Skip to content

Commit 862a602

Browse files
vib-toolsvib-tools
committed
feat(project): apply comprehensive forensic audit and production hardening
Implement repository-wide improvements including documentation updates, CI/CD enhancements, GitHub community files, security policies, validation improvements, release workflow, dependency management, compatibility updates, VPMS manifest refinements, TypeScript configuration improvements, source packaging enhancements, and production readiness fixes.
1 parent 01766d1 commit 862a602

44 files changed

Lines changed: 1660 additions & 692 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.gitattributes‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
* text=auto eol=lf
2+
3+
*.ico binary
4+
*.jpg binary
5+
*.jpeg binary
6+
*.pdf binary
7+
*.png binary
8+
*.webp binary
9+
10+
*.json diff=json
11+
*.ygit diff=json

‎.github/CODEOWNERS‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
# Default code owner for the YGit Schema repository.
2+
* @vib-tools
3+
4+
# Schema, validation, release, and CI changes require maintainer review.
5+
/v1/ @vib-tools
6+
/scripts/ @vib-tools
7+
/test/ @vib-tools
8+
/.github/ @vib-tools

‎.github/ISSUE_TEMPLATE/bug_report.yml‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
name: Bug report
2+
description: Report a reproducible schema, validator, documentation, or registry defect.
3+
title: '[Bug]: '
4+
body:
5+
- type: markdown
6+
attributes:
7+
value: Thank you for helping improve YGit Schema. Do not include secrets or private manifests.
8+
- type: dropdown
9+
id: area
10+
attributes:
11+
label: Affected area
12+
options:
13+
- VPMS schema
14+
- Python validator
15+
- Examples or fixtures
16+
- Registry website
17+
- Documentation
18+
- CI/CD or release tooling
19+
validations:
20+
required: true
21+
- type: textarea
22+
id: description
23+
attributes:
24+
label: Description
25+
description: Explain the observed behavior and why it is incorrect.
26+
validations:
27+
required: true
28+
- type: textarea
29+
id: reproduction
30+
attributes:
31+
label: Reproduction steps
32+
placeholder: |
33+
1. Run ...
34+
2. Open ...
35+
3. Observe ...
36+
validations:
37+
required: true
38+
- type: textarea
39+
id: expected
40+
attributes:
41+
label: Expected behavior
42+
validations:
43+
required: true
44+
- type: input
45+
id: version
46+
attributes:
47+
label: Version or commit
48+
placeholder: 1.0.0 or commit SHA
49+
validations:
50+
required: true
51+
- type: textarea
52+
id: environment
53+
attributes:
54+
label: Environment
55+
description: Operating system, Python version, Node.js version, and browser where relevant.
56+
- type: checkboxes
57+
id: checks
58+
attributes:
59+
label: Pre-submission checks
60+
options:
61+
- label: I searched existing issues for duplicates.
62+
required: true
63+
- label: I removed secrets and private data from the report.
64+
required: true

‎.github/ISSUE_TEMPLATE/config.yml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
blank_issues_enabled: false
2+
contact_links:
3+
- name: Security vulnerability
4+
url: https://github.com/vibtools/ygit-schema/security/advisories/new
5+
about: Report security vulnerabilities privately through GitHub Security Advisories.
6+
- name: Usage support
7+
url: https://github.com/vibtools/ygit-schema/discussions
8+
about: Ask usage and integration questions without opening a defect report.

‎.github/ISSUE_TEMPLATE/feature_request.yml‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
name: Scoped improvement request
2+
description: Propose an improvement that remains within the frozen YGit Schema roadmap and architecture.
3+
title: '[Enhancement]: '
4+
body:
5+
- type: markdown
6+
attributes:
7+
value: Requests must preserve the documented scope, architecture, schema compatibility, and technology choices.
8+
- type: dropdown
9+
id: area
10+
attributes:
11+
label: Affected area
12+
options:
13+
- VPMS schema
14+
- Validation tooling
15+
- Documentation
16+
- Registry website
17+
- CI/CD or release tooling
18+
validations:
19+
required: true
20+
- type: textarea
21+
id: problem
22+
attributes:
23+
label: Problem statement
24+
description: Describe the in-scope problem without prescribing an architectural redesign.
25+
validations:
26+
required: true
27+
- type: textarea
28+
id: outcome
29+
attributes:
30+
label: Required outcome
31+
description: State the observable result and compatibility requirements.
32+
validations:
33+
required: true
34+
- type: textarea
35+
id: references
36+
attributes:
37+
label: Specification references
38+
description: Cite the relevant project, schema, roadmap, or documentation files.
39+
validations:
40+
required: true
41+
- type: checkboxes
42+
id: checks
43+
attributes:
44+
label: Scope confirmation
45+
options:
46+
- label: This request does not redesign the architecture or replace the selected technology stack.
47+
required: true
48+
- label: This request preserves existing features and backward compatibility.
49+
required: true

‎.github/dependabot.yml‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
version: 2
2+
updates:
3+
- package-ecosystem: npm
4+
directory: /
5+
schedule:
6+
interval: weekly
7+
day: monday
8+
time: '06:00'
9+
timezone: Etc/UTC
10+
open-pull-requests-limit: 5
11+
labels:
12+
- dependencies
13+
commit-message:
14+
prefix: chore(deps)
15+
- package-ecosystem: pip
16+
directory: /
17+
schedule:
18+
interval: weekly
19+
day: monday
20+
time: '06:15'
21+
timezone: Etc/UTC
22+
open-pull-requests-limit: 5
23+
labels:
24+
- dependencies
25+
commit-message:
26+
prefix: chore(deps)
27+
- package-ecosystem: github-actions
28+
directory: /
29+
schedule:
30+
interval: weekly
31+
day: monday
32+
time: '06:30'
33+
timezone: Etc/UTC
34+
open-pull-requests-limit: 5
35+
labels:
36+
- dependencies
37+
commit-message:
38+
prefix: chore(actions)

‎.github/pull_request_template.md‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
## Summary
2+
3+
Describe the exact change and its approved scope.
4+
5+
## Verification
6+
7+
- [ ] `python scripts/audit.py`
8+
- [ ] `python scripts/validate.py --all`
9+
- [ ] `python -m unittest discover -s test -p "test_*.py"`
10+
- [ ] `npm run format:check`
11+
- [ ] `npm run check`
12+
- [ ] `npm run build`
13+
14+
## Consistency
15+
16+
- [ ] Architecture and existing behavior are preserved.
17+
- [ ] Schema, examples, fixtures, and documentation remain synchronized.
18+
- [ ] `CHANGELOG.md` is updated when user-visible behavior changes.
19+
- [ ] No secrets, generated caches, or local artifacts are included.

‎.github/workflows/deploy.yml‎

Lines changed: 13 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -8,22 +8,31 @@ on:
88
permissions:
99
contents: read
1010

11+
concurrency:
12+
group: cloudflare-readiness-${{ github.ref }}
13+
cancel-in-progress: true
14+
1115
jobs:
1216
readiness:
1317
name: Production build readiness
1418
runs-on: ubuntu-latest
19+
timeout-minutes: 20
1520
steps:
1621
- name: Checkout
17-
uses: actions/checkout@v4
22+
uses: actions/checkout@v6
1823
- name: Set up Node.js
19-
uses: actions/setup-node@v4
24+
uses: actions/setup-node@v6
2025
with:
21-
node-version: '24'
26+
node-version-file: .nvmrc
2227
- name: Install dependencies
2328
run: npm install --no-audit --no-fund
2429
- name: Build production output
2530
run: npm run build
2631
- name: Verify required output
27-
run: test -f dist/index.html && test -f dist/pagefind/pagefind.js
32+
shell: bash
33+
run: |
34+
test -f dist/index.html
35+
test -f dist/pagefind/pagefind.js
36+
test -f dist/vpms/v1/vibproject.schema.json
2837
2938
# Production deployment is intentionally performed by Cloudflare Pages Git integration.

‎.github/workflows/release.yml‎

Lines changed: 81 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,81 @@
1+
name: Release
2+
3+
on:
4+
push:
5+
tags:
6+
- 'v*.*.*'
7+
workflow_dispatch:
8+
inputs:
9+
version:
10+
description: Semantic version without the v prefix
11+
required: true
12+
type: string
13+
14+
permissions:
15+
contents: write
16+
17+
concurrency:
18+
group: release-${{ github.ref }}
19+
cancel-in-progress: false
20+
21+
jobs:
22+
release:
23+
name: Verify and publish release
24+
runs-on: ubuntu-latest
25+
timeout-minutes: 30
26+
steps:
27+
- name: Checkout
28+
uses: actions/checkout@v6
29+
with:
30+
fetch-depth: 0
31+
- name: Set up Python
32+
uses: actions/setup-python@v6
33+
with:
34+
python-version: '3.13'
35+
cache: pip
36+
- name: Set up Node.js
37+
uses: actions/setup-node@v6
38+
with:
39+
node-version-file: .nvmrc
40+
- name: Install Python dependencies
41+
run: python -m pip install --disable-pip-version-check --upgrade pip -r requirements.txt
42+
- name: Install frontend dependencies
43+
run: npm install --no-audit --no-fund
44+
- name: Resolve release version
45+
id: version
46+
shell: bash
47+
env:
48+
INPUT_VERSION: ${{ inputs.version }}
49+
run: |
50+
if [[ "${GITHUB_REF_TYPE}" == "tag" ]]; then
51+
VERSION="${GITHUB_REF_NAME#v}"
52+
else
53+
VERSION="${INPUT_VERSION}"
54+
fi
55+
if [[ ! "${VERSION}" =~ ^[0-9]+\.[0-9]+\.[0-9]+([+-][0-9A-Za-z.-]+)?$ ]]; then
56+
echo "Invalid semantic version: ${VERSION}" >&2
57+
exit 2
58+
fi
59+
echo "version=${VERSION}" >> "${GITHUB_OUTPUT}"
60+
- name: Build verified release package
61+
run: python scripts/release.py --version "${{ steps.version.outputs.version }}"
62+
- name: Upload release package
63+
uses: actions/upload-artifact@v7
64+
with:
65+
name: ygit-schema-${{ steps.version.outputs.version }}
66+
path: |
67+
release/ygit-schema-${{ steps.version.outputs.version }}.zip
68+
release/ygit-schema-${{ steps.version.outputs.version }}.zip.sha256
69+
if-no-files-found: error
70+
retention-days: 90
71+
- name: Publish GitHub release
72+
if: github.ref_type == 'tag'
73+
env:
74+
GH_TOKEN: ${{ github.token }}
75+
run: |
76+
gh release create "${GITHUB_REF_NAME}" \
77+
"release/ygit-schema-${{ steps.version.outputs.version }}.zip" \
78+
"release/ygit-schema-${{ steps.version.outputs.version }}.zip.sha256" \
79+
--verify-tag \
80+
--generate-notes \
81+
--title "YGit Schema ${{ steps.version.outputs.version }}"

‎.github/workflows/validate.yml‎

Lines changed: 14 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -17,31 +17,37 @@ jobs:
1717
schema:
1818
name: Schema and Python
1919
runs-on: ubuntu-latest
20+
timeout-minutes: 15
2021
steps:
2122
- name: Checkout
22-
uses: actions/checkout@v4
23+
uses: actions/checkout@v6
2324
- name: Set up Python
24-
uses: actions/setup-python@v5
25+
uses: actions/setup-python@v6
2526
with:
2627
python-version: '3.13'
2728
cache: pip
2829
- name: Install validator dependencies
29-
run: python -m pip install --upgrade pip -r requirements.txt
30+
run: python -m pip install --disable-pip-version-check --upgrade pip -r requirements.txt
31+
- name: Run repository audit
32+
run: python scripts/audit.py
3033
- name: Validate examples and fixtures
3134
run: python scripts/validate.py --all
3235
- name: Run regression tests
3336
run: python -m unittest discover -s test -p 'test_*.py'
37+
- name: Compile Python sources
38+
run: python -m compileall -q scripts test
3439

3540
frontend:
3641
name: Frontend quality
3742
runs-on: ubuntu-latest
43+
timeout-minutes: 20
3844
steps:
3945
- name: Checkout
40-
uses: actions/checkout@v4
46+
uses: actions/checkout@v6
4147
- name: Set up Node.js
42-
uses: actions/setup-node@v4
48+
uses: actions/setup-node@v6
4349
with:
44-
node-version: '24'
50+
node-version-file: .nvmrc
4551
- name: Install dependencies
4652
run: npm install --no-audit --no-fund
4753
- name: Check formatting
@@ -51,8 +57,9 @@ jobs:
5157
- name: Build registry and search index
5258
run: npm run build
5359
- name: Upload static build
54-
uses: actions/upload-artifact@v4
60+
uses: actions/upload-artifact@v7
5561
with:
5662
name: schema-registry-dist
5763
path: dist
5864
if-no-files-found: error
65+
retention-days: 14

0 commit comments

Comments
 (0)