security: enforce HTTPS on curl downloads (SonarCloud S6506)

Add --proto '=https' to curl invocations so redirects cannot downgrade to plaintext HTTP. Resolves SonarCloud S6506 (shell/docker/githubactions).
ci: add sonar-project.properties for CI-based analysis
2026-10-24 18:46:49 -06:00 · 2026-10-21 17:07:16 -04:00 · 2026-10-21 16:00:49 -04:00 · 2026-10-21 15:47:06 -04:00 · 2026-10-21 13:57:33 -04:00 · 2026-10-20 11:40:20 -04:00
6 changed files with 48 additions and 20 deletions
@@ -0,0 +1,6 @@
+# yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json
+reviews:
+  auto_review:
+    # Dependabot bumps are checked by CI; skip CodeRabbit reviews on them.
+    ignore_usernames:
+      - "dependabot[bot]"
@@ -0,0 +1,20 @@
+name: SonarCloud
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    types: [opened, synchronize, reopened]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: sonarcloud-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  sonarcloud:
+    # Tracked at @main so org-wide CI improvements propagate without PR churn.
+    uses: storytold/craft-common-actions/.github/workflows/sonarcloud.yml@main
+    secrets: inherit
@@ -3572,7 +3572,7 @@ dependencies = [

 [[package]]
 name = "soundcraft"
-version = "0.10.0"
+version = "0.11.0"
 dependencies = [
 "eframe",
 "egui",
@@ -3590,7 +3590,7 @@ dependencies = [

 [[package]]
 name = "soundcraft-au-host"
-version = "0.10.0"
+version = "0.11.0"
 dependencies = [
 "log",
 "serde",
@@ -3600,7 +3600,7 @@ dependencies = [

 [[package]]
 name = "soundcraft-audio-io"
-version = "0.10.0"
+version = "0.11.0"
 dependencies = [
 "log",
 "proptest",
@@ -3612,7 +3612,7 @@ dependencies = [

 [[package]]
 name = "soundcraft-automation"
-version = "0.10.0"
+version = "0.11.0"
 dependencies = [
 "log",
 "serde_json",
@@ -3622,7 +3622,7 @@ dependencies = [

 [[package]]
 name = "soundcraft-clap-host"
-version = "0.10.0"
+version = "0.11.0"
 dependencies = [
 "clap-sys",
 "libloading",
@@ -3635,7 +3635,7 @@ dependencies = [

 [[package]]
 name = "soundcraft-cli"
-version = "0.10.0"
+version = "0.11.0"
 dependencies = [
 "serde_json",
 "soundcraft-audio-io",
@@ -3646,7 +3646,7 @@ dependencies = [

 [[package]]
 name = "soundcraft-dsp"
-version = "0.10.0"
+version = "0.11.0"
 dependencies = [
 "log",
 "proptest",
@@ -3657,7 +3657,7 @@ dependencies = [

 [[package]]
 name = "soundcraft-engine"
-version = "0.10.0"
+version = "0.11.0"
 dependencies = [
 "craft-docpath",
 "log",
@@ -3680,7 +3680,7 @@ dependencies = [

 [[package]]
 name = "soundcraft-midi"
-version = "0.10.0"
+version = "0.11.0"
 dependencies = [
 "proptest",
 "serde",
@@ -3690,7 +3690,7 @@ dependencies = [

 [[package]]
 name = "soundcraft-mix"
-version = "0.10.0"
+version = "0.11.0"
 dependencies = [
 "log",
 "rayon",
@@ -3706,7 +3706,7 @@ dependencies = [

 [[package]]
 name = "soundcraft-model"
-version = "0.10.0"
+version = "0.11.0"
 dependencies = [
 "proptest",
 "serde",
@@ -3719,7 +3719,7 @@ dependencies = [

 [[package]]
 name = "soundcraft-playback"
-version = "0.10.0"
+version = "0.11.0"
 dependencies = [
 "cpal",
 "log",
@@ -3734,7 +3734,7 @@ dependencies = [

 [[package]]
 name = "soundcraft-time"
-version = "0.10.0"
+version = "0.11.0"
 dependencies = [
 "proptest",
 "serde",
@@ -3744,7 +3744,7 @@ dependencies = [

 [[package]]
 name = "soundcraft-ui-egui"
-version = "0.10.0"
+version = "0.11.0"
 dependencies = [
 "craft-ui",
 "egui",
@@ -3770,7 +3770,7 @@ dependencies = [

 [[package]]
 name = "soundcraft-video"
-version = "0.10.0"
+version = "0.11.0"
 dependencies = [
 "image",
 "proptest",
@@ -3781,7 +3781,7 @@ dependencies = [

 [[package]]
 name = "soundcraft-vst3-host"
-version = "0.10.0"
+version = "0.11.0"
 dependencies = [
 "libloading",
 "log",
@@ -3797,7 +3797,7 @@ dependencies = [

 [[package]]
 name = "soundcraft-web"
-version = "0.10.0"
+version = "0.11.0"
 dependencies = [
 "eframe",
 "egui",
@@ -5354,7 +5354,7 @@ checksum = "e450f9b2ed1dff33c94c12589a87338689467b9c4f5d8a5710bd09a847d2c8a7"

 [[package]]
 name = "xtask"
-version = "0.10.0"
+version = "0.11.0"
 dependencies = [
 "serde_json",
 ]
@@ -4,7 +4,7 @@ members = ["crates/*", "apps/*", "xtask"]
 default-members = ["crates/*", "apps/*", "xtask"]

 [workspace.package]
-version = "0.10.0"
+version = "0.11.0"
 edition = "2024"
 license = "MIT OR Apache-2.0"
 rust-version = "1.90"
@@ -115,7 +115,7 @@ if has appimage; then
  if [ -z "$TOOL" ]; then
    TOOL="$CARGO_TARGET_DIR/appimagetool-$ARCH.AppImage"
    if [ ! -x "$TOOL" ]; then
-      curl -fsSL -o "$TOOL" "https://github.com/AppImage/appimagetool/releases/download/continuous/appimagetool-$ARCH.AppImage"
+      curl --proto '=https' -fsSL -o "$TOOL" "https://github.com/AppImage/appimagetool/releases/download/continuous/appimagetool-$ARCH.AppImage"
      chmod +x "$TOOL"
    fi
  fi
@@ -0,0 +1,2 @@
+sonar.projectKey=storytold_soundcraft
+sonar.organization=storytold
Author	SHA1	Message	Date
Dylan M. Taylor	6731ba2dce	security: enforce HTTPS on curl downloads (SonarCloud S6506) Add --proto '=https' to curl invocations so redirects cannot downgrade to plaintext HTTP. Resolves SonarCloud S6506 (shell/docker/githubactions).	2026-10-21 17:07:16 -04:00
Dylan M. Taylor	30ef8306f8	ci: add sonar-project.properties for CI-based analysis Marks the project ineligible for SonarCloud Automatic Analysis, resolving the CI-vs-automatic-analysis conflict so the SonarCloud workflow succeeds.	2026-10-21 16:00:49 -04:00
Dylan M. Taylor	7587ae2690	ci: add SonarCloud scan via shared reusable workflow Calls storytold/craft-common-actions/.github/workflows/sonarcloud.yml@main with secrets: inherit. Adds SonarCloud badge to README where missing and removes the redundant sonar-project.properties (config now passed by the reusable workflow).	2026-10-21 15:47:06 -04:00
Brandon ThomasandClaude Opus 5.5	b74fca0fb0	Release 0.11.0 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-21 13:57:33 -04:00
Brandon ThomasandClaude Opus 5.5	7b339fe921	Skip CodeRabbit reviews on Dependabot PRs (#821 ) Adds .coderabbit.yaml so CodeRabbit no longer reviews or comments on PRs opened by dependabot[bot]. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-20 11:40:20 -04:00