Merge pull request #11 from malbeclabs/chore/open-source-readiness

chore: prepare repo for open source (governance + CI controls)

Author: ben-dz

.github/CODEOWNERS

@@ -0,0 +1,3 @@
+# Default owners for everything in the repo. Listed owners are requested for
+# review on every PR (enforced once branch protection requires CODEOWNERS review).
+* @juan-malbeclabs @ben-dz

.github/actionlint.yaml

@@ -0,0 +1,4 @@
+# actionlint config. The workflows here only run on the default GitHub-hosted
+# ubuntu-latest runner, so no self-hosted runner labels need declaring.
+self-hosted-runner:
+  labels: []

.github/dependabot.yml

@@ -0,0 +1,30 @@
+# Dependabot keeps Cargo crates and the SHA-pinned GitHub Actions up to date.
+# Mirrors the grouping style of malbeclabs/doublezero, trimmed to this single Rust
+# crate (no Go/Solana ecosystems here).
+version: 2
+updates:
+  # Rust crates. Grouped so routine minor/patch bumps land in one PR, with the async
+  # and serialization stacks split out (they tend to move together and need attention).
+  - package-ecosystem: cargo
+    directory: "/"
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 10
+    groups:
+      rust-minor-patch:
+        update-types: [minor, patch]
+      tokio:
+        patterns: ["tokio*", "tokio-*", "futures-*"]
+      serde:
+        patterns: ["serde", "serde_*"]
+
+  # GitHub Actions are pinned to commit SHAs (see .github/workflows/*). Dependabot
+  # bumps the SHA and the trailing version comment when a new release ships.
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 10
+    groups:
+      actions-minor-patch:
+        update-types: [minor, patch]

.github/pull_request_template.md

@@ -0,0 +1,12 @@
+## Summary of changes
+
+<!-- What changed and why. Link any related issue or design doc. -->
+
+- **What:**
+- **Why:**
+- **Protocol impact:** <!-- Any change to the WebSocket JSON in PROTOCOL.md? If so, how is forward-compat preserved? -->
+- **CHANGELOG.md update needed?** <!-- yes/no — if no, apply the `skip-changelog` label -->
+
+## Testing
+
+<!-- Evidence the change works: cargo test output, a manual run, a hexdump comparison, etc. -->

.github/workflows/actionlint.yml

@@ -0,0 +1,26 @@
+name: actionlint
+
+# Lints the GitHub Actions workflow YAML itself (syntax, expression typos, shellcheck
+# of inline run: scripts). Runs only when a workflow file or its config changes.
+on:
+  push:
+    branches: [main]
+    paths:
+      - ".github/workflows/**"
+      - ".github/actionlint.yaml"
+  pull_request:
+    paths:
+      - ".github/workflows/**"
+      - ".github/actionlint.yaml"
+
+permissions:
+  contents: read
+
+jobs:
+  actionlint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: rhysd/actionlint@914e7df21a07ef503a81201c76d2b11c789d3fca # v1.7.12
+        with:
+          fail-on-error: true

.github/workflows/changelog-reminder.yml

@@ -0,0 +1,47 @@
+name: changelog-reminder
+
+# Nudges contributors to keep CHANGELOG.md current. Fails a PR that changes code but
+# leaves the changelog untouched, unless it carries the `skip-changelog` label.
+# Ported from malbeclabs/doublezero (.github/workflows/changelog-reminder.yml).
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, labeled, unlabeled]
+
+permissions:
+  contents: read
+
+jobs:
+  changelog:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          fetch-depth: 0
+
+      - name: Require CHANGELOG.md update (or skip-changelog label)
+        shell: bash
+        env:
+          LABELS: ${{ toJSON(github.event.pull_request.labels.*.name) }}
+        run: |
+          set -euo pipefail
+          if echo "$LABELS" | grep -q '"skip-changelog"'; then
+            echo "skip-changelog label present — skipping changelog check."
+            exit 0
+          fi
+
+          base="${GITHUB_BASE_REF:-}"
+          if [ -z "$base" ]; then
+            base="$(git remote show origin | sed -n 's/.*HEAD branch: //p')"
+          fi
+          git fetch --quiet origin "$base"
+
+          changed="$(git diff --name-only "origin/${base}...HEAD")"
+          echo "Changed files:"; echo "$changed"
+
+          if echo "$changed" | grep -qx 'CHANGELOG.md'; then
+            echo "CHANGELOG.md updated. ✓"
+            exit 0
+          fi
+
+          echo "::error::CHANGELOG.md was not updated. Add an entry, or apply the 'skip-changelog' label if this change does not warrant one."
+          exit 1

.github/workflows/release.docker.edge-connect.build.yml

@@ -29,11 +29,16 @@ on:
         default: ""
         type: string
 
+# Reusable workflow: it runs under the caller job's permissions (publish/smoke/rebuild
+# set contents:read + packages:read/write). This default applies only to direct runs.
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
           ref: ${{ inputs.ref }}
 
@@ -74,13 +79,13 @@ jobs:
             echo "latest=$latest"
           } >> "$GITHUB_OUTPUT"
 
-      - uses: docker/login-action@v3
+      - uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
-      - uses: docker/setup-buildx-action@v3
+      - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
 
       # Resolve the base to an immutable digest: reproducible builds + the digest
       # we record in the image label for the poll to compare against.
@@ -124,7 +129,7 @@ jobs:
           } >> "$GITHUB_OUTPUT"
           echo "Tags:"; printf '%s\n' "$tags"
 
-      - uses: docker/build-push-action@v6
+      - uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
         with:
           context: .
           push: ${{ inputs.push }}

.github/workflows/release.docker.edge-connect.poll.yml

@@ -9,6 +9,10 @@ on:
     - cron: "23 5 * * *" # daily 05:23 UTC
   workflow_dispatch: {}
 
+# Least-privilege default; the check/rebuild jobs set their own per-job permissions.
+permissions:
+  contents: read
+
 jobs:
   # Inspect all three bases; emit a JSON array of the variants whose base digest
   # no longer matches the digest baked into the published image.
@@ -20,13 +24,13 @@ jobs:
     outputs:
       stale: ${{ steps.scan.outputs.stale }}
     steps:
-      - uses: docker/login-action@v3
+      - uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
-      - uses: docker/setup-buildx-action@v3
+      - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
 
       - id: scan
         shell: bash

.github/workflows/release.docker.edge-connect.yml

@@ -19,6 +19,10 @@ on:
       - .github/workflows/release.docker.edge-connect.poll.yml
   workflow_dispatch: {}
 
+# Least-privilege default; the publish/smoke jobs widen this per job as needed.
+permissions:
+  contents: read
+
 jobs:
   # Resolve the release version once: the vX.Y.Z tag with leading v stripped, or
   # empty for non-tag builds (which then publish moving tags only).

.github/workflows/release.install-script.yml

@@ -25,17 +25,22 @@ permissions:
 
 env:
   AWS_REGION: us-east-1
-  DEPLOY_ROLE: arn:aws:iam::879381273509:role/github-doublezero-install-deploy
   BUCKET: doublezero-install
-  DISTRIBUTION_ID: E393SM6O109RQ3
+  # Account-scoped infra (deploy-role ARN incl. the AWS account ID, and the CloudFront
+  # distribution id) lives in repo Actions Variables so it is not baked into a public
+  # workflow. Set both under Settings -> Secrets and variables -> Actions -> Variables:
+  #   DEPLOY_ROLE     = arn:aws:iam::<account-id>:role/github-doublezero-install-deploy
+  #   DISTRIBUTION_ID = <cloudfront-distribution-id>
+  DEPLOY_ROLE: ${{ vars.DEPLOY_ROLE }}
+  DISTRIBUTION_ID: ${{ vars.DISTRIBUTION_ID }}
 
 jobs:
   publish:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
-      - uses: aws-actions/configure-aws-credentials@v4
+      - uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4
         with:
           role-to-assume: ${{ env.DEPLOY_ROLE }}
           aws-region: ${{ env.AWS_REGION }}