mirror of
https://github.com/Studio-Saelix/sencho.git
synced 2026-07-26 20:00:08 +00:00
Anso
5e29649f3e
* chore(repo): enforce Conventional Commits via husky and commitlint release-please parses commit subjects on main to compute the next version and regenerate CHANGELOG.md. A non-conforming commit silently breaks both, so the format must be enforced at commit time, not by review. Adds husky 9 to wire a commit-msg hook, commitlint with the conventional config, and a small rule override (loosen subject length to 120 chars, disable subject-case so existing imperative subjects keep passing). The prepare script runs husky on npm install so contributors do not need to configure it manually. * ci: add dependency-review workflow GitHub-native action that diffs the PR's manifests (package.json, package-lock.json) against main and fails when a new transitive dep introduces a high or critical CVE. Existing vulnerabilities tracked in security/vex/sencho.openvex.json and the Trivy scan in ci.yml are not re-flagged here. Pinned to actions/dependency-review-action v4.9.0 by commit SHA. Comment summaries are posted to the PR only on failure to keep the conversation clean on green PRs. * ci: add stale workflow for issues and pull requests Marks issues and PRs as stale after 60 days of inactivity and closes 14 days later unless re-engaged. Issues labeled pinned, security, bug, or tracking are exempt and never auto-closed; PRs labeled pinned or security are exempt. Runs daily at 01:30 UTC and processes up to 30 items per run to stay within the action's rate budget. Pinned to actions/stale v10.2.0 by commit SHA. * chore(repo): route new issues to docs, discussions, and security policy Disables the blank-issue option and adds three contact links the issue chooser surfaces above the bug-report and feature-request templates: docs.sencho.io for setup questions, GitHub Discussions for open-ended chat, and the repository security policy for private vulnerability reports. This keeps the bug tracker focused on actionable bug reports and feature requests instead of support questions. * ci(docker): publish multi-arch image to GHCR alongside Docker Hub Mirrors every released sencho and sencho-mesh image to ghcr.io with the same tags, signing, and supply-chain attestations as the Docker Hub copy. Same content; pull from whichever registry your environment prefers. - Adds packages:write to both publish jobs so the auto-provisioned GITHUB_TOKEN can push to ghcr.io/studio-saelix/sencho and -mesh. - Adds a second docker/login-action step authenticating to ghcr.io. The Docker Hub login still resolves credentials from the production env. - docker/metadata-action now lists both image references; one buildx push attaches the manifest to both registries in a single round trip. - Cosign keyless signing already loops over $TAGS, so adding the GHCR reference is enough to sign both digests. - The cosign attest step now loops over both registry paths so SBOM (CDX + SPDX) and OpenVEX attestations are resolvable from either registry. Quickstart and image-verification docs note GHCR as an alternative pull source with identical content. * fix(mesh-sidecar): pin base image by digest The main Sencho Dockerfile pins every base image by sha256 digest so a republish of an upstream tag cannot silently shift content into a release. The mesh-sidecar Dockerfile pinned node:22-alpine by tag, which is exactly the gap that pinning closes. Resolves node:22-alpine to its current multi-arch index digest (covers linux/amd64 and linux/arm64) and threads it through both build stages via a single ARG so a future digest roll only edits one line. The inline comment documents the resolution command. The sidecar holds an outbound websocket and has no inbound HTTP listener, so adding a HEALTHCHECK is intentionally out of scope: a process-liveness probe would be tautological with Docker's restart policy. The Dockerfile now records that decision so it does not get reopened on every audit. * ci(docker): use repository_owner for GHCR login username github.actor varies by event source (the maintainer who merged the release PR on tag pushes, github-actions[bot] on bot-driven runs, the dispatcher on workflow_dispatch). The username field is metadata only; GITHUB_TOKEN is what authenticates against GHCR. github.repository_owner resolves to a fixed value (studio-saelix) on every event and matches GitHub's own example workflows for GHCR push. * chore(repo): tighten commit subject-case rule Disabling subject-case entirely allowed accidental ALL-CAPS or PascalCase subjects through. Restrict to "never upper-case or pascal-case" instead, which preserves the lowercase / kebab-case norm of this repo and lets sentence-case subjects (used sparingly on main) keep passing.
44 lines
1.6 KiB
JavaScript
44 lines
1.6 KiB
JavaScript
/**
|
|
* Conventional Commits validation for Sencho. Subject lines must match
|
|
* <type>(<optional scope>): <subject>
|
|
* with type drawn from the allow-list below. release-please reads commits
|
|
* with these types from main and computes the next version + changelog,
|
|
* so any non-conforming commit silently breaks the release pipeline.
|
|
*
|
|
* Scope is free-form; common scopes used in this repo include backend,
|
|
* frontend, e2e, mesh-sidecar, docs, deps, ci, license, blueprints,
|
|
* fleet, security.
|
|
*/
|
|
module.exports = {
|
|
extends: ['@commitlint/config-conventional'],
|
|
rules: {
|
|
'type-enum': [
|
|
2,
|
|
'always',
|
|
[
|
|
'feat',
|
|
'fix',
|
|
'perf',
|
|
'revert',
|
|
'docs',
|
|
'style',
|
|
'refactor',
|
|
'test',
|
|
'build',
|
|
'ci',
|
|
'chore',
|
|
'security',
|
|
],
|
|
],
|
|
// The default 100-char subject limit is too tight for the descriptive
|
|
// subjects this repo prefers; loosen to 120 to match the longest
|
|
// existing commit subjects on main without enabling unbounded sprawl.
|
|
'header-max-length': [2, 'always', 120],
|
|
// Allow lowercase and kebab-case subjects (the repo norm), block
|
|
// accidental ALL-CAPS or PascalCase. Looser than the default which
|
|
// also banned sentence-case and start-case; existing commits on main
|
|
// use sentence-case sparingly and we do not want to retro-block them.
|
|
'subject-case': [2, 'never', ['upper-case', 'pascal-case']],
|
|
},
|
|
};
|