Skip to content

Commit 31ffb5a

Browse files
UsernameLoadUsernameLoad
committed
chore: initial commit
0 parents  commit 31ffb5a

332 files changed

Lines changed: 13323 additions & 0 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.changeset/README.md‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
# Changesets
2+
3+
Hardened uses [changesets](https://github.com/changesets/changesets) for version management.
4+
5+
## When you make a change worth releasing
6+
7+
Run `pnpm changeset` and follow the prompts. This creates a markdown file in `.changeset/` describing the change. Commit it with your PR.
8+
9+
## What counts as "worth releasing"
10+
11+
- Any change to code in a published package (`@hardened/core`, `@hardened/rules-risk`, `hardened-runtime`, `hardened`)
12+
- New rules
13+
- Bug fixes affecting user-visible behavior
14+
- Documentation that users will see on npm
15+
16+
## What does NOT need a changeset
17+
18+
- Internal refactors with no behavior change
19+
- CI / tooling changes
20+
- Fixture updates
21+
- Internal-only docs
22+
23+
## Release flow
24+
25+
Maintainers merge changesets into `main`. When ready to release, run the `Version Packages` workflow which:
26+
27+
1. Consumes all pending changesets
28+
2. Bumps package versions according to the collected changes
29+
3. Updates each package's `CHANGELOG.md`
30+
4. Opens a release PR
31+
32+
Merging that PR publishes to npm with provenance.

‎.changeset/config.json‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
{
2+
"$schema": "https://unpkg.com/@changesets/config@3.0.0/schema.json",
3+
"changelog": "@changesets/cli/changelog",
4+
"commit": false,
5+
"fixed": [],
6+
"linked": [],
7+
"access": "public",
8+
"baseBranch": "main",
9+
"updateInternalDependencies": "patch",
10+
"ignore": [
11+
"@fixtures/sample-app",
12+
"@hardened/rules-config",
13+
"@hardened/rules-schema"
14+
]
15+
}

‎.devcontainer/devcontainer.json‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
{
2+
"name": "hardened",
3+
"image": "mcr.microsoft.com/devcontainers/typescript-node:1-20-bookworm",
4+
"features": {
5+
"ghcr.io/devcontainers/features/github-cli:1": {},
6+
"ghcr.io/devcontainers/features/common-utils:2": {}
7+
},
8+
"customizations": {
9+
"vscode": {
10+
"extensions": [
11+
"dbaeumer.vscode-eslint",
12+
"esbenp.prettier-vscode",
13+
"vitest.explorer",
14+
"editorconfig.editorconfig",
15+
"unifiedjs.vscode-mdx",
16+
"yzhang.markdown-all-in-one"
17+
],
18+
"settings": {
19+
"editor.formatOnSave": true,
20+
"editor.tabSize": 2,
21+
"typescript.tsdk": "node_modules/typescript/lib",
22+
"files.eol": "\n"
23+
}
24+
}
25+
},
26+
"postCreateCommand": "corepack enable && pnpm install && pre-commit install || true",
27+
"remoteUser": "node",
28+
"mounts": [
29+
"source=${localWorkspaceFolderBasename}-node_modules,target=${containerWorkspaceFolder}/node_modules,type=volume"
30+
]
31+
}

‎.editorconfig‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
root = true
2+
3+
[*]
4+
charset = utf-8
5+
end_of_line = lf
6+
indent_style = space
7+
indent_size = 2
8+
insert_final_newline = true
9+
trim_trailing_whitespace = true
10+
11+
[*.md]
12+
trim_trailing_whitespace = false
13+
14+
[{*.yml,*.yaml}]
15+
indent_size = 2
16+
17+
[Makefile]
18+
indent_style = tab

‎.gitattributes‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
# Normalize line endings. Enforces LF on commit regardless of platform.
2+
* text=auto eol=lf
3+
4+
# Explicit text files (make intent clear for contributors)
5+
*.ts text eol=lf
6+
*.tsx text eol=lf
7+
*.js text eol=lf
8+
*.mjs text eol=lf
9+
*.cjs text eol=lf
10+
*.json text eol=lf
11+
*.jsonc text eol=lf
12+
*.yml text eol=lf
13+
*.yaml text eol=lf
14+
*.md text eol=lf
15+
*.toml text eol=lf
16+
*.sh text eol=lf
17+
*.ps1 text eol=crlf
18+
19+
# Lockfiles: text with LF endings, but mark as generated so GitHub collapses
20+
# them in PR diffs. Earlier we tried `-text` (binary) which prevented line-
21+
# ending normalization and confused pnpm's YAML parser on CI runners.
22+
pnpm-lock.yaml text eol=lf linguist-generated=true
23+
package-lock.json text eol=lf linguist-generated=true
24+
yarn.lock text eol=lf linguist-generated=true
25+
26+
# Mark generated files so GitHub collapses them in PR diffs
27+
CHANGELOG.md linguist-generated=true

‎.github/CODEOWNERS‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
# Every PR requires review from the maintainer.
2+
# See https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners
3+
* @UsernameLoad

‎.github/ISSUE_TEMPLATE/bug_report.yml‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
name: Bug report
2+
description: Report a correctness or behavior issue with hardened.
3+
labels: [bug]
4+
body:
5+
- type: markdown
6+
attributes:
7+
value: |
8+
Thanks for filing a bug. Please include enough detail to reproduce the issue locally.
9+
10+
- type: textarea
11+
id: what-happened
12+
attributes:
13+
label: What happened?
14+
description: What did you run, and what did hardened do?
15+
validations:
16+
required: true
17+
18+
- type: textarea
19+
id: expected
20+
attributes:
21+
label: What did you expect?
22+
validations:
23+
required: true
24+
25+
- type: textarea
26+
id: minimal-repro
27+
attributes:
28+
label: Minimal reproduction
29+
description: A code snippet that triggers the issue, or a link to a public repo.
30+
render: typescript
31+
validations:
32+
required: true
33+
34+
- type: input
35+
id: hardened-version
36+
attributes:
37+
label: hardened version
38+
placeholder: 0.1.0
39+
validations:
40+
required: true
41+
42+
- type: input
43+
id: node-version
44+
attributes:
45+
label: Node version
46+
placeholder: 20.11.1
47+
validations:
48+
required: true
49+
50+
- type: dropdown
51+
id: os
52+
attributes:
53+
label: Operating system
54+
options:
55+
- Linux
56+
- macOS
57+
- Windows
58+
validations:
59+
required: true

‎.github/ISSUE_TEMPLATE/config.yml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
blank_issues_enabled: false
2+
contact_links:
3+
- name: Ask a question
4+
url: https://github.com/compactbench/hardened/discussions
5+
about: Please use GitHub Discussions for usage questions.
6+
- name: Security concern
7+
url: https://github.com/compactbench/hardened/security/advisories/new
8+
about: Report vulnerabilities privately via a Security Advisory.

‎.github/ISSUE_TEMPLATE/rule_proposal.yml‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
name: Rule proposal
2+
description: Propose a new rule for hardened.
3+
labels: [rule-proposal]
4+
body:
5+
- type: markdown
6+
attributes:
7+
value: |
8+
Rule proposals are reviewed against three criteria: determinism, false-positive risk, and fit with hardened's local-transform design principles (zero/near-zero config, safe to auto-apply).
9+
10+
- type: input
11+
id: rule-id
12+
attributes:
13+
label: Proposed rule ID
14+
description: "Format: category/kebab-case-name. Example: risk/graphql-no-timeout"
15+
placeholder: category/kebab-case-name
16+
validations:
17+
required: true
18+
19+
- type: textarea
20+
id: problem
21+
attributes:
22+
label: Problem
23+
description: What production-reliability or correctness issue does this rule address?
24+
validations:
25+
required: true
26+
27+
- type: textarea
28+
id: detection
29+
attributes:
30+
label: Detection strategy
31+
description: What AST patterns does the rule match? Include before/after examples.
32+
render: typescript
33+
validations:
34+
required: true
35+
36+
- type: textarea
37+
id: fix-strategy
38+
attributes:
39+
label: Fix strategy
40+
description: Is there a deterministic auto-fix? If not, explain why and propose finding-only.
41+
render: typescript
42+
43+
- type: textarea
44+
id: false-positive-risk
45+
attributes:
46+
label: False-positive risk
47+
description: When might this rule fire incorrectly? How can we reduce that risk?
48+
validations:
49+
required: true
50+
51+
- type: checkboxes
52+
id: determinism
53+
attributes:
54+
label: Determinism check
55+
options:
56+
- label: The proposed fix produces byte-identical output for identical input.
57+
required: true

‎.github/dependabot.yml‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
version: 2
2+
updates:
3+
- package-ecosystem: "npm"
4+
directory: "/"
5+
schedule:
6+
interval: "weekly"
7+
day: "monday"
8+
time: "09:00"
9+
timezone: "UTC"
10+
open-pull-requests-limit: 5
11+
groups:
12+
typescript:
13+
patterns:
14+
- "typescript"
15+
- "@types/*"
16+
dev-dependencies:
17+
dependency-type: "development"
18+
commit-message:
19+
prefix: "chore(deps)"
20+
include: "scope"
21+
22+
- package-ecosystem: "github-actions"
23+
directory: "/"
24+
schedule:
25+
interval: "weekly"
26+
day: "monday"
27+
commit-message:
28+
prefix: "ci(deps)"

0 commit comments

Comments
 (0)