Remediate the 2026-09-22 audit and overhaul CI/CD

.config/dotnet-tools.json

@@ -0,0 +1,13 @@
+{
+  "version": 1,
+  "isRoot": true,
+  "tools": {
+    "dotnet-coverage": {
+      "version": "18.11.2",
+      "commands": [
+        "dotnet-coverage"
+      ],
+      "rollForward": false
+    }
+  }
+}

.git-blame-ignore-revs

@@ -0,0 +1,9 @@
+# Commits that only reformat or mechanically rename code. Enable locally with: git config blame.ignoreRevsFile .git-blame-ignore-revs
+# Apply repository formatting
+e5b1e0dde918a54c0dd628737bb7ad86d36c1c7f
+# Reformat the plugin template sources with tabs
+d3d261e15bc520dd5cb24a2237bdefd417887532
+# Apply the hardened code style to every source file
+c9080ea19c5db2d4f9aa6ff3025923aed3dde5d7
+# Rename private constants, static fields and async methods
+cf07fdc6e39fce692679cb4074ba8bf36ff523a7

.gitattributes

@@ -0,0 +1,11 @@
+# Working trees use CRLF on every OS; this file owns line-ending normalization while .editorconfig governs formatting.
+* text=auto eol=crlf
+
+# Binary assets are never normalized.
+*.dll binary
+*.exe binary
+*.nupkg binary
+*.snupkg binary
+*.png binary
+*.ico binary
+*.snk binary

.github/CODEOWNERS

@@ -0,0 +1,16 @@
+# Informational only. "Require review from Code Owners" stays off while the project has a single active maintainer:
+# an author cannot approve their own pull request, so a required code-owner review would block every change.
+# Owners must have write access to the repository; invalid lines are skipped silently. Syntax:
+# https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners
+# The sensitive paths below repeat the default owner so that a second owner can be added in one place.
+
+*                           @AriusII
+
+/.github/                   @AriusII
+/eng/                       @AriusII
+/Directory.Build.props      @AriusII
+/Directory.Build.targets    @AriusII
+/Directory.Packages.props   @AriusII
+/global.json                @AriusII
+/nuget.config               @AriusII
+/SECURITY.md                @AriusII

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,76 @@
+name: Bug report
+description: A Client API, package or template behaves incorrectly; load or host problems use the compatibility report.
+title: "Bug: "
+labels: [ bug ]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        If the problem depends on the Cheat Engine build, its .NET runtime policy or plugin loading, use the
+        **Compatibility report** form instead: it records the exact tuple needed to investigate.
+        Security problems go through private vulnerability reporting (see SECURITY.md), never through an issue.
+  - type: input
+    id: client-version
+    attributes:
+      label: CheatEngine.Client version
+      description: All CheatEngine.Client* packages share one version. Read it from your packages.lock.json.
+      placeholder: 1.0.0
+    validations:
+      required: true
+  - type: input
+    id: sdk-version
+    attributes:
+      label: CheatEngine.SDK version resolved in packages.lock.json
+      placeholder: 2.0.0
+    validations:
+      required: true
+  - type: dropdown
+    id: area
+    attributes:
+      label: Area
+      options:
+        - Abstractions (public contracts, options, failures, leases)
+        - Fluent API
+        - Core (processes, memory, AOB scanning, inspection and symbols, tables, protected Lua)
+        - Experimental APIs (value scans, allocations, instructions, Auto Assembler patches; CECLIENT5001-5004)
+        - Hosting and dependency injection
+        - Lua source generator
+        - Template (dotnet new ceplugin)
+        - Packaging
+        - Other
+    validations:
+      required: true
+  - type: textarea
+    id: reproduction
+    attributes:
+      label: Steps to reproduce
+      description: A minimal code sample or project is best.
+    validations:
+      required: true
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected behaviour
+    validations:
+      required: true
+  - type: textarea
+    id: actual
+    attributes:
+      label: Actual behaviour
+      description: Include the exact exception, or the CheatEngineFailure kind and operation name.
+    validations:
+      required: true
+  - type: textarea
+    id: logs
+    attributes:
+      label: Redacted logs
+      render: text
+  - type: checkboxes
+    id: confirmations
+    attributes:
+      label: Confirmations
+      options:
+        - label: I removed user names, private paths and target-memory contents from this report.
+          required: true
+        - label: This is not a security vulnerability.
+          required: true

.github/ISSUE_TEMPLATE/compatibility.yml

@@ -0,0 +1,206 @@
+name: Compatibility report
+description: A CheatEngine.Client plugin fails to load or behaves differently on a specific Cheat Engine setup.
+title: "Compatibility: "
+labels: [ bug ]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        A compatibility problem can only be investigated against an exact tuple: the Client packages, the
+        CheatEngine.SDK package they resolved (version and fingerprint), the native Lua protection bridge, the Lua DLL
+        and the Cheat Engine build actually used, the .NET runtime policy of Cheat Engine, the plugin build options and
+        the load profile. A file name or a version alone does not identify it.
+
+        The profile targeted for qualification is Cheat Engine 7.7.0.10621 x64 (`cheatengine-x86_64.exe`) loading a
+        managed plugin through hostfxr (`ce-7.7.0.10621-x64-managed-hostfxr`). Whether that profile has been qualified,
+        and at which level, is stated by the qualification matrix of the release you use, not by this form. Reports
+        from other builds and load profiles are welcome too; say which one you used.
+
+        Compute every hash with `Get-FileHash <file> -Algorithm SHA256`. Remove user names and private paths.
+        Never attach Cheat Engine binaries, target binaries, authorization manifests or raw DebugView dumps.
+        Security problems go through private vulnerability reporting (see SECURITY.md), never through an issue.
+  - type: input
+    id: client-version
+    attributes:
+      label: CheatEngine.Client version
+      description: All CheatEngine.Client* packages share one version. Read it from your plugin's packages.lock.json.
+      placeholder: 1.0.0
+    validations:
+      required: true
+  - type: input
+    id: sdk-version
+    attributes:
+      label: CheatEngine.SDK version
+      description: The `resolved` version of CheatEngine.SDK in your plugin's packages.lock.json.
+      placeholder: 2.0.0
+    validations:
+      required: true
+  - type: input
+    id: sdk-content-hash
+    attributes:
+      label: CheatEngine.SDK contentHash
+      description: The `contentHash` of the same CheatEngine.SDK entry, copied from packages.lock.json (not recomputed).
+      placeholder: NLEdZYJ9...lQ==
+    validations:
+      required: true
+  - type: input
+    id: bridge-sha256
+    attributes:
+      label: Native bridge SHA-256
+      description: SHA-256 of `cheatengine-sdk-lua-bridge.dll` in your plugin output folder.
+    validations:
+      required: true
+  - type: input
+    id: bridge-fingerprint
+    attributes:
+      label: Native bridge source fingerprint (optional)
+      description: The `<c-sha256>:<xmake-sha256>` fingerprint, when the SDK release notes or the plugin log print it.
+  - type: input
+    id: lua-dll-sha256
+    attributes:
+      label: Lua DLL SHA-256
+      description: SHA-256 of `lua53-64.dll` in the Cheat Engine folder (the Lua runtime the plugin actually binds to).
+    validations:
+      required: true
+  - type: input
+    id: ce-version
+    attributes:
+      label: Cheat Engine version and executable
+      description: The version from Help > About, and the name of the executable you started.
+      placeholder: 7.7.0.10621, cheatengine-x86_64.exe
+    validations:
+      required: true
+  - type: input
+    id: ce-exe-sha256
+    attributes:
+      label: Cheat Engine executable SHA-256
+      description: SHA-256 of the executable you started.
+    validations:
+      required: true
+  - type: dropdown
+    id: ce-build
+    attributes:
+      label: Cheat Engine build and architecture
+      options:
+        - cheatengine-x86_64.exe (x64)
+        - cheatengine-x86_64-SSE4-AVX2.exe (x64, not a profiled build)
+        - Started through the Cheat Engine.exe launcher (not a profiled route)
+        - x86 Cheat Engine (not supported)
+        - Other
+    validations:
+      required: true
+  - type: input
+    id: runtimeconfig-sha256
+    attributes:
+      label: ce.runtimeconfig.json SHA-256
+      description: >-
+        SHA-256 of `ce.runtimeconfig.json` in the Cheat Engine folder. Record it as it is; do not change it for
+        this report.
+    validations:
+      required: true
+  - type: dropdown
+    id: runtimeconfig-state
+    attributes:
+      label: ce.runtimeconfig.json state
+      options:
+        - As installed by Cheat Engine
+        - Modified locally (describe the difference under Actual behaviour)
+        - Unknown
+    validations:
+      required: true
+  - type: textarea
+    id: dotnet-runtimes
+    attributes:
+      label: Installed .NET runtimes
+      description: Output of `dotnet --list-runtimes`, with private paths removed.
+      render: text
+    validations:
+      required: true
+  - type: dropdown
+    id: load-profile
+    attributes:
+      label: Plugin load profile
+      options:
+        - Managed plugin loaded through hostfxr (supported route, targeted for qualification)
+        - NativeAOT plugin (not supported)
+        - Historical CLR route (not supported)
+        - I do not know
+    validations:
+      required: true
+  - type: textarea
+    id: plugin-build
+    attributes:
+      label: Plugin build settings
+      description: |
+        `dotnet --version`, TargetFramework, RuntimeIdentifier, PlatformTarget, PublishAot and SelfContained if set,
+        whether the plugin was created with `dotnet new ceplugin`, and whether the Client packages came from nuget.org
+        or another feed.
+      render: text
+    validations:
+      required: true
+  - type: dropdown
+    id: observed-level
+    attributes:
+      label: Where did you observe the problem?
+      description: The qualification level of the observation. A build or unit-test result is not a Cheat Engine result.
+      options:
+        - Build, restore, analyzer or packaging output (C0)
+        - Unit tests or test doubles (C1)
+        - Native fixture outside Cheat Engine (C2)
+        - Cheat Engine with this plugin loaded (C3)
+        - Cheat Engine with several plugins, or after a target switch (C4)
+    validations:
+      required: true
+  - type: input
+    id: target
+    attributes:
+      label: Target process
+      description: Architecture (x64 or x86) and kind (local process, CEServer, file opened as a process).
+      placeholder: x64 local process
+    validations:
+      required: true
+  - type: input
+    id: os
+    attributes:
+      label: Windows version
+      placeholder: Windows 11 24H2 x64 (26100.xxxx)
+    validations:
+      required: true
+  - type: textarea
+    id: reproduction
+    attributes:
+      label: Steps to reproduce
+    validations:
+      required: true
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected behaviour
+    validations:
+      required: true
+  - type: textarea
+    id: actual
+    attributes:
+      label: Actual behaviour
+      description: Include the exact exception, or the CheatEngineFailure kind and operation name.
+    validations:
+      required: true
+  - type: textarea
+    id: logs
+    attributes:
+      label: Redacted logs
+      description: >-
+        Plugin log lines around the failure. Remove paths, addresses and memory contents you do not want
+        public.
+      render: text
+  - type: checkboxes
+    id: confirmations
+    attributes:
+      label: Confirmations
+      options:
+        - label: I removed user names, private paths and target-memory contents from this report.
+          required: true
+        - label: I attached no Cheat Engine binaries, target binaries, authorization manifests or raw DebugView dumps.
+          required: true
+        - label: This is not a security vulnerability.
+          required: true

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,11 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Report a security vulnerability
+    url: https://github.com/CheatEngineNet/CheatEngine.Client/security/advisories/new
+    about: Private vulnerability reporting. Never open a public issue for a vulnerability.
+  - name: CheatEngine.SDK problems (bootstrap, native bridge, Lua bindings, ABI)
+    url: https://github.com/CheatEngineNet/CheatEngine.SDK/issues/new/choose
+    about: Low-level SDK behaviour belongs to the CheatEngine.SDK repository.
+  - name: Cheat Engine itself
+    url: https://github.com/cheat-engine/cheat-engine/issues
+    about: Problems in Cheat Engine are reported upstream.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,38 @@
+name: Feature request
+description: Propose a new Client capability or an improvement to an existing one.
+title: "Feature: "
+labels: [ enhancement ]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        CheatEngine.SDK owns native bindings, Lua globals and native resource ownership; CheatEngine.Client composes
+        them. A request that needs a new Cheat Engine primitive usually starts in the CheatEngine.SDK repository.
+        Security problems go through private vulnerability reporting (see SECURITY.md), never through an issue.
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem
+      description: What do you want to do, and why is it hard today?
+    validations:
+      required: true
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposed API or behaviour
+    validations:
+      required: true
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives considered
+  - type: dropdown
+    id: sdk-dependency
+    attributes:
+      label: Does it need something CheatEngine.SDK does not expose?
+      options:
+        - "No"
+        - "Yes"
+        - I do not know
+    validations:
+      required: true