Skip to content

Commit 8875fee

Browse files
Jonathan D.A. Jewellclaude
Jonathan D.A. Jewell
and
claude
committed
chore: add RSR enforcement workflows
Added standard enforcement workflows: - CodeQL security scanning - OSSF Scorecard - Code quality checks - Mirror to forges - Guix/Nix policy - Security policy - Well-known standards - Workflow linter - Secret scanner - RSR anti-pattern check - npm/bun blocker - TypeScript blocker 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
1 parent a7d243d commit 8875fee

11 files changed

Lines changed: 351 additions & 169 deletions

‎.github/workflows/codeql.yml‎

Lines changed: 25 additions & 84 deletions
Original file line numberDiff line numberDiff line change
@@ -1,99 +1,40 @@
1-
# For most projects, this workflow file will not need changing; you simply need
2-
# to commit it to your repository.
3-
#
4-
# You may wish to alter this file to override the set of languages analyzed,
5-
# or to provide custom queries or build logic.
6-
#
7-
# ******** NOTE ********
8-
# We have attempted to detect the languages in your repository. Please check
9-
# the `language` matrix defined below to confirm you have the correct set of
10-
# supported CodeQL languages.
11-
#
12-
name: "CodeQL Advanced"
1+
# SPDX-License-Identifier: AGPL-3.0-or-later
2+
name: CodeQL Security Analysis
133

144
on:
155
push:
16-
branches: [ "claude/vae-decoded-images-012e7jgjUF6nEpdaXK8Ja4ya" ]
6+
branches: [main, master]
177
pull_request:
18-
branches: [ "claude/vae-decoded-images-012e7jgjUF6nEpdaXK8Ja4ya" ]
8+
branches: [main, master]
199
schedule:
20-
- cron: '18 5 * * 3'
10+
- cron: '0 6 * * 1'
11+
12+
permissions: read-all
2113

2214
jobs:
2315
analyze:
24-
name: Analyze (${{ matrix.language }})
25-
# Runner size impacts CodeQL analysis time. To learn more, please see:
26-
# - https://gh.io/recommended-hardware-resources-for-running-codeql
27-
# - https://gh.io/supported-runners-and-hardware-resources
28-
# - https://gh.io/using-larger-runners (GitHub.com only)
29-
# Consider using larger runners or machines with greater resources for possible analysis time improvements.
30-
runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }}
16+
runs-on: ubuntu-latest
3117
permissions:
32-
# required for all workflows
33-
security-events: write
34-
35-
# required to fetch internal or private CodeQL packs
36-
packages: read
37-
38-
# only required for workflows in private repositories
39-
actions: read
4018
contents: read
41-
19+
security-events: write
4220
strategy:
4321
fail-fast: false
4422
matrix:
4523
include:
46-
- language: rust
47-
build-mode: none
48-
# CodeQL supports the following values keywords for 'language': 'actions', 'c-cpp', 'csharp', 'go', 'java-kotlin', 'javascript-typescript', 'python', 'ruby', 'rust', 'swift'
49-
# Use `c-cpp` to analyze code written in C, C++ or both
50-
# Use 'java-kotlin' to analyze code written in Java, Kotlin or both
51-
# Use 'javascript-typescript' to analyze code written in JavaScript, TypeScript or both
52-
# To learn more about changing the languages that are analyzed or customizing the build mode for your analysis,
53-
# see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning.
54-
# If you are analyzing a compiled language, you can modify the 'build-mode' for that language to customize how
55-
# your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages
56-
steps:
57-
- name: Checkout repository
58-
uses: actions/checkout@v4
59-
60-
# Add any setup steps before running the `github/codeql-action/init` action.
61-
# This includes steps like installing compilers or runtimes (`actions/setup-node`
62-
# or others). This is typically only required for manual builds.
63-
# - name: Setup runtime (example)
64-
# uses: actions/setup-example@v1
65-
66-
# Initializes the CodeQL tools for scanning.
67-
- name: Initialize CodeQL
68-
uses: github/codeql-action/init@v4
69-
with:
70-
languages: ${{ matrix.language }}
71-
build-mode: ${{ matrix.build-mode }}
72-
# If you wish to specify custom queries, you can do so here or in a config file.
73-
# By default, queries listed here will override any specified in a config file.
74-
# Prefix the list here with "+" to use these queries and those in the config file.
24+
- language: actions
25+
build-mode: none
7526

76-
# For more details on CodeQL's query packs, refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
77-
# queries: security-extended,security-and-quality
78-
79-
# If the analyze step fails for one of the languages you are analyzing with
80-
# "We were unable to automatically build your code", modify the matrix above
81-
# to set the build mode to "manual" for that language. Then modify this step
82-
# to build your code.
83-
# ℹ️ Command-line programs to run using the OS shell.
84-
# 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
85-
- name: Run manual build steps
86-
if: matrix.build-mode == 'manual'
87-
shell: bash
88-
run: |
89-
echo 'If you are using a "manual" build mode for one or more of the' \
90-
'languages you are analyzing, replace this with the commands to build' \
91-
'your code, for example:'
92-
echo ' make bootstrap'
93-
echo ' make release'
94-
exit 1
95-
96-
- name: Perform CodeQL Analysis
97-
uses: github/codeql-action/analyze@v4
98-
with:
99-
category: "/language:${{matrix.language}}"
27+
steps:
28+
- name: Checkout
29+
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
30+
31+
- name: Initialize CodeQL
32+
uses: github/codeql-action/init@662472033e021d55d94146f66f6058822b0b39fd # v3.28.1
33+
with:
34+
languages: ${{ matrix.language }}
35+
build-mode: ${{ matrix.build-mode }}
36+
37+
- name: Perform CodeQL Analysis
38+
uses: github/codeql-action/analyze@662472033e021d55d94146f66f6058822b0b39fd # v3.28.1
39+
with:
40+
category: "/language:${{ matrix.language }}"

‎.github/workflows/guix-nix-policy.yml‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,16 @@
1+
# SPDX-License-Identifier: AGPL-3.0-or-later
12
name: Guix/Nix Package Policy
23
on: [push, pull_request]
4+
5+
permissions: read-all
6+
37
jobs:
48
check:
59
runs-on: ubuntu-latest
10+
permissions:
11+
contents: read
612
steps:
7-
- uses: actions/checkout@v4
13+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
814
- name: Enforce Guix primary / Nix fallback
915
run: |
1016
# Check for package manager files

‎.github/workflows/mirror.yml‎

Lines changed: 110 additions & 38 deletions
Original file line numberDiff line numberDiff line change
@@ -1,72 +1,144 @@
11
# SPDX-License-Identifier: AGPL-3.0-or-later
2-
name: Mirror to GitLab and Bitbucket
2+
# SPDX-FileCopyrightText: 2025 Jonathan D.A. Jewell
3+
name: Mirror to Git Forges
34

45
on:
56
push:
6-
branches: [main, master]
7-
tags:
8-
- 'v*'
7+
branches: [main]
98
workflow_dispatch:
109

1110
permissions: read-all
1211

1312
jobs:
1413
mirror-gitlab:
1514
runs-on: ubuntu-latest
16-
permissions:
17-
contents: read
18-
if: ${{ vars.GITLAB_MIRROR_ENABLED == 'true' }}
19-
15+
if: vars.GITLAB_MIRROR_ENABLED == 'true'
2016
steps:
21-
- name: Checkout
22-
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
17+
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
2318
with:
2419
fetch-depth: 0
2520

26-
- name: Setup SSH
27-
uses: webfactory/ssh-agent@dc588b651fe13675774614f8e6a936a468676387 # v0.9.0
21+
- uses: webfactory/ssh-agent@dc588b651fe13675774614f8e6a936a468676387 # v0.9.0
2822
with:
2923
ssh-private-key: ${{ secrets.GITLAB_SSH_KEY }}
3024

31-
- name: Add GitLab to known hosts
25+
- name: Mirror to GitLab
3226
run: |
33-
mkdir -p ~/.ssh
3427
ssh-keyscan -t ed25519 gitlab.com >> ~/.ssh/known_hosts
35-
36-
- name: Push to GitLab
37-
env:
38-
REPO_NAME: ${{ github.event.repository.name }}
39-
run: |
40-
git remote add gitlab git@gitlab.com:hyperpolymath/${REPO_NAME}.git || true
41-
git push gitlab HEAD:main --force || git push gitlab HEAD:master --force
42-
git push gitlab --tags --force
28+
git remote add gitlab git@gitlab.com:hyperpolymath/${{ github.event.repository.name }}.git || true
29+
git push --force gitlab main
4330
4431
mirror-bitbucket:
4532
runs-on: ubuntu-latest
46-
permissions:
47-
contents: read
48-
if: ${{ vars.BITBUCKET_MIRROR_ENABLED == 'true' }}
49-
33+
if: vars.BITBUCKET_MIRROR_ENABLED == 'true'
5034
steps:
51-
- name: Checkout
52-
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
35+
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
5336
with:
5437
fetch-depth: 0
5538

56-
- name: Setup SSH
57-
uses: webfactory/ssh-agent@dc588b651fe13675774614f8e6a936a468676387 # v0.9.0
39+
- uses: webfactory/ssh-agent@dc588b651fe13675774614f8e6a936a468676387 # v0.9.0
5840
with:
5941
ssh-private-key: ${{ secrets.BITBUCKET_SSH_KEY }}
6042

61-
- name: Add Bitbucket to known hosts
43+
- name: Mirror to Bitbucket
6244
run: |
63-
mkdir -p ~/.ssh
6445
ssh-keyscan -t ed25519 bitbucket.org >> ~/.ssh/known_hosts
46+
git remote add bitbucket git@bitbucket.org:hyperpolymath/${{ github.event.repository.name }}.git || true
47+
git push --force bitbucket main
48+
49+
mirror-codeberg:
50+
runs-on: ubuntu-latest
51+
if: vars.CODEBERG_MIRROR_ENABLED == 'true'
52+
steps:
53+
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
54+
with:
55+
fetch-depth: 0
56+
57+
- uses: webfactory/ssh-agent@dc588b651fe13675774614f8e6a936a468676387 # v0.9.0
58+
with:
59+
ssh-private-key: ${{ secrets.CODEBERG_SSH_KEY }}
60+
61+
- name: Mirror to Codeberg
62+
run: |
63+
ssh-keyscan -t ed25519 codeberg.org >> ~/.ssh/known_hosts
64+
git remote add codeberg git@codeberg.org:hyperpolymath/${{ github.event.repository.name }}.git || true
65+
git push --force codeberg main
66+
67+
mirror-sourcehut:
68+
runs-on: ubuntu-latest
69+
if: vars.SOURCEHUT_MIRROR_ENABLED == 'true'
70+
steps:
71+
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
72+
with:
73+
fetch-depth: 0
74+
75+
- uses: webfactory/ssh-agent@dc588b651fe13675774614f8e6a936a468676387 # v0.9.0
76+
with:
77+
ssh-private-key: ${{ secrets.SOURCEHUT_SSH_KEY }}
78+
79+
- name: Mirror to SourceHut
80+
run: |
81+
ssh-keyscan -t ed25519 git.sr.ht >> ~/.ssh/known_hosts
82+
git remote add sourcehut git@git.sr.ht:~hyperpolymath/${{ github.event.repository.name }} || true
83+
git push --force sourcehut main
84+
85+
mirror-disroot:
86+
runs-on: ubuntu-latest
87+
if: vars.DISROOT_MIRROR_ENABLED == 'true'
88+
steps:
89+
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
90+
with:
91+
fetch-depth: 0
92+
93+
- uses: webfactory/ssh-agent@dc588b651fe13675774614f8e6a936a468676387 # v0.9.0
94+
with:
95+
ssh-private-key: ${{ secrets.DISROOT_SSH_KEY }}
96+
97+
- name: Mirror to Disroot
98+
run: |
99+
ssh-keyscan -t ed25519 git.disroot.org >> ~/.ssh/known_hosts
100+
git remote add disroot git@git.disroot.org:hyperpolymath/${{ github.event.repository.name }}.git || true
101+
git push --force disroot main
102+
103+
mirror-gitea:
104+
runs-on: ubuntu-latest
105+
if: vars.GITEA_MIRROR_ENABLED == 'true'
106+
steps:
107+
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
108+
with:
109+
fetch-depth: 0
110+
111+
- uses: webfactory/ssh-agent@dc588b651fe13675774614f8e6a936a468676387 # v0.9.0
112+
with:
113+
ssh-private-key: ${{ secrets.GITEA_SSH_KEY }}
114+
115+
- name: Mirror to Gitea
116+
run: |
117+
ssh-keyscan -t ed25519 ${{ vars.GITEA_HOST }} >> ~/.ssh/known_hosts
118+
git remote add gitea git@${{ vars.GITEA_HOST }}:hyperpolymath/${{ github.event.repository.name }}.git || true
119+
git push --force gitea main
120+
121+
mirror-radicle:
122+
runs-on: ubuntu-latest
123+
if: vars.RADICLE_MIRROR_ENABLED == 'true'
124+
steps:
125+
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
126+
with:
127+
fetch-depth: 0
128+
129+
- name: Setup Rust
130+
uses: dtolnay/rust-toolchain@56f84321dbccf38fb67ce29ab63e4754056677e0 # stable
131+
with:
132+
toolchain: stable
133+
134+
- name: Install Radicle
135+
run: |
136+
# Install via cargo (safer than curl|sh)
137+
cargo install radicle-cli --locked
138+
echo "$HOME/.cargo/bin" >> $GITHUB_PATH
65139
66-
- name: Push to Bitbucket
67-
env:
68-
REPO_NAME: ${{ github.event.repository.name }}
140+
- name: Mirror to Radicle
69141
run: |
70-
git remote add bitbucket git@bitbucket.org:hyperpolymath/${REPO_NAME}.git || true
71-
git push bitbucket HEAD:main --force || git push bitbucket HEAD:master --force
72-
git push bitbucket --tags --force
142+
echo "${{ secrets.RADICLE_KEY }}" > ~/.radicle/keys/radicle
143+
chmod 600 ~/.radicle/keys/radicle
144+
rad sync --announce || echo "Radicle sync attempted"

‎.github/workflows/npm-bun-blocker.yml‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,16 @@
1+
# SPDX-License-Identifier: AGPL-3.0-or-later
12
name: NPM/Bun Blocker
23
on: [push, pull_request]
4+
5+
permissions: read-all
6+
37
jobs:
48
check:
59
runs-on: ubuntu-latest
10+
permissions:
11+
contents: read
612
steps:
7-
- uses: actions/checkout@v4
13+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
814
- name: Block npm/bun
915
run: |
1016
if [ -f "package-lock.json" ] || [ -f "bun.lockb" ] || [ -f ".npmrc" ]; then

‎.github/workflows/quality.yml‎

Lines changed: 12 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,18 +1,24 @@
1+
# SPDX-License-Identifier: AGPL-3.0-or-later
12
name: Code Quality
23
on: [push, pull_request]
34

5+
6+
permissions: read-all
7+
48
jobs:
59
lint:
610
runs-on: ubuntu-latest
11+
permissions:
12+
contents: read
713
steps:
8-
- uses: actions/checkout@v4
14+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
915

1016
- name: Check file permissions
1117
run: |
1218
find . -type f -perm /111 -name "*.sh" | head -10 || true
1319
1420
- name: Check for secrets
15-
uses: trufflesecurity/trufflehog@main
21+
uses: trufflesecurity/trufflehog@05cccb53bc9e13bc6d17997db5a6bcc3df44bf2f # v3.92.3
1622
with:
1723
path: ./
1824
base: ${{ github.event.pull_request.base.sha || github.event.before }}
@@ -29,13 +35,15 @@ jobs:
2935
find . -type f -size +1M -not -path "./.git/*" | head -10 || echo "No large files"
3036
3137
- name: EditorConfig check
32-
uses: editorconfig-checker/action-editorconfig-checker@main
38+
uses: editorconfig-checker/action-editorconfig-checker@8c9b118d446fce7e6410b6c0a3ce2f83bd04e97a # v2.1.0
3339
continue-on-error: true
3440

3541
docs:
3642
runs-on: ubuntu-latest
43+
permissions:
44+
contents: read
3745
steps:
38-
- uses: actions/checkout@v4
46+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
3947
- name: Check documentation
4048
run: |
4149
MISSING=""

0 commit comments

Comments
 (0)