Cockpit Procedure Trainer

SECURITY.md § Supported versions: the only supported version is the latest production deployment, and the update path is stated (an installed PWA offers the update on the next online visit); the app checks for a new version while open (#250). Pre-1.0, no older line is maintained, and that is documented rather than implied.

GitHub Issues with labels (type:bug, type:feature, area:*) and milestones.

SECURITY.md step 7: "Credit the reporter by name or handle in the advisory and the changelog entry, unless they ask to stay anonymous." No report has been received yet, so none has been credited. https://github.com/DocGerd/cockpit-procedure-trainer/blob/develop/SECURITY.md

SECURITY.md § Vulnerability response process: acknowledge (7 days, never more than 14), triage, severity, fix on a private fork, release, advisory, credit; upstream forwarding for dependency issues. https://github.com/DocGerd/cockpit-procedure-trainer/blob/develop/SECURITY.md

eslint.config.js (@eslint/js recommended, typescript-eslint strict, package-boundary and design-literal rules), stylelint.config.mjs, Prettier, tsconfig.base.json; the rules a contributor must follow are in CONTRIBUTING.md § Package boundaries. https://github.com/DocGerd/cockpit-procedure-trainer/blob/develop/eslint.config.js

pnpm lint, pnpm format:check and pnpm typecheck run in the required check job (ci.yml), which both rulesets require before merge; tools/boundary.test.ts and tools/design-literals.test.ts prove the custom rules fire.

A Vite/TypeScript bundle, not a compiled or linked binary; no CC/CFLAGS-style convention applies.

No compiled binaries and no installation system; nothing to strip. The criterion's own guidance selects N/A for JavaScript projects.

No recursive make-style build; one Vite build of apps/web resolving workspace packages.

Building twice from the same commit produces byte-identical output: pnpm build, copy apps/web/dist aside, pnpm build again, diff -r (as measured when submitted; identical on 2026-10-07 at the commit of this document). The build injects no timestamp; the only variable input is VITE_BUILD_SHA, the commit. pnpm install --frozen-lockfile fixes the dependency tree. The release workflow additionally packs the bundle with deterministic tar flags. Measured property, not a CI gate.

For users: open the live URL; the app is a PWA with a web manifest (vite-plugin-pwa in apps/web/vite.config.ts), installed and uninstalled through the browser's standard install prompt. For developers: README § Quick start.

No filesystem install step; a static web build has no DESTDIR-style convention to honour.

README § Quick start: pnpm install then pnpm dev; the only prerequisites are Node 24 and pnpm (CONTRIBUTING.md § Machine prerequisites).

Declared in the workspace package.json files and pinned with integrity hashes in pnpm-lock.yaml; CI installs with --frozen-lockfile. https://github.com/DocGerd/cockpit-procedure-trainer/blob/develop/pnpm-lock.yaml

.github/dependabot.yml: weekly npm and github-actions version updates; Dependabot security updates enabled on the repository; CodeQL weekly.

No vendored or forked dependency: every reused component is a lockfile entry Dependabot can update by pull request; the lockfile is the machine-readable inventory.

Current platform throughout (Node 24, TypeScript 6, React, Vite, ESLint 10 flat config), kept current by weekly Dependabot updates; no known deprecated API in use. No dedicated deprecation lint rule is configured; the check is the strict compiler plus dependency currency.

The required check job runs the whole Vitest suite and the Playwright end-to-end suite against the built app on every pull request and push to develop and main.

Self-attestation with a measured basis. Method: list closed type:bug issues (gh api "repos/DocGerd/cockpit-procedure-trainer/issues?state=closed&labels=type:bug&per_page=100" --jq '.[] | select(.pull_request == null) | .number'; the filter drops pull requests that carry the label), find each fixing commit on develop (git log --grep for the issue or its pull request), and check whether it touched a .test.ts(x) or e2e/.spec.ts file. As measured when submitted; on 2026-10-07, 24 of the 26 traceable fixes did (92 %), and even counting the 13 untraceable ones as misses the share is 24 of 39 (62 %), above 50 %.

vitest.config.ts enforces thresholds: { statements: 95 } over packages/*/src and apps/web/src, and pnpm test:coverage runs in the required check job, so merge is impossible below 95 %. Current figure: as measured when submitted with pnpm test:coverage (98.4 % statements on 2026-10-07).

CONTRIBUTING.md § Tests: "New functionality needs automated tests … in the same pull request."

The same CONTRIBUTING.md § Tests sentence; the pull request template's verification checklist repeats the command chain.

Beyond strict: true: noUncheckedIndexedAccess, exactOptionalPropertyTypes, noImplicitOverride, verbatimModuleSyntax, isolatedModules; ESLint uses typescript-eslint's strict config, not merely recommended, and the custom rules fail the build on package-boundary or design-literal violations.

Self-attestation, evidenced by docs/security-assurance-case.md § 5: least privilege (CSP 'self' only, minimal workflow permissions, no secrets), fail-safe defaults (guarded storage, error boundary), economy of mechanism (no parsing of external input), defence in depth (CSP plus ESLint boundaries), build integrity (lockfile, CI-built, protected branches, CodeQL).

release.yml builds the production bundle, packs it deterministically, attests it with actions/attest-build-provenance (keyless Sigstore: Fulcio certificate for the workflow identity, Rekor transparency log), verifies the attestation with gh attestation verify and only then creates the tag and Release with the asset attached. docs/verifying-a-release.md gives the download and verify commands and states what the signature proves. The first signed release is the next one after v0.11.0; see section 0 item 1 before entering this.

The app parses no file, URL or network response supplied by a user (docs/security-assurance-case.md § 2). The inputs it does take are validated: aircraft and device data pass validateAircraft in packages/core/src/validator/ (typed contract plus structural findings) in CI for every registered aircraft; localStorage values are read through a guarded accessor and checked against an allow-list (isLanguage) before use; pointer and keyboard events reach typed control models only. TypeScript strict with exactOptionalPropertyTypes and noUncheckedIndexedAccess types the rest.

Strict CSP shipped in the build (apps/web/src/csp.ts: default-src 'self', object-src 'none', form-action 'none', base-uri 'self', no inline script or style) and asserted by every e2e spec; least-privilege workflow permissions with contents: read at the top level; SHA-pinned actions in codeql.yml and release.yml; build and signing in separate jobs so build-time code cannot mint an OIDC token; no repository secrets.

docs/security-assurance-case.md: claims, system description, trust boundaries, threat model, secure-design argument, common-weakness table, known gaps and accepted risk, assumptions, maintenance triggers. https://github.com/DocGerd/cockpit-procedure-trainer/blob/develop/docs/security-assurance-case.md

CodeQL's default javascript-typescript query suite (security queries for XSS, injection, prototype pollution, path traversal, unsafe DOM sinks) on every pull request, push and weekly; ESLint typescript-eslint strict in the required check.

The project's own code is entirely TypeScript, a memory-safe language; there is no C/C++ component.