Add github workflow for doxygen.

[kimkulling]

Summary by CodeRabbit

• Documentation
  • Added automated API documentation generation.
  • Documentation is published to GitHub Pages after updates to the main branch or through manual deployment.

[coderabbitai]

Walkthrough

The pull request adds a GitHub Actions workflow that generates Doxygen documentation and deploys the HTML output to GitHub Pages.

Changes

Doxygen Pages Deployment

Layer / File(s)	Summary
Build and deploy Doxygen documentation .github/workflows/doxygen.yml	Adds triggers for pushes to main and manual dispatch. The workflow installs Doxygen, generates documentation from docs/Doxyfile.in, uploads a Pages artifact, and deploys it with required permissions and concurrency control.

Estimated code review effort: 2 (Simple) | ~10 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the addition of the GitHub Actions workflow for Doxygen documentation.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feature/doxygen_action

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate failed

Failed conditions
C Security Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/doxygen.yml:
- Line 24: Pin the third-party actions at .github/workflows/doxygen.yml lines
24, 37, and 50 to their approved full-length commit SHAs, replacing mutable
version refs while retaining each action’s major version in an inline comment.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 5bbf1ae2-d945-4506-8d7e-b507cf202ab3

📥 Commits

Reviewing files that changed from the base of the PR and between bf62ca3 and 1787eb3.

📒 Files selected for processing (1)

• .github/workflows/doxygen.yml

[coderabbitai]

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== workflow files =="
git ls-files .github/workflows || true

echo "== doxygen workflow excerpt =="
if [ -f .github/workflows/doxygen.yml ]; then
  cat -n .github/workflows/doxygen.yml
fi

echo "== action uses with refs (all workflows) =="
rg -n 'uses:\s*[^#\s]+' .github/workflows || true

Repository: kimkulling/tiny_ui

Length of output: 2130

---

🌐 Web query:

GitHub Actions workflows pin third-party actions immutable commit SHA CWE-829

💡 Result:

Pinning third-party GitHub Actions to an immutable, full-length commit SHA (Secure Hash Algorithm) is a critical security best practice that mitigates supply chain risks associated with CWE-829: Inclusion of Functionality from Untrusted Control Sphere [1][2][3]. When an action is referenced using a mutable tag (e.g., @v4) or a branch name (e.g., @main), the workflow fetches whatever code currently points to that reference at runtime [2][4][5]. If the action's repository is compromised or a malicious actor gains control over the tag, they can silently inject backdoors or malicious logic into your CI/CD pipeline, which often has access to sensitive secrets and tokens [1][2][4][5]. Pinning to a specific 40-character commit SHA ensures that the exact, reviewed version of the code is always executed, providing immutability at the Git level [1][4][3]. This protects against upstream tampering because changing the executed code would require the attacker to generate a SHA-1 collision, which is computationally infeasible for valid Git object payloads [1][6][7]. To maintain this security posture without sacrificing convenience: 1. Pin to the full-length SHA: Use the 40-character commit hash in your workflow file [1][3][5]. 2. Maintain human-readable labels: Append the version tag as a comment (e.g., uses: actions/checkout@b4ffde6 # v4.1.0) [2][4][5]. This allows tools like Dependabot and Renovate to continue tracking version updates and opening upgrade pull requests while keeping your workflow pinned to an immutable hash [4][3][5]. 3. Enable security policies: Organizations can enforce this practice by configuring repository or organization-level policies to require actions to be pinned to a full-length commit SHA [1]. This practice directly addresses CWE-829 by preventing the inclusion of potentially untrusted or unauthorized code from external sources [2][8][9]. The CodeQL security analysis engine specifically flags unpinned actions under the CWE-829 category because they introduce an unacceptable risk of executing untrusted code [6][10][8].

Citations:

• 1: https://docs.github.com/en/actions/reference/security/secure-use
• 2: ci: pin third-party Actions to commit SHAs (CWE-829) nasa/CryptoLib#511
• 3: https://microsoft.github.io/zerotrustassessment/docs/workshop-guidance/devsecops/DS_032
• 4: https://github.com/github/awesome-copilot/blob/main/skills/github-actions-hardening/references/supply-chain.md
• 5: https://starsling.dev/best-practices/github-actions/pin-action-shas
• 6: https://codeql.github.com/codeql-query-help/actions/actions-unpinned-tag/
• 7: https://github.com/github/docs/blob/962a1c8dccb8c0f66548b324e5b921b5e4fbc3d6/content/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions.md
• 8: https://github.com/github/codeql/blob/main/actions/ql/src/Security/CWE-829/UnpinnedActionsTag.md
• 9: https://cwe.mitre.org/data/definitions/829.html
• 10: https://github.com/github/codeql/blob/main/actions/ql/src/Security/CWE-829/UnpinnedActionsTag.ql

---

Other (CWE-829): Inclusion of Functionality from Untrusted Control Sphere

Reachability: Internal

Pin GitHub Actions to immutable commit SHAs.

Mutable version tags can resolve to different action code later. Pin the third-party action refs in .github/workflows/doxygen.yml to approved full-length SHAs, with the major version retained in a comment.

🧰 Tools

🪛 zizmor (1.28.0)

[warning] 24-24: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

📍 Affects 1 file

• .github/workflows/doxygen.yml#L24-L24 (this comment)
• .github/workflows/doxygen.yml#L37-L37
• .github/workflows/doxygen.yml#L50-L50

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/doxygen.yml at line 24, Pin the third-party actions at
.github/workflows/doxygen.yml lines 24, 37, and 50 to their approved full-length
commit SHAs, replacing mutable version refs while retaining each action’s major
version in an inline comment.