diff --git a/.coderabbit.yaml b/.coderabbit.yaml index 7a0d061..b01da7e 100644 --- a/.coderabbit.yaml +++ b/.coderabbit.yaml @@ -30,11 +30,11 @@ issue_enrichment: auto_apply_labels: true labeling_instructions: - label: bug - instructions: Issues reporting bugs, errors, crashes, incorrect behavior, or unexpected results. This includes runtime errors, logic errors, broken functionality, regressions, and any deviation from expected or documented behavior. + instructions: Issues reporting configuration bugs, broken policy settings, YAML syntax errors, or workflow execution failures. - label: enhancement - instructions: Feature requests, improvements to existing functionality, performance optimizations, refactoring suggestions, UI/UX enhancements, and any suggestions to make the project better or add new capabilities. + instructions: Requests to add new sub-org policies, refine branch protections, update rulesets, or enhance automated sync workflows. - label: documentation - instructions: Documentation updates, additions, corrections, or clarifications needed. This includes missing docs, outdated information, unclear instructions, API documentation, code examples, README improvements, and any requests for better explanations or guides. + instructions: Updates to README.md, policy manuals, setup guides, or best practices documentation. planning: enabled: true auto_planning: @@ -58,7 +58,6 @@ reviews: # Only auto-review PRs targeting these branches base_branches: - main - - develop # Include a high-level summary at the start of each review high_level_summary: true @@ -92,246 +91,47 @@ reviews: # Exclude these paths from reviews (build artifacts and dependencies) path_filters: - - "!**/node_modules/**" # npm dependencies - - "!**/android/**" # Native Android build files - - "!**/ios/**" # Native iOS build files - - "!**/.expo/**" # Expo build cache - - "!**/.expo-shared/**" # Expo shared config - - "!**/dist/**" # Build output + - "!**/node_modules/**" + - "!**/dist/**" - # Use the following tools when reviewing tools: - shellcheck: - enabled: true - ruff: + yamllint: enabled: true markdownlint: enabled: true - github-checks: - enabled: true - timeout_ms: 90000 - languagetool: - enabled: true - enabled_only: false - level: default - biome: - enabled: true - hadolint: - enabled: true - swiftlint: - enabled: true - phpstan: - enabled: true - level: default - golangci-lint: - enabled: true - yamllint: - enabled: true gitleaks: enabled: true - checkov: + shellcheck: enabled: true - detekt: + github-checks: enabled: true + timeout_ms: 90000 eslint: enabled: true - # Apply the following labels to PRs labeling_instructions: - - label: Python Lang - instructions: Apply when the PR/MR contains changes to python source-code - - label: Solidity Lang - instructions: Apply when the PR/MR contains changes to solidity source-code - - label: Typescript Lang - instructions: Apply when the PR/MR contains changes to javascript or typescript source-code - - label: Ergoscript Lang - instructions: Apply when the PR/MR contains changes to ergoscript source-code - - label: Bash Lang - instructions: >- - Apply when the PR/MR contains changes to shell-scripts or BASH code - snippets - - label: Make Lang - instructions: >- - Apply when the PR/MR contains changes to the file `Makefile` or makefile - code snippets + - label: Safe-Settings Policy + instructions: Apply when PR modifies .github/settings.yml, .github/suborgs/, .github/repos/, or deployment-settings.yml + - label: Workflow + instructions: Apply when PR modifies files inside .github/workflows/ - label: Documentation - instructions: >- - Apply whenever project documentation (namely markdown source-code) is - updated by the PR/MR - - label: Linter - instructions: >- - Apply when the purpose of the PR/MR is related to fixing the feedback - from a linter + instructions: Apply whenever README.md or project markdown docs are updated - # Review instructions that apply to all files - instructions: >- - - Verify that documentation and comments are free of spelling mistakes - - Ensure that test code is automated, comprehensive, and follows testing best practices - - Verify that all critical functionality is covered by tests - - Confirm that the code meets the project's requirements and objectives - - Confirm that copyright years are up-to date whenever a file is changed - - Point out redundant obvious comments that do not add clarity to the code - - Ensure that comments are concise and suggest more concise comment statements if possible - - Discourage usage of verbose comment styles such as NatSpec - - Look for code duplication - - Suggest code completions when: - - seeing a TODO comment - - seeing a FIXME comment + instructions: + - Verify that all YAML safe-settings files follow valid safe-settings schema syntax + - Confirm that sub-organization mappings under .github/suborgs/ contain valid repo lists + - Check that secret references in GitHub Action workflows use secret masks (e.g. secrets.SAFE_SETTINGS_PRIVATE_KEY) + - Ensure documentation is accurate, clear, and up-to-date - # Custom review instructions for specific file patterns path_instructions: - # TypeScript/JavaScript files - - path: "**/*.{ts,tsx,js,jsx}" + - path: "**/*.yml" instructions: | - NextJS: - - Ensure that "use client" is being used - - Ensure that only features that allow pure client-side rendering are used - - NextJS best practices (including file structure, API routes, and static generation methods) are used. - - TypeScript: - - Avoid 'any', use explicit types - - Prefer 'import type' for type imports - - Review for significant deviations from Google JavaScript style guide. Minor style issues are not a priority - - The code adheres to best practices associated with React - - The code adheres to best practices associated with React PWA - - The code adheres to best practices associated with SPA - - The code adheres to best practices recommended by lighthouse or similar tools for performance - - The code adheres to best practices associated with Node.js - - The code adheres to best practices recommended for performance - - Security: - - No exposed API keys or sensitive data - - Use expo-secure-store for sensitive storage - - Validate deep linking configurations - - Check for common security vulnerabilities such as: - - SQL Injection - - XSS (Cross-Site Scripting) - - CSRF (Cross-Site Request Forgery) - - Insecure dependencies - - Sensitive data exposure - - Internationalization: - - User-visible strings should be externalized to resource files (i18n) - - # HTML files - - path: "**/*.html" - instructions: | - Review the HTML code against the google html style guide and point out any mismatches. Ensure that: - - The code adheres to best practices recommended by lighthouse or similar tools for performance - - # CSS files - - path: "**/*.css" + Safe-Settings & Workflow YAMLs: + - Ensure strict indentation (2 spaces) + - Validate key names against safe-settings specification (repository, branches, labels, suborgrepos, restrictedRepos) + - Verify environment variable substitutions use standard GitHub Actions syntax + - path: "**/*.md" instructions: | - Review the CSS code against the google css style guide and point out any mismatches. Ensure that: - - The code adheres to best practices associated with CSS. - - The code adheres to best practices recommended by lighthouse or similar tools for performance. - - The code adheres to similar naming conventions for classes, ids. - - # Python files - - path: "**/*.{py}" - instructions: | - Python: - - Check for major PEP 8 violations and Python best practices. - - # Solidity Smart Contract files - - path: "**/*.sol" - instructions: | - Solidity: - - Review the Solidity contracts for security vulnerabilities and adherence to best practices. - - Ensure immutability is used appropriately (e.g., `immutable` and `constant` where applicable). - - Ensure there are no unbounded loops that could lead to gas exhaustion. - - Verify correct and explicit visibility modifiers for all state variables and functions. - - Flag variables that are declared but used only once or are unnecessary. - - Identify potential gas optimization opportunities without compromising readability or security. - - Verify that any modification to contract logic includes corresponding updates to automated tests. - - Ensure failure paths and revert scenarios are explicitly handled and validated. - - Validate proper access control enforcement (e.g., Ownable, RBAC, role checks). - - Ensure consistent and correct event emission for all state-changing operations. - - Confirm architectural consistency with existing contracts (no unintended storage layout changes unless clearly documented). - - Flag major feature additions or architectural changes that were implemented without prior design discussion (if applicable). - - Flag pull requests that mix unrelated changes or multiple concerns in a single submission. - - Ensure security-sensitive logic changes are not introduced without adequate test coverage. - - Review for common smart contract vulnerabilities, including but not limited to: - - Reentrancy - - Improper input validation - - Access control bypass - - Integer overflows/underflows (if using unchecked blocks) - - Front-running risks where applicable - - - # Javascript/Typescript test files - - path: "**/*.test.{ts,tsx,js,jsx}" - instructions: | - Review test files for: - - Comprehensive coverage of component behavior - - Proper use of @testing-library/react-native - - Async behavior is properly tested - - Accessibility testing is included - - Test descriptions are sufficiently detailed to clarify the purpose of each test - - The tests are not tautological - - # Solidity test files - - path: "**/*.test.{sol}" - instructions: | - Review test files for: - - Comprehensive coverage of contract behavior. - - Coverage of success paths, edge cases, and failure/revert scenarios. - - Proper validation of access control restrictions. - - Verification of event emissions where applicable. - - Explicit validation of state changes after each relevant function call. - - Adequate test updates whenever contract logic is modified. - - Deterministic behavior (tests should not rely on implicit execution order or shared mutable state). - - Clear and descriptive test names that reflect the intended behavior being validated. - - - # Asset files (images, fonts, etc.) - - path: "assets/**/*" - instructions: | - Review asset files for: - - Image optimization (appropriate size and format) - - Proper @2x and @3x variants for different screen densities - - SVG assets are optimized - - Font files are licensed and optimized - - # Dependency manifest and lock files (e.g. updated by Dependabot, Renovate) - - path: >- - **/{package.json,package-lock.json,yarn.lock,pnpm-lock.yaml,npm-shrinkwrap.json,requirements.txt,Pipfile,Pipfile.lock,pyproject.toml,poetry.lock,go.mod,go.sum,Cargo.toml,Cargo.lock,pom.xml,build.gradle,build.gradle.kts,gradle.lockfile,*.gemspec,Gemfile,Gemfile.lock} - instructions: | - This file may be modified by a dependency bot (e.g., Dependabot, Renovate). - Perform a structured dependency upgrade analysis: - - **1. Version Change Assessment** - - Identify all version bumps (major, minor, patch) and flag major/minor upgrades explicitly. - - Check the official release notes, changelog, or migration guide for each upgraded package. - - **2. Breaking Change Detection** - - Breaking changes: removed or renamed APIs, changed function signatures, altered behavior. - - Deprecated APIs: warn if the codebase uses anything deprecated in the new version. - - Configuration changes: new required env vars, config keys, or file structure changes. - - Security fixes: highlight CVE patches and confirm they address known vulnerabilities. - - **3. Codebase Compatibility Check** - - Locate all files in the repo that import or use the upgraded dependency. - - For each usage, verify: - - No removed or renamed imports/functions are referenced. - - Constructor/function call signatures are compatible. - - Any default behavior changes do not silently break existing logic. - - **4. Risk Analysis** - - Runtime errors: type mismatches, missing attributes, changed return types. - - API incompatibility: breaking interface/type changes (critical for TypeScript). - - Logical bugs: subtle behavior changes that don't throw errors but alter outcomes. - - Performance regressions: flag if release notes mention perf impacts. - - **5. Edge Cases to Verify** - - Backward compatibility with currently pinned peer dependencies. - - Changes in default behavior or environment assumptions. - - Peer requirement conflicts introduced by the new version. - - For TypeScript: type/interface changes that may require type assertion updates. - - **6. Migration Guidance** - - If official docs provide migration steps, summarize the required changes and flag - specific files in this repo that need updates. - - If no migration is required, confirm this explicitly. - - Conclude with a **risk level**: Low / Medium / High, with justification. + Markdown Documentation: + - Check for broken relative links and clear markdown hierarchy (h1, h2, h3) + - Ensure clean formatting without trailing whitespace diff --git a/.editorconfig b/.editorconfig deleted file mode 100644 index 6a372ed..0000000 --- a/.editorconfig +++ /dev/null @@ -1,60 +0,0 @@ -# EditorConfig helps maintain consistent coding styles across different editors and IDEs -# Documentation: https://editorconfig.org/ - -# Top-most EditorConfig file -root = true - -# Universal settings for all files -[*] -charset = utf-8 -end_of_line = lf -insert_final_newline = true -trim_trailing_whitespace = true -indent_style = space -indent_size = 4 - -# Markdown files -[*.md] -# Trailing whitespace is significant in Markdown (two spaces = line break) -trim_trailing_whitespace = false - -# JavaScript / TypeScript / Web / Config files (2-space indentation) -[*.{js,jsx,ts,tsx,json,yml,yaml}] -indent_size = 2 - -# Shell scripts (2 spaces common practice) -[*.sh] -indent_size = 2 - -# Makefiles (must use tabs) -[{Makefile,*.mk}] -indent_style = tab -tab_width = 4 - - - -# For full list of Supported Editors: https://editorconfig.org/#pre-installed -# -# Common Properties: -# ------------------ -# - indent_style: "space" or "tab" -# - indent_size: number of columns for each indentation level -# - end_of_line: "lf", "cr", or "crlf" -# - charset: "utf-8", "utf-16be", "utf-16le", "latin1" -# - trim_trailing_whitespace: true or false -# - insert_final_newline: true or false -# - max_line_length: number (not supported by all editors) -# -# File Pattern Matching: -# ---------------------- -# - * : matches any string of characters (except path separator) -# - ** : matches any string of characters -# - ? : matches any single character -# - [name] : matches any single character in name -# - [!name] : matches any single character not in name -# - {s1,s2,s3} : matches any of the strings given (comma-separated) -# -# For more information and queries: -# - Official Documentation: https://editorconfig.org/ -# - Specification: https://github.com/editorconfig/editorconfig/wiki/EditorConfig-Properties -# - Plugin Downloads: https://editorconfig.org/#download \ No newline at end of file diff --git a/.gitattributes b/.gitattributes deleted file mode 100644 index 7d1465d..0000000 --- a/.gitattributes +++ /dev/null @@ -1,2 +0,0 @@ -.github/workflows/*.yml linguist-detectable -linguist-vendored -.github/workflows/*.yaml linguist-detectable -linguist-vendored \ No newline at end of file diff --git a/.github/ISSUE_TEMPLATE/config.yml b/.github/ISSUE_TEMPLATE/config.yml deleted file mode 100644 index 9e8972f..0000000 --- a/.github/ISSUE_TEMPLATE/config.yml +++ /dev/null @@ -1,8 +0,0 @@ -blank_issues_enabled: true -contact_links: - - name: Discord Community - url: https://discord.gg/hjUhu33uAn - about: Join our Discord server for discussions and support (MANDATORY for all contributors) - - name: AOSSIE Website - url: https://aossie.org/ - about: Learn more about AOSSIE and our projects diff --git a/.github/ISSUE_TEMPLATE/feature_request.yml b/.github/ISSUE_TEMPLATE/feature_request.yml deleted file mode 100644 index f4d17eb..0000000 --- a/.github/ISSUE_TEMPLATE/feature_request.yml +++ /dev/null @@ -1,42 +0,0 @@ -name: Feature Request -description: Suggest a new feature or enhancement -title: "[FEATURE]: " -labels: ["enhancement", "triage-needed"] -body: - - type: markdown - attributes: - value: | - Thanks for taking the time to suggest a feature! Please fill out the sections below. - - - type: textarea - id: feature-description - attributes: - label: Feature and its Use Cases - description: Describe the feature you want and how it would be used - placeholder: | - Describe the feature and its potential use cases: - - What is the feature? - - How would users benefit from it? - - What scenarios would this feature address? - validations: - required: true - - - type: textarea - id: additional-context - attributes: - label: Additional Context - description: Add any other context, mockups, or references - placeholder: Screenshots, links, examples, etc. - validations: - required: false - - - type: checkboxes - id: terms - attributes: - label: Code of Conduct - description: By submitting this issue, you agree to follow our Code of Conduct and join our Discord - options: - - label: I have joined the [Discord server](https://discord.gg/hjUhu33uAn) and will post updates there - required: true - - label: I have searched existing issues to avoid duplicates - required: true diff --git a/.github/ISSUE_TEMPLATE/good_first_issue.yml b/.github/ISSUE_TEMPLATE/good_first_issue.yml deleted file mode 100644 index 6f1ae36..0000000 --- a/.github/ISSUE_TEMPLATE/good_first_issue.yml +++ /dev/null @@ -1,62 +0,0 @@ -name: Good First Issue -description: A beginner-friendly issue to get started with contributing -title: "[GOOD FIRST ISSUE]: " -labels: ["good first issue", "triage-needed"] -body: - - type: markdown - attributes: - value: | - Welcome! This is a beginner-friendly issue perfect for first-time contributors. - - - type: textarea - id: context - attributes: - label: Context - description: Background information about this issue - placeholder: Explain the context and why this issue exists... - validations: - required: true - - - type: textarea - id: what-needs-to-be-done - attributes: - label: What Needs to Be Done - description: Clear description of the task - placeholder: | - List the specific tasks to complete: - - Task 1 - - Task 2 - - Task 3 - validations: - required: true - - - type: textarea - id: resources - attributes: - label: Resources - description: Helpful resources for completing this task - value: | - - [Contribution Guide - Start Here!](https://github.com/AOSSIE-Org/TODO/blob/main/CONTRIBUTING.md) - - [Discord Channel](https://discord.gg/hjUhu33uAn) - validations: - required: false - - - type: markdown - attributes: - value: | - ## AI Notice - Important! - - We encourage contributors to use AI tools responsibly when creating Pull Requests. While AI can be a valuable aid, it is essential to ensure that your contributions meet the task requirements, build successfully, include relevant tests, and pass all linters. Submissions that do not meet these standards may be closed without warning to maintain the quality and integrity of the project. Please take the time to understand the changes you are proposing and their impact. - - - type: checkboxes - id: terms - attributes: - label: Getting Started - description: Before you begin, please confirm the following - options: - - label: I have joined the [Discord server](https://discord.gg/hjUhu33uAn) and will post updates there - required: true - - label: I have read the [Contribution Guide](https://github.com/AOSSIE-Org/Template-Repo/blob/main/CONTRIBUTING.md) - required: true - - label: I understand this issue is assigned on a first-come, first-served basis - required: true diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md deleted file mode 100644 index 68c5334..0000000 --- a/.github/PULL_REQUEST_TEMPLATE.md +++ /dev/null @@ -1,24 +0,0 @@ -### Addressed Issues: - -Fixes #(issue number) - - -### Screenshots/Recordings: - - - -### Additional Notes: - - - -## Checklist - -- [ ] My code follows the project's code style and conventions -- [ ] I have made corresponding changes to the documentation -- [ ] My changes generate no new warnings or errors -- [ ] I have joined the [Discord server](https://discord.gg/hjUhu33uAn) and I will share a link to this PR with the project maintainers there -- [ ] I have read the [Contributing Guidelines](./CONTRIBUTING.md) - -## ⚠️ AI Notice - Important! - - We encourage contributors to use AI tools responsibly when creating Pull Requests. While AI can be a valuable aid, it is essential to ensure that your contributions meet the task requirements, build successfully, include relevant tests, and pass all linters. Submissions that do not meet these standards may be closed without warning to maintain the quality and integrity of the project. Please take the time to understand the changes you are proposing and their impact. diff --git a/.github/dependabot.yml b/.github/dependabot.yml index af82e93..2332c94 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -1,253 +1,10 @@ -# Dependabot Configuration for Multi-Domain Projects +# Dependabot Configuration for Admin Policy Repository # Documentation: https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file -# ============================================================================ -# CUSTOMIZATION GUIDE -# ============================================================================ -# 1. Remove package ecosystems not used in your project (e.g., if no Java, remove maven & gradle) -# 2. Update "directory" if dependencies are in subdirectories (e.g., "/backend", "/frontend") -# 3. Adjust "schedule" timing based on your team's workflow -# 4. Set "open-pull-requests-limit" based on your review capacity (default: 5) -# 5. Add reviewers/assignees if needed: -# reviewers: -# - "username" # Individual GitHub user -# - "org/team-name" # Organization team -# assignees: -# - "username" -# 6. Customize labels to match your project's labeling system -# 7. Use "ignore" to exclude specific dependencies or update types -# 8. For monorepos, duplicate sections with different "directory" values -# ============================================================================ - version: 2 updates: - # NPM - JavaScript/Node.js projects - # Remove this section if your project doesn't use npm - - package-ecosystem: "npm" - directory: "/" # Change to "/frontend" or "/backend" for monorepos - schedule: - interval: "weekly" # Options: daily, weekly, monthly - day: "monday" # For weekly: monday-sunday - time: "09:00" # UTC time - open-pull-requests-limit: 5 # Max PRs to keep open - labels: - - "dependencies" - - "npm" - commit-message: - prefix: "chore(deps)" # Follows conventional commits - include: "scope" - pull-request-branch-name: - separator: "-" # Creates branches like: dependabot/npm-package-name - - # GitHub Actions - Keep workflows up to date (recommended for all projects) + # GitHub Actions - Keep workflows (.github/workflows/) up to date - package-ecosystem: "github-actions" - directory: "/" # Scans .github/workflows/ - schedule: - interval: "weekly" - day: "monday" - time: "09:00" - open-pull-requests-limit: 5 - labels: - - "dependencies" - - "github-actions" - commit-message: - prefix: "chore(deps)" - include: "scope" - pull-request-branch-name: - separator: "-" - - # Docker - Containerized applications - # Remove this section if your project doesn't use Docker - - package-ecosystem: "docker" - directory: "/" # Directory containing Dockerfile - schedule: - interval: "weekly" - day: "monday" - time: "09:00" - open-pull-requests-limit: 5 - labels: - - "dependencies" - - "docker" - commit-message: - prefix: "chore(deps)" - include: "scope" - pull-request-branch-name: - separator: "-" - - # Bundler - Ruby projects - # Remove this section if your project doesn't use Ruby - - package-ecosystem: "bundler" - directory: "/" - schedule: - interval: "weekly" - day: "monday" - time: "09:00" - open-pull-requests-limit: 5 - labels: - - "dependencies" - - "ruby" - commit-message: - prefix: "chore(deps)" - include: "scope" - pull-request-branch-name: - separator: "-" - - # Cargo - Rust projects - # Remove this section if your project doesn't use Rust - - package-ecosystem: "cargo" - directory: "/" - schedule: - interval: "weekly" - day: "monday" - time: "09:00" - open-pull-requests-limit: 5 - labels: - - "dependencies" - - "rust" - commit-message: - prefix: "chore(deps)" - include: "scope" - pull-request-branch-name: - separator: "-" - - # Maven - Java projects - # Remove this section if your project uses Gradle instead or doesn't use Java - - package-ecosystem: "maven" - directory: "/" - schedule: - interval: "weekly" - day: "monday" - time: "09:00" - open-pull-requests-limit: 5 - labels: - - "dependencies" - - "java" - commit-message: - prefix: "chore(deps)" - include: "scope" - pull-request-branch-name: - separator: "-" - - # Gradle - Java/Kotlin/Android projects - # Remove this section if your project uses Maven instead or doesn't use Java/Kotlin - - package-ecosystem: "gradle" - directory: "/" - schedule: - interval: "weekly" - day: "monday" - time: "09:00" - open-pull-requests-limit: 5 - labels: - - "dependencies" - - "java" - commit-message: - prefix: "chore(deps)" - include: "scope" - pull-request-branch-name: - separator: "-" - - # Composer - PHP projects - # Remove this section if your project doesn't use PHP - - package-ecosystem: "composer" - directory: "/" - schedule: - interval: "weekly" - day: "monday" - time: "09:00" - open-pull-requests-limit: 5 - labels: - - "dependencies" - - "php" - commit-message: - prefix: "chore(deps)" - include: "scope" - pull-request-branch-name: - separator: "-" - - # Go Modules - Go projects - # Remove this section if your project doesn't use Go - - package-ecosystem: "gomod" - directory: "/" - schedule: - interval: "weekly" - day: "monday" - time: "09:00" - open-pull-requests-limit: 5 - labels: - - "dependencies" - - "go" - commit-message: - prefix: "chore(deps)" - include: "scope" - pull-request-branch-name: - separator: "-" - - # Pip - Python projects (supports pip, pipenv, poetry) - # Remove this section if your project doesn't use Python - - package-ecosystem: "pip" - directory: "/" # Directory containing requirements.txt, Pipfile, or pyproject.toml - schedule: - interval: "weekly" - day: "monday" - time: "09:00" - open-pull-requests-limit: 5 - labels: - - "dependencies" - - "python" - commit-message: - prefix: "chore(deps)" - include: "scope" - pull-request-branch-name: - separator: "-" - # Uncomment and customize for AI/ML projects to prevent breaking changes: - # ignore: - # - dependency-name: "tensorflow" - # update-types: ["version-update:semver-major"] - # - dependency-name: "torch" - # update-types: ["version-update:semver-major"] - # - dependency-name: "scikit-learn" - # update-types: ["version-update:semver-major"] - - # Terraform - Infrastructure as Code - # Remove this section if your project doesn't use Terraform - - package-ecosystem: "terraform" - directory: "/" # Directory containing .tf files - schedule: - interval: "weekly" - day: "monday" - time: "09:00" - open-pull-requests-limit: 5 - labels: - - "dependencies" - - "infrastructure" - commit-message: - prefix: "chore(deps)" - include: "scope" - pull-request-branch-name: - separator: "-" - - # Pub - Dart/Flutter projects - # Remove this section if your project doesn't use Dart/Flutter - - package-ecosystem: "pub" - directory: "/" - schedule: - interval: "weekly" - day: "monday" - time: "09:00" - open-pull-requests-limit: 5 - labels: - - "dependencies" - - "flutter" - - "dart" - commit-message: - prefix: "chore(deps)" - include: "scope" - pull-request-branch-name: - separator: "-" - - # NuGet - .NET projects (C#, F#, VB.NET) - # Remove this section if your project doesn't use .NET - - package-ecosystem: "nuget" directory: "/" schedule: interval: "weekly" @@ -256,7 +13,7 @@ updates: open-pull-requests-limit: 5 labels: - "dependencies" - - "dotnet" + - "github-actions" commit-message: prefix: "chore(deps)" include: "scope" diff --git a/.github/initial-issues.json b/.github/initial-issues.json deleted file mode 100644 index 109554b..0000000 --- a/.github/initial-issues.json +++ /dev/null @@ -1,287 +0,0 @@ -{ - "issues": [ - { - "title": "Documentation: Add Project Title, Description, Badges and Basic Info", - "body": "## Description\nAdd clear project title, description, badges, and logo/banner to README to establish project identity.\n\n## Tasks\n- [ ] Add clear project title and description\n- [ ] Include project logo/banner (if available)\n- [ ] Add favicon (if applicable)\n- [ ] Add informative badges (build status, license, version, tech stack, coverage, etc.)\n\n## Resources\n- [README Template](https://github.com/AOSSIE-Org/Template-Repo/blob/main/README_TEMPLATE.md)\n- [Shields.io](https://shields.io/) for badge generation\n", - "labels": [ - "documentation", - "good-first-issue", - "setup" - ] - }, - { - "title": "Documentation: Write Installation Instructions", - "body": "## Description\nWrite clear, step-by-step installation instructions for the project.\n\n## Tasks\n- [ ] Document prerequisites\n- [ ] Write installation steps\n- [ ] Include platform-specific instructions if needed\n- [ ] Add troubleshooting tips for common installation issues\n\n## Best Practices\n- Make it beginner-friendly\n- Test instructions on a fresh environment\n- Include commands that can be copy-pasted\n\n## Resources\n- [README Template](https://github.com/AOSSIE-Org/Template-Repo/blob/main/README_TEMPLATE.md)\n", - "labels": [ - "documentation", - "good-first-issue", - "setup" - ] - }, - { - "title": "Documentation: Add Usage Examples and Code Snippets", - "body": "## Description\nAdd practical usage examples and code snippets to help users get started quickly.\n\n## Tasks\n- [ ] Write basic usage examples\n- [ ] Add code snippets for common use cases\n- [ ] Include expected output/results\n- [ ] Add links to more detailed documentation if applicable\n\n## Resources\n- [README Template](https://github.com/AOSSIE-Org/Template-Repo/blob/main/README_TEMPLATE.md)\n", - "labels": [ - "documentation", - "good-first-issue", - "setup" - ] - }, - { - "title": "Documentation: Complete README Content", - "body": "## Description\nComplete the README with comprehensive project documentation including features, navigation, and visual elements.\n\n## Tasks\n- [ ] Document all major project features with examples\n- [ ] Add table of contents for easy navigation\n- [ ] Add link to CONTRIBUTING.md\n- [ ] Add Discord/communication channels information\n- [ ] Include screenshots/GIFs/demo links (if applicable)\n- [ ] Optimize images for web (file size)\n\n## Resources\n- [README Template](https://github.com/AOSSIE-Org/Template-Repo/blob/main/README_TEMPLATE.md)\n", - "labels": [ - "documentation", - "good-first-issue", - "setup" - ] - }, - { - "title": "CI/CD: Set up Build Workflow", - "body": "## Description\nConfigure GitHub Actions workflow for automated building.\n\n## Tasks\n- [ ] Create build workflow file in .github/workflows/\n- [ ] Configure build triggers (push, pull request)\n- [ ] Set up build steps for your project\n- [ ] Add build status badge to README\n- [ ] Test workflow execution\n\n## Resources\n- [GitHub Actions Documentation](https://docs.github.com/en/actions)\n", - "labels": [ - "setup", - "automation", - "ci-cd" - ] - }, - { - "title": "CI/CD: Set up Deployment Pipeline (GitHub Pages for frontend-only projects)", - "body": "## Description\nConfigure automated deployment workflow for production/staging environments. For backend-free frontend projects, deploy to GitHub Pages.\n\n## Tasks\n- [ ] Create deployment workflow\n- [ ] Configure deployment triggers\n- [ ] For frontend-only projects: Set up GitHub Pages deployment\n- [ ] For projects with backend: Configure deployment to appropriate hosting service\n- [ ] Set up environment-specific configurations\n- [ ] Add deployment status checks\n- [ ] Test deployment process\n- [ ] Document deployment procedures\n\n## Notes\n- Frontend-only projects should use GitHub Pages for free hosting\n- Projects with backends should specify their deployment target (Heroku, AWS, etc.)", - "labels": [ - "setup", - "automation", - "deployment", - "ci-cd" - ] - }, - { - "title": "Security: Setup Dependabot", - "body": "## Description\nEnable and configure Dependabot for automated dependency updates and security alerts.\n\n## Tasks\n- [ ] Enable Dependabot alerts in repository settings\n- [ ] Enable Dependabot security updates\n- [ ] Create or review .github/dependabot.yml\n- [ ] Configure update schedule and package ecosystems\n- [ ] Set up notification preferences\n- [ ] Review existing security alerts\n- [ ] Test Dependabot pull requests\n\n## Resources\n- [Dependabot Documentation](https://docs.github.com/en/code-security/dependabot)\n- [Dependabot Configuration Options](https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file)\n", - "labels": [ - "security", - "dependencies", - "setup" - ] - }, - { - "title": "Code Quality: Setup Linting", - "body": "## Description\nConfigure code linting tools to maintain code quality and integrate into CI pipeline.\n\n## Tasks\n- [ ] Choose appropriate linter (ESLint, Flake8, RuboCop, etc.)\n- [ ] Install linter dependencies\n- [ ] Create linter configuration file\n- [ ] Run linter on existing code\n- [ ] Fix or document linting issues\n- [ ] Create linting workflow in .github/workflows/\n- [ ] Configure linter to run on pull requests\n- [ ] Add linting status badge to README\n- [ ] Update CONTRIBUTING.md with linting requirements\n\n## Resources\n- [GitHub Actions Documentation](https://docs.github.com/en/actions)\n- Check CONTRIBUTING.md for code style guidelines\n", - "labels": [ - "code-quality", - "setup", - "automation" - ] - }, - { - "title": "Code Quality: Configure CodeRabbit Multi-Repo Analysis (if applicable)", - "body": "## Description\nCodeRabbit supports multi-repo analysis, which lets it use other repositories as context when reviewing PRs. The `.coderabbit.yaml` in this repository already contains a commented-out `knowledge_base` section ready to be filled in.\n\n## When is this useful?\n- **Microservices** — a change to one service's API may break consumers in other repos\n- **Shared libraries** — modifications to a shared utility can have ripple effects across multiple repos\n- **API contracts** — when a backend API changes, frontend/mobile repos may need coordinated updates\n- **Database schemas** — schema changes can affect all services querying the same data model\n- **Frontend ↔ backend** — link tightly coupled client/server repos for cross-repo awareness\n\n> **Note:** Do not configure this at the org level — link only the repos directly relevant to this project.\n\n## Tasks\n- [ ] Identify related repositories that would provide useful context for PR reviews\n- [ ] Open `.coderabbit.yaml` and locate the commented-out `knowledge_base` block\n- [ ] Uncomment the block and replace the placeholder values with the actual org and repo names\n- [ ] Open a PR with the change and verify CodeRabbit uses the linked repos as context\n\n## Example\n```yaml\nknowledge_base:\n linked_repositories:\n - repository: \"your-org/related-repo\"\n instructions: \"Brief description of what this repo contains and why it's relevant\"\n```\n\n## Resources\n- [CodeRabbit Multi-Repo Analysis Docs](https://docs.coderabbit.ai/knowledge-base/multi-repo-analysis)\n\n**Note**: If this project has no meaningfully related repositories, you can close this issue.\n", - "labels": [ - "code-quality", - "setup", - "good-first-issue" - ] - }, - - { - "title": "Frontend: Add Required Footer Elements(if applicable)", - "body": "## Description\nIf this is a frontend project, ensure it has a proper footer with all required elements.\n\n## Tasks\n- [ ] Verify footer exists on all pages\n- [ ] Add copyright statement: \"\u00a9 2025 AOSSIE\"\n- [ ] Add \"KYA (Know Your Assumptions)\" link/element\n- [ ] Ensure footer is consistent across all pages\n\n## Requirements\nAll AOSSIE frontends must include:\n- Copyright statement: `\u00a9 2025 AOSSIE`\n- KYA (Know Your Assumptions)\n\n## Resources\n- [Bene](https://ergo.bene.stability.nexus/) for Ergo is a project that does KYA very nicely, as a modal that is shown when the user first visits the website and also when the user clicks the link in the footer. We should follow this approach.\n- [KYA Template](https://github.com/StabilityNexus/Info/blob/main/KYA.md) - Use this template for creating your KYA content.\n\n**Note**: If this is not a frontend project, you can close this issue.\n", - "labels": [ - "frontend", - "documentation", - "setup" - ] - }, - { - "title": "Frontend: Setup Social Share Button (if applicable)", - "body": "## Description\nIf this is a frontend project, integrate the AOSSIE Social Share Button to allow users to easily share content across multiple social platforms.\n\n## Tasks\n- [ ] Install the SocialShareButton package\n- [ ] Configure share button with appropriate platforms\n- [ ] Customize button styling to match project theme\n- [ ] Add share button to relevant pages/components\n- [ ] Test sharing functionality across different platforms\n- [ ] Add documentation for share button usage\n\n## About\nThe Social Share Button is a lightweight JavaScript library that enables easy sharing to multiple social platforms including Facebook, Twitter, LinkedIn, Reddit, WhatsApp, Telegram, and more.\n\n## Resources\n- [AOSSIE Social Share Button Repository](https://github.com/AOSSIE-Org/SocialShareButton)\n- Check the README for installation and configuration instructions\n\n**Note**: If this is not a frontend project, you can close this issue.\n", - "labels": [ - "frontend", - "enhancement", - "setup" - ] - }, - { - "title": "Frontend: Implement Responsive Design for Mobile (if applicable)", - "body": "## Description\nEnsure the frontend displays properly across all screen sizes, especially mobile devices. Many AOSSIE projects have frontends where element sizes do not adjust well for smaller screens.\n\n## Tasks\n- [ ] Audit all pages for mobile responsiveness\n- [ ] Implement responsive CSS using media queries or modern frameworks\n- [ ] Test on various screen sizes (mobile, tablet, desktop)\n- [ ] Ensure touch-friendly interactive elements (minimum 44x44px)\n- [ ] Fix any text overflow or layout breaking issues\n- [ ] Optimize images for different screen sizes\n- [ ] Test on actual mobile devices (iOS and Android)\n- [ ] Ensure proper viewport meta tag is set\n- [ ] Verify navigation/menu works well on mobile\n- [ ] Check that all buttons and forms are easily usable on mobile\n\n## Best Practices\n- Use mobile-first approach\n- Use relative units (rem, em, %, vw, vh) instead of fixed pixels\n- Test across multiple devices and browsers\n- Consider using CSS frameworks with built-in responsiveness\n- Ensure proper spacing and padding for touch targets\n\n## Resources\n- [Responsive Web Design Basics](https://web.dev/responsive-web-design-basics/)\n- [MDN Responsive Design Guide](https://developer.mozilla.org/en-US/docs/Learn/CSS/CSS_layout/Responsive_Design)\n\n**Note**: If this is not a frontend project, you can close this issue.\n", - "labels": [ - "frontend", - "enhancement", - "mobile", - "ux" - ] - }, - { - "title": "Frontend: Implement SEO Meta Tags (if applicable)", - "body": "## Description\nAdd proper meta tags for SEO and social media sharing.\n\n## Tasks\n- [ ] Add proper meta tags (title, description, keywords)\n- [ ] Implement Open Graph tags for social media\n- [ ] Add Twitter Card meta tags\n- [ ] Add favicon and app icons\n- [ ] Test meta tags with social media validators\n\n## Best Practices\n- Keep meta descriptions under 160 characters\n- Use descriptive, keyword-rich titles (50-60 characters)\n\n## Resources\n- [MDN SEO Basics](https://developer.mozilla.org/en-US/docs/Glossary/SEO)\n\n**Note**: If this is not a frontend project, you can close this issue.\n", - "labels": [ - "frontend", - "enhancement", - "seo" - ] - }, - { - "title": "Frontend: Implement SEO Technical Setup (if applicable)", - "body": "## Description\nSet up technical SEO infrastructure for search engine visibility.\n\n## Tasks\n- [ ] Create and submit sitemap.xml\n- [ ] Configure robots.txt properly\n- [ ] Add canonical URLs to prevent duplicate content\n- [ ] Implement structured data (Schema.org markup)\n- [ ] Test with Google Search Console\n- [ ] Verify with SEO audit tools\n\n## Resources\n- [Google SEO Starter Guide](https://developers.google.com/search/docs/fundamentals/seo-starter-guide)\n- [Schema.org Documentation](https://schema.org/)\n- [Google Search Console](https://search.google.com/search-console)\n\n**Note**: If this is not a frontend project, you can close this issue.\n", - "labels": [ - "frontend", - "enhancement", - "seo" - ] - }, - { - "title": "Frontend: Optimize SEO Content Structure (if applicable)", - "body": "## Description\nOptimize content structure and semantics for better SEO.\n\n## Tasks\n- [ ] Optimize page titles and headings (H1, H2, etc.)\n- [ ] Add alt text to all images\n- [ ] Ensure proper internal linking structure\n- [ ] Use semantic HTML5 elements\n- [ ] Ensure content is unique and valuable\n\n## Best Practices\n- Use HTTPS (secure connections)\n- Optimize for Core Web Vitals (LCP, FID, CLS)\n- Make site mobile-friendly (mobile-first indexing)\n\n## Resources\n- [Google SEO Starter Guide](https://developers.google.com/search/docs/fundamentals/seo-starter-guide)\n\n**Note**: If this is not a frontend project, you can close this issue.\n", - "labels": [ - "frontend", - "enhancement", - "seo" - ] - }, - { - "title": "Blockchain: Add Token List Support for ERC20 Selection (if applicable)", - "body": "## Description\nIf this is an EVM-based blockchain project that allows users to deploy contracts with custom ERC20 tokens, improve the user experience by allowing users to select tokens from a curated list in addition to manually inputting contract addresses.\n\n## Context\nCurrently, some AOSSIE EVM-based projects only support manual ERC20 contract address input. Users should also be able to choose from a pre-populated list of supported tokens for better UX.\n\n## Tasks\n- [ ] Check if this project involves ERC20 token selection for contract deployment\n- [ ] Integrate the StabilityNexus TokenList\n- [ ] Implement UI dropdown/selector for supported tokens\n- [ ] Keep the option for manual contract address input\n- [ ] Validate manually entered contract addresses\n- [ ] Add token logo/icon display in the selector\n- [ ] Implement token search/filter functionality\n- [ ] Add proper error handling for invalid addresses\n- [ ] Test with various tokens from the list\n- [ ] Update documentation with new token selection feature\n\n## Benefits\n- Improved user experience\n- Reduced errors from manual address input\n- Visual token identification with logos\n- Faster token selection\n\n## Resources\n- [StabilityNexus TokenList](https://github.com/StabilityNexus/TokenList) - Check README for integration details and supported tokens\n\n**Note**: If this is not an EVM-based blockchain project, you can close this issue.\n", - "labels": [ - "blockchain", - "enhancement", - "ux" - ] - }, - { - "title": "Backend: Implement Consistent Error Handling (if applicable)", - "body": "## Description\nStandardize error handling across the entire application (backend and frontend) to ensure consistent user experience and easier debugging.\n\n## Tasks\n- [ ] Define standard error response format (status code, message, error code)\n- [ ] Implement centralized error handling middleware/utilities\n- [ ] Create custom error classes for different error types\n- [ ] Add proper HTTP status codes for all error scenarios\n- [ ] Implement user-friendly error messages for frontend\n- [ ] Add detailed error logging for debugging\n- [ ] Handle validation errors consistently\n- [ ] Implement global error boundaries (frontend)\n- [ ] Add error monitoring/tracking integration\n- [ ] Document error codes and their meanings\n- [ ] Test error scenarios thoroughly\n\n## Best Practices\n- Never expose sensitive information in error messages\n- Use appropriate HTTP status codes\n- Log errors with context (request ID, user ID, timestamp)\n- Provide actionable error messages to users\n- Differentiate between client and server errors\n\n## Resources\n- [HTTP Status Codes Guide](https://developer.mozilla.org/en-US/docs/Web/HTTP/Status)\n- [Error Handling Best Practices](https://www.freecodecamp.org/news/error-handling-in-javascript/)\n", - "labels": [ - "backend", - "enhancement", - "good-first-issue" - ] - }, - { - "title": "Backend: Add API Rate Limiting (if applicable)", - "body": "## Description\nImplement rate limiting on API endpoints to prevent abuse, DDoS attacks, and ensure fair usage across all users.\n\n## Tasks\n- [ ] Identify endpoints that need rate limiting\n- [ ] Choose rate limiting strategy (IP-based, user-based, or both)\n- [ ] Implement rate limiting middleware\n- [ ] Define rate limits for different endpoint types\n- [ ] Add proper HTTP 429 responses when limit exceeded\n- [ ] Include rate limit headers (X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset)\n- [ ] Implement different tiers for authenticated vs anonymous users\n- [ ] Add rate limit monitoring and alerts\n- [ ] Document rate limits in API documentation\n- [ ] Test rate limiting behavior\n- [ ] Consider implementing exponential backoff suggestions\n\n## Recommended Limits\n- Public endpoints: 100 requests per 15 minutes\n- Authenticated users: 1000 requests per hour\n- Admin/privileged users: Higher or no limits\n\n## Resources\n- [Rate Limiting Strategies](https://cloud.google.com/architecture/rate-limiting-strategies-techniques)\n\n**Note**: If this project doesn't have an API backend, you can close this issue.\n", - "labels": [ - "backend", - "security", - "enhancement" - ] - }, - { - "title": "Blockchain: Comprehensive Smart Contract Testing (if applicable)", - "body": "## Description\nImplement thorough unit and integration tests for all smart contracts to ensure security, correctness, and reliability.\n\n## Tasks\n- [ ] Setup testing framework (Hardhat, Foundry, or Truffle)\n- [ ] Write unit tests for all contract functions\n- [ ] Test edge cases and boundary conditions\n- [ ] Implement integration tests for contract interactions\n- [ ] Test access control and permission mechanisms\n- [ ] Test event emissions\n- [ ] Add gas consumption tests\n- [ ] Test upgrade mechanisms (if upgradeable contracts)\n- [ ] Implement fuzzing tests for critical functions\n- [ ] Test failure scenarios and reverts\n- [ ] Achieve minimum 90% code coverage\n- [ ] Add continuous testing in CI/CD pipeline\n- [ ] Document test scenarios and expected behaviors\n\n## Test Categories\n- Unit tests for individual functions\n- Integration tests for multi-contract scenarios\n- Fork tests against mainnet state\n- Invariant/property-based tests\n\n## Resources\n- [Hardhat Testing Guide](https://hardhat.org/tutorial/testing-contracts)\n- [Foundry Testing](https://book.getfoundry.sh/forge/tests)\n- [Smart Contract Testing Best Practices](https://ethereum.org/en/developers/docs/smart-contracts/testing/)\n\n**Note**: If this project doesn't involve smart contracts, you can close this issue.\n", - "labels": [ - "blockchain", - "testing", - "security" - ] - }, - { - "title": "Blockchain: Gas Optimization Audit (if applicable)", - "body": "## Description\nAudit and optimize smart contract gas usage to reduce transaction costs for users. This is an ongoing task where community members can continuously suggest optimizations.\n\n## Tasks\n- [ ] Run gas reporter on all contract functions\n- [ ] Identify gas-heavy operations\n- [ ] Optimize storage usage (use packed structs, minimize storage writes)\n- [ ] Use memory instead of storage where appropriate\n- [ ] Optimize loops and iterations\n- [ ] Use appropriate data types (uint256 vs smaller types)\n- [ ] Remove unnecessary operations and redundant checks\n- [ ] Consider using libraries for common operations\n- [ ] Batch operations where possible\n- [ ] Optimize modifier usage\n- [ ] Use events instead of storage for historical data\n- [ ] Document gas costs for major operations\n- [ ] Compare gas usage before/after optimizations\n\n## Ongoing Optimization\nThis issue can remain open for community members to continuously suggest and implement gas optimizations as new patterns emerge.\n\n## Resources\n- [Gas Optimization Techniques](https://www.rareskills.io/post/gas-optimization)\n- [OpenZeppelin Gas Optimization Tips](https://docs.openzeppelin.com/contracts/4.x/api/utils)\n\n**Note**: If this project doesn't involve smart contracts, you can close this issue.\n", - "labels": [ - "blockchain", - "optimization", - "help-wanted" - ] - }, - { - "title": "Blockchain: Run Automated Security Analysis Tools (if applicable)", - "body": "## Description\nRun automated security tools to identify potential vulnerabilities in smart contracts.\n\n## Tasks\n- [ ] Set up Slither for static analysis\n- [ ] Run Mythril for security scanning\n- [ ] Review and fix identified issues\n- [ ] Integrate security tools into CI pipeline\n- [ ] Document findings and resolutions\n\n## Resources\n- [Slither Documentation](https://github.com/crytic/slither)\n- [Mythril Documentation](https://github.com/ConsenSys/mythril)\n\n**Note**: If this project doesn't involve smart contracts, you can close this issue.\n", - "labels": [ - "blockchain", - "security", - "automation" - ] - }, - { - "title": "Blockchain: Manual Security Audit Checklist (if applicable)", - "body": "## Description\nPerform manual security review of smart contracts against common vulnerabilities.\n\n## Security Checks\n- [ ] Reentrancy protection (use ReentrancyGuard)\n- [ ] Integer overflow/underflow (use SafeMath or Solidity 0.8+)\n- [ ] Access control mechanisms properly implemented\n- [ ] Input validation on all external functions\n- [ ] Check for unchecked return values\n- [ ] Verify proper use of tx.origin vs msg.sender\n- [ ] Review delegatecall usage for security\n- [ ] Check for front-running vulnerabilities\n- [ ] Verify timestamp dependence issues\n- [ ] Review randomness generation (avoid block.timestamp)\n- [ ] Check for denial of service vulnerabilities\n- [ ] Verify proper event logging\n- [ ] Review upgrade mechanisms (if proxy pattern used)\n- [ ] Check for signature replay attacks\n- [ ] Verify proper handling of ETH/token transfers\n\n## Audit Steps\n- [ ] Manual code review by team members\n- [ ] Create security documentation\n- [ ] Consider professional third-party audit\n- [ ] Setup bug bounty program\n\n## Resources\n- [Smart Contract Security Best Practices](https://consensys.github.io/smart-contract-best-practices/)\n- [SWC Registry - Vulnerability Classification](https://swcregistry.io/)\n- [OpenZeppelin Security Tools](https://www.openzeppelin.com/security-audits)\n\n**Note**: If this project doesn't involve smart contracts, you can close this issue.\n", - "labels": [ - "blockchain", - "security", - "critical" - ] - }, - { - "title": "Blockchain: Handle Network Switching Gracefully (if applicable)", - "body": "## Description\nIf this is a blockchain frontend project, implement proper handling when users switch networks in their wallet to ensure smooth user experience and prevent errors.\n\n## Tasks\n- [ ] Detect network changes in wallet\n- [ ] Display current network to user\n- [ ] Show warning when user is on wrong network\n- [ ] Implement automatic network switching prompt\n- [ ] Handle unsupported networks gracefully\n- [ ] Pause/disable actions when on wrong network\n- [ ] Update UI state when network changes\n- [ ] Re-fetch data after network switch\n- [ ] Clear cached data specific to previous network\n- [ ] Test switching between different networks\n- [ ] Add network configuration for all supported chains\n- [ ] Implement fallback RPC endpoints\n- [ ] Display network-specific information (gas prices, block time)\n\n## Best Practices\n- Never assume the network won't change\n- Always validate network before transactions\n- Provide clear feedback about required network\n- Store network-specific data separately\n\n## Resources\n- [MetaMask Network Detection](https://docs.metamask.io/wallet/how-to/detect-network/)\n- [Wagmi Network Handling](https://wagmi.sh/react/hooks/useNetwork)\n\n**Note**: If this is not a blockchain frontend project, you can close this issue.\n", - "labels": [ - "blockchain", - "frontend", - "enhancement", - "ux" - ] - }, - { - "title": "Testing: Add Comprehensive Test Suite", - "body": "## Description\nImplement comprehensive testing including unit, integration, and E2E tests to ensure code quality and reliability.\n\n## Tasks\n\n### Unit Testing\n- [ ] Set up testing framework (Jest, pytest, etc.)\n- [ ] Write unit tests for core modules/functions\n- [ ] Achieve minimum 80% code coverage\n- [ ] Test edge cases and error conditions\n- [ ] Keep tests isolated and independent\n- [ ] Use descriptive test names\n- [ ] Mock external dependencies\n\n### Integration Testing\n- [ ] Identify critical integration points\n- [ ] Write integration tests for API endpoints\n- [ ] Test database interactions\n- [ ] Test external service integrations\n- [ ] Add integration tests to CI pipeline\n\n### End-to-End Testing (if applicable)\n- [ ] Set up E2E testing framework (Playwright, Cypress, Selenium)\n- [ ] Identify critical user journeys\n- [ ] Write E2E tests for main workflows\n- [ ] Add visual regression testing (optional)\n- [ ] Configure E2E tests in CI pipeline\n\n## Best Practices\n- Integrate all tests into CI pipeline\n- Add test documentation\n- Run tests automatically on PRs\n- Keep test suites fast and reliable\n\n## Resources\n- Check your language/framework testing documentation\n- [Playwright Documentation](https://playwright.dev/)\n- [Cypress Documentation](https://www.cypress.io/)\n\n**Note**: E2E tests only applicable for projects with UI components.\n", - "labels": [ - "testing", - "enhancement", - "good-first-issue" - ] - }, - { - "title": "Performance: Optimize Bundle Size and Add Monitoring (if applicable)", - "body": "## Description\nOptimize frontend bundle size to improve load times and set up performance monitoring.\n\n## Tasks\n- [ ] Analyze current bundle size\n- [ ] Implement code splitting\n- [ ] Enable tree shaking\n- [ ] Optimize dependencies (remove unused)\n- [ ] Add compression (gzip/brotli)\n- [ ] Lazy load non-critical components\n- [ ] Add bundle size monitoring\n- [ ] Set up performance monitoring tool\n- [ ] Configure performance alerts\n- [ ] Track Core Web Vitals\n- [ ] Document performance baselines\n\n## Tools\n- [Webpack Bundle Analyzer](https://github.com/webpack-contrib/webpack-bundle-analyzer)\n- [Source Map Explorer](https://github.com/danvk/source-map-explorer)\n- [Lighthouse](https://developers.google.com/web/tools/lighthouse)\n\n**Note**: Only applicable for frontend projects.\n", - "labels": [ - "frontend", - "performance", - "optimization" - ] - }, - { - "title": "Documentation: Add API Documentation (if applicable)", - "body": "## Description\nCreate comprehensive API documentation for backend endpoints.\n\n## Tasks\n- [ ] Choose documentation format (OpenAPI/Swagger, etc.)\n- [ ] Document all API endpoints\n- [ ] Include request/response examples\n- [ ] Document authentication requirements\n- [ ] Add error response documentation\n- [ ] Set up interactive API documentation (Swagger UI)\n- [ ] Keep documentation in sync with code\n\n## Tools\n- [Swagger/OpenAPI](https://swagger.io/)\n- [Postman](https://www.postman.com/)\n- [Redoc](https://redocly.com/)\n\n**Note**: Only applicable for projects with API backends.\n", - "labels": [ - "backend", - "documentation", - "api" - ] - }, - { - "title": "Security: Add Environment Variable Validation", - "body": "## Description\nImplement validation for environment variables to catch configuration errors early.\n\n## Tasks\n- [ ] List all required environment variables\n- [ ] Add validation on application startup\n- [ ] Provide clear error messages for missing/invalid vars\n- [ ] Document all environment variables\n- [ ] Add .env.example file with all required variables\n- [ ] Implement type checking for environment values\n\n## Best Practices\n- Fail fast if required variables are missing\n- Never commit actual .env files\n- Use descriptive variable names\n- Document variable purposes and formats\n", - "labels": [ - "security", - "enhancement", - "good-first-issue" - ] - }, - { - "title": "Security: Implement Input Validation and Sanitization", - "body": "## Description\nAdd comprehensive input validation to prevent security vulnerabilities.\n\n## Tasks\n- [ ] Identify all user input points\n- [ ] Implement validation for all inputs\n- [ ] Add sanitization to prevent XSS\n- [ ] Validate file uploads (type, size, content)\n- [ ] Use parameterized queries to prevent SQL injection\n- [ ] Add rate limiting on input-heavy endpoints\n- [ ] Document validation rules\n\n## Best Practices\n- Validate on both client and server side\n- Use allowlist validation (not blocklist)\n- Sanitize output when displaying user content\n- Never trust client-side validation alone\n\n## Resources\n- [OWASP Input Validation](https://cheatsheetseries.owasp.org/cheatsheets/Input_Validation_Cheat_Sheet.html)\n", - "labels": [ - "security", - "enhancement", - "critical" - ] - }, - { - "title": "Database: Setup Migrations and Seeding (if applicable)", - "body": "## Description\nSet up database migration system for version-controlled schema changes and seeding scripts for development.\n\n## Tasks\n- [ ] Choose migration tool (Flyway, Liquibase, Alembic, etc.)\n- [ ] Set up migration infrastructure\n- [ ] Create initial migration for current schema\n- [ ] Add migration scripts to version control\n- [ ] Create seed data scripts for development\n- [ ] Add commands to run migrations and seeds\n- [ ] Document migration and seeding workflow\n- [ ] Test migrations (up and down)\n- [ ] Ensure seeds are idempotent\n\n## Best Practices\n- Never modify existing migrations\n- Always make migrations reversible when possible\n- Never run seeds in production\n- Test migrations on staging before production\n- Back up database before running migrations\n\n## Resources\n- [Flyway](https://flywaydb.org/) (Java)\n- [Alembic](https://alembic.sqlalchemy.org/) (Python)\n- [Knex.js](http://knexjs.org/) (Node.js)\n\n**Note**: Only applicable for projects with databases.\n", - "labels": [ - "database", - "backend", - "setup" - ] - }, - { - "title": "Logging: Implement Structured Logging (if applicable)", - "body": "## Description\nImplement structured logging for better log analysis and debugging.\n\n## Tasks\n- [ ] Choose logging library with structured logging support\n- [ ] Replace console.log/print with proper logger\n- [ ] Add log levels (debug, info, warn, error)\n- [ ] Include context in logs (request ID, user ID, etc.)\n- [ ] Add log aggregation (optional)\n- [ ] Configure log rotation\n- [ ] Document logging standards\n\n## Log Levels\n- ERROR: Application errors that need attention\n- WARN: Warning conditions\n- INFO: Informational messages\n- DEBUG: Detailed debug information\n\n## Tools\n- [Winston](https://github.com/winstonjs/winston) (Node.js)\n- [Loguru](https://github.com/Delgan/loguru) (Python)\n- [Serilog](https://serilog.net/) (.NET)\n\n## Resources\n- [Structured Logging Best Practices](https://www.honeycomb.io/blog/structured-logging-and-your-team)\n", - "labels": [ - "backend", - "logging", - "enhancement" - ] - }, - { - "title": "Setup: Add GitHub Repository Social Preview Image", - "body": "## Description\nAdd a social preview image to the GitHub repository to improve visibility and branding when the repository link is shared on social media, messaging apps, or other platforms.\n\n## Tasks\n- [ ] Design or create a social preview image (recommended size: 1280×640 px)\n- [ ] Go to the repository **Settings** on GitHub\n- [ ] Scroll down to the **Social preview** section\n- [ ] Upload the image\n- [ ] Verify the preview looks correct by sharing the repository link\n\n## Image Guidelines\n- Recommended size: **1280×640 px**\n- File formats: PNG, JPG, or GIF\n- Keep file size reasonable (under 1 MB)\n- Include project name, logo, and a short tagline if possible\n- Use high contrast and readable fonts\n- Ensure the image represents the project clearly\n\n## Why This Matters\nWhen users share the repository link on platforms like Twitter, LinkedIn, Slack, or Discord, GitHub automatically uses this image as the link preview thumbnail. A professional social preview image improves the project's credibility and recognition.\n\n## Resources\n- [GitHub Docs: Customizing your repository's social media preview](https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/customizing-your-repositorys-social-media-preview)\n- [Canva](https://www.canva.com/) for designing the image\n- [Figma](https://www.figma.com/) for more advanced design\n", - "labels": [ - "documentation", - "setup", - "good-first-issue" - ] - } - ] -} diff --git a/.github/release-drafter.yml b/.github/release-drafter.yml deleted file mode 100644 index e5a173b..0000000 --- a/.github/release-drafter.yml +++ /dev/null @@ -1,85 +0,0 @@ -name-template: 'v$RESOLVED_VERSION' -tag-template: 'v$RESOLVED_VERSION' - -categories: - - title: '🚀 Features' - labels: - - 'feature' - - 'enhancement' - - 'feat' - - title: '🐛 Bug Fixes' - labels: - - 'fix' - - 'bugfix' - - 'bug' - - title: '🧰 Maintenance' - labels: - - 'chore' - - 'maintenance' - - 'refactor' - - title: '📝 Documentation' - labels: - - 'documentation' - - 'docs' - - title: '🔧 Configuration' - labels: - - 'configuration' - - 'config' - - title: '🧪 Tests' - labels: - - 'tests' - - 'test' - - title: '⬆️ Dependencies' - labels: - - 'dependencies' - - 'deps' - - title: '🎨 Frontend' - labels: - - 'frontend' - - 'ui' - - title: '⚙️ Backend' - labels: - - 'backend' - - 'api' - - title: '🔐 Security' - labels: - - 'security' - - title: '🐳 Docker' - labels: - - 'docker' - - title: '🚀 CI/CD' - labels: - - 'ci-cd' - - 'github-actions' - - title: '👥 Contributors' - labels: - - 'first-time-contributor' - - 'repeat-contributor' - - 'org-member' - -change-template: '- $TITLE @$AUTHOR (#$NUMBER)' -change-title-escapes: '\<*_&' - -template: | - ## What's Changed - - $CHANGES - - ## Contributors - - $CONTRIBUTORS - - **Full Changelog**: https://github.com/$OWNER/$REPOSITORY/compare/$PREVIOUS_TAG...v$RESOLVED_VERSION - -exclude-labels: - - 'skip-changelog' - - 'no-changelog' - - 'duplicate' - - 'invalid' - - 'wontfix' - -replacers: - - search: '/CVE-(\d{4})-(\d+)/g' - replace: '[CVE-$1-$2](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-$1-$2)' - -include-pre-releases: false diff --git a/.github/workflows/cache-reaper.yml b/.github/workflows/cache-reaper.yml deleted file mode 100644 index 2b46db2..0000000 --- a/.github/workflows/cache-reaper.yml +++ /dev/null @@ -1,98 +0,0 @@ -# cache workaround : https://prosopo.io/blog/github-actions-cache-chaos/ -name: 🧹 Cache Reaper - -on: - schedule: - - cron: '0 2 * * 0' - workflow_dispatch: - inputs: - dry_run: - description: 'Dry run (log only)' - default: 'false' - type: choice - options: ['false', 'true'] - stale_days: - description: 'Days before cache is stale' - default: '7' - type: string - -permissions: - actions: write - contents: read - -jobs: - reap: - runs-on: ubuntu-latest - steps: - - name: Delete stale & orphaned caches - uses: actions/github-script@v9 - with: - script: | - const DRY_RUN = '${{ github.event.inputs.dry_run }}' === 'true'; - const staleDaysRaw = '${{ github.event.inputs.stale_days }}' || '7'; - const STALE_DAYS = Number(staleDaysRaw); - if (!Number.isInteger(STALE_DAYS) || STALE_DAYS < 1) { - throw new Error(`stale_days must be a positive integer, got "${staleDaysRaw}"`); - } - const cutoff = new Date(); - cutoff.setDate(cutoff.getDate() - STALE_DAYS); - - // Paginate all caches - let page = 1, all = []; - while (true) { - let data; - try { - ({ data } = await github.rest.actions.getActionsCacheList({ - owner: context.repo.owner, repo: context.repo.repo, - per_page: 100, page, - })); - } catch (err) { - core.setFailed(`Failed to list caches (page ${page}): ${err.message}`); - return; - } - if (!data.actions_caches.length) break; - all = all.concat(data.actions_caches); - if (data.actions_caches.length < 100) break; - page++; - } - - let deleted = 0, freed = 0; - for (const cache of all) { - const stale = new Date(cache.last_accessed_at) < cutoff; - const zeroByte = (cache.size_in_bytes || 0) === 0; - let closedPR = false; - const prMatch = cache.ref?.match(/refs\/pull\/(\d+)\/merge/); - if (prMatch) { - try { - const { data: pr } = await github.rest.pulls.get({ - owner: context.repo.owner, - repo: context.repo.repo, - pull_number: parseInt(prMatch[1]), - }); - closedPR = pr.state === 'closed'; - } catch (err) { - // PR may have been deleted; treat as closed - closedPR = true; - } - } - - if (!stale && !zeroByte && !closedPR) continue; - - const reason = stale ? `stale(${STALE_DAYS}d)` : zeroByte ? 'zero-byte' : 'closed-PR'; - console.log(`${DRY_RUN ? '[DRY]' : '🗑️'} ${reason} → ${cache.key}`); - - if (!DRY_RUN) { - try { - await github.rest.actions.deleteActionsCacheById({ - owner: context.repo.owner, repo: context.repo.repo, - cache_id: cache.id, - }); - deleted++; - freed += cache.size_in_bytes || 0; - } catch (err) { - console.log(`⚠️ Failed to delete ${cache.key}: ${err.message}`); - } - } - } - - console.log(`Done: ${deleted} deleted, ${(freed/1024/1024).toFixed(1)} MB freed`); \ No newline at end of file diff --git a/.github/workflows/checklist-score.yml b/.github/workflows/checklist-score.yml deleted file mode 100644 index a4c1223..0000000 --- a/.github/workflows/checklist-score.yml +++ /dev/null @@ -1,256 +0,0 @@ -name: Best Practices - -on: - push: - paths: - - 'BestPracticesChecklist.md' - schedule: - - cron: '0 9 * * 1' # Every Monday 9am UTC (for criteria sync) - workflow_dispatch: - -jobs: - - # Runs when BestPracticesChecklist.md changes - update-score: - runs-on: ubuntu-latest - permissions: - contents: write - if: github.event_name == 'push' || github.event_name == 'workflow_dispatch' - steps: - - uses: actions/checkout@v7 - with: - token: ${{ secrets.GITHUB_TOKEN }} - - - name: Parse checklist and compute score - run: | - python3 << 'EOF' - import json, re - from datetime import date - - CATEGORY_HEADERS = { - "## 🏗️ Basics": "basics", - "## 🔄 Change Control": "change_control", - "## 🐛 Reporting": "reporting", - "## ✅ Quality": "quality", - "## 🔐 Security": "security", - "## 🔬 Analysis": "analysis", - } - - CATEGORY_TOTALS = { - "basics": 8, - "change_control": 6, - "reporting": 8, - "quality": 11, - "security": 9, - "analysis": 7, - } - - with open("BestPracticesChecklist.md") as f: - content = f.read() - - lines = content.splitlines() - current_cat = None - counts = {k: 0 for k in CATEGORY_TOTALS} - - for line in lines: - stripped = line.strip() - for header, cat in CATEGORY_HEADERS.items(): - if stripped == header: - current_cat = cat - break - # [x] = Met, [~] = N/A (counts as met) - if current_cat and re.match(r'- \[[xX~]\]', stripped): - counts[current_cat] += 1 - - total_met = sum(counts.values()) - total = sum(CATEGORY_TOTALS.values()) - percent = round((total_met / total) * 100) if total > 0 else 0 - - if percent >= 80: - color = "brightgreen" - elif percent >= 60: - color = "yellow" - elif percent >= 40: - color = "orange" - else: - color = "red" - - status = { - "schemaVersion": 1, - "label": "Best Practices", - "message": f"{percent}%", - "schema": "aossie-best-practices-v1", - "updated": str(date.today()), - "met": total_met, - "total": total, - "percent": percent, - "color": color, - "categories": { - cat: {"met": counts[cat], "total": CATEGORY_TOTALS[cat]} - for cat in CATEGORY_TOTALS - } - } - - with open("checklist-status.json", "w") as f: - json.dump(status, f, indent=2) - - print(f"Score: {total_met}/{total} ({percent}%)") - EOF - - - name: Update score table in checklist - run: | - python3 << 'EOF' - import json, re - - with open("checklist-status.json") as f: - s = json.load(f) - - def emoji(met, total): - pct = met / total * 100 if total else 0 - return "✅" if pct == 100 else ("🟡" if pct >= 50 else "🔴") - - c = s["categories"] - table = f"""| Category | Met | Total | Status | - |--------------------|-----|-------|--------| - | Basics | {c['basics']['met']} | {c['basics']['total']} | {emoji(c['basics']['met'], c['basics']['total'])} | - | Change Control | {c['change_control']['met']} | {c['change_control']['total']} | {emoji(c['change_control']['met'], c['change_control']['total'])} | - | Reporting | {c['reporting']['met']} | {c['reporting']['total']} | {emoji(c['reporting']['met'], c['reporting']['total'])} | - | Quality | {c['quality']['met']} | {c['quality']['total']} | {emoji(c['quality']['met'], c['quality']['total'])} | - | Security | {c['security']['met']} | {c['security']['total']} | {emoji(c['security']['met'], c['security']['total'])} | - | Analysis | {c['analysis']['met']} | {c['analysis']['total']} | {emoji(c['analysis']['met'], c['analysis']['total'])} | - | **Total** | **{s['met']}** | **{s['total']}** | **{s['percent']}%** |""" - - with open("BestPracticesChecklist.md") as f: - content = f.read() - - marker = "" - if marker not in content: - print("⚠️ Warning: Auto-update marker not found in BestPracticesChecklist.md") - - new_content = re.sub( - r'(?<=\n).*?(?=\n---)', - table.strip(), - content, - flags=re.DOTALL - ) - - if new_content == content: - print("⚠️ Warning: Table was not updated - check marker format") - - with open("BestPracticesChecklist.md", "w") as f: - f.write(new_content) - EOF - - - name: Commit updated files - run: | - git config user.name "github-actions[bot]" - git config user.email "github-actions[bot]@users.noreply.github.com" - git add checklist-status.json BestPracticesChecklist.md - if ! git diff --staged --quiet; then - git commit -m "chore: update best practices score [skip ci]" - git fetch origin ${{ github.ref_name }} - if ! git rebase origin/${{ github.ref_name }}; then - git rebase --abort - exit 1 - fi - git push - fi - - # Fetches OpenSSF criteria → diffs → opens PR if changed (Runs ONLY in template-repo on schedule) - sync-criteria: - runs-on: ubuntu-latest - permissions: - contents: write - pull-requests: write - if: | - github.repository == 'AOSSIE-Org/Template-Repo' && - (github.event_name == 'schedule' || github.event_name == 'workflow_dispatch') - steps: - - uses: actions/checkout@v7 - - - name: Fetch upstream OpenSSF criteria - run: | - curl -sf \ - "https://raw.githubusercontent.com/coreinfrastructure/best-practices-badge/main/docs/criteria/criteria.md" \ - -o upstream_criteria.md || \ - curl -sf \ - "https://raw.githubusercontent.com/coreinfrastructure/best-practices-badge/main/docs/criteria.md" \ - -o upstream_criteria.md || { - echo "::error::Failed to fetch upstream OpenSSF criteria from both URLs" - exit 1 - } - - - name: Ensure maintenance label exists - run: gh label create maintenance --description "Maintenance tasks" --color "FBCA04" || true - env: - GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} - - - name: Diff upstream vs checklist and open PR if changed - run: | - python3 << 'EOF' - import re, subprocess, sys - from datetime import date - - with open("upstream_criteria.md") as f: - upstream_content = f.read() - - with open("BestPracticesChecklist.md") as f: - local_content = f.read() - - upstream_ids = set(re.findall(r'\[([a-z][a-z0-9_]+)\]\(#\1\)', upstream_content)) - local_ids = set(re.findall(r'\*\*([a-z][a-z0-9_]+)\*\*', local_content)) - - if not upstream_ids: - print("⚠️ Warning: No criteria IDs found in upstream. Format may have changed.") - sys.exit(0) - - added = upstream_ids - local_ids - removed = local_ids - upstream_ids - - if not added and not removed: - print("✅ In sync with upstream. No PR needed.") - sys.exit(0) - - lines = ["# OpenSSF Criteria Sync Report\n"] - if added: - lines.append("## 🆕 New criteria to add to checklist\n") - lines += [f"- `{c}`" for c in sorted(added)] - if removed: - lines.append("\n## ❌ Criteria removed from OpenSSF (review checklist)\n") - lines += [f"- `{c}`" for c in sorted(removed)] - - report = "\n".join(lines) - print(report) - - branch = f"chore/openssf-sync-{date.today()}" - subprocess.run(["git", "config", "user.name", "github-actions[bot]"], check=True) - subprocess.run(["git", "config", "user.email", "github-actions[bot]@users.noreply.github.com"], check=True) - subprocess.run(["git", "checkout", "-b", branch], check=True) - - with open(".github/openssf_criteria_diff.md", "w") as f: - f.write(report) - - subprocess.run(["git", "add", ".github/openssf_criteria_diff.md"], check=True) - subprocess.run(["git", "commit", "-m", f"chore: OpenSSF criteria diff {date.today()}"], check=True) - subprocess.run(["git", "push", "origin", branch], check=True) - - # Check if PR already exists for this branch - result = subprocess.run( - ["gh", "pr", "list", "--head", branch, "--json", "number"], - capture_output=True, text=True - ) - if result.returncode == 0 and result.stdout.strip() != "[]": - print(f"PR already exists for branch {branch}, skipping creation") - sys.exit(0) - - subprocess.run([ - "gh", "pr", "create", - "--title", "🔄 OpenSSF Criteria Update - Action Required", - "--body", report, - "--base", "main", - "--head", branch, - "--label", "maintenance" - ], check=True) - EOF - env: - GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} \ No newline at end of file diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml deleted file mode 100644 index 078c2fa..0000000 --- a/.github/workflows/codeql.yml +++ /dev/null @@ -1,141 +0,0 @@ -name: CodeQL Security Scan - -on: - push: - branches: [main] - pull_request: - branches: [main] - schedule: - - cron: "20 2 * * 1" # weekly scan - workflow_dispatch: - -jobs: - -# -------------------------------------------------- -# STEP 1: Detect languages automatically -# -------------------------------------------------- - - create-matrix: - runs-on: ubuntu-latest - if: ${{ github.repository_owner == 'AOSSIE-Org' }} - - permissions: - security-events: write - actions: read - contents: read - packages: read - - outputs: - matrix: ${{ steps.set-matrix.outputs.matrix || '[]' }} - - steps: - - - name: Detect repository languages - id: set-matrix - uses: advanced-security/set-codeql-language-matrix@v1 - with: - access-token: ${{ secrets.GITHUB_TOKEN }} - endpoint: ${{ github.event.repository.languages_url }} - - # ⚠️ OPTIONAL - # exclude: 'java,python' - - # ⚠️ OPTIONAL - # Force manual build for certain languages - # build-mode-manual-override: 'java' - - -# -------------------------------------------------- -# STEP 2: Run CodeQL analysis -# -------------------------------------------------- - - analyze: - needs: create-matrix - - if: ${{ github.repository_owner == 'AOSSIE-Org' && needs.create-matrix.outputs.matrix != '[]' }} - - name: Analyze (${{ matrix.language }}) - - # Swift requires macOS runners - runs-on: ${{ matrix.language == 'swift' && 'macos-latest' || 'ubuntu-latest' }} - - permissions: - security-events: write - actions: read - contents: read - - strategy: - fail-fast: false - matrix: ${{ fromJSON(needs.create-matrix.outputs.matrix || '[]') }} - - steps: - - - name: Checkout repository - uses: actions/checkout@v7 - - -# -------------------------------------------------- -# LANGUAGE RUNTIME SETUPS -# Only run if language exists -# -------------------------------------------------- - - - name: Setup Node - if: matrix.language == 'javascript-typescript' - uses: actions/setup-node@v7 - with: - node-version: 20 # ⚠️ MANUAL change if project requires another version - - - - name: Setup Python - if: matrix.language == 'python' - uses: actions/setup-python@v7 - with: - python-version: '3.x' # ⚠️ MANUAL change if project pins version - - - - name: Setup Java - if: matrix.language == 'java-kotlin' - uses: actions/setup-java@v5 - with: - distribution: temurin - java-version: '21' # ⚠️ MANUAL change if project uses 11 or 17 - -# -------------------------------------------------- -# Initialize CodeQL -# IMPORTANT: must run BEFORE build -# -------------------------------------------------- - - - name: Initialize CodeQL - uses: github/codeql-action/init@v4 - with: - languages: ${{ matrix.language }} - build-mode: ${{ matrix.build-mode }} - - # ⚠️ OPTIONAL - # Uncomment for deeper scans - # queries: security-extended - -# -------------------------------------------------- -# MANUAL BUILD (only for compiled languages) -# CodeQL must observe the build process -# -------------------------------------------------- - - # Gradle build - - name: Build Java (Gradle) - if: matrix.language == 'java-kotlin' && matrix.build-mode == 'manual' && hashFiles('gradlew') != '' - run: ./gradlew build --no-daemon -x test - - - # Maven build - - name: Build Java (Maven) - if: matrix.language == 'java-kotlin' && matrix.build-mode == 'manual' && hashFiles('pom.xml') != '' - run: mvn -B package --file pom.xml - -# -------------------------------------------------- -# Run CodeQL scan -# -------------------------------------------------- - - - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v4 - with: - category: "/language:${{ matrix.language }}" \ No newline at end of file diff --git a/.github/workflows/coderabbit-approval-dispatch.yml b/.github/workflows/coderabbit-approval-dispatch.yml deleted file mode 100644 index 71eb225..0000000 --- a/.github/workflows/coderabbit-approval-dispatch.yml +++ /dev/null @@ -1,101 +0,0 @@ -name: CodeRabbit Approval Label Applier - -on: - repository_dispatch: - types: [coderabbit_approved] - -permissions: - pull-requests: write - issues: write - -jobs: - apply-labels: - if: ${{ github.repository_owner == 'AOSSIE-Org' }} - runs-on: ubuntu-latest - steps: - - name: Remove pending CodeRabbit review label - id: remove-label - uses: actions/github-script@v9 - with: - github-token: ${{ github.token }} - script: | - const prNumber = context.payload.client_payload?.pr_number; - const labelToRemove = 'pending-coderabbit-review'; - - if (!prNumber) { - core.setFailed('Missing pr_number in repository_dispatch payload.'); - return; - } - - try { - const pr = await github.rest.issues.get({ - owner: context.repo.owner, - repo: context.repo.repo, - issue_number: prNumber - }); - - const hasLabel = pr.data.labels.some((label) => label.name === labelToRemove); - - if (hasLabel) { - await github.rest.issues.removeLabel({ - owner: context.repo.owner, - repo: context.repo.repo, - issue_number: prNumber, - name: labelToRemove - }); - - console.log(`✅ Removed '${labelToRemove}' from PR #${prNumber}`); - core.setOutput('label_was_present', 'true'); - } else { - console.log(`ℹ️ '${labelToRemove}' not present on PR #${prNumber}`); - core.setOutput('label_was_present', 'false'); - } - } catch (error) { - if (error.status === 404) { - console.log(`ℹ️ '${labelToRemove}' not found on PR #${prNumber}`); - core.setOutput('label_was_present', 'false'); - } else { - throw error; - } - } - - - name: Add CodeRabbit approved label - uses: actions/github-script@v9 - with: - github-token: ${{ github.token }} - script: | - const prNumber = context.payload.client_payload?.pr_number; - - if (!prNumber) { - core.setFailed('Missing pr_number in repository_dispatch payload.'); - return; - } - - await github.rest.issues.addLabels({ - owner: context.repo.owner, - repo: context.repo.repo, - issue_number: prNumber, - labels: ['coderabbit-approved'] - }); - - console.log(`✅ Added 'coderabbit-approved' to PR #${prNumber}`); - - - name: Summary - uses: actions/github-script@v9 - with: - github-token: ${{ github.token }} - script: | - const prNumber = context.payload.client_payload?.pr_number; - const labelWasPresent = '${{ steps.remove-label.outputs.label_was_present }}' === 'true'; - - console.log('='.repeat(50)); - console.log('CodeRabbit Approval Label Applier Complete'); - console.log('='.repeat(50)); - console.log(`✅ Processed PR #${prNumber}`); - if (labelWasPresent) { - console.log("✅ Removed 'pending-coderabbit-review' label"); - } else { - console.log("ℹ️ 'pending-coderabbit-review' label was not present"); - } - console.log("✅ Added 'coderabbit-approved' label"); - console.log('='.repeat(50)); diff --git a/.github/workflows/coderabbit-approval.yml b/.github/workflows/coderabbit-approval.yml deleted file mode 100644 index b5e386c..0000000 --- a/.github/workflows/coderabbit-approval.yml +++ /dev/null @@ -1,50 +0,0 @@ -name: CodeRabbit Approval Handler - -on: - pull_request_review: - types: [submitted] - -permissions: - contents: write - actions: write - pull-requests: write - -jobs: - dispatch-coderabbit-approval: - if: ${{ github.repository_owner == 'AOSSIE-Org' }} - runs-on: ubuntu-latest - steps: - - name: Dispatch event when CodeRabbit approves - uses: actions/github-script@v9 - with: - github-token: ${{ github.token }} - script: | - const prNumber = context.payload.pull_request.number; - const review = context.payload.review; - const reviewer = review?.user?.login || ''; - const state = review?.state || ''; - - console.log(`PR number: ${prNumber}`); - console.log(`Reviewer: ${reviewer}`); - console.log(`Review state: ${state}`); - - const isCodeRabbit = reviewer === 'coderabbitai' || reviewer === 'coderabbitai[bot]'; - const isApproved = state === 'approved'; - - if (!isCodeRabbit || !isApproved) { - console.log('Not a CodeRabbit approval review. No dispatch will be sent.'); - return; - } - - await github.rest.repos.createDispatchEvent({ - owner: context.repo.owner, - repo: context.repo.repo, - event_type: 'coderabbit_approved', - client_payload: { - pr_number: prNumber, - reviewer, - review_state: state - } - }); - - console.log(`✅ Dispatched 'coderabbit_approved' event for PR #${prNumber}`); diff --git a/.github/workflows/create-initial-issues.yml b/.github/workflows/create-initial-issues.yml deleted file mode 100644 index a09e306..0000000 --- a/.github/workflows/create-initial-issues.yml +++ /dev/null @@ -1,95 +0,0 @@ -name: Create Initial Issues - -on: - workflow_dispatch: - -jobs: - create-issues: - runs-on: ubuntu-latest - concurrency: - group: create-initial-issues-${{ github.ref }} - cancel-in-progress: false - if: ${{ github.repository != 'AOSSIE-Org/Template-Repo' }} - permissions: - contents: write - issues: write - - steps: - - name: Checkout repository - uses: actions/checkout@v7 - - - name: Check if issues file exists - id: check_file - run: | - if [ -f ".github/initial-issues.json" ]; then - echo "exists=true" >> $GITHUB_OUTPUT - else - echo "exists=false" >> $GITHUB_OUTPUT - echo "Issues file not found. Skipping..." - fi - - - name: Create issues from JSON - if: steps.check_file.outputs.exists == 'true' - id: create_issues - uses: actions/github-script@v9 - #js-yaml is NOT bundled with actions/github-script@v9 hecne we use JSON for the issues file - with: - script: | - const fs = require('fs'); - - // Read and parse the issues JSON file - const issuesData = JSON.parse(fs.readFileSync('.github/initial-issues.json', 'utf8')); - - // Validate structure - if (!issuesData || !issuesData.issues || !Array.isArray(issuesData.issues)) { - throw new Error('Invalid issues data structure. Expected { issues: [...] }'); - } - - console.log(`Creating ${issuesData.issues.length} issues...`); - - let successCount = 0; - let failCount = 0; - - // Create each issue - for (const issue of issuesData.issues) { - try { - const response = await github.rest.issues.create({ - owner: context.repo.owner, - repo: context.repo.repo, - title: issue.title, - body: issue.body, - labels: issue.labels || [] - }); - console.log(`✓ Created issue #${response.data.number}: ${issue.title}`); - successCount++; - } catch (error) { - console.error(`✗ Failed to create issue "${issue.title}":`, error.message); - failCount++; - } - } - - console.log(`\nSummary: ${successCount} succeeded, ${failCount} failed`); - - // Fail the step if any issues failed to create - if (failCount > 0) { - throw new Error(`Failed to create ${failCount} issue(s)`); - } - - - name: Delete issues file and workflow - if: steps.create_issues.outcome == 'success' - run: | - git config user.name "github-actions[bot]" - git config user.email "github-actions[bot]@users.noreply.github.com" - - # Delete the files - git rm .github/initial-issues.json - git rm .github/workflows/create-initial-issues.yml - - # Commit the changes - git commit -m "chore: cleanup initial issues automation files" - - # Pull latest changes to avoid conflicts - git pull --rebase origin ${{ github.ref_name }} - - # Push the changes - git push diff --git a/.github/workflows/danger.yml b/.github/workflows/danger.yml deleted file mode 100644 index d082189..0000000 --- a/.github/workflows/danger.yml +++ /dev/null @@ -1,32 +0,0 @@ -name: PR Template Validation - -# pull_request_target is used (instead of pull_request) so that GITHUB_TOKEN -# has write permissions even for PRs from forks, which is required for Danger -# to post review comments. The Dangerfile is always read from the base branch -# (checked out below), so no untrusted code from the fork is executed. -on: - pull_request_target: - types: [opened, edited, reopened, synchronize] - -permissions: - contents: read - pull-requests: write - issues: write - -jobs: - danger: - if: ${{ github.repository_owner == 'AOSSIE-Org' }} - runs-on: ubuntu-latest - steps: - - name: Checkout base branch - uses: actions/checkout@v7 - - - name: Setup Node.js - uses: actions/setup-node@v7 - with: - node-version: "20" - - - name: Run Danger JS - run: npx --yes danger@13.0.7 ci - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/dependency-review-action.yml b/.github/workflows/dependency-review-action.yml deleted file mode 100644 index 05ac8ac..0000000 --- a/.github/workflows/dependency-review-action.yml +++ /dev/null @@ -1,153 +0,0 @@ -# Automatically scans every PR for newly added dependencies -# Blocks merges if a dependency license is NOT in the allow-list -# Flags CVEs with moderate+ severity -# Docs: https://github.com/actions/dependency-review-action - - -name: Dependency Review - -on: - pull_request: - branches: - - main - - master - - develop - # Only re-run when dependency manifests actually change - paths: - # JavaScript / TypeScript / Node - - "**/package.json" - - "**/package-lock.json" - - "**/yarn.lock" - - "**/pnpm-lock.yaml" - # Python - - "**/requirements*.txt" - - "**/Pipfile.lock" - - "**/pyproject.toml" - - "**/poetry.lock" - # Rust - - "**/Cargo.toml" - - "**/Cargo.lock" - # Go - - "**/go.mod" - - "**/go.sum" - # Java / Kotlin / Android - - "**/pom.xml" - - "**/build.gradle" - - "**/build.gradle.kts" - - "**/*.gradle" - # Ruby - - "**/Gemfile.lock" - # Docker / Infrastructure - - "**/Dockerfile" - - "**/docker-compose*.yml" - - "**/docker-compose*.yaml" - # GitHub Actions themselves - - ".github/workflows/*.yml" - - ".github/workflows/*.yaml" - -permissions: - contents: read # Required to read the repo content -# pull-requests: write # Required to post review comments on the PR - -jobs: - dependency-review: - name: Dependency & License Review - runs-on: ubuntu-latest - - steps: - - name: Run Dependency Review - uses: actions/dependency-review-action@v5 - with: - # ── VULNERABILITY SETTINGS ────────────────────────── - # Fail if any newly added dependency has a CVE at this - # severity level or above. Options: low | moderate | high | critical - fail-on-severity: moderate - - # Which dependency scopes to check for vulnerabilities - # Options: runtime | development | unknown (comma-separated) - fail-on-scopes: runtime - - # ── LICENSE ENFORCEMENT ───────────────────────────── - # ALLOW: Only these licenses are permitted in new dependencies. - # PRs introducing any other license will fail automatically. - # Full SPDX list: https://spdx.org/licenses/ - allow-licenses: >- - MIT, - Apache-2.0, - BSD-2-Clause, - BSD-3-Clause, - ISC, - CC0-1.0, - Unlicense, - GPL-2.0-only, - GPL-2.0-or-later, - GPL-3.0-only, - GPL-3.0-or-later, - LGPL-2.0-only, - LGPL-2.0-or-later, - LGPL-2.1-only, - LGPL-2.1-or-later, - LGPL-3.0-only, - LGPL-3.0-or-later, - AGPL-3.0-only, - AGPL-3.0-or-later, - MPL-2.0, - EUPL-1.2, - Python-2.0, - PSF-2.0 - - # PER-PACKAGE EXCEPTIONS: Packages excluded from license checks entirely. - # Use for packages with unrecognized/non-standard license declarations. - # Format: "pkg:npm/name, pkg:pypi/name, pkg:githubactions/owner/repo@version" - # ── Edit this list when adding approved exceptions ── - # allow-dependencies-licenses: >- - # pkg:npm/example-package, - # pkg:pypi/example-package - - # ── SCOPE FILTERING ───────────────────────────────── - # Skip dev-only dependencies (test frameworks, linters, etc.) - # They are not shipped to production so risk is lower. - # Set to "all" to also scan devDependencies. - # Options: runtime | development | all - # Using "runtime" keeps noise low in template repos - # where dev deps vary wildly by project type. - # Uncomment the line below to enforce on devDeps too: - # fail-on-scopes: runtime, development - allow-ghsas: "" # Leave empty to block all known GHSAs - - # ── OUTPUT & COMMENTS ──────────────────────────────── - # Post a detailed summary comment directly on the PR - # comment-summary-in-pr: always - - # Fail (don't just warn) on license violations. - # Change to "true" to only warn without failing. - warn-only: false - - # ── VULNERABILITY DATABASE ─────────────────────────── - # Use the GitHub Advisory Database (GHSA) as the source. - # This is the default; listed explicitly for clarity. - # vulnerability-check: true # default - # Add explicitly so teams know it's active - show-openssf-scorecard: true - warn-on-openssf-scorecard-level: 3 - - # Post a status summary badge to PR - # summarize: - # name: Post Review Summary - # runs-on: ubuntu-latest - # needs: dependency-review - # if: always() - - # steps: - # - name: 📋 Summarize Result - # run: | - # if [ "${{ needs.dependency-review.result }}" == "success" ]; then - # echo "✅ Dependency review passed — no license violations or CVEs found." - # else - # echo "❌ Dependency review failed — check the PR comment for details." - # echo "" - # echo "Common fixes:" - # echo " • Replace dependencies using licenses not in allow-licenses" - # echo " • Upgrade vulnerable packages to patched versions" - # echo " • Add an explicit exception to allow-dependencies-licenses if intentional" - # fi \ No newline at end of file diff --git a/.github/workflows/gitleaks-scanning.yml b/.github/workflows/gitleaks-scanning.yml deleted file mode 100644 index fe88e87..0000000 --- a/.github/workflows/gitleaks-scanning.yml +++ /dev/null @@ -1,19 +0,0 @@ -name: gitleaks -on: - pull_request: - push: - workflow_dispatch: - schedule: - - cron: "0 4 * * *" # run once a day at 4 AM -jobs: - scan: - name: gitleaks - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v7 - with: - fetch-depth: 0 - - uses: gitleaks/gitleaks-action@v3 - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE }} \ No newline at end of file diff --git a/.github/workflows/label-merge-conflicts.yml b/.github/workflows/label-merge-conflicts.yml deleted file mode 100644 index ecad65c..0000000 --- a/.github/workflows/label-merge-conflicts.yml +++ /dev/null @@ -1,29 +0,0 @@ -name: Label Merge Conflicts - -on: - push: - pull_request_target: - types: [opened, reopened, synchronize] - -permissions: - pull-requests: write - contents: read - -jobs: - label-conflicts: - runs-on: ubuntu-latest - steps: - - name: Label PRs with merge conflicts - uses: eps1lon/actions-label-merge-conflict@v3 - with: - dirtyLabel: "PR has merge conflicts" - repoToken: "${{ secrets.GITHUB_TOKEN }}" - commentOnDirty: | - ⚠️ **This PR has merge conflicts.** - - Please resolve the merge conflicts before review. - - Your PR will only be reviewed by a maintainer after all conflicts have been resolved. - - 📺 Watch this video to understand why conflicts occur and how to resolve them: - https://www.youtube.com/watch?v=Sqsz1-o7nXk diff --git a/.github/workflows/osv-scanner-pr.yml b/.github/workflows/osv-scanner-pr.yml deleted file mode 100644 index 4951186..0000000 --- a/.github/workflows/osv-scanner-pr.yml +++ /dev/null @@ -1,21 +0,0 @@ -# https://google.github.io/osv-scanner/github-action/#scan-on-pull-request -name: OSV-Scanner PR Scan - -# Change "main" to your default branch if you use a different name, i.e. "master" -on: - pull_request: - branches: [main] - merge_group: - branches: [main] - -permissions: - # Required to upload SARIF file to CodeQL. See: https://github.com/github/codeql-action/issues/2117 - actions: read - # Require writing security events to upload SARIF file to security tab - security-events: write - # Only need to read contents - contents: read - -jobs: - scan-pr: - uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml@v2.3.8 \ No newline at end of file diff --git a/.github/workflows/osv-scanner-release.yml b/.github/workflows/osv-scanner-release.yml deleted file mode 100644 index d543db9..0000000 --- a/.github/workflows/osv-scanner-release.yml +++ /dev/null @@ -1,54 +0,0 @@ -# https://google.github.io/osv-scanner/github-action/#scan-on-release -name: Go Release Process - -on: - push: - tags: - - "*" # triggers only if push new tag version, like `0.8.4` or else - -permissions: - # Required to upload SARIF file to CodeQL. See: https://github.com/github/codeql-action/issues/2117 - actions: read - # Require writing security events to upload SARIF file to security tab - security-events: write - # to fetch code (actions/checkout) - contents: read - -jobs: - osv-scan: - uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml@v2.3.8" - with: - # Recursive scan supports multiple ecosystems: - # Go, Node.js, Python, Rust, Java, etc. - scan-args: |- - ./ - permissions: - # Require writing security events to upload SARIF file to security tab - security-events: write - tests: - name: Run unit tests - runs-on: ubuntu-latest - steps: - - name: Placeholder test step - run: echo "Configure project-specific tests here" - # Replace placeholder steps with actual project tests - # Examples: - # npm test - # go test ./... - # pytest - # cargo test - release: - needs: # Needs both tests and osv-scan to pass - - tests - - osv-scan - runs-on: ubuntu-latest - # Your actual release steps - steps: - - name: Placeholder release step - run: echo "Configure release steps here" - # Add actual release/build/publish steps here - # Examples: - # - Build binaries - # - Publish Docker image - # - Create GitHub Release - # - Upload artifacts diff --git a/.github/workflows/release-drafter.yml b/.github/workflows/release-drafter.yml deleted file mode 100644 index 69c3b10..0000000 --- a/.github/workflows/release-drafter.yml +++ /dev/null @@ -1,26 +0,0 @@ -name: Release Drafter - -on: - push: - branches: - - main - - master - pull_request: - types: [closed] - -permissions: - contents: write - pull-requests: write - -jobs: - update_release_draft: - if: ${{ github.repository_owner == 'AOSSIE-Org' }} - runs-on: ubuntu-latest - steps: - - name: Run Release Drafter - uses: release-drafter/release-drafter@v7 - with: - config-name: release-drafter.yml - disable-autolabeler: false - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/release-goreleaser.yml b/.github/workflows/release-goreleaser.yml deleted file mode 100644 index 8da7c02..0000000 --- a/.github/workflows/release-goreleaser.yml +++ /dev/null @@ -1,35 +0,0 @@ -name: Release -concurrency: - group: release-${{ github.ref }} - cancel-in-progress: false -on: - push: - tags: ["v*.*.*"] -jobs: - release: - name: Release with GoReleaser - runs-on: ubuntu-latest - permissions: - contents: write - packages: write # [DOCKER] Required for ghcr.io push - id-token: write # [SIGNING] Required for cosign keyless signing - steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 - with: - fetch-depth: 0 # Full history needed for changelog - persist-credentials: false # Avoid exposing token to submodules - - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # [NODE] Remove if not a Node.js project - with: - node-version: '20' - cache: '' - # [PYTHON] Add: actions/setup-python@v5 with python-version: '3.12' - # [DOCKER] Add: docker/setup-buildx-action@v3 + docker/login-action@v3 - # [GO] Add: actions/setup-go@v5 with go-version: stable - - uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 - with: - version: latest - args: release --clean - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - # NPM_TOKEN: ${{ secrets.NPM_TOKEN }} # [NODE] - # DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }} # [DOCKER] \ No newline at end of file diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml deleted file mode 100644 index 5b54af5..0000000 --- a/.github/workflows/scorecard.yml +++ /dev/null @@ -1,103 +0,0 @@ -name: Scorecard supply-chain security - -# ⚠️ API INTEGRITY RULES (enforced when publish_results: true): -# - NO top-level `env:` or `defaults:` blocks in this file -# - NO workflow-level write permissions -# - ONLY this job may use id-token: write -# Violating any of these causes the publish step to be REJECTED by api.scorecard.dev - -on: - branch_protection_rule: - - schedule: - - cron: '23 8 * * 6' - - push: - # Branch-Protection check ONLY works on the default branch(Must match your actual default branch). - branches: ["dev"] - - workflow_dispatch: - -permissions: read-all - -jobs: - analysis: - name: Scorecard analysis - runs-on: ubuntu-latest - - if: | - !github.event.repository.fork && - (github.event.repository.default_branch == github.ref_name || - github.event_name == 'workflow_dispatch' || - github.event_name == 'pull_request') - - permissions: - security-events: write - id-token: write - actions: read - # Uncomment for PRIVATE repositories. - # contents: read - - steps: - - name: "Harden Runner" - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 - with: - disable-sudo-and-containers: false - # MAINTAINER CHOICE: Use "audit" first to discover needed endpoints, - # then switch to "block" once confirmed stable. - egress-policy: block - # MAINTAINER CHOICE: Add project-specific endpoints if your stack - # needs private registries, package mirrors, etc. - allowed-endpoints: > - github.com:443 - api.github.com:443 - index.docker.io:443 - www.bestpractices.dev:443 - oss-fuzz-build-logs.storage.googleapis.com:443 - api.osv.dev:443 - api.deps.dev:443 - fulcio.sigstore.dev:443 - tuf-repo-cdn.sigstore.dev:443 - rekor.sigstore.dev:443 - auth.docker.io:443 - api.scorecard.dev:443 - - - name: "Checkout code" - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - with: - persist-credentials: false - - - name: "Run analysis" - uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3 - with: - results_file: results.sarif - results_format: sarif - - # MAINTAINER CHOICE: Uncomment + add secret if: - # - PUBLIC repo wanting Branch-Protection check, OR - # - PRIVATE repo (needs full `repo` scope, not just `public_repo`) - # PAT scopes needed: public_repo (public) OR repo (private) - # If org uses SAML SSO, also enable SSO on this PAT. - # repo_token: ${{ secrets.SCORECARD_TOKEN }} - - # MAINTAINER CHOICE: true = enables badge + publishes to api.scorecard.dev - # After first run, add this badge to your README.md: - # [![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/{owner}/{repo}/badge)](https://scorecard.dev/viewer/?uri=github.com/{owner}/{repo}) - publish_results: true - - # MAINTAINER CHOICE: "archive" (default) is faster. - # Switch to "git" only if your repo uses .gitattributes export-ignore - # directives that cause files to be excluded from the archive download. - # file_mode: archive - - - name: "Upload artifact" - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 - with: - name: SARIF file - path: results.sarif - retention-days: 5 - - - name: "Upload to code-scanning" - uses: github/codeql-action/upload-sarif@v4 - with: - sarif_file: results.sarif \ No newline at end of file diff --git a/.github/workflows/setup-labels.yml b/.github/workflows/setup-labels.yml deleted file mode 100644 index 2865f3b..0000000 --- a/.github/workflows/setup-labels.yml +++ /dev/null @@ -1,210 +0,0 @@ -name: Setup Repository Labels - -on: - workflow_dispatch: # Manual trigger - push: - branches: [main, master] - paths: - - '.github/workflows/setup-labels.yml' - -permissions: - issues: write - -jobs: - create-labels: - runs-on: ubuntu-latest - steps: - - name: Create all required labels - uses: actions/github-script@v9 - with: - github-token: ${{ secrets.GITHUB_TOKEN }} - script: | - // Define all labels with colors and descriptions - const requiredLabels = [ - // ==================== CONTRIBUTOR LABELS ==================== - { - name: 'org-member', - color: '0E8A16', - description: 'Member of the organization with admin/maintain permissions' - }, - { - name: 'first-time-contributor', - color: '7057FF', - description: 'First PR of an external contributor' - }, - { - name: 'repeat-contributor', - color: '6F42C1', - description: 'PR from an external contributor who already had PRs merged' - }, - - // ==================== ISSUE TRACKING LABELS ==================== - { - name: 'no-issue-linked', - color: 'D73A4A', - description: 'PR is not linked to any issue' - }, - - // ==================== FILE TYPE LABELS ==================== - { - name: 'documentation', - color: '0075CA', - description: 'Changes to documentation files' - }, - { - name: 'frontend', - color: 'FEF2C0', - description: 'Changes to frontend code' - }, - { - name: 'backend', - color: 'BFD4F2', - description: 'Changes to backend code' - }, - { - name: 'javascript', - color: 'F1E05A', - description: 'JavaScript/TypeScript code changes' - }, - { - name: 'python', - color: '3572A5', - description: 'Python code changes' - }, - { - name: 'configuration', - color: 'EDEDED', - description: 'Configuration file changes' - }, - { - name: 'github-actions', - color: '2088FF', - description: 'GitHub Actions workflow changes' - }, - { - name: 'dependencies', - color: '0366D6', - description: 'Dependency file changes' - }, - { - name: 'tests', - color: 'C5DEF5', - description: 'Test file changes' - }, - { - name: 'docker', - color: '0DB7ED', - description: 'Docker-related changes' - }, - { - name: 'ci-cd', - color: '6E5494', - description: 'CI/CD pipeline changes' - }, - - // ==================== SIZE LABELS ==================== - { - name: 'size/XS', - color: '00FF00', - description: 'Extra small PR (≤10 lines changed)' - }, - { - name: 'size/S', - color: '77FF00', - description: 'Small PR (11-50 lines changed)' - }, - { - name: 'size/M', - color: 'FFFF00', - description: 'Medium PR (51-200 lines changed)' - }, - { - name: 'size/L', - color: 'FF9900', - description: 'Large PR (201-500 lines changed)' - }, - { - name: 'size/XL', - color: 'FF0000', - description: 'Extra large PR (>500 lines changed)' - } - ]; - - console.log('='.repeat(60)); - console.log('🏷️ REPOSITORY LABEL SETUP'); - console.log('='.repeat(60)); - console.log(`Total labels to create: ${requiredLabels.length}\n`); - - // Get existing labels with pagination - const existingLabels = await github.paginate( - github.rest.issues.listLabelsForRepo, - { - owner: context.repo.owner, - repo: context.repo.repo, - per_page: 100 - } - ); - - const existingLabelNames = existingLabels.map(label => label.name); - - let created = 0; - let updated = 0; - let skipped = 0; - let failed = 0; - - // Process each label - for (const label of requiredLabels) { - try { - if (!existingLabelNames.includes(label.name)) { - // Create new label - await github.rest.issues.createLabel({ - owner: context.repo.owner, - repo: context.repo.repo, - name: label.name, - color: label.color, - description: label.description - }); - console.log(`✅ Created: ${label.name} (#${label.color})`); - created++; - } else { - // Update existing label (in case color/description changed) - const existingLabel = existingLabels.find(l => l.name === label.name); - if (existingLabel.color !== label.color || existingLabel.description !== label.description) { - await github.rest.issues.updateLabel({ - owner: context.repo.owner, - repo: context.repo.repo, - name: label.name, - color: label.color, - description: label.description - }); - console.log(`🔄 Updated: ${label.name} (#${label.color})`); - updated++; - } else { - console.log(`⏭️ Skipped: ${label.name} (already exists)`); - skipped++; - } - } - } catch (error) { - console.log(`❌ Failed: ${label.name} - ${error.message}`); - failed++; - } - } - - // Summary - console.log('\n' + '='.repeat(60)); - console.log('📊 SUMMARY'); - console.log('='.repeat(60)); - console.log(`✅ Created: ${created}`); - console.log(`🔄 Updated: ${updated}`); - console.log(`⏭️ Skipped: ${skipped}`); - console.log(`❌ Failed: ${failed}`); - console.log('='.repeat(60)); - - // Fail the step if any labels failed to create/update - if (failed > 0) { - core.setFailed(`Label setup failed! ${failed} label(s) could not be created or updated.`); - } else if (created > 0 || updated > 0) { - console.log('\n🎉 Label setup complete! Your repository is ready.'); - } else { - console.log('\n✨ All labels are already up to date.'); - } diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml deleted file mode 100644 index 496ccd6..0000000 --- a/.github/workflows/stale.yml +++ /dev/null @@ -1,153 +0,0 @@ -name: Mark stale issues and pull requests - -on: - schedule: - # Runs every hour at minute 35. - # `@maintainer`: For most repos a daily schedule is sufficient, e.g. '0 1 * * *' - - cron: "0 1 * * *" - -permissions: - contents: read - -jobs: - stale: - permissions: - issues: write # required: mark stale, comment, and close issues - pull-requests: write # required: mark stale, comment, and close PRs - # contents: write # @maintainer: uncomment if you enable delete-branch: true - runs-on: ubuntu-latest - - steps: - - uses: actions/stale@v10 - with: - repo-token: ${{ secrets.GITHUB_TOKEN }} - - # ── Stale & close timing ──────────────────────────────────────────── - # Issues inactive for 90 days are marked stale - days-before-issue-stale: 90 - # PRs inactive for 14 days are marked stale - days-before-pr-stale: 14 - # Close stale issues after 7 more days of inactivity - days-before-issue-close: 7 - # Close stale PRs after 7 more days of inactivity - days-before-pr-close: 7 - - # ── Messages ──────────────────────────────────────────────────────── - stale-issue-message: > - Hello 👋 This issue has been open for more than 3 months with no activity. - If it is still relevant, please leave a comment to keep it alive — community - support is always welcome! If you found a fix, please open a pull request. 🙏 - This issue will be automatically closed in **7 days** if there is no further activity. - - stale-pr-message: > - Hello 👋 This PR has had no activity for more than 2 weeks. - If you are still working on it, please push an update or leave a comment. - Ping a maintainer if you believe it is ready for review or merge! - This PR will be automatically closed in **7 days** if there is no further activity. - - # Message posted when a stale issue is actually closed - close-issue-message: > - This issue was automatically closed after being stale for 7 days with no activity. 😔 - If you believe this was closed in error, feel free to reopen it with additional context. - Thank you for contributing to AOSSIE! 🙏 - - # Message posted when a stale PR is actually closed - close-pr-message: > - This PR was automatically closed after being stale for 7 days with no activity. 😔 - If you would like to continue, please reopen it and ping a maintainer for a review. - Thank you for your contribution to AOSSIE! 🙏 - - # ── Labels ────────────────────────────────────────────────────────── - stale-issue-label: 'Stale' - stale-pr-label: 'Stale' - # Reason shown on GitHub when an issue is closed automatically - close-issue-reason: 'not_planned' - - # @maintainer: Uncomment and set a label to apply when issues are auto-closed - # close-issue-label: 'Closed - Stale' - - # @maintainer: Uncomment and set a label to apply when PRs are auto-closed - # close-pr-label: 'Closed - Stale' - - # ── Exempt labels ──────────────────────────────────────────────────── - # Issues carrying ANY of these labels are never marked stale. - # @maintainer: Adjust the list to match your project's label conventions. - exempt-issue-labels: 'Keep Open,Accepted,In Progress,help wanted,good first issue' - - # PRs carrying ANY of these labels are never marked stale. - # @maintainer: Adjust as needed (e.g. add 'ready for review'). - exempt-pr-labels: 'Keep Open,Work In Progress,WIP' - - # ── Draft PR protection ────────────────────────────────────────────── - # Draft PRs are always excluded — they are explicitly works in progress. - exempt-draft-pr: true - - # ── Milestone protection ───────────────────────────────────────────── - # @maintainer: Uncomment to prevent staling issues/PRs that belong to a milestone. - # exempt-all-issue-milestones: true - # exempt-all-pr-milestones: true - - # @maintainer: Or exempt only specific milestone names (comma-separated): - # exempt-issue-milestones: 'v1.0,v2.0' - # exempt-pr-milestones: 'v1.0,v2.0' - - # ── Assignee protection ────────────────────────────────────────────── - # @maintainer: Uncomment to prevent staling any assigned issue or PR. - # exempt-all-issue-assignees: true - # exempt-all-pr-assignees: true - - # @maintainer: Or exempt specific maintainer/bot accounts (comma-separated): - # exempt-issue-assignees: 'maintainer1,maintainer2' - # exempt-pr-assignees: 'maintainer1,maintainer2' - - # ── PR filtering ───────────────────────────────────────────────────── - # @maintainer: Uncomment to process ONLY PRs that carry a specific label - # (e.g. only chase PRs that are waiting on the author to respond). - # only-pr-labels: 'Needs Author Reply' - - # @maintainer: Uncomment to process only issues/PRs that carry AT LEAST ONE - # of the listed labels (useful to target specific categories). - # any-of-labels: 'needs-more-info,awaiting-feedback' - - # ── Branch cleanup ─────────────────────────────────────────────────── - # @maintainer: Set to true to auto-delete branches of auto-closed stale PRs. - # Also requires 'contents: write' permission in the job block above. - # delete-branch: false - - # ── Behaviour ──────────────────────────────────────────────────────── - # Remove the Stale label automatically when a new comment or push arrives. - remove-stale-when-updated: true - - # Process oldest issues/PRs first so long-standing contributions get attention. - ascending: true - - # Cap GitHub API calls per run to stay within rate limits. - # @maintainer: Raise this (e.g. 100–200) if your repo has many open items. - operations-per-run: 30 - - # Print a statistics summary at the end of each run (useful for debugging). - enable-statistics: true - - # ── Label transitions ───────────────────────────────────────────────── - # @maintainer: Uncomment to strip a label when an issue/PR becomes stale. - # labels-to-remove-when-stale: 'In Progress' - - # @maintainer: Uncomment to add a label when an issue/PR becomes un-stale. - # labels-to-add-when-unstale: 'In Progress' - - # @maintainer: Uncomment to strip a label when an issue/PR becomes un-stale. - # labels-to-remove-when-unstale: 'Needs Author Reply' - - # ── Start date ──────────────────────────────────────────────────────── - # @maintainer: Uncomment and set a date to skip issues/PRs created before it. - # Handy when adding this workflow to an existing repo with old open items. - # start-date: '2024-01-01T00:00:00Z' # ISO 8601 format - - # ── Issue types ─────────────────────────────────────────────────────── - # @maintainer: Uncomment to restrict stale processing to specific issue types - # (GitHub Issues feature — only applies if your org uses issue types). - # only-issue-types: 'bug,feature' - - # ── Sort order ──────────────────────────────────────────────────────── - # @maintainer: Change sort field if needed. Options: created | updated | comments - # sort-by: 'created' \ No newline at end of file diff --git a/.github/workflows/sync-pr-labels.yml b/.github/workflows/sync-pr-labels.yml deleted file mode 100644 index bcaf6f7..0000000 --- a/.github/workflows/sync-pr-labels.yml +++ /dev/null @@ -1,456 +0,0 @@ -name: Sync PR Labels - -on: - pull_request_target: - types: [opened, reopened, synchronize, edited] - -permissions: - contents: read - pull-requests: write - issues: write - -jobs: - sync-labels: - if: ${{ github.repository_owner == 'AOSSIE-Org' }} - runs-on: ubuntu-latest - steps: - - name: Get PR details - id: pr-details - uses: actions/github-script@v9 - with: - github-token: ${{ secrets.GITHUB_TOKEN }} - script: | - const pr = context.payload.pull_request; - const details = { - number: pr.number, - body: pr.body || '', - base: pr.base.ref, - head: pr.head.ref - }; - core.info(`PR Details:\n${JSON.stringify(details, null, 2)}`); - return details; - - # STEP 1: Issue-based labels - - name: Extract linked issue number - id: extract-issue - uses: actions/github-script@v9 - with: - github-token: ${{ secrets.GITHUB_TOKEN }} - script: | - const prBody = context.payload.pull_request.body || ''; - - // Match patterns: Fixes #123, Closes #123, Resolves #123, etc. - const issuePatterns = [ - /(?:fix|fixes|fixed|close|closes|closed|resolve|resolves|resolved)\s+#(\d+)/gi, - /#(\d+)/g - ]; - - let issueNumber = null; - for (const pattern of issuePatterns) { - const match = prBody.match(pattern); - if (match) { - const numbers = match.map(m => m.match(/\d+/)[0]); - issueNumber = numbers[0]; - break; - } - } - - core.setOutput('issue_number', issueNumber || ''); - return issueNumber; - - - name: Apply issue-based labels - if: steps.extract-issue.outputs.issue_number != '' - uses: actions/github-script@v9 - env: - ISSUE_NUMBER: ${{ steps.extract-issue.outputs.issue_number }} - with: - github-token: ${{ secrets.GITHUB_TOKEN }} - script: | - const issueNumber = process.env.ISSUE_NUMBER; - const prNumber = context.payload.pull_request.number; - - try { - // Fetch issue labels - const issue = await github.rest.issues.get({ - owner: context.repo.owner, - repo: context.repo.repo, - issue_number: parseInt(issueNumber) - }); - - const issueLabels = issue.data.labels.map(label => - typeof label === 'string' ? label : label.name - ); - - if (issueLabels.length > 0) { - console.log(`Applying issue-based labels: ${issueLabels.join(', ')}`); - - // Add labels from issue - await github.rest.issues.addLabels({ - owner: context.repo.owner, - repo: context.repo.repo, - issue_number: prNumber, - labels: issueLabels - }); - } - - // Remove "no-issue-linked" label if present - try { - await github.rest.issues.removeLabel({ - owner: context.repo.owner, - repo: context.repo.repo, - issue_number: prNumber, - name: 'no-issue-linked' - }); - console.log('Removed "no-issue-linked" label'); - } catch (error) { - if (error.status !== 404) { - console.error(`Error removing no-issue-linked label: ${error.message}`); - throw error; - } - } - } catch (error) { - console.log(`Error fetching issue #${issueNumber}: ${error.message}`); - } - - - name: Mark no issue linked - if: steps.extract-issue.outputs.issue_number == '' - uses: actions/github-script@v9 - with: - github-token: ${{ secrets.GITHUB_TOKEN }} - script: | - const prNumber = context.payload.pull_request.number; - - console.log('No issue linked to this PR'); - - // Add "no-issue-linked" label - try { - await github.rest.issues.addLabels({ - owner: context.repo.owner, - repo: context.repo.repo, - issue_number: prNumber, - labels: ['no-issue-linked'] - }); - } catch (error) { - console.error(`Error adding no-issue-linked label to PR #${prNumber}: ${error.message}`); - } - - # STEP 2: File-based labels - - name: Get changed files - id: changed-files - uses: actions/github-script@v9 - with: - github-token: ${{ secrets.GITHUB_TOKEN }} - script: | - const prNumber = context.payload.pull_request.number; - - // Get list of files changed in the PR - const files = await github.paginate(github.rest.pulls.listFiles, { - owner: context.repo.owner, - repo: context.repo.repo, - pull_number: prNumber - }); - - const changedFiles = files.map(file => file.filename); - core.setOutput('files', JSON.stringify(changedFiles)); - - return changedFiles; - - - name: Apply file-based labels - uses: actions/github-script@v9 - env: - CHANGED_FILES: ${{ steps.changed-files.outputs.files }} - with: - github-token: ${{ secrets.GITHUB_TOKEN }} - script: | - const prNumber = context.payload.pull_request.number; - const changedFiles = JSON.parse(process.env.CHANGED_FILES); - - const fileLabels = []; - - // Define file-based label mappings - const labelMappings = { - 'documentation': ['.md', 'README', 'CONTRIBUTING', 'LICENSE', '.txt'], - 'frontend': ['.html', '.css', '.scss', '.jsx', '.tsx', '.vue'], - 'backend': ['.py', '.java', '.go', '.rb', '.php', '.rs'], - 'javascript': ['.js', '.ts', '.jsx', '.tsx'], - 'python': ['.py'], - 'configuration': ['.yml', '.yaml', '.json', '.toml', '.ini', '.env', '.config'], - 'github-actions': ['.github/workflows/'], - 'dependencies': ['package.json', 'requirements.txt', 'Gemfile', 'Cargo.toml', 'go.mod', 'pom.xml'], - 'tests': ['test/', '__tests__/', '.test.', '.spec.', '_test.'], - 'docker': ['Dockerfile', 'docker-compose', '.dockerignore'], - 'ci-cd': ['.github/', '.gitlab-ci', 'Jenkinsfile', '.circleci'] - }; - - // Check each file against label mappings - for (const file of changedFiles) { - for (const [label, patterns] of Object.entries(labelMappings)) { - for (const pattern of patterns) { - if (file.includes(pattern) || file.endsWith(pattern)) { - if (!fileLabels.includes(label)) { - fileLabels.push(label); - } - } - } - } - } - - // Get current labels - const currentLabels = await github.rest.issues.listLabelsOnIssue({ - owner: context.repo.owner, - repo: context.repo.repo, - issue_number: prNumber - }); - - const existingLabels = currentLabels.data.map(label => label.name); - const managedLabels = Object.keys(labelMappings); - - // Find managed labels that are currently on the PR but shouldn't be - const labelsToRemove = existingLabels.filter(label => - managedLabels.includes(label) && !fileLabels.includes(label) - ); - - // Remove stale labels - if (labelsToRemove.length > 0) { - console.log(`Removing stale file-based labels: ${labelsToRemove.join(', ')}`); - for (const label of labelsToRemove) { - try { - await github.rest.issues.removeLabel({ - owner: context.repo.owner, - repo: context.repo.repo, - issue_number: prNumber, - name: label - }); - } catch (error) { - console.log(`Error removing label ${label}: ${error.message}`); - } - } - } - - // Determine which new labels need to be added - const labelsToAdd = fileLabels.filter(label => !existingLabels.includes(label)); - - if (labelsToAdd.length > 0) { - console.log(`Applying file-based labels: ${labelsToAdd.join(', ')}`); - - try { - await github.rest.issues.addLabels({ - owner: context.repo.owner, - repo: context.repo.repo, - issue_number: prNumber, - labels: labelsToAdd - }); - } catch (error) { - console.error(`Error adding file-based labels [${labelsToAdd.join(', ')}] to PR #${prNumber}: ${error.message}`); - } - } else { - if (fileLabels.length > 0) console.log('All matched file-based labels are already present'); - else console.log('No file-based labels matched'); - } - - # STEP 3: PR size labels - - name: Apply PR size label - uses: actions/github-script@v9 - with: - github-token: ${{ secrets.GITHUB_TOKEN }} - script: | - const prNumber = context.payload.pull_request.number; - - // Get PR details to calculate size - const pr = await github.rest.pulls.get({ - owner: context.repo.owner, - repo: context.repo.repo, - pull_number: prNumber - }); - - const additions = pr.data.additions; - const deletions = pr.data.deletions; - const totalChanges = additions + deletions; - - console.log(`PR has ${additions} additions and ${deletions} deletions (${totalChanges} total changes)`); - - // Determine size label based on total changes - let sizeLabel = ''; - if (totalChanges <= 10) { - sizeLabel = 'size/XS'; - } else if (totalChanges <= 50) { - sizeLabel = 'size/S'; - } else if (totalChanges <= 200) { - sizeLabel = 'size/M'; - } else if (totalChanges <= 500) { - sizeLabel = 'size/L'; - } else { - sizeLabel = 'size/XL'; - } - - console.log(`Calculated size label: ${sizeLabel}`); - - // Get current labels on the PR - const currentLabels = await github.rest.issues.listLabelsOnIssue({ - owner: context.repo.owner, - repo: context.repo.repo, - issue_number: prNumber - }); - - const existingSizeLabels = currentLabels.data - .map(label => label.name) - .filter(name => name.startsWith('size/')); - - // Check if the size label needs to be changed - if (existingSizeLabels.length === 1 && existingSizeLabels[0] === sizeLabel) { - console.log(`Size label ${sizeLabel} is already correct, no changes needed`); - return; - } - - // Remove outdated size labels only if they differ - if (existingSizeLabels.length > 0) { - console.log(`Removing outdated size labels: ${existingSizeLabels.join(', ')}`); - for (const label of existingSizeLabels) { - try { - await github.rest.issues.removeLabel({ - owner: context.repo.owner, - repo: context.repo.repo, - issue_number: prNumber, - name: label - }); - } catch (error) { - console.log(`Error removing size label ${label}: ${error.message}`); - } - } - } - - // Apply the new size label - console.log(`Applying new size label: ${sizeLabel}`); - try { - await github.rest.issues.addLabels({ - owner: context.repo.owner, - repo: context.repo.repo, - issue_number: prNumber, - labels: [sizeLabel] - }); - } catch (error) { - console.error(`Error adding size label ${sizeLabel} to PR #${prNumber}: ${error.message}`); - } - - # STEP 4: Contributor-based labels(in this later we can add logic of team p as discussed on discord) - - name: Apply contributor-based labels - uses: actions/github-script@v9 - env: - LABELLER_TOKEN: ${{ secrets.EXTERNAL_LABELLER_TOKEN || secrets.GITHUB_TOKEN }} - with: - github-token: ${{ env.LABELLER_TOKEN }} - script: | - const prNumber = context.payload.pull_request.number; - const prAuthor = context.payload.pull_request.user.login; - - try { - // Check if user is a first-time contributor - const commits = await github.rest.repos.listCommits({ - owner: context.repo.owner, - repo: context.repo.repo, - author: prAuthor - }); - - const contributorLabels = []; - - // First check if maintainer - let isMaintainer = false; - try { - const permissionLevel = await github.rest.repos.getCollaboratorPermissionLevel({ - owner: context.repo.owner, - repo: context.repo.repo, - username: prAuthor - }); - - if (['admin', 'maintain'].includes(permissionLevel.data.permission)) { - contributorLabels.push('org-Member'); - isMaintainer = true; - } - } catch (error) { - console.log('Could not check collaborator status'); - } - - // If not maintainer, check contributor type - if (!isMaintainer) { - if (commits.data.length === 0) { - contributorLabels.push('first-time-contributor'); - } else { - contributorLabels.push('repeat-contributor'); - } - } - - const managedContributorLabels = ['org-Member', 'first-time-contributor', 'repeat-contributor']; - const labelsToRemove = managedContributorLabels.filter(label => !contributorLabels.includes(label)); - - for (const label of labelsToRemove) { - try { - await github.rest.issues.removeLabel({ - owner: context.repo.owner, - repo: context.repo.repo, - issue_number: prNumber, - name: label - }); - } catch (error) { - if (error.status !== 404) { - console.error(`Error removing stale contributor label ${label}: ${error.message}`); - } - } - } - - if (contributorLabels.length > 0) { - console.log(`Applying contributor-based labels: ${contributorLabels.join(', ')}`); - await github.rest.issues.addLabels({ - owner: context.repo.owner, - repo: context.repo.repo, - issue_number: prNumber, - labels: contributorLabels - }); - } - } catch (error) { - console.log(`Error applying contributor labels: ${error.message}`); - } - - # STEP 5: Review status - - name: Add needs review label - if: github.event.action != 'edited' - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 - with: - github-token: ${{ secrets.GITHUB_TOKEN }} - script: | - const prNumber = context.payload.pull_request.number; - - console.log('Adding needs-review label'); - - try { - await github.rest.issues.addLabels({ - owner: context.repo.owner, - repo: context.repo.repo, - issue_number: prNumber, - labels: ['needs-review'] - }); - } catch (error) { - core.warning(`Error adding needs-review label to PR #${prNumber}: ${error.message}`); - } - - # Summary step - - name: Label sync summary - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 - with: - github-token: ${{ secrets.GITHUB_TOKEN }} - script: | - const prNumber = context.payload.pull_request.number; - - // Get current labels on PR - const pr = await github.rest.issues.get({ - owner: context.repo.owner, - repo: context.repo.repo, - issue_number: prNumber - }); - - const currentLabels = pr.data.labels.map(label => label.name); - console.log('='.repeat(50)); - console.log('PR Label Sync Complete'); - console.log('='.repeat(50)); - console.log(`Current labels on PR #${prNumber}:`); - console.log(currentLabels.join(', ') || 'No labels'); - console.log('='.repeat(50)); diff --git a/.github/workflows/template-sync.yml b/.github/workflows/template-sync.yml deleted file mode 100644 index 19784b8..0000000 --- a/.github/workflows/template-sync.yml +++ /dev/null @@ -1,33 +0,0 @@ -name: Template Sync - -on: - # cronjob trigger - runs monthly on the 1st at midnight - schedule: - - cron: "0 0 1 * *" - workflow_dispatch: -jobs: - repo-sync: - runs-on: ubuntu-latest - if: github.repository != 'AOSSIE-Org/Template-Repo' - # https://docs.github.com/en/actions/using-jobs/assigning-permissions-to-jobs - permissions: - contents: write - pull-requests: write - - steps: - # Check out the repository - - name: Checkout - uses: actions/checkout@v7 - # https://github.com/actions/checkout#usage - # uncomment if you use submodules within the repository - # with: - # submodules: true - - - name: actions-template-sync - uses: AndreasAugustin/actions-template-sync@v2 - with: - source_repo_path: AOSSIE-Org/Template-Repo - upstream_branch: main # defaults to main - pr_labels: template_sync,auto_pr # defaults to template_sync - source_gh_token: ${{ secrets.GITHUB_TOKEN }} - is_pr_cleanup: true # for not open multiple PRs diff --git a/.github/workflows/version-release.yml b/.github/workflows/version-release.yml deleted file mode 100644 index c58a429..0000000 --- a/.github/workflows/version-release.yml +++ /dev/null @@ -1,123 +0,0 @@ -name: Version Release - -on: - push: - branches: - - main - paths: - - 'VERSION' - -permissions: - contents: write - -jobs: - release: - if: ${{ github.repository_owner == 'AOSSIE-Org' }} - runs-on: ubuntu-latest - - steps: - - name: Checkout code - uses: actions/checkout@v7 - with: - fetch-depth: 0 - - - name: Read VERSION file - id: get_version - run: | - VERSION=$(cat VERSION | tr -d '[:space:]') - echo "version=$VERSION" >> $GITHUB_OUTPUT - echo "Version detected: $VERSION" - - - name: Validate VERSION format - run: | - VERSION="${{ steps.get_version.outputs.version }}" - if ! [[ $VERSION =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then - echo "Error: VERSION must follow semantic versioning (e.g., 1.0.0)" - exit 1 - fi - echo "✓ Version format is valid: $VERSION" - - - name: Check if tag already exists - run: | - VERSION="${{ steps.get_version.outputs.version }}" - if git show-ref --tags --verify --quiet "refs/tags/v$VERSION"; then - echo "Error: Tag v$VERSION already exists" - exit 1 - fi - echo "✓ Tag v$VERSION does not exist yet" - - - name: Create and push tag - run: | - VERSION="${{ steps.get_version.outputs.version }}" - git config user.name "github-actions[bot]" - git config user.email "github-actions[bot]@users.noreply.github.com" - git tag -a "v$VERSION" -m "Release version $VERSION" - git push origin "v$VERSION" - echo "✓ Created and pushed tag v$VERSION" - - - name: Find and Publish Draft Release - id: publish_release - uses: actions/github-script@v9 - with: - github-token: ${{ secrets.GITHUB_TOKEN }} - script: | - const version = 'v${{ steps.get_version.outputs.version }}'; - - // Get all releases - const { data: releases } = await github.rest.repos.listReleases({ - owner: context.repo.owner, - repo: context.repo.repo, - }); - - // Find the draft release - const draftRelease = releases.find(release => release.draft === true); - - if (draftRelease) { - console.log(`Found draft release: ${draftRelease.name}`); - - // Update and publish the draft release - await github.rest.repos.updateRelease({ - owner: context.repo.owner, - repo: context.repo.repo, - release_id: draftRelease.id, - tag_name: version, - name: version, - draft: false, - }); - - console.log(`✓ Published draft release as ${version}`); - core.setOutput('released', 'true'); - } else { - console.log('⚠️ No draft release found. Please ensure release-drafter has created a draft release first.'); - core.setOutput('released', 'false'); - core.setFailed('No draft release found to publish'); - - //Uncomment below to auto-create release if no draft exists but also check release-drafter config first(why not working) - // await github.rest.repos.createRelease({ - // owner: context.repo.owner, - // repo: context.repo.repo, - // tag_name: version, - // name: version, - // body: `## Release ${version}\n\nThis release was automatically created when the VERSION file was updated.`, - // draft: false, - // prerelease: false, - // }); - } - - - name: Release Summary - run: | - echo "### Release Summary" >> $GITHUB_STEP_SUMMARY - echo "" >> $GITHUB_STEP_SUMMARY - echo "- **Version:** v${{ steps.get_version.outputs.version }}" >> $GITHUB_STEP_SUMMARY - echo "- **Tag Created:** ✓" >> $GITHUB_STEP_SUMMARY - if [ "${{ steps.publish_release.outputs.released }}" = "true" ]; then - echo "- **GitHub Release:** ✓" >> $GITHUB_STEP_SUMMARY - else - echo "- **GitHub Release:** ✗ (no draft found)" >> $GITHUB_STEP_SUMMARY - fi - echo "" >> $GITHUB_STEP_SUMMARY - if [ "${{ steps.publish_release.outputs.released }}" = "true" ]; then - echo "Release completed successfully!" >> $GITHUB_STEP_SUMMARY - else - echo "Release failed - no draft release was found to publish" >> $GITHUB_STEP_SUMMARY - fi diff --git a/.goreleaser.yaml b/.goreleaser.yaml deleted file mode 100644 index 16a9ffb..0000000 --- a/.goreleaser.yaml +++ /dev/null @@ -1,198 +0,0 @@ -# https://goreleaser.com/customization/ -# 1. Uncomment only the sections relevant to your project type -# 2. Fill in placeholders marked with -# 3. Run `goreleaser check` to validate before pushing - -version: 2 - -project_name: template-repo # replace with project name e.g. my-tool, my-project - -# before: -# hooks: - # Clean up build artifacts before release - # - go mod tidy # [GO] uncomment if Go project - # - npm ci # [NODE] Uncomment for Node.js projects - # - bun install --frozen # [NODE/BUN] Uncomment for Bun projects - -env: - - GITHUB_TOKEN={{ .Env.GITHUB_TOKEN }} - # - NPM_TOKEN={{ .Env.NPM_TOKEN }} # [NODE] Uncomment if publishing to npm - # - DOCKER_USERNAME={{ .Env.DOCKER_USERNAME }} # [DOCKER] Uncomment if pushing to Docker Hub - -# builds: -# # [GO] — Go binary build (most common for CLI tools, GitHub Actions runners) -# - id: go-build -# builder: go -# main: ./main.go # Entry point — change to ./cmd//main.go if needed -# binary: template-repo # Output binary name e.g. my-project -# env: -# - CGO_ENABLED=0 # Disable CGO for static binaries (recommended for Actions) -# goos: -# - linux -# - darwin -# - windows -# goarch: -# - amd64 -# - arm64 -# ldflags: -# # Embed version info at build time -# - -s -w -# - -X main.version={{ .Version }} -# - -X main.commit={{ .Commit }} -# - -X main.date={{ .Date }} - # [GO] Uncomment if building multiple binaries from the same repo - # targets: - # - linux_amd64 - # - linux_arm64 - # - darwin_amd64 - # - darwin_arm64 - # - windows_amd64 - - # [NODE] — Node.js project build, Uncomment this entire block if your project is Node.js/Bun based - # - id: node-build - # builder: node - # command: build # Runs `npm run build` or equivalent - # ids: [] - # # For Bun projects, replace builder with: - # # builder: bun - # # command: build - - # [PYTHON] — Python project (uv/poetry),Uncomment this entire block if your project is Python based - # - id: python-build - # builder: uv # Options: uv, poetry, python - # # For Poetry projects replace with: - # # builder: poetry - - # [PREBUILT] — Import pre-built binaries, Use if you build binaries in a prior CI step and just want GoReleaser to package - # - id: prebuilt-import - # builder: prebuilt - # goos: - # - linux - # - darwin - # - windows - # goarch: - # - amd64 - # - arm64 - # prebuilt: - # path: dist/{{ .Os }}_{{ .Arch }}/{{ .ProjectName }} - -archives: - - id: default-archive - name_template: "{{ .ProjectName }}_{{ .Version }}_{{ .Os }}_{{ .Arch }}" - wrap_in_directory: true # Wrap binary in a directory inside the archive - files: - - LICENSE - - README.md - - CHANGELOG.md - # Uncomment if shipping ABI/contract artifacts with release ( for web3 projects) - # - artifacts/abi/** - # - artifacts/addresses.json - format_overrides: # Windows gets .zip, everything else gets .tar.gz - - goos: windows - format: zip - - # [NODE] Uncomment if your project produces a dist/ folder to archive - # - id: node-archive - # ids: [node-build] - # name_template: "{{ .ProjectName }}_{{ .Version }}_js" - # files: - # - dist/** - # - package.json - # - README.md - -# include checksums for security/verification -checksum: - name_template: "{{ .ProjectName }}_{{ .Version }}_checksums.txt" - algorithm: sha256 - -# source archive of the full repository at the release tag, useful for source-based distributions and OpenSSF compliance -source: - enabled: true - name_template: "{{ .ProjectName }}_{{ .Version }}_source" - -# SBOM — Software Bill of Materials generation for supply chain transparency -sboms: - - artifacts: archive - # Requires syft to be installed: https://github.com/anchore/syft - -# SIGNING — Sign release artifacts with cosign (keyless via GitHub OIDC) -# signs: -# - cmd: cosign -# args: -# - sign-blob -# - --output-signature=${signature} -# - ${artifact} -# - --yes -# artifacts: checksum - - -# [DOCKER] Uncomment this entire section if your project has a Dockerfile -# docker_builds: -# - id: docker-linux -# ids: [go-build] # Reference your build id above; or remove for non-Go -# goos: linux -# goarchs: -# - amd64 -# - arm64 -# image_templates: -# - "ghcr.io/{{ .Env.GITHUB_REPOSITORY_OWNER }}/{{ .ProjectName }}:{{ .Version }}-{{ .Os }}-{{ .Arch }}" -# - "ghcr.io/{{ .Env.GITHUB_REPOSITORY_OWNER }}/{{ .ProjectName }}:latest" -# build_flag_templates: -# - --label=org.opencontainers.image.title={{ .ProjectName }} -# - --label=org.opencontainers.image.version={{ .Version }} -# - --label=org.opencontainers.image.created={{ .Date }} -# - --label=org.opencontainers.image.revision={{ .FullCommit }} -# - --label=org.opencontainers.image.source={{ .GitURL }} -# # Optional: push to Docker Hub as well -# # extra_files: -# # - docker-compose.yml - -# [NODE] Uncomment if your project is an npm package, Requires NPM_TOKEN secret in GitHub Actions -# nfpms: [] # Not applicable for npm — GoReleaser publishes npm directly: -# publishers: -# - name: npm -# cmd: npm publish --access public -# env: -# - NODE_AUTH_TOKEN={{ .Env.NPM_TOKEN }} -# dir: "{{ dir .ArtifactPath }}" -# artifacts: archive -# ids: [node-archive] - - -# [WEB3] Uncomment if your project compiles Solidity/Hardhat/Foundry contracts, This publishes ABI + bytecode artifacts alongside the release -# before hooks for WEB3 — add to before.hooks above: -# - forge build --sizes # Foundry projects -# - npx hardhat compile # Hardhat projects -# -# extra_files: -# - glob: ./artifacts/contracts/**/*.json -# - glob: ./deployments/**/*.json # deployment addresses per network -# - glob: ./broadcast/**/*-latest.json # Foundry broadcast logs - -release: # Release metadata and GitHub release configuration - github: - owner: AOSSIE-Org - name: template-repo # Repo name e.g. pr-feedback-action - # Make release a draft first so maintainer can review before publishing - draft: false - # Set to true to mark as a pre-release if version has a pre-release tag (e.g. v1.0.0-beta.1) - prerelease: auto - # Override release name - name_template: "{{ .ProjectName }} {{ .Version }}" - # [OPTIONAL] Point to a hand-crafted release notes file instead of auto-changelog - # release_notes: RELEASE_NOTES.md - -# CHANGELOG generation disabled here because Release Drafter already produces changelog drafts via .github/release-drafter.yml - -# [MONOREPO] Uncomment if this template repo spans multiple sub-projects. Each sub-project should have its own .goreleaser.yaml that includes this base -# monorepo: -# tag_prefix: "{{ .ProjectName }}/" -# dir: . # Root of the monorepo - -# SNAPSHOT — Local test builds (no git tag required) -# Run: goreleaser release --snapshot --clean -snapshot: - version_template: "{{ .Tag }}-SNAPSHOT-{{ .ShortCommit }}" - -# REPORT SIZES — Print artifact size table after build which is useful for tracking binary bloat over releases -report_sizes: true \ No newline at end of file diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml deleted file mode 100644 index 2a9b56d..0000000 --- a/.pre-commit-config.yaml +++ /dev/null @@ -1,52 +0,0 @@ -# Pre-commit hooks configuration -# Documentation: https://pre-commit.com/ -# -# Installation: -# pip install pre-commit -# pre-commit install -# -# Usage: -# pre-commit run --all-files # Run on all files -# pre-commit run # Run specific hook -# -# For queries and documentation, visit: https://pre-commit.com/hooks.html - -repos: - # ---------------------------------- - # 1. Universal Git / file hygiene - # ---------------------------------- - - repo: https://github.com/pre-commit/pre-commit-hooks - rev: v4.5.0 - hooks: - - id: trailing-whitespace - - id: end-of-file-fixer - - id: check-merge-conflict - - id: check-added-large-files - - id: mixed-line-ending - args: ['--fix=lf'] - - # ---------------------------------- - # 2. Config & data files validation - # ---------------------------------- - - repo: https://github.com/pre-commit/pre-commit-hooks - rev: v4.5.0 - hooks: - - id: check-yaml - - id: check-json - - id: check-toml - - # ---------------------------------- - # 3. Security (language-agnostic) - # ---------------------------------- - - repo: https://github.com/Yelp/detect-secrets - rev: v1.4.0 - hooks: - - id: detect-secrets - - # args: ['--baseline', '.secrets.baseline'] (Maintainers should add a .secrets.baseline file for secret scanning.) - -# ============================================================================== -# IMPORTANT: -# Pre-commit runs locally every time you commit; only simple logic should be included here. -# Heavy operations should be handled by CI/CD pipelines (GitHub Actions, etc.) -# ============================================================================== diff --git a/.templatesyncignore b/.templatesyncignore deleted file mode 100644 index 5d0a374..0000000 --- a/.templatesyncignore +++ /dev/null @@ -1,23 +0,0 @@ -# read this before editing in this file: https://github.com/AndreasAugustin/actions-template-sync?tab=readme-ov-file#ignore-files -# .templatesyncignore -# Files and folders to exclude from template sync -# Uses glob pattern syntax similar to .gitignore -# Note: This file itself cannot be synced - any template changes will be restored automatically - -# Repository-specific files that should not be synced -README.md -LICENSE - -# GitHub workflows are not synced by default due to GitHub policy -# .github/workflows/ - -# Add more patterns to exclude specific files or directories -# Examples: -# docs/ -# *.log -# config/local.yml - -# Use :! prefix for exceptions (pathspec syntax) -# Example - ignore all files except specific ones: -# :!newfile-1.txt -# * diff --git a/.vscode/extensions.json b/.vscode/extensions.json deleted file mode 100644 index 7d81e36..0000000 --- a/.vscode/extensions.json +++ /dev/null @@ -1,19 +0,0 @@ -{ - "recommendations": [ - "DavidAnson.vscode-markdownlint", // Markdown linting - "eamodio.gitlens", // Git integration and visualization - "esbenp.prettier-vscode", // Code formatter - "github.vscode-github-actions", // GitHub Actions support - "github.vscode-pull-request-github", // GitHub Pull Requests and Issues integration - "hediet.vscode-drawio", // Draw.io editor integration (useful for /drawio) - "humao.rest-client", // REST Client for testing HTTP endpoints - "mhutchie.git-graph", // Git graph visualizer - "ms-azuretools.vscode-docker", // Dockerfile / container tooling - "editorconfig.editorconfig", // EditorConfig support for consistent coding styles - "dbaeumer.vscode-eslint", // Linting for JavaScript and TypeScript - "redhat.vscode-yaml", // YAML support and validation - "streetsidesoftware.code-spell-checker", // Spell checking for code and comments - "usernamehw.errorlens", // Highlighting errors and warnings in the code - "yzhang.markdown-all-in-one" // Markdown productivity features - ] -} \ No newline at end of file diff --git a/.vscode/settings.example.json b/.vscode/settings.example.json deleted file mode 100644 index c1c4678..0000000 --- a/.vscode/settings.example.json +++ /dev/null @@ -1,23 +0,0 @@ -{ - "editor.formatOnSave": true, - "editor.defaultFormatter": "esbenp.prettier-vscode", - "editor.rulers": [80, 120], - "files.trimTrailingWhitespace": true, - "files.insertFinalNewline": true, - "files.eol": "\n", - "editor.codeActionsOnSave": { - "source.fixAll.eslint": true - }, - "prettier.requireConfig": true, - "yaml.validate": true, - "files.exclude": { - "node_modules": true, - "dist": true, - "build": true - }, - "search.exclude": { - "node_modules": true, - ".git": true, - "dist": true - } -} \ No newline at end of file diff --git a/BestPracticesChecklist.md b/BestPracticesChecklist.md deleted file mode 100644 index ed8ba50..0000000 --- a/BestPracticesChecklist.md +++ /dev/null @@ -1,258 +0,0 @@ -# AOSSIE Best Practices Checklist - -> Criteria adapted from the [OpenSSF Best Practices Badge](https://github.com/coreinfrastructure/best-practices-badge) -> (MIT / CC BY 3.0) by OpenSSF contributors. Modified for AOSSIE multi-repo template use. - -> **Purpose:** Covers OpenSSF Best Practices criteria that are NOT auto-detected by OpenSSF Scorecard. -> Scorecard already handles: License, SAST tools, CI tests, Security Policy file, Branch Protection, -> Pinned Dependencies, Signed Releases, Maintained status, and Known Vulnerabilities. -> -> **How to use:** -> 1. Fill in checkboxes below — tick `[x]` for Met, leave `[ ]` for Unmet, use `[~]` for N/A -> 2. Add a brief note or URL after each item as evidence -> 3. Run the checklist-score workflow to update the badge automatically -> -> **Legend:** -> - 🔴 MUST — Required for passing -> - 🟡 SHOULD — Required unless documented rationale given -> - 🔵 SUGGESTED — Optional but recommended -> - ⚪ N/A — Mark `[~]` if not applicable, add justification - ---- - -## Score Summary - - -| Category | Met | Total | Status | -|--------------------|-----|-------|--------| -| Basics | 0 | 8 | 🔴 | -| Change Control | 0 | 6 | 🔴 | -| Reporting | 0 | 8 | 🔴 | -| Quality | 0 | 11 | 🔴 | -| Security | 0 | 9 | 🔴 | -| Analysis | 0 | 7 | 🔴 | -| **Total** | **0** | **49** | **0%** | ---- - -## 🏗️ Basics - -### Project Website & Documentation - -- [ ] 🔴 **description_good** — The project README/website clearly describes what the software does and what problem it solves. - - *Evidence URL:* - -- [ ] 🔴 **interact** — The project provides information on how to obtain the software, submit bug reports, and contribute. - - *Evidence URL:* - -- [ ] 🔴 **contribution** — `CONTRIBUTING.md` explains the contribution process (e.g., PRs are used, how to open one). - - *Evidence URL:* - -- [ ] 🟡 **contribution_requirements** — `CONTRIBUTING.md` references acceptable contribution standards (coding style, tests required, etc.). - - *Evidence URL:* - -- [ ] 🔴 **documentation_basics** — Basic documentation exists for the software (README, Wiki, or docs folder). - - *Evidence URL:* `[ ]` N/A — *Justification:* - -- [ ] 🔴 **documentation_interface** — Reference documentation describes the external interface (API inputs/outputs, CLI flags, config schema, etc.). - - *Evidence URL:* `[ ]` N/A — *Justification:* - -### Other Basics - -- [ ] 🔴 **discussion** — Project has a searchable, URL-addressable discussion mechanism (GitHub Issues, Discord with archive, mailing list, etc.) that doesn't require proprietary client software. - - *Evidence URL:* - -- [ ] 🟡 **english** — Documentation is provided in English and English bug reports/comments are accepted. - - *Note:* - ---- - -## 🔄 Change Control - -### Version Control - -- [ ] 🔵 **repo_distributed** — Project uses a distributed VCS (e.g., git). *(SUGGESTED)* - - *Evidence URL:* - -### Version Numbering - -- [ ] 🔴 **version_unique** — Each release has a unique version identifier (e.g., v1.0.0). - - *Evidence URL:* - -- [ ] 🔵 **version_semver** — Project uses [SemVer](https://semver.org) or [CalVer](https://calver.org/) format. *(SUGGESTED)* - - *Note:* - -- [ ] 🔵 **version_tags** — Releases are tagged in the VCS (e.g., `git tag v1.0.0`). *(SUGGESTED)* - - *Evidence URL:* - -### Release Notes - -- [ ] 🔴 **release_notes** — Each release includes human-readable release notes summarizing major changes. Raw `git log` output is NOT acceptable. - - *Evidence URL:* `[ ]` N/A — *Justification (continuous delivery / no external reuse):* - -- [ ] 🔴 **release_notes_vulns** — Release notes identify every publicly known vulnerability (with CVE) fixed in that release. - - *Evidence URL:* `[ ]` N/A — *Justification (no publicly known vulns / users can't self-update):* - ---- - -## 🐛 Reporting - -### Bug Reporting - -- [ ] 🔴 **report_process** — A bug-reporting process exists (e.g., GitHub Issues link in README). - - *Evidence URL:* - -- [ ] 🟡 **report_tracker** — An issue tracker (e.g., GitHub Issues) is used to track individual bugs. - - *Evidence URL:* - -- [ ] 🔴 **report_responses** — A majority of bug reports submitted in the last 2–12 months have been acknowledged (response ≠ fix). - - *Self-certification note:* - -- [ ] 🟡 **enhancement_responses** — More than 50% of enhancement requests in the last 2–12 months have received a response. - - *Self-certification note:* - -- [ ] 🔴 **report_archive** — Reports and responses are publicly archived and searchable (GitHub Issues satisfies this). - - *Evidence URL:* - -### Vulnerability Reporting - -- [ ] 🔴 **vulnerability_report_process** — A vulnerability reporting process is documented (e.g., `SECURITY.md`). - - *Evidence URL:* - -- [ ] 🟡 **vulnerability_report_private** — If private vulnerability reporting is supported, the method for private submission is documented. - - *Evidence URL:* `[ ]` N/A — *Justification:* - -- [ ] 🔴 **vulnerability_report_response** — Initial response to any vulnerability report received in the last 6 months was within 14 days. - - *Self-certification note:* `[ ]` N/A — *Justification (no reports received):* - ---- - -## ✅ Quality - -### Build System - -- [ ] 🔴 **build** — If the project requires building, a working build system exists that can auto-rebuild from source. - - *Evidence URL:* `[ ]` N/A — *Justification (interpreted language / no build step):* - -- [ ] 🔵 **build_common_tools** — Common build tools are used (npm, pip, cargo, make, gradle, etc.). *(SUGGESTED)* - - *Evidence URL:* `[ ]` N/A - -- [ ] 🟡 **build_floss_tools** — The project can be built using only FLOSS tools. - - *Note:* `[ ]` N/A - -### Automated Testing - -- [ ] 🔵 **test_invocation** — The test suite can be invoked in a standard way for the language (e.g., `npm test`, `pytest`, `cargo test`). *(SUGGESTED)* - - *Evidence URL:* - -- [ ] 🔵 **test_most** — The test suite covers most code branches, input fields, and functionality. *(SUGGESTED)* - - *Estimated coverage %:* - -### New Functionality Testing Policy - -- [ ] 🔴 **test_policy** — The project has a general policy that new functionality must include tests in the automated test suite. - - *Evidence (CONTRIBUTING reference or informal policy):* - -- [ ] 🔴 **tests_are_added** — Evidence exists that the test policy has been followed in recent major changes (e.g., PRs include tests). - - *Evidence URL (recent PR with tests):* - -- [ ] 🔵 **tests_documented_added** — The test policy is documented in contribution instructions. *(SUGGESTED)* - - *Evidence URL:* - -### Linting / Warning Flags - -- [ ] 🔴 **warnings** — At least one linter or compiler warning flag is enabled (ESLint, Pylint, clippy, golangci-lint, Slither for Solidity, etc.). - - *Tool used:* - -- [ ] 🔴 **warnings_fixed** — Warnings from the linter are addressed (not suppressed without reason). - - *Note:* - -- [ ] 🔵 **warnings_strict** — Project uses maximum strictness in linter config where practical. *(SUGGESTED)* - - *Note:* - ---- - -## 🔐 Security - -### Secure Development Knowledge - -- [ ] 🔴 **know_secure_design** — At least one primary developer knows how to design secure software (familiar with OWASP, threat modeling, secure-by-default principles). - - *Self-certification note:* - -- [ ] 🔴 **know_common_errors** — At least one primary developer knows common vulnerability types for this software's category and how to mitigate them (e.g., injection, XSS, reentrancy for Solidity, prompt injection for AI). - - *Self-certification note:* - -### Cryptography (mark N/A if project does not handle cryptography) - -- [ ] 🔴 **crypto_published** — Only publicly reviewed cryptographic protocols/algorithms are used by default. - - *Note:* `[ ]` N/A - -- [ ] 🟡 **crypto_call** — Project calls an established crypto library rather than reimplementing crypto functions. - - *Library used:* `[ ]` N/A - -- [ ] 🔴 **crypto_working** — No broken algorithms (MD4, MD5, single DES, RC4, Dual_EC_DRBG) used unless required for interoperability (must be documented). - - *Note:* `[ ]` N/A - -- [ ] 🔴 **crypto_keylength** — Key lengths meet [NIST 2030 minimums](https://www.keylength.com/en/4/) by default. - - *Note:* `[ ]` N/A - -- [ ] 🔴 **crypto_password_storage** — Passwords for external users are stored as iterated salted hashes (Argon2id, bcrypt, scrypt, PBKDF2). - - *Note:* `[ ]` N/A — *Justification (project doesn't store passwords):* - -- [ ] 🔴 **crypto_random** — Cryptographic keys and nonces are generated using a CSPRNG; insecure generators (Math.random, rand()) are NOT used for security purposes. - - *Note:* `[ ]` N/A - -- [ ] 🟡 **delivery_unsigned** — Cryptographic hashes are NOT retrieved over plain HTTP without a signature check. - - *Note:* - ---- - -## 🔬 Analysis - -### Static Code Analysis - -- [ ] 🔴 **static_analysis_fixed** — All medium+ severity vulnerabilities found by static analysis are fixed in a timely manner after confirmation. - - *Note:* `[ ]` N/A - -- [ ] 🔵 **static_analysis_common_vulnerabilities** — The static analysis tool includes checks for common vulnerabilities in the language/environment (e.g., eslint-plugin-security, bandit, Slither). *(SUGGESTED)* - - *Tool + ruleset:* `[ ]` N/A - -- [ ] 🔵 **static_analysis_often** — Static analysis runs on every commit or at least daily (CI integration). *(SUGGESTED)* - - *Evidence URL:* `[ ]` N/A - -### Dynamic Code Analysis - -- [ ] 🔵 **dynamic_analysis** — At least one dynamic analysis tool is applied before major releases (fuzzer, web app scanner like OWASP ZAP, etc.). *(SUGGESTED)* - - *Tool used:* `[ ]` N/A — *Justification:* - -- [ ] 🔵 **dynamic_analysis_enable_assertions** — Dynamic analysis / testing runs with assertions enabled (not just production mode). *(SUGGESTED)* - - *Note:* - -- [ ] 🔴 **dynamic_analysis_fixed** — Medium+ severity vulnerabilities found by dynamic analysis are fixed in a timely manner. - - *Note:* `[ ]` N/A - -- [ ] 🔵 **dynamic_analysis_unsafe** — If the project uses memory-unsafe languages (C/C++), memory safety tools (Valgrind, AddressSanitizer) are used. *(SUGGESTED)* - - *Note:* `[ ]` N/A — *Justification (project uses memory-safe languages):* - ---- - -## 📎 Project-Specific Notes - -> Add domain-specific notes here for Web3, Full-Stack, or AI projects. - -### Web3 / Solidity Notes -- Scorecard does not audit Solidity-specific security. Use [Slither](https://github.com/crytic/slither) for `static_analysis` and `warnings` criteria. -- For `crypto_*` criteria, document which cryptographic primitives your contracts rely on (e.g., ECDSA in EVM is standard). -- Smart contract audit reports count as evidence for `know_secure_design`. - -### Full-Stack / Next.js Notes -- For `crypto_password_storage`: document which auth library handles hashing (e.g., NextAuth + bcrypt). -- For `dynamic_analysis`: [OWASP ZAP](https://www.zaproxy.org/) can be run as a GitHub Action. - -### AI / LLM Notes -- For `know_common_errors`: include awareness of prompt injection, data leakage, and model output validation. -- For `dynamic_analysis`: consider adversarial input testing as a form of dynamic analysis. - ---- - -*This checklist complements [OpenSSF Scorecard](https://scorecard.dev/) (auto-detected checks) and is -inspired by the [OpenSSF Best Practices Badge](https://www.bestpractices.dev/en/criteria/0) passing criteria.* \ No newline at end of file diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md deleted file mode 100644 index 8b5300b..0000000 --- a/CONTRIBUTING.md +++ /dev/null @@ -1,541 +0,0 @@ -# Contributing to TODO: Project Name - -⭐ First off, thank you for considering contributing to this project! ⭐ - -We welcome contributions from everyone. By participating in this project, you agree to abide by our Code of Conduct. - -## � IMPORTANT: Discord Communication is Mandatory - -**All project communication MUST happen on Discord. We do not pay attention to GitHub notifications.** - -- Join our [Discord server](https://discord.gg/hjUhu33uAn) before starting any work -- Post your PR/issue updates in the relevant Discord channel (**MANDATORY**) -- All discussions, questions, and updates should be on Discord -- GitHub is for code only - Discord is for communication - -**PRs without Discord updates will not be reviewed or may face delays.** - -## �📋 Table of Contents - -- [How Can I Contribute?](#how-can-i-contribute) -- [Coding with AI](#coding-with-ai) -- [Getting Started](#getting-started) -- [Development Workflow](#development-workflow) -- [Pull Request Guidelines](#pull-request-guidelines) -- [Code Style Guidelines](#code-style-guidelines) -- [Debugging Pre-commit Hooks](#debugging-pre-commit-hooks) -- [Community Guidelines](#community-guidelines) - -## 🤝 How Can I Contribute? - -### Reporting Bugs - -Before creating bug reports, please check existing issues to avoid duplicates. When creating a bug report, include: - -- Clear and descriptive title -- Steps to reproduce the issue -- Expected behavior vs actual behavior -- Screenshots/Video (if applicable) -- Environment details (OS, browser, versions, etc.) - -### Suggesting Features - -Feature suggestions are welcome! Please: - -- Check if the feature has already been suggested -- Provide a clear description of the feature -- Explain why this feature would be useful -- Include examples of how it would work -### Contributing Code - -1. **Submit an Issue First**: For features, bugs, or enhancements, create an issue first -2. **Get Assigned**: Wait to be assigned before starting work(preferable) -3. **Submit Your PR**: Once assigned, create a PR addressing the issue -4. **Unrelated PRs**: Pull requests unrelated to issues may be closed or take longer to review - -## 🤖 Coding with AI - -We accept the use of AI-powered tools (GitHub Copilot, ChatGPT, Claude, Cursor, etc.) for contributions, whether for code, tests, or documentation. - -⚠️ However, transparency is required: if you use AI assistance, please mention it in your PR description. This helps maintainers during code review and ensure the quality of contributions. - -What we expect: -- **Disclose AI usage**: A simple note like "Used GitHub Copilot for autocompletion" or "Generated initial test structure with ChatGPT" is sufficient. -- **Specify the scope**: Indicate which parts of your contribution involved AI assistance. -- **Review AI-generated content**: Ensure you understand and have verified any AI-generated code before submitting. - -## 🚀 Getting Started - -### Prerequisites - -TODO: List prerequisites specific to your project - -### Setup - -1. **Fork the Repository** - ```bash - # Click the 'Fork' button at the top right of this page - ``` - -2. **Clone Your Fork** - ```bash - git clone https://github.com/YOUR_USERNAME/TODO.git - cd TODO - ``` - -3. **Add Upstream Remote** - ```bash - git remote add upstream https://github.com/AOSSIE-Org/TODO.git - ``` - -4. **Install Dependencies** - ```bash - npm install - # or yarn install - # or pnpm install - ``` - -5. **Run the Project** - ```bash - npm run dev - ``` - -## 🔄 Development Workflow - -### 1. Create a Feature Branch - -Always work on a new branch, never on `main` or `dev`: - -```bash -git checkout -b feature/your-feature-name -# or -git checkout -b fix/your-bug-fix -``` - -### 2. Make Your Changes - -- Write clean, readable code -- Follow the project's code style -- Add comments where necessary -- Update documentation if needed - -### 3. Test Your Changes - -TODO: Add project-specific testing instructions - -```bash -npm test -# or -npm run lint -``` - -### 4. Commit Your Changes - -Write clear, concise commit messages: - -```bash -git add . -git commit -m "feat: add user authentication" -# or -git commit -m "fix: resolve navigation bug" -``` - -**Commit Message Format:** -- `feat:` for new features -- `fix:` for bug fixes -- `docs:` for documentation changes -- `style:` for formatting changes -- `refactor:` for code refactoring -- `test:` for adding tests -- `chore:` for maintenance tasks - -### 5. Keep Your Branch Updated - -```bash -git fetch upstream -git rebase upstream/main -# or upstream/dev depending on the project -``` - -### 6. Push Your Changes - -```bash -git push origin feature/your-feature-name -``` - -## 📤 Pull Request Guidelines - -### Before Submitting - -- [ ] Your code follows the project's style guidelines -- [ ] You've tested your changes thoroughly -- [ ] You've updated relevant documentation -- [ ] Your commits are clean and well-organized -- [ ] You've rebased with the latest upstream changes -- [ ] You've thought from the reviewer's perspective and made your PR easy to review - -### Submitting a Pull Request - -1. Go to the original repository on GitHub -2. Click "New Pull Request" -3. Select your fork and branch -4. Fill out the PR template with: - - Clear description of changes - - Link to related issue(s) - - Screenshots (if UI changes) - - Testing steps - -### PR Description Template - -```markdown -## Description -Brief description of what this PR does - -## Related Issue -Closes #issue_number - - -## Screenshots/Video (if applicable) -Add screenshots here - -## Testing(if applicable) -Steps to test the changes - -## Checklist -- [ ] Code follows style guidelines -- [ ] Self-review completed -- [ ] Documentation updated -- [ ] Tests added/updated -``` - -### After Submission - -- Post your PR in the project's Discord channel for visibility(**IMPORTANT**) -- Respond to review comments promptly -- Make requested changes in new commits -- Be patient - maintainers will review when available -- Use `[WIP]` in your PR title for incomplete PRs. Don't use this as a way to gatekeep; focus on one change until it gets merged. - -### Reviewing PRs - -- Instead of opening duplicate PRs, help review and improve existing ones. -- When reviewing, assess whether the change is actually necessary before diving into implementation details and functionality testing. - -## 📝 Code Style Guidelines - -TODO: Add project-specific code style guidelines - -### General Guidelines - -- Use meaningful variable and function names -- Keep functions small and focused -- Add comments for complex logic -- Remove console.logs before committing -- Avoid code duplication -- Avoid unnecessary complexity and minor over-optimization - -### JavaScript/TypeScript -- Use ES6+ syntax -- Prefer `const` over `let`, avoid `var` -- Use arrow functions where appropriate -- Follow ESLint rules - -### Python -- Follow PEP 8 style guide -- Use type hints where applicable -- Write docstrings for functions/classes - -## 🔧 Debugging Pre-commit Hooks - -Pre-commit hooks help maintain code quality by running automated checks before each commit. This section helps you troubleshoot common issues. - -### Initial Setup - -If pre-commit is configured in this project, install it first: - -```bash -pip install pre-commit -pre-commit install -``` - -### Common Errors and Solutions - -#### 1. **Pre-commit Hook Failed: Trailing Whitespace** - -**Error:** -```text -Trim Trailing Whitespace.................................................Failed -- hook id: trailing-whitespace -- exit code: 1 -- files were modified by this hook -``` - -**Solution:** -```bash -# Pre-commit automatically fixes this. Just re-stage and commit: -git add . -git commit -m "your message" -``` - -#### 2. **Pre-commit Hook Failed: End of File Fixer** - -**Error:** -```text -Fix End of Files.........................................................Failed -- hook id: end-of-file-fixer -- exit code: 1 -- files were modified by this hook -``` - -**Solution:** -```bash -# Files are automatically fixed. Re-add and commit: -git add . -git commit -m "your message" -``` - -#### 3. **Pre-commit Hook Failed: Check YAML/JSON/TOML** - -**Error:** -```text -Check Yaml..........................................Failed -- hook id: check-yaml -- exit code: 1 - -File .github/workflows/test.yml: mapping values are not allowed here -``` - -**Solution:** -```bash -# Fix the syntax error in the file (check line number in error) -# Common issues: -# - Incorrect indentation -# - Missing colons -# - Invalid characters -# Then commit again -``` - -#### 4. **Pre-commit Hook Failed: Detect Secrets** - -**Error:** -```text -detect-secrets...........................................................Failed -- hook id: detect-secrets -- exit code: 1 - -Potential secrets about to be added to git repo: - - Secret Type: AWS Access Key - Location: config/settings.py:42 -``` - -**Solution:** -```bash -# Option 1: Remove the secret and use environment variables -# Replace hardcoded secrets with: -# API_KEY = os.getenv('API_KEY') - -# Option 2: If it's a false positive, update baseline: -# detect-secrets scan > .secrets.baseline -# git add .secrets.baseline -``` - -#### 5. **Pre-commit Hook Failed: Mixed Line Endings** - -**Error:** -```text -Mixed line ending........................................................Failed -- hook id: mixed-line-ending -- exit code: 1 -- files were modified by this hook -``` - -**Solution:** -```bash -# Automatically fixed to LF. Re-add and commit: -git add . -git commit -m "your message" -``` - -#### 6. **Pre-commit Hook Failed: Large Files** - -**Error:** -```text -Check for added large files..............................................Failed -- hook id: check-added-large-files -- exit code: 1 - -large.zip (5.2 MB) exceeds 500 KB -``` - -**Solution:** -```bash -# Option 1: Remove large files -git rm --cached large.zip - -# Option 2: Use Git LFS for large files -git lfs install -git lfs track "*.zip" -git add .gitattributes - -# Option 3: Increase limit (not recommended) -# Edit .pre-commit-config.yaml: -# args: ['--maxkb=10000'] # 10MB -``` - -#### 7. **Pre-commit Hook Failed: Merge Conflict Markers** - -**Error:** -```text -Check for merge conflicts................................................Failed -- hook id: check-merge-conflict -- exit code: 1 - -Merge conflict markers found in: - src/main.js:45 -``` - -**Solution:** -```bash -# Open the file and remove conflict markers: -# <<<<<<< HEAD -# ======= -# >>>>>>> branch-name - -# Then commit again -``` - -#### 8. **Pre-commit Not Running** - -**Problem:** Commits go through without pre-commit checks - -**Solution:** -```bash -# Reinstall pre-commit hooks -pre-commit uninstall -pre-commit install - -# Verify installation -pre-commit run --all-files -``` - -#### 9. **Pre-commit Takes Too Long** - -**Problem:** Pre-commit is slow on every commit - -**Solution:** -```bash -# Run only on changed files (default behavior) -git commit -m "message" - -# Skip pre-commit for quick commits (use sparingly!) -git commit --no-verify -m "message" - -# Update pre-commit hooks -pre-commit autoupdate -``` - -#### 10. **Hook Installation Failed** - -**Error:** -```text -An error has occurred: InvalidManifestError: -=====> /path/to/.pre-commit-config.yaml does not exist -``` - -**Solution:** -```bash -# Ensure you're in the project root directory -cd /path/to/project/root - -# Verify config file exists -ls -la .pre-commit-config.yaml - -# Reinstall -pre-commit install -``` - -### Bypassing Pre-commit (Emergency Only) - -**⚠️ Use only when absolutely necessary:** - -```bash -# Skip pre-commit hooks for a single commit -git commit --no-verify -m "emergency fix" - -# Or use the short flag -git commit -n -m "emergency fix" -``` - -**Note:** This should be rare. If you need to bypass frequently, discuss with maintainers. - -### Running Pre-commit Manually - -```bash -# Run all hooks on all files -pre-commit run --all-files - -# Run a specific hook -pre-commit run trailing-whitespace --all-files - -# Run on specific files -pre-commit run --files src/main.js src/utils.js -``` - -### Updating Pre-commit Hooks - -```bash -# Update to latest versions -pre-commit autoupdate - -# Clean and reinstall -pre-commit clean -pre-commit install -``` - -### Getting Help - -If you encounter issues not covered here: - -1. Check [pre-commit documentation](https://pre-commit.com/) -2. Review the error message carefully (it usually tells you what's wrong) -3. Ask in the project's Discord channel -4. Search for similar issues in the repository - -**Remember:** Pre-commit hooks are there to help you maintain code quality. Don't fight them - fix the issues they find! - -## 🌟 Community Guidelines - -### Communication - -- Be respectful and inclusive -- Provide constructive feedback -- Help others when you can -- Ask questions - no question is too small! - -### Progress Updates - -- If your work is taking longer than expected, comment on the discord with updates -- Issues should be completed within 5-30 days depending on complexity -- If you can no longer work on an issue, let maintainers know on discord - -### Getting Help - -- Check existing documentation first -- Search closed issues for similar problems -- Ask in Discord -- Tag maintainers if your PR is unattended for 1-2 weeks on discord - -## 🎯 Issue Assignment - -- One contributor per issue (unless specified otherwise) - -- If there are no active PRs for an issue for 2+ days, mention your intent under the issue and begin -- Avoid working on issues which are assigned to someone, even if they are inactive -- Check for existing PRs before starting to avoid duplication, as there might PRs that didn't mention the related issue - - -Thank you for contributing to TODO! Your efforts help make this project better for everyone. 🚀 diff --git a/README.md b/README.md index 8b9217e..c32401f 100644 --- a/README.md +++ b/README.md @@ -4,20 +4,10 @@
AOSSIE -
  - -
- -[![Static Badge](https://img.shields.io/badge/aossie.org/TODO-228B22?style=for-the-badge&labelColor=FFC517)](https://TODO.aossie.org/) - - - -
-

@@ -41,251 +31,201 @@ Youtube Badge

- -

- - OpenSSF Scorecard - -    - - Best Practices - -    - - Protected by Gitleaks - -

- ---
-

TODO: Project Name

+

🛡️ AOSSIE Admin Repository (Safe-Settings Policy-as-Code)

-[TODO](https://TODO.stability.nexus/) is a ... TODO: Project Description. - ---- - -## 🚀 Features - -TODO: List your main features here: +The **`admin`** repository centrally manages and enforces repository policies, branch protection rules, issue labels, team access permissions, custom properties, rulesets, and environments across all public repositories in the **[AOSSIE](https://github.com/AOSSIE-Org)** organization. -- **Feature 1**: Description -- **Feature 2**: Description -- **Feature 3**: Description -- **Feature 4**: Description +> [!NOTE] +> This repository strictly adheres to the official **[GitHub Safe-Settings](https://github.com/github-community-projects/safe-settings)** specification (`main-enterprise` branch), utilizing standard GitHub Actions workflows ([docs/github-action.md](https://github.com/github-community-projects/safe-settings/blob/main-enterprise/docs/github-action.md)) for policy evaluation, dry-run PR checks, and scheduled drift prevention. --- -## 💻 Tech Stack - -TODO: Update based on your project - -### Frontend -- React / Next.js / Flutter / React Native -- TypeScript -- TailwindCSS +## 🚀 Key Features & Capabilities -### Backend -- Flask / FastAPI / Node.js / Supabase -- Database: PostgreSQL / SQLite / MongoDB - -### AI/ML (if applicable) -- LangChain / LangGraph / LlamaIndex -- Google Gemini / OpenAI / Anthropic Claude -- Vector Database: Weaviate / Pinecone / Chroma -- RAG / Prompt Engineering / Agent Frameworks - -### Blockchain (if applicable) -- Solidity / solana / cardano / ergo Smart Contracts -- Hardhat / Truffle / foundry -- Web3.js / Ethers.js / Wagmi -- OpenZeppelin / alchemy / Infura - ---- - -## ✅ Project Checklist - -TODO: Complete applicable items based on your project type - -- [ ] **The protocol** (if applicable): - - [ ] has been described and formally specified in a paper. - - [ ] has had its main properties mathematically proven. - - [ ] has been formally verified. -- [ ] **The smart contracts** (if applicable): - - [ ] were thoroughly reviewed by at least two knights of The Stable Order. - - [ ] were deployed to: [Add deployment details] -- [ ] **The mobile app** (if applicable): - - [ ] has an _About_ page containing the Stability Nexus's logo and pointing to the social media accounts of the Stability Nexus. - - [ ] is available for download as a release in this repo. - - [ ] is available in the relevant app stores. -- [ ] **The AI/ML components** (if applicable): - - [ ] LLM/model selection and configuration are documented. - - [ ] Prompts and system instructions are version-controlled. - - [ ] Content safety and moderation mechanisms are implemented. - - [ ] API keys and rate limits are properly managed. +- **Centralized Policy-as-Code**: Store and manage all organization settings in Git-tracked YAML configuration files under `.github/`. +- **Three-Tier Precedence Hierarchy**: Precedence order `Repository > Sub-Organization > Organization` allows domain-specific customization while enforcing global compliance. +- **Dry-Run PR Validation (Nop Mode)**: When a PR is opened in `admin`, safe-settings runs in dry-run mode to evaluate and validate proposed policy changes before merging. +- **Scheduled Drift Prevention**: Automated GitHub Actions (`.github/workflows/safe-settings-sync.yml`) run on a 4-hour schedule to prevent manual configuration drift in GitHub. +- **Restricted Scope Protection**: Configured via `deployment-settings.yml` (`restrictedRepos`) to safeguard core administrative repositories (`admin`, `.github`, `safe-settings`) from unintended bot operations. +- **Fine-Grained Glob Scoping**: Supports `include` and `exclude` glob patterns for scoping teams, labels, collaborators, and repository lists. +- **External Status Checks Preservation**: Supports `{{EXTERNALLY_DEFINED}}` token under status checks to allow external CI checks configured via the GitHub UI. --- -## 🔗 Repository Links - -TODO: Update with your repository structure +## 📊 Visual Architecture & System Flows -1. [Main Repository](https://github.com/AOSSIE-Org/TODO) -2. [Frontend](https://github.com/AOSSIE-Org/TODO/tree/main/frontend) (if separate) -3. [Backend](https://github.com/AOSSIE-Org/TODO/tree/main/backend) (if separate) - ---- - -## 🏗️ Architecture Diagram - -TODO: Add your system architecture diagram here +### Configuration Precedence Hierarchy +```mermaid +graph TD + A[Organization Defaults
.github/settings.yml] --> B[Sub-Organization Policies
.github/suborgs/*.yml] + B --> C[Repository Overrides
.github/repos/*.yml] + + style A fill:#e1f5fe,stroke:#01579b,stroke-width:2px,color:#000 + style B fill:#f3e5f5,stroke:#4a148c,stroke-width:2px,color:#000 + style C fill:#e8f5e8,stroke:#1b5e20,stroke-width:2px,color:#000 ``` -[Architecture Diagram Placeholder] -``` - -You can create architecture diagrams using: -- [Draw.io](https://draw.io) -- [Excalidraw](https://excalidraw.com) -- [Lucidchart](https://lucidchart.com) -- [Mermaid](https://mermaid.js.org) (for code-based diagrams) -Example structure to include: -- Frontend components -- Backend services -- Database architecture -- External APIs/services -- Data flow between components +**Precedence Order**: `Repository > Sub-Organization > Organization` + +### System Request & Processing Flow + +```mermaid +sequenceDiagram + participant GH as GitHub Organization + participant SS as Safe-Settings Engine (GHA) + participant AR as Admin Repo (.github/) + participant TR as Target Repositories + + Note over GH,TR: Event-Driven & Scheduled Processing + + GH->>+SS: Trigger Event (Push, Cron, PR, Repo Created) + SS->>+AR: Fetch Configuration Files + AR-->>-SS: Return settings.yml, suborgs/*.yml, repos/*.yml + + SS->>SS: Merge Hierarchy (Org → Suborg → Repo) + SS->>SS: Compare Config with Active GitHub Settings + + alt Active Sync (Push / Cron / Repo Created) + SS->>+TR: Apply Settings (Branch Protection, Labels, Teams, Rulesets) + TR-->>-SS: Confirm Applied Changes + SS->>GH: Update Check Run (Success) + else PR Validation (Dry-Run Mode) + SS->>SS: Run Dry-Run (Nop Mode) & Custom Validators + SS->>GH: Update PR Check Run + Dry-Run Summary Comment + end + + SS-->>-GH: Processing Complete +``` --- -## 🔄 User Flow - -TODO: Add user flow diagrams showing how users interact with your application +## 📁 Repository Directory Structure ``` -[User Flow Diagram Placeholder] +admin/ +├── deployment-settings.yml # Defines restrictedRepos (admin, .github, safe-settings) +├── .coderabbit.yaml # CodeRabbit AI code review configuration for policy repo +├── .github/ +│ ├── settings.yml # Organization-wide settings (default branch protection, labels, teams) +│ ├── suborgs/ # Sub-organization policies (grouped by domain) +│ │ ├── ai-agentic-tools.yml +│ │ ├── blockchain-web3.yml +│ │ ├── web-frontend.yml +│ │ ├── education-learning.yml +│ │ ├── mobile-apps.yml +│ │ └── core-infra.yml +│ ├── repos/ # Repository-specific override files +│ │ └── admin.yml +│ ├── workflows/ +│ │ └── safe-settings-sync.yml # GitHub Actions workflow for scheduled full-sync +│ └── dependabot.yml # Dependabot configuration (monitoring github-actions) +├── public/ +│ └── aossie-logo.svg +└── README.md # Official Admin Policy README ``` -### Key User Journeys - -TODO: Document main user flows: - -1. **User Journey 1**: Description - - Step 1 - - Step 2 - - Step 3 - -2. **User Journey 2**: Description - - Step 1 - - Step 2 - - Step 3 - -3. **User Journey 3**: Description - - Step 1 - - Step 2 - - Step 3 - --- -## �🍀 Getting Started +## 🏛️ Sub-Organization Domain Breakdown -### Prerequisites +All 100+ public repositories in **AOSSIE-Org** are grouped into 6 sub-organization policy categories: -TODO: List what developers need installed +| Sub-Org Domain | Description | Key Managed Repositories | +| :--- | :--- | :--- | +| **`ai-agentic-tools`** | AI agents, LLMs, Discord bots, PR analyzers, and automated assistants | `SkillBot`, `PullRequestDashboard`, `Skills`, `OpenVerifiableLLM`, `CodingAgent`, `Gitcord`, `EduAid`, `DebateAI` | +| **`blockchain-web3`** | Decentralized apps, smart contracts, and Web3 dashboards | `Djed-Solidity-WebDashboard`, `IndexedDB-Import-Export` | +| **`web-frontend`** | Web applications, dashboards, frontend components, and social widgets | `OrgExplorer`, `SocialShareButton`, `SupportUsButton`, `Website`, `Resonate-Website`, `PictoPy-Website` | +| **`education-learning`** | Educational tools, Rust ML bindings, knowledge bases | `Social-Street-Smart`, `SciKitLearn-Rust`, `Info`, `LibrEd` | +| **`mobile-apps`** | Android, Flutter, iOS, and cross-platform mobile apps | `CarbonFootprint-Mobile`, `Starcross-Android`, `Agora-Android`, `Agora-iOS`, `Resonate`, `Monumento`, `PictoPy` | +| **`core-infra`** | Core infrastructure, template repositories, blogs, and org tools | `admin`, `Template-Repo`, `.github`, `AOSSIE-Blogs`, `ContributorAutomation`, `Scavenger`, `Skeptik` | -- Node.js 18+ / Python 3.9+ / Flutter SDK -- npm / yarn / pnpm -- [Any specific tools or accounts needed] - -### Installation - -TODO: Provide detailed setup instructions - -#### 1. Clone the Repository +--- -```bash -git clone https://github.com/AOSSIE-Org/TODO.git -cd TODO +## ⚙️ Configuration Specification Guide + +### 1. Organization Defaults (`.github/settings.yml`) +Applies globally to all repositories unless overridden by a suborg or repo file: +```yaml +repository: + has_issues: true + has_projects: true + allow_squash_merge: true + delete_branch_on_merge: true + +branches: + - name: main + protection: + required_pull_request_reviews: + required_approving_review_count: 1 + dismiss_stale_reviews: true + required_status_checks: + strict: true + contexts: [] + required_conversation_resolution: true + +labels: + - name: "bug" + color: "d73a4a" + - name: "gsoc" + color: "f9d0c4" + +teams: + - name: admins + permission: admin + - name: maintainers + permission: push ``` -#### 2. Install Dependencies +### 2. Sub-Organization Policies (`.github/suborgs/*.yml`) +Defines policies for a collection of repositories specified in `suborgrepos` (supports glob patterns like `test*`): +```yaml +suborgrepos: + - "SkillBot" + - "PullRequestDashboard" + - "Skills" -```bash -npm install -# or -yarn install -# or -pnpm install +repository: + has_issues: true ``` -#### 3. Configure Environment Variables(.env.example) - -Create a `.env` file in the root directory: - -```env -# Add your environment variables here -API_KEY=your_api_key -DATABASE_URL=your_database_url +### 3. Repository Overrides (`.github/repos/.yml`) +Applies specific overrides for a single repository (e.g. `admin.yml` enforcing strict 2-reviewer approvals): +```yaml +branches: + - name: main + protection: + required_pull_request_reviews: + required_approving_review_count: 2 + require_code_owner_reviews: true + enforce_admins: true ``` -#### 4. Run the Development Server - -```bash -npm run dev -# or -yarn dev -# or -pnpm dev +### 4. Scope Restrictions (`deployment-settings.yml`) +Controls which repositories safe-settings can manage or exclude: +```yaml +restrictedRepos: + - admin + - .github + - safe-settings ``` -#### 5. Open your Browser - -Navigate to [http://localhost:3000](http://localhost:3000) to see the application. - -For detailed setup instructions, please refer to our [Installation Guide](./docs/INSTALL_GUIDE.md) (if you have one). - ---- - -## 📱 App Screenshots - -TODO: Add screenshots showcasing your application - -| | | | -|---|---|---| -| Screenshot 1 | Screenshot 2 | Screenshot 3 | - --- -## 🙌 Contributing +## 🛠️ Policy Change Workflow -⭐ Don't forget to star this repository if you find it useful! ⭐ - -Thank you for considering contributing to this project! Contributions are highly appreciated and welcomed. To ensure smooth collaboration, please refer to our [Contribution Guidelines](./CONTRIBUTING.md). - ---- - -## ✨ Maintainers - -TODO: Add maintainer information - -- [Maintainer Name](https://github.com/username) -- [Maintainer Name](https://github.com/username) +1. Create a branch and modify policy files in `.github/settings.yml`, `.github/suborgs/`, or `.github/repos/`. +2. Open a Pull Request. Safe-settings automatically runs in **dry-run mode** (`nop` mode) to evaluate proposed changes and posts a validation report. +3. Upon approval and merge to `main`, the `.github/workflows/safe-settings-sync.yml` workflow triggers and applies the settings live across target repositories. --- ## 📍 License -This project is licensed under the GNU General Public License v3.0. -See the [LICENSE](LICENSE) file for details. - ---- - -## 💪 Thanks To All Contributors - -Thanks a lot for spending your time helping TODO grow. Keep rocking 🥂 - -[![Contributors](https://contrib.rocks/image?repo=AOSSIE-Org/TODO)](https://github.com/AOSSIE-Org/TODO/graphs/contributors) +This project is licensed under the **GNU General Public License v3.0**. See the [LICENSE](LICENSE) file for details. -© 2025 AOSSIE +© 2026 **AOSSIE** diff --git a/VERSION b/VERSION deleted file mode 100644 index afaf360..0000000 --- a/VERSION +++ /dev/null @@ -1 +0,0 @@ -1.0.0 \ No newline at end of file diff --git a/checklist-status.json b/checklist-status.json deleted file mode 100644 index 3b4235a..0000000 --- a/checklist-status.json +++ /dev/null @@ -1,37 +0,0 @@ -{ - "schemaVersion": 1, - "label": "Best Practices", - "message": "0%", - "schema": "aossie-best-practices-v1", - "updated": "2026-07-27", - "met": 0, - "total": 49, - "percent": 0, - "color": "red", - "categories": { - "basics": { - "met": 0, - "total": 8 - }, - "change_control": { - "met": 0, - "total": 6 - }, - "reporting": { - "met": 0, - "total": 8 - }, - "quality": { - "met": 0, - "total": 11 - }, - "security": { - "met": 0, - "total": 9 - }, - "analysis": { - "met": 0, - "total": 7 - } - } -} \ No newline at end of file diff --git a/dangerfile.js b/dangerfile.js deleted file mode 100644 index be6911d..0000000 --- a/dangerfile.js +++ /dev/null @@ -1,91 +0,0 @@ -// dangerfile.js — enforces the PR description template -// Docs: https://danger.systems/js/ -const body = danger.github.pr.body || ""; -const normalizedBody = body.replace(/\r\n/g, "\n"); - -const issues = []; - -function escapeRegex(value) { - return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"); -} - -function hasCheckedChecklistItem(itemText) { - const escapedItem = escapeRegex(itemText).replace(/\s+/g, "\\s+"); - const checkedItemPattern = new RegExp(`-\\s*\\[[xX]\\]\\s*${escapedItem}`, "i"); - return checkedItemPattern.test(normalizedBody); -} - -// --------------------------------------------------------------------------- -// 1. Required section headings (tolerant to spacing and casing) -// --------------------------------------------------------------------------- -const requiredSections = [ - { - label: "### Addressed Issues:", - pattern: /#{3}\s+addressed\s+issues:/i, - }, - { - label: "## Checklist", - pattern: /#{2}\s+checklist/i, - }, -]; - -const missingSections = requiredSections - .filter((section) => !section.pattern.test(normalizedBody)) - .map((section) => section.label); - -if (!normalizedBody.trim()) { - fail("PR description is empty. Please follow the PR template."); -} - -if (missingSections.length > 0) { - issues.push( - `**PR description is missing required sections:**\n` + - missingSections.map((s) => `- \`${s}\``).join("\n") + - `\n\nPlease follow the [PR template](.github/PULL_REQUEST_TEMPLATE.md).` - ); -} - -// --------------------------------------------------------------------------- -// 2. Issue link — warn on placeholder and missing issue reference -// --------------------------------------------------------------------------- -if (/\bfixes\s*#\s*\(\s*issue\s*number\s*\)/i.test(normalizedBody)) { - issues.push( - "Please replace the placeholder `Fixes #(issue number)` with the actual " + - "issue number (e.g. `Fixes #42`)." - ); -} else if (!/\b(fixes|closes|resolves)\s*#\d+\b/i.test(normalizedBody)) { - issues.push( - "No issue linked. Consider adding `Fixes #` (e.g. `Fixes #42`) " + - "under the **Addressed Issues** section." - ); -} - -// --------------------------------------------------------------------------- -// 3. Checklist — required items must be checked -// --------------------------------------------------------------------------- -const requiredChecklistItems = [ - "My PR addresses a single issue", - "My code follows the project's code style", - "My changes generate no new warnings or errors", -]; - -const missingRequired = requiredChecklistItems.filter( - (item) => !hasCheckedChecklistItem(item) -); - -if (missingRequired.length > 0) { - issues.push( - "Some required checklist items are not completed:\n" + - missingRequired.map((item) => `- ${item}`).join("\n") - ); -} - -if (issues.length > 0) { - message(` -### ⚠️ PR Template Check - -These are non-blocking, but please fix: - -${issues.map((issue) => `- ${issue}`).join("\n")} - `); -} diff --git a/public/stability.svg b/public/stability.svg deleted file mode 100644 index cd2d3a7..0000000 --- a/public/stability.svg +++ /dev/null @@ -1,14 +0,0 @@ - - - - - - - - - - - - - -