Add CI, security, contributor infrastructure and dual licensing

AnExiledDev · AnExiledDev · commit 1d9184f1567f · 2026-02-26T04:15:11.000Z
- CI workflow with test + lint jobs (Node 18, Biome)
- CodeQL security analysis (JS, weekly + PR triggers)
- Dependabot for npm and GitHub Actions dependencies
- Bug report and feature request issue templates (YAML forms)
- Pull request template with checklist
- CONTRIBUTING.md with GPL-3.0 and CLA guidelines
- CLA.md (Individual Contributor License Agreement)
- Dual licensing header in LICENSE.txt
- Contributing and License sections in README.md with CI badge
- SPDX copyright headers (GPL-3.0-only) in all 36 source files
- Updated REPO-AUDIT.md scorecard (22/50 → 42/50)
diff --git a/.devcontainer/CHANGELOG.md b/.devcontainer/CHANGELOG.md
@@ -4,6 +4,20 @@
 
 ### Added
 
+#### Public Repo Quality
+- **CI workflow** (`.github/workflows/ci.yml`) — test and lint jobs on PRs and pushes to main (Node 18, `npm test` + Biome check)
+- **CodeQL security analysis** (`.github/workflows/codeql.yml`) — JavaScript scanning on PRs, pushes, and weekly schedule
+- **Dependabot** (`.github/dependabot.yml`) — weekly updates for npm (root + docs) and GitHub Actions
+- **Bug report template** (`.github/ISSUE_TEMPLATE/bug-report.yml`) — YAML form with version, environment, and repro steps
+- **Feature request template** (`.github/ISSUE_TEMPLATE/feature-request.yml`) — YAML form with problem/solution/alternatives
+- **Issue template config** (`.github/ISSUE_TEMPLATE/config.yml`) — commercial licensing contact link
+- **Pull request template** (`.github/pull_request_template.md`) — description, type of change, and checklist
+- **CONTRIBUTING.md** — contribution guidelines with GPL-3.0 licensing and CLA requirement
+- **CLA.md** — Individual Contributor License Agreement enabling dual licensing
+- **Dual licensing notice** — added to README.md (Contributing + License sections) and LICENSE.txt (header)
+- **CI badge** — added to README.md badge row
+- **SPDX copyright headers** — `GPL-3.0-only` identifier and `Copyright (c) 2026 Marcus Krueger` added to all 36 source files (setup.js, test.js, 34 shell scripts)
+
 #### Docs
 - **CLAUDE.md** — new "Status Bar Widgets" section documenting widget properties, token color conventions, label fusion pattern, and available widget types
 
diff --git a/.devcontainer/connect-external-terminal.sh b/.devcontainer/connect-external-terminal.sh
@@ -1,4 +1,6 @@
 #!/bin/bash
+# SPDX-License-Identifier: GPL-3.0-only
+# Copyright (c) 2026 Marcus Krueger
 #
 # Connect to CodeForge devcontainer from external terminal with tmux
 # For Claude Code Agent Teams split-pane support
diff --git a/.devcontainer/features/agent-browser/install.sh b/.devcontainer/features/agent-browser/install.sh
@@ -1,4 +1,6 @@
 #!/bin/bash
+# SPDX-License-Identifier: GPL-3.0-only
+# Copyright (c) 2026 Marcus Krueger
 set -euo pipefail
 
 VERSION="${VERSION:-latest}"
diff --git a/.devcontainer/features/ast-grep/install.sh b/.devcontainer/features/ast-grep/install.sh
@@ -1,4 +1,6 @@
 #!/bin/bash
+# SPDX-License-Identifier: GPL-3.0-only
+# Copyright (c) 2026 Marcus Krueger
 set -euo pipefail
 
 VERSION="${VERSION:-latest}"
diff --git a/.devcontainer/features/biome/install.sh b/.devcontainer/features/biome/install.sh
@@ -1,4 +1,6 @@
 #!/bin/bash
+# SPDX-License-Identifier: GPL-3.0-only
+# Copyright (c) 2026 Marcus Krueger
 set -euo pipefail
 
 VERSION="${VERSION:-latest}"
diff --git a/.devcontainer/features/ccburn/install.sh b/.devcontainer/features/ccburn/install.sh
@@ -1,4 +1,6 @@
 #!/bin/bash
+# SPDX-License-Identifier: GPL-3.0-only
+# Copyright (c) 2026 Marcus Krueger
 set -euo pipefail
 
 # === SETUP ===
diff --git a/.devcontainer/features/ccms/install.sh b/.devcontainer/features/ccms/install.sh
@@ -1,4 +1,6 @@
 #!/bin/bash
+# SPDX-License-Identifier: GPL-3.0-only
+# Copyright (c) 2026 Marcus Krueger
 set -euo pipefail
 
 # === SETUP ===
diff --git a/.devcontainer/features/ccstatusline/install.sh b/.devcontainer/features/ccstatusline/install.sh
@@ -1,4 +1,6 @@
 #!/bin/bash
+# SPDX-License-Identifier: GPL-3.0-only
+# Copyright (c) 2026 Marcus Krueger
 set -euo pipefail
 
 # Cleanup on exit
diff --git a/.devcontainer/features/ccusage/install.sh b/.devcontainer/features/ccusage/install.sh
@@ -1,4 +1,6 @@
 #!/bin/bash
+# SPDX-License-Identifier: GPL-3.0-only
+# Copyright (c) 2026 Marcus Krueger
 set -euo pipefail
 
 # === SETUP ===
diff --git a/.devcontainer/features/chromaterm/install.sh b/.devcontainer/features/chromaterm/install.sh
@@ -1,4 +1,6 @@
 #!/bin/bash
+# SPDX-License-Identifier: GPL-3.0-only
+# Copyright (c) 2026 Marcus Krueger
 set -euo pipefail
 
 # ==============================
diff --git a/.devcontainer/features/claude-code-native/install.sh b/.devcontainer/features/claude-code-native/install.sh
@@ -1,4 +1,6 @@
 #!/bin/bash
+# SPDX-License-Identifier: GPL-3.0-only
+# Copyright (c) 2026 Marcus Krueger
 set -euo pipefail
 
 VERSION="${VERSION:-latest}"
diff --git a/.devcontainer/features/claude-monitor/install.sh b/.devcontainer/features/claude-monitor/install.sh
@@ -1,4 +1,6 @@
 #!/bin/bash
+# SPDX-License-Identifier: GPL-3.0-only
+# Copyright (c) 2026 Marcus Krueger
 set -euo pipefail
 
 # ==============================
diff --git a/.devcontainer/features/claude-session-dashboard/install.sh b/.devcontainer/features/claude-session-dashboard/install.sh
@@ -1,4 +1,6 @@
 #!/bin/bash
+# SPDX-License-Identifier: GPL-3.0-only
+# Copyright (c) 2026 Marcus Krueger
 set -euo pipefail
 
 # ==============================
diff --git a/.devcontainer/features/dprint/install.sh b/.devcontainer/features/dprint/install.sh
@@ -1,4 +1,6 @@
 #!/bin/bash
+# SPDX-License-Identifier: GPL-3.0-only
+# Copyright (c) 2026 Marcus Krueger
 set -euo pipefail
 
 # ==============================
diff --git a/.devcontainer/features/hadolint/install.sh b/.devcontainer/features/hadolint/install.sh
@@ -1,4 +1,6 @@
 #!/bin/bash
+# SPDX-License-Identifier: GPL-3.0-only
+# Copyright (c) 2026 Marcus Krueger
 set -euo pipefail
 
 # ==============================
diff --git a/.devcontainer/features/kitty-terminfo/install.sh b/.devcontainer/features/kitty-terminfo/install.sh
@@ -1,4 +1,6 @@
 #!/bin/bash
+# SPDX-License-Identifier: GPL-3.0-only
+# Copyright (c) 2026 Marcus Krueger
 set -euo pipefail
 
 # ==============================
diff --git a/.devcontainer/features/lsp-servers/install.sh b/.devcontainer/features/lsp-servers/install.sh
@@ -1,4 +1,6 @@
 #!/bin/bash
+# SPDX-License-Identifier: GPL-3.0-only
+# Copyright (c) 2026 Marcus Krueger
 # LSP Servers for Claude Code
 # Installs pyright, typescript-language-server, and gopls binaries
 
diff --git a/.devcontainer/features/mcp-qdrant/install.sh b/.devcontainer/features/mcp-qdrant/install.sh
@@ -1,4 +1,6 @@
 #!/bin/bash
+# SPDX-License-Identifier: GPL-3.0-only
+# Copyright (c) 2026 Marcus Krueger
 set -euo pipefail
 
 # Import options from devcontainer-feature.json
diff --git a/.devcontainer/features/mcp-qdrant/poststart-hook.sh b/.devcontainer/features/mcp-qdrant/poststart-hook.sh
@@ -1,4 +1,6 @@
 #!/bin/bash
+# SPDX-License-Identifier: GPL-3.0-only
+# Copyright (c) 2026 Marcus Krueger
 set -euo pipefail
 
 echo "[mcp-qdrant] Registering Qdrant MCP server with Claude Code..."
diff --git a/.devcontainer/features/notify-hook/install.sh b/.devcontainer/features/notify-hook/install.sh
@@ -1,4 +1,6 @@
 #!/bin/bash
+# SPDX-License-Identifier: GPL-3.0-only
+# Copyright (c) 2026 Marcus Krueger
 set -euo pipefail
 
 VERSION="${VERSION:-latest}"
diff --git a/.devcontainer/features/ruff/install.sh b/.devcontainer/features/ruff/install.sh
@@ -1,4 +1,6 @@
 #!/bin/bash
+# SPDX-License-Identifier: GPL-3.0-only
+# Copyright (c) 2026 Marcus Krueger
 set -euo pipefail
 
 # ==============================
diff --git a/.devcontainer/features/shellcheck/install.sh b/.devcontainer/features/shellcheck/install.sh
@@ -1,4 +1,6 @@
 #!/bin/bash
+# SPDX-License-Identifier: GPL-3.0-only
+# Copyright (c) 2026 Marcus Krueger
 set -euo pipefail
 
 # ==============================
diff --git a/.devcontainer/features/shfmt/install.sh b/.devcontainer/features/shfmt/install.sh
@@ -1,4 +1,6 @@
 #!/bin/bash
+# SPDX-License-Identifier: GPL-3.0-only
+# Copyright (c) 2026 Marcus Krueger
 set -euo pipefail
 
 # ==============================
diff --git a/.devcontainer/features/tmux/install.sh b/.devcontainer/features/tmux/install.sh
@@ -1,4 +1,6 @@
 #!/bin/bash
+# SPDX-License-Identifier: GPL-3.0-only
+# Copyright (c) 2026 Marcus Krueger
 set -e
 
 VERSION="${VERSION:-latest}"
diff --git a/.devcontainer/features/tree-sitter/install.sh b/.devcontainer/features/tree-sitter/install.sh
@@ -1,4 +1,6 @@
 #!/bin/bash
+# SPDX-License-Identifier: GPL-3.0-only
+# Copyright (c) 2026 Marcus Krueger
 set -euo pipefail
 
 # === IMPORT OPTIONS ===
diff --git a/.devcontainer/scripts/check-setup.sh b/.devcontainer/scripts/check-setup.sh
@@ -1,4 +1,6 @@
 #!/bin/bash
+# SPDX-License-Identifier: GPL-3.0-only
+# Copyright (c) 2026 Marcus Krueger
 # Verify CodeForge setup is working correctly
 # Run anytime with: check-setup
 
diff --git a/.devcontainer/scripts/setup-aliases.sh b/.devcontainer/scripts/setup-aliases.sh
@@ -1,4 +1,6 @@
 #!/bin/bash
+# SPDX-License-Identifier: GPL-3.0-only
+# Copyright (c) 2026 Marcus Krueger
 # Setup cc/claude/ccraw aliases for claude with local system prompt support
 #
 # Idempotent: removes the entire managed block then re-writes it fresh.
diff --git a/.devcontainer/scripts/setup-auth.sh b/.devcontainer/scripts/setup-auth.sh
@@ -1,4 +1,6 @@
 #!/bin/bash
+# SPDX-License-Identifier: GPL-3.0-only
+# Copyright (c) 2026 Marcus Krueger
 # Configure Git (GitHub CLI) and NPM authentication from .secrets file or environment variables.
 # Environment variables override .secrets values, supporting Codespaces secrets and localEnv.
 # Auth failure should not block other setup steps, so set -e is intentionally omitted.
diff --git a/.devcontainer/scripts/setup-config.sh b/.devcontainer/scripts/setup-config.sh
@@ -1,4 +1,6 @@
 #!/bin/bash
+# SPDX-License-Identifier: GPL-3.0-only
+# Copyright (c) 2026 Marcus Krueger
 # Copy configuration files to workspace based on file-manifest.json
 
 CONFIG_DIR="${CONFIG_SOURCE_DIR:?CONFIG_SOURCE_DIR not set}"
diff --git a/.devcontainer/scripts/setup-migrate-claude.sh b/.devcontainer/scripts/setup-migrate-claude.sh
@@ -1,4 +1,6 @@
 #!/bin/bash
+# SPDX-License-Identifier: GPL-3.0-only
+# Copyright (c) 2026 Marcus Krueger
 # One-time migration: /workspaces/.claude → $HOME/.claude
 # Migrates config, credentials, and rules from the old bind-mount location
 # to the new home directory (Docker named volume).
diff --git a/.devcontainer/scripts/setup-plugins.sh b/.devcontainer/scripts/setup-plugins.sh
@@ -1,4 +1,6 @@
 #!/bin/bash
+# SPDX-License-Identifier: GPL-3.0-only
+# Copyright (c) 2026 Marcus Krueger
 # Install plugins: official Anthropic + local devs-marketplace registration
 #
 # Individual marketplace plugins are enabled via enabledPlugins in settings.json.
diff --git a/.devcontainer/scripts/setup-projects.sh b/.devcontainer/scripts/setup-projects.sh
@@ -1,4 +1,6 @@
 #!/bin/bash
+# SPDX-License-Identifier: GPL-3.0-only
+# Copyright (c) 2026 Marcus Krueger
 # Auto-detect projects under /workspaces/ and register them in Project Manager's projects.json.
 # Runs an initial scan synchronously, then starts an inotifywait background watcher
 # that updates the project list instantly when directories are created or removed.
diff --git a/.devcontainer/scripts/setup-terminal.sh b/.devcontainer/scripts/setup-terminal.sh
@@ -1,4 +1,6 @@
 #!/bin/bash
+# SPDX-License-Identifier: GPL-3.0-only
+# Copyright (c) 2026 Marcus Krueger
 # Configure VS Code Shift+Enter → newline for Claude Code terminal input
 # Writes to ~/.config/Code/User/keybindings.json (same path /terminal-setup uses)
 
diff --git a/.devcontainer/scripts/setup-update-claude.sh b/.devcontainer/scripts/setup-update-claude.sh
@@ -1,4 +1,6 @@
 #!/bin/bash
+# SPDX-License-Identifier: GPL-3.0-only
+# Copyright (c) 2026 Marcus Krueger
 # Update Claude Code CLI to the latest version (native binary only)
 # Runs non-blocking in background by default via setup.sh
 # All failures are warnings — this script never blocks container startup
diff --git a/.devcontainer/scripts/setup.sh b/.devcontainer/scripts/setup.sh
@@ -1,4 +1,6 @@
 #!/bin/bash
+# SPDX-License-Identifier: GPL-3.0-only
+# Copyright (c) 2026 Marcus Krueger
 # Master setup script for CodeForge devcontainer
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
diff --git a/.github/ISSUE_TEMPLATE/bug-report.yml b/.github/ISSUE_TEMPLATE/bug-report.yml
@@ -0,0 +1,61 @@
+name: Bug Report
+description: Report a bug or unexpected behavior
+labels: ["bug"]
+body:
+  - type: textarea
+    id: description
+    attributes:
+      label: Description
+      description: A clear description of the bug
+    validations:
+      required: true
+
+  - type: textarea
+    id: steps
+    attributes:
+      label: Steps to Reproduce
+      description: Steps to reproduce the behavior
+      placeholder: |
+        1. Run `npx codeforge-dev`
+        2. Open in container
+        3. ...
+    validations:
+      required: true
+
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected Behavior
+      description: What you expected to happen
+    validations:
+      required: true
+
+  - type: input
+    id: version
+    attributes:
+      label: CodeForge Version
+      description: "Run `npm view codeforge-dev version` or check package.json"
+      placeholder: "1.14.2"
+    validations:
+      required: true
+
+  - type: dropdown
+    id: environment
+    attributes:
+      label: Environment
+      options:
+        - Docker Desktop
+        - Podman
+        - GitHub Codespaces
+        - DevPod
+        - Other
+    validations:
+      required: true
+
+  - type: textarea
+    id: context
+    attributes:
+      label: Additional Context
+      description: Any other context, screenshots, or logs
+    validations:
+      required: false
diff --git a/.github/ISSUE_TEMPLATE/config.yml b/.github/ISSUE_TEMPLATE/config.yml
@@ -0,0 +1,5 @@
+blank_issues_enabled: true
+contact_links:
+  - name: Commercial Licensing
+    url: mailto:696222+AnExiledDev@users.noreply.github.com
+    about: Inquire about commercial licensing options
diff --git a/.github/ISSUE_TEMPLATE/feature-request.yml b/.github/ISSUE_TEMPLATE/feature-request.yml
@@ -0,0 +1,36 @@
+name: Feature Request
+description: Suggest a new feature or enhancement
+labels: ["enhancement"]
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem
+      description: What problem does this solve?
+      placeholder: "I'm always frustrated when..."
+    validations:
+      required: true
+
+  - type: textarea
+    id: solution
+    attributes:
+      label: Proposed Solution
+      description: Describe the solution you'd like
+    validations:
+      required: true
+
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives Considered
+      description: Any alternative solutions or features you've considered
+    validations:
+      required: false
+
+  - type: textarea
+    id: context
+    attributes:
+      label: Additional Context
+      description: Any other context, mockups, or references
+    validations:
+      required: false
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
@@ -0,0 +1,16 @@
+version: 2
+updates:
+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+
+  - package-ecosystem: "npm"
+    directory: "/docs"
+    schedule:
+      interval: "weekly"
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
diff --git a/CLA.md b/CLA.md
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
diff --git a/LICENSE.txt b/LICENSE.txt
diff --git a/README.md b/README.md
diff --git a/REPO-AUDIT.md b/REPO-AUDIT.md
diff --git a/setup.js b/setup.js
diff --git a/test.js b/test.js

Original file line number	Diff line number	Diff line change
`@@ -1,4 +1,6 @@`
`1`	`1`	`#!/bin/bash`
	`2`	`+# SPDX-License-Identifier: GPL-3.0-only`
	`3`	`+# Copyright (c) 2026 Marcus Krueger`
`2`	`4`	`#`
`3`	`5`	`# Connect to CodeForge devcontainer from external terminal with tmux`
`4`	`6`	`# For Claude Code Agent Teams split-pane support`