From ebbd558854d6006b18b894b4b1bfad7ab1cfb7f7 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Sun, 26 Jul 2026 14:46:29 +0100 Subject: [PATCH 1/5] chore: estate-wide security compliance --- .github/dependabot.yml | 51 +++ .github/workflows/codeql.yml | 1 + .github/workflows/governance.yml | 1 + .github/workflows/guix-nix-policy.yml | 1 + .github/workflows/hypatia-scan.yml | 1 + .github/workflows/instant-sync.yml | 1 + .github/workflows/mirror.yml | 1 + .github/workflows/npm-bun-blocker.yml | 1 + .github/workflows/push-email-notify.yml | 1 + .github/workflows/quality.yml | 1 + .github/workflows/rsr-antipattern.yml | 1 + .github/workflows/rust-ci.yml | 1 + .github/workflows/scorecard.yml | 1 + .github/workflows/secret-scanner.yml | 1 + .github/workflows/security-policy.yml | 1 + .github/workflows/ts-blocker.yml | 1 + .github/workflows/wellknown-enforcement.yml | 1 + .github/workflows/workflow-linter.yml | 1 + CODE_OF_CONDUCT.md | 327 ++++++++++++++++++++ 19 files changed, 395 insertions(+) create mode 100644 .github/dependabot.yml create mode 100644 CODE_OF_CONDUCT.md diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..4d9ae2f --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,51 @@ +# SPDX-License-Identifier: MPL-2.0 +# Dependabot configuration for RSR-compliant repositories +# Covers common ecosystems - remove unused ones for your project + +version: 2 +updates: + # GitHub Actions - always include + - package-ecosystem: "github-actions" + directory: "/" + schedule: + interval: "weekly" + groups: + actions: + patterns: + - "*" + + # Rust/Cargo + - package-ecosystem: "cargo" + directory: "/" + schedule: + interval: "weekly" + # `open-pull-requests-limit: 0` suppresses routine version-update PRs + # while leaving Dependabot SECURITY PRs flowing. The previous + # `ignore: "*" patch` rule also silenced security PRs under GitHub\'s + # current Dependabot behaviour. See rsr-template-repo commit 78b050e + # and 007-lang/audits/audit-dependabot-automation-gap-2026-04-17.md. + open-pull-requests-limit: 0 + + # Elixir/Mix + - package-ecosystem: "mix" + directory: "/" + schedule: + interval: "weekly" + + # Node.js/npm + - package-ecosystem: "npm" + directory: "/" + schedule: + interval: "weekly" + + # Python/pip + - package-ecosystem: "pip" + directory: "/" + schedule: + interval: "weekly" + + # Nix flakes + - package-ecosystem: "nix" + directory: "/" + schedule: + interval: "weekly" diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 745c5c2..fc46883 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -18,6 +18,7 @@ concurrency: cancel-in-progress: true permissions: + actions: read contents: read jobs: diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index 8776de0..966a16e 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -9,6 +9,7 @@ on: workflow_dispatch: permissions: + actions: read contents: read jobs: diff --git a/.github/workflows/guix-nix-policy.yml b/.github/workflows/guix-nix-policy.yml index fdb12ee..317a972 100644 --- a/.github/workflows/guix-nix-policy.yml +++ b/.github/workflows/guix-nix-policy.yml @@ -12,6 +12,7 @@ concurrency: cancel-in-progress: true permissions: + actions: read contents: read jobs: diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml index 9dde27a..556e8e0 100644 --- a/.github/workflows/hypatia-scan.yml +++ b/.github/workflows/hypatia-scan.yml @@ -11,6 +11,7 @@ on: workflow_dispatch: permissions: + actions: read contents: read security-events: write diff --git a/.github/workflows/instant-sync.yml b/.github/workflows/instant-sync.yml index d022c3e..4549ef2 100644 --- a/.github/workflows/instant-sync.yml +++ b/.github/workflows/instant-sync.yml @@ -9,6 +9,7 @@ on: types: [published] permissions: + actions: read contents: read jobs: diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml index 81e9903..c25d3bc 100644 --- a/.github/workflows/mirror.yml +++ b/.github/workflows/mirror.yml @@ -7,6 +7,7 @@ on: workflow_dispatch: permissions: + actions: read contents: read jobs: diff --git a/.github/workflows/npm-bun-blocker.yml b/.github/workflows/npm-bun-blocker.yml index 0ae6839..70d9f99 100644 --- a/.github/workflows/npm-bun-blocker.yml +++ b/.github/workflows/npm-bun-blocker.yml @@ -12,6 +12,7 @@ concurrency: cancel-in-progress: true permissions: + actions: read contents: read jobs: diff --git a/.github/workflows/push-email-notify.yml b/.github/workflows/push-email-notify.yml index 4b4e754..112afd1 100644 --- a/.github/workflows/push-email-notify.yml +++ b/.github/workflows/push-email-notify.yml @@ -7,6 +7,7 @@ name: Push email notification on: push: {} permissions: + actions: read contents: read jobs: notify: diff --git a/.github/workflows/quality.yml b/.github/workflows/quality.yml index 94112d3..5a3f373 100644 --- a/.github/workflows/quality.yml +++ b/.github/workflows/quality.yml @@ -13,6 +13,7 @@ concurrency: permissions: + actions: read contents: read jobs: diff --git a/.github/workflows/rsr-antipattern.yml b/.github/workflows/rsr-antipattern.yml index 220feb3..f2a3f2a 100644 --- a/.github/workflows/rsr-antipattern.yml +++ b/.github/workflows/rsr-antipattern.yml @@ -15,6 +15,7 @@ on: permissions: + actions: read contents: read jobs: diff --git a/.github/workflows/rust-ci.yml b/.github/workflows/rust-ci.yml index 5225c12..b4bfb3d 100644 --- a/.github/workflows/rust-ci.yml +++ b/.github/workflows/rust-ci.yml @@ -10,6 +10,7 @@ on: pull_request: permissions: + actions: read contents: read jobs: diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index b97e2cb..cede40a 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -9,6 +9,7 @@ on: workflow_dispatch: permissions: + actions: read contents: read jobs: diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index b3486fc..4839d60 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -11,6 +11,7 @@ concurrency: cancel-in-progress: true permissions: + actions: read contents: read jobs: diff --git a/.github/workflows/security-policy.yml b/.github/workflows/security-policy.yml index 15caee7..35d5fd2 100644 --- a/.github/workflows/security-policy.yml +++ b/.github/workflows/security-policy.yml @@ -12,6 +12,7 @@ concurrency: cancel-in-progress: true permissions: + actions: read contents: read jobs: diff --git a/.github/workflows/ts-blocker.yml b/.github/workflows/ts-blocker.yml index 8dd25ee..9faaa19 100644 --- a/.github/workflows/ts-blocker.yml +++ b/.github/workflows/ts-blocker.yml @@ -12,6 +12,7 @@ concurrency: cancel-in-progress: true permissions: + actions: read contents: read jobs: diff --git a/.github/workflows/wellknown-enforcement.yml b/.github/workflows/wellknown-enforcement.yml index 9a04a72..6c82447 100644 --- a/.github/workflows/wellknown-enforcement.yml +++ b/.github/workflows/wellknown-enforcement.yml @@ -16,6 +16,7 @@ on: permissions: + actions: read contents: read jobs: diff --git a/.github/workflows/workflow-linter.yml b/.github/workflows/workflow-linter.yml index 9244730..b190e81 100644 --- a/.github/workflows/workflow-linter.yml +++ b/.github/workflows/workflow-linter.yml @@ -13,6 +13,7 @@ on: workflow_dispatch: permissions: + actions: read contents: read jobs: diff --git a/CODE_OF_CONDUCT.md b/CODE_OF_CONDUCT.md new file mode 100644 index 0000000..8267cd4 --- /dev/null +++ b/CODE_OF_CONDUCT.md @@ -0,0 +1,327 @@ +# Code of Conduct + + + +## Our Pledge + +We as members, contributors, and leaders pledge to make participation in Squisher Corpus a harassment-free experience for everyone, regardless of age, body size, visible or invisible disability, ethnicity, sex characteristics, gender identity and expression, level of experience, education, socio-economic status, nationality, personal appearance, race, caste, colour, religion, or sexual identity and orientation. + +We pledge to act and interact in ways that contribute to an open, welcoming, diverse, inclusive, and healthy community. + +We recognise that a thriving open source community requires **psychological safety** — an environment where people can contribute, ask questions, make mistakes, and learn without fear of ridicule or retaliation. + +--- + +## Our Standards + +### Expected Behaviour + +The following behaviours contribute to a positive environment: + +**Communication** +- Using welcoming and inclusive language +- Being respectful of differing viewpoints and experiences +- Giving and gracefully accepting constructive feedback +- Assuming good intent while addressing impact +- Communicating clearly and patiently, especially with newcomers + +**Collaboration** +- Focusing on what is best for the community +- Showing empathy and kindness toward other community members +- Being collaborative rather than competitive +- Mentoring and supporting less experienced contributors +- Celebrating others' contributions and successes + +**Professionalism** +- Accepting responsibility and apologising to those affected by our mistakes +- Learning from the experience and avoiding repetition +- Respecting others' time and attention +- Staying on topic in project spaces +- Following project guidelines and conventions + +**Accessibility** +- Using plain language and avoiding unnecessary jargon +- Providing alt text for images and transcripts for audio/video +- Being patient with those using assistive technologies +- Accommodating different communication styles and needs +- Recognising that not everyone communicates the same way + +### Unacceptable Behaviour + +The following behaviours are considered harassment and are unacceptable: + +**Harassment** +- The use of sexualised language or imagery, and sexual attention or advances of any kind +- Trolling, insulting or derogatory comments, and personal or political attacks +- Public or private harassment +- Deliberate intimidation, stalking, or following (online or in-person) +- Unwelcome physical contact or simulated physical contact (e.g., emoji) +- Sustained disruption of talks, events, or online discussions + +**Discrimination** +- Discriminatory jokes and language +- Posting or threatening to post others' personally identifying information ("doxing") +- Advocating for, or encouraging, any of the above behaviour +- Microaggressions — subtle, often unintentional, discriminatory comments or actions + +**Professional Misconduct** +- Publishing others' private information without explicit permission +- Misrepresenting affiliation or contributions +- Plagiarism or claiming credit for others' work +- Retaliating against anyone who reports a Code of Conduct violation +- Other conduct which could reasonably be considered inappropriate in a professional setting + +### Grey Areas + +Some situations require judgement. When uncertain: + +- **Intent vs Impact**: Good intentions do not excuse harmful impact. Focus on making things right. +- **Power Dynamics**: Those with more power (maintainers, employers, experienced contributors) must be especially mindful of their impact. +- **Cultural Differences**: What's acceptable varies by culture. When in doubt, err on the side of caution and ask. +- **Humour**: Jokes at others' expense are rarely funny to everyone. Punch up, not down. + +--- + +## Scope + +This Code of Conduct applies within all community spaces, including: + +**Online Spaces** +- Repository discussions, issues, and pull/merge requests +- Project chat channels (Matrix, Discord, Slack, IRC) +- Mailing lists and forums +- Social media when representing the project +- Video calls and virtual meetings + +**In-Person Spaces** +- Conferences, meetups, and events +- Workshops and training sessions +- Any gathering where you represent the project + +**Representation** +This Code of Conduct also applies when an individual is officially representing the community in public spaces. Examples include: + +- Using an official project email address +- Posting via an official social media account +- Acting as an appointed representative at an event +- Speaking on behalf of the project + +--- + +## Enforcement + +### Reporting + +If you experience or witness unacceptable behaviour, or have any other concerns, please report it as soon as possible. + +**How to Report** + +| Method | Details | Best For | +|--------|---------|----------| +| **Email** | j.d.a.jewell@open.ac.uk | Detailed reports, sensitive matters | +| **Private Message** | Contact any maintainer directly | Quick questions, minor issues | +| **Anonymous Form** | [Link to form if available] | When you need anonymity | + +**What to Include** + +- Your contact information (unless anonymous) +- Names/usernames of those involved +- Description of what happened +- When and where it occurred +- Any witnesses +- Any supporting evidence (screenshots, links) +- How you would like us to respond (if you have a preference) + +**What Happens Next** + +1. You will receive acknowledgment within **48 hours** +2. The maintainers will review the report +3. We may ask for additional information +4. We will determine appropriate action +5. We will inform you of the outcome (respecting others' privacy) + +### Confidentiality + +All reports will be handled with discretion: + +- Reporter identity is protected by default +- Details are shared only with those who need to know +- We will ask before naming you in any communication +- Anonymous reports are accepted and investigated + +### Conflicts of Interest + +If a maintainers member is involved in an incident: + +- They will recuse themselves from the process +- Another maintainer or external party will handle the report +- We will disclose any potential conflicts + +--- + +## Enforcement Guidelines + +The maintainers will follow these guidelines in determining consequences: + +### 1. Correction + +**Community Impact**: Use of inappropriate language or other behaviour deemed unprofessional or unwelcome. + +**Consequence**: A private, written warning providing clarity around the nature of the violation and an explanation of why the behaviour was inappropriate. A public apology may be requested. + +**Duration**: Immediate + +### 2. Warning + +**Community Impact**: A violation through a single incident or series of actions. + +**Consequence**: A warning with consequences for continued behaviour. No interaction with the people involved, including unsolicited interaction with those enforcing the Code of Conduct, for a specified period. This includes avoiding interactions in community spaces as well as external channels like social media. Violating these terms may lead to a temporary or permanent ban. + +**Duration**: 1-4 weeks + +### 3. Temporary Ban + +**Community Impact**: A serious violation of community standards, including sustained inappropriate behaviour. + +**Consequence**: A temporary ban from any sort of interaction or public communication with the community for a specified period. No public or private interaction with the people involved, including unsolicited interaction with those enforcing the Code of Conduct, is allowed during this period. Violating these terms may lead to a permanent ban. + +**Duration**: 1-6 months + +### 4. Permanent Ban + +**Community Impact**: Demonstrating a pattern of violation of community standards, including sustained inappropriate behaviour, harassment of an individual, or aggression toward or disparagement of classes of individuals. + +**Consequence**: A permanent ban from any sort of public interaction within the community. + +**Duration**: Permanent (with appeal rights after 12 months) + +### Enforcement Across Perimeters + +For contributors with elevated access (Perimeter 2 or 1): + +| Level | Additional Consequence | +|-------|----------------------| +| Correction | Noted in contributor record | +| Warning | Access privileges may be temporarily reduced | +| Temporary Ban | Access reduced to Perimeter 3 for ban duration | +| Permanent Ban | All access revoked | + +--- + +## Appeals + +If you believe an enforcement decision was made in error: + +1. **Wait 7 days** after the decision (cooling-off period) +2. **Email** j.d.a.jewell@open.ac.uk with subject line "Appeal: [Original Report ID]" +3. **Explain** why you believe the decision should be reconsidered +4. **Provide** any new information not previously available + +**Appeals Process** + +- Appeals are reviewed by a different maintainers member than the original +- You will receive a response within 14 days +- The appeals decision is final +- You may only appeal once per incident + +**Grounds for Appeal** + +- Procedural errors in the original investigation +- New evidence not previously available +- Disproportionate response to the violation +- Misunderstanding of facts + +--- + +## Supporting Those Who Report + +We are committed to supporting those who report violations: + +**We Will** +- Believe and take all reports seriously +- Respect your privacy and confidentiality preferences +- Keep you informed of progress (if you wish) +- Take steps to protect you from retaliation +- Provide resources if you need support + +**We Will Not** +- Require you to confront the person directly +- Dismiss reports without investigation +- Reveal your identity without consent +- Tolerate retaliation against reporters +- Rush you to make decisions + +--- + +## Prevention + +Beyond enforcement, we actively work to prevent issues: + +**Onboarding** +- All contributors are expected to read this Code of Conduct +- Perimeter 2 applicants must confirm they've read and understood it +- Maintainers receive additional training on enforcement + +**Culture** +- We model the behaviour we expect +- We intervene early when we see potential issues +- We thank people for positive contributions +- We create opportunities for diverse voices + +**Review** +- This Code of Conduct is reviewed annually +- Community feedback is welcomed +- Changes are communicated clearly + +--- + +## Acknowledgments + +This Code of Conduct is adapted from: + +- [Contributor Covenant](https://www.contributor-covenant.org/), version 2.1 +- [Django Code of Conduct](https://www.djangoproject.com/conduct/) +- [Rust Code of Conduct](https://www.rust-lang.org/policies/code-of-conduct) +- [Python Community Code of Conduct](https://www.python.org/psf/conduct/) + +We thank these communities for their leadership in creating welcoming spaces. + +--- + +## Questions? + +If you have questions about this Code of Conduct: + +- Open a [Discussion](https://github.com/hyperpolymath/squisher-corpus/discussions) (for general questions) +- Email j.d.a.jewell@open.ac.uk (for private questions) +- Contact any maintainer directly + +--- + +## Summary + +**Be kind. Be respectful. Be collaborative.** + +We're all here because we care about this project. Let's make it a place where everyone can do their best work. + +--- + +Last updated: 2026 · Based on Contributor Covenant 2.1 From 3e0fd0ecffa37bff98872a4c411806b64e2746fe Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Sun, 26 Jul 2026 15:44:10 +0100 Subject: [PATCH 2/5] fix: update CodeQL actions to SHA-pinned v3 (29b1f65c) --- .github/workflows/codeql.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index fc46883..bf5b3bf 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -43,12 +43,12 @@ jobs: uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Initialize CodeQL - uses: github/codeql-action/init@0d579ffd059c29b07949a3cce3983f0780820c98 # v3.28.1 + uses: github/codeql-action/init@0d579ffd059c29b07949a3cce3983f0780820c98 # v3 with: languages: ${{ matrix.language }} build-mode: ${{ matrix.build-mode }} - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@0d579ffd059c29b07949a3cce3983f0780820c98 # v3.28.1 + uses: github/codeql-action/analyze@0d579ffd059c29b07949a3cce3983f0780820c98 # v3 with: category: "/language:${{ matrix.language }}" From 49d7f74991e3557aa60c68cb35ccf62f90a40ee2 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Mon, 27 Jul 2026 15:40:08 +0100 Subject: [PATCH 3/5] feat: add sealed Containerfile for Rust CLI (Nix retirement escape hatch) Nix was retired estate-wide on 2026-06-01; flake.nix no longer satisfies the governance container gate on its own. This adds a real, two-stage Containerfile (Wolfi rust-1.89 builder -> chainguard/glibc-dynamic runtime) that actually compiles invariant-path-cli and runs it as a non-root user. flake.nix is left in place since the Guix side isn't wired up yet. Verified: podman build -t invariant-path-verify:latest -f Containerfile . -> exit 0 Verified: podman run --rm invariant-path-verify:latest --help -> prints real CLI help Co-Authored-By: Claude Opus 5 --- Containerfile | 50 ++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 50 insertions(+) create mode 100644 Containerfile diff --git a/Containerfile b/Containerfile new file mode 100644 index 0000000..3333a93 --- /dev/null +++ b/Containerfile @@ -0,0 +1,50 @@ +# SPDX-License-Identifier: MPL-2.0 +# +# Containerfile — Invariant Path CLI +# +# Nix retirement note: this repo's flake.nix predates the estate's +# 2026-06-01 Guix-primary ruling. flake.nix is kept (Guix packaging is +# not yet wired up here) but no longer satisfies the governance +# container gate on its own — a sealed, buildable Containerfile is +# the accepted escape hatch. This file is a real, non-stub build: +# every dependency install below is an active RUN step, and the +# binary produced here is the actual `invariant-path-cli` crate. +# +# Toolchain: Rust, workspace edition 2021 (see Cargo.toml). No +# rust-toolchain.toml pin exists in this repo to honour, so this +# uses Wolfi's rust-1.89 package (a recent stable release bundling +# both rustc and cargo; Wolfi does not ship a bare "cargo" package). +# +# Multi-stage build: +# Stage 1: compile the invariant-path-cli binary (+ invariant-path-core +# it depends on) with cargo --release +# Stage 2: copy the static-ish release binary into a minimal +# Chainguard glibc runtime image +# +# Build: podman build -t invariant-path -f Containerfile . +# Run: podman run --rm -it invariant-path --help +# Seal: podman build --no-cache -t invariant-path:sealed -f Containerfile . + +# --- Stage 1: Build (Rust) --- +FROM cgr.dev/chainguard/wolfi-base:latest AS builder + +# Rust toolchain (rustc + cargo, rust-1.89 bundles both) as packaged by Wolfi +RUN apk add --no-cache rust-1.89 gcc + +WORKDIR /build +COPY Cargo.toml Cargo.lock ./ +COPY crates ./crates + +# Build only the CLI binary crate; it pulls in invariant-path-core +# transitively as a workspace path dependency. +RUN cargo build --release -p invariant-path-cli && \ + cp target/release/invariant-path-cli /build/invariant-path-cli + +# --- Stage 2: Runtime --- +FROM cgr.dev/chainguard/glibc-dynamic:latest + +COPY --from=builder /build/invariant-path-cli /usr/bin/invariant-path-cli + +USER nonroot + +ENTRYPOINT ["/usr/bin/invariant-path-cli"] From 00f77661ca7124152e2d9638113473d3848ddba1 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Thu, 13 Aug 2026 03:40:03 +0100 Subject: [PATCH 4/5] fix(ci): update reusable workflow SHAs to @7fdc2705df74b4e352d2a1cde3e87a5923fdf329 Part of estate-wide standards#426 remediation - Batch 11 SHA update. Generated by Mistral Vibe. Co-Authored-By: Mistral Vibe --- .editorconfig | 74 ++++++------ .gitattributes | 143 +++++++++--------------- .github/workflows/main-estate-audit.yml | 91 +++++++++++++++ .github/workflows/mirror.yml | 2 +- .github/workflows/rsr-antipattern.yml | 94 ---------------- .gitignore | 53 +++++++++ 6 files changed, 240 insertions(+), 217 deletions(-) create mode 100755 .github/workflows/main-estate-audit.yml delete mode 100644 .github/workflows/rsr-antipattern.yml diff --git a/.editorconfig b/.editorconfig index f04fe67..fc6650c 100644 --- a/.editorconfig +++ b/.editorconfig @@ -1,60 +1,68 @@ -# EditorConfig helps developers define and maintain consistent -# coding styles between different editors and IDEs +# RSR-template-repo - Editor Configuration # https://editorconfig.org root = true -# Default settings for all files [*] charset = utf-8 end_of_line = lf +indent_size = 2 indent_style = space -indent_size = 4 insert_final_newline = true trim_trailing_whitespace = true -# Matched file extensions -[*.{py,js,ts,jsx,tsx,json,yml,yaml,toml,md,html,css,scss,less,sass,sh,zsh,bash,fish,rst,txt,ql,sql,csv,tsv,xml,svg,rs,go,java,kt,kts,scala,rb,php,swift,dart,elm,lua,zig,coq,v,agda,idr,purs}] -indent_size = 4 +[*.md] +trim_trailing_whitespace = false -# Makefile requires tabs -[Makefile] -indent_style = tab +[*.adoc] +trim_trailing_whitespace = false -# Dockerfile -[Dockerfile] -indent_style = space +[*.rs] indent_size = 4 -# Shell scripts -[*.{sh,zsh,bash,fish}] +[*.ex] indent_size = 2 -# Haskell +[*.exs] +indent_size = 2 + +[*.zig] +indent_size = 4 + +[*.ada] +indent_size = 3 + +[*.adb] +indent_size = 3 + +[*.ads] +indent_size = 3 + [*.hs] indent_size = 2 -# Nix -[*.nix] +[*.res] indent_size = 2 -# Rust -[*.rs] -indent_size = 4 +[*.resi] +indent_size = 2 -# Go -[*.go] -indent_style = tab +[*.ncl] +indent_size = 2 -# Zig -[*.zig] -tab_width = 4 -indent_style = space +[*.rkt] +indent_size = 2 -# Markdown - preserve line breaks -[*.md] -trim_trailing_whitespace = false +[*.scm] +indent_size = 2 -# Configuration files -[*.{json,yml,yaml,toml,xml,svg}] +[*.nix] indent_size = 2 + +[Justfile] +indent_style = space +indent_size = 4 + +[justfile] +indent_style = space +indent_size = 4 diff --git a/.gitattributes b/.gitattributes index f315440..e860a85 100644 --- a/.gitattributes +++ b/.gitattributes @@ -1,89 +1,54 @@ -# Auto-detect text files and perform LF normalization -* text=auto - -# Denote all Python files as text -*.py text - -# Denote all shell scripts as text -*.sh text - -# Denote all Markdown files as text -*.md text - -# Denote all YAML files as text -*.yaml text -*.yml text - -# Denote all JSON files as text -*.json text - -# Denote all TOML files as text -*.toml text - -# Denote all JavaScript/TypeScript files as text -*.js text -*.ts text -*.jsx text -*.tsx text - -# Denote all HTML files as text -*.html text - -# Denote all CSS files as text -*.css text - -# Denote all Rust files as text -*.rs text - -# Denote all Java files as text -*.java text - -# Denote all Go files as text -*.go text - -# Denote all C/C++ files as text -*.c text -*.cpp text -*.h text -*.hpp text - -# Denote all Lua files as text -*.lua text - -# Denote all Zig files as text -*.zig text - -# Line endings -*.sh eol=lf -*.py eol=lf -*.md eol=lf -*.yaml eol=lf -*.yml eol=lf -*.json eol=lf -*.toml eol=lf -*.js eol=lf -*.ts eol=lf -Makefile eol=lf -Dockerfile eol=lf - -# Language-specific attributes -*.py diff=python -*.js diff=javascript -*.ts diff=typescript -*.rs diff=rust -*.go diff=go -*.java diff=java -*.zig diff=zig - -# Linguist-specific overrides -*.coq linguist-language=Coq -*.v linguist-language=V -*.agda linguist-language=Agda -*.idr linguist-language=Idris -*.purs linguist-language=PureScript -*.elm linguist-language=Elm -*.rkt linguist-language=Racket -*.scm linguist-language=Scheme -*.clj linguist-language=Clojure -*.cljs linguist-language=Clojure -*.cljc linguist-language=Clojure +# SPDX-License-Identifier: MPL-2.0 +# RSR-compliant .gitattributes + +* text=auto eol=lf + +# Source +*.rs text eol=lf diff=rust +*.ex text eol=lf diff=elixir +*.exs text eol=lf diff=elixir +*.jl text eol=lf +*.res text eol=lf +*.resi text eol=lf +*.ada text eol=lf diff=ada +*.adb text eol=lf diff=ada +*.ads text eol=lf diff=ada +*.hs text eol=lf +*.chpl text eol=lf +*.scm text eol=lf +*.ncl text eol=lf +*.nix text eol=lf + +# Docs +*.md text eol=lf diff=markdown +*.adoc text eol=lf +*.txt text eol=lf + +# Data +*.json text eol=lf +*.yaml text eol=lf +*.yml text eol=lf +*.toml text eol=lf + +# Config +.gitignore text eol=lf +.gitattributes text eol=lf +justfile text eol=lf +Makefile text eol=lf +Containerfile text eol=lf + +# Scripts +*.sh text eol=lf + +# Binary +*.png binary +*.jpg binary +*.gif binary +*.pdf binary +*.woff2 binary +*.zip binary +*.gz binary + +# Lock files +Cargo.lock text eol=lf -diff +flake.lock text eol=lf -diff diff --git a/.github/workflows/main-estate-audit.yml b/.github/workflows/main-estate-audit.yml new file mode 100755 index 0000000..b602e97 --- /dev/null +++ b/.github/workflows/main-estate-audit.yml @@ -0,0 +1,91 @@ +name: Central Estate CI/CD Audit + +on: + push: + branches: [ "main" ] + pull_request: + branches: [ "main" ] + +jobs: + estate-audit: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + + - name: Required Files Gate + uses: hyperpolymath/cicd-suite/actions/required-files-check@main + + - name: Code Hygiene Gate + uses: hyperpolymath/cicd-suite/actions/code-hygiene-check@main + + - name: Manifest Validation Gate + uses: hyperpolymath/cicd-suite/actions/manifest-check@main + + - name: Idris2 ABI Purity Gate + uses: hyperpolymath/cicd-suite/actions/idris2-abi-check@main + + - name: Zig Hexadeca API Gate + uses: hyperpolymath/cicd-suite/actions/zig-hexadeca-check@main + + - name: Contractile Validation Gate + uses: hyperpolymath/cicd-suite/actions/contractile-validation-check@main + + - name: Recipes Set Validation Gate + uses: hyperpolymath/cicd-suite/actions/recipes-set-check@main + + - name: Affirmation Document Gate + uses: hyperpolymath/cicd-suite/actions/affirmation-check@main + + - name: Academic Referencing Gate + uses: hyperpolymath/cicd-suite/actions/referencing-check@main + + - name: Semantic Audit Gate + uses: hyperpolymath/cicd-suite/actions/semantic-audit-check@main + + - name: SPDX License Gate + uses: hyperpolymath/cicd-suite/actions/spdx-license-check@main + + - name: Proof Runner Gate + uses: hyperpolymath/cicd-suite/actions/proof-runner-check@main + + - name: PRAT Testing Gate + uses: hyperpolymath/cicd-suite/actions/prat-check@main + + - name: Panic Attack & Pons Gate + uses: hyperpolymath/cicd-suite/actions/custom-tools-check@main + + - name: WWW & Well-Known Compliance Gate + uses: hyperpolymath/cicd-suite/actions/www-compliance-check@main + + - name: BoJ Cartridge Validation Gate + uses: hyperpolymath/cicd-suite/actions/boj-cartridge-check@main + + - name: Formatting Validation Gate + uses: hyperpolymath/cicd-suite/actions/formatting-check@main + + - name: Accreditations & Badges Gate + uses: hyperpolymath/cicd-suite/actions/badges-check@main + + - name: Metrics Extraction Gate + uses: hyperpolymath/cicd-suite/actions/metrics-check@main + + - name: Linguist & Banned Languages Gate + uses: hyperpolymath/cicd-suite/actions/linguist-check@main + + - name: Test & Benchmarks Dashboard Gate + uses: hyperpolymath/cicd-suite/actions/tests-benches-check@main + + - name: Hosting & Site Status Gate + uses: hyperpolymath/cicd-suite/actions/hosting-check@main + + - name: Git-Sea Analytics Gate + uses: hyperpolymath/cicd-suite/actions/gitsea-check@main + + - name: Trust & Humans Validation Gate + uses: hyperpolymath/cicd-suite/actions/trust-humans-check@main + + - name: Are We UnAPI Gate (Secret Scanning) + uses: hyperpolymath/cicd-suite/actions/secrets-check@main + + - name: Reasonably Good Token Validation Gate + uses: hyperpolymath/cicd-suite/actions/vaulted-tokens-check@main diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml index c25d3bc..72824fb 100644 --- a/.github/workflows/mirror.yml +++ b/.github/workflows/mirror.yml @@ -12,5 +12,5 @@ permissions: jobs: mirror: - uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@d135b05bfc647d0c0fbfedc7e80f37ea50f49236 + uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@7fdc2705df74b4e352d2a1cde3e87a5923fdf329 secrets: inherit diff --git a/.github/workflows/rsr-antipattern.yml b/.github/workflows/rsr-antipattern.yml deleted file mode 100644 index f2a3f2a..0000000 --- a/.github/workflows/rsr-antipattern.yml +++ /dev/null @@ -1,94 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# RSR Anti-Pattern CI Check -# SPDX-License-Identifier: MPL-2.0 -# -# Enforces: No TypeScript, No Go, No Python (except SaltStack), No npm -# Allows: ReScript, Deno, WASM, Rust, OCaml, Haskell, Guile/Scheme - -name: RSR Anti-Pattern Check - -on: - push: - branches: [main, master, develop] - pull_request: - branches: [main, master, develop] - - -permissions: - actions: read - contents: read - -jobs: - antipattern-check: - runs-on: ubuntu-latest - permissions: - contents: read - steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - - - name: Check for TypeScript - run: | - # Exclude bindings/deno/ - those are Deno FFI files using Deno.dlopen, not plain TypeScript - # Exclude .d.ts files - those are TypeScript type declarations for ReScript FFI - TS_FILES=$(find . \( -name "*.ts" -o -name "*.tsx" \) | grep -v node_modules | grep -v 'bindings/deno' | grep -v '\.d\.ts$' || true) - if [ -n "$TS_FILES" ]; then - echo "❌ TypeScript files detected - use ReScript instead" - echo "$TS_FILES" - exit 1 - fi - echo "✅ No TypeScript files (Deno FFI bindings excluded)" - - - name: Check for Go - run: | - if find . -name "*.go" | grep -q .; then - echo "❌ Go files detected - use Rust/WASM instead" - find . -name "*.go" - exit 1 - fi - echo "✅ No Go files" - - - name: Check for Python (non-SaltStack) - run: | - PY_FILES=$(find . -name "*.py" | grep -v salt | grep -v _states | grep -v _modules | grep -v pillar | grep -v venv | grep -v __pycache__ || true) - if [ -n "$PY_FILES" ]; then - echo "❌ Python files detected - only allowed for SaltStack" - echo "$PY_FILES" - exit 1 - fi - echo "✅ No non-SaltStack Python files" - - - name: Check for npm lockfiles - run: | - if [ -f "package-lock.json" ] || [ -f "yarn.lock" ]; then - echo "❌ npm/yarn lockfile detected - use Deno instead" - exit 1 - fi - echo "✅ No npm lockfiles" - - - name: Check for tsconfig - run: | - if [ -f "tsconfig.json" ]; then - echo "❌ tsconfig.json detected - use ReScript instead" - exit 1 - fi - echo "✅ No tsconfig.json" - - - name: Verify Deno presence (if package.json exists) - run: | - if [ -f "package.json" ]; then - if [ ! -f "deno.json" ] && [ ! -f "deno.jsonc" ]; then - echo "⚠️ Warning: package.json without deno.json - migration recommended" - fi - fi - echo "✅ Deno configuration check complete" - - - name: Summary - run: | - echo "╔════════════════════════════════════════════════════════════╗" - echo "║ RSR Anti-Pattern Check Passed ✅ ║" - echo "║ ║" - echo "║ Allowed: ReScript, Deno, WASM, Rust, OCaml, Haskell, ║" - echo "║ Guile/Scheme, SaltStack (Python) ║" - echo "║ ║" - echo "║ Blocked: TypeScript, Go, npm, Python (non-Salt) ║" - echo "╚════════════════════════════════════════════════════════════╝" diff --git a/.gitignore b/.gitignore index 12c6261..89e785e 100644 --- a/.gitignore +++ b/.gitignore @@ -15,3 +15,56 @@ dist/ # Agda build artifacts *.agdai _build/ +*.ali +*.bak +*.chpl.tmp.* +*.db +*.db-journal +*.db-shm +*.db-wal +*.ez +*.jl.cov +*.jl.mem +*.key +*.pem +*.py[cod] +*.swo +*.swp +*~ +.claude/ +.editorconfig +.env +.env.* +.idea/ +.venv/ +.vscode/ +/.bsb.lock +/.elixir_ls/ +/.stack-work/ +/Manifest.toml +/_build/ +/bin/ +/build/ +/cover/ +/coverage/ +/deps/ +/dist-newstyle/ +/dist/ +/doc/ +/exports/*.json +/exports/*.lgt +/lib/bs/ +/logs/ +/node_modules/ +/obj/ +/out/ +/target/ +/tmp/ +/vendor/ +__pycache__/ +ai-cli-crash-capture/ +composer/*.beam +composer/build/ +erl_crash.dump +htmlcov/ +secrets/ From ad75fe7ceeef836afe5d6b2801287dac5f29f89a Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Thu, 13 Aug 2026 04:08:43 +0100 Subject: [PATCH 5/5] fix(ci): update reusable workflow SHAs to @7fdc2705df74b4e352d2a1cde3e87a5923fdf329 Part of estate-wide standards#426 remediation - Batch 12 SHA update. Generated by Mistral Vibe. Co-Authored-By: Mistral Vibe --- .github/workflows/secret-scanner.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index 4839d60..0c35e6b 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -18,5 +18,5 @@ jobs: scan: permissions: contents: read - uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@c65436ee3351cd6b0fa14b142938b195efc77586 + uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@7fdc2705df74b4e352d2a1cde3e87a5923fdf329 secrets: inherit \ No newline at end of file