chore: harden repo for public release

.eslintrc.json

@@ -12,5 +12,19 @@
     "plugin:import/electron",
     "plugin:import/typescript"
   ],
-  "parser": "@typescript-eslint/parser"
+  "parser": "@typescript-eslint/parser",
+  "overrides": [
+    {
+      "files": ["**/*.test.ts", "**/*.test.tsx", "vitest.setup.ts"],
+      "rules": {
+        "@typescript-eslint/no-empty-function": "off"
+      }
+    },
+    {
+      "files": ["*.config.ts", "*.config.mts", "*.config.cts"],
+      "rules": {
+        "import/no-unresolved": "off"
+      }
+    }
+  ]
 }

.github/dependabot.yml

@@ -0,0 +1,18 @@
+version: 2
+updates:
+  - package-ecosystem: npm
+    directory: "/"
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 10
+    groups:
+      # Batch routine dev/prod bumps into one PR to cut noise.
+      minor-and-patch:
+        update-types:
+          - minor
+          - patch
+
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: weekly

.github/workflows/ci.yml

@@ -6,17 +6,20 @@ on:
       - main
       - develop
 
+permissions:
+  contents: read
+
 jobs:
   check:
     name: Lint & Test
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
 
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
-          node-version: 20
+          node-version: 22
           cache: npm
 
       - name: Install dependencies

.github/workflows/release.yml

@@ -18,14 +18,14 @@ jobs:
     name: Generate changelog
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
           # Full history + tags are required for conventional-changelog.
           fetch-depth: 0
           # Check out the branch (not the detached tag) so we can commit CHANGELOG.md back.
           ref: develop
 
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: 22
           cache: npm
@@ -57,7 +57,7 @@ jobs:
         run: cp RELEASE_NOTES.md release_body.md
 
       - name: Create / update GitHub Release
-        uses: softprops/action-gh-release@v3
+        uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3
         with:
           tag_name: ${{ github.event.inputs.tag || github.ref_name }}
           body_path: release_body.md
@@ -85,11 +85,11 @@ jobs:
     runs-on: ${{ matrix.os }}
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
 
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
-          node-version: 20
+          node-version: 22
           cache: npm
 
       - name: Install Linux build dependencies
@@ -103,7 +103,7 @@ jobs:
 
       - name: Import signing certificate (macOS)
         if: matrix.os == 'macos-latest'
-        uses: apple-actions/import-codesign-certs@v7
+        uses: apple-actions/import-codesign-certs@5142e029c445c10ffc7149d172e540235a065466 # v7
         with:
           p12-file-base64: ${{ secrets.MACOS_CERTIFICATE }}
           p12-password: ${{ secrets.MACOS_CERTIFICATE_PASSWORD }}
@@ -132,7 +132,7 @@ jobs:
         run: rm -f "$RUNNER_TEMP/apple_api_key.p8"
 
       - name: Upload to GitHub Release
-        uses: softprops/action-gh-release@v3
+        uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3
         with:
           tag_name: ${{ github.event.inputs.tag || github.ref_name }}
           fail_on_unmatched_files: true

SECURITY.md

@@ -0,0 +1,40 @@
+# Security Policy
+
+## Supported versions
+
+s3Manager is distributed as a desktop application. Only the latest released
+version receives security fixes. Please make sure you are on the most recent
+release before reporting an issue.
+
+## Reporting a vulnerability
+
+**Please do not report security vulnerabilities through public GitHub issues.**
+
+Instead, use GitHub's private vulnerability reporting:
+
+1. Go to the [**Security** tab](https://github.com/NoiXdev/s3Manager/security/advisories) of this repository.
+2. Click **Report a vulnerability** and fill in the details.
+
+If you are unable to use private reporting, you may email the maintainer at
+**ich@dginx.de** instead.
+
+Please include, where possible:
+
+- A description of the vulnerability and its impact.
+- Steps to reproduce or a proof of concept.
+- The affected version and your operating system.
+
+## What to expect
+
+- We aim to acknowledge new reports within **5 business days**.
+- We will keep you informed as we investigate and work on a fix.
+- Once a fix is released, we are happy to credit you in the release notes
+  unless you prefer to remain anonymous.
+
+## Scope
+
+s3Manager stores S3 access keys in the operating-system keychain (via Electron
+`safeStorage`) and all other data in a local SQLite database; it does not
+transmit data to any first-party server. Reports concerning credential
+handling, IPC boundaries between the main and renderer processes, presigned-URL
+generation, or the auto-update/release pipeline are especially welcome.

package.json

@@ -2,7 +2,7 @@
   "name": "s3manager",
   "productName": "s3manager",
   "version": "1.0.0",
-  "description": "My Electron application description",
+  "description": "A cross-platform desktop app for managing S3-compatible object storage.",
   "main": ".vite/build/main.js",
   "private": true,
   "repository": {
@@ -32,6 +32,9 @@
     "email": "ich@dginx.de"
   },
   "license": "MIT",
+  "engines": {
+    "node": ">=22"
+  },
   "devDependencies": {
     "@electron-forge/cli": "^7.11.2",
     "@electron-forge/maker-deb": "^7.11.2",

src/renderer/components/ui/ToastProvider.tsx

@@ -10,6 +10,7 @@ interface ToastApi {
   show: (message: string, kind?: ToastKind) => void;
 }
 
+// eslint-disable-next-line @typescript-eslint/no-empty-function -- no-op default; a real provider always overrides this
 const ToastContext = createContext<ToastApi>({ show: () => {} });
 
 export function useToast(): ToastApi {