diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml new file mode 100644 index 0000000..ec755d9 --- /dev/null +++ b/.github/workflows/release-please.yml @@ -0,0 +1,22 @@ +name: Release Please + +on: + push: + branches: [main] + +permissions: + contents: write + pull-requests: write + +jobs: + release-please: + name: Release Please + runs-on: ubuntu-24.04 + steps: + - name: Release Please + # googleapis/release-please-action v4 + uses: googleapis/release-please-action@5c625bfb5d1ff62eadeeb3772007f7f66fdcf071 + with: + token: ${{ secrets.GITHUB_TOKEN }} + config-file: release-please-config.json + manifest-file: .release-please-manifest.json diff --git a/.release-please-manifest.json b/.release-please-manifest.json new file mode 100644 index 0000000..1772e6f --- /dev/null +++ b/.release-please-manifest.json @@ -0,0 +1,3 @@ +{ + ".": "1.0.0" +} diff --git a/README.md b/README.md index f2987e1..78775e1 100644 --- a/README.md +++ b/README.md @@ -1,5 +1,7 @@ # samlguy +[![CI](https://github.com/kellenmurphy/samlguy/actions/workflows/ci.yml/badge.svg?branch=main)](https://github.com/kellenmurphy/samlguy/actions/workflows/ci.yml) [![codecov](https://codecov.io/gh/kellenmurphy/samlguy/graph/badge.svg)](https://codecov.io/gh/kellenmurphy/samlguy) [![OpenSSF Best Practices](https://www.bestpractices.dev/projects/12859/badge)](https://www.bestpractices.dev/projects/12859) + **SAML assertion and JWT decoder for the IAM community.** Visit [samlguy.com](https://samlguy.com) — paste whatever messy thing you grabbed from a log file, a network tab, or a browser plugin and the tool figures out what it is and (attempts to) decode it. diff --git a/SECURITY.md b/SECURITY.md index ec82078..70bb473 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -70,6 +70,14 @@ Current pins in `.github/workflows/scorecard.yml`: - `actions/upload-artifact` — SHA-pinned (v7.0.1) - `github/codeql-action/upload-sarif` — SHA-pinned +Current pins in `.github/workflows/release-please.yml`: +- `googleapis/release-please-action` — SHA-pinned (v4) + +Current pins in `.github/workflows/codeql.yml`: +- `actions/checkout` — SHA-pinned +- `github/codeql-action/init` — SHA-pinned (v3.28.13) +- `github/codeql-action/analyze` — SHA-pinned (v3.28.13) + Dependabot is configured to open weekly PRs when new versions of these actions are released, keeping SHA rotation low-friction. ### Minimal token permissions @@ -110,6 +118,16 @@ A CodeQL workflow runs on every push and pull request to `main`, and weekly on M A [Scorecard](https://securityscorecards.dev) workflow runs weekly and on every push to `main`. It evaluates supply-chain security practices (pinned dependencies, branch protection, token permissions, code review, vulnerability disclosure) and publishes results to the GitHub code scanning dashboard. Results are also published publicly to the OSSF scorecard index. +### Branch protection + +The `main` branch is protected with the following rules enforced for all contributors including administrators: + +- **Required status checks** — the `Build & Test` CI job must pass before any merge is allowed; the branch must be up to date with `main` before merging (strict mode) +- **Required signatures** — every commit merged to `main` must carry a verified cryptographic signature +- **Required pull request review** — at least one approval is required; stale approvals are dismissed on new pushes; code owner review is required +- **No force pushes** — force-pushing to `main` is blocked +- **No branch deletion** — `main` cannot be deleted + ### CODEOWNERS `.github/CODEOWNERS` requires `@kellenmurphy` to approve any pull request that touches any file. This ensures no code is merged without review if collaborators are added in the future. @@ -124,6 +142,14 @@ Property-based fuzz tests (`src/lib/fuzz.test.ts`) run against every parser on e --- +## Versioning and releases + +This project follows [Semantic Versioning](https://semver.org/) (`MAJOR.MINOR.PATCH`). Each release is tagged in the repository with a `v`-prefixed version tag (e.g. `v1.0.0`). Tags are signed with the same SSH key used for commit signing. + +Since samlguy.com deploys continuously from `main`, the production deployment always reflects the latest tagged release or the commits immediately following it. Security fixes are released as patch versions and deployed immediately on merge to `main`. + +--- + ## License This project is released under the [MIT License](LICENSE). You are free to use, fork, modify, and distribute the code. The only requirement is that the copyright notice is preserved in copies or substantial portions of the software. diff --git a/package.json b/package.json index 190db7b..6c4fd3c 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "samlguy", - "version": "0.0.1", + "version": "1.0.0", "private": true, "type": "module", "scripts": { diff --git a/release-please-config.json b/release-please-config.json new file mode 100644 index 0000000..715a26c --- /dev/null +++ b/release-please-config.json @@ -0,0 +1,19 @@ +{ + "$schema": "https://raw.githubusercontent.com/googleapis/release-please/main/schemas/config.json", + "release-type": "node", + "packages": { + ".": { + "package-name": "samlguy", + "changelog-sections": [ + { "type": "feat", "section": "Features" }, + { "type": "fix", "section": "Bug Fixes" }, + { "type": "perf", "section": "Performance" }, + { "type": "security", "section": "Security" }, + { "type": "deps", "section": "Dependencies" }, + { "type": "docs", "section": "Documentation", "hidden": false }, + { "type": "chore", "section": "Miscellaneous", "hidden": true }, + { "type": "ci", "section": "CI/CD", "hidden": true } + ] + } + } +} diff --git a/src/routes/+layout.svelte b/src/routes/+layout.svelte index 17b07c9..f16e70a 100644 --- a/src/routes/+layout.svelte +++ b/src/routes/+layout.svelte @@ -97,64 +97,34 @@