From 3863e63f2caecca5d0c7e4da7c083486b84ae0b3 Mon Sep 17 00:00:00 2001 From: Kellen Murphy Date: Sat, 16 May 2026 14:38:26 -0400 Subject: [PATCH 1/3] Add CI, Codecov, and OpenSSF Best Practices badges to README and footer --- README.md | 2 ++ src/routes/+layout.svelte | 16 ++++++++++++++-- 2 files changed, 16 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index f2987e1..78775e1 100644 --- a/README.md +++ b/README.md @@ -1,5 +1,7 @@ # samlguy +[![CI](https://github.com/kellenmurphy/samlguy/actions/workflows/ci.yml/badge.svg?branch=main)](https://github.com/kellenmurphy/samlguy/actions/workflows/ci.yml) [![codecov](https://codecov.io/gh/kellenmurphy/samlguy/graph/badge.svg)](https://codecov.io/gh/kellenmurphy/samlguy) [![OpenSSF Best Practices](https://www.bestpractices.dev/projects/12859/badge)](https://www.bestpractices.dev/projects/12859) + **SAML assertion and JWT decoder for the IAM community.** Visit [samlguy.com](https://samlguy.com) — paste whatever messy thing you grabbed from a log file, a network tab, or a browser plugin and the tool figures out what it is and (attempts to) decode it. diff --git a/src/routes/+layout.svelte b/src/routes/+layout.svelte index 17b07c9..d3fc41d 100644 --- a/src/routes/+layout.svelte +++ b/src/routes/+layout.svelte @@ -143,17 +143,29 @@ /> Code coverage + + OpenSSF Best Practices + From c95e485a33e921ab05c7d9e1c7f17451eb4dbe57 Mon Sep 17 00:00:00 2001 From: Kellen Murphy Date: Sat, 16 May 2026 14:52:57 -0400 Subject: [PATCH 2/3] Revamp footer and update SECURITY.md MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Footer: replace badges with plain text links — Privacy · Security · Made with ♥ by The SAML Guy · Source · MIT License. Badges moved to README.md only (CI, Codecov, OpenSSF Best Practices). SECURITY.md: add codeql.yml action pins, branch protection subsection, and versioning/release process section. --- SECURITY.md | 23 ++++++++++ src/routes/+layout.svelte | 92 +++++++++++---------------------------- 2 files changed, 48 insertions(+), 67 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index ec82078..db853fe 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -70,6 +70,11 @@ Current pins in `.github/workflows/scorecard.yml`: - `actions/upload-artifact` — SHA-pinned (v7.0.1) - `github/codeql-action/upload-sarif` — SHA-pinned +Current pins in `.github/workflows/codeql.yml`: +- `actions/checkout` — SHA-pinned +- `github/codeql-action/init` — SHA-pinned (v3.28.13) +- `github/codeql-action/analyze` — SHA-pinned (v3.28.13) + Dependabot is configured to open weekly PRs when new versions of these actions are released, keeping SHA rotation low-friction. ### Minimal token permissions @@ -110,6 +115,16 @@ A CodeQL workflow runs on every push and pull request to `main`, and weekly on M A [Scorecard](https://securityscorecards.dev) workflow runs weekly and on every push to `main`. It evaluates supply-chain security practices (pinned dependencies, branch protection, token permissions, code review, vulnerability disclosure) and publishes results to the GitHub code scanning dashboard. Results are also published publicly to the OSSF scorecard index. +### Branch protection + +The `main` branch is protected with the following rules enforced for all contributors including administrators: + +- **Required status checks** — the `Build & Test` CI job must pass before any merge is allowed; the branch must be up to date with `main` before merging (strict mode) +- **Required signatures** — every commit merged to `main` must carry a verified cryptographic signature +- **Required pull request review** — at least one approval is required; stale approvals are dismissed on new pushes; code owner review is required +- **No force pushes** — force-pushing to `main` is blocked +- **No branch deletion** — `main` cannot be deleted + ### CODEOWNERS `.github/CODEOWNERS` requires `@kellenmurphy` to approve any pull request that touches any file. This ensures no code is merged without review if collaborators are added in the future. @@ -124,6 +139,14 @@ Property-based fuzz tests (`src/lib/fuzz.test.ts`) run against every parser on e --- +## Versioning and releases + +This project follows [Semantic Versioning](https://semver.org/) (`MAJOR.MINOR.PATCH`). Each release is tagged in the repository with a `v`-prefixed version tag (e.g. `v1.0.0`). Tags are signed with the same SSH key used for commit signing. + +Since samlguy.com deploys continuously from `main`, the production deployment always reflects the latest tagged release or the commits immediately following it. Security fixes are released as patch versions and deployed immediately on merge to `main`. + +--- + ## License This project is released under the [MIT License](LICENSE). You are free to use, fork, modify, and distribute the code. The only requirement is that the copyright notice is preserved in copies or substantial portions of the software. diff --git a/src/routes/+layout.svelte b/src/routes/+layout.svelte index d3fc41d..f16e70a 100644 --- a/src/routes/+layout.svelte +++ b/src/routes/+layout.svelte @@ -97,76 +97,34 @@ From 74ff54f10c1328b81630a285dada4b0767a14555 Mon Sep 17 00:00:00 2001 From: Kellen Murphy Date: Sat, 16 May 2026 14:55:36 -0400 Subject: [PATCH 3/3] feat: add release-please for automated changelog and GitHub releases Adds release-please-action (v4, SHA-pinned) to generate a release PR on every merge to main. The PR accumulates a CHANGELOG.md from Conventional Commits and bumps package.json version; merging it creates a signed GitHub Release automatically. Also syncs package.json version to 1.0.0 to match the existing v1.0.0 tag, and documents the new workflow pin in SECURITY.md. --- .github/workflows/release-please.yml | 22 ++++++++++++++++++++++ .release-please-manifest.json | 3 +++ SECURITY.md | 3 +++ package.json | 2 +- release-please-config.json | 19 +++++++++++++++++++ 5 files changed, 48 insertions(+), 1 deletion(-) create mode 100644 .github/workflows/release-please.yml create mode 100644 .release-please-manifest.json create mode 100644 release-please-config.json diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml new file mode 100644 index 0000000..ec755d9 --- /dev/null +++ b/.github/workflows/release-please.yml @@ -0,0 +1,22 @@ +name: Release Please + +on: + push: + branches: [main] + +permissions: + contents: write + pull-requests: write + +jobs: + release-please: + name: Release Please + runs-on: ubuntu-24.04 + steps: + - name: Release Please + # googleapis/release-please-action v4 + uses: googleapis/release-please-action@5c625bfb5d1ff62eadeeb3772007f7f66fdcf071 + with: + token: ${{ secrets.GITHUB_TOKEN }} + config-file: release-please-config.json + manifest-file: .release-please-manifest.json diff --git a/.release-please-manifest.json b/.release-please-manifest.json new file mode 100644 index 0000000..1772e6f --- /dev/null +++ b/.release-please-manifest.json @@ -0,0 +1,3 @@ +{ + ".": "1.0.0" +} diff --git a/SECURITY.md b/SECURITY.md index db853fe..70bb473 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -70,6 +70,9 @@ Current pins in `.github/workflows/scorecard.yml`: - `actions/upload-artifact` — SHA-pinned (v7.0.1) - `github/codeql-action/upload-sarif` — SHA-pinned +Current pins in `.github/workflows/release-please.yml`: +- `googleapis/release-please-action` — SHA-pinned (v4) + Current pins in `.github/workflows/codeql.yml`: - `actions/checkout` — SHA-pinned - `github/codeql-action/init` — SHA-pinned (v3.28.13) diff --git a/package.json b/package.json index 190db7b..6c4fd3c 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "samlguy", - "version": "0.0.1", + "version": "1.0.0", "private": true, "type": "module", "scripts": { diff --git a/release-please-config.json b/release-please-config.json new file mode 100644 index 0000000..715a26c --- /dev/null +++ b/release-please-config.json @@ -0,0 +1,19 @@ +{ + "$schema": "https://raw.githubusercontent.com/googleapis/release-please/main/schemas/config.json", + "release-type": "node", + "packages": { + ".": { + "package-name": "samlguy", + "changelog-sections": [ + { "type": "feat", "section": "Features" }, + { "type": "fix", "section": "Bug Fixes" }, + { "type": "perf", "section": "Performance" }, + { "type": "security", "section": "Security" }, + { "type": "deps", "section": "Dependencies" }, + { "type": "docs", "section": "Documentation", "hidden": false }, + { "type": "chore", "section": "Miscellaneous", "hidden": true }, + { "type": "ci", "section": "CI/CD", "hidden": true } + ] + } + } +}