Version 6.0

.github/workflows/auto-label-author.yml

@@ -20,7 +20,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Label PRs from bellus869 and Lemi257
-        uses: actions/github-script@v7
+        # Pin the privileged pull_request_target action to a reviewed commit.
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
         with:
           script: |
             const labelName = "comments translation";

.github/workflows/nightly-lock-stress.yml

@@ -0,0 +1,80 @@
+name: Nightly Lock Stress
+
+on:
+  schedule:
+    - cron: '17 2 * * *'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
+  BUILD_CONFIGURATION: Debug
+  SOLUTION_PATH: 'src\\vcxproj\\salamand.sln'
+  PLATFORM_TOOLSET: v145
+  OPENSAL_BUILD_DIR: '${{ github.workspace }}\\build_stage\\'
+
+jobs:
+  verifier-lock-stress:
+    # FlaUI needs an unlocked desktop and an isolated profile; this label is deliberately not a hosted runner.
+    runs-on: [self-hosted, windows, filemanager-ui]
+
+    steps:
+      - name: Checkout
+        # Pin actions by reviewed commit to keep the nightly diagnostic lane reproducible.
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      - name: Setup MSBuild
+        uses: microsoft/setup-msbuild@6fb02220983dee41ce7ae257b6f4d8f9bf5ed4ce # v2
+
+      - name: Setup MSVC Developer Command Prompt (x64 toolchain)
+        uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756 # v1
+        with:
+          arch: x64
+
+      - name: Build Debug x64 executable
+        shell: pwsh
+        run: |
+          msbuild $env:SOLUTION_PATH /m /t:Build /p:Configuration=$env:BUILD_CONFIGURATION /p:Platform=x64 /p:PlatformToolset=$env:PLATFORM_TOOLSET /p:PreferredToolArchitecture=x64 /nr:false
+
+      - name: Run Application Verifier and PageHeap UI suite
+        shell: pwsh
+        run: |
+          $appVerifier = Get-Command appverif.exe -ErrorAction SilentlyContinue
+          if ($null -eq $appVerifier) {
+            $appVerifier = Get-ChildItem 'C:\Program Files (x86)\Windows Kits\10\Debuggers' -Filter appverif.exe -Recurse -ErrorAction SilentlyContinue |
+              Select-Object -First 1
+          }
+          if ($null -eq $appVerifier) {
+            throw 'Application Verifier is required on the filemanager-ui runner.'
+          }
+          $appVerifierPath = if ($appVerifier -is [System.Management.Automation.CommandInfo]) {
+            $appVerifier.Source
+          } else {
+            $appVerifier.FullName
+          }
+
+          $executable = Get-ChildItem $env:OPENSAL_BUILD_DIR -Filter salamand.exe -Recurse |
+            Where-Object { $_.FullName -like '*Debug_x64*' } |
+            Select-Object -First 1
+          if ($null -eq $executable) {
+            throw 'The Debug x64 salamand.exe build output was not found.'
+          }
+
+          # The self-hosted runner account is dedicated to this lane, which makes profile-mutating UI tests safe.
+          $env:FILEMANAGER_UI_ISOLATED = '1'
+          $env:FILEMANAGER_UI_EXE = $executable.FullName
+          # Nightly has the time budget for the longer lifecycle resource-growth sample.
+          $env:FILEMANAGER_UI_LEAK_CYCLES = '100'
+          .\tools\run-lock-verifier-stress.ps1 -ExecutablePath $executable.FullName `
+            -TestProject '.\tests\FileManager.UiTests\FileManager.UiTests.csproj' -AppVerifierPath $appVerifierPath `
+            -LogOutputDirectory '.\application-verifier-logs' -VerifierProfile Full -TestFilter 'TestCategory=UI'
+
+      - name: Upload Application Verifier logs
+        if: always()
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: application-verifier-pageheap-logs
+          path: application-verifier-logs
+          if-no-files-found: warn

.github/workflows/nightly-parser-fuzz.yml

@@ -0,0 +1,35 @@
+name: Nightly Parser Corpus Soak
+
+on:
+  schedule:
+    - cron: '43 3 * * *'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
+
+jobs:
+  deterministic-parser-soak:
+    runs-on: windows-2025
+
+    steps:
+      - name: Checkout
+        # Pin the scheduled campaign to a reviewed action commit as well as a reviewed source revision.
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      - name: Setup MSVC Developer Command Prompt (x64 toolchain)
+        uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756 # v1
+        with:
+          arch: x64
+
+      - name: Replay bzip2 hostile-input corpus
+        shell: pwsh
+        # Repetition raises the scheduled parser-execution budget without making PR checks slow.
+        run: .\tools\test-bzip2-compatibility.ps1 -Architecture x64 -Iterations 250
+
+      - name: Replay Markdown extension-combination corpus
+        shell: pwsh
+        run: .\tools\test-cmark-gfm-hardening.ps1 -Iterations 250

.github/workflows/pr-comments-guard.yml

@@ -64,7 +64,8 @@ jobs:
 
       - name: Checkout PR
         if: steps.label_check.outputs.should-skip != 'true'
-        uses: actions/checkout@v4
+        # Pin checkout because this pull_request_target job reads untrusted PR content.
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           ref: ${{ github.event.pull_request.head.sha }}
           fetch-depth: 0
@@ -206,7 +207,6 @@ jobs:
               'src/plugins/automation/generated',
               'src/plugins/shared/lukas',
               'src/plugins/ftp',
-              'src/plugins/ftp/openssl',
               'src/plugins/ieviewer/cmark-gfm/build/src',
               'src/plugins/ieviewer/cmark-gfm/build/extensions',
               'src/plugins/ieviewer/cmark-gfm/extensions',

.github/workflows/pr-msbuild.yml

@@ -48,15 +48,16 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        # Pin actions by reviewed commit to keep PR execution independent of moved tags.
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           path: s
 
       - name: Setup MSBuild in PATH (VS2022)
-        uses: microsoft/setup-msbuild@v2
+        uses: microsoft/setup-msbuild@6fb02220983dee41ce7ae257b6f4d8f9bf5ed4ce # v2
 
       - name: Setup MSVC Developer Command Prompt (x64 toolchain)
-        uses: ilammy/msvc-dev-cmd@v1
+        uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756 # v1
         with:
           arch: x64
 
@@ -66,8 +67,51 @@ jobs:
           git fetch --no-tags --depth=1 origin ${{ github.event.pull_request.base.ref }}
           .\tools\verify-no-new-terminatethread.ps1 -BaseCommit origin/${{ github.event.pull_request.base.ref }}
 
+      - name: Reject new raw thread creation
+        if: github.event_name == 'pull_request'
+        run: |
+          git fetch --no-tags --depth=1 origin ${{ github.event.pull_request.base.ref }}
+          .\tools\verify-no-new-raw-thread-creation.ps1 -BaseCommit origin/${{ github.event.pull_request.base.ref }}
+
+      - name: Reject new wrap-prone tick-count timing
+        if: github.event_name == 'pull_request'
+        run: |
+          git fetch --no-tags --depth=1 origin ${{ github.event.pull_request.base.ref }}
+          .\tools\verify-no-new-gettickcount.ps1 -BaseCommit origin/${{ github.event.pull_request.base.ref }}
+
+      - name: Reject new fixed MAX_PATH buffers
+        if: github.event_name == 'pull_request'
+        run: |
+          git fetch --no-tags --depth=1 origin ${{ github.event.pull_request.base.ref }}
+          .\tools\verify-no-new-max-path-buffers.ps1 -BaseCommit origin/${{ github.event.pull_request.base.ref }}
+
+      - name: Reject new unchecked string-copy and formatting calls
+        if: github.event_name == 'pull_request'
+        run: |
+          git fetch --no-tags --depth=1 origin ${{ github.event.pull_request.base.ref }}
+          .\tools\verify-no-new-unsafe-string-calls.ps1 -BaseCommit origin/${{ github.event.pull_request.base.ref }}
+
+      - name: Verify asynchronous operation completion protocol
+        run: .\tools\verify-operation-completion-protocol.ps1
+
+      - name: Verify durable copy commit protocol
+        run: .\tools\verify-durable-copy-commit.ps1
+
+      - name: Exercise zlib compatibility and corrupt-input vectors
+        if: matrix.platform == 'x64'
+        run: .\tools\test-zlib-compatibility.ps1
+
+      - name: Exercise bzip2 golden archives, truncation, and fuzz corpus
+        if: matrix.platform == 'x64'
+        run: .\tools\test-bzip2-compatibility.ps1
+
+      - name: Exercise cmark-gfm snapshots, limits, and extension fuzz combinations
+        if: matrix.platform == 'x64'
+        run: .\tools\test-cmark-gfm-hardening.ps1
+
       - name: Register MSVC problem matcher
-        uses: ammaraskar/msvc-problem-matcher@master
+        # This reviewed commit replaces the mutable master branch in PR builds.
+        uses: ammaraskar/msvc-problem-matcher@541aa4360062d76d9620af6b8bd35cfa0c5ef19f
 
       - name: Build via MSBuild (Debug | ${{ matrix.platform }})
         run: |
@@ -99,9 +143,14 @@ jobs:
             exit $LASTEXITCODE
           }
 
+      - name: Exercise SQLite WAL recovery and corrupt-page detection
+        # The native DLL must be built first; this x64 probe owns only a GUID-named temporary database.
+        if: matrix.platform == 'x64'
+        run: .\tools\test-sqlite-recovery.ps1 -SqliteDll .\src\vcxproj\sqlite\salamander\Debug_x64\utils\sqlite.dll
+
       - name: Upload build logs
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: msbuild-${{ matrix.platform }}-debug-logs
           path: |

.github/workflows/pr-squash-guard.yml

@@ -20,7 +20,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check commit count and fail if necessary
-        uses: actions/github-script@v7
+        # Pin the action so the policy guard cannot inherit a moved release tag.
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
         with:
           script: |
             const targetAuthors = ["Lemi257", "bellus869"];

.gitignore

@@ -42,3 +42,7 @@ nul
 *.backup
 .claude
 .vscode
+.dotnet-cli
+.nuget-packages
+tests/FileManager.UiTests/obj
+*.trx