From 5985c44359d214d2408b92bf1ab69b3bc07c43ed Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Mon, 10 Nov 2025 15:01:44 +0000
Subject: [PATCH 1/6] Add comprehensive GitHub Actions workflows for build,
 security, and quality checks

Co-authored-by: Mika3578 <58137747+Mika3578@users.noreply.github.com>
---
 .github/workflows/README.md             | 213 ++++++++++++++++++++++++
 .github/workflows/build.yml             |  65 ++++++++
 .github/workflows/code-quality.yml      |  96 +++++++++++
 .github/workflows/codeql.yml            |  69 ++++++++
 .github/workflows/dependency-review.yml |  25 +++
 .github/workflows/security-scan.yml     |  87 ++++++++++
 .gitignore                              |   6 +-
 7 files changed, 560 insertions(+), 1 deletion(-)
 create mode 100644 .github/workflows/README.md
 create mode 100644 .github/workflows/build.yml
 create mode 100644 .github/workflows/code-quality.yml
 create mode 100644 .github/workflows/codeql.yml
 create mode 100644 .github/workflows/dependency-review.yml
 create mode 100644 .github/workflows/security-scan.yml

diff --git a/.github/workflows/README.md b/.github/workflows/README.md
new file mode 100644
index 00000000..0a8883d2
--- /dev/null
+++ b/.github/workflows/README.md
@@ -0,0 +1,213 @@
+# GitHub Actions Workflows
+
+This directory contains GitHub Actions workflows for automated building, testing, and security scanning of the eMule MorphXT project.
+
+## Workflows
+
+### 🔨 Build (`build.yml`)
+**Triggers:** Push to main/master/develop, Pull Requests, Manual dispatch
+
+Builds the eMule project using MSBuild on Windows runners.
+
+**Features:**
+- Builds both Debug and Release configurations
+- Supports Win32 platform
+- Automatically checks out and initializes git submodules
+- Uploads Release build artifacts (executables, DLLs, PDBs)
+- Provides build summary with file sizes
+
+**Matrix Strategy:**
+- Configuration: `Release`, `Debug`
+- Platform: `Win32`
+
+### 🔒 CodeQL Security Scan (`codeql.yml`)
+**Triggers:** Push to main/master/develop, Pull Requests, Weekly schedule (Mondays), Manual dispatch
+
+Performs deep security analysis on C++ code using GitHub's CodeQL.
+
+**Features:**
+- Analyzes C++ code for security vulnerabilities
+- Uses extended security queries
+- Excludes test and build directories
+- Results appear in the Security tab
+- Builds the project to ensure comprehensive analysis
+
+**Configuration:**
+- Language: C++
+- Queries: Security Extended + Security and Quality
+- Schedule: Weekly on Mondays at midnight UTC
+
+### 📦 Dependency Review (`dependency-review.yml`)
+**Triggers:** Pull Requests only
+
+Reviews dependencies for known security vulnerabilities.
+
+**Features:**
+- Scans for vulnerable dependencies
+- Fails on moderate severity or higher
+- Posts summary comments on pull requests
+- Checks all git submodules
+
+**Configuration:**
+- Severity threshold: Moderate
+- Includes submodule dependencies
+
+### ✅ Code Quality Check (`code-quality.yml`)
+**Triggers:** Push to main/master/develop, Pull Requests, Manual dispatch
+
+Performs static analysis and code quality checks.
+
+**Features:**
+- Runs Visual Studio Code Analysis with NativeRecommendedRules
+- Counts source files and generates statistics
+- Checks for TODO/FIXME/HACK comments
+- Detects hardcoded paths
+- Validates git submodule configuration
+- Posts detailed summary to workflow run
+
+**Analysis Includes:**
+- Static code analysis
+- Code metrics and statistics
+- Common code smell detection
+- Submodule health check
+
+### 🛡️ Security Scan (`security-scan.yml`)
+**Triggers:** Push to main/master/develop, Pull Requests, Weekly schedule (Sundays), Manual dispatch
+
+Comprehensive security vulnerability scanning using Trivy.
+
+**Features:**
+- Filesystem-based security scanning
+- Detects vulnerabilities in dependencies
+- Uploads results to GitHub Security tab
+- License compliance check
+- Lists all project dependencies
+
+**Configuration:**
+- Scanner: Trivy
+- Severity levels: Critical, High, Medium
+- Schedule: Weekly on Sundays at midnight UTC
+- Includes license file detection
+
+## Dependencies
+
+The project uses the following git submodules as dependencies:
+
+- **cryptopp** - Crypto++ cryptographic library
+- **zlib** - Data compression library
+- **libpng** - PNG image library
+- **id3lib** - ID3 tag manipulation library
+- **pupnp** - Portable UPnP library
+- **pthreads** - POSIX threads implementation for Windows
+
+All workflows automatically initialize and update these submodules.
+
+## Build Requirements
+
+### Windows Build Environment
+- Windows Server (latest)
+- MSBuild (via microsoft/setup-msbuild)
+- Visual Studio Developer Command Prompt
+- NuGet package manager
+- Platform Toolset: v142 (Visual Studio 2019+)
+
+### Configuration Options
+- **Debug**: Development build with debugging symbols
+- **Release**: Optimized production build
+- **Beta**: Pre-release build configuration
+
+## Workflow Permissions
+
+Workflows require the following permissions:
+
+- **actions**: read - To access workflow artifacts
+- **contents**: read - To checkout repository code
+- **security-events**: write - To upload security scan results
+- **pull-requests**: write - To post PR comments (dependency review)
+
+## Viewing Results
+
+### Build Artifacts
+Build artifacts (executables, DLLs, debug symbols) are available:
+1. Navigate to the Actions tab
+2. Select the Build workflow run
+3. Download artifacts from the Artifacts section
+
+### Security Scan Results
+Security vulnerabilities are reported in:
+1. **Security Tab** → Code scanning alerts
+2. Workflow run summaries
+3. Pull request comments (for dependency issues)
+
+### Code Quality Reports
+Code quality metrics appear in:
+1. Workflow run summaries
+2. Job step outputs
+3. Build logs
+
+## Customization
+
+### Adjusting Build Configuration
+
+To modify build settings, edit `build.yml`:
+```yaml
+matrix:
+  configuration: [Release, Debug, Beta]  # Add or remove configurations
+  platform: [Win32, x64]                  # Add x64 if needed
+```
+
+### Changing Scan Schedules
+
+To adjust security scan frequency, modify the cron expressions:
+```yaml
+schedule:
+  - cron: '0 0 * * 1'  # Change day/time as needed
+```
+
+### Security Severity Levels
+
+To adjust security thresholds, edit the respective workflow:
+```yaml
+severity: 'CRITICAL,HIGH,MEDIUM,LOW'  # Add/remove levels
+fail-on-severity: moderate             # Change threshold
+```
+
+## Troubleshooting
+
+### Build Failures
+1. Check that all submodules are properly initialized
+2. Verify Visual Studio platform toolset version
+3. Review MSBuild error messages in workflow logs
+
+### CodeQL Timeout
+If CodeQL analysis times out:
+1. Increase timeout in workflow (default: 360 minutes)
+2. Reduce code analysis scope if needed
+
+### Missing Dependencies
+If builds fail due to missing dependencies:
+1. Ensure submodules are properly configured in `.gitmodules`
+2. Verify NuGet packages are restored correctly
+
+## Manual Workflow Execution
+
+All workflows support manual dispatch via the GitHub Actions UI:
+1. Go to Actions tab
+2. Select the desired workflow
+3. Click "Run workflow"
+4. Choose branch and click "Run workflow"
+
+## Contributing
+
+When adding new workflow files:
+1. Validate YAML syntax before committing
+2. Test workflows on a feature branch first
+3. Document any new configurations in this README
+4. Follow existing naming conventions
+
+## Additional Resources
+
+- [GitHub Actions Documentation](https://docs.github.com/en/actions)
+- [MSBuild Reference](https://docs.microsoft.com/en-us/visualstudio/msbuild/)
+- [CodeQL Documentation](https://codeql.github.com/docs/)
+- [Trivy Documentation](https://aquasecurity.github.io/trivy/)
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
new file mode 100644
index 00000000..ac30c33e
--- /dev/null
+++ b/.github/workflows/build.yml
@@ -0,0 +1,65 @@
+name: Build
+
+on:
+  push:
+    branches: [ main, master, develop ]
+  pull_request:
+    branches: [ main, master, develop ]
+  workflow_dispatch:
+
+jobs:
+  build:
+    runs-on: windows-latest
+    
+    strategy:
+      fail-fast: false
+      matrix:
+        configuration: [Release, Debug]
+        platform: [Win32]
+    
+    steps:
+    - name: Checkout code
+      uses: actions/checkout@v4
+      with:
+        submodules: recursive
+        fetch-depth: 0
+    
+    - name: Add MSBuild to PATH
+      uses: microsoft/setup-msbuild@v2
+      with:
+        msbuild-architecture: x86
+    
+    - name: Setup Visual Studio Developer Environment
+      uses: ilammy/msvc-dev-cmd@v1
+      with:
+        arch: x86
+    
+    - name: Restore NuGet packages
+      working-directory: ${{github.workspace}}/srchybrid
+      run: nuget restore emule.sln
+    
+    - name: Build Solution
+      working-directory: ${{github.workspace}}/srchybrid
+      run: msbuild /m /p:Configuration=${{matrix.configuration}} /p:Platform=${{matrix.platform}} emule.sln
+    
+    - name: Upload Build Artifacts
+      if: matrix.configuration == 'Release'
+      uses: actions/upload-artifact@v4
+      with:
+        name: emule-${{matrix.platform}}-${{matrix.configuration}}
+        path: |
+          srchybrid/${{matrix.configuration}}/*.exe
+          srchybrid/${{matrix.configuration}}/*.dll
+          srchybrid/${{matrix.configuration}}/*.pdb
+        retention-days: 30
+    
+    - name: Build Summary
+      if: always()
+      run: |
+        echo "### Build Complete :rocket:" >> $env:GITHUB_STEP_SUMMARY
+        echo "Configuration: ${{matrix.configuration}}" >> $env:GITHUB_STEP_SUMMARY
+        echo "Platform: ${{matrix.platform}}" >> $env:GITHUB_STEP_SUMMARY
+        if (Test-Path "srchybrid/${{matrix.configuration}}/emule.exe") {
+          $fileInfo = Get-Item "srchybrid/${{matrix.configuration}}/emule.exe"
+          echo "Executable Size: $($fileInfo.Length / 1MB) MB" >> $env:GITHUB_STEP_SUMMARY
+        }
diff --git a/.github/workflows/code-quality.yml b/.github/workflows/code-quality.yml
new file mode 100644
index 00000000..0d8cdfdf
--- /dev/null
+++ b/.github/workflows/code-quality.yml
@@ -0,0 +1,96 @@
+name: "Code Quality Check"
+
+on:
+  push:
+    branches: [ main, master, develop ]
+  pull_request:
+    branches: [ main, master, develop ]
+  workflow_dispatch:
+
+jobs:
+  code-quality:
+    name: Code Quality Analysis
+    runs-on: windows-latest
+    
+    steps:
+    - name: Checkout code
+      uses: actions/checkout@v4
+      with:
+        submodules: recursive
+        fetch-depth: 0
+    
+    - name: Add MSBuild to PATH
+      uses: microsoft/setup-msbuild@v2
+      with:
+        msbuild-architecture: x86
+    
+    - name: Setup Visual Studio Developer Environment
+      uses: ilammy/msvc-dev-cmd@v1
+      with:
+        arch: x86
+    
+    - name: Restore NuGet packages
+      working-directory: ${{github.workspace}}/srchybrid
+      run: nuget restore emule.sln
+    
+    - name: Build with Code Analysis
+      working-directory: ${{github.workspace}}/srchybrid
+      run: |
+        msbuild /m /p:Configuration=Release /p:Platform=Win32 /p:RunCodeAnalysis=true /p:CodeAnalysisRuleSet=NativeRecommendedRules.ruleset emule.sln
+      continue-on-error: true
+    
+    - name: Count Source Files
+      run: |
+        echo "### Code Statistics :bar_chart:" >> $env:GITHUB_STEP_SUMMARY
+        $cppFiles = (Get-ChildItem -Path srchybrid -Recurse -Include *.cpp -File).Count
+        $hFiles = (Get-ChildItem -Path srchybrid -Recurse -Include *.h -File).Count
+        echo "C++ Source Files (.cpp): $cppFiles" >> $env:GITHUB_STEP_SUMMARY
+        echo "Header Files (.h): $hFiles" >> $env:GITHUB_STEP_SUMMARY
+        echo "Total Files: $($cppFiles + $hFiles)" >> $env:GITHUB_STEP_SUMMARY
+    
+    - name: Check for Common Issues
+      run: |
+        echo "### Code Quality Checks :mag:" >> $env:GITHUB_STEP_SUMMARY
+        
+        # Check for TODO comments
+        $todos = Select-String -Path srchybrid\*.cpp,srchybrid\*.h -Pattern "TODO|FIXME|HACK" -Recurse -ErrorAction SilentlyContinue
+        if ($todos) {
+          $todoCount = ($todos | Measure-Object).Count
+          echo "Found $todoCount TODO/FIXME/HACK comments" >> $env:GITHUB_STEP_SUMMARY
+        } else {
+          echo "No TODO/FIXME/HACK comments found" >> $env:GITHUB_STEP_SUMMARY
+        }
+        
+        # Check for hardcoded paths
+        $hardcodedPaths = Select-String -Path srchybrid\*.cpp -Pattern "C:\\\\|D:\\\\" -Recurse -ErrorAction SilentlyContinue
+        if ($hardcodedPaths) {
+          $pathCount = ($hardcodedPaths | Measure-Object).Count
+          echo ":warning: Found $pathCount potential hardcoded paths" >> $env:GITHUB_STEP_SUMMARY
+        }
+        
+        echo "" >> $env:GITHUB_STEP_SUMMARY
+        echo "Code quality check completed" >> $env:GITHUB_STEP_SUMMARY
+    
+  submodule-check:
+    name: Submodule Security Check
+    runs-on: ubuntu-latest
+    
+    steps:
+    - name: Checkout code
+      uses: actions/checkout@v4
+      with:
+        submodules: recursive
+    
+    - name: Check Submodule Status
+      run: |
+        echo "### Git Submodules Status :link:" >> $GITHUB_STEP_SUMMARY
+        git submodule status >> $GITHUB_STEP_SUMMARY
+        
+        echo "" >> $GITHUB_STEP_SUMMARY
+        echo "### Submodule Details" >> $GITHUB_STEP_SUMMARY
+        git config --file .gitmodules --get-regexp path | while read key value; do
+          name=$(echo $key | sed 's/^submodule\.\(.*\)\.path$/\1/')
+          url=$(git config --file .gitmodules --get "submodule.$name.url")
+          branch=$(git config --file .gitmodules --get "submodule.$name.branch" || echo "N/A")
+          echo "- **$name**: $url (branch: $branch)" >> $GITHUB_STEP_SUMMARY
+        done
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
new file mode 100644
index 00000000..c2429818
--- /dev/null
+++ b/.github/workflows/codeql.yml
@@ -0,0 +1,69 @@
+name: "CodeQL Security Scan"
+
+on:
+  push:
+    branches: [ main, master, develop ]
+  pull_request:
+    branches: [ main, master, develop ]
+  schedule:
+    - cron: '0 0 * * 1'  # Weekly on Mondays
+  workflow_dispatch:
+
+jobs:
+  analyze:
+    name: Analyze C++ Code
+    runs-on: windows-latest
+    timeout-minutes: 360
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+    
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [ 'cpp' ]
+    
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+      with:
+        submodules: recursive
+        fetch-depth: 0
+    
+    - name: Initialize CodeQL
+      uses: github/codeql-action/init@v3
+      with:
+        languages: ${{ matrix.language }}
+        queries: +security-extended,security-and-quality
+        config: |
+          paths-ignore:
+            - '**/test/**'
+            - '**/tests/**'
+            - '**/build/**'
+            - '**/Debug/**'
+            - '**/Release/**'
+    
+    - name: Add MSBuild to PATH
+      uses: microsoft/setup-msbuild@v2
+      with:
+        msbuild-architecture: x86
+    
+    - name: Setup Visual Studio Developer Environment
+      uses: ilammy/msvc-dev-cmd@v1
+      with:
+        arch: x86
+    
+    - name: Restore NuGet packages
+      working-directory: ${{github.workspace}}/srchybrid
+      run: nuget restore emule.sln
+    
+    - name: Build for CodeQL Analysis
+      working-directory: ${{github.workspace}}/srchybrid
+      run: msbuild /m /p:Configuration=Release /p:Platform=Win32 emule.sln
+    
+    - name: Perform CodeQL Analysis
+      uses: github/codeql-action/analyze@v3
+      with:
+        category: "/language:${{matrix.language}}"
+        upload: true
diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml
new file mode 100644
index 00000000..1897455b
--- /dev/null
+++ b/.github/workflows/dependency-review.yml
@@ -0,0 +1,25 @@
+name: "Dependency Review"
+
+on:
+  pull_request:
+    branches: [ main, master, develop ]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  pull-requests: write
+
+jobs:
+  dependency-review:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout Repository
+        uses: actions/checkout@v4
+        with:
+          submodules: recursive
+      
+      - name: Dependency Review
+        uses: actions/dependency-review-action@v4
+        with:
+          fail-on-severity: moderate
+          comment-summary-in-pr: true
diff --git a/.github/workflows/security-scan.yml b/.github/workflows/security-scan.yml
new file mode 100644
index 00000000..96bcc945
--- /dev/null
+++ b/.github/workflows/security-scan.yml
@@ -0,0 +1,87 @@
+name: "Security Scan"
+
+on:
+  push:
+    branches: [ main, master, develop ]
+  pull_request:
+    branches: [ main, master, develop ]
+  schedule:
+    - cron: '0 0 * * 0'  # Weekly on Sundays
+  workflow_dispatch:
+
+jobs:
+  security-scan:
+    name: Security Vulnerability Scan
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      security-events: write
+    
+    steps:
+    - name: Checkout code
+      uses: actions/checkout@v4
+      with:
+        submodules: recursive
+        fetch-depth: 0
+    
+    - name: Run Trivy vulnerability scanner
+      uses: aquasecurity/trivy-action@master
+      with:
+        scan-type: 'fs'
+        scan-ref: '.'
+        format: 'sarif'
+        output: 'trivy-results.sarif'
+        severity: 'CRITICAL,HIGH,MEDIUM'
+        exit-code: '0'
+    
+    - name: Upload Trivy results to GitHub Security tab
+      uses: github/codeql-action/upload-sarif@v3
+      if: always()
+      with:
+        sarif_file: 'trivy-results.sarif'
+    
+    - name: Generate Security Report
+      run: |
+        echo "### Security Scan Results :shield:" >> $GITHUB_STEP_SUMMARY
+        echo "" >> $GITHUB_STEP_SUMMARY
+        echo "Trivy scan completed. Check the Security tab for detailed results." >> $GITHUB_STEP_SUMMARY
+        echo "" >> $GITHUB_STEP_SUMMARY
+        
+        # List all C/C++ dependencies
+        echo "### Project Dependencies" >> $GITHUB_STEP_SUMMARY
+        echo "- cryptopp (Crypto++ library)" >> $GITHUB_STEP_SUMMARY
+        echo "- zlib (compression library)" >> $GITHUB_STEP_SUMMARY
+        echo "- libpng (PNG image library)" >> $GITHUB_STEP_SUMMARY
+        echo "- id3lib (ID3 tag library)" >> $GITHUB_STEP_SUMMARY
+        echo "- pupnp (Portable UPnP library)" >> $GITHUB_STEP_SUMMARY
+        echo "- pthreads (POSIX threads for Windows)" >> $GITHUB_STEP_SUMMARY
+  
+  license-check:
+    name: License Compliance Check
+    runs-on: ubuntu-latest
+    
+    steps:
+    - name: Checkout code
+      uses: actions/checkout@v4
+      with:
+        submodules: recursive
+    
+    - name: Check License Files
+      run: |
+        echo "### License Compliance :page_facing_up:" >> $GITHUB_STEP_SUMMARY
+        echo "" >> $GITHUB_STEP_SUMMARY
+        
+        # Find all license files
+        LICENSE_FILES=$(find . -iname "license*" -o -iname "copying*" -o -iname "licence*" | grep -v ".git" | head -20)
+        
+        if [ -n "$LICENSE_FILES" ]; then
+          echo "Found the following license files:" >> $GITHUB_STEP_SUMMARY
+          echo '```' >> $GITHUB_STEP_SUMMARY
+          echo "$LICENSE_FILES" >> $GITHUB_STEP_SUMMARY
+          echo '```' >> $GITHUB_STEP_SUMMARY
+        else
+          echo ":warning: No license files found in the repository" >> $GITHUB_STEP_SUMMARY
+        fi
+        
+        echo "" >> $GITHUB_STEP_SUMMARY
+        echo "**Note**: Please ensure all dependencies comply with your project's license." >> $GITHUB_STEP_SUMMARY
diff --git a/.gitignore b/.gitignore
index 4a8270a9..6667484d 100644
--- a/.gitignore
+++ b/.gitignore
@@ -3,4 +3,8 @@
 **/*Release*/*
 srchybrid/build/*
 *.user
-IUpnp*.txt
\ No newline at end of file
+IUpnp*.txt
+
+# GitHub Actions artifacts
+*.sarif
+trivy-results.sarif
\ No newline at end of file

From 262f2170e1b5499be8609a58862dd76a3c48bced Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Mon, 10 Nov 2025 15:03:08 +0000
Subject: [PATCH 2/6] Add comprehensive workflow documentation (WORKFLOWS.md)

Co-authored-by: Mika3578 <58137747+Mika3578@users.noreply.github.com>
---
 WORKFLOWS.md | 181 +++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 181 insertions(+)
 create mode 100644 WORKFLOWS.md

diff --git a/WORKFLOWS.md b/WORKFLOWS.md
new file mode 100644
index 00000000..aaf67d2c
--- /dev/null
+++ b/WORKFLOWS.md
@@ -0,0 +1,181 @@
+# CI/CD and Security Workflows
+
+This repository now includes comprehensive GitHub Actions workflows for automated building, testing, and security scanning.
+
+## Overview
+
+Five workflows have been added to ensure code quality, security, and reliable builds:
+
+| Workflow | Purpose | Trigger |
+|----------|---------|---------|
+| **Build** | Compile project for Debug/Release | Push, PR, Manual |
+| **CodeQL** | Deep security code analysis | Push, PR, Weekly, Manual |
+| **Dependency Review** | Check dependencies for vulnerabilities | PR only |
+| **Code Quality** | Static analysis & metrics | Push, PR, Manual |
+| **Security Scan** | Trivy vulnerability scanning | Push, PR, Weekly, Manual |
+
+## Quick Start
+
+### Viewing Workflow Status
+
+1. Navigate to the **Actions** tab in the GitHub repository
+2. Select a workflow to see its runs and results
+3. Click on a specific run to view detailed logs
+
+### Downloading Build Artifacts
+
+After a successful build:
+1. Go to **Actions** → **Build** workflow
+2. Select a completed workflow run
+3. Scroll to **Artifacts** section
+4. Download `emule-Win32-Release` (or Debug)
+
+### Security Alerts
+
+Security issues are reported in:
+- **Security** tab → **Code scanning alerts**
+- Workflow run summaries
+- Pull request comments
+
+## Workflows in Detail
+
+### 🔨 Build Workflow
+- **File**: `.github/workflows/build.yml`
+- **Runs on**: Windows latest
+- **Configurations**: Debug, Release
+- **Platform**: Win32
+- **Output**: Executable, DLLs, PDB files
+
+The build workflow:
+1. Checks out code with all submodules
+2. Sets up MSBuild and Visual Studio environment
+3. Restores NuGet packages
+4. Builds the solution
+5. Uploads artifacts for Release builds
+
+### 🔒 CodeQL Security Scan
+- **File**: `.github/workflows/codeql.yml`
+- **Runs on**: Windows latest
+- **Language**: C++
+- **Schedule**: Weekly (Mondays at 00:00 UTC)
+
+CodeQL performs deep static analysis to find:
+- Security vulnerabilities
+- Memory safety issues
+- Common coding errors
+- Best practice violations
+
+### 📦 Dependency Review
+- **File**: `.github/workflows/dependency-review.yml`
+- **Runs on**: Ubuntu latest
+- **Trigger**: Pull requests only
+- **Severity**: Fails on moderate or higher
+
+Checks all dependencies (including submodules) for known vulnerabilities.
+
+### ✅ Code Quality Check
+- **File**: `.github/workflows/code-quality.yml`
+- **Runs on**: Windows latest
+
+Performs:
+- Visual Studio Code Analysis
+- Source code metrics
+- TODO/FIXME detection
+- Hardcoded path detection
+- Submodule health check
+
+### 🛡️ Security Scan
+- **File**: `.github/workflows/security-scan.yml`
+- **Runs on**: Ubuntu latest
+- **Schedule**: Weekly (Sundays at 00:00 UTC)
+
+Uses Trivy to scan for:
+- Dependency vulnerabilities
+- Configuration issues
+- License compliance
+
+## Manual Workflow Execution
+
+To manually trigger a workflow:
+
+1. Go to **Actions** tab
+2. Select the workflow from the left sidebar
+3. Click **Run workflow** button
+4. Select the branch
+5. Click **Run workflow**
+
+## Build Requirements
+
+The project requires:
+- Windows environment
+- Visual Studio 2019 or later (Platform Toolset v142)
+- MSBuild
+- Git with submodule support
+
+All dependencies are managed via git submodules:
+- cryptopp (Crypto++)
+- zlib
+- libpng
+- id3lib
+- pupnp
+- pthreads
+
+## Configuration
+
+### Branch Protection
+
+Consider enabling these branch protection rules:
+- Require status checks to pass before merging
+- Require Build workflow to pass
+- Require CodeQL scan to pass (for main/master)
+
+### Scheduled Scans
+
+Security scans run automatically:
+- **CodeQL**: Mondays at 00:00 UTC
+- **Trivy**: Sundays at 00:00 UTC
+
+### Customization
+
+To modify workflows, edit files in `.github/workflows/`:
+- Adjust build configurations in `build.yml`
+- Change scan schedules in `codeql.yml` and `security-scan.yml`
+- Modify severity thresholds in `dependency-review.yml`
+
+## Troubleshooting
+
+### Build Failures
+
+Common issues:
+1. **Submodules not initialized**: Workflows automatically handle this
+2. **Missing dependencies**: Check NuGet restore step
+3. **Platform toolset**: Verify Visual Studio version compatibility
+
+### Security Scan False Positives
+
+If security scans report false positives:
+1. Review the alert in the Security tab
+2. If confirmed as false positive, dismiss with explanation
+3. Consider adding to CodeQL query filters if needed
+
+### Workflow Not Triggering
+
+Ensure:
+- Branch name matches trigger configuration (main/master/develop)
+- Workflow file is committed to the branch
+- Repository has Actions enabled in Settings
+
+## Resources
+
+For detailed documentation, see:
+- [Workflow README](.github/workflows/README.md)
+- [GitHub Actions Documentation](https://docs.github.com/en/actions)
+- [CodeQL Documentation](https://codeql.github.com/docs/)
+
+## Support
+
+For issues with workflows:
+1. Check workflow run logs in Actions tab
+2. Review this documentation
+3. Check GitHub Actions status page
+4. Open an issue if problem persists

From 03e06126d49f34acba00af5ca50cd98ca5816da6 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Mon, 10 Nov 2025 15:05:56 +0000
Subject: [PATCH 3/6] Fix security: Add explicit permissions to all workflow
 jobs

Co-authored-by: Mika3578 <58137747+Mika3578@users.noreply.github.com>
---
 .github/workflows/build.yml         | 3 +++
 .github/workflows/code-quality.yml  | 4 ++++
 .github/workflows/security-scan.yml | 2 ++
 3 files changed, 9 insertions(+)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index ac30c33e..e31425dd 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -10,6 +10,9 @@ on:
 jobs:
   build:
     runs-on: windows-latest
+    permissions:
+      contents: read
+      actions: write
     
     strategy:
       fail-fast: false
diff --git a/.github/workflows/code-quality.yml b/.github/workflows/code-quality.yml
index 0d8cdfdf..d4df6fc8 100644
--- a/.github/workflows/code-quality.yml
+++ b/.github/workflows/code-quality.yml
@@ -11,6 +11,8 @@ jobs:
   code-quality:
     name: Code Quality Analysis
     runs-on: windows-latest
+    permissions:
+      contents: read
     
     steps:
     - name: Checkout code
@@ -74,6 +76,8 @@ jobs:
   submodule-check:
     name: Submodule Security Check
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     
     steps:
     - name: Checkout code
diff --git a/.github/workflows/security-scan.yml b/.github/workflows/security-scan.yml
index 96bcc945..a625a12a 100644
--- a/.github/workflows/security-scan.yml
+++ b/.github/workflows/security-scan.yml
@@ -59,6 +59,8 @@ jobs:
   license-check:
     name: License Compliance Check
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     
     steps:
     - name: Checkout code

From b88797b2e9661bb55a726449eb8254fb69367007 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Mon, 10 Nov 2025 15:10:34 +0000
Subject: [PATCH 4/6] Configure workflows to use latest Visual Studio with
 MFC/ATL support

Co-authored-by: Mika3578 <58137747+Mika3578@users.noreply.github.com>
---
 .github/workflows/build.yml        | 17 ++++++++++++++++-
 .github/workflows/code-quality.yml |  4 +++-
 .github/workflows/codeql.yml       |  4 +++-
 3 files changed, 22 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index e31425dd..597ab1d6 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -27,15 +27,30 @@ jobs:
         submodules: recursive
         fetch-depth: 0
     
-    - name: Add MSBuild to PATH
+    - name: Setup Visual Studio with MFC/ATL
       uses: microsoft/setup-msbuild@v2
       with:
         msbuild-architecture: x86
+        vs-version: 'latest'
+    
+    - name: Install Visual Studio MFC/ATL Components
+      shell: pwsh
+      run: |
+        # Visual Studio already includes MFC/ATL in windows-latest runner
+        # Verify installation
+        $vsPath = & "C:\Program Files (x86)\Microsoft Visual Studio\Installer\vswhere.exe" -latest -property installationPath
+        Write-Host "Visual Studio Path: $vsPath"
+        Write-Host "Checking MFC/ATL availability..."
+        if (Test-Path "$vsPath\VC\Tools\MSVC") {
+          $mfcPath = Get-ChildItem "$vsPath\VC\Tools\MSVC" -Directory | Select-Object -Last 1
+          Write-Host "MFC/ATL Path: $mfcPath"
+        }
     
     - name: Setup Visual Studio Developer Environment
       uses: ilammy/msvc-dev-cmd@v1
       with:
         arch: x86
+        vsversion: 'latest'
     
     - name: Restore NuGet packages
       working-directory: ${{github.workspace}}/srchybrid
diff --git a/.github/workflows/code-quality.yml b/.github/workflows/code-quality.yml
index d4df6fc8..637ae530 100644
--- a/.github/workflows/code-quality.yml
+++ b/.github/workflows/code-quality.yml
@@ -21,15 +21,17 @@ jobs:
         submodules: recursive
         fetch-depth: 0
     
-    - name: Add MSBuild to PATH
+    - name: Setup Visual Studio with MFC/ATL
       uses: microsoft/setup-msbuild@v2
       with:
         msbuild-architecture: x86
+        vs-version: 'latest'
     
     - name: Setup Visual Studio Developer Environment
       uses: ilammy/msvc-dev-cmd@v1
       with:
         arch: x86
+        vsversion: 'latest'
     
     - name: Restore NuGet packages
       working-directory: ${{github.workspace}}/srchybrid
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index c2429818..5574bf97 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -44,15 +44,17 @@ jobs:
             - '**/Debug/**'
             - '**/Release/**'
     
-    - name: Add MSBuild to PATH
+    - name: Setup Visual Studio with MFC/ATL
       uses: microsoft/setup-msbuild@v2
       with:
         msbuild-architecture: x86
+        vs-version: 'latest'
     
     - name: Setup Visual Studio Developer Environment
       uses: ilammy/msvc-dev-cmd@v1
       with:
         arch: x86
+        vsversion: 'latest'
     
     - name: Restore NuGet packages
       working-directory: ${{github.workspace}}/srchybrid

From 3d93fc72800ea844cfb13ac5331cc3207d525614 Mon Sep 17 00:00:00 2001
From: Mika3578 <58137747+Mika3578@users.noreply.github.com>
Date: Mon, 10 Nov 2025 20:16:25 +0100
Subject: [PATCH 5/6] Update .github/workflows/security-scan.yml

Co-authored-by: sourcery-ai[bot] <58596630+sourcery-ai[bot]@users.noreply.github.com>
---
 .github/workflows/security-scan.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/security-scan.yml b/.github/workflows/security-scan.yml
index a625a12a..350e91e7 100644
--- a/.github/workflows/security-scan.yml
+++ b/.github/workflows/security-scan.yml
@@ -32,7 +32,7 @@ jobs:
         format: 'sarif'
         output: 'trivy-results.sarif'
         severity: 'CRITICAL,HIGH,MEDIUM'
-        exit-code: '0'
+        exit-code: '1'
     
     - name: Upload Trivy results to GitHub Security tab
       uses: github/codeql-action/upload-sarif@v3

From cf3ffb37fb395ab7734d3a018fa5e0219b891a16 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Mon, 10 Nov 2025 18:17:17 +0000
Subject: [PATCH 6/6] Fix MFC/ATL installation and address reviewer comments

Co-authored-by: Mika3578 <58137747+Mika3578@users.noreply.github.com>
---
 .github/workflows/build.yml         | 10 ++++++----
 .github/workflows/code-quality.yml  |  4 ++--
 .github/workflows/security-scan.yml |  2 +-
 3 files changed, 9 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 597ab1d6..761af0bc 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -36,14 +36,16 @@ jobs:
     - name: Install Visual Studio MFC/ATL Components
       shell: pwsh
       run: |
-        # Visual Studio already includes MFC/ATL in windows-latest runner
+        # Install MFC and ATL components required for building eMule
+        Write-Host "Installing Visual Studio MFC and ATL components..."
+        choco install visualstudio2022-workload-vctools --package-parameters "--add Microsoft.VisualStudio.Component.VC.ATL --add Microsoft.VisualStudio.Component.VC.ATLMFC" -y
+        
         # Verify installation
         $vsPath = & "C:\Program Files (x86)\Microsoft Visual Studio\Installer\vswhere.exe" -latest -property installationPath
         Write-Host "Visual Studio Path: $vsPath"
-        Write-Host "Checking MFC/ATL availability..."
         if (Test-Path "$vsPath\VC\Tools\MSVC") {
           $mfcPath = Get-ChildItem "$vsPath\VC\Tools\MSVC" -Directory | Select-Object -Last 1
-          Write-Host "MFC/ATL Path: $mfcPath"
+          Write-Host "MFC/ATL installed at: $mfcPath"
         }
     
     - name: Setup Visual Studio Developer Environment
@@ -79,5 +81,5 @@ jobs:
         echo "Platform: ${{matrix.platform}}" >> $env:GITHUB_STEP_SUMMARY
         if (Test-Path "srchybrid/${{matrix.configuration}}/emule.exe") {
           $fileInfo = Get-Item "srchybrid/${{matrix.configuration}}/emule.exe"
-          echo "Executable Size: $($fileInfo.Length / 1MB) MB" >> $env:GITHUB_STEP_SUMMARY
+          echo "Executable Size: $([math]::Round($fileInfo.Length / 1MB, 2)) MB" >> $env:GITHUB_STEP_SUMMARY
         }
diff --git a/.github/workflows/code-quality.yml b/.github/workflows/code-quality.yml
index 637ae530..2fbcd399 100644
--- a/.github/workflows/code-quality.yml
+++ b/.github/workflows/code-quality.yml
@@ -57,7 +57,7 @@ jobs:
         echo "### Code Quality Checks :mag:" >> $env:GITHUB_STEP_SUMMARY
         
         # Check for TODO comments
-        $todos = Select-String -Path srchybrid\*.cpp,srchybrid\*.h -Pattern "TODO|FIXME|HACK" -Recurse -ErrorAction SilentlyContinue
+        $todos = Select-String -Path srchybrid -Include *.cpp,*.h -Pattern "TODO|FIXME|HACK" -Recurse -ErrorAction SilentlyContinue
         if ($todos) {
           $todoCount = ($todos | Measure-Object).Count
           echo "Found $todoCount TODO/FIXME/HACK comments" >> $env:GITHUB_STEP_SUMMARY
@@ -66,7 +66,7 @@ jobs:
         }
         
         # Check for hardcoded paths
-        $hardcodedPaths = Select-String -Path srchybrid\*.cpp -Pattern "C:\\\\|D:\\\\" -Recurse -ErrorAction SilentlyContinue
+        $hardcodedPaths = Select-String -Path srchybrid -Include *.cpp -Pattern "C:\\\\|D:\\\\" -Recurse -ErrorAction SilentlyContinue
         if ($hardcodedPaths) {
           $pathCount = ($hardcodedPaths | Measure-Object).Count
           echo ":warning: Found $pathCount potential hardcoded paths" >> $env:GITHUB_STEP_SUMMARY
diff --git a/.github/workflows/security-scan.yml b/.github/workflows/security-scan.yml
index 350e91e7..409aed19 100644
--- a/.github/workflows/security-scan.yml
+++ b/.github/workflows/security-scan.yml
@@ -25,7 +25,7 @@ jobs:
         fetch-depth: 0
     
     - name: Run Trivy vulnerability scanner
-      uses: aquasecurity/trivy-action@master
+      uses: aquasecurity/trivy-action@0.28.0
       with:
         scan-type: 'fs'
         scan-ref: '.'