windows 10/11
62+
- macOS
63+
- Linux
64+
- Other
65+
validations:
66+
required: true
67+
68+
- type: input
69+
id: version
70+
attributes:
71+
label: Version
72+
description: What version of the MCP server are you using?
73+
placeholder: e.g., 0.2.1
74+
validations:
75+
required: true
76+
77+
- type: textarea
78+
id: logs
79+
attributes:
80+
label: Logs
81+
description: Relevant log output
82+
placeholder: Paste relevant logs here...
83+
render: shell
84+
85+
- type: textarea
86+
id: additional-context
87+
attributes:
88+
label: Additional Context
89+
description: Any other context about the problem
90+
placeholder: Add any other context about the problem here...

‎.github/ISSUE_TEMPLATE/security-vulnerability.yml‎

Lines changed: 114 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,114 @@
1+
name: 🚨 Security Vulnerability Report
2+
description: Report a security vulnerability in the Roblox Studio MCP Server
3+
title: "[SECURITY] "
4+
labels: ["security", "vulnerability", "urgent"]
5+
assignees: []
6+
7+
body:
8+
- type: markdown
9+
attributes:
10+
value: |
11+
## 🚨 Security Vulnerability Report
12+
13+
**⚠️ IMPORTANT**: This issue template is for reporting security vulnerabilities.
14+
15+
For general security questions or discussions, please use the regular issue template.
16+
17+
**🔒 Please DO NOT** include sensitive information, proof-of-concept code, or exploit details in this issue.
18+
19+
**📧 For highly sensitive vulnerabilities**, consider emailing security details privately instead.
20+
21+
- type: textarea
22+
id: vulnerability-description
23+
attributes:
24+
label: Vulnerability Description
25+
description: Provide a clear description of the security vulnerability
26+
placeholder: Describe the security issue without including sensitive details...
27+
validations:
28+
required: true
29+
30+
- type: textarea
31+
id: affected-versions
32+
attributes:
33+
label: Affected Versions
34+
description: Which versions are affected by this vulnerability?
35+
placeholder: |
36+
- Version 0.1.x
37+
- Version 0.2.x
38+
- All versions
39+
validations:
40+
required: true
41+
42+
- type: textarea
43+
id: reproduction-steps
44+
attributes:
45+
label: Steps to Reproduce
46+
description: How can this vulnerability be reproduced? (Do not include exploit code)
47+
placeholder: |
48+
1. Step one
49+
2. Step two
50+
3. Step three
51+
validations:
52+
required: true
53+
54+
- type: dropdown
55+
id: severity
56+
attributes:
57+
label: Severity Level
58+
description: What is the severity of this vulnerability?
59+
options:
60+
- Critical (Remote Code Execution, Data Breach)
61+
- High (Privilege Escalation, Authentication Bypass)
62+
- Medium (Information Disclosure, Denial of Service)
63+
- Low (Minor security issues)
64+
validations:
65+
required: true
66+
67+
- type: textarea
68+
id: impact
69+
attributes:
70+
label: Potential Impact
71+
description: What could an attacker achieve with this vulnerability?
72+
placeholder: Describe the potential impact without providing exploit details...
73+
validations:
74+
required: true
75+
76+
- type: textarea
77+
id: suggested-fix
78+
attributes:
79+
label: Suggested Fix
80+
description: Do you have any suggestions for fixing this vulnerability?
81+
placeholder: Optional: Describe how this vulnerability could be fixed...
82+
83+
- type: checkboxes
84+
id: disclosure-preference
85+
attributes:
86+
label: Disclosure Preference
87+
description: How would you like this vulnerability to be disclosed?
88+
options:
89+
- label: I agree to coordinated disclosure (recommended)
90+
required: false
91+
- label: I prefer immediate public disclosure
92+
required: false
93+
- label: I would like to discuss disclosure timeline privately
94+
required: false
95+
96+
- type: textarea
97+
id: additional-info
98+
attributes:
99+
label: Additional Information
100+
description: Any additional information that might be helpful?
101+
placeholder: References, related issues, etc...
102+
103+
- type: checkboxes
104+
id: terms
105+
attributes:
106+
label: Terms
107+
description: By submitting this report, you agree to the following
108+
options:
109+
- label: I have read and agree to the [Security Policy](SECURITY.md)
110+
required: true
111+
- label: I understand that this is a public repository and my report will be visible to others
112+
required: true
113+
- label: I will not use this vulnerability for malicious purposes
114+
required: true

‎.github/workflows/README.md‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -62,5 +62,59 @@ The security workflow implements multiple layers of protection:
6262
2. **Dependency Scanning**: Automatically checks for vulnerable dependencies
6363
3. **Secret Detection**: Prevents accidental exposure of API keys, passwords, and tokens
6464
4. **Rust-Specific Security**: Cargo audit checks for known vulnerabilities in Rust crates
65+
5. **Weekly Security Scans**: Automated vulnerability detection runs every Monday
66+
6. **Security Reporting**: Detailed security reports with vulnerability summaries
67+
7. **Dependency Updates**: Automated checking for outdated dependencies
6568

6669
All security checks must pass before code can be merged into the main branch.
70+
71+
### Enhanced Security Workflows
72+
73+
#### Security Scan (`security-scan.yml`)
74+
- **CodeQL Analysis**: Static Application Security Testing (SAST)
75+
- **Dependency Review**: Scans dependencies for known vulnerabilities (PRs only)
76+
- **Secrets Scan**: Detects accidentally committed secrets using Gitleaks
77+
- **Cargo Audit**: Checks Rust dependencies for security vulnerabilities
78+
- **Dependency Check**: Identifies outdated dependencies
79+
- **Security Summary**: Comprehensive security status report
80+
81+
#### Dependency Update (`dependency-update.yml`)
82+
- **Weekly Updates**: Automated dependency update checking
83+
- **Security Alerts**: Creates issues for security vulnerabilities
84+
- **Critical Fixes**: Automated fixing of critical vulnerabilities
85+
- **Update Reports**: Detailed reports on outdated dependencies
86+
87+
### Security Tools
88+
89+
The project includes several security tools and scripts:
90+
91+
- **`scripts/fix-vulnerabilities.sh`**: Bash script to fix known vulnerabilities
92+
- **`scripts/fix-vulnerabilities.ps1`**: PowerShell script for Windows users
93+
- **`SECURITY.md`**: Comprehensive security policy and vulnerability tracking
94+
- **Issue Templates**: Structured reporting for security vulnerabilities
95+
96+
### Known Vulnerabilities
97+
98+
Current vulnerabilities being tracked:
99+
100+
1. **tracing-subscriber 0.3.19** → **Fixed** (upgraded to 0.3.20)
101+
2. **adler 1.0.2** → **Planned** (replace with adler2)
102+
3. **atty 0.2.14** → **Planned** (replace with is-terminal)
103+
4. **net2 0.2.39** → **Planned** (replace with socket2)
104+
5. **paste 1.0.15** → **Planned** (replace with paste-next)
105+
6. **proc-macro-error 1.0.4** → **Planned** (replace with proc-macro-error-attr)
106+
107+
### Running Security Fixes
108+
109+
To fix vulnerabilities manually:
110+
111+
```bash
112+
# On Unix/Linux/macOS
113+
./scripts/fix-vulnerabilities.sh
114+
115+
# On Windows (PowerShell)
116+
.\scripts\fix-vulnerabilities.ps1
117+
118+
# Dry run to see what would be changed
119+
.\scripts\fix-vulnerabilities.ps1 -DryRun
120+
```

0 commit comments

Comments
 (0)