v1.2 - snake, DS3231 RTC, gzip, hardening and more

Author: Tech1k

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,8 @@
+blank_issues_enabled: true
+contact_links:
+  - name: Question or discussion
+    url: https://github.com/Tech1k/helloesp/discussions
+    about: For questions, ideas, or general chat. Issues are for bug reports.
+  - name: Security vulnerability
+    url: https://github.com/Tech1k/helloesp/security/policy
+    about: See SECURITY.md for how to report security issues.

.github/dependabot.yml

@@ -0,0 +1,11 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    commit-message:
+      prefix: "ci"
+    labels:
+      - "dependencies"
+      - "ci"

.github/workflows/build.yml

@@ -4,13 +4,14 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/cache@v4
+      - uses: actions/checkout@v6
+      - uses: actions/cache@v5
         with:
           path: ~/.platformio
-          key: pio-${{ hashFiles('platformio.ini') }}
-      - uses: actions/setup-python@v5
+          key: pio-${{ runner.os }}-${{ hashFiles('platformio.ini') }}
+      - uses: actions/setup-python@v6
         with:
           python-version: '3.x'
-      - run: pip install platformio
+      - run: pip install 'platformio==6.1.*'
       - run: pio run
+      - run: pio check --fail-on-defect=high

.github/workflows/codeql.yml

@@ -0,0 +1,28 @@
+name: CodeQL
+on:
+  push:
+    branches: [master]
+  pull_request:
+    branches: [master]
+  schedule:
+    - cron: "0 5 * * 0"
+
+jobs:
+  analyze:
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [javascript]
+    steps:
+      - uses: actions/checkout@v6
+      - uses: github/codeql-action/init@v4
+        with:
+          languages: ${{ matrix.language }}
+      - uses: github/codeql-action/analyze@v4
+        with:
+          category: "/language:${{ matrix.language }}"

.github/workflows/lighthouse.yml

@@ -0,0 +1,28 @@
+name: Lighthouse CI
+on:
+  push:
+    branches: [master]
+  schedule:
+    - cron: "0 12 * * 1"
+  workflow_dispatch:
+
+jobs:
+  lighthouse:
+    name: Lighthouse (${{ matrix.preset }})
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      statuses: write
+    strategy:
+      fail-fast: false
+      matrix:
+        preset: [desktop, mobile]
+    steps:
+      - uses: actions/checkout@v6
+      - uses: actions/setup-node@v6
+        with:
+          node-version: "22"
+      - run: npm install -g @lhci/cli@0.15.x
+      - run: lhci autorun ${{ matrix.preset == 'desktop' && '--collect.settings.preset=desktop' || '' }}
+        env:
+          LHCI_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.gitignore

@@ -3,3 +3,8 @@
 .cache
 compile_commands.json
 data/config.txt
+data/logs/
+data/stats/
+data/records/
+*.bak
+*.tmp

README.md

@@ -0,0 +1,22 @@
+# Security Policy
+
+If you discover a security issue, please email **hello@tech1k.com** instead of opening a public issue. I'll respond as soon as I can.
+
+## Scope
+
+In scope:
+- Cloudflare Worker (`worker/worker.js`)
+- ESP32 firmware (`src/main.cpp`)
+- Any repository code that could expose credentials or sensitive data
+
+Out of scope:
+- Issues requiring physical access (device is on a wall, behind glass)
+- Social engineering
+- Third-party services like Cloudflare/SMTP2GO/Open-Meteo (report those upstream)
+- Temporary downtime or availability issues
+
+## Notes
+
+This is a hobby project, not a paid bug bounty. Reports are appreciated regardless.
+
+If you'd like credit in the changelog, let me know. If you prefer to stay anonymous, that's fine too.