Skip to content

v0.2.0: Windows Server 2025 support, CI/release pipeline, SDLC guardrails - #1

Merged
spydisec merged 2 commits into
mainfrom
feat/sdlc-and-server-2025
Aug 31, 2026
Merged

v0.2.0: Windows Server 2025 support, CI/release pipeline, SDLC guardrails#1
spydisec merged 2 commits into
mainfrom
feat/sdlc-and-server-2025

Conversation

@spydisec

Copy link
Copy Markdown
Owner

What

  • Windows Server 2025 support: new SMB signing/encryption capability auditing (AuditClientDoesNotSupport* / AuditServerDoesNotSupport* via Set-Smb*Configuration, events 3021/3022 and 31998/31999), OS-gated at runtime — reported NOT APPLICABLE on 2019/2022. SMBServer/Audit and SmbClient/Audit channels sized. README notes on NTLMv1 removal and SMB NTLM blocking in Server 2025.
  • CI (.github/workflows/ci.yml): PSScriptAnalyzer lint (config in PSScriptAnalyzerSettings.psd1), kit self-checks on both Windows PowerShell 5.1 and PowerShell 7 (tests/Invoke-KitChecks.ps1), DevSkim security scan with SARIF upload to the Security tab.
  • Release (.github/workflows/release.yml): pushing a v* tag re-runs the checks on the tagged commit, then publishes a GitHub Release with WinLogKit-vX.Y.Z.zip + SHA256SUMS.txt.
  • Dependabot for GitHub Actions (weekly), CHANGELOG.md, contributing/SDLC section in the README.
  • Bug fix caught by the new harness: $PSScriptRoot-based parameter defaults are empty when scripts are invoked via powershell.exe -File in 5.1 — defaults now resolve in the script body across all five scripts.

Verification

  • tests/Invoke-KitChecks.ps1 passes locally under Windows PowerShell 5.1 (parse, settings consistency, builder round-trip over all 79 items, tier defaults)
  • Invoke-ScriptAnalyzer clean locally with the repo settings
  • SMB audit facts grounded in Microsoft Learn (What's new in Windows Server 2025, Block NTLM connections on SMB)

🤖 Generated with Claude Code

…ails

- Server 2025: SMB signing/encryption capability auditing via the SMB
  configuration cmdlets (events 3021/3022, 31998/31999), OS-gated with
  NOT APPLICABLE on 2019/2022; SMBServer/Audit and SmbClient/Audit channels
  sized; README notes on NTLMv1 removal and SMB NTLM blocking
- CI workflow: PSScriptAnalyzer lint, kit self-checks on Windows PowerShell
  5.1 and PowerShell 7, DevSkim security scan with SARIF upload
- Release workflow: version tags produce a GitHub Release with
  WinLogKit-vX.Y.Z.zip and SHA256SUMS.txt after re-running the checks
- Dependabot for GitHub Actions; CHANGELOG.md; tests/Invoke-KitChecks.ps1
- Fix: $PSScriptRoot-based parameter defaults resolved in script bodies
  (empty during param-default evaluation under powershell.exe -File)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@github-advanced-security

Copy link
Copy Markdown

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

  • The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
  • Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
  • You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

Verified against the actions' release tags (checkout v7.0.1 current,
node24 runtime; codeql-action major v4; DevSkim-Action v1.0.16 stays @v1).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@spydisec
spydisec merged commit dba5d10 into main Aug 31, 2026
4 checks passed
@spydisec
spydisec deleted the feat/sdlc-and-server-2025 branch August 31, 2026 02:54
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants