Skip to content

Commit 76ae3e9

Browse files
hyperpolymathclaude
hyperpolymath
and
claude
committed
feat: OpenSSF Silver push — security policy, conduct, branch protection
SECURITY.md: expanded from 21 to 710 lines with incident response phases, severity classification, safe harbour, reporter credits, formal verification, container security, dependency management. CODE_OF_CONDUCT.md: full Contributor Covenant v2.1 with 4-level enforcement. settings.yml: branch protection for probot/settings. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
1 parent 11fcde2 commit 76ae3e9

3 files changed

Lines changed: 934 additions & 23 deletions

File tree

‎.github/settings.yml‎

Lines changed: 122 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,122 @@
1+
# SPDX-License-Identifier: PMPL-1.0-or-later
2+
#
3+
# Repository settings for probot/settings GitHub App.
4+
# https://github.com/probot/settings
5+
#
6+
# This file defines repository-level configuration that is automatically
7+
# applied by the probot/settings app when changes are pushed to the default
8+
# branch. Install the app at: https://github.com/apps/settings
9+
10+
# ─── Repository Settings ───────────────────────────────────────────────────────
11+
12+
repository:
13+
name: "boj-server"
14+
description: "BoJ (Bureau of Justice) — unified MCP server consolidating GitHub, GitLab, Cloudflare, browser automation, and 50+ open-source cartridges"
15+
homepage: "https://github.com/hyperpolymath/boj-server"
16+
private: false
17+
has_issues: true
18+
has_projects: true
19+
has_wiki: false
20+
has_downloads: true
21+
default_branch: main
22+
allow_squash_merge: true
23+
allow_merge_commit: true
24+
allow_rebase_merge: true
25+
delete_branch_on_merge: true
26+
enable_automated_security_fixes: true
27+
enable_vulnerability_alerts: true
28+
29+
# ─── Labels ────────────────────────────────────────────────────────────────────
30+
31+
labels:
32+
- name: "bug"
33+
color: "d73a4a"
34+
description: "Something isn't working"
35+
36+
- name: "enhancement"
37+
color: "a2eeef"
38+
description: "New feature or request"
39+
40+
- name: "documentation"
41+
color: "0075ca"
42+
description: "Improvements or additions to documentation"
43+
44+
- name: "security"
45+
color: "e4e669"
46+
description: "Security-related issue or vulnerability"
47+
48+
- name: "good first issue"
49+
color: "7057ff"
50+
description: "Good for newcomers"
51+
52+
- name: "help wanted"
53+
color: "008672"
54+
description: "Extra attention is needed"
55+
56+
- name: "question"
57+
color: "d876e3"
58+
description: "Further information is requested"
59+
60+
- name: "duplicate"
61+
color: "cfd3d7"
62+
description: "This issue or pull request already exists"
63+
64+
- name: "invalid"
65+
color: "e4e669"
66+
description: "This doesn't seem right"
67+
68+
- name: "wontfix"
69+
color: "ffffff"
70+
description: "This will not be worked on"
71+
72+
- name: "dependencies"
73+
color: "0366d6"
74+
description: "Pull requests that update a dependency file"
75+
76+
- name: "ci/cd"
77+
color: "fbca04"
78+
description: "Continuous integration and deployment"
79+
80+
- name: "rsr"
81+
color: "006b75"
82+
description: "Rhodium Standard Repository compliance"
83+
84+
- name: "hypatia"
85+
color: "5319e7"
86+
description: "Hypatia neurosymbolic scanner finding"
87+
88+
- name: "bot"
89+
color: "b4a8d1"
90+
description: "Automated action by gitbot-fleet"
91+
92+
- name: "breaking-change"
93+
color: "b60205"
94+
description: "Introduces a breaking change"
95+
96+
- name: "performance"
97+
color: "f9d0c4"
98+
description: "Performance improvement"
99+
100+
- name: "refactor"
101+
color: "c5def5"
102+
description: "Code refactoring with no functional change"
103+
104+
# ─── Branch Protection ─────────────────────────────────────────────────────────
105+
106+
branches:
107+
- name: "main"
108+
protection:
109+
required_pull_request_reviews:
110+
required_approving_review_count: 1
111+
dismiss_stale_reviews: true
112+
require_code_owner_reviews: true
113+
required_status_checks:
114+
strict: true
115+
contexts:
116+
- "hypatia-scan"
117+
- "codeql"
118+
enforce_admins: true
119+
required_signatures: true
120+
restrictions: null
121+
allow_force_pushes: false
122+
allow_deletions: false

‎CODE_OF_CONDUCT.md‎

Lines changed: 111 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1,27 +1,126 @@
1-
<!-- SPDX-License-Identifier: PMPL-1.0-or-later -->
1+
<!-- SPDX-License-Identifier: CC-BY-4.0 -->
22
# Contributor Covenant Code of Conduct
33

44
## Our Pledge
55

6-
We pledge to make participation a harassment-free experience for everyone.
6+
We as members, contributors, and leaders pledge to make participation in our
7+
community a harassment-free experience for everyone, regardless of age, body
8+
size, visible or invisible disability, ethnicity, sex characteristics, gender
9+
identity and expression, level of experience, education, socio-economic status,
10+
nationality, personal appearance, race, religion, or sexual identity
11+
and orientation.
12+
13+
We pledge to act and interact in ways that contribute to an open, welcoming,
14+
diverse, inclusive, and healthy community.
715

816
## Our Standards
917

10-
**Positive behavior:**
11-
* Using welcoming language
12-
* Being respectful of differing viewpoints
13-
* Accepting constructive criticism
14-
* Focusing on what is best for the community
18+
Examples of behavior that contributes to a positive environment for our
19+
community include:
20+
21+
* Demonstrating empathy and kindness toward other people
22+
* Being respectful of differing opinions, viewpoints, and experiences
23+
* Giving and gracefully accepting constructive feedback
24+
* Accepting responsibility and apologizing to those affected by our mistakes,
25+
and learning from the experience
26+
* Focusing on what is best not just for us as individuals, but for the
27+
overall community
28+
29+
Examples of unacceptable behavior include:
30+
31+
* Trolling, insulting or derogatory comments, and personal or political attacks
32+
* Public or private harassment of any kind
33+
* Publishing others' private information, such as a physical or email
34+
address, without their explicit permission
35+
* Other conduct which could reasonably be considered inappropriate in a
36+
professional setting
37+
38+
## Enforcement Responsibilities
39+
40+
Community leaders are responsible for clarifying and enforcing our standards of
41+
acceptable behavior and will take appropriate and fair corrective action in
42+
response to any behavior that they deem inappropriate, threatening, offensive,
43+
or harmful.
44+
45+
Community leaders have the right and responsibility to remove, edit, or reject
46+
comments, commits, code, wiki edits, issues, and other contributions that are
47+
not aligned to this Code of Conduct, and will communicate reasons for moderation
48+
decisions when appropriate.
1549

16-
**Unacceptable behavior:**
17-
* Harassment, trolling, or personal attacks
18-
* Publishing private information without permission
50+
## Scope
51+
52+
This Code of Conduct applies within all community spaces, and also applies when
53+
an individual is officially representing the community in public spaces.
54+
Examples of representing our community include using an official e-mail address,
55+
posting via an official social media account, or acting as an appointed
56+
representative at an online or offline event.
1957

2058
## Enforcement
2159

22-
Report issues to the maintainers. All complaints will be reviewed.
60+
Instances of unacceptable behavior may be reported to the community leaders
61+
responsible for enforcement at j.d.a.jewell@open.ac.uk.
62+
All complaints will be reviewed and investigated promptly and fairly.
63+
64+
All community leaders are obligated to respect the privacy and security of the
65+
reporter of any incident.
66+
67+
## Enforcement Guidelines
68+
69+
Community leaders will follow these Community Impact Guidelines in determining
70+
the consequences for any action they deem in violation of this Code of Conduct:
71+
72+
### 1. Correction
73+
74+
**Community Impact**: Use of inappropriate language or other behavior deemed
75+
unprofessional or unwelcome in the community.
76+
77+
**Consequence**: A private, written warning from community leaders, providing
78+
clarity around the nature of the violation and an explanation of why the
79+
behavior was inappropriate. A public apology may be requested.
80+
81+
### 2. Warning
82+
83+
**Community Impact**: A violation through a single incident or series
84+
of actions.
85+
86+
**Consequence**: A warning with consequences for continued behavior. No
87+
interaction with the people involved, including unsolicited interaction with
88+
those enforcing the Code of Conduct, for a specified period of time. This
89+
includes avoiding interactions in community spaces as well as external channels
90+
like social media. Violating these terms may lead to a temporary or
91+
permanent ban.
92+
93+
### 3. Temporary Ban
94+
95+
**Community Impact**: A serious violation of community standards, including
96+
sustained inappropriate behavior.
97+
98+
**Consequence**: A temporary ban from any sort of interaction or public
99+
communication with the community for a specified period of time. No public or
100+
private interaction with the people involved, including unsolicited interaction
101+
with those enforcing the Code of Conduct, is allowed during this period.
102+
Violating these terms may lead to a permanent ban.
103+
104+
### 4. Permanent Ban
105+
106+
**Community Impact**: Demonstrating a pattern of violation of community
107+
standards, including sustained inappropriate behavior, or aggression toward
108+
or disparagement of classes of individuals.
109+
110+
**Consequence**: A permanent ban from any sort of public interaction within
111+
the community.
23112

24113
## Attribution
25114

26-
Adapted from [Contributor Covenant](https://www.contributor-covenant.org/) v2.1.
115+
This Code of Conduct is adapted from the [Contributor Covenant][homepage],
116+
version 2.1, available at
117+
https://www.contributor-covenant.org/version/2/1/code_of_conduct.html.
118+
119+
Community Impact Guidelines were inspired by [Mozilla's code of conduct
120+
enforcement ladder](https://github.com/mozilla/diversity).
121+
122+
[homepage]: https://www.contributor-covenant.org
27123

124+
For answers to common questions about this code of conduct, see the FAQ at
125+
https://www.contributor-covenant.org/faq. Translations are available at
126+
https://www.contributor-covenant.org/translations.

0 commit comments

Comments
 (0)