[pull] main from VirusTotal:main

.gemini/config.yaml

@@ -1,3 +1,4 @@
 code_review:
-  disable: true
-  comment_severity_threshold: HIGH
+  pull_request_opened:
+    summary: true
+    include_drafts: false

.github/scripts/update_playground.py

@@ -0,0 +1,188 @@
+
+#!/usr/bin/env python3
+"""Update the YARA-X playground from a published release.
+
+Usage: python3 .github/scripts/update_playground.py 1.22.0
+Requires Python 3.11+, Rust, wasm32-unknown-unknown, Node.js and npm.
+"""
+
+import argparse
+import re
+import shlex
+import shutil
+import subprocess
+import tempfile
+import tomllib
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parents[2]
+PLAYGROUND = ROOT / "playground"
+LS_PACKAGE = PLAYGROUND / "src/wasm/yara-x-ls/pkg"
+LS_FILES = (
+    "yara_x_ls.js",
+    "yara_x_ls.d.ts",
+    "yara_x_ls_bg.wasm",
+    "yara_x_ls_bg.wasm.d.ts",
+)
+
+
+def run(*command: str | Path, cwd: Path = ROOT) -> None:
+    args = [str(arg) for arg in command]
+    print(f"\n$ {shlex.join(args)}", flush=True)
+    subprocess.run(args, cwd=cwd, check=True)
+
+
+def parse_version(value: str) -> str:
+    if not re.fullmatch(r"v?\d+\.\d+\.\d+", value):
+        raise argparse.ArgumentTypeError("Expected 1.22.0 or v1.22.0")
+    return value.removeprefix("v")
+
+
+def verify_npm_release(version: str) -> None:
+    package = f"@virustotal/yara-x@{version}"
+    result = subprocess.run(
+        ["npm", "view", package, "version"],
+        capture_output=True,
+        text=True,
+    )
+
+    if result.returncode != 0:
+        raise ValueError(
+            f"Cannot verify {package} on npm: {result.stderr.strip()}"
+        )
+
+    if result.stdout.strip() != version:
+        raise ValueError(
+            f"Expected npm version {version}, got {result.stdout.strip()!r}"
+        )
+
+    print(f"npm release found: {package}", flush=True)
+
+
+def fetch_release(version: str, directory: Path) -> Path:
+    source = directory / "source"
+
+    run(
+        "git", "clone", "--depth", "1", "--branch", f"v{version}",
+        "--single-branch", "https://github.com/VirusTotal/yara-x.git",
+        source,
+    )
+
+    manifest_path = source / "ls/Cargo.toml"
+
+    if not manifest_path.is_file():
+        raise ValueError(
+            f"Release v{version} does not include the Language Server"
+        )
+
+    manifest = tomllib.loads(
+        manifest_path.read_text(encoding="utf-8")
+    )
+
+    if manifest["package"]["name"] != "yara-x-ls":
+        raise ValueError(
+            f"Release v{version} does not contain yara-x-ls"
+        )
+
+    return source
+
+
+def wasm_bindgen_version(source: Path) -> str:
+    lockfile = tomllib.loads(
+        (source / "Cargo.lock").read_text(encoding="utf-8")
+    )
+
+    for package in lockfile["package"]:
+        if package["name"] == "wasm-bindgen":
+            return package["version"]
+
+    raise ValueError("wasm-bindgen not found in Cargo.lock")
+
+
+def build_language_server(source: Path) -> Path:
+    run(
+        "cargo", "build",
+        "--target", "wasm32-unknown-unknown",
+        "--no-default-features",
+        "-p", "yara-x-ls", "--lib",
+        "--release", "--locked",
+        cwd=source,
+    )
+
+    return source / "target/wasm32-unknown-unknown/release/yara_x_ls.wasm"
+
+
+def generate_bindings(
+    source: Path, wasm: Path, directory: Path
+) -> Path:
+    tools = directory / "tools"
+
+    run(
+        "cargo", "install", "wasm-bindgen-cli", "--locked",
+        "--version", wasm_bindgen_version(source),
+        "--root", tools,
+    )
+
+    output = directory / "bindings"
+
+    run(
+        tools / "bin/wasm-bindgen", wasm,
+        "--target", "web",
+        "--out-dir", output,
+    )
+
+    for filename in LS_FILES:
+        if not (output / filename).is_file():
+            raise ValueError(f"Missing generated LS file: {filename}")
+
+    return output
+
+
+def update_playground(version: str, bindings: Path) -> None:
+    run(
+        "npm", "install", "--save-exact",
+        f"@virustotal/yara-x@{version}",
+        cwd=PLAYGROUND,
+    )
+
+    LS_PACKAGE.mkdir(parents=True, exist_ok=True)
+
+    for filename in LS_FILES:
+        shutil.copyfile(bindings / filename, LS_PACKAGE / filename)
+
+    run("npm", "run", "format", cwd=PLAYGROUND)
+    run("npm", "run", "build", cwd=PLAYGROUND)
+
+
+def main() -> None:
+    parser = argparse.ArgumentParser(
+        description="Update the YARA-X playground"
+    )
+    parser.add_argument(
+        "version",
+        type=parse_version,
+        help="e.g. 1.22.0 or v1.22.0",
+    )
+
+    version = parser.parse_args().version
+
+    verify_npm_release(version)
+
+    with tempfile.TemporaryDirectory(
+        prefix="yara-x-playground-"
+    ) as temporary:
+        directory = Path(temporary)
+
+        source = fetch_release(version, directory)
+        wasm = build_language_server(source)
+        bindings = generate_bindings(source, wasm, directory)
+        update_playground(version, bindings)
+
+    print("\nPlayground updated. Review the diff before committing.")
+
+
+if __name__ == "__main__":
+    try:
+        main()
+    except (OSError, ValueError, subprocess.CalledProcessError) as error:
+        raise SystemExit(f"Update failed: {error}") from None

.github/workflows/code_health.yaml

@@ -2,13 +2,18 @@ name: Code health
 
 on: [ push, pull_request ]
 
+permissions:
+  contents: read
+
 jobs:
   clippy:
     name: Clippy
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-    - uses: dtolnay/rust-toolchain@master
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      with:
+        persist-credentials: false
+    - uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772
       with:
         toolchain: stable
         components: clippy
@@ -18,8 +23,10 @@ jobs:
     name: Rustfmt
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-    - uses: dtolnay/rust-toolchain@master
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      with:
+        persist-credentials: false
+    - uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # v1
       with:
         toolchain: stable
         components: rustfmt

.github/workflows/coverage.yaml

@@ -11,6 +11,9 @@ on:
   # Also run manually from the Actions tab
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   coverage:
     name: Coverage
@@ -19,10 +22,12 @@ jobs:
       CARGO_TERM_COLOR: always
     steps:
     - name: Checkout sources
-      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      with:
+        persist-credentials: false
 
     - name: Install toolchain
-      uses: dtolnay/rust-toolchain@master
+      uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772
       with:
         toolchain: stable
 
@@ -32,13 +37,15 @@ jobs:
         sudo apt-get install -y libmagic-dev
 
     - name: Install cargo-llvm-cov
-      uses: taiki-e/install-action@cargo-llvm-cov
+      uses: taiki-e/install-action@6cd13508893c0e7eab5f273c2575d3859bd7229a # v2.86.6
+      with:
+        tool: 'cargo-llvm-cov'
 
     - name: Generate code coverage
       run: cargo llvm-cov --features=magic-module,rules-profiling --workspace --lib --lcov --output-path lcov.info
 
     - name: Upload coverage to Codecov
-      uses: codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac # v7.0.0
+      uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
       with:
         token: ${{ secrets.CODECOV_TOKEN }}
         files: lcov.info

.github/workflows/golang.yaml

@@ -14,28 +14,30 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        go-version: [ '1.25.x', '1.26.x' ]
+        go-version: [ '1.26.x', '1.27.x' ]
         os: [ ubuntu-latest, macos-latest ]
     runs-on: ${{ matrix.os }}
     steps:
     - name: Checkout
-      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      with:
+        persist-credentials: false
 
     - name: Setup Go ${{ matrix.go-version }}
-      uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+      uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
       with:
         go-version: ${{ matrix.go-version }}
 
     - name: Setup Rust
-      uses: dtolnay/rust-toolchain@master
+      uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772
       with:
         toolchain: stable
 
     - name: Install cargo-c
       run: cargo install cargo-c
 
     - name: Build and install Rust library
-      run: cargo cinstall -p yara-x-capi --release --pkgconfigdir=${{ github.workspace }} --includedir=${{ github.workspace }} --libdir=${{ github.workspace }}
+      run: cargo cinstall -p yara-x-capi --release --features=test_proto2-module,test_proto3-module --pkgconfigdir=${{ github.workspace }} --includedir=${{ github.workspace }} --libdir=${{ github.workspace }}
 
     - name: Run Go tests
       run: |

.github/workflows/pr_title.yaml

@@ -1,6 +1,6 @@
 name: Check PR title
 on:
-  pull_request_target:
+  pull_request:
     types:
     - opened
     - reopened

.github/workflows/publish_npm_package.yaml

@@ -12,21 +12,23 @@ jobs:
     if: ${{ startsWith(github.ref, 'refs/tags/v') }}
     runs-on: ubuntu-latest
     permissions:
-      contents: write
+      contents: read
       id-token: write
 
     steps:
       - name: Checkout sources
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@master
+        uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772
         with:
           toolchain: stable
           target: wasm32-unknown-unknown
 
       - name: Install Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 24
           registry-url: https://registry.npmjs.org/