Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
99 changes: 99 additions & 0 deletions .github/workflows/release.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,99 @@
name: Release

on:
push:
branches:
- master
workflow_dispatch:

# Required to create the version tag and GitHub release with the built assets.
permissions:
contents: write
Comment on lines +10 to +11

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

Limit contents: write to publish.

Line 11 grants repository write access to all four build jobs. A compromised build step can modify repository contents or release state. Set the workflow default to contents: read, then grant contents: write only to publish. GitHub recommends read-only default permissions and job-specific escalation. (docs.github.com)

Proposed fix
 permissions:
-  contents: write
+  contents: read
...
   publish:
     name: Publish GitHub release
+    permissions:
+      contents: write
     needs: build
🧰 Tools
🪛 zizmor (1.29.0)

[error] 11-11: overly broad permissions (excessive-permissions): contents: write is overly broad at the workflow level

(excessive-permissions)

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/release.yml around lines 10 - 11, Set the workflow-level
contents permission to read, then add a job-level contents: write permission
only to the publish job. Keep the other build jobs restricted to the read-only
default.

Source: Linters/SAST tools


# Never publish two releases from the same branch at once.
concurrency:
group: release-master
cancel-in-progress: false

jobs:
build:
name: Build ${{ matrix.target }}
# Manual dispatches are also constrained to master.
if: github.ref == 'refs/heads/master'
strategy:
fail-fast: false
matrix:
include:
- os: ubuntu-24.04
target: x86_64-unknown-linux-gnu
- os: ubuntu-24.04-arm
target: aarch64-unknown-linux-gnu
- os: macos-15-intel
target: x86_64-apple-darwin
- os: macos-15
target: aarch64-apple-darwin
runs-on: ${{ matrix.os }}
steps:
- uses: actions/checkout@v4

- uses: dtolnay/rust-toolchain@stable
Comment on lines +37 to +39

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== workflow excerpt =="
sed -n '1,110p' .github/workflows/release.yml | cat -n

echo
echo "== action uses in release workflow =="
rg -n "uses:" .github/workflows/release.yml

Repository: imsudiproy/uniproc

Length of output: 3869


Pin each action to a verified full commit SHA.

Lines 37, 39, 58, 69, and 72 use mutable action tags for actions/checkout, dtolnay/rust-toolchain, actions/upload-artifact, and actions/download-artifact. Pin these actions to verified 40-character commit SHAs; keep the release tag in a trailing comment for update tooling. Use a full commit SHA, which is an immutable GitHub Actions reference.

Also applies to: 58, 69, 72

🧰 Tools
🪛 zizmor (1.29.0)

[warning] 37-37: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/release.yml around lines 37 - 39, Update the action
references in the release workflow for actions/checkout, dtolnay/rust-toolchain,
actions/upload-artifact, and actions/download-artifact to verified 40-character
commit SHAs, retaining each current release tag in a trailing comment for update
tooling.

with:
targets: ${{ matrix.target }}

- name: Build release binary
run: cargo build --locked --release --target ${{ matrix.target }}

- name: Package archive and checksum
shell: bash
env:
TARGET: ${{ matrix.target }}
run: |
set -euo pipefail
mkdir -p dist
archive="dist/uniproc-${TARGET}.tar.gz"
tar -C "target/${TARGET}/release" -czf "${archive}" uniproc
shasum -a 256 "${archive}" > "${archive}.sha256"

- name: Upload release asset
uses: actions/upload-artifact@v4
with:
name: uniproc-${{ matrix.target }}
path: dist/
if-no-files-found: error

publish:
name: Publish GitHub release
needs: build
runs-on: ubuntu-24.04
steps:
- uses: actions/checkout@v4

- name: Download release assets
uses: actions/download-artifact@v4
with:
path: dist
merge-multiple: true

- name: Read release version
id: version
shell: bash
run: |
set -euo pipefail
version="$(sed -nE 's/^version = "([^"]+)"/\1/p' Cargo.toml | head -n 1)"
test -n "${version}"
echo "tag=v${version}" >> "$GITHUB_OUTPUT"

- name: Create release and tag
env:
GH_TOKEN: ${{ github.token }}
TAG: ${{ steps.version.outputs.tag }}
TARGET: ${{ github.sha }}
run: |
if gh release view "$TAG" >/dev/null 2>&1; then
echo "Release $TAG already exists; bump package.version to publish a new release."
exit 0
fi
gh release create "$TAG" dist/* \
--target "$TARGET" \
--title "UniProc $TAG" \
--generate-notes
78 changes: 70 additions & 8 deletions Cargo.lock

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 2 additions & 0 deletions Cargo.toml
Original file line number Diff line number Diff line change
Expand Up @@ -8,3 +8,5 @@ sysinfo = "0.37.0"
clap = { version = "4.5", features = ["derive"] }
ratatui = "0.29.0"
crossterm = "0.29.0"
serde = { version = "1.0", features = ["derive"] }
serde_json = "1.0"
48 changes: 21 additions & 27 deletions readme.md
Original file line number Diff line number Diff line change
@@ -1,36 +1,30 @@
# 🚧 UniProc — Under Construction 🚧
# UniProc

> **Status:** Work in Progress
> Expect breaking changes, missing features, and occasional dragons 🐉
UniProc is a terminal-first process monitor built with Rust and Ratatui. It monitors one process safely by PID or exact name, with a responsive dashboard and script-friendly exports.

---
## Features

## 📌 About
- Live CPU, resident memory, disk I/O, and history charts
- System-wide network traffic shown alongside the selected process (per-process network I/O is not portable)
- Pause, clear-history, and quit controls
- Exact process-name lookup that refuses ambiguous matches
- Bounded in-memory history and reliable terminal cleanup
- CSV and pretty JSON export with byte-accurate fields

**UniProc** Monitors process by PID or name.
Right now, we’re actively building the foundation — so things may be unstable, incomplete, or change without notice.
## Use

---

## 🛠 Current Status

- [x] Project scaffolding set up
- [x] Initial build works locally
- [ ] Core functionality implementation
- [ ] Tests and documentation
- [ ] First public release

>⚠️ Windows support isn’t fully tested yet; it’s still experimental.
If it starts failing in CI, we’ll disable Windows runs immediately.
---

## Getting Started
```bash
cargo run -- --pid 1234
cargo run -- --name my-service --interval 500
cargo run -- --pid 1234 --duration 60 --csv metrics.csv
cargo run -- --pid 1234 --duration 60 --json metrics.json
```

> ⚠️ This project is not production-ready yet.
Use `p` or `Space` to pause the dashboard, `c` to clear its history, and `q` or `Esc` to quit. Export modes require `--duration` so they always finish predictably.

Clone and build locally:
## Development

```bash
git clone https://github.com/imsudiproy/uniproc.git
cd uniproc
cargo build
cargo test
cargo fmt --check
```
1 change: 1 addition & 0 deletions src/core/mod.rs
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
pub mod monitor;
Loading
Loading