Skip to content

Commit 24c5611

Browse files
author
Jonathan D.A. Jewell
committed
Remove contamination
1 parent c4c7f30 commit 24c5611

9 files changed

Lines changed: 267 additions & 200 deletions

File tree

‎.claude/CLAUDE.md‎

Lines changed: 0 additions & 24 deletions
This file was deleted.

‎.github/workflows/codeql-analysis.yml‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
# SPDX-License-Identifier: AGPL-3.0-or-later
2+
name: "CodeQL"
3+
4+
on:
5+
push:
6+
branches: [ "main", "master" ]
7+
pull_request:
8+
branches: [ "main", "master" ]
9+
schedule:
10+
- cron: '30 1 * * *'
11+
12+
permissions: read-all
13+
14+
jobs:
15+
analyze:
16+
name: Analyze
17+
runs-on: ubuntu-latest
18+
timeout-minutes: 360
19+
permissions:
20+
security-events: write
21+
contents: read
22+
actions: read
23+
24+
strategy:
25+
fail-fast: false
26+
matrix:
27+
include:
28+
- language: javascript-typescript
29+
build-mode: none
30+
- language: python
31+
build-mode: none
32+
- language: go
33+
build-mode: autobuild
34+
35+
steps:
36+
- name: Checkout repository
37+
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
38+
39+
- name: Initialize CodeQL
40+
uses: github/codeql-action/init@662472033e021d55d94146f66f6058822b0b39fd # v3.28.1
41+
with:
42+
languages: ${{ matrix.language }}
43+
build-mode: ${{ matrix.build-mode }}
44+
45+
- if: matrix.build-mode == 'manual'
46+
run: |
47+
echo 'Build step for compiled languages'
48+
49+
- name: Perform CodeQL Analysis
50+
uses: github/codeql-action/analyze@662472033e021d55d94146f66f6058822b0b39fd # v3.28.1
51+
with:
52+
category: "/language:${{matrix.language}}"

‎.github/workflows/comprehensive-quality.yml‎

Lines changed: 215 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,215 @@
1+
# SPDX-License-Identifier: AGPL-3.0-or-later
2+
name: Comprehensive Quality Gates
3+
4+
on:
5+
push:
6+
branches: [main, master]
7+
pull_request:
8+
schedule:
9+
- cron: '0 5 * * *'
10+
11+
permissions: read-all
12+
13+
jobs:
14+
# DEPENDABILITY - Stability and reliability
15+
dependability:
16+
runs-on: ubuntu-latest
17+
permissions:
18+
contents: read
19+
steps:
20+
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
21+
- name: Check test coverage
22+
run: |
23+
echo "Checking for test files..."
24+
TESTS=$(find . -name "*_test.*" -o -name "test_*" -o -name "*_spec.*" -o -name "*.test.*" | wc -l)
25+
echo "Found $TESTS test files"
26+
if [ "$TESTS" -lt 1 ]; then
27+
echo "::warning::No test files detected"
28+
fi
29+
- name: Check error handling
30+
run: |
31+
# Check for proper error handling patterns
32+
PANICS=$(grep -rE "panic!|unwrap\(\)|expect\(" --include="*.rs" . 2>/dev/null | wc -l || echo "0")
33+
echo "Rust panics/unwraps: $PANICS"
34+
35+
# SECURITY - Multi-layer security scanning
36+
security:
37+
runs-on: ubuntu-latest
38+
permissions:
39+
contents: read
40+
steps:
41+
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
42+
- name: Secret scanning
43+
uses: trufflesecurity/trufflehog@8a8ef8526528d8a4ff3e2c90be08e25ef8efbd9b # v3.88.3
44+
continue-on-error: true
45+
- name: Dependency vulnerabilities
46+
run: |
47+
if [ -f "Cargo.toml" ]; then
48+
cargo install cargo-audit && cargo audit || true
49+
fi
50+
if [ -f "requirements.txt" ]; then
51+
pip install safety && safety check -r requirements.txt || true
52+
fi
53+
- name: SAST scan
54+
uses: returntocorp/semgrep-action@713efdd345f3035192eaa63f56867b88e63e4e5d # v1.100.0
55+
continue-on-error: true
56+
57+
# INTEROPERABILITY - API and format compatibility
58+
interoperability:
59+
runs-on: ubuntu-latest
60+
permissions:
61+
contents: read
62+
steps:
63+
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
64+
- name: Check API specs
65+
run: |
66+
if [ -f "openapi.yaml" ] || [ -f "openapi.json" ]; then
67+
echo "✅ OpenAPI spec found"
68+
fi
69+
if [ -f "schema.graphql" ]; then
70+
echo "✅ GraphQL schema found"
71+
fi
72+
- name: Validate JSON/YAML schemas
73+
run: |
74+
find . -name "*.json" -exec python3 -m json.tool {} \; 2>/dev/null | head -5 || true
75+
76+
# VALIDATION - Input/output validation
77+
validation:
78+
runs-on: ubuntu-latest
79+
permissions:
80+
contents: read
81+
steps:
82+
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
83+
- name: Check for validation patterns
84+
run: |
85+
VALIDATION=$(grep -rE "validate|sanitize|Schema|Validator" --include="*.rs" --include="*.res" --include="*.ex" . 2>/dev/null | wc -l || echo "0")
86+
echo "Validation patterns found: $VALIDATION"
87+
88+
# ATTESTATION - Supply chain integrity (SLSA)
89+
attestation:
90+
runs-on: ubuntu-latest
91+
permissions:
92+
id-token: write
93+
contents: read
94+
attestations: write
95+
steps:
96+
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
97+
- name: Generate SBOM
98+
run: |
99+
echo "SBOM generation would run here"
100+
# For Rust: cargo-sbom
101+
# For Node: npm sbom
102+
- name: Check signatures
103+
run: |
104+
if [ -f "CHECKSUMS.txt" ] || [ -f "SHA256SUMS" ]; then
105+
echo "✅ Checksums file present"
106+
fi
107+
108+
# VERIFICATION - Formal methods where applicable
109+
verification:
110+
runs-on: ubuntu-latest
111+
permissions:
112+
contents: read
113+
steps:
114+
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
115+
- name: Check SPARK proofs
116+
run: |
117+
if find . -name "*.ads" | grep -q .; then
118+
echo "Ada/SPARK files found - formal verification applicable"
119+
fi
120+
- name: Type coverage
121+
run: |
122+
if [ -f "rescript.json" ]; then
123+
echo "ReScript provides 100% type coverage"
124+
fi
125+
126+
# FUNCTIONALITY - Feature completeness
127+
functionality:
128+
runs-on: ubuntu-latest
129+
permissions:
130+
contents: read
131+
steps:
132+
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
133+
- name: Check TODOs and FIXMEs
134+
run: |
135+
echo "=== Incomplete items ==="
136+
grep -rn "TODO\|FIXME\|UNIMPLEMENTED\|unimplemented!" . 2>/dev/null | head -20 || echo "None"
137+
- name: Check deprecated usage
138+
run: |
139+
grep -rn "deprecated\|DEPRECATED" . 2>/dev/null | head -10 || echo "No deprecations"
140+
141+
# PERFORMANCE - Benchmarks and profiling
142+
performance:
143+
runs-on: ubuntu-latest
144+
permissions:
145+
contents: read
146+
steps:
147+
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
148+
- name: Check for benchmarks
149+
run: |
150+
BENCHES=$(find . -name "*bench*" -o -name "*perf*" | wc -l)
151+
echo "Benchmark files: $BENCHES"
152+
- name: Binary size check (Rust)
153+
run: |
154+
if [ -f "Cargo.toml" ]; then
155+
cargo build --release 2>/dev/null || true
156+
find target/release -maxdepth 1 -type f -executable -exec ls -lh {} \; 2>/dev/null || true
157+
fi
158+
159+
# ACCESSIBILITY - A11y compliance
160+
accessibility:
161+
runs-on: ubuntu-latest
162+
if: hashFiles('**/*.html') != ''
163+
permissions:
164+
contents: read
165+
steps:
166+
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
167+
- name: HTML accessibility check
168+
run: |
169+
echo "Checking for a11y attributes..."
170+
A11Y=$(grep -rE 'aria-|role=|alt=' --include="*.html" . 2>/dev/null | wc -l || echo "0")
171+
echo "A11y attributes found: $A11Y"
172+
- name: Lighthouse (if web project)
173+
run: |
174+
echo "Lighthouse would run on deployed URL"
175+
176+
# LICENSE COMPLIANCE
177+
license:
178+
runs-on: ubuntu-latest
179+
permissions:
180+
contents: read
181+
steps:
182+
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
183+
- name: Check license files
184+
run: |
185+
if [ -f "LICENSE" ] || [ -f "LICENSE.txt" ] || [ -f "LICENSE.md" ]; then
186+
echo "✅ License file present"
187+
head -5 LICENSE* 2>/dev/null
188+
else
189+
echo "::warning::No LICENSE file"
190+
fi
191+
- name: Check SPDX headers
192+
run: |
193+
SPDX=$(grep -rE "SPDX-License-Identifier" . 2>/dev/null | wc -l || echo "0")
194+
echo "Files with SPDX headers: $SPDX"
195+
196+
# DOCUMENTATION QUALITY
197+
documentation:
198+
runs-on: ubuntu-latest
199+
permissions:
200+
contents: read
201+
steps:
202+
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
203+
- name: Check docs completeness
204+
run: |
205+
DOCS=""
206+
[ -f "README.md" ] || [ -f "README.adoc" ] && DOCS="$DOCS README"
207+
[ -f "CONTRIBUTING.md" ] || [ -f "CONTRIBUTING.adoc" ] && DOCS="$DOCS CONTRIBUTING"
208+
[ -f "CHANGELOG.md" ] && DOCS="$DOCS CHANGELOG"
209+
[ -f "SECURITY.md" ] && DOCS="$DOCS SECURITY"
210+
[ -d "docs" ] && DOCS="$DOCS docs/"
211+
echo "Documentation:$DOCS"
212+
- name: Check code comments
213+
run: |
214+
COMMENTS=$(grep -rE "^[[:space:]]*(//|#|/\*)" --include="*.rs" --include="*.res" --include="*.py" . 2>/dev/null | wc -l || echo "0")
215+
echo "Comment lines: $COMMENTS"

‎.guix-channel‎

Lines changed: 0 additions & 4 deletions
This file was deleted.

‎CITATION.cff‎

Lines changed: 0 additions & 20 deletions
This file was deleted.

‎ECOSYSTEM.scm‎

Lines changed: 0 additions & 20 deletions
This file was deleted.

‎META.scm‎

Lines changed: 0 additions & 24 deletions
This file was deleted.

0 commit comments

Comments
 (0)