chore: fill or remove RSR template placeholders - #78
Conversation
Generated by Mistral Vibe. Co-Authored-By: Mistral Vibe <vibe@mistral.ai>
Generated by Mistral Vibe. Co-Authored-By: Mistral Vibe <vibe@mistral.ai>
Generated by Mistral Vibe. Co-Authored-By: Mistral Vibe <vibe@mistral.ai>
openssf-compliance.yml fails when any of the thirteen files it checks
still contains a {{PLACEHOLDER}} token. This clears them.
Three kinds of change, no invention:
The "TEMPLATE INSTRUCTIONS (delete this block before publishing)" comment
is deleted. The template says to delete it, and it is where every legend
line lives -- so a large share of the reported tokens were the file
documenting its own placeholders, not real unfilled fields.
Tokens derivable from the repository are filled: owner and repo from the
git remote, project name, year, forge, main branch, contact email.
PGP and website lines are removed rather than filled, because nothing
true could go in them. https://github.com/<user>.gpg returns HTTP 200 for
every account; with no key uploaded the body is a stub reading "This user
hasnt uploaded any GPG keys". No key is published for either account
here, and commit signing in this estate is SSH, which is unrelated. Only
one repository in the estate has a domain, so {{WEBSITE}} likewise has no
correct value. The template sanctions this: "Optional: Remove sections
that dont apply (e.g. PGP if you dont use it)." A security policy telling
a researcher to encrypt to a key that does not exist is worse than one
that does not mention encryption.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com>
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| @@ -0,0 +1,55 @@ | |||
| #!/usr/bin/env python3 | |||
![gitar-bot[bot]](https://avatars.githubusercontent.com/in/827041?s=60&v=4){kind=small}
|
Note Automatic reviews are paused because your trial's included automatic processing has been used for this period. Upgrade now, or comment "Gitar review" to run a review anytime. CI failed: CI failures caused by a missing custom GitHub Action repository reference and a governance check violation for banned ReScript files.OverviewTwo distinct failure patterns were found across 3 analyzed logs: a missing custom GitHub Action dependency and a repository governance check violation due to banned ReScript source files. FailuresMissing Custom GitHub Action (confidence: high)
Governance Banned Language Violation (confidence: high)
Summary
Code Review ✅ Approved 2 resolved / 2 findingsFills RSR template placeholders, cleans up governance files, and adds repository configuration and compliance assets. Consider addressing the TOML parsing issues and missing quote escaping in the mise_to_a2ml.py translation utility.
✅ 2 resolved✅ Quality: A2ML output does not escape quotes in tool/version values
✅ Edge Case: mise_to_a2ml.py silently mangles TOML input despite its name
Tip Comment OptionsDisplay: compact → Showing less information. Comment with these commands to change the behavior for this request:
Was this helpful? React with 👍 / 👎 | Gitar |
|
|
2 participants
openssf-compliance.ymlfails when any of the thirteen files it checks still contains a{{PLACEHOLDER}}token. This clears them, with no invention.TEMPLATE INSTRUCTIONS (delete this block before publishing)comment — the template says to delete it, and it is where every legend line lived, so a large share of the reported tokens were the file documenting its own placeholders.https://github.com/<user>.gpgreturns HTTP 200 for every account; with no key uploaded the body is a stub reading "This user hasn't uploaded any GPG keys". No key is published for either account, and commit signing here is SSH — unrelated. The template sanctions this: "Optional: Remove sections that don't apply (e.g. PGP if you don't use it)."\n\nA security policy telling a researcher to encrypt to a key that does not exist is worse than one that does not mention encryption.\n\nWhere applicable, this also fixes a misrouted advisory URL. A previousjust initcopied already-filled templates out ofsquisher-corpus, so 51 repositories directed vulnerability reports tohyperpolymath/squisher-corpus— a repository unrelated to the code being reported, meaning the affected maintainer never saw them. Repointed from this repository's own git remote.Summary by Gitar
ARCHITECTURE.md,GOVERNANCE.md, andMAINTAINERSfilesGOVERNANCE.adocwith Markdown format and updatedSECURITY.mdpoliciesmise.tomlconfiguration andscripts/mise_to_a2ml.pytranslation utility.github/funding.ymlsponsor configurationLICENSES/includingAGPL-3.0-or-later.txtand updated existing license filesThis will update automatically on new commits.