release: v2.3.0

.gitea/workflows/security.yml

@@ -0,0 +1,177 @@
+name: Security Scan and Upload
+
+on:
+  push:
+    branches: [ main ]
+  pull_request:
+    branches: [ main ]
+  schedule:
+    - cron: '0 0 * * 1'
+  workflow_dispatch:
+
+jobs:
+  security-audit:
+    name: Security & DefectDojo Upload
+    runs-on: ubuntu-latest
+    continue-on-error: true
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      # --- AUTO-SETUP PROJECT ---
+      - name: Ensure DefectDojo Product Exists
+        env:
+          DD_URL: ${{ secrets.DD_URL }}
+          DD_TOKEN: ${{ secrets.DD_TOKEN }}
+          PRODUCT_NAME: ${{ github.repository }} 
+          PRODUCT_TYPE_ID: 1 
+        run: |
+          sudo apt-get install jq -y > /dev/null
+          
+          echo "Checking connection to $DD_URL..."
+          
+          # Check if product exists - capture HTTP code to debug connection issues
+          RESPONSE=$(curl --write-out "%{http_code}" --silent --output /tmp/response.json \
+            -H "Authorization: Token $DD_TOKEN" \
+            "$DD_URL/api/v2/products/?name=$PRODUCT_NAME")
+          
+          # If response is not 200, print error
+          if [ "$RESPONSE" != "200" ]; then
+            echo "::error::Failed to query DefectDojo. HTTP Code: $RESPONSE"
+            cat /tmp/response.json
+            exit 1
+          fi
+
+          COUNT=$(cat /tmp/response.json | jq -r '.count')
+          
+          if [ "$COUNT" = "0" ]; then
+            echo "Creating product '$PRODUCT_NAME'..."
+            curl -s -X POST "$DD_URL/api/v2/products/" \
+              -H "Authorization: Token $DD_TOKEN" \
+              -H "Content-Type: application/json" \
+              -d '{ "name": "'"$PRODUCT_NAME"'", "description": "Auto-created by Gitea Actions", "prod_type": '$PRODUCT_TYPE_ID' }'
+          else
+            echo "Product '$PRODUCT_NAME' already exists."
+          fi
+
+      # --- 1. TRIVY (Dependencies & Misconfig) ---
+      - name: Install Trivy
+        run: |
+          sudo apt-get install wget apt-transport-https gnupg lsb-release -y
+          wget -qO - https://aquasecurity.github.io/trivy-repo/deb/public.key | sudo apt-key add -
+          echo "deb https://aquasecurity.github.io/trivy-repo/deb $(lsb_release -sc) main" | sudo tee -a /etc/apt/sources.list.d/trivy.list
+          sudo apt-get update && sudo apt-get install trivy -y
+
+      - name: Run Trivy (FS Scan)
+        run: |
+          trivy fs . --scanners vuln,misconfig --format json --output trivy-results.json --exit-code 0
+
+      - name: Upload Trivy to DefectDojo
+        env:
+          DD_URL: ${{ secrets.DD_URL }}
+          DD_TOKEN: ${{ secrets.DD_TOKEN }}
+        run: |
+          echo "Uploading Trivy results..."
+          # Generate today's date in YYYY-MM-DD format
+          TODAY=$(date +%Y-%m-%d)
+          
+          HTTP_CODE=$(curl --write-out "%{http_code}" --output response.txt --silent -X POST "$DD_URL/api/v2/import-scan/" \
+            -H "Authorization: Token $DD_TOKEN" \
+            -F "active=true" \
+            -F "verified=true" \
+            -F "scan_type=Trivy Scan" \
+            -F "engagement_name=CI/CD Pipeline" \
+            -F "product_name=${{ github.repository }}" \
+            -F "scan_date=$TODAY" \
+            -F "auto_create_context=true" \
+            -F "file=@trivy-results.json")
+          
+          if [[ "$HTTP_CODE" != "200" && "$HTTP_CODE" != "201" ]]; then
+            echo "::error::Upload Failed with HTTP $HTTP_CODE"
+            echo "--- SERVER RESPONSE ---"
+            cat response.txt
+            echo "-----------------------"
+            exit 1
+          else
+            echo "Upload Success!"
+          fi
+
+      # --- 2. GITLEAKS (Secrets) ---
+      - name: Install Gitleaks
+        run: |
+          wget -qO gitleaks.tar.gz https://github.com/gitleaks/gitleaks/releases/download/v8.18.0/gitleaks_8.18.0_linux_x64.tar.gz
+          tar -xzf gitleaks.tar.gz
+          sudo mv gitleaks /usr/local/bin/ && chmod +x /usr/local/bin/gitleaks
+
+      - name: Run Gitleaks
+        run: gitleaks detect --source . -v --report-path gitleaks-results.json --report-format json --no-git || true
+
+      - name: Upload Gitleaks to DefectDojo
+        env:
+          DD_URL: ${{ secrets.DD_URL }}
+          DD_TOKEN: ${{ secrets.DD_TOKEN }}
+        run: |
+          echo "Uploading Gitleaks results..."  
+          TODAY=$(date +%Y-%m-%d)
+
+          HTTP_CODE=$(curl --write-out "%{http_code}" --output response.txt --silent -X POST "$DD_URL/api/v2/import-scan/" \
+            -H "Authorization: Token $DD_TOKEN" \
+            -F "active=true" \
+            -F "verified=true" \
+            -F "scan_type=Gitleaks Scan" \
+            -F "engagement_name=CI/CD Pipeline" \
+            -F "product_name=${{ github.repository }}" \
+            -F "scan_date=$TODAY" \
+            -F "auto_create_context=true" \
+            -F "file=@gitleaks-results.json")
+
+          if [[ "$HTTP_CODE" != "200" && "$HTTP_CODE" != "201" ]]; then
+             echo "::error::Upload Failed with HTTP $HTTP_CODE"
+             echo "--- SERVER RESPONSE ---"
+             cat response.txt
+             echo "-----------------------"
+             exit 1
+          else
+             echo "Upload Success!"
+          fi
+
+      # --- 3. SEMGREP (SAST) ---
+      - name: Install Semgrep (via pipx)
+        run: |
+          sudo apt-get install pipx -y
+          pipx install semgrep
+          # Add pipx binary path to GITHUB_PATH so next steps can see 'semgrep'
+          echo "$HOME/.local/bin" >> $GITHUB_PATH
+
+      - name: Run Semgrep
+        run: semgrep scan --config=p/security-audit --config=p/owasp-top-ten --json --output semgrep-results.json . || true
+
+      - name: Upload Semgrep to DefectDojo
+        env:
+          DD_URL: ${{ secrets.DD_URL }}
+          DD_TOKEN: ${{ secrets.DD_TOKEN }}
+        run: |
+          echo "Uploading Semgrep results..."
+          TODAY=$(date +%Y-%m-%d)
+          
+          HTTP_CODE=$(curl --write-out "%{http_code}" --output response.txt --silent -X POST "$DD_URL/api/v2/import-scan/" \
+            -H "Authorization: Token $DD_TOKEN" \
+            -F "active=true" \
+            -F "verified=true" \
+            -F "scan_type=Semgrep JSON Report" \
+            -F "engagement_name=CI/CD Pipeline" \
+            -F "product_name=${{ github.repository }}" \
+            -F "scan_date=$TODAY" \
+            -F "auto_create_context=true" \
+            -F "file=@semgrep-results.json")
+
+          if [[ "$HTTP_CODE" != "200" && "$HTTP_CODE" != "201" ]]; then
+             echo "::error::Upload Failed with HTTP $HTTP_CODE"
+             echo "--- SERVER RESPONSE ---"
+             cat response.txt
+             echo "-----------------------"
+             exit 1
+          else
+             echo "Upload Success!"
+          fi

.gitea/workflows/sonar.yml

@@ -1,34 +0,0 @@
-name: Code Analysis
-on:
-  push:
-    branches:
-      - main
-
-jobs:
-  sonar:
-    name: SonarQube
-
-    steps:
-      - name: Checkout Source Files
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - name: SonarCube Scan
-        uses: SonarSource/sonarqube-scan-action@v4
-        timeout-minutes: 10
-        env:
-          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
-          SONAR_HOST_URL: "https://quality.nhcarrigan.com"
-        with:
-          args: >
-            -Dsonar.sources=.
-            -Dsonar.projectKey=ocean-breeze
-
-      - name: SonarQube Quality Gate check
-        uses: sonarsource/sonarqube-quality-gate-action@v1
-        with:
-          pollingTimeoutSec: 600
-        env:
-          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
-          SONAR_HOST_URL: "https://quality.nhcarrigan.com"

.npmrc

@@ -0,0 +1,25 @@
+# Package Manager Configuration
+# Force pnpm usage - breaks npm/yarn intentionally
+node-linker=pnpm
+
+# Security: Disable all lifecycle scripts
+ignore-scripts=true
+enable-pre-post-scripts=false
+
+# Security: Require packages to be 10+ days old before installation
+minimum-release-age=14400
+
+# Security: Verify package integrity hashes
+verify-store-integrity=true
+
+# Security: Enforce strict trust policies
+trust-policy=strict
+
+# Security: Strict peer dependency resolution
+strict-peer-dependencies=true
+
+# Performance: Use symlinks for node_modules
+symlink=true
+
+# Lockfile: Ensure lockfile is not modified during install
+frozen-lockfile=false

.vscode/launch.json

@@ -0,0 +1,13 @@
+{
+  "version": "0.2.0",
+  "configurations": [
+    {
+      "name": "Extension Development Host",
+      "type": "extensionHost",
+      "request": "launch",
+      "args": [
+        "--extensionDevelopmentPath=${workspaceFolder}"
+      ]
+    }
+  ]
+}

README.md

@@ -4,7 +4,7 @@ This is a collection of various VSCode themes Naomi has written to suit her ever
 
 ## Feedback and Bugs
 
-If you have feedback or a bug report, please feel free to open an issue!
+If you have feedback or a bug report, please [log a ticket on our forum](https://support.nhcarrigan.com).
 
 ## Contributing
 

package.json

@@ -2,7 +2,7 @@
   "name": "naomis-themes",
   "displayName": "Naomi's Themes",
   "icon": "icon.png",
-  "version": "2.2.0",
+  "version": "2.3.0",
   "description": "Various themes Naomi has created.",
   "engines": {
     "vscode": "^1.96.4"
@@ -32,6 +32,11 @@
         "label": "Trans Pride",
         "uiTheme": "vs",
         "path": "./themes/trans-pride.json"
+      },
+      {
+        "label": "Witchy Dark",
+        "uiTheme": "vs-dark",
+        "path": "./themes/witchy-dark.json"
       }
     ]
   },

themes/witchy-dark.json

@@ -0,0 +1,463 @@
+{
+    "name": "Witchy Dark",
+    "type": "dark",
+    "colors": {
+      "editor.background": "#0A0009",
+      "editor.foreground": "#E8D5E8",
+      "activityBar.background": "#150A1E",
+      "activityBar.foreground": "#E8D5E8",
+      "activityBarBadge.background": "#A8577E",
+      "activityBarBadge.foreground": "#F5F5F5",
+      "sideBar.background": "#150A1E",
+      "sideBar.foreground": "#E8D5E8",
+      "sideBarTitle.foreground": "#D4A5C7",
+      "titleBar.activeBackground": "#2B1B3D",
+      "titleBar.activeForeground": "#E8D5E8",
+      "statusBar.background": "#44275A",
+      "statusBar.foreground": "#E8D5E8",
+      "statusBar.noFolderBackground": "#0A0009",
+      "tab.activeBackground": "#2B1B3D",
+      "tab.activeForeground": "#E8D5E8",
+      "tab.inactiveBackground": "#150A1E",
+      "tab.inactiveForeground": "#D4A5C7",
+      "editorGroupHeader.tabsBackground": "#150A1E",
+      "button.background": "#44275A",
+      "button.foreground": "#E8D5E8",
+      "dropdown.background": "#2B1B3D",
+      "dropdown.foreground": "#E8D5E8",
+      "input.background": "#150A1E",
+      "input.foreground": "#E8D5E8",
+      "input.placeholderForeground": "#D4A5C7",
+      "focusBorder": "#A8577E",
+      "list.activeSelectionBackground": "#44275A",
+      "list.activeSelectionForeground": "#E8D5E8",
+      "list.hoverBackground": "#2B1B3D",
+      "list.hoverForeground": "#E8D5E8",
+      "editor.selectionBackground": "#A8577E",
+      "editor.selectionHighlightBackground": "#A8577E50",
+      "editor.wordHighlightBackground": "#A8577E40",
+      "editor.lineHighlightBackground": "#2B1B3D",
+      "editorCursor.foreground": "#A8577E",
+      "editorWhitespace.foreground": "#44275A",
+      "editorIndentGuide.background": "#44275A",
+      "editorIndentGuide.activeBackground": "#A8577E",
+      "terminal.background": "#0A0009",
+      "terminal.foreground": "#E8D5E8",
+      "terminal.ansiBlack": "#2B1B3D",
+      "terminal.ansiBrightBlack": "#44275A",
+      "terminal.ansiRed": "#A8577E",
+      "terminal.ansiBrightRed": "#C96B8E",
+      "terminal.ansiGreen": "#8A7A9E",
+      "terminal.ansiBrightGreen": "#A898C0",
+      "terminal.ansiYellow": "#D4A5C7",
+      "terminal.ansiBrightYellow": "#E8D5E8",
+      "terminal.ansiBlue": "#7B5EA8",
+      "terminal.ansiBrightBlue": "#9B7EC8",
+      "terminal.ansiMagenta": "#A8577E",
+      "terminal.ansiBrightMagenta": "#D4A5C7",
+      "terminal.ansiCyan": "#B8A0D0",
+      "terminal.ansiBrightCyan": "#D0B8E8",
+      "terminal.ansiWhite": "#D4A5C7",
+      "terminal.ansiBrightWhite": "#F5F5F5"
+    },
+    "tokenColors": [
+      {
+        "scope": ["comment", "punctuation.definition.comment"],
+        "settings": {
+          "foreground": "#7A5A8A",
+          "fontStyle": "italic"
+        }
+      },
+      {
+        "scope": [
+          "string",
+          "string.quoted.single",
+          "string.quoted.double",
+          "string.quoted.triple",
+          "string.template",
+          "constant.character",
+          "constant.other.symbol"
+        ],
+        "settings": {
+          "foreground": "#D4A5C7"
+        }
+      },
+      {
+        "scope": [
+          "constant.numeric",
+          "constant.language",
+          "constant.character.escape",
+          "constant.other",
+          "support.constant"
+        ],
+        "settings": {
+          "foreground": "#C88FA8"
+        }
+      },
+      {
+        "scope": [
+          "variable",
+          "variable.other",
+          "variable.parameter",
+          "variable.language",
+          "variable.object.property"
+        ],
+        "settings": {
+          "foreground": "#E8D5E8"
+        }
+      },
+      {
+        "scope": [
+          "keyword",
+          "keyword.control",
+          "keyword.operator",
+          "keyword.other",
+          "storage.type",
+          "storage.modifier",
+          "punctuation.decorator"
+        ],
+        "settings": {
+          "foreground": "#A8577E"
+        }
+      },
+      {
+        "scope": [
+          "entity.name.function",
+          "entity.name.method",
+          "support.function",
+          "meta.function-call",
+          "meta.method-call",
+          "meta.function.dart"
+        ],
+        "settings": {
+          "foreground": "#C070A0"
+        }
+      },
+      {
+        "scope": [
+          "entity.name.type",
+          "entity.name.class",
+          "entity.name.struct",
+          "entity.name.enum",
+          "entity.name.union",
+          "entity.name.trait",
+          "entity.name.interface",
+          "support.class",
+          "support.type",
+          "meta.return-type"
+        ],
+        "settings": {
+          "foreground": "#D4A5C7",
+          "fontStyle": "bold"
+        }
+      },
+      {
+        "scope": [
+          "meta.decorator",
+          "meta.annotation",
+          "punctuation.definition.annotation"
+        ],
+        "settings": {
+          "foreground": "#9B5878"
+        }
+      },
+      {
+        "scope": ["entity.name.tag", "punctuation.definition.tag"],
+        "settings": {
+          "foreground": "#A8577E"
+        }
+      },
+      {
+        "scope": [
+          "entity.other.attribute-name",
+          "entity.other.attribute-name.html",
+          "entity.other.attribute-name.css",
+          "support.type.property-name.css",
+          "entity.other.attribute-name.class"
+        ],
+        "settings": {
+          "foreground": "#D4A5C7"
+        }
+      },
+      {
+        "scope": [
+          "support.type.primitive",
+          "support.type.builtin",
+          "keyword.type",
+          "storage.type.primitive",
+          "storage.type.built-in",
+          "support.type.primitive.dart"
+        ],
+        "settings": {
+          "foreground": "#D4A5C7"
+        }
+      },
+      {
+        "scope": ["string.regexp", "constant.character.escape.regex"],
+        "settings": {
+          "foreground": "#D4A5C7"
+        }
+      },
+      {
+        "scope": ["markup.heading", "entity.name.section"],
+        "settings": {
+          "foreground": "#A8577E",
+          "fontStyle": "bold"
+        }
+      },
+      {
+        "scope": ["markup.bold"],
+        "settings": {
+          "fontStyle": "bold"
+        }
+      },
+      {
+        "scope": ["markup.italic"],
+        "settings": {
+          "fontStyle": "italic"
+        }
+      },
+      {
+        "scope": ["markup.inline.raw", "markup.fenced_code", "markup.raw"],
+        "settings": {
+          "foreground": "#D4A5C7"
+        }
+      },
+      {
+        "scope": [
+          "support.type.property-name.json",
+          "support.type.property-name.jsonc"
+        ],
+        "settings": {
+          "foreground": "#D4A5C7"
+        }
+      },
+      {
+        "scope": [
+          "keyword.operator.expression",
+          "keyword.operator.new",
+          "keyword.operator.optional",
+          "keyword.operator.comparison",
+          "keyword.operator.arithmetic",
+          "keyword.operator.assignment",
+          "keyword.operator.logical"
+        ],
+        "settings": {
+          "foreground": "#CF8FAE"
+        }
+      },
+      {
+        "scope": [
+          "meta.embedded",
+          "source.groovy.embedded",
+          "meta.template.expression"
+        ],
+        "settings": {
+          "foreground": "#E8D5E8"
+        }
+      },
+      {
+        "scope": [
+          "meta.object-literal.key",
+          "variable.object.property",
+          "variable.other.property",
+          "variable.other.object.property"
+        ],
+        "settings": {
+          "foreground": "#D4A5C7"
+        }
+      },
+      {
+        "scope": [
+          "support.variable.property",
+          "support.variable.object.process",
+          "support.variable.object.node"
+        ],
+        "settings": {
+          "foreground": "#D4A5C7"
+        }
+      },
+      {
+        "scope": [
+          "source.rust storage.type.rust",
+          "source.rust entity.name.type.rust",
+          "source.rust entity.name.type.struct.rust"
+        ],
+        "settings": {
+          "foreground": "#D4A5C7"
+        }
+      },
+      {
+        "scope": [
+          "source.rust keyword.operator",
+          "source.rust keyword.operator.arithmetic",
+          "source.rust keyword.operator.logical"
+        ],
+        "settings": {
+          "foreground": "#CF8FAE"
+        }
+      },
+      {
+        "scope": [
+          "source.python support.type.python",
+          "source.python support.function.builtin.python"
+        ],
+        "settings": {
+          "foreground": "#C070A0"
+        }
+      },
+      {
+        "scope": [
+          "source.cs entity.name.type.class.cs",
+          "source.cs storage.type.cs"
+        ],
+        "settings": {
+          "foreground": "#D4A5C7"
+        }
+      },
+      {
+        "scope": [
+          "source.dart support.class.dart",
+          "source.dart support.type.dart"
+        ],
+        "settings": {
+          "foreground": "#D4A5C7"
+        }
+      },
+      {
+        "scope": [
+          "source.prisma keyword.operator",
+          "source.prisma constant.language",
+          "source.prisma keyword.type"
+        ],
+        "settings": {
+          "foreground": "#A8577E"
+        }
+      },
+      {
+        "scope": [
+          "source.graphql support.type",
+          "source.graphql constant.character"
+        ],
+        "settings": {
+          "foreground": "#D4A5C7"
+        }
+      },
+      {
+        "scope": ["source.sql keyword.other", "source.sql storage.type"],
+        "settings": {
+          "foreground": "#A8577E"
+        }
+      },
+      {
+        "scope": [
+          "meta.jsx.children",
+          "meta.embedded.block.tsx",
+          "meta.embedded.block.jsx"
+        ],
+        "settings": {
+          "foreground": "#E8D5E8"
+        }
+      },
+      {
+        "scope": [
+          "meta.decorator.ts",
+          "meta.decorator.tsx",
+          "meta.decorator.angular"
+        ],
+        "settings": {
+          "foreground": "#9B5878"
+        }
+      },
+      {
+        "scope": [
+          "entity.name.tag.yaml",
+          "string.unquoted.plain.out.yaml"
+        ],
+        "settings": {
+          "foreground": "#D4A5C7"
+        }
+      },
+      {
+        "scope": [
+          "support.type.property-name.toml",
+          "entity.name.tag.toml"
+        ],
+        "settings": {
+          "foreground": "#D4A5C7"
+        }
+      },
+      {
+        "scope": [
+          "markup.underline.link",
+          "string.other.link.title.markdown",
+          "meta.link.inline.markdown"
+        ],
+        "settings": {
+          "foreground": "#A8577E"
+        }
+      },
+      {
+        "scope": ["markup.quote"],
+        "settings": {
+          "foreground": "#7A5A8A",
+          "fontStyle": "italic"
+        }
+      },
+      {
+        "scope": [
+          "punctuation.definition.list.begin.markdown",
+          "beginning.punctuation.definition.list.markdown"
+        ],
+        "settings": {
+          "foreground": "#A8577E"
+        }
+      },
+      {
+        "scope": [
+          "variable.css",
+          "variable.other.custom-property.css",
+          "support.type.custom-property.css"
+        ],
+        "settings": {
+          "foreground": "#CF8FAE"
+        }
+      },
+      {
+        "scope": [
+          "support.macro.rust",
+          "entity.name.function.macro.rust",
+          "meta.macro.rust entity.name.function.rust"
+        ],
+        "settings": {
+          "foreground": "#C070A0"
+        }
+      },
+      {
+        "scope": [
+          "storage.modifier.lifetime.rust",
+          "entity.name.lifetime.rust",
+          "punctuation.definition.lifetime.rust"
+        ],
+        "settings": {
+          "foreground": "#9B5878"
+        }
+      },
+      {
+        "scope": ["entity.name.package.go"],
+        "settings": {
+          "foreground": "#C88FA8"
+        }
+      },
+      {
+        "scope": [
+          "entity.name.package.java",
+          "support.other.package.java",
+          "entity.name.package.kotlin"
+        ],
+        "settings": {
+          "foreground": "#C88FA8"
+        }
+      }
+    ]
+  }