diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..4d9ae2f --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,51 @@ +# SPDX-License-Identifier: MPL-2.0 +# Dependabot configuration for RSR-compliant repositories +# Covers common ecosystems - remove unused ones for your project + +version: 2 +updates: + # GitHub Actions - always include + - package-ecosystem: "github-actions" + directory: "/" + schedule: + interval: "weekly" + groups: + actions: + patterns: + - "*" + + # Rust/Cargo + - package-ecosystem: "cargo" + directory: "/" + schedule: + interval: "weekly" + # `open-pull-requests-limit: 0` suppresses routine version-update PRs + # while leaving Dependabot SECURITY PRs flowing. The previous + # `ignore: "*" patch` rule also silenced security PRs under GitHub\'s + # current Dependabot behaviour. See rsr-template-repo commit 78b050e + # and 007-lang/audits/audit-dependabot-automation-gap-2026-04-17.md. + open-pull-requests-limit: 0 + + # Elixir/Mix + - package-ecosystem: "mix" + directory: "/" + schedule: + interval: "weekly" + + # Node.js/npm + - package-ecosystem: "npm" + directory: "/" + schedule: + interval: "weekly" + + # Python/pip + - package-ecosystem: "pip" + directory: "/" + schedule: + interval: "weekly" + + # Nix flakes + - package-ecosystem: "nix" + directory: "/" + schedule: + interval: "weekly" diff --git a/.github/workflows/anchor-drift.yml b/.github/workflows/anchor-drift.yml index b63de06..9dc9b0a 100644 --- a/.github/workflows/anchor-drift.yml +++ b/.github/workflows/anchor-drift.yml @@ -14,6 +14,7 @@ on: workflow_dispatch: permissions: + actions: read contents: read jobs: diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml new file mode 100644 index 0000000..34ae58e --- /dev/null +++ b/.github/workflows/codeql.yml @@ -0,0 +1,45 @@ +# SPDX-License-Identifier: MPL-2.0 +name: CodeQL + +on: + push: + branches: [main] + pull_request: + branches: [main] + schedule: + - cron: '0 0 * * 0' + +permissions: + actions: read + contents: read + security-events: write + +jobs: + analyze: + name: CodeQL Analysis + runs-on: ubuntu-latest + permissions: + actions: read + contents: read + security-events: write + strategy: + fail-fast: false + matrix: + include: + - language: actions + build-mode: none + steps: + - name: Checkout repository + uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 + + - name: Initialize CodeQL + uses: github/codeql-action/init@4187e74d05793876e9989daffde9c3e66b4acd07 # v3 + with: + languages: ${{ matrix.language }} + build-mode: ${{ matrix.build-mode }} + + - name: Autobuild + uses: github/codeql-action/autobuild@4187e74d05793876e9989daffde9c3e66b4acd07 # v3 + + - name: Perform CodeQL Analysis + uses: github/codeql-action/analyze@4187e74d05793876e9989daffde9c3e66b4acd07 # v3 diff --git a/.github/workflows/push-email-notify.yml b/.github/workflows/push-email-notify.yml index 4b4e754..112afd1 100644 --- a/.github/workflows/push-email-notify.yml +++ b/.github/workflows/push-email-notify.yml @@ -7,6 +7,7 @@ name: Push email notification on: push: {} permissions: + actions: read contents: read jobs: notify: diff --git a/GOVERNANCE.adoc b/GOVERNANCE.adoc deleted file mode 100644 index 0b8ac89..0000000 --- a/GOVERNANCE.adoc +++ /dev/null @@ -1,93 +0,0 @@ -= Governance - -// SPDX-License-Identifier: CC-BY-SA-4.0 - -[NOTE] -==== -Personal / solo-project model (Benevolent Maintainer). Last reviewed: 2026-06-27. -==== - -== Project status - -This project is governed by a *Benevolent Maintainer* model. - -The project founder retains final authority over project direction, -architecture, releases, licensing, and governance. - -== Founder - -Current founder and lead maintainer: - -* Jonathan D.A. Jewell (`@hyperpolymath`) - -== Decision making - -Normal decisions are made by the founder. - -Contributors are encouraged to: - -* open issues -* submit pull requests -* propose designs -* discuss alternatives - -Feedback is considered in good faith but does not bind the project. - -== Contributions - -Contributions are welcome. See `CONTRIBUTING.md` for how to get started. - -Submitting a contribution does not guarantee acceptance. The founder may: - -* accept a contribution -* request changes -* reject a contribution -* replace a contribution with an alternative implementation - -without further justification. - -== Architectural direction - -The founder is responsible for: - -* project vision -* long-term roadmap -* architecture -* naming -* release strategy - -== Maintainers - -Additional maintainers may be appointed by the founder (see `MAINTAINERS.adoc`). -Maintainers may review changes, merge pull requests, and manage issues unless -otherwise restricted. The founder may remove maintainers at any time. - -== Code of conduct - -All participants are expected to follow the project's `CODE_OF_CONDUCT.md`. -The founder is the point of contact for enforcement. - -== Security - -Report suspected vulnerabilities *privately* as described in `SECURITY.md`. -Please do not disclose vulnerabilities in public issues. - -== Forking - -Users are free to fork the project according to the license. Forks are -independent projects and are not considered official unless explicitly -designated. - -== Governance changes - -This document may be amended by the founder. - -== Project continuity - -If the founder permanently ceases maintenance: - -. a successor may be appointed; -. ownership may be transferred; -. the project may become community-maintained. - -Until such designation exists, no successor is implied. diff --git a/gleam/scripts/check-no-vlang.sh b/gleam/scripts/check-no-vlang.sh new file mode 100644 index 0000000..f2125a3 --- /dev/null +++ b/gleam/scripts/check-no-vlang.sh @@ -0,0 +1,81 @@ +#!/usr/bin/env bash +# SPDX-License-Identifier: MPL-2.0 +# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) +# +# check-no-vlang.sh — enforce "V-lang is banned in the estate". +# +# Estate rule: V-lang (vlang.io) is banned estate-wide (2026-04-10). It was +# migrated to Zig — the estate's default FFI/API/gateway language — via the +# `zig-unified-api-adapter`. Zig is ALLOWED and is deliberately NOT matched by +# this check; only V-lang references are treated as drift and must be removed. +# +# Searches for V-lang-specific content patterns in tracked files. The .v file +# extension is intentionally NOT used as a marker because Coq theorem files +# share that extension; this check looks at content patterns instead. +# +# Excludes: +# .git/ (vcs internals) +# affinescript/ (a separately-licensed AffineScript subtree; pattern hits +# there are not estate-managed and false-positive on `.v` mentions in +# linguistic / academic prose). +# +# Exit codes: +# 0 — no V-lang references found +# 1 — V-lang references found (treat as drift) +# 2 — usage / setup error + +set -euo pipefail + +REPO_ROOT="${1:-.}" + +# Patterns that uniquely indicate V-lang code, scaffolding, or naming. +# Zig is the estate FFI/API default and is deliberately NOT matched here. +# Coq's `.v` extension and the affinescript subtree are excluded by path. +PATTERNS=( + 'gen-v-connector' + 'V-TRIPLE' + 'v-triple' + 'vlang' + 'connectors/v-' +) + +PATTERN_OR=$(IFS='|'; echo "${PATTERNS[*]}") + +# Files that document the V-lang ban itself (the rule's own description +# legitimately names "V-lang", "vlang", "V-TRIPLE", etc.). Excluded by name. +DOC_EXCLUSIONS=( + "estate-rules.yml" # the workflow that calls this script + "check-no-vlang.sh" # this script itself + "PLAYBOOK.a2ml" # documents the [rsr-repo-skeleton] rules + "feedback_v_lang_banned.md" # memory entry documenting the ban + "project_zig_unified_api.md" # memory entry documenting the replacement +) + +EXCLUDE_ARGS=() +for f in "${DOC_EXCLUSIONS[@]}"; do + EXCLUDE_ARGS+=(--exclude="$f") +done + +# Build grep arguments. Use -r to recurse, -n for line numbers, -i for +# case-insensitive matching. Exclude .git, the affinescript subtree, and +# files that legitimately document the ban. +HITS=$(grep -rni -E "$PATTERN_OR" "$REPO_ROOT" \ + --exclude-dir=.git \ + --exclude-dir=affinescript \ + --exclude-dir=node_modules \ + "${EXCLUDE_ARGS[@]}" \ + 2>/dev/null || true) + +if [ -z "$HITS" ]; then + echo "PASS: no V-lang references" + exit 0 +fi + +# Count matches +LINES=$(echo "$HITS" | wc -l | tr -d ' ') + +echo "FAIL: $LINES V-lang reference(s) found (estate rule: V-lang is banned):" >&2 +echo "$HITS" | sed 's|^| |' >&2 +echo "" >&2 +echo "V-lang has been replaced by Zig (the zig-unified-api-adapter). Remove these references." >&2 +exit 1