Skip to content

Commit 415e3d6

Browse files
gamawaregamaware
committed
feat: initial repo scaffold for GitHub org settings governance
Automated settings sync across all gamaware repos with weekly schedule, drift detection, email reports, and full CI/CD pipeline.
0 parents  commit 415e3d6

31 files changed

Lines changed: 1560 additions & 0 deletions

‎.claude/hooks/post-edit.sh‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
#!/usr/bin/env bash
2+
set -euo pipefail
3+
4+
# Post-edit hook: auto-format shell scripts and markdown after Edit/Write.
5+
# Called by Claude Code via .claude/settings.json PostToolUse hook.
6+
7+
FILE="$TOOL_INPUT_FILE_PATH"
8+
9+
case "$FILE" in
10+
*.sh)
11+
if command -v shellharden > /dev/null 2>&1; then
12+
shellharden --replace "$FILE" 2>/dev/null || true
13+
fi
14+
if [ -f "$FILE" ] && head -1 "$FILE" | grep -q '^#!'; then
15+
chmod +x "$FILE"
16+
fi
17+
;;
18+
*.md)
19+
if command -v markdownlint > /dev/null 2>&1; then
20+
markdownlint --fix "$FILE" 2>/dev/null || true
21+
fi
22+
;;
23+
esac

‎.claude/settings.json‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
{
2+
"hooks": {
3+
"PostToolUse": [
4+
{
5+
"matcher": "Edit|Write",
6+
"hooks": [
7+
{
8+
"type": "command",
9+
"command": "\"$CLAUDE_PROJECT_DIR\"/.claude/hooks/post-edit.sh"
10+
}
11+
]
12+
}
13+
]
14+
}
15+
}

‎.coderabbit.yaml‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
reviews:
2+
auto_review:
3+
enabled: true
4+
path_instructions:
5+
- path: "scripts/**/*.sh"
6+
instructions: |
7+
Review for:
8+
- shellcheck and shellharden compliance
9+
- Proper quoting of all variables
10+
- Error handling (set -euo pipefail)
11+
- GitHub API usage best practices
12+
- No hardcoded tokens or credentials
13+
- path: "config/**/*.json"
14+
instructions: |
15+
Review for:
16+
- Valid JSON structure
17+
- Settings match documented baseline
18+
- Override values are justified
19+
- path: ".github/workflows/**"
20+
instructions: |
21+
Review for:
22+
- Pinned action versions (SHA references)
23+
- Least-privilege permissions
24+
- No credential leaks in logs
25+
- Proper secret usage
26+
- path: "**/*.md"
27+
instructions: |
28+
Review for:
29+
- Clarity and accuracy
30+
- Markdown lint compliance (120 char lines)
31+
- No hardcoded values
32+
path_filters:
33+
- "!**/*.png"
34+
- "!**/*.gif"
35+
- "!**/*.jpg"

‎.github/ISSUE_TEMPLATE/settings-bug.md‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
---
2+
name: Settings Bug
3+
about: Report a settings sync issue
4+
title: ""
5+
labels: bug
6+
---
7+
8+
## Repository affected
9+
10+
<!-- Which repo has the wrong settings? -->
11+
12+
## Expected setting
13+
14+
<!-- What should the setting be? -->
15+
16+
## Actual setting
17+
18+
<!-- What is the setting currently? -->
19+
20+
## Additional context
21+
22+
<!-- Any relevant logs or screenshots -->

‎.github/ISSUE_TEMPLATE/settings-request.md‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
---
2+
name: Settings Request
3+
about: Propose a new setting to enforce
4+
title: ""
5+
labels: enhancement
6+
---
7+
8+
## Setting to add
9+
10+
<!-- Describe the setting -->
11+
12+
## Why
13+
14+
<!-- Why should this be enforced across all repos? -->
15+
16+
## Scope
17+
18+
<!-- All repos, or specific repos only? -->

‎.github/PULL_REQUEST_TEMPLATE.md‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
## What changed
2+
3+
<!-- Brief description of the change -->
4+
5+
## Type of change
6+
7+
- [ ] Settings baseline update
8+
- [ ] Override configuration
9+
- [ ] Workflow improvement
10+
- [ ] Bug fix
11+
- [ ] Documentation
12+
13+
## Checklist
14+
15+
- [ ] JSON configs are valid (`jq empty config/*.json`)
16+
- [ ] Shell scripts pass `shellcheck`
17+
- [ ] Markdown passes `markdownlint`
18+
- [ ] Tested with `--dry-run` mode
19+
- [ ] Updated README if settings changed

‎.github/copilot-instructions.md‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
Review priorities for this repository:
2+
3+
1. Shell script quality: shellcheck and shellharden compliance, proper
4+
quoting, error handling (set -euo pipefail), no hardcoded tokens
5+
2. GitHub API usage: correct endpoints, proper error handling, rate
6+
limit awareness, least-privilege token scopes
7+
3. JSON configuration: valid structure, settings match documented
8+
baseline, overrides are justified
9+
4. Security: no credential leaks, secrets used properly, tokens never
10+
logged
11+
5. Workflow security: pinned action versions (SHA references), minimal
12+
permissions, no script injection
13+
6. Markdown quality: 120 char line limit, fenced code blocks, accurate
14+
documentation

‎.github/dependabot.yml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
version: 2
2+
updates:
3+
- package-ecosystem: github-actions
4+
directory: /
5+
schedule:
6+
interval: weekly
7+
open-pull-requests-limit: 10

‎.github/workflows/quality-checks.yml‎

Lines changed: 99 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,99 @@
1+
name: Quality Checks
2+
3+
on:
4+
pull_request:
5+
branches: [main]
6+
push:
7+
branches: [main]
8+
9+
permissions:
10+
contents: read
11+
12+
jobs:
13+
markdown-lint:
14+
name: Markdown Linting
15+
runs-on: ubuntu-latest
16+
steps:
17+
- name: Checkout
18+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
19+
20+
- name: Lint markdown
21+
uses: DavidAnson/markdownlint-cli2-action@db4c2f7b1e4a6de4660458dd8d547f94deaac667 # v22.0.0
22+
23+
yaml-lint:
24+
name: YAML Validation
25+
runs-on: ubuntu-latest
26+
steps:
27+
- name: Checkout
28+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
29+
30+
- name: Lint YAML
31+
uses: ibiqlik/action-yamllint@2576f72e4b4e5aef56e60fc8a24fa17e25be1fef # v3.1.1
32+
with:
33+
config_file: .yamllint.yml
34+
35+
shell-check:
36+
name: Shell Script Validation
37+
runs-on: ubuntu-latest
38+
steps:
39+
- name: Checkout
40+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
41+
42+
- name: Run ShellCheck
43+
uses: ludeeus/action-shellcheck@00cae500b08a931fb5698e11e79bfbd38e612a38 # v2.0.0
44+
45+
structure:
46+
name: Validate Repository Structure
47+
runs-on: ubuntu-latest
48+
steps:
49+
- name: Checkout
50+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
51+
52+
- name: Check required files
53+
run: |
54+
MISSING=0
55+
for file in LICENSE README.md .gitignore CODEOWNERS CONTRIBUTING.md \
56+
SECURITY.md CLAUDE.md .pre-commit-config.yaml \
57+
.github/dependabot.yml config/baseline.json \
58+
config/overrides.json; do
59+
if [ ! -f "$file" ]; then
60+
echo "MISSING: $file"
61+
MISSING=$((MISSING + 1))
62+
else
63+
echo "OK: $file"
64+
fi
65+
done
66+
if [ "$MISSING" -gt 0 ]; then
67+
echo "ERROR: $MISSING required files are missing"
68+
exit 1
69+
fi
70+
71+
- name: Validate JSON configs
72+
run: |
73+
for file in config/baseline.json config/overrides.json; do
74+
if ! jq empty "$file" 2>/dev/null; then
75+
echo "ERROR: Invalid JSON in $file"
76+
exit 1
77+
else
78+
echo "OK: $file is valid JSON"
79+
fi
80+
done
81+
82+
actions-security:
83+
name: Actions Security
84+
runs-on: ubuntu-latest
85+
steps:
86+
- name: Checkout
87+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
88+
89+
- name: Install zizmor
90+
run: |
91+
ZIZMOR_VERSION="1.5.0"
92+
curl -sL "https://github.com/woodruffw/zizmor/releases/download/v${ZIZMOR_VERSION}/zizmor-x86_64-unknown-linux-gnu.tar.gz" -o /tmp/zizmor.tar.gz
93+
mkdir -p /tmp/zizmor-extract
94+
tar -xzf /tmp/zizmor.tar.gz -C /tmp/zizmor-extract
95+
sudo mv /tmp/zizmor-extract/zizmor /usr/local/bin/zizmor
96+
chmod +x /usr/local/bin/zizmor
97+
98+
- name: Run zizmor
99+
run: zizmor --config zizmor.yml .github/workflows/

‎.github/workflows/security.yml‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
name: Security Scanning
2+
3+
on:
4+
pull_request:
5+
branches: [main]
6+
push:
7+
branches: [main]
8+
9+
permissions:
10+
contents: read
11+
security-events: write
12+
13+
jobs:
14+
security-scan:
15+
name: Security Scan
16+
runs-on: ubuntu-latest
17+
steps:
18+
- name: Checkout
19+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
20+
21+
- name: Run Semgrep
22+
uses: returntocorp/semgrep-action@713efdd345f3035192eaa63f56867b88e63e4e5d # v1.0.0
23+
with:
24+
config: auto
25+
26+
- name: Run Trivy
27+
uses: aquasecurity/trivy-action@18f2510ee396bbf400402947e7f3b01483832965 # v0.31.0
28+
with:
29+
scan-type: fs
30+
format: sarif
31+
output: trivy-results.sarif
32+
33+
- name: Upload Trivy SARIF
34+
uses: github/codeql-action/upload-sarif@ff0a06e83cb2de871e5a09832bc6a81e7276941f # v3.28.18
35+
if: always()
36+
with:
37+
sarif_file: trivy-results.sarif

0 commit comments

Comments
 (0)