diff --git a/.github/workflows/boj-build.yml b/.github/workflows/boj-build.yml index b59be5f..410dc3c 100644 --- a/.github/workflows/boj-build.yml +++ b/.github/workflows/boj-build.yml @@ -1,19 +1,19 @@ +# SPDX-License-Identifier: PMPL-1.0-or-later name: BoJ Server Build Trigger - on: push: - branches: [ main, master ] + branches: [main, master] workflow_dispatch: - jobs: trigger-boj: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v4 - + uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7 - name: Trigger BoJ Server (Casket/ssg-mcp) run: | # Send a secure trigger to boj-server to build this repository curl -X POST "http://boj-server.local:7700/cartridges/ssg-mcp/invoke" -H "Content-Type: application/json" -d "{\"repo\": \"${{ github.repository }}\", \"branch\": \"${{ github.ref_name }}\", \"engine\": \"casket\\"}"} continue-on-error: true +permissions: + contents: read diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 865b355..c523d0b 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -1,5 +1,6 @@ # SPDX-License-Identifier: PMPL-1.0-or-later -permissions: read-all +permissions: + contents: read name: CI @@ -87,14 +88,14 @@ jobs: - name: Setup Python if: needs.detect.outputs.has_python == 'true' - uses: actions/setup-python@v5 + uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5 with: python-version: '3.12' cache: 'pip' - name: Setup Go if: needs.detect.outputs.has_go == 'true' - uses: actions/setup-go@v5 + uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5 with: go-version: '1.22' cache: true @@ -141,14 +142,14 @@ jobs: - name: Setup Python if: needs.detect.outputs.has_python == 'true' - uses: actions/setup-python@v5 + uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5 with: python-version: ${{ matrix.python-version }} cache: 'pip' - name: Setup Go if: needs.detect.outputs.has_go == 'true' - uses: actions/setup-go@v5 + uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5 with: go-version: ${{ matrix.go-version }} cache: true @@ -181,7 +182,7 @@ jobs: - name: Upload coverage if: success() && github.event_name == 'push' - uses: codecov/codecov-action@v4 + uses: codecov/codecov-action@b9fd7d16f6d7d1b5d2bec1a2887e65ceed900238 # v4 with: token: ${{ secrets.CODECOV_TOKEN }} fail_ci_if_error: false @@ -205,13 +206,13 @@ jobs: - name: Setup Python if: needs.detect.outputs.has_python == 'true' - uses: actions/setup-python@v5 + uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5 with: python-version: '3.12' - name: Setup Go if: needs.detect.outputs.has_go == 'true' - uses: actions/setup-go@v5 + uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5 with: go-version: '1.22' @@ -277,11 +278,11 @@ jobs: uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v3 + uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3 - name: Login to GitHub Container Registry if: github.event_name == 'push' - uses: docker/login-action@v3 + uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3 with: registry: ghcr.io username: ${{ github.actor }} @@ -289,7 +290,7 @@ jobs: - name: Extract metadata id: meta - uses: docker/metadata-action@v5 + uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5 with: images: ghcr.io/${{ github.repository }} tags: | @@ -300,7 +301,7 @@ jobs: type=sha - name: Build and push - uses: docker/build-push-action@v5 + uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5 with: context: . push: ${{ github.event_name == 'push' }} @@ -328,7 +329,7 @@ jobs: path: dist/ - name: Create Release - uses: softprops/action-gh-release@v1 + uses: softprops/action-gh-release@de2c0eb89ae2a093876385947365aca7b0e5f844 # v1 with: generate_release_notes: true files: dist/* diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 174fe7c..1da86b5 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -3,7 +3,8 @@ # Scans for security vulnerabilities and coding errors # https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/about-code-scanning -permissions: read-all +permissions: + contents: read name: "CodeQL Security Analysis" @@ -119,26 +120,26 @@ jobs: - name: Setup Python if: matrix.language == 'python' - uses: actions/setup-python@v5 + uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5 with: python-version: '3.12' - name: Setup Go if: matrix.language == 'go' - uses: actions/setup-go@v5 + uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5 with: go-version: '1.22' - name: Setup Java if: matrix.language == 'java-kotlin' - uses: actions/setup-java@v4 + uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4 with: distribution: 'temurin' java-version: '21' - name: Setup .NET if: matrix.language == 'csharp' - uses: actions/setup-dotnet@v4 + uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4 with: dotnet-version: '8.0.x' diff --git a/.github/workflows/guix-nix-policy.yml b/.github/workflows/guix-nix-policy.yml index 6e9da49..f056c41 100644 --- a/.github/workflows/guix-nix-policy.yml +++ b/.github/workflows/guix-nix-policy.yml @@ -1,5 +1,6 @@ # SPDX-License-Identifier: PMPL-1.0-or-later -permissions: read-all +permissions: + contents: read name: Guix/Nix Package Policy on: [push, pull_request] diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml index f2bf132..1250a56 100644 --- a/.github/workflows/hypatia-scan.yml +++ b/.github/workflows/hypatia-scan.yml @@ -11,7 +11,8 @@ on: - cron: '0 0 * * 0' # Weekly on Sunday workflow_dispatch: -permissions: read-all +permissions: + contents: read jobs: scan: diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml index 4c0d553..408093b 100644 --- a/.github/workflows/mirror.yml +++ b/.github/workflows/mirror.yml @@ -7,7 +7,8 @@ on: branches: [main] workflow_dispatch: -permissions: read-all +permissions: + contents: read jobs: mirror-gitlab: diff --git a/.github/workflows/npm-bun-blocker.yml b/.github/workflows/npm-bun-blocker.yml index 2d2783b..c6b6726 100644 --- a/.github/workflows/npm-bun-blocker.yml +++ b/.github/workflows/npm-bun-blocker.yml @@ -2,7 +2,8 @@ name: NPM/Bun Blocker on: [push, pull_request] -permissions: read-all +permissions: + contents: read jobs: check: diff --git a/.github/workflows/quality.yml b/.github/workflows/quality.yml index 0346986..52bc057 100644 --- a/.github/workflows/quality.yml +++ b/.github/workflows/quality.yml @@ -1,5 +1,6 @@ # SPDX-License-Identifier: PMPL-1.0-or-later -permissions: read-all +permissions: + contents: read name: Code Quality on: [push, pull_request] diff --git a/.github/workflows/rsr-antipattern.yml b/.github/workflows/rsr-antipattern.yml index 4ef3142..21bb240 100644 --- a/.github/workflows/rsr-antipattern.yml +++ b/.github/workflows/rsr-antipattern.yml @@ -5,7 +5,8 @@ # Enforces: No TypeScript, No Go, No Python (except SaltStack), No npm # Allows: ReScript, Deno, WASM, Rust, OCaml, Haskell, Guile/Scheme -permissions: read-all +permissions: + contents: read name: RSR Anti-Pattern Check diff --git a/.github/workflows/scorecard-enforcer.yml b/.github/workflows/scorecard-enforcer.yml index 58b1f09..26322c9 100644 --- a/.github/workflows/scorecard-enforcer.yml +++ b/.github/workflows/scorecard-enforcer.yml @@ -9,7 +9,8 @@ on: - cron: '0 6 * * 1' # Weekly on Monday workflow_dispatch: -permissions: read-all +permissions: + contents: read jobs: scorecard: diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index b93c9c1..ffda2b6 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -6,7 +6,8 @@ on: schedule: - cron: '0 4 * * 0' -permissions: read-all +permissions: + contents: read jobs: analysis: diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index 051fecf..fd62c4f 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -7,7 +7,8 @@ on: push: branches: [main] -permissions: read-all +permissions: + contents: read jobs: trufflehog: diff --git a/.github/workflows/security-policy.yml b/.github/workflows/security-policy.yml index fa8c0c6..5022643 100644 --- a/.github/workflows/security-policy.yml +++ b/.github/workflows/security-policy.yml @@ -1,5 +1,6 @@ # SPDX-License-Identifier: PMPL-1.0-or-later -permissions: read-all +permissions: + contents: read name: Security Policy on: [push, pull_request] diff --git a/.github/workflows/ts-blocker.yml b/.github/workflows/ts-blocker.yml index 5c34a58..6a09ba2 100644 --- a/.github/workflows/ts-blocker.yml +++ b/.github/workflows/ts-blocker.yml @@ -2,7 +2,8 @@ name: TypeScript/JavaScript Blocker on: [push, pull_request] -permissions: read-all +permissions: + contents: read jobs: check: diff --git a/.github/workflows/wellknown-enforcement.yml b/.github/workflows/wellknown-enforcement.yml index 6e81044..65ec890 100644 --- a/.github/workflows/wellknown-enforcement.yml +++ b/.github/workflows/wellknown-enforcement.yml @@ -1,5 +1,6 @@ # SPDX-License-Identifier: PMPL-1.0-or-later -permissions: read-all +permissions: + contents: read name: Well-Known Standards (RFC 9116 + RSR) on: diff --git a/.github/workflows/workflow-linter.yml b/.github/workflows/workflow-linter.yml index 94dd0b2..e97d211 100644 --- a/.github/workflows/workflow-linter.yml +++ b/.github/workflows/workflow-linter.yml @@ -10,7 +10,8 @@ on: paths: - '.github/workflows/**' -permissions: read-all +permissions: + contents: read jobs: lint-workflows: diff --git a/.machine_readable/contractiles/dust/Dustfile.a2ml b/.machine_readable/contractiles/dust/Dustfile.a2ml new file mode 100644 index 0000000..d7dfc19 --- /dev/null +++ b/.machine_readable/contractiles/dust/Dustfile.a2ml @@ -0,0 +1,22 @@ +# SPDX-License-Identifier: PMPL-1.0-or-later +# Dustfile — Cleanup and Hygiene Contract + +[dustfile] +version = "1.0.0" +format = "a2ml" + +[cleanup] +stale-branch-policy = "delete-after-merge" +artifact-retention = "90-days" +cache-policy = "clear-on-release" + +[hygiene] +linting = "required" +formatting = "required" +dead-code-removal = "encouraged" +todo-tracking = "tracked-in-issues" + +[reversibility] +backup-before-destructive = true +rollback-mechanism = "git-revert" +data-retention-policy = "preserve-30-days" diff --git a/.machine_readable/integrations/feedback-o-tron.a2ml b/.machine_readable/integrations/feedback-o-tron.a2ml new file mode 100644 index 0000000..1c473ae --- /dev/null +++ b/.machine_readable/integrations/feedback-o-tron.a2ml @@ -0,0 +1,13 @@ +# SPDX-License-Identifier: PMPL-1.0-or-later +# Feedback-o-Tron Integration — Autonomous Bug Reporting + +[integration] +name = "feedback-o-tron" +type = "bug-reporter" +repository = "https://github.com/hyperpolymath/feedback-o-tron" + +[reporting-config] +platforms = ["github", "gitlab", "bugzilla"] +deduplication = true +audit-logging = true +auto-file-upstream = "on-external-dependency-failure" diff --git a/.machine_readable/integrations/proven.a2ml b/.machine_readable/integrations/proven.a2ml new file mode 100644 index 0000000..6b3e805 --- /dev/null +++ b/.machine_readable/integrations/proven.a2ml @@ -0,0 +1,18 @@ +# SPDX-License-Identifier: PMPL-1.0-or-later +# Proven Integration — Formally Verified Safety Library + +[integration] +name = "proven" +type = "safety-library" +repository = "https://github.com/hyperpolymath/proven" +version = "1.2.0" + +[binding-policy] +approach = "thin-ffi-wrapper" +unsafe-patterns = "replace-with-proven-equivalent" +modules-available = ["SafeMath", "SafeString", "SafeJSON", "SafeURL", "SafeRegex", "SafeSQL", "SafeFile", "SafeTemplate", "SafeCrypto"] + +[adoption-guidance] +priority = "high" +scope = "all-string-json-url-crypto-operations" +migration = "incremental — replace unsafe patterns as encountered" diff --git a/.machine_readable/integrations/verisimdb.a2ml b/.machine_readable/integrations/verisimdb.a2ml new file mode 100644 index 0000000..2c8f8f5 --- /dev/null +++ b/.machine_readable/integrations/verisimdb.a2ml @@ -0,0 +1,15 @@ +# SPDX-License-Identifier: PMPL-1.0-or-later +# VeriSimDB Feed — Cross-Repo Analytics Data Store + +[integration] +name = "verisimdb" +type = "data-feed" +repository = "https://github.com/hyperpolymath/nextgen-databases" +data-store = "verisimdb-data" + +[feed-config] +emit-scan-results = true +emit-build-metrics = true +emit-dependency-graph = true +format = "hexad" +destination = "verisimdb-data/feeds/" diff --git a/.machine_readable/integrations/vexometer.a2ml b/.machine_readable/integrations/vexometer.a2ml new file mode 100644 index 0000000..bb7fc43 --- /dev/null +++ b/.machine_readable/integrations/vexometer.a2ml @@ -0,0 +1,18 @@ +# SPDX-License-Identifier: PMPL-1.0-or-later +# Vexometer Integration — Irritation Surface Analysis + +[integration] +name = "vexometer" +type = "friction-measurement" +repository = "https://github.com/hyperpolymath/vexometer" + +[measurement-config] +dimensions = 10 +emit-isa-reports = true +lazy-eliminator = true +satellite-interventions = true + +[hooks] +cli-tools = "measure-on-error" +ui-panels = "measure-on-interaction" +build-failures = "measure-on-failure" diff --git a/README.md b/README.md deleted file mode 100644 index 9d341b3..0000000 --- a/README.md +++ /dev/null @@ -1,251 +0,0 @@ -# Universal Project Manager - -[![CI](https://github.com/hyperpolymath/Universal-Project-Manager/actions/workflows/ci.yml/badge.svg)](https://github.com/hyperpolymath/Universal-Project-Manager/actions/workflows/ci.yml) -[![CodeQL](https://github.com/hyperpolymath/Universal-Project-Manager/actions/workflows/codeql.yml/badge.svg)](https://github.com/hyperpolymath/Universal-Project-Manager/actions/workflows/codeql.yml) -image:https://img.shields.io/badge/License-PMPL--1.0-blue.svg[License: PMPL-1.0,link="https://github.com/hyperpolymath/palimpsest-license"] - -A comprehensive, language-agnostic CI/CD framework that automatically detects project configurations and provides unified scripts for building, testing, and deploying across multiple platforms. - -## Features - -- **Auto-Detection**: Automatically detects programming languages, package managers, test frameworks, and build systems -- **Multi-Language Support**: JavaScript/TypeScript, Python, Ruby, Go, Rust, Java/Kotlin, C/C++, C#, PHP, and more -- **Platform Agnostic**: Works with GitHub Actions and GitLab CI out of the box -- **Mirror Sync**: Event-driven repository mirroring between platforms -- **Unified Scripts**: Single set of scripts that work across all CI platforms - -## Quick Start - -### 1. Copy CI Scripts - -Copy the `ci-scripts/` directory to your project: - -```bash -cp -r ci-scripts/ /path/to/your/project/ -chmod +x /path/to/your/project/ci-scripts/*.sh -``` - -### 2. Run Detection - -```bash -./ci-scripts/detect.sh -``` - -Output: -``` -[INFO] Detecting project configuration in: /your/project -[SUCCESS] Detection complete! - -Languages detected: javascript,typescript -Primary language: javascript -Package managers: npm -Test frameworks: jest -Build systems: npm-scripts,webpack -``` - -### 3. Setup Dependencies - -```bash -./ci-scripts/setup.sh -``` - -### 4. Run Tests - -```bash -./ci-scripts/test.sh --coverage -``` - -### 5. Lint Code - -```bash -./ci-scripts/lint.sh -# Or with auto-fix: -./ci-scripts/lint.sh --fix -``` - -### 6. Build - -```bash -./ci-scripts/build.sh --release -``` - -## CI Scripts Reference - -| Script | Description | Options | -|--------|-------------|---------| -| `detect.sh` | Detects project configuration | `json` - Output as JSON | -| `setup.sh` | Installs project dependencies | - | -| `test.sh` | Runs test suites | `--coverage`, `--verbose`, `--ci` | -| `lint.sh` | Runs code linters | `--fix`, `--verbose` | -| `build.sh` | Builds the project | `--release`, `--debug` | -| `sync-mirror.sh` | Syncs to mirror repository | `--mirror-url`, `--dry-run` | -| `verify-mirror.sh` | Verifies mirror sync | `--source`, `--mirror` | - -## Supported Languages - -| Language | Package Manager | Test Framework | Linter | -|----------|----------------|----------------|--------| -| JavaScript/TypeScript | npm, yarn, pnpm, bun | Jest, Mocha, Vitest, AVA | ESLint, Prettier | -| Python | pip, pipenv, poetry | pytest, unittest, tox | Ruff, Flake8, Black, mypy | -| Ruby | Bundler | RSpec, Minitest | RuboCop | -| Go | Go Modules | go test | golangci-lint, go vet | -| Rust | Cargo | cargo test | clippy, rustfmt | -| Java/Kotlin | Maven, Gradle | JUnit | Checkstyle, SpotBugs | -| C/C++ | CMake, Make | - | clang-format | -| C#/.NET | NuGet | xUnit, NUnit | dotnet format | -| PHP | Composer | PHPUnit | PHP-CS-Fixer, PHPStan | - -## CI/CD Integration - -### GitHub Actions - -The included `.github/workflows/ci.yml` provides: - -- Automatic language detection -- Matrix testing across OS and language versions -- Dependency caching -- Code coverage reporting -- Build artifact uploads -- Docker image builds -- Automatic releases on tags -- Event-driven mirror sync - -### GitLab CI - -The included `.gitlab-ci.yml` provides: - -- Language-specific job templates -- Parallel test execution -- Coverage reporting -- Container Registry integration -- GitLab Pages deployment -- Release automation - -## Repository Mirroring - -### Setup (GitHub to GitLab) - -1. Generate an SSH key: - ```bash - ssh-keygen -t ed25519 -C "github-to-gitlab-mirror" -f gitlab_mirror_key - ``` - -2. Add the public key to GitLab as a deploy key with write access - -3. Add secrets to GitHub: - - `GITLAB_SSH_PRIVATE_KEY`: Contents of `gitlab_mirror_key` - - `GITLAB_MIRROR_URL`: `git@gitlab.com:your/repo.git` - -4. Push to main/master to trigger sync - -See [SECRETS.md](SECRETS.md) for detailed instructions. - -## Project Structure - -``` -. -├── ci-scripts/ -│ ├── detect.sh # Project detection -│ ├── setup.sh # Dependency setup -│ ├── test.sh # Test runner -│ ├── lint.sh # Linter runner -│ ├── build.sh # Build script -│ ├── sync-mirror.sh # Mirror sync -│ └── verify-mirror.sh # Mirror verification -├── tests/ -│ ├── test_detect.bats # BATS tests -│ └── run_tests.sh # Test runner -├── .github/ -│ ├── workflows/ -│ │ ├── ci.yml # Main CI workflow -│ │ └── codeql.yml # Security scanning -│ └── dependabot.yml # Dependency updates -├── .gitlab-ci.yml # GitLab CI config -├── TODO.md # Project TODO list -├── SECRETS.md # Secrets documentation -├── ROADMAP.adoc # Project roadmap -└── README.md # This file -``` - -## Configuration - -### Environment Variables - -| Variable | Description | Default | -|----------|-------------|---------| -| `PROJECT_ROOT` | Project root directory | Script's parent dir | -| `CI` | CI environment flag | `false` | -| `COVERAGE` | Enable coverage reporting | `false` | -| `VERBOSE` | Enable verbose output | `false` | -| `FIX` | Auto-fix lint issues | `false` | -| `BUILD_MODE` | Build mode (`release`/`debug`) | `release` | - -### Future: Configuration File - -Support for a `upm.yml` configuration file is planned: - -```yaml -version: 1 - -project: - name: my-project - type: nodejs # Override auto-detection - -ci: - test: - coverage: true - parallel: true - lint: - fix: false -``` - -## Security - -- **CodeQL**: Automated security scanning -- **Dependabot**: Automated dependency updates -- **SAST**: Static Application Security Testing - -See [SECURITY.md](SECURITY.md) for security policy. - -## Contributing - -Contributions are welcome! Please read [CODE_OF_CONDUCT.md](CODE_OF_CONDUCT.md) first. - -1. Fork the repository -2. Create a feature branch -3. Make your changes -4. Run tests: `./tests/run_tests.sh` -5. Submit a pull request - -## Roadmap - -See [ROADMAP.adoc](ROADMAP.adoc) for the full roadmap. - -### MVP v1.0 Goals - -- [x] Auto-detection for 10+ languages -- [x] GitHub Actions workflow -- [x] GitLab CI configuration -- [x] Mirror sync support -- [ ] Configuration file support -- [ ] CLI wrapper tool - -## License - -This project is licensed under the MIT License - see [LICENSE](LICENSE) for details. - -## Acknowledgments - -- Inspired by the need for unified CI/CD across multiple platforms -- Thanks to all contributors and users - ---- - -**Note**: This project is mirrored between: -- GitHub: https://github.com/hyperpolymath/Universal-Project-Manager -- GitLab: https://gitlab.com/overarch-underpin/managers/universal-project-manager - - -## Architecture - -See [TOPOLOGY.md](TOPOLOGY.md) for a visual architecture map and completion dashboard. diff --git a/justfile b/justfile index f1f0971..2cb3760 100644 --- a/justfile +++ b/justfile @@ -32,3 +32,7 @@ lint: build-riscv: @echo "Building for RISC-V..." cross build --target riscv64gc-unknown-linux-gnu + +# Run panic-attacker pre-commit scan +assail: + @command -v panic-attack >/dev/null 2>&1 && panic-attack assail . || echo "panic-attack not found — install from https://github.com/hyperpolymath/panic-attacker" diff --git a/tests/fuzz/placeholder.txt b/tests/fuzz/placeholder.txt new file mode 100644 index 0000000..8621280 --- /dev/null +++ b/tests/fuzz/placeholder.txt @@ -0,0 +1 @@ +Scorecard requirement placeholder