Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 18 additions & 0 deletions .clang-format
Original file line number Diff line number Diff line change
@@ -0,0 +1,18 @@
---
BasedOnStyle: Google
IndentWidth: 4
Language: Cpp
ColumnLimit: 100
PointerAlignment: Right
AlignAfterOpenBracket: Align
AlignConsecutiveMacros: true
AllowAllParametersOfDeclarationOnNextLine: false
SortIncludes: false
SpaceAfterCStyleCast: true
AllowShortCaseLabelsOnASingleLine: false
AllowAllArgumentsOnNextLine: false
AllowShortBlocksOnASingleLine: Never
AllowShortFunctionsOnASingleLine: None
BinPackArguments: false
BinPackParameters: false
---
35 changes: 35 additions & 0 deletions .github/workflows/build_and_functional_tests.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,35 @@
name: Build and run functional tests using ragger through reusable workflow

# This workflow will build the app and then run functional tests using the Ragger framework upon Speculos emulation.
# It calls a reusable workflow developed by Ledger's internal developer team to build the application and upload the
# resulting binaries.
# It then calls another reusable workflow to run the Ragger tests on the compiled application binary.
#
# The build part of this workflow is mandatory, this ensures that the app will be deployable in the Ledger App Store.
# While the test part of this workflow is optional, having functional testing on your application is mandatory and this workflow and
# tooling environment is meant to be easy to use and adapt after forking your application

on:
workflow_dispatch:
inputs:
golden_run:
type: choice
required: true
default: "Raise an error (default)"
description: CI behavior if the test snapshots are different than expected.
options:
- "Raise an error (default)"
- "Open a PR"
push:
branches:
- master
- main
- develop
pull_request:

jobs:
build_application:
name: Build application using the reusable workflow
uses: LedgerHQ/ledger-app-workflows/.github/workflows/reusable_build.yml@v1
with:
upload_app_binaries_artifact: "app_boilerplate_binaries"
Comment on lines +32 to +35

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {}

Copilot Autofix

AI 6 months ago

To fix the issue, add an explicit permissions block to the workflow. The most robust practice is to set permissions at the workflow root so they apply to all jobs unless a specific job needs an override. The required permissions are typically minimal—contents: read is safe for builds that simply need access to the repository source, and if artifact uploads or pull requests are handled, additional permissions might be needed (e.g., pull-requests: write). For this workflow, which builds applications and uploads binaries but does not appear to create PRs directly, contents: read should suffice for a starting point. Add the following block after the workflow name (above on:):

permissions:
  contents: read

If later steps require additional permissions, these can be added.

Change to make:
In .github/workflows/build_and_functional_tests.yml, insert the above block after line 1 (following the workflow name and before the on: block).


Suggested changeset 1
.github/workflows/build_and_functional_tests.yml

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/.github/workflows/build_and_functional_tests.yml b/.github/workflows/build_and_functional_tests.yml
--- a/.github/workflows/build_and_functional_tests.yml
+++ b/.github/workflows/build_and_functional_tests.yml
@@ -1,4 +1,6 @@
 name: Build and run functional tests using ragger through reusable workflow
+permissions:
+  contents: read
 
 # This workflow will build the app and then run functional tests using the Ragger framework upon Speculos emulation.
 # It calls a reusable workflow developed by Ledger's internal developer team to build the application and upload the
EOF
@@ -1,4 +1,6 @@
name: Build and run functional tests using ragger through reusable workflow
permissions:
contents: read

# This workflow will build the app and then run functional tests using the Ragger framework upon Speculos emulation.
# It calls a reusable workflow developed by Ledger's internal developer team to build the application and upload the
Copilot is powered by AI and may make mistakes. Always verify output.
25 changes: 25 additions & 0 deletions .github/workflows/coding_style_checks.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,25 @@
name: Run coding style check through reusable workflow

# This workflow will run linting checks to ensure a level of uniformization among all Ledger applications.
#
# The presence of this workflow is mandatory as a minimal level of linting is required.
# You are however free to modify the content of the .clang-format file and thus the coding style of your application.
# We simply ask you to not diverge too much from the linting of the Boilerplate application.

on:
workflow_dispatch:
push:
branches:
- master
- main
- develop
pull_request:

jobs:
check_linting:
name: Check linting using the reusable workflow
uses: LedgerHQ/ledger-app-workflows/.github/workflows/reusable_lint.yml@v1
with:
source: "./src"
extensions: "h,c"
version: 18
Comment on lines +20 to +25

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {}

Copilot Autofix

AI 6 months ago

To address this issue, add a permissions block to limit the privileges granted to the GITHUB_TOKEN within the workflow. The code should set the permissions block at the job level (check_linting:), as the only job present is invoking a reusable workflow and may not require any special permissions; using permissions: {} is the minimal restrictive configuration. If the workflow requires specific permissions, these can be set as required, but the secure default is to assign no permissions. Insert the block above the uses: key as per GitHub Actions syntax.


Suggested changeset 1
.github/workflows/coding_style_checks.yml

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/.github/workflows/coding_style_checks.yml b/.github/workflows/coding_style_checks.yml
--- a/.github/workflows/coding_style_checks.yml
+++ b/.github/workflows/coding_style_checks.yml
@@ -18,6 +18,7 @@
 jobs:
   check_linting:
     name: Check linting using the reusable workflow
+    permissions: {}
     uses: LedgerHQ/ledger-app-workflows/.github/workflows/reusable_lint.yml@v1
     with:
       source: "./src"
EOF
@@ -18,6 +18,7 @@
jobs:
check_linting:
name: Check linting using the reusable workflow
permissions: {}
uses: LedgerHQ/ledger-app-workflows/.github/workflows/reusable_lint.yml@v1
with:
source: "./src"
Copilot is powered by AI and may make mistakes. Always verify output.
3 changes: 3 additions & 0 deletions .gitignore
Original file line number Diff line number Diff line change
@@ -1,7 +1,10 @@
bin
build
debug
dep
obj
output-scan-build
.vscode
src/glyphs.c
src/glyphs.h
customCA.key
Loading
Loading