- Remove CodeQL job: this repo has no JS/TS or Rust source code,
so CodeQL exits with error 32 ('no source code seen during build')
on every run. CodeQL belongs on nixpanel-website/nixpanel-licensing.
- cargo-audit: skip Rust toolchain install entirely when no Cargo.toml
present (saves ~3 min of wasted CI time); use step output condition
- ShellCheck: severity error->only fails on real errors, not style
warnings; pin to ludeeus/[email protected] (not @master)
- Rename workflow to 'Security Audit' (CodeQL is no longer included)
- CodeQL: scans JS/TS with security-extended + security-and-quality queries
- cargo-audit: scans Rust dependencies for known CVEs (--deny warnings)
- ShellCheck: lints install.sh and all shell scripts for bugs/vulnerabilities
- Runs on push to master, PRs, and weekly on Mondays at 08:00 UTC
- README: add shields.io badges, fix stack (Rust, not Node.js),
add licensing plan table, improve structure throughout
- CHANGELOG: proper Keep a Changelog format, document v0.1.0-alpha
- LICENSE: expand source-available terms with clearer restrictions
- install.sh: strip licensing/website-api build steps (those run on
nixpanel.io/license.nixpanel.io, not on customer servers); add
license key prompt + activation against license.nixpanel.io; keep
only the panel DB; fix Apache to only expose ports 2083/2087
On Ubuntu 24.04, PHP 8.2 is not in the default apt repos.
The ondrej/php PPA must be added before package installation.
Previously this was a separate step that could be bypassed when
running a locally-cached (pre-fix) copy of install.sh.
Changes:
- Add self-update block: script fetches latest version from GitHub
and re-execs itself, so stale local copies are never used
- Remove standalone php_ppa step; PPA is now added unconditionally
inside the packages step (checks if already present to avoid
duplicate adds on re-runs)
- Idempotent: grep checks sources.list before calling
add-apt-repository
NixReaper