diff --git a/.github/workflows/boj-build.yml b/.github/workflows/boj-build.yml index c4f641d..4fe6b9a 100644 --- a/.github/workflows/boj-build.yml +++ b/.github/workflows/boj-build.yml @@ -17,4 +17,5 @@ jobs: curl -X POST "http://boj-server.local:7700/cartridges/ssg-mcp/invoke" -H "Content-Type: application/json" -d "{\"repo\": \"${{ github.repository }}\", \"branch\": \"${{ github.ref_name }}\", \"engine\": \"casket\\"}"} continue-on-error: true permissions: + actions: read contents: read diff --git a/.github/workflows/casket-pages.yml b/.github/workflows/casket-pages.yml index a849da3..ae916dc 100644 --- a/.github/workflows/casket-pages.yml +++ b/.github/workflows/casket-pages.yml @@ -7,6 +7,7 @@ on: workflow_dispatch: permissions: + actions: read contents: read pages: write id-token: write diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 7e233f9..883c63c 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -18,6 +18,7 @@ concurrency: cancel-in-progress: true permissions: + actions: read contents: read jobs: @@ -39,12 +40,12 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Initialize CodeQL - uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v3 + uses: github/codeql-action/init@29b1f65c1f735799893313399435a59f54045865 # v3 with: languages: ${{ matrix.language }} build-mode: ${{ matrix.build-mode }} - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v3 + uses: github/codeql-action/analyze@29b1f65c1f735799893313399435a59f54045865 # v3 with: category: "/language:${{ matrix.language }}" diff --git a/.github/workflows/dogfood-gate.yml b/.github/workflows/dogfood-gate.yml index 83cc24e..5d491b7 100644 --- a/.github/workflows/dogfood-gate.yml +++ b/.github/workflows/dogfood-gate.yml @@ -13,6 +13,7 @@ on: branches: [main, master] permissions: + actions: read contents: read jobs: diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index 8776de0..aad0d03 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -9,8 +9,9 @@ on: workflow_dispatch: permissions: + actions: read contents: read jobs: governance: - uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@81dbf2dd854b1444fd6236fa2352474383b2c2b9 \ No newline at end of file + uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@7fdc2705df74b4e352d2a1cde3e87a5923fdf329 \ No newline at end of file diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml index 9dde27a..1f8c940 100644 --- a/.github/workflows/hypatia-scan.yml +++ b/.github/workflows/hypatia-scan.yml @@ -11,9 +11,10 @@ on: workflow_dispatch: permissions: + actions: read contents: read security-events: write jobs: scan: - uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@81dbf2dd854b1444fd6236fa2352474383b2c2b9 \ No newline at end of file + uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@7fdc2705df74b4e352d2a1cde3e87a5923fdf329 \ No newline at end of file diff --git a/.github/workflows/instant-sync.yml b/.github/workflows/instant-sync.yml index 32e9e3e..61aa9f6 100644 --- a/.github/workflows/instant-sync.yml +++ b/.github/workflows/instant-sync.yml @@ -9,6 +9,7 @@ on: types: [published] permissions: + actions: read contents: read jobs: diff --git a/.github/workflows/main-estate-audit.yml b/.github/workflows/main-estate-audit.yml new file mode 100755 index 0000000..f4da03c --- /dev/null +++ b/.github/workflows/main-estate-audit.yml @@ -0,0 +1,94 @@ +# SPDX-License-Identifier: MPL-2.0 +name: Central Estate CI/CD Audit + +on: +permissions: + contents: read + push: + branches: [ "main" ] + pull_request: + branches: [ "main" ] + +jobs: + estate-audit: + runs-on: ubuntu-latest + steps: + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 + + - name: Required Files Gate + uses: hyperpolymath/cicd-suite/actions/required-files-check@main + + - name: Code Hygiene Gate + uses: hyperpolymath/cicd-suite/actions/code-hygiene-check@main + + - name: Manifest Validation Gate + uses: hyperpolymath/cicd-suite/actions/manifest-check@main + + - name: Idris2 ABI Purity Gate + uses: hyperpolymath/cicd-suite/actions/idris2-abi-check@main + + - name: Zig Hexadeca API Gate + uses: hyperpolymath/cicd-suite/actions/zig-hexadeca-check@main + + - name: Contractile Validation Gate + uses: hyperpolymath/cicd-suite/actions/contractile-validation-check@main + + - name: Recipes Set Validation Gate + uses: hyperpolymath/cicd-suite/actions/recipes-set-check@main + + - name: Affirmation Document Gate + uses: hyperpolymath/cicd-suite/actions/affirmation-check@main + + - name: Academic Referencing Gate + uses: hyperpolymath/cicd-suite/actions/referencing-check@main + + - name: Semantic Audit Gate + uses: hyperpolymath/cicd-suite/actions/semantic-audit-check@main + + - name: SPDX License Gate + uses: hyperpolymath/cicd-suite/actions/spdx-license-check@main + + - name: Proof Runner Gate + uses: hyperpolymath/cicd-suite/actions/proof-runner-check@main + + - name: PRAT Testing Gate + uses: hyperpolymath/cicd-suite/actions/prat-check@main + + - name: Panic Attack & Pons Gate + uses: hyperpolymath/cicd-suite/actions/custom-tools-check@main + + - name: WWW & Well-Known Compliance Gate + uses: hyperpolymath/cicd-suite/actions/www-compliance-check@main + + - name: BoJ Cartridge Validation Gate + uses: hyperpolymath/cicd-suite/actions/boj-cartridge-check@main + + - name: Formatting Validation Gate + uses: hyperpolymath/cicd-suite/actions/formatting-check@main + + - name: Accreditations & Badges Gate + uses: hyperpolymath/cicd-suite/actions/badges-check@main + + - name: Metrics Extraction Gate + uses: hyperpolymath/cicd-suite/actions/metrics-check@main + + - name: Linguist & Banned Languages Gate + uses: hyperpolymath/cicd-suite/actions/linguist-check@main + + - name: Test & Benchmarks Dashboard Gate + uses: hyperpolymath/cicd-suite/actions/tests-benches-check@main + + - name: Hosting & Site Status Gate + uses: hyperpolymath/cicd-suite/actions/hosting-check@main + + - name: Git-Sea Analytics Gate + uses: hyperpolymath/cicd-suite/actions/gitsea-check@main + + - name: Trust & Humans Validation Gate + uses: hyperpolymath/cicd-suite/actions/trust-humans-check@main + + - name: Are We UnAPI Gate (Secret Scanning) + uses: hyperpolymath/cicd-suite/actions/secrets-check@main + + - name: Reasonably Good Token Validation Gate + uses: hyperpolymath/cicd-suite/actions/vaulted-tokens-check@main diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml index 81e9903..72824fb 100644 --- a/.github/workflows/mirror.yml +++ b/.github/workflows/mirror.yml @@ -7,9 +7,10 @@ on: workflow_dispatch: permissions: + actions: read contents: read jobs: mirror: - uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@d135b05bfc647d0c0fbfedc7e80f37ea50f49236 + uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@7fdc2705df74b4e352d2a1cde3e87a5923fdf329 secrets: inherit diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml index a1a1aa3..31f3ddc 100644 --- a/.github/workflows/pages.yml +++ b/.github/workflows/pages.yml @@ -5,6 +5,7 @@ on: branches: [main, master] workflow_dispatch: permissions: + actions: read contents: read pages: write id-token: write diff --git a/.github/workflows/push-email-notify.yml b/.github/workflows/push-email-notify.yml index 2a95f5d..c08ea16 100644 --- a/.github/workflows/push-email-notify.yml +++ b/.github/workflows/push-email-notify.yml @@ -7,6 +7,7 @@ name: Push email notification on: push: {} permissions: + actions: read contents: read jobs: notify: diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index b97e2cb..03413b9 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -9,11 +9,12 @@ on: workflow_dispatch: permissions: + actions: read contents: read jobs: scorecard: - uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@81dbf2dd854b1444fd6236fa2352474383b2c2b9 + uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@7fdc2705df74b4e352d2a1cde3e87a5923fdf329 permissions: contents: read security-events: write diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index b3486fc..0c35e6b 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -11,11 +11,12 @@ concurrency: cancel-in-progress: true permissions: + actions: read contents: read jobs: scan: permissions: contents: read - uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@c65436ee3351cd6b0fa14b142938b195efc77586 + uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@7fdc2705df74b4e352d2a1cde3e87a5923fdf329 secrets: inherit \ No newline at end of file diff --git a/.github/workflows/workflow-linter.yml b/.github/workflows/workflow-linter.yml index 67b6a82..9ad08b3 100644 --- a/.github/workflows/workflow-linter.yml +++ b/.github/workflows/workflow-linter.yml @@ -11,6 +11,7 @@ on: - '.github/workflows/**' permissions: read-all + actions: read jobs: lint-workflows: diff --git a/.machine_readable/self-validating/examples/ci-config.k9.ncl b/.machine_readable/self-validating/examples/ci-config.k9.ncl index 9fe314e..35b2d85 100644 --- a/.machine_readable/self-validating/examples/ci-config.k9.ncl +++ b/.machine_readable/self-validating/examples/ci-config.k9.ncl @@ -6,6 +6,8 @@ K9! { pedigree = { + name = "ci-config.k9.ncl", + security = { leash = 'Yard }, schema_version = "1.0.0", component_type = "ci-configuration", security = { @@ -16,7 +18,7 @@ K9! allow_subprocess = false, }, metadata = { - name = "ci-config", + version = "1.0.0", description = "CI/CD configuration with runtime validation", author = "Jonathan D.A. Jewell ", @@ -48,21 +50,21 @@ K9! # Workflow steps with validation steps = [ { - name = "Checkout", + action = "actions/checkout@v4", # Version must be SHA-pinned for security sha | String | std.string.NonEmpty = "b4ffde65f46336ab88eb53be808477a3936bae11", }, { - name = "Build", + run = "just build", }, { - name = "Test", + run = "just test", }, { - name = "Lint", + run = "just lint", }, ], @@ -87,15 +89,15 @@ K9! scanners = [ { - name = "CodeQL", + languages = ["rust", "javascript"], }, { - name = "OSSF Scorecard", + enabled = true, }, { - name = "TruffleHog", + scan_for = "secrets", }, ], diff --git a/.machine_readable/self-validating/examples/project-metadata.k9.ncl b/.machine_readable/self-validating/examples/project-metadata.k9.ncl index b2299b4..7e2c8d0 100644 --- a/.machine_readable/self-validating/examples/project-metadata.k9.ncl +++ b/.machine_readable/self-validating/examples/project-metadata.k9.ncl @@ -6,6 +6,8 @@ K9! { pedigree = { + name = "project-metadata.k9.ncl", + security = { leash = 'Yard }, schema_version = "1.0.0", component_type = "project-metadata", security = { @@ -16,7 +18,7 @@ K9! allow_subprocess = false, }, metadata = { - name = "project-metadata", + version = "1.0.0", description = "Pure data configuration for project metadata", author = "Jonathan D.A. Jewell ", @@ -25,7 +27,7 @@ K9! # Project configuration project = { - name = "my-project", + version = "0.1.0", description = "A project following Rhodium Standard Repositories", @@ -35,7 +37,7 @@ K9! }, author = { - name = "Jonathan D.A. Jewell", + email = "j.d.a.jewell@open.ac.uk", organization = "The Open University", }, diff --git a/.machine_readable/self-validating/examples/setup-repo.k9.ncl b/.machine_readable/self-validating/examples/setup-repo.k9.ncl index b635d5b..8225260 100644 --- a/.machine_readable/self-validating/examples/setup-repo.k9.ncl +++ b/.machine_readable/self-validating/examples/setup-repo.k9.ncl @@ -6,6 +6,8 @@ K9! { pedigree = { + name = "setup-repo.k9.ncl", + security = { leash = 'Yard }, schema_version = "1.0.0", component_type = "repository-setup", security = { @@ -17,7 +19,7 @@ K9! signature_required = true, }, metadata = { - name = "setup-repo", + version = "1.0.0", description = "Automated repository setup with RSR standards", author = "Jonathan D.A. Jewell ", diff --git a/.machine_readable/self-validating/template-hunt.k9.ncl b/.machine_readable/self-validating/template-hunt.k9.ncl index b3fcb47..d623df5 100644 --- a/.machine_readable/self-validating/template-hunt.k9.ncl +++ b/.machine_readable/self-validating/template-hunt.k9.ncl @@ -6,6 +6,8 @@ K9! { pedigree = { + name = "template-hunt.k9.ncl", + security = { leash = 'Yard }, schema_version = "1.0.0", component_type = "TODO: describe component type (e.g., 'deployment', 'setup-script')", security = { @@ -17,7 +19,7 @@ K9! signature_required = true, }, metadata = { - name = "TODO: component-name", + version = "1.0.0", description = "TODO: Detailed description of what this component does", author = "Jonathan D.A. Jewell ", diff --git a/.machine_readable/self-validating/template-kennel.k9.ncl b/.machine_readable/self-validating/template-kennel.k9.ncl index 4228b26..4a1ac9d 100644 --- a/.machine_readable/self-validating/template-kennel.k9.ncl +++ b/.machine_readable/self-validating/template-kennel.k9.ncl @@ -6,6 +6,8 @@ K9! { pedigree = { + name = "template-kennel.k9.ncl", + security = { leash = 'Yard }, schema_version = "1.0.0", component_type = "TODO: describe component type (e.g., 'build-config', 'metadata')", security = { @@ -16,7 +18,7 @@ K9! allow_subprocess = false, }, metadata = { - name = "TODO: component-name", + version = "1.0.0", description = "TODO: Brief description of what this component contains", author = "Jonathan D.A. Jewell ", diff --git a/.machine_readable/self-validating/template-yard.k9.ncl b/.machine_readable/self-validating/template-yard.k9.ncl index a723f5a..0f03269 100644 --- a/.machine_readable/self-validating/template-yard.k9.ncl +++ b/.machine_readable/self-validating/template-yard.k9.ncl @@ -6,6 +6,8 @@ K9! { pedigree = { + name = "template-yard.k9.ncl", + security = { leash = 'Yard }, schema_version = "1.0.0", component_type = "TODO: describe component type (e.g., 'validated-config', 'schema')", security = { @@ -16,7 +18,7 @@ K9! allow_subprocess = false, }, metadata = { - name = "TODO: component-name", + version = "1.0.0", description = "TODO: Brief description with validation details", author = "Jonathan D.A. Jewell ", diff --git a/GOVERNANCE.adoc b/GOVERNANCE.adoc deleted file mode 100644 index 2647537..0000000 --- a/GOVERNANCE.adoc +++ /dev/null @@ -1,295 +0,0 @@ -// SPDX-License-Identifier: CC-BY-SA-4.0 -// Copyright (c) Jonathan D.A. Jewell -= Governance -:toc: -:toc-placement!: -:sectnums: - -toc::[] - -== Overview - -polysafe-gitfixer is governed by principles of transparency, consensus-seeking, -and graduated trust. This document describes how decisions are made and how -contributors can participate in project governance. - -== Core Principles - -=== Consensus-Seeking - -We prefer consensus over voting. Decisions should emerge from discussion -where possible, with voting reserved for deadlocks. - -=== Graduated Trust - -The Tri-Perimeter Contribution Framework (TPCF) provides graduated access -based on demonstrated expertise and commitment. - -=== Reversibility - -Decisions should be reversible when practical. We prefer experiments over -permanent commitments. - -=== Transparency - -All governance discussions happen in public, with decisions documented -in issues or merge requests. - -=== Merit-Based - -Advancement is based on contributions and demonstrated judgment, not -tenure alone. - -== Tri-Perimeter Framework - -See link:CONTRIBUTING.adoc[CONTRIBUTING] for detailed framework description. - -[cols="1,2,3"] -|=== -|Perimeter |Access Level |Scope - -|3 - Community -|Open to all -|Documentation, bug reports, features, examples - -|2 - Expert -|Trusted contributors -|Code review, extensions, mentoring - -|1 - Core -|Maintainers only -|Security, CI/CD, releases, architecture -|=== - -== Decision-Making - -=== Decision Categories - -==== Routine Decisions - -* Typo fixes, documentation improvements -* Clear bug fixes with tests -* Approved by any maintainer - -==== Minor Decisions - -* Feature additions within existing architecture -* Dependency updates (non-breaking) -* Requires review from one core maintainer - -==== Major Decisions - -* New components or languages -* Breaking changes to public APIs -* Significant architectural changes -* Requires discussion period (1 week) and approval from 2+ maintainers - -==== Critical Decisions - -* Security-critical changes -* License modifications -* Governance changes -* Requires supermajority (2/3) of active maintainers - -=== Voting Process - -When consensus cannot be reached: - -1. Discussion period of at least 72 hours -2. Clear proposal documented in an issue -3. Voting period of 1 week -4. Each active maintainer gets one vote -5. Results documented publicly - -== Project Roles - -=== Community Contributor - -* Anyone who participates in discussions or reports bugs -* No special permissions required - -=== Regular Contributor - -* Has submitted multiple accepted contributions -* Demonstrates understanding of project goals -* May be invited to review PRs - -=== Trusted Contributor (Perimeter 2) - -* Requirements: -** 3+ months active participation, OR -** 10+ merged contributions, OR -** Demonstrated domain expertise -* Responsibilities: -** Review and approve merge requests -** Mentor new contributors -** Help with issue triage - -=== Core Maintainer (Perimeter 1) - -* Requirements: -** Sustained high-quality contributions -** Demonstrated good judgment -** Nominated by existing maintainer, approved by consensus -* Responsibilities: -** Merge to protected branches -** Release management -** Security response -** Final say on architectural decisions -* Listed in MAINTAINERS.md - -== Security Governance - -=== Security Team - -Core maintainers form the security response team. - -=== Response Process - -1. Vulnerability reported via SECURITY.md channels -2. Acknowledged within SLA timeframe -3. Assessed and assigned severity -4. Fix developed in private -5. Coordinated disclosure - -=== Emergency Authority - -In critical security situations, any core maintainer may: - -* Revert commits -* Disable features -* Push emergency patches - -Such actions must be documented immediately and reviewed by the team -within 24 hours. - -== Release Management - -=== Versioning - -We follow Semantic Versioning (SemVer): - -* MAJOR: Breaking changes -* MINOR: New features, backward compatible -* PATCH: Bug fixes, backward compatible - -=== Release Process - -1. Feature freeze announced -2. Release candidate prepared -3. Testing period (1 week for major, 3 days for minor) -4. Release notes drafted -5. Tag created and release published -6. Announcement posted - -=== Release Schedule - -* Patch releases: As needed -* Minor releases: Quarterly -* Major releases: When necessary, with migration guides - -== Conflict Resolution - -=== Technical Disagreements - -1. Discussion in relevant issue/MR -2. Seek input from domain experts -3. If unresolved, escalate to core maintainers -4. If still unresolved, vote - -=== Code of Conduct Violations - -See link:CODE_OF_CONDUCT.adoc[CODE OF CONDUCT] for enforcement procedures. - -=== Maintainer Disputes - -1. Private discussion between involved parties -2. Mediation by uninvolved maintainer -3. If unresolved, vote by all other maintainers - -== Succession Planning - -=== Bus Factor Mitigation - -* No single maintainer should have exclusive knowledge -* Critical systems documented in docs/ -* Multiple maintainers for each component - -=== Maintainer Transitions - -When a maintainer steps down: - -1. Knowledge transfer period (if possible) -2. Update MAINTAINERS.md -3. Credential rotation -4. Public acknowledgment - -=== Project Archival - -If the project becomes unmaintained: - -1. Clear announcement with 90-day notice -2. Fork recommendations documented -3. Archive repository (read-only) -4. Preserve issue history - -== Amendment Process - -=== Minor Amendments - -* Clarifications, typo fixes -* Single maintainer approval - -=== Major Amendments - -* Structural changes to governance -* Process: -1. Proposal issue created -2. 2-week discussion period -3. 2/3 supermajority vote required -4. 1-week implementation period - -== Financial Governance - -=== Transparency - -If the project receives funding: - -* All income and expenses documented -* Quarterly reports published -* OpenCollective or similar transparent platform preferred - -=== Spending Authority - -* Under $100: Any maintainer -* $100-$500: Two maintainer approval -* Over $500: Majority maintainer approval - -=== Budget Priorities - -1. Infrastructure and hosting -2. Security audits -3. Contributor compensation -4. Community events -5. Upstream support - -== Platform Governance - -=== Primary Platform - -GitLab (gitlab.com/Hyperpolymath/polysafe-gitfixer) - -=== Mirrors - -GitHub mirror maintained for discoverability. - -=== Credentials - -* Access credentials documented securely -* Rotation on maintainer departure -* 2FA required for all maintainers - -== Contact - -For governance questions, open an issue or contact maintainers listed -in MAINTAINERS.md. diff --git a/guix.scm b/guix.scm index 5ec5f30..c6dd7be 100644 --- a/guix.scm +++ b/guix.scm @@ -1,5 +1,5 @@ ; SPDX-License-Identifier: MPL-2.0 -;; guix.scm — GNU Guix package definition for polysafe-gitfixer +;; guix.scm — GNU Guix package definition for squisher-corpus ;; Usage: guix shell -f guix.scm (use-modules (guix packages) @@ -7,12 +7,12 @@ (guix licenses)) (package - (name "polysafe-gitfixer") + (name "squisher-corpus") (version "0.1.0") (source #f) (build-system gnu-build-system) - (synopsis "polysafe-gitfixer") - (description "polysafe-gitfixer — part of the hyperpolymath ecosystem.") - (home-page "https://github.com/hyperpolymath/polysafe-gitfixer") - (license ((@@ (guix licenses) license) "MPL-2.0" + (synopsis "squisher-corpus") + (description "squisher-corpus — part of the hyperpolymath ecosystem.") + (home-page "https://github.com/hyperpolymath/squisher-corpus") + (license ((@@ (guix licenses) license) "PMPL-1.0-or-later" "https://github.com/hyperpolymath/palimpsest-license")))