security: enforce HTTPS on curl downloads (SonarCloud S6506)

Add --proto '=https' to curl invocations so redirects cannot downgrade to
plaintext HTTP. Resolves SonarCloud S6506 (shell/docker/githubactions).

.coderabbit.yaml

@@ -0,0 +1,6 @@
+# yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json
+reviews:
+  auto_review:
+    # Dependabot bumps are checked by CI; skip CodeRabbit reviews on them.
+    ignore_usernames:
+      - "dependabot[bot]"

.github/workflows/nix.yml

@@ -18,16 +18,6 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
-  eval:
+  nix:
-    runs-on: ubuntu-latest
+    # Intentionally tracked at @main (not SHA-pinned) so org-wide CI improvements, security fixes, and build optimizations propagate without PR churn across all craftapp repos.
-    timeout-minutes: 15
+    uses: storytold/craft-common-actions/.github/workflows/nix.yml@main
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31.11.1
-      - name: nix flake check --no-build
-        run: |
-          if [ -f flake.nix ]; then
-            nix flake check --no-build --all-systems
-          else
-            echo "No flake.nix present in this repository; skipping check."
-          fi

.github/workflows/sonarcloud.yml

@@ -0,0 +1,20 @@
+name: SonarCloud
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    types: [opened, synchronize, reopened]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: sonarcloud-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  sonarcloud:
+    # Tracked at @main so org-wide CI improvements propagate without PR churn.
+    uses: storytold/craft-common-actions/.github/workflows/sonarcloud.yml@main
+    secrets: inherit

Cargo.lock

@@ -1496,7 +1496,7 @@ dependencies = [
 
 [[package]]
 name = "gridcraft"
-version = "0.9.0"
+version = "0.10.0"
 dependencies = [
  "arboard",
  "craft-print",
@@ -1518,7 +1518,7 @@ dependencies = [
 
 [[package]]
 name = "gridcraft-calc"
-version = "0.9.0"
+version = "0.10.0"
 dependencies = [
  "gridcraft-core",
  "gridcraft-formula",
@@ -1530,7 +1530,7 @@ dependencies = [
 
 [[package]]
 name = "gridcraft-chart"
-version = "0.9.0"
+version = "0.10.0"
 dependencies = [
  "gridcraft-calc",
  "gridcraft-core",
@@ -1541,7 +1541,7 @@ dependencies = [
 
 [[package]]
 name = "gridcraft-cli"
-version = "0.9.0"
+version = "0.10.0"
 dependencies = [
  "gridcraft-engine",
  "gridcraft-mcp",
@@ -1553,7 +1553,7 @@ dependencies = [
 
 [[package]]
 name = "gridcraft-core"
-version = "0.9.0"
+version = "0.10.0"
 dependencies = [
  "js-sys",
  "serde",
@@ -1563,7 +1563,7 @@ dependencies = [
 
 [[package]]
 name = "gridcraft-engine"
-version = "0.9.0"
+version = "0.10.0"
 dependencies = [
  "gridcraft-calc",
  "gridcraft-chart",
@@ -1584,7 +1584,7 @@ dependencies = [
 
 [[package]]
 name = "gridcraft-formula"
-version = "0.9.0"
+version = "0.10.0"
 dependencies = [
  "gridcraft-core",
  "serde",
@@ -1593,7 +1593,7 @@ dependencies = [
 
 [[package]]
 name = "gridcraft-functions"
-version = "0.9.0"
+version = "0.10.0"
 dependencies = [
  "gridcraft-core",
  "regex",
@@ -1601,7 +1601,7 @@ dependencies = [
 
 [[package]]
 name = "gridcraft-mcp"
-version = "0.9.0"
+version = "0.10.0"
 dependencies = [
  "gridcraft-engine",
  "log",
@@ -1610,7 +1610,7 @@ dependencies = [
 
 [[package]]
 name = "gridcraft-model"
-version = "0.9.0"
+version = "0.10.0"
 dependencies = [
  "gridcraft-core",
  "gridcraft-formula",
@@ -1622,18 +1622,18 @@ dependencies = [
 
 [[package]]
 name = "gridcraft-numfmt"
-version = "0.9.0"
+version = "0.10.0"
 dependencies = [
  "gridcraft-core",
 ]
 
 [[package]]
 name = "gridcraft-pdf"
-version = "0.9.0"
+version = "0.10.0"
 
 [[package]]
 name = "gridcraft-ui-egui"
-version = "0.9.0"
+version = "0.10.0"
 dependencies = [
  "craft-ui",
  "egui",
@@ -1655,7 +1655,7 @@ dependencies = [
 
 [[package]]
 name = "gridcraft-web"
-version = "0.9.0"
+version = "0.10.0"
 dependencies = [
  "eframe",
  "egui",
@@ -1672,7 +1672,7 @@ dependencies = [
 
 [[package]]
 name = "gridcraft-xlsx"
-version = "0.9.0"
+version = "0.10.0"
 dependencies = [
  "aes",
  "gridcraft-core",
@@ -4526,7 +4526,7 @@ checksum = "e450f9b2ed1dff33c94c12589a87338689467b9c4f5d8a5710bd09a847d2c8a7"
 
 [[package]]
 name = "xtask"
-version = "0.9.0"
+version = "0.10.0"
 dependencies = [
  "gridcraft-engine",
  "serde_json",

Cargo.toml

@@ -4,7 +4,7 @@ members = ["crates/*", "apps/*", "xtask"]
 default-members = ["crates/*", "apps/gridcraft", "apps/gridcraft-cli", "xtask"]
 
 [workspace.package]
-version = "0.9.0"
+version = "0.10.0"
 edition = "2024"
 license = "MIT OR Apache-2.0"
 rust-version = "1.90"

packaging/linux/package.sh

@@ -111,7 +111,7 @@ if has appimage; then
   if [ -z "$TOOL" ]; then
     TOOL="$CARGO_TARGET_DIR/appimagetool-$ARCH.AppImage"
     if [ ! -x "$TOOL" ]; then
-      curl -fsSL -o "$TOOL" "https://github.com/AppImage/appimagetool/releases/download/continuous/appimagetool-$ARCH.AppImage"
+      curl --proto '=https' -fsSL -o "$TOOL" "https://github.com/AppImage/appimagetool/releases/download/continuous/appimagetool-$ARCH.AppImage"
       chmod +x "$TOOL"
     fi
   fi

sonar-project.properties

@@ -0,0 +1,2 @@
+sonar.projectKey=storytold_gridcraft
+sonar.organization=storytold