Macro-Deck

GitHub requires 2FA as of March 2023.

Macro Deck uses GitHub for version control. New collaborators must be explicitly granted access to the repository, with permissions assigned according to their responsibilities. GitHub's role-based access control ensures that collaborators only receive the permissions assigned to them.

The project's primary branch is protected using GitHub repository rulesets. Direct commits are blocked, and changes must be submitted through pull requests before they can be merged.

The project's primary branch is protected using GitHub repository rulesets. Branch deletion is restricted to prevent accidental or unauthorized removal of the primary branch.

Macro Deck uses GitHub Actions for CI/CD. Untrusted inputs, such as pull request metadata, branch names, and user-provided parameters, are handled through GitHub Actions contexts and environment variables rather than being directly interpolated into executable shell commands. Inputs are validated where necessary to prevent command injection and unintended workflow execution.

Macro Deck uses GitHub Actions for CI/CD. Workflows triggered by pull requests from forks run with restricted permissions and do not receive repository secrets. Privileged credentials, such as signing certificates, publishing tokens, and deployment secrets, are reserved for trusted release workflows and are not exposed to untrusted code.

All official Macro Deck project channels, including the website, documentation, GitHub repositories, community platforms, and the Macro Deck Store, are accessible via HTTPS. Encrypted connections are used to protect communication with these services.

All official Macro Deck distribution channels, including GitHub Releases and the official website, use HTTPS to ensure encrypted and authenticated connections and protect against adversary-in-the-middle attacks. Additionally, the Macro Deck installers are digitally signed using code signing certificates, providing an additional layer of authenticity and integrity verification.

Macro Deck uses GitHub Actions secrets to securely store sensitive credentials, such as signing certificates, API tokens, and publishing credentials, outside the version control system. Sensitive configuration files are excluded from version control where applicable. Repository secret scanning is used to help detect accidentally committed credentials.

Macro Deck provides publicly accessible user documentation at https://docs.macro-deck.app/, covering installation, initial setup, configuration, and the basic functionality of the application. The documentation is maintained alongside the project to help users get started and use Macro Deck's core features.

Macro Deck uses GitHub Issues for defect reporting. Users can report bugs through the project's GitHub repository at https://github.com/Macro-Deck-App/Macro-Deck/issues/new/choose. Dedicated issue templates guide users through providing relevant information, including a description of the problem, steps to reproduce it, expected behavior, and environment details.

Macro Deck provides multiple public channels for discussing proposed changes, feature requests, and usage difficulties. GitHub Issues and Pull Requests allow users and contributors to propose features, report problems, and discuss implementation details. Additionally, the official Macro Deck Discord community provides dedicated channels for support, feedback, feature suggestions, and general discussions.

Macro Deck accepts public contributions through GitHub. The project's contribution guidelines describe how contributors can report issues, propose changes, and submit pull requests. GitHub Issues and Pull Requests are used to coordinate contributions and review proposed changes before merging.

The Apache-2.0 license for the repository contents is approved by the Open Source Initiative (OSI).

The Apache-2.0 license is approved by the Open Source Initiative (OSI). [floss_license]

Macro Deck's source code license is maintained in the LICENSE file at the root of the GitHub repository, making the licensing terms publicly accessible to users and contributors.

https://github.com/Macro-Deck-App/Macro-Deck/blob/main/LICENSE

Macro Deck's source code releases include the project's LICENSE file in the repository root. The license is included in the source archives provided through GitHub Releases, ensuring that the applicable licensing terms are available alongside the released source code.

https://github.com/Macro-Deck-App/Macro-Deck/releases

Macro Deck's source code is publicly accessible without authentication through its official GitHub repository at https://github.com/Macro-Deck-App/Macro-Deck. The repository provides a permanent URL where anyone can browse, clone, and review the project's source code.

Macro Deck uses Git and GitHub for version control. The repository maintains a publicly accessible commit history that records code changes, their authors, and timestamps. Each commit includes a unique identifier and can be inspected through GitHub, providing traceability of changes to the project's source code.

https://github.com/Macro-Deck-App/Macro-Deck/commits/main/

Macro Deck maintains its direct dependencies in version-controlled package manifests across its technology stack. .NET dependencies are declared using NuGet PackageReference entries in C# project files, with versions centrally managed through Directory.Packages.props. JavaScript and Angular dependencies are declared in package.json files, with package-lock.json providing reproducible dependency resolution. The Tauri-based desktop bootstrapper uses Rust's Cargo dependency management. These dependency manifests are maintained alongside the source code in the public GitHub repository.

Macro Deck maintains a publicly accessible list of its project repositories in the official GitHub organization profile README. The documentation provides direct links and descriptions of the repositories and their purposes.

https://github.com/Macro-Deck-App/.github/blob/main/profile/README.md#repositories

Macro Deck does not store generated executable artifacts in its source code repository. Compiled binaries, installers, and other build outputs are generated through the CI/CD pipeline and distributed separately via GitHub Releases. Build output directories are excluded from version control using .gitignore rules.

Macro Deck keeps its source code and build configurations in human-readable formats. Compiled binaries and other non-reviewable build artifacts are distributed separately through GitHub Releases rather than being committed to the source repository. Binary assets required by the project, such as images and icons, are limited to resources necessary for the application's functionality.

Macro Deck provides security contact information through its GitHub repository's security policy. Security vulnerabilities can be reported privately using GitHub's vulnerability reporting feature, allowing security issues to be disclosed without publicly exposing sensitive details.

https://github.com/Macro-Deck-App/Macro-Deck/security/policy