Repository navigation
docs: answers the merged security and server work earns, and the license rule - #20
Merged
Merged
Conversation
…nse rule PRs #13 and #15 merged, and the main ruleset now requires osv-scanner, the two CodeQL analyses and CodeQL code scanning results (security severity high or higher, or errors). So these answers are Met, each with its evidence: - silver static_analysis_common_vulnerabilities (Sobelow, CodeQL), crypto_credential_agility (NAME_FILE secrets), installation_standard_variables (XDG) and installation_common (install-service.sh --uninstall; the browser's extension manager); - passing static_analysis_common_vulnerabilities, reworded; - Baseline osps_vm_05_01, 05_02, 05_03, 06_01 and 06_02. The dependency policy's license list now follows the Apache Software Foundation's categories (A allowed, B only unmodified and recorded, X never), decided by the lead agent at the maintainer's request and recorded in DECISIONS.md. Its two "Not yet" notes are gone: the ruleset requires both the dependency scan and code scanning results. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Ayla Croft <dev@scriptkittyos.com>
The page was hard to use: twenty buttons, a checkbox to remember, and answers that kept changing back. The cause of the last part: a criterion repeated at a higher level (crypto_weaknesses at passing and silver, for example) is one field on the entry, and 13 of them had different text at each level, so saving one form overwrote the other. - One answer per shared field (the stricter level's), and --check now fails if two copies differ. - The page downloads the entry's JSON and lists only the answers whose status or text differs, with the saved status next to each, as few buttons per form as fit, each replacing what is saved. --all lists everything, for a new entry. - roles_responsibilities, osps_ac_02_01 and osps_br_02_01 no longer describe the GitHub team or the old tag ruleset, and silver achieve_passing is Met (passing was earned on 2026-10-06). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Ayla Croft <dev@scriptkittyos.com>
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
…re Met with PR #16 PR #16 runs Credo in strict mode and tests with --warnings-as-errors, adds about 60 stricter ESLint rules, and enforces the JavaScript layout with @stylistic/eslint-plugin. These were the last two silver MUSTs. Merge #16 before this, so the answers are true when they are saved on the form. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Ayla Croft <dev@scriptkittyos.com>
The stricter ESLint rules in PR #16 (no-shadow) flag the page builder's local 'links', which hides the exported links(). Renamed to 'parts'. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Ayla Croft <dev@scriptkittyos.com>
… the document CodeQL (js/file-access-to-http, medium) flagged that the badge page built its request URL from text read out of docs/best-practices.md. The id is public and only the entry's public JSON was fetched, so nothing leaked, but no file contents need to reach a request at all: the script now fetches a fixed PROJECT id, and --check fails if the document names a different entry. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Ayla Croft <dev@scriptkittyos.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
The badge answers that the merged PRs (#13 server secrets/XDG/uninstall, #15 Sobelow/CodeQL/OSV-Scanner) and today's ruleset change now earn:
static_analysis_common_vulnerabilitiescrypto_credential_agilityinstallation_standard_variablesinstallation_commonstatic_analysis_common_vulnerabilitiesosps_vm_05_01,05_02,05_03,06_01,06_02Ruleset (done 2026-10-06):
mainnow requiresosv-scanner,analyze (actions)andanalyze (javascript-typescript). It also has a code scanning rule: a CodeQL alert of high or critical security severity, or of severity error, blocks the merge. Theanalyzejobs alone pass even when they find something, so this rule is what makes a finding block.License rule: the dependency policy now follows the Apache Software Foundation's categories:
Everything shipped today is Apache-2.0, MIT, public domain (SQLite) or Unicode-3.0 (CLDR). Recorded in DECISIONS.md.
Checked
bestpractices-links --check(209 answers valid),check-old-name,reuse lint. Every claim was checked againstmainand the live ruleset.🤖 Generated with Claude Code