mirror of
https://github.com/Studio-Saelix/sencho.git
synced 2026-07-26 11:49:16 +00:00
Anso
5e29649f3e
* chore(repo): enforce Conventional Commits via husky and commitlint release-please parses commit subjects on main to compute the next version and regenerate CHANGELOG.md. A non-conforming commit silently breaks both, so the format must be enforced at commit time, not by review. Adds husky 9 to wire a commit-msg hook, commitlint with the conventional config, and a small rule override (loosen subject length to 120 chars, disable subject-case so existing imperative subjects keep passing). The prepare script runs husky on npm install so contributors do not need to configure it manually. * ci: add dependency-review workflow GitHub-native action that diffs the PR's manifests (package.json, package-lock.json) against main and fails when a new transitive dep introduces a high or critical CVE. Existing vulnerabilities tracked in security/vex/sencho.openvex.json and the Trivy scan in ci.yml are not re-flagged here. Pinned to actions/dependency-review-action v4.9.0 by commit SHA. Comment summaries are posted to the PR only on failure to keep the conversation clean on green PRs. * ci: add stale workflow for issues and pull requests Marks issues and PRs as stale after 60 days of inactivity and closes 14 days later unless re-engaged. Issues labeled pinned, security, bug, or tracking are exempt and never auto-closed; PRs labeled pinned or security are exempt. Runs daily at 01:30 UTC and processes up to 30 items per run to stay within the action's rate budget. Pinned to actions/stale v10.2.0 by commit SHA. * chore(repo): route new issues to docs, discussions, and security policy Disables the blank-issue option and adds three contact links the issue chooser surfaces above the bug-report and feature-request templates: docs.sencho.io for setup questions, GitHub Discussions for open-ended chat, and the repository security policy for private vulnerability reports. This keeps the bug tracker focused on actionable bug reports and feature requests instead of support questions. * ci(docker): publish multi-arch image to GHCR alongside Docker Hub Mirrors every released sencho and sencho-mesh image to ghcr.io with the same tags, signing, and supply-chain attestations as the Docker Hub copy. Same content; pull from whichever registry your environment prefers. - Adds packages:write to both publish jobs so the auto-provisioned GITHUB_TOKEN can push to ghcr.io/studio-saelix/sencho and -mesh. - Adds a second docker/login-action step authenticating to ghcr.io. The Docker Hub login still resolves credentials from the production env. - docker/metadata-action now lists both image references; one buildx push attaches the manifest to both registries in a single round trip. - Cosign keyless signing already loops over $TAGS, so adding the GHCR reference is enough to sign both digests. - The cosign attest step now loops over both registry paths so SBOM (CDX + SPDX) and OpenVEX attestations are resolvable from either registry. Quickstart and image-verification docs note GHCR as an alternative pull source with identical content. * fix(mesh-sidecar): pin base image by digest The main Sencho Dockerfile pins every base image by sha256 digest so a republish of an upstream tag cannot silently shift content into a release. The mesh-sidecar Dockerfile pinned node:22-alpine by tag, which is exactly the gap that pinning closes. Resolves node:22-alpine to its current multi-arch index digest (covers linux/amd64 and linux/arm64) and threads it through both build stages via a single ARG so a future digest roll only edits one line. The inline comment documents the resolution command. The sidecar holds an outbound websocket and has no inbound HTTP listener, so adding a HEALTHCHECK is intentionally out of scope: a process-liveness probe would be tautological with Docker's restart policy. The Dockerfile now records that decision so it does not get reopened on every audit. * ci(docker): use repository_owner for GHCR login username github.actor varies by event source (the maintainer who merged the release PR on tag pushes, github-actions[bot] on bot-driven runs, the dispatcher on workflow_dispatch). The username field is metadata only; GITHUB_TOKEN is what authenticates against GHCR. github.repository_owner resolves to a fixed value (studio-saelix) on every event and matches GitHub's own example workflows for GHCR push. * chore(repo): tighten commit subject-case rule Disabling subject-case entirely allowed accidental ALL-CAPS or PascalCase subjects through. Restrict to "never upper-case or pascal-case" instead, which preserves the lowercase / kebab-case norm of this repo and lets sentence-case subjects (used sparingly on main) keep passing.
49 lines
1.7 KiB
YAML
49 lines
1.7 KiB
YAML
name: Stale Issues and Pull Requests
|
|
|
|
# Marks issues and PRs as stale after 60 days of inactivity and closes
|
|
# them 14 days after that unless re-engaged. Keeps the issue tracker
|
|
# focused on actionable work without losing real bugs: anything labeled
|
|
# pinned, security, bug, or tracking is exempt and never auto-closed.
|
|
|
|
on:
|
|
schedule:
|
|
# Daily at 01:30 UTC. Off-peak for the GitHub Actions stale runner.
|
|
- cron: '30 1 * * *'
|
|
workflow_dispatch:
|
|
|
|
permissions:
|
|
issues: write
|
|
pull-requests: write
|
|
|
|
concurrency:
|
|
group: stale
|
|
cancel-in-progress: false
|
|
|
|
jobs:
|
|
stale:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/stale@b5d41d4e1d5dceea10e7104786b73624c18a190f # v10.2.0
|
|
with:
|
|
days-before-stale: 60
|
|
days-before-close: 14
|
|
stale-issue-label: stale
|
|
stale-pr-label: stale
|
|
exempt-issue-labels: 'pinned,security,bug,tracking'
|
|
exempt-pr-labels: 'pinned,security'
|
|
stale-issue-message: >
|
|
This issue has had no activity for 60 days and will be closed in
|
|
14 days unless someone replies. Add a comment or remove the stale
|
|
label to keep it open.
|
|
close-issue-message: >
|
|
Closing for inactivity. Reopen if this is still relevant.
|
|
stale-pr-message: >
|
|
This pull request has had no activity for 60 days and will be
|
|
closed in 14 days unless updated. Push a new commit or remove the
|
|
stale label to keep it open.
|
|
close-pr-message: >
|
|
Closing for inactivity. Reopen and rebase if you want to continue.
|
|
# Process up to 30 items per run to stay within the action's rate
|
|
# budget; running daily covers the steady state easily.
|
|
operations-per-run: 30
|