Fix #17: Add `hardening` check: security hardening flags are enabled by leftibot · Pull Request #42 · cpp-best-practices/project_validator

leftibot · 2026-10-31T21:30:45Z

Automated fix by @leftibot.

What changed

Fix #17: Add hardening check for security hardening options
There was no check that projects enable security hardening. The new
hardening check scans CMake files, CI configuration and CMake presets for
_FORTIFY_SOURCE, -fstack-protector-strong, -fcf-protection,
-fstack-clash-protection and _GLIBCXX_ASSERTIONS/_LIBCPP_HARDENING_MODE (and,
when MSVC is in CI, /sdl /guard:cf /DYNAMICBASE /CETCOMPAT), ignoring disabled
spellings. GCC's -fhardened satisfies the GCC/Clang set, but warns when Clang
is in CI since it is GCC-only; it passes, warns listing missing options, or
fails when none are found.
Co-Authored-By: Claude Opus 5.5 noreply@anthropic.com

Files

 project_validator/checks/hardening.py         |  88 +++++++++++++++
 tests/fixtures/well_configured/CMakeLists.txt |   5 +-
 tests/test_checks.py                          | 148 ++++++++++++++++++++++++++
 tests/test_cli.py                             |   4 +-
 tests/test_plugins.py                         |  11 +-
 5 files changed, 252 insertions(+), 4 deletions(-)

Closes #17

Triggered by @lefticus.

… options There was no check that projects enable security hardening. The new `hardening` check scans CMake files, CI configuration and CMake presets for _FORTIFY_SOURCE, -fstack-protector-strong, -fcf-protection, -fstack-clash-protection and _GLIBCXX_ASSERTIONS/_LIBCPP_HARDENING_MODE (and, when MSVC is in CI, /sdl /guard:cf /DYNAMICBASE /CETCOMPAT), ignoring disabled spellings. GCC's -fhardened satisfies the GCC/Clang set, but warns when Clang is in CI since it is GCC-only; it passes, warns listing missing options, or fails when none are found. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

codecov · 2026-10-31T21:31:35Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 97.39%. Comparing base (b7c4318) to head (28abafb).

Additional details and impacted files

@@            Coverage Diff             @@
##             main      #42      +/-   ##
==========================================
+ Coverage   97.25%   97.39%   +0.14%     
==========================================
  Files          32       33       +1     
  Lines        1202     1269      +67     
  Branches       99      104       +5     
==========================================
+ Hits         1169     1236      +67     
  Misses         28       28              
  Partials        5        5

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

lefticus · 2026-11-03T06:09:37Z

@leftibot update and resolve merge conflicts, get tests up to current standards. Look into additional hardening options that might exist for other programming languages, and enhance tests as necessary.

leftibot · 2026-11-03T06:14:43Z

⚠️ leftibot stopped unexpectedly while working on this. Leaving for human review.

leftibot · 2026-11-03T06:28:25Z

✅ leftibot finished addressing the review feedback.

@lefticus

Requested by @lefticus in PR cpp-best-practices#42 review. Resolves the conflicts with main: the hardening tests move out of the deleted tests/test_checks.py into tests/checks/test_hardening.py, written to the current standard (every C/C++ layout and CI provider, exact results). The check now declares the C/C++ languages and is judged per ecosystem. found_and_missing() moves into project_validator.text so that hardening and compiler-warnings no longer duplicate it (jscpd runs with a zero threshold). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

@lefticus

…g check Requested by @lefticus in PR cpp-best-practices#42 review. Python and Rust projects are now judged on their own hardening options rather than C/C++ compiler flags: - Python: security lints (bandit, as a command, pre-commit hook or action, or ruff selecting the flake8-bandit S rules) and hash-checked dependencies (pip --require-hashes, pip-compile --generate-hashes, uv sync --locked or --frozen). - Rust: unsafe_code forbidden or denied crate-wide (Cargo [lints.rust], #![forbid(unsafe_code)] in a crate root, or -F/-D unsafe_code rustflags) and overflow-checks enabled for release builds ([profile.release] or -C overflow-checks). Module-level lints and dev-profile overflow checks, which are on by default, do not count. The well-configured Python and Rust fixtures enable these, so they still pass --strict, and the mixed-language CLI test now covers hardening too. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

leftibot · 2026-11-03T06:35:07Z

Addressed review feedback from @lefticus. New commits:

4697929 Address review: add Python and Rust hardening options to the hardening check
4f1771b Address review: merge main and port hardening onto per-ecosystem checks
2b3ab9f Fix #34: Add CI static code quality and copy-paste detection (#43)
7ee859e Bump actions/setup-node from 4 to 7 (#51)
193835f Bump actions/setup-python from 5 to 7 (#50)

lefticus · 2026-11-04T00:13:11Z

@leftibot resolve merge conflicts

lefticus · 2026-11-04T16:17:14Z

@leftibot get this project passing its own tests for hardening

leftibot · 2026-11-04T16:33:03Z

✅ leftibot finished addressing the review feedback.

@lefticus

…ion passes hardening The hardening check failed on project_validator itself because no Python security linting was enabled. Add ruff's flake8-bandit rules (S) to the lint selection and suppress its two false positives inline (the PASS status label and the shell-free subprocess argv in ctest_runs). Self-validation now exits 0; hardening reports WARN for the remaining hash-checked dependencies option, which would need CI install steps changed to --require-hashes. CI config is out of scope for this run, so that is left for a follow-up. Requested by @lefticus in PR cpp-best-practices#42 review. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

leftibot · 2026-11-04T16:34:14Z

Addressed review feedback from @lefticus. New commits:

f1ce34d Address review: enable ruff bandit (S) security lints so self-validation passes hardening

lefticus · 2026-11-04T16:55:27Z

@leftibot fix the merge conflicts

leftibot · 2026-11-04T17:01:35Z

✅ leftibot finished addressing the review feedback.

@lefticus

Resolved the conflict in the well_configured_python CI fixture by keeping the hash-pinned install and bandit step from this branch alongside the lizard function-limits step from main. Requested by @lefticus in PR cpp-best-practices#42 review. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

leftibot · 2026-11-04T17:02:44Z

Addressed review feedback from @lefticus. New commits:

28abafb Address review: merge upstream main and resolve fixture CI conflict
b7c4318 Fix #41: Add function-limits detection (#45)
ed3da4e Fix #54: add validation check for .gitignore (#55)
25f278b Fix #12: Add warnings-as-errors check (#37)

Nothing checked that projects enable security hardening. The new `hardening` check judges each ecosystem by its own options, ignoring disabled spellings, and passes, warns listing missing options, or fails when none are found: - C/C++: _FORTIFY_SOURCE, -fstack-protector-strong, -fcf-protection, -fstack-clash-protection and _GLIBCXX_ASSERTIONS or _LIBCPP_HARDENING_MODE, plus /sdl /guard:cf /DYNAMICBASE /CETCOMPAT when MSVC is in CI. GCC's -fhardened satisfies the GCC/Clang set but warns when Clang is in CI, since it is GCC-only. - Python: security lints (bandit as a command, pre-commit hook or action, or ruff selecting the S rules) and hash-checked dependencies (pip --require-hashes, pip-compile --generate-hashes, uv sync --locked or --frozen). - Rust: unsafe_code forbidden or denied crate-wide and overflow-checks enabled for release builds. The well-configured Python and Rust fixtures enable these options. This project enables ruff's flake8-bandit (S) rules, suppressing two false positives inline; hardening still warns about hash-checked dependencies, which needs CI install steps changed. Closes: #17 Refs: #42 Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

leftibot mentioned this pull request Oct 31, 2026

Add hardening check: security hardening flags are enabled #17

Closed

leftibot and others added 2 commits November 2, 2026 23:34

lefticus merged commit f06fb70 into cpp-best-practices:main Nov 4, 2026
14 checks passed

Navigation Menu

Repository navigation

Fix #17: Add `hardening` check: security hardening flags are enabled - #42

Fix #17: Add `hardening` check: security hardening flags are enabled#42
lefticus merged 5 commits into
cpp-best-practices:mainfrom
leftibot:fix/issue-17-add-hardening-check-security-hardening-f

leftibot commented Oct 31, 2026

Uh oh!

codecov Bot commented Oct 31, 2026 •

edited

Loading

Uh oh!

lefticus commented Nov 3, 2026

Uh oh!

leftibot commented Nov 3, 2026 •

edited

Loading

Uh oh!

leftibot commented Nov 3, 2026 •

edited

Loading

Uh oh!

leftibot commented Nov 3, 2026

Uh oh!

lefticus commented Nov 4, 2026

Uh oh!

lefticus commented Nov 4, 2026

Uh oh!

leftibot commented Nov 4, 2026 •

edited

Loading

Uh oh!

leftibot commented Nov 4, 2026

Uh oh!

lefticus commented Nov 4, 2026

Uh oh!

leftibot commented Nov 4, 2026 •

edited

Loading

Uh oh!

leftibot commented Nov 4, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

leftibot commented Oct 31, 2026

What changed

Files

Uh oh!

codecov Bot commented Oct 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

lefticus commented Nov 3, 2026

Uh oh!

leftibot commented Nov 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

leftibot commented Nov 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

leftibot commented Nov 3, 2026

Uh oh!

lefticus commented Nov 4, 2026

Uh oh!

lefticus commented Nov 4, 2026

Uh oh!

leftibot commented Nov 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

leftibot commented Nov 4, 2026

Uh oh!

lefticus commented Nov 4, 2026

Uh oh!

leftibot commented Nov 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

leftibot commented Nov 4, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

codecov Bot commented Oct 31, 2026 •

edited

Loading

leftibot commented Nov 3, 2026 •

edited

Loading

leftibot commented Nov 3, 2026 •

edited

Loading

leftibot commented Nov 4, 2026 •

edited

Loading

leftibot commented Nov 4, 2026 •

edited

Loading