feat: cross-platform CI matrix and runtime sandbox hardening

.clang-tidy

@@ -0,0 +1,10 @@
+---
+Checks: >
+  clang-analyzer-*,
+  bugprone-*,
+  cert-*,
+  -cert-err58-cpp
+WarningsAsErrors: ""
+HeaderFilterRegex: ".*"
+FormatStyle: none
+...

.clangd

@@ -0,0 +1,12 @@
+CompileFlags:
+  CompilationDatabase: build
+  Add:
+    - -I./build/config
+    - -I.
+    - -I./src
+    - -I./src/platform
+    - -I./third_party
+Diagnostics:
+  UnusedIncludes: None
+  Suppress:
+    - pp_file_not_found

.codespell-ignore-words.txt

@@ -0,0 +1,2 @@
+te
+caf

.devcontainer/devcontainer.json

@@ -0,0 +1,31 @@
+{
+  "name": "spine dev",
+  "image": "mcr.microsoft.com/devcontainers/cpp:ubuntu-24.04",
+  "features": {
+    "ghcr.io/devcontainers/features/common-utils:2": {
+      "installZsh": true
+    },
+    "ghcr.io/devcontainers/features/github-cli:1": {}
+  },
+  "postCreateCommand": "sudo apt-get update && sudo apt-get install -y libsnmp-dev libmariadb-dev-compat libssl-dev libsystemd-dev pkg-config cmake ninja-build cppcheck clang-tools && cmake -G Ninja -S . -B build -DSPINE_BUILD_MAIN=ON && cmake --build build -j",
+  "customizations": {
+    "vscode": {
+      "extensions": [
+        "ms-vscode.cpptools",
+        "llvm-vs-code-extensions.vscode-clangd",
+        "twxs.cmake",
+        "ms-vscode.cmake-tools",
+        "github.vscode-github-actions",
+        "github.vscode-pull-request-github"
+      ],
+      "settings": {
+        "C_Cpp.intelliSenseEngine": "disabled",
+        "clangd.arguments": [
+          "--background-index",
+          "--compile-commands-dir=build"
+        ]
+      }
+    }
+  },
+  "remoteUser": "vscode"
+}

.dockerignore

@@ -1,10 +1,19 @@
-# Test fixtures and CI scripts -- not needed for the spine build
-tests/
+# Test fixtures and CI scripts -- allowed for test images
+# tests/
 .git/
-*.md
-config/
+.github/
+.claude/
+.omc/
+.worktrees/
+build/
+build-*/
+# build-reports/
+# *.md
 m4/
 autom4te.cache/
-.omc/
-*.conf.dist
 *.log
+*.o
+*.a
+*.so
+*.dylib
+.php-cs-fixer.cache

.github/ISSUE_TEMPLATE/bug_report.md

@@ -34,7 +34,7 @@ If applicable, add screenshots to help explain your problem.
 **Compiling (please complete the following information):**
 
  - compiler: [e.g. clang or gcc 5.4.0]
- - autoconf: [e.g. autoconf 2.69]
+ - cmake: [e.g. cmake 3.22]
  - glibc: [e.g. 2.23]
  - source: [e.g. release or github]
 

.github/actions/install-apt-deps/action.yml

@@ -0,0 +1,30 @@
+name: Install apt dependencies
+description: Update apt cache and install a whitespace-delimited package list.
+inputs:
+  packages:
+    description: Whitespace-delimited package names to install.
+    required: true
+runs:
+  using: composite
+  steps:
+    - name: Install packages
+      shell: bash
+      env:
+        INSTALL_APT_DEPS_PACKAGES: ${{ inputs.packages }}
+      run: |
+        set -euo pipefail
+        # Reject anything outside the apt-package grammar. Callers pass a
+        # static whitespace-delimited list; this blocks shell metacharacters
+        # even though the input comes from workflow YAML.
+        # tr-d approach: strip allowed chars (alnum, . _ + - space tab);
+        # anything remaining is disallowed. The \- escapes hyphen so it is
+        # not treated as a range specifier by tr.
+        _bad=$(printf '%s' "$INSTALL_APT_DEPS_PACKAGES" | LC_ALL=C tr -d 'A-Za-z0-9._+\- \t')
+        if [ -n "$_bad" ]; then
+          echo "install-apt-deps: rejecting packages string with disallowed characters: $_bad" >&2
+          exit 2
+        fi
+        unset _bad
+        sudo apt-get update
+        # shellcheck disable=SC2086 # intentional word-splitting of validated list
+        sudo apt-get install -y $INSTALL_APT_DEPS_PACKAGES

.github/dependabot.yml

@@ -0,0 +1,84 @@
+version: 2
+
+updates:
+  # Workflow actions are supply-chain dependencies. Keep them current, but
+  # group routine updates so the PR queue stays reviewable.
+  - package-ecosystem: github-actions
+    directory: /
+    target-branch: develop
+    schedule:
+      interval: weekly
+      day: monday
+      time: '06:00'
+      timezone: America/Los_Angeles
+    open-pull-requests-limit: 5
+    cooldown:
+      default-days: 7
+    groups:
+      actions:
+        patterns: ['*']
+    labels: [dependencies, github-actions]
+    commit-message:
+      prefix: ci
+      include: scope
+
+  # The production image and the SNMPv3 integration image are maintained
+  # independently, so each directory gets its own bounded update stream.
+  - package-ecosystem: docker
+    directory: /docker
+    target-branch: develop
+    schedule:
+      interval: weekly
+      day: tuesday
+      time: '06:00'
+      timezone: America/Los_Angeles
+    open-pull-requests-limit: 3
+    cooldown:
+      default-days: 7
+    groups:
+      docker:
+        patterns: ['*']
+    labels: [dependencies, docker]
+    commit-message:
+      prefix: build
+      include: scope
+
+  - package-ecosystem: docker
+    directory: /tests/snmpv3
+    target-branch: develop
+    schedule:
+      interval: weekly
+      day: tuesday
+      time: '06:00'
+      timezone: America/Los_Angeles
+    open-pull-requests-limit: 3
+    cooldown:
+      default-days: 7
+    groups:
+      docker:
+        patterns: ['*']
+    labels: [dependencies, docker, tests]
+    commit-message:
+      prefix: test
+      include: scope
+
+  # Tabler is the only checked-in Node package. Keep application and tooling
+  # updates together because the package is built and linted as one unit.
+  - package-ecosystem: npm
+    directory: /include/tabler
+    target-branch: develop
+    schedule:
+      interval: weekly
+      day: wednesday
+      time: '06:00'
+      timezone: America/Los_Angeles
+    open-pull-requests-limit: 5
+    cooldown:
+      default-days: 7
+    groups:
+      npm:
+        patterns: ['*']
+    labels: [dependencies, javascript]
+    commit-message:
+      prefix: build
+      include: scope

.github/instructions/instructions.md

@@ -1,23 +1,22 @@
 # GitHub Copilot Instructions for spine
 
 spine is the high-performance C poller for Cacti. It is a multi-threaded
-POSIX C99 program using pthreads, net-snmp, and libmariadb, built with
-GNU autotools.
+POSIX program using pthreads, net-snmp, libmariadb, and libuv, built with
+CMake.
 
 ## Language and standard
 
-- C99. Mixed declarations and statements are allowed. No VLAs.
+- C17. Mixed declarations and statements are allowed. No VLAs.
 - POSIX.1-2008 is the baseline. Do not use glibc extensions unless they
   already appear in the codebase.
 - All new files must include the LGPL-2.1 header block found in `spine.c`.
 
 ## Build system
 
-- `configure.ac` + `Makefile.am`. Run `./bootstrap` to regenerate.
-- AC_PREREQ is 2.69. Do not add macros deprecated before autoconf 2.69
-  (AC_C_CONST, AC_STRUCT_TM, RETSIGTYPE, etc.). AC_HEADER_TIME is used
-  and must be kept because common.h guards with TIME_WITH_SYS_TIME.
-- `make -j$(nproc) CFLAGS="-Wall -Wextra"` must produce zero warnings.
+- CMake >= 3.15, driven from `CMakeLists.txt` with helpers under `cmake/`.
+- `cmake -S . -B build -G Ninja && cmake --build build` is the canonical
+  build. CMakePresets.json exposes `ci-smoke` and `ci-main`.
+- `cmake --build build` with `-Wall -Wextra` must produce zero warnings.
 
 ## Code conventions
 
@@ -32,6 +31,9 @@ GNU autotools.
   bounds.
 - String buffers: declare length constants; do not use magic numbers for
   buffer sizes.
+- Public APIs: prefer `const char *` for input-only string parameters.
+  Document ownership expectations in function comments when transfer is not
+  obvious.
 
 ## SNMP
 
@@ -62,6 +64,8 @@ GNU autotools.
 - Before opening a PR, run `cppcheck --enable=all --std=c11 *.c *.h`
   locally and fix all errors (warnings are informational).
 - flawfinder level-5 hits fail CI; lower levels are informational.
+- CI has a guardrail for newly introduced unsafe C APIs (`sprintf`, `strcpy`,
+  `strcat`, `gets`, `vsprintf`) and fails closed on additions.
 
 ## Commits and PRs
 

.github/lint-codespell-globs.txt

@@ -0,0 +1,8 @@
+*.c
+*.h
+*.md
+*.txt
+*.yml
+*.yaml
+CMakeLists.txt
+cmake/*.cmake

.github/lint-shell-files.txt

@@ -0,0 +1,10 @@
+debug
+package
+scripts/copyright_year.sh
+scripts/lint-codespell.sh
+scripts/lint-shell.sh
+scripts/preflight.sh
+scripts/test-distros.sh
+scripts/test-vagrant.sh
+scripts/test-workflows.sh
+scripts/verify.sh

.github/nightly-leak-baseline.json

@@ -0,0 +1,12 @@
+{
+  "valgrind": {
+    "max_definitely_lost_bytes": 0,
+    "max_indirectly_lost_bytes": 0,
+    "max_possibly_lost_bytes": 0,
+    "max_error_summary": 0
+  },
+  "asan": {
+    "max_asan_error_events": 0,
+    "max_ubsan_error_events": 0
+  }
+}

.github/perf-baseline.json

@@ -0,0 +1,20 @@
+{
+  "sample_size": 20,
+  "commands": {
+    "./spine --version": {
+      "median_seconds": 0.35,
+      "allowed_regression_factor": 1.5,
+      "max_rss_kb": 32768
+    },
+    "./spine --help": {
+      "median_seconds": 0.45,
+      "allowed_regression_factor": 1.5,
+      "max_rss_kb": 40960
+    },
+    "snmpget -v2c -c public -On 127.0.0.1:1161 1.3.6.1.2.1.1.3.0": {
+      "median_seconds": 0.25,
+      "allowed_regression_factor": 2.0,
+      "max_rss_kb": 32768
+    }
+  }
+}