Skip to content

Commit dea4b36

Browse files
author
Jonathan D.A. Jewell
committed
Remove contamination
1 parent 5f24b4c commit dea4b36

17 files changed

Lines changed: 267 additions & 719 deletions

‎.claude/CLAUDE.md‎

Lines changed: 0 additions & 35 deletions
This file was deleted.

‎.github/workflows/codeql-analysis.yml‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
# SPDX-License-Identifier: AGPL-3.0-or-later
2+
name: "CodeQL"
3+
4+
on:
5+
push:
6+
branches: [ "main", "master" ]
7+
pull_request:
8+
branches: [ "main", "master" ]
9+
schedule:
10+
- cron: '30 1 * * *'
11+
12+
permissions: read-all
13+
14+
jobs:
15+
analyze:
16+
name: Analyze
17+
runs-on: ubuntu-latest
18+
timeout-minutes: 360
19+
permissions:
20+
security-events: write
21+
packages: read
22+
actions: read
23+
contents: read
24+
25+
strategy:
26+
fail-fast: false
27+
matrix:
28+
include:
29+
- language: javascript-typescript
30+
build-mode: none
31+
- language: python
32+
build-mode: none
33+
- language: go
34+
build-mode: autobuild
35+
36+
steps:
37+
- name: Checkout repository
38+
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
39+
40+
- name: Initialize CodeQL
41+
uses: github/codeql-action/init@662472033e021d55d94146f66f6058822b0b39fd # v3.28.1
42+
with:
43+
languages: ${{ matrix.language }}
44+
build-mode: ${{ matrix.build-mode }}
45+
46+
- if: matrix.build-mode == 'manual'
47+
run: |
48+
echo 'Build step for compiled languages'
49+
50+
- name: Perform CodeQL Analysis
51+
uses: github/codeql-action/analyze@662472033e021d55d94146f66f6058822b0b39fd # v3.28.1
52+
with:
53+
category: "/language:${{matrix.language}}"

‎.github/workflows/comprehensive-quality.yml‎

Lines changed: 214 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,214 @@
1+
# SPDX-License-Identifier: AGPL-3.0-or-later
2+
name: Comprehensive Quality Gates
3+
on:
4+
push:
5+
branches: [main, master]
6+
pull_request:
7+
schedule:
8+
- cron: '0 5 * * *'
9+
10+
permissions: read-all
11+
12+
jobs:
13+
# DEPENDABILITY - Stability and reliability
14+
dependability:
15+
runs-on: ubuntu-latest
16+
permissions:
17+
contents: read
18+
steps:
19+
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
20+
- name: Check test coverage
21+
run: |
22+
echo "Checking for test files..."
23+
TESTS=$(find . -name "*_test.*" -o -name "test_*" -o -name "*_spec.*" -o -name "*.test.*" | wc -l)
24+
echo "Found $TESTS test files"
25+
if [ "$TESTS" -lt 1 ]; then
26+
echo "::warning::No test files detected"
27+
fi
28+
- name: Check error handling
29+
run: |
30+
# Check for proper error handling patterns
31+
PANICS=$(grep -rE "panic!|unwrap\(\)|expect\(" --include="*.rs" . 2>/dev/null | wc -l || echo "0")
32+
echo "Rust panics/unwraps: $PANICS"
33+
34+
# SECURITY - Multi-layer security scanning
35+
security:
36+
runs-on: ubuntu-latest
37+
permissions:
38+
contents: read
39+
steps:
40+
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
41+
- name: Secret scanning
42+
uses: trufflesecurity/trufflehog@8a8ef8526528d8a4ff3e2c90be08e25ef8efbd9b # v3.88.3
43+
continue-on-error: true
44+
- name: Dependency vulnerabilities
45+
run: |
46+
if [ -f "Cargo.toml" ]; then
47+
cargo install cargo-audit && cargo audit || true
48+
fi
49+
if [ -f "requirements.txt" ]; then
50+
pip install safety && safety check -r requirements.txt || true
51+
fi
52+
- name: SAST scan
53+
uses: returntocorp/semgrep-action@v1
54+
continue-on-error: true
55+
56+
# INTEROPERABILITY - API and format compatibility
57+
interoperability:
58+
runs-on: ubuntu-latest
59+
permissions:
60+
contents: read
61+
steps:
62+
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
63+
- name: Check API specs
64+
run: |
65+
if [ -f "openapi.yaml" ] || [ -f "openapi.json" ]; then
66+
echo "✅ OpenAPI spec found"
67+
fi
68+
if [ -f "schema.graphql" ]; then
69+
echo "✅ GraphQL schema found"
70+
fi
71+
- name: Validate JSON/YAML schemas
72+
run: |
73+
find . -name "*.json" -exec python3 -m json.tool {} \; 2>/dev/null | head -5 || true
74+
75+
# VALIDATION - Input/output validation
76+
validation:
77+
runs-on: ubuntu-latest
78+
permissions:
79+
contents: read
80+
steps:
81+
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
82+
- name: Check for validation patterns
83+
run: |
84+
VALIDATION=$(grep -rE "validate|sanitize|Schema|Validator" --include="*.rs" --include="*.res" --include="*.ex" . 2>/dev/null | wc -l || echo "0")
85+
echo "Validation patterns found: $VALIDATION"
86+
87+
# ATTESTATION - Supply chain integrity (SLSA)
88+
attestation:
89+
runs-on: ubuntu-latest
90+
permissions:
91+
id-token: write
92+
contents: read
93+
attestations: write
94+
steps:
95+
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
96+
- name: Generate SBOM
97+
run: |
98+
echo "SBOM generation would run here"
99+
# For Rust: cargo-sbom
100+
# For Node: npm sbom
101+
- name: Check signatures
102+
run: |
103+
if [ -f "CHECKSUMS.txt" ] || [ -f "SHA256SUMS" ]; then
104+
echo "✅ Checksums file present"
105+
fi
106+
107+
# VERIFICATION - Formal methods where applicable
108+
verification:
109+
runs-on: ubuntu-latest
110+
permissions:
111+
contents: read
112+
steps:
113+
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
114+
- name: Check SPARK proofs
115+
run: |
116+
if find . -name "*.ads" | grep -q .; then
117+
echo "Ada/SPARK files found - formal verification applicable"
118+
fi
119+
- name: Type coverage
120+
run: |
121+
if [ -f "rescript.json" ]; then
122+
echo "ReScript provides 100% type coverage"
123+
fi
124+
125+
# FUNCTIONALITY - Feature completeness
126+
functionality:
127+
runs-on: ubuntu-latest
128+
permissions:
129+
contents: read
130+
steps:
131+
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
132+
- name: Check TODOs and FIXMEs
133+
run: |
134+
echo "=== Incomplete items ==="
135+
grep -rn "TODO\|FIXME\|UNIMPLEMENTED\|unimplemented!" . 2>/dev/null | head -20 || echo "None"
136+
- name: Check deprecated usage
137+
run: |
138+
grep -rn "deprecated\|DEPRECATED" . 2>/dev/null | head -10 || echo "No deprecations"
139+
140+
# PERFORMANCE - Benchmarks and profiling
141+
performance:
142+
runs-on: ubuntu-latest
143+
permissions:
144+
contents: read
145+
steps:
146+
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
147+
- name: Check for benchmarks
148+
run: |
149+
BENCHES=$(find . -name "*bench*" -o -name "*perf*" | wc -l)
150+
echo "Benchmark files: $BENCHES"
151+
- name: Binary size check (Rust)
152+
run: |
153+
if [ -f "Cargo.toml" ]; then
154+
cargo build --release 2>/dev/null || true
155+
find target/release -maxdepth 1 -type f -executable -exec ls -lh {} \; 2>/dev/null || true
156+
fi
157+
158+
# ACCESSIBILITY - A11y compliance
159+
accessibility:
160+
runs-on: ubuntu-latest
161+
if: hashFiles('**/*.html') != ''
162+
permissions:
163+
contents: read
164+
steps:
165+
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
166+
- name: HTML accessibility check
167+
run: |
168+
echo "Checking for a11y attributes..."
169+
A11Y=$(grep -rE 'aria-|role=|alt=' --include="*.html" . 2>/dev/null | wc -l || echo "0")
170+
echo "A11y attributes found: $A11Y"
171+
- name: Lighthouse (if web project)
172+
run: |
173+
echo "Lighthouse would run on deployed URL"
174+
175+
# LICENSE COMPLIANCE
176+
license:
177+
runs-on: ubuntu-latest
178+
permissions:
179+
contents: read
180+
steps:
181+
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
182+
- name: Check license files
183+
run: |
184+
if [ -f "LICENSE" ] || [ -f "LICENSE.txt" ] || [ -f "LICENSE.md" ]; then
185+
echo "✅ License file present"
186+
head -5 LICENSE* 2>/dev/null
187+
else
188+
echo "::warning::No LICENSE file"
189+
fi
190+
- name: Check SPDX headers
191+
run: |
192+
SPDX=$(grep -rE "SPDX-License-Identifier" . 2>/dev/null | wc -l || echo "0")
193+
echo "Files with SPDX headers: $SPDX"
194+
195+
# DOCUMENTATION QUALITY
196+
documentation:
197+
runs-on: ubuntu-latest
198+
permissions:
199+
contents: read
200+
steps:
201+
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
202+
- name: Check docs completeness
203+
run: |
204+
DOCS=""
205+
[ -f "README.md" ] || [ -f "README.adoc" ] && DOCS="$DOCS README"
206+
[ -f "CONTRIBUTING.md" ] || [ -f "CONTRIBUTING.adoc" ] && DOCS="$DOCS CONTRIBUTING"
207+
[ -f "CHANGELOG.md" ] && DOCS="$DOCS CHANGELOG"
208+
[ -f "SECURITY.md" ] && DOCS="$DOCS SECURITY"
209+
[ -d "docs" ] && DOCS="$DOCS docs/"
210+
echo "Documentation:$DOCS"
211+
- name: Check code comments
212+
run: |
213+
COMMENTS=$(grep -rE "^[[:space:]]*(//|#|/\*)" --include="*.rs" --include="*.res" --include="*.py" . 2>/dev/null | wc -l || echo "0")
214+
echo "Comment lines: $COMMENTS"

‎.guix-channel‎

Lines changed: 0 additions & 7 deletions
This file was deleted.

‎.well-known/ai.txt‎

Lines changed: 0 additions & 36 deletions
This file was deleted.

‎.well-known/consent-required.txt‎

Lines changed: 0 additions & 32 deletions
This file was deleted.

0 commit comments

Comments
 (0)