Add security.md file to the repo

.github/workflows/broken_links_checker.yml

@@ -1,19 +1,44 @@
 name: Broken Links Checker
-
 on:
   schedule:
-    - cron: "0 5 * * *"
-  push:
-    branches:
-      - main
-  pull_request:
-
+    - {
+      cron: 0 5 * * 0
+    }
+  workflow_dispatch: null
 jobs:
   linkChecker:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-latest
+    permissions: {
+      contents: read
+    }
+    defaults:
+      run: {
+        shell: bash
+      }
+    concurrency: {
+      group: '${{ github.workflow }}-${{ github.ref }}',
+      cancel-in-progress: true
+    }
     steps:
-      - uses: actions/checkout@v4
-      - uses: gaurav-nelson/github-action-markdown-link-check@v1
-        with:
-          use-quiet-mode: "yes"
-          use-verbose-mode: "yes"
+      - id: checkout
+        uses: actions/checkout@v7
+        with: {
+          persist-credentials: false
+        }
+      - id: configure-broken-links-checker
+        name: Configure broken links checker
+        run: |
+          mkdir -p ./target
+          echo '{"aliveStatusCodes": [429, 200], "ignorePatterns": [' \
+          '{"pattern": "^https?://(www|dev).mysql.com/"},' \
+          '{"pattern": "^https?://(www.)?opensource.org"}' \
+          '{"pattern": "^https?://(www.)?eclipse.org"}' \
+          '{"pattern": "^https?://projects.eclipse.org"}' \
+          ']}' > ./target/broken_links_checker.json
+      - id: run-broken-links-checker
+        uses: tcort/github-action-markdown-link-check@e7c7a18363c842693fadde5d41a3bd3573a7a225
+        with: {
+          use-quiet-mode: yes,
+          use-verbose-mode: yes,
+          config-file: ./target/broken_links_checker.json
+        }

.github/workflows/ci-build.yml

@@ -7,37 +7,57 @@ on:
   pull_request:
 
 jobs:
-  build:
-    strategy:
-      fail-fast: true
-      matrix:
-        lua_version: [5.4]
-    runs-on: ubuntu-24.04
+  lint-github-actions:
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+      contents: read
+      actions: read
+    defaults:
+      run:
+        shell: bash
+    concurrency:
+      group: '${{ github.workflow }}-github-actions-linter-${{ github.ref }}'
+      cancel-in-progress: true
     steps:
       - name: Checkout the repository
-        uses: actions/checkout@v4
+        id: checkout
+        uses: actions/checkout@v7
         with:
-          fetch-depth: 0
-      - name: Install Lua ${{ matrix.lua_version }}
-        uses: leafo/gh-actions-lua@v10
+          persist-credentials: false
+      - name: Lint GitHub actions with Zizmore
+        id: lint-github-actions
+        uses: zizmorcore/zizmor-action@192e21d79ab29983730a13d1382995c2307fbcaa
         with:
-          luaVersion: ${{ matrix.lua_version }}
-      - name: Install LuaRocks
-        uses: leafo/gh-actions-luarocks@v4
+          advanced-security: false
+
+  build:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout the repository
+        uses: actions/checkout@v7
         with:
-          luaRocksVersion: "3.11.1"
-      - name: Cache Lua dependencies
-        id: cache-lua-dependencies
-        uses: actions/cache@v4
+          fetch-depth: 0
+          persist-credentials: false
+      - name: Cache downloaded LuaRocks packages
+        uses: actions/cache@v6
         with:
-          path: ~/.luarocks
-          key: |
-            ${{ runner.os }}-lua-${{ matrix.lua_version }}-${{ hashFiles('*.rockspec') }}
-          restore-keys: |
-            "${{ runner.os }}-lua-${{ matrix.lua_version }}"
-            "${{ runner.os }}-lua"
+          path: ~/.cache/luarocks
+          key: ${{ runner.os }}-luarocks-lua-5.4-${{ hashFiles('*.rockspec') }}
+      - name: Install Lua and LuaRocks
+        run: |
+          sudo apt-get install lua5.4 liblua5.4-dev luarocks
+          sudo update-alternatives --install /usr/bin/lua lua-interpreter /usr/bin/lua5.4 54
+          sudo update-alternatives --install /usr/bin/luac lua-compiler /usr/bin/luac5.4 54
+          sudo update-alternatives --set lua-interpreter /usr/bin/lua5.4
+          sudo update-alternatives --set lua-compiler /usr/bin/luac5.4
+          luarocks config --scope user lua_version 5.4
+          luarocks config --scope user lua_dir /usr
+          luarocks config --local deploy_bin_dir >> "$GITHUB_PATH"
       - name: Install Lua dependencies
-        run: luarocks make --local
+        run: luarocks make --local --lua-version 5.4
       - name: Run tests
         run: tools/run_tests.sh --run=ci
       - name: Run static code analysis
@@ -47,37 +67,21 @@ jobs:
       - name: Run shellcheck
         run: tools/shellcheck.sh
       - name: Archive code coverage results
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: luacov-report
           path: target/luacov-reports/*
+      - name: Install Plantuml
+        run: |
+          sudo apt-get update -y
+          sudo apt-get install -y plantuml
+      - name: Build diagrams
+        run: tools/build_diagrams.sh
       - name: Build API documentation
         run: tools/build_docs.sh
       - name: Upload API documentation
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: api-documentation
           path: target/luals-doc/
           if-no-files-found: error
-
-  ## This is a separate job because it requires running apt-get which takes > 40s.
-  ## When the other job also uses apt-get this can be moved back.
-  plantuml:
-    strategy:
-      fail-fast: true
-    concurrency:
-      group: ${{ github.workflow }}-${{ github.ref }}
-      cancel-in-progress: true
-    name: "Build Plantuml diagrams"
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 1
-      - name: Install Plantuml
-        run: |
-          sudo apt-get update -y
-          sudo apt-get install -y plantuml
-      - name: Build diagrams
-        run: tools/build_diagrams.sh

.github/workflows/publish-api-doc.yml

@@ -4,37 +4,43 @@ on:
   push:
     branches:
       - main
+  pull_request:
 
 jobs:
   build:
+    permissions:
+      contents: read
     runs-on: ubuntu-latest
     concurrency:
       group: ${{ github.workflow }}-${{ github.ref }}
       cancel-in-progress: true
     steps:
       - name: Checkout the repository
-        uses: actions/checkout@v4
-
-      - name: Install Lua
-        uses: leafo/gh-actions-lua@v10
-        with:
-          luaVersion: 5.4
-
-      - name: Install LuaRocks
-        uses: leafo/gh-actions-luarocks@v4
+        uses: actions/checkout@v7
         with:
-          luaRocksVersion: "3.11.1"
-
+          persist-credentials: false
+      - name: Install Lua and LuaRocks
+        run: sudo apt-get install lua5.4 liblua5.4-dev luarocks
       - name: Generate API documentation
         run: |
           ./tools/build_docs.sh
-
-      - name: Deploy
-        uses: JamesIves/github-pages-deploy-action@v4
+      - name: Upload artifact
+        uses: actions/upload-pages-artifact@v5
         with:
-          branch: gh-pages
-          folder: target/luals-doc
-          target-folder: api
-          clean: true
-          single-commit: true
-          force: true
+          path: ./target/luals-doc
+
+  deploy:
+    if: ${{ github.ref == 'refs/heads/main' }}
+    permissions:
+      contents: read
+      id-token: write
+      pages: write
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    runs-on: ubuntu-latest
+    needs: build
+    steps:
+      - name: Deploy to GitHub Pages
+        id: deployment
+        uses: actions/deploy-pages@v5

.github/zizmor.yml

@@ -0,0 +1,17 @@
+# See https://docs.zizmor.sh/configuration/#settings
+rules:
+  unpinned-uses:
+    config:
+      policies:
+        "actions/*": ref-pin
+        "exasol/python-toolbox/.github/actions/security-issues": ref-pin
+        "*": hash-pin
+  cache-poisoning:
+    ignore:
+      # Enabling caching is OK for non-release workflows
+      - ci-build.yml
+      - ci-build-native-build.yml
+      - ci-build-db-version-matrix.yml
+      - project-keeper-verify.yml
+      - test_on_windows.yml
+      - test_linux_build_on_windows.yml

.gitignore

@@ -12,3 +12,4 @@ Scripts
 .idea/workspace.xml
 .idea/misc.xml
 virtual-schema-common-lua-*.src.rock
+/.idea/

SECURITY.md

@@ -0,0 +1,26 @@
+# Security
+
+If you believe you have found a new security vulnerability in this repository, please report it to us as follows.
+
+## Reporting Security Issues
+
+* Please do **not** report security vulnerabilities through public GitHub issues.
+
+* Please create a draft security advisory on the Github page: the reporting form is under `> Security > Advisories`. The URL is https://github.com/exasol/virtual-schema-common-lua/security/advisories/new.
+
+* If you prefer to email, please send your report to `infosec@exasol.com`.
+
+## Guidelines 
+
+* When reporting a vulnerability, please include as much information as possible, including the complete steps to reproduce the issue. 
+
+* Avoid sending us executables.
+
+* Feel free to include any script you wrote and used but avoid sending us scripts that download and run binaries. 
+
+* We will prioritise reports that show how the exploits work in realistic environments. 
+
+* We prefer all communications to be in English. 
+
+* We do not offer financial rewards. We are happy to acknowledge your research publicly when possible. 
+

doc/changes/changelog.md

@@ -1,5 +1,6 @@
 # Changes
 
+* [5.0.1](changes_5.0.1.md)
 * [5.0.0](changes_5.0.0.md)
 * [4.0.1](changes_4.0.1.md)
 * [4.0.0](changes_4.0.0.md)

doc/changes/changes_5.0.1.md

@@ -0,0 +1,13 @@
+# virtual-schema-common-lua 5.0.1, released 2026-08-12
+
+Code name: Update LuaRocks dependencies
+
+## Summary
+
+This release updates the LuaRocks dependencies used for JSON handling, testing and code coverage.
+
+## Dependency Updates
+
+* `lua-cjson` 2.1.0.10
+* `busted` 2.3.0
+* `luacov` 0.17.0

virtual-schema-common-lua-5.0.0-1.rockspec → virtual-schema-common-lua-5.0.1-1.rockspec

@@ -1,7 +1,7 @@
 ---@diagnostic disable: lowercase-global
 rockspec_format = "3.0"
 
-local tag = "5.0.0"
+local tag = "5.0.1"
 
 package = "virtual-schema-common-lua"
 version = tag .. "-1"
@@ -30,9 +30,9 @@ dependencies = {
 }
 
 test_dependencies = {
-    "busted >= 2.2.0",
+    "busted >= 2.3.0",
     "luacheck >= 1.2.0",
-    "luacov >= 0.15.0",
+    "luacov >= 0.17.0",
     "luacov-coveralls >= 0.2.3"
 }
 -- LuaFormatter on