diff --git a/.bumpversion.toml b/.bumpversion.toml index a13739c..d2a1ff0 100644 --- a/.bumpversion.toml +++ b/.bumpversion.toml @@ -46,30 +46,3 @@ replace = 'git tag -s -m "Release v{new_version}" v{new_version}' filename = "RELEASE.md" search = "git push origin v{current_version}" replace = "git push origin v{new_version}" - -# ── README.md ───────────────────────────────────────────────────────────────── - -[[tool.bumpversion.files]] -filename = "README.md" -search = "Zenzic Core v{current_version} or higher" -replace = "Zenzic Core v{new_version} or higher" - -[[tool.bumpversion.files]] -filename = "README.md" -search = "minimum required Core version (`v{current_version}`)" -replace = "minimum required Core version (`v{new_version}`)" - -[[tool.bumpversion.files]] -filename = "README.md" -search = "virtual environment containing Core `v{current_version}` or higher" -replace = "virtual environment containing Core `v{new_version}` or higher" - -[[tool.bumpversion.files]] -filename = "CONTRIBUTING.md" -search = "**Zenzic Core `v{current_version}`** (`MIN_CORE_VERSION = '{current_version}'` in `src/extension.ts`)." -replace = "**Zenzic Core `v{new_version}`** (`MIN_CORE_VERSION = '{new_version}'` in `src/extension.ts`)." - -[[tool.bumpversion.files]] -filename = "CONTRIBUTING.md" -search = "| **Zenzic Core** | ≥ {current_version} |" -replace = "| **Zenzic Core** | ≥ {new_version} |" diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index b0f1efc..40ff720 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -15,10 +15,7 @@ permissions: jobs: verify: name: Verify & Package - strategy: - matrix: - os: [ubuntu-latest, windows-latest] - runs-on: ${{ matrix.os }} + runs-on: ubuntu-latest steps: - name: Checkout Repository uses: actions/checkout@v7 diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml new file mode 100644 index 0000000..41c5341 --- /dev/null +++ b/.github/workflows/codeql.yml @@ -0,0 +1,50 @@ +# SPDX-FileCopyrightText: 2026 PythonWoods +# SPDX-License-Identifier: Apache-2.0 + +name: Zenzic VS Code CodeQL + +on: + push: + branches: [ main ] + paths: + - 'src/**' + - 'package.json' + - '.github/workflows/codeql.yml' + pull_request: + branches: [ main ] + paths: + - 'src/**' + - 'package.json' + - '.github/workflows/codeql.yml' + schedule: + - cron: '24 3 * * 1' + +permissions: + actions: read + contents: read + security-events: write + +jobs: + analyze: + if: vars.ENABLE_CODEQL == 'true' + name: Analyze + runs-on: ubuntu-latest + strategy: + fail-fast: false + matrix: + language: [ javascript-typescript ] + + steps: + - name: Checkout Repository + uses: actions/checkout@v4 + + - name: Initialize CodeQL + uses: github/codeql-action/init@v3 + with: + languages: ${{ matrix.language }} + + - name: Autobuild + uses: github/codeql-action/autobuild@v3 + + - name: Perform CodeQL Analysis + uses: github/codeql-action/analyze@v3 \ No newline at end of file diff --git a/CHANGELOG.md b/CHANGELOG.md index 9833e84..98d6ae9 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,6 +7,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ## [Unreleased] +### Added +- **Suppression Code Actions (`LSP-FEAT-003`)**: Added support for automated inline suppressions. You can now use the Quick Fix (Lightbulb) menu to instantly inject `` comments above offending lines. This feature is intentionally disabled for Z2xx Security findings. + +### Fixed +- **DQS Tooltip Rendering (`LSP-FIX-015`)**: Fixed a rendering issue where a `security_breach` status incorrectly displayed green checkmarks in the DQS tooltip. The tooltip now prominently displays a security breach warning. +- **Core Baseline Alignment**: Realigned pinned Zenzic Core baseline to `0.26.3`. + ## [0.26.2] - 2026-07-28 ### Fixed diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index ee83dfe..b3f58af 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -27,7 +27,7 @@ Zenzic is structured across three independent, dedicated repositories: - **Thin Client Sovereignty**: `zenzic-vscode` contains **zero** AST parsing, regex checks, or link validation rules. All analysis logic resides in Zenzic Core (`zenzic lsp`). - **Protocol Parity**: The extension communicates via standard Language Server Protocol (LSP) over stdio. -- **Minimum Core Baseline**: Currently pinned to **Zenzic Core `v0.26.2`** (`MIN_CORE_VERSION = '0.26.2'` in `src/extension.ts`). +- **Minimum Core Baseline**: Currently pinned to **Zenzic Core `v0.26.3`** (`MIN_CORE_VERSION = '0.26.3'` in `src/extension.ts`). --- @@ -51,7 +51,7 @@ To maintain security, architectural integrity, and legal compliance, all contrib | **npm** | required | Package manager | | **just** | required | Task runner — `cargo install just` or via OS package manager | | **reuse** | required | SPDX license auditor (`uv tool install reuse`) | -| **Zenzic Core** | ≥ 0.26.2 | Core engine (`uv tool install zenzic`) | +| **Zenzic Core** | ≥ 0.26.3 | Core engine (`uv tool install zenzic`) | --- diff --git a/README.md b/README.md index 8be2f7b..46ccca2 100644 --- a/README.md +++ b/README.md @@ -29,8 +29,8 @@ Modify a heading or link in one file, and Zenzic's Virtual Site Map (VSM) instan ### 3. Adapter-Driven Config Hot-Reloading (`v0.25.0`) When framework configuration files (e.g. `mkdocs.yml`, `zensical.toml`, `.zenzic.toml`) are modified, the Language Server automatically reloads adapter metadata and rebuilds the Virtual Site Map without requiring an extension or editor restart. -### 4. Inline Diagnostics & Quick Fixes -Hover over any diagnostic to view the exact Z-Code, DQS score penalty, and remediation guidance. Apply automated Quick Fixes via `textDocument/codeAction` directly from the editor lightbulb menu. +### 4. Inline Diagnostics, Quick Fixes & Automated Suppressions +Hover over any diagnostic to view the exact Z-Code, DQS score penalty, and remediation guidance. Apply automated Quick Fixes or insert Automated Inline Suppressions (``, except for `Z2xx` Security findings) via `textDocument/codeAction` directly from the editor lightbulb menu. ### 5. DQS Workspace UI Stream Document Quality Score (DQS) updates directly to the status bar, providing real-time visibility into overall repository health. @@ -46,7 +46,7 @@ To guarantee sub-50ms performance, Zenzic operates with a strict separation of c ## Requirements -This extension requires **Zenzic Core v0.26.2 or higher**. +This extension requires **Zenzic Core v0.26.3 or higher**. We recommend installing or updating the global binary via `uv`: @@ -101,12 +101,12 @@ The extension contributes the following commands to the Command Palette: ### Zenzic: Outdated Core -- **Cause**: The executable resolved by the extension is older than the minimum required Core version (`v0.26.2`). +- **Cause**: The executable resolved by the extension is older than the minimum required Core version (`v0.26.3`). - **Remediation**: Upgrade your global binary: ```bash uv tool install --force zenzic ``` - Or point `zenzic.executablePath` in `settings.json` to a virtual environment containing Core `v0.26.2` or higher. + Or point `zenzic.executablePath` in `settings.json` to a virtual environment containing Core `v0.26.3` or higher. ### Zenzic: Not Found (ENOENT) diff --git a/RELEASE.md b/RELEASE.md index 75e64a6..2a987f4 100644 --- a/RELEASE.md +++ b/RELEASE.md @@ -9,7 +9,7 @@ | Field | Value | | :--- | :--- | | **Extension Version** | 0.26.2 | -| **Pinned Core** | `zenzic>=0.26.2` | +| **Pinned Core** | `zenzic>=0.26.3` | | **Date** | 2026-07-11 | ## 1. Pre-Flight Checklist diff --git a/src/extension.ts b/src/extension.ts index 4f4fbff..1e3b910 100644 --- a/src/extension.ts +++ b/src/extension.ts @@ -20,7 +20,7 @@ let dqsStatusBarItem: vscode.StatusBarItem | undefined; // A2 fix: guard flag prevents concurrent restart calls. let restarting = false; -const MIN_CORE_VERSION = '0.26.2'; +const MIN_CORE_VERSION = '0.26.3'; /** * Expand supported user-facing path variables in zenzic.executablePath. @@ -415,18 +415,40 @@ export async function activate(context: vscode.ExtensionContext) { const status = report.status ?? 'unknown'; const debt = report.suppression_debt_pts ?? 0; - const icon = score >= 80 ? '$(dashboard)' : score >= 50 ? '$(warning)' : '$(error)'; - dqsStatusBarItem.text = `${icon} Zenzic DQS: ${score}/100`; - - const categoryLines = (report.categories ?? []) - .map(c => ` ${c.name}: ${c.issues === 0 ? '✓' : `${c.issues} issue(s)`}`) - .join('\n'); - dqsStatusBarItem.tooltip = [ - `Documentation Quality Score: ${score}/100`, - `Status: ${status}`, - debt > 0 ? `Technical Debt: -${debt}pts` : '', - categoryLines ? `\nBreakdown:\n${categoryLines}` : '', - ].filter(Boolean).join('\n'); + // LSP-FIX-015 Fix 3: security_breach (Z201) forces score to 0. + // Do NOT show category checkmarks — they would be misleading. + // A credential was detected; the status bar and tooltip must + // communicate the breach prominently and unambiguously. + const isSecurityBreach = status === 'security_breach'; + + const icon = isSecurityBreach + ? '$(shield)' + : score >= 80 ? '$(dashboard)' : score >= 50 ? '$(warning)' : '$(error)'; + dqsStatusBarItem.text = isSecurityBreach + ? `${icon} Zenzic DQS: SECURITY BREACH` + : `${icon} Zenzic DQS: ${score}/100`; + + if (isSecurityBreach) { + dqsStatusBarItem.tooltip = [ + '🚨 ZENZIC — SECURITY BREACH DETECTED 🚨', + '', + 'A credential or hardcoded secret was found in the documentation.', + 'Score is forced to 0/100 — Z201 is non-suppressible.', + '', + '⚠️ Rotate the exposed credential immediately.', + 'Reference: https://zenzic.dev/docs/reference/finding-codes#Z201', + ].join('\n'); + } else { + const categoryLines = (report.categories ?? []) + .map(c => ` ${c.name}: ${c.issues === 0 ? '✓' : `${c.issues} issue(s)`}`) + .join('\n'); + dqsStatusBarItem.tooltip = [ + `Documentation Quality Score: ${score}/100`, + `Status: ${status}`, + debt > 0 ? `Technical Debt: -${debt}pts` : '', + categoryLines ? `\nBreakdown:\n${categoryLines}` : '', + ].filter(Boolean).join('\n'); + } } catch { dqsStatusBarItem.text = '$(error) Zenzic DQS: Parse Error';