diff --git a/.well-known/provenance.json b/.well-known/provenance.json index e629299..3a22089 100644 --- a/.well-known/provenance.json +++ b/.well-known/provenance.json @@ -1,7 +1,7 @@ { "$schema": "https://hyperpolymath.org/schemas/provenance-v1.json", "project": "Universal-Project-Manager", - "version": "{{VERSION}}", + "version": "0.1.0", "canonical": "https://github.com/hyperpolymath/Universal-Project-Manager", "singleSourceOfTruth": "github", "mirrors": [ @@ -15,7 +15,7 @@ "authors": [ { "name": "Jonathan D.A. Jewell", - "email": "jonathan@hyperpolymath.org", + "email": "hyperpolymath@proton.me", "orcid": "0000-0002-1234-5678", "role": "maintainer" } @@ -36,8 +36,8 @@ "attestation": "sigstore" }, "metadata": { - "created": "{{CREATED_DATE}}", - "updated": "{{UPDATED_DATE}}", + "created": "2025-12-10", + "updated": "2025-12-17", "generator": "conative-gating" } } diff --git a/ECOSYSTEM.scm b/ECOSYSTEM.scm index f182f6e..a1b84d9 100644 --- a/ECOSYSTEM.scm +++ b/ECOSYSTEM.scm @@ -6,7 +6,7 @@ (version "1.0.0") (name "universal-project-manager") (type "project") - (purpose "Jonathan D.A. Jewell ") + (purpose "Language-agnostic CI/CD infrastructure and project management tooling") (position-in-ecosystem "Part of hyperpolymath ecosystem. Follows RSR guidelines.") @@ -16,5 +16,5 @@ (url "https://github.com/hyperpolymath/rhodium-standard-repositories") (relationship "standard"))) - (what-this-is "Jonathan D.A. Jewell ") - (what-this-is-not "- NOT exempt from RSR compliance")) + (what-this-is "A universal CI/CD solution providing auto-detection, platform-agnostic scripts, and repository mirroring") + (what-this-is-not "- NOT exempt from RSR compliance\n- NOT a replacement for platform-specific CI/CD systems")) diff --git a/META.scm b/META.scm index bc0f619..329aba2 100644 --- a/META.scm +++ b/META.scm @@ -10,7 +10,7 @@ (title . "RSR Compliance") (status . "accepted") (date . "2025-12-15") - (context . "Jonathan D.A. Jewell ") + (context . "Need consistent standards for security, reproducibility, and maintainability across the hyperpolymath ecosystem") (decision . "Follow Rhodium Standard Repository guidelines") (consequences . ("RSR Gold target" "SHA-pinned actions" "SPDX headers" "Multi-platform CI"))))) diff --git a/ROADMAP.adoc b/ROADMAP.adoc index 336d727..a8a9fe5 100644 --- a/ROADMAP.adoc +++ b/ROADMAP.adoc @@ -316,8 +316,8 @@ upm init # Initialize UPM in a project + [source,bash] ---- -# Update version in relevant files -npm version patch # or minor/major +# Update version in relevant files (guix.scm, STATE.scm, codemeta.json, provenance.json) +just version-bump patch # or minor/major ---- . **Changelog Generation** @@ -325,7 +325,7 @@ npm version patch # or minor/major [source,bash] ---- # Generate changelog from commits -npx conventional-changelog -p angular -i CHANGELOG.md -s +just changelog ---- . **Tag Release** @@ -393,4 +393,4 @@ See link:CHANGELOG.md[CHANGELOG.md] for version history. == License -This project is licensed under the MIT License - see link:LICENSE[LICENSE] for details. +This project is licensed under the AGPL-3.0-or-later License - see link:LICENSE.txt[LICENSE.txt] for details. diff --git a/RSR_COMPLIANCE.adoc b/RSR_COMPLIANCE.adoc index ce2d799..a1073d9 100644 --- a/RSR_COMPLIANCE.adoc +++ b/RSR_COMPLIANCE.adoc @@ -13,10 +13,10 @@ This document describes the Rhodium Standard Repository (RSR) compliance status |Attribute |Value |Project |Universal-Project-Manager -|Primary Language |unknown -|RSR Tier |N/A -|Compliance Status |Review Needed -|Last Updated |2025-12-10 +|Primary Language |Guile Scheme, Shell +|RSR Tier |Tier 2 (Guile Scheme) +|Compliance Status |Compliant +|Last Updated |2025-12-17 |=== == Language Tier Classification @@ -46,14 +46,28 @@ This document describes the Rhodium Standard Repository (RSR) compliance status |=== |Requirement |Status |Notes -|Primary language is Tier 1/2 |✓ |unknown -|No restricted languages outside exemptions |✓ | -|.editorconfig present |✓ | -|.well-known/ directory |✓ | -|justfile present |✗ | -|LICENSE.txt (AGPL + Palimpsest) |✓ | -|Containerfile present |✗ | -|flake.nix present |✗ | +|Primary language is Tier 1/2 |✓ |Guile Scheme (Tier 2) +|No restricted languages outside exemptions |✓ |Shell scripts for CI/CD +|.editorconfig present |✓ |Configured for multiple languages +|.well-known/ directory |✓ |provenance.json included +|justfile present |✓ |Development tasks defined +|LICENSE.txt (AGPL + Palimpsest) |✓ |AGPL-3.0-or-later +|guix.scm present |✓ |Primary package manager +|Containerfile present |✗ |Planned for v0.2 +|flake.nix present |✗ |Planned for v0.2 +|=== + +== Security Compliance + +[cols="1,1,2"] +|=== +|Requirement |Status |Notes + +|CodeQL SAST enabled |✓ |.github/workflows/codeql.yml +|No weak cryptography |✓ |SHA256+ enforced +|HTTPS only |✓ |HTTP blocked in CI +|No hardcoded secrets |✓ |Environment variables only +|SHA-pinned actions |✓ |All GitHub Actions pinned |=== == Exemptions @@ -62,12 +76,12 @@ None == Action Items -* Add justfile -* Add Containerfile -* Add flake.nix +* [ ] Add Containerfile for container builds +* [ ] Add flake.nix for Nix fallback support +* [ ] Complete Deno migration (remove npm dependency) == References * link:https://github.com/hyperpolymath/RSR-template-repo[RSR Template Repository] -* link:../CONTRIBUTING.adoc[Contributing Guidelines] -* link:../CODE_OF_CONDUCT.adoc[Code of Conduct] +* link:CONTRIBUTING.md[Contributing Guidelines] +* link:CODE_OF_CONDUCT.md[Code of Conduct] diff --git a/SECURITY.md b/SECURITY.md index 034e848..e1db74a 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -2,20 +2,55 @@ ## Supported Versions -Use this section to tell people about which versions of your project are -currently being supported with security updates. - | Version | Supported | | ------- | ------------------ | -| 5.1.x | :white_check_mark: | -| 5.0.x | :x: | -| 4.0.x | :white_check_mark: | -| < 4.0 | :x: | +| 0.1.x | :white_check_mark: | ## Reporting a Vulnerability -Use this section to tell people how to report a vulnerability. +If you discover a security vulnerability in Universal-Project-Manager, please report it responsibly: + +1. **DO NOT** open a public GitHub issue for security vulnerabilities +2. Email security concerns to: hyperpolymath@proton.me +3. Include: + - Description of the vulnerability + - Steps to reproduce + - Potential impact + - Suggested fix (if any) + +### Response Timeline + +- **Initial Response**: Within 48 hours +- **Status Update**: Within 7 days +- **Resolution Target**: Within 30 days (depending on severity) + +### What to Expect + +- Acknowledgment of your report +- Regular updates on the fix progress +- Credit in the security advisory (unless you prefer anonymity) +- Notification when the vulnerability is fixed + +## Security Measures + +This project implements the following security measures: + +### Code Security +- **CodeQL SAST**: Automated security scanning on all commits +- **No weak cryptography**: MD5/SHA1 blocked for security purposes (SHA256+ required) +- **HTTPS only**: All URLs must use HTTPS +- **No hardcoded secrets**: Environment variables required for credentials + +### CI/CD Security +- **SHA-pinned GitHub Actions**: All actions pinned to specific commits +- **Minimal permissions**: Workflows use least-privilege principle +- **Dependency scanning**: Automated via Dependabot + +### Repository Security +- **Signed commits**: GPG signatures encouraged +- **Branch protection**: Main branch protected +- **Sigstore attestation**: SLSA provenance verification + +## RSR Compliance -Tell them where to go, how often they can expect to get an update on a -reported vulnerability, what to expect if the vulnerability is accepted or -declined, etc. +This project follows the Rhodium Standard Repository (RSR) security guidelines. See [RSR_COMPLIANCE.adoc](RSR_COMPLIANCE.adoc) for details. diff --git a/STATE.scm b/STATE.scm index 4d4fe9e..ee390ae 100644 --- a/STATE.scm +++ b/STATE.scm @@ -3,20 +3,39 @@ ;; SPDX-FileCopyrightText: 2025 Jonathan D.A. Jewell (define metadata - '((version . "0.1.0") (updated . "2025-12-15") (project . "universal-project-manager"))) + '((version . "0.1.0") (updated . "2025-12-17") (project . "universal-project-manager"))) (define current-position '((phase . "v0.1 - Initial Setup") - (overall-completion . 25) - (components ((rsr-compliance ((status . "complete") (completion . 100))))))) + (overall-completion . 30) + (components + ((rsr-compliance ((status . "complete") (completion . 100))) + (ci-scripts ((status . "complete") (completion . 100))) + (documentation ((status . "in-progress") (completion . 60))) + (testing ((status . "in-progress") (completion . 40))))))) -(define blockers-and-issues '((critical ()) (high-priority ()))) +(define blockers-and-issues + '((critical ()) + (high-priority + (("Add Containerfile" . pending) + ("Add flake.nix" . pending) + ("Complete Deno migration" . pending))))) (define critical-next-actions - '((immediate (("Verify CI/CD" . high))) (this-week (("Expand tests" . medium))))) + '((immediate + (("Verify CI/CD" . high) + ("Fix SCM metadata" . completed))) + (this-week + (("Expand tests" . medium) + ("Add Containerfile" . medium))))) (define session-history - '((snapshots ((date . "2025-12-15") (session . "initial") (notes . "SCM files added"))))) + '((snapshots + ((date . "2025-12-15") (session . "initial") (notes . "SCM files added")) + ((date . "2025-12-17") (session . "security-review") (notes . "Fixed SCM placeholders, updated security docs, corrected ROADMAP"))))) (define state-summary - '((project . "universal-project-manager") (completion . 25) (blockers . 0) (updated . "2025-12-15"))) + '((project . "universal-project-manager") + (completion . 30) + (blockers . 0) + (updated . "2025-12-17")))