From 6ed3586d417868305b1bc0737d4893df576826af Mon Sep 17 00:00:00 2001 From: Raven Repo Date: Fri, 2 Oct 2026 21:18:11 +0530 Subject: [PATCH] Add community health files: CoC, contributing, security policy, templates Adds Contributor Covenant 2.1, a contributing guide reflecting the repo's rules (no secrets, no host-specific details, verify.sh), a private vulnerability reporting policy, YAML issue forms, and a PR template. Co-Authored-By: Claude Sonnet 5.5 --- .github/ISSUE_TEMPLATE/bug_report.yml | 60 +++++++++ .github/ISSUE_TEMPLATE/config.yml | 5 + .github/ISSUE_TEMPLATE/feature_request.yml | 43 +++++++ .github/PULL_REQUEST_TEMPLATE.md | 30 +++++ CODE_OF_CONDUCT.md | 134 +++++++++++++++++++++ CONTRIBUTING.md | 66 ++++++++++ README.md | 7 ++ SECURITY.md | 55 +++++++++ 8 files changed, 400 insertions(+) create mode 100644 .github/ISSUE_TEMPLATE/bug_report.yml create mode 100644 .github/ISSUE_TEMPLATE/config.yml create mode 100644 .github/ISSUE_TEMPLATE/feature_request.yml create mode 100644 .github/PULL_REQUEST_TEMPLATE.md create mode 100644 CODE_OF_CONDUCT.md create mode 100644 CONTRIBUTING.md create mode 100644 SECURITY.md diff --git a/.github/ISSUE_TEMPLATE/bug_report.yml b/.github/ISSUE_TEMPLATE/bug_report.yml new file mode 100644 index 0000000..d2a6228 --- /dev/null +++ b/.github/ISSUE_TEMPLATE/bug_report.yml @@ -0,0 +1,60 @@ +name: Bug report +description: A doc is wrong, or a script fails or misbehaves +title: "[Bug]: " +labels: ["bug"] +body: + - type: markdown + attributes: + value: | + Thanks for reporting. **Do not report security problems here**; use the + private [security advisory form](https://github.com/RavenRepo/cachyossystem/security/advisories/new). + Remove personal or host-specific details (addresses, hostnames, keys) from anything you paste. + - type: dropdown + id: area + attributes: + label: Area + options: + - Documentation + - Script + - verify.sh + - README + - Other + validations: + required: true + - type: input + id: location + attributes: + label: File or phase + description: For example `docs/03-gnome.md` or `scripts/02-development.sh`. + validations: + required: true + - type: textarea + id: what + attributes: + label: What is wrong? + description: What did you expect, and what happened instead? + validations: + required: true + - type: textarea + id: repro + attributes: + label: Steps to reproduce + placeholder: | + 1. Run ... + 2. See ... + validations: + required: true + - type: textarea + id: env + attributes: + label: Environment + description: Output of `fastfetch` or `uname -r` and `gnome-shell --version`. + render: text + validations: + required: true + - type: textarea + id: output + attributes: + label: Relevant output + description: Logs or error messages, with sensitive details removed. + render: shell diff --git a/.github/ISSUE_TEMPLATE/config.yml b/.github/ISSUE_TEMPLATE/config.yml new file mode 100644 index 0000000..32b7e15 --- /dev/null +++ b/.github/ISSUE_TEMPLATE/config.yml @@ -0,0 +1,5 @@ +blank_issues_enabled: false +contact_links: + - name: Report a security vulnerability + url: https://github.com/RavenRepo/cachyossystem/security/advisories/new + about: Report security issues privately. Do not open a public issue. diff --git a/.github/ISSUE_TEMPLATE/feature_request.yml b/.github/ISSUE_TEMPLATE/feature_request.yml new file mode 100644 index 0000000..13111b8 --- /dev/null +++ b/.github/ISSUE_TEMPLATE/feature_request.yml @@ -0,0 +1,43 @@ +name: Feature request +description: Suggest a new tool, phase, or improvement +title: "[Feature]: " +labels: ["enhancement"] +body: + - type: textarea + id: problem + attributes: + label: Problem or goal + description: What are you trying to do that the repo does not cover today? + validations: + required: true + - type: textarea + id: proposal + attributes: + label: Proposed change + description: Which doc or script would change, and how? + validations: + required: true + - type: textarea + id: alternatives + attributes: + label: Alternatives considered + - type: dropdown + id: source + attributes: + label: Package source + description: The repo prefers official repositories over the AUR. + options: + - Official repository + - AUR + - Upstream installer + - Not applicable + validations: + required: true + - type: checkboxes + id: checks + attributes: + label: Checks + options: + - label: I searched existing issues and docs first + required: true + - label: I am willing to open a pull request diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md new file mode 100644 index 0000000..2fe4890 --- /dev/null +++ b/.github/PULL_REQUEST_TEMPLATE.md @@ -0,0 +1,30 @@ +## Summary + + + +## Type of change + +- [ ] Documentation fix or update +- [ ] Script fix +- [ ] New phase, tool, or section +- [ ] Drift sync against a live system +- [ ] Repository/community files + +## Testing + + + +- [ ] `scripts/verify.sh` passes on my system +- [ ] Changed shell scripts pass `bash -n` (and `shellcheck`, if available) +- [ ] Docs and scripts are consistent with each other +- [ ] Versions/status statements come from a real system, with the observation date + +## Security and hygiene + +- [ ] No secrets, tokens, keys, `.env` values, or auth keys +- [ ] No IP addresses, hostnames, open ports, firewall rules, or other host-specific details +- [ ] Nothing is piped to a shell without being documented as "review first" + +## Notes for reviewers + + diff --git a/CODE_OF_CONDUCT.md b/CODE_OF_CONDUCT.md new file mode 100644 index 0000000..5e44e31 --- /dev/null +++ b/CODE_OF_CONDUCT.md @@ -0,0 +1,134 @@ +# Contributor Covenant Code of Conduct + +## Our Pledge + +We as members, contributors, and leaders pledge to make participation in our +community a harassment-free experience for everyone, regardless of age, body +size, visible or invisible disability, ethnicity, sex characteristics, gender +identity and expression, level of experience, education, socio-economic status, +nationality, personal appearance, race, caste, color, religion, or sexual +identity and orientation. + +We pledge to act and interact in ways that contribute to an open, welcoming, +diverse, inclusive, and healthy community. + +## Our Standards + +Examples of behavior that contributes to a positive environment for our +community include: + +* Demonstrating empathy and kindness toward other people +* Being respectful of differing opinions, viewpoints, and experiences +* Giving and gracefully accepting constructive feedback +* Accepting responsibility and apologizing to those affected by our mistakes, + and learning from the experience +* Focusing on what is best not just for us as individuals, but for the overall + community + +Examples of unacceptable behavior include: + +* The use of sexualized language or imagery, and sexual attention or advances of + any kind +* Trolling, insulting or derogatory comments, and personal or political attacks +* Public or private harassment +* Publishing others' private information, such as a physical or email address, + without their explicit permission +* Other conduct which could reasonably be considered inappropriate in a + professional setting + +## Enforcement Responsibilities + +Community leaders are responsible for clarifying and enforcing our standards of +acceptable behavior and will take appropriate and fair corrective action in +response to any behavior that they deem inappropriate, threatening, offensive, +or harmful. + +Community leaders have the right and responsibility to remove, edit, or reject +comments, commits, code, wiki edits, issues, and other contributions that are +not aligned to this Code of Conduct, and will communicate reasons for moderation +decisions when appropriate. + +## Scope + +This Code of Conduct applies within all community spaces, and also applies when +an individual is officially representing the community in public spaces. +Examples of representing our community include using an official e-mail address, +posting via an official social media account, or acting as an appointed +representative at an online or offline event. + +## Enforcement + +Instances of abusive, harassing, or otherwise unacceptable behavior may be +reported to the community leaders responsible for enforcement by opening a +[private security advisory](https://github.com/RavenRepo/cachyossystem/security/advisories/new) +on this repository (visible only to the maintainers) or by contacting the +maintainer through their [GitHub profile](https://github.com/RavenRepo). +All complaints will be reviewed and investigated promptly and fairly. + +All community leaders are obligated to respect the privacy and security of the +reporter of any incident. + +## Enforcement Guidelines + +Community leaders will follow these Community Impact Guidelines in determining +the consequences for any action they deem in violation of this Code of Conduct: + +### 1. Correction + +**Community Impact**: Use of inappropriate language or other behavior deemed +unprofessional or unwelcome in the community. + +**Consequence**: A private, written warning from community leaders, providing +clarity around the nature of the violation and an explanation of why the +behavior was inappropriate. A public apology may be requested. + +### 2. Warning + +**Community Impact**: A violation through a single incident or series of +actions. + +**Consequence**: A warning with consequences for continued behavior. No +interaction with the people involved, including unsolicited interaction with +those enforcing the Code of Conduct, for a specified period of time. This +includes avoiding interactions in community spaces as well as external channels +like social media. Violating these terms may lead to a temporary or permanent +ban. + +### 3. Temporary Ban + +**Community Impact**: A serious violation of community standards, including +sustained inappropriate behavior. + +**Consequence**: A temporary ban from any sort of interaction or public +communication with the community for a specified period of time. No public or +private interaction with the people involved, including unsolicited interaction +with those enforcing the Code of Conduct, is allowed during this period. +Violating these terms may lead to a permanent ban. + +### 4. Permanent Ban + +**Community Impact**: Demonstrating a pattern of violation of community +standards, including sustained inappropriate behavior, harassment of an +individual, or aggression toward or disparagement of classes of individuals. + +**Consequence**: A permanent ban from any sort of public interaction within the +community. + +## Attribution + +This Code of Conduct is adapted from the [Contributor Covenant][homepage], +version 2.1, available at +[https://www.contributor-covenant.org/version/2/1/code_of_conduct.html][v2.1]. + +Community Impact Guidelines were inspired by +[Mozilla's code of conduct enforcement ladder][Mozilla CoC]. + +For answers to common questions about this code of conduct, see the FAQ at +[https://www.contributor-covenant.org/faq][FAQ]. Translations are available at +[https://www.contributor-covenant.org/translations][translations]. + +[homepage]: https://www.contributor-covenant.org +[v2.1]: https://www.contributor-covenant.org/version/2/1/code_of_conduct.html +[Mozilla CoC]: https://github.com/mozilla/diversity +[FAQ]: https://www.contributor-covenant.org/faq +[translations]: https://www.contributor-covenant.org/translations diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md new file mode 100644 index 0000000..10f2803 --- /dev/null +++ b/CONTRIBUTING.md @@ -0,0 +1,66 @@ +# Contributing + +Thanks for helping improve this workstation guide. Fixes to docs and scripts, +corrections for newer CachyOS/GNOME releases, and well-reasoned additions are +all welcome. + +By participating you agree to follow the [Code of Conduct](CODE_OF_CONDUCT.md). +For security problems, do not open an issue: see [SECURITY.md](SECURITY.md). + +## How the repo is organised + +| Path | Purpose | +|---|---| +| `README.md` | Entry point and overview | +| `docs/00-*.md` to `docs/15-*.md` | One document per setup phase | +| `scripts/NN-*.sh` | Automation for a phase, run in numeric order | +| `scripts/verify.sh` | Read-only verification of the whole workstation | + +## Ground rules + +- **Review before running.** This is a guide, not a one-click installer. Keep + each phase readable and independently runnable. +- **Never commit secrets**, tokens, keys, `.env` files with values, VPN or mesh + auth keys, or browser profiles. +- **Do not publish host-specific details** such as IP addresses, hostnames, + open ports, firewall rule sets, or key material. Describe the approach, not + the specifics of one machine. +- **Prefer official repositories over the AUR.** Use upstream installers only + for fast-moving tools (for example AI CLIs), and say so in the doc. +- **Verify before you claim.** Version numbers and "installed" statements + should come from a real system, with the observation date. +- Keep changes small and focused: one concern per pull request. + +## Making a change + +1. Fork the repository and create a branch from `main` + (`docs/`, `fix/` or `feat/`). +2. Edit the relevant doc, and the matching script in `scripts/` if the change + affects what gets installed. Keep the two in sync. +3. For shell scripts, run `bash -n script.sh` and, if available, + `shellcheck script.sh`. Use `set -euo pipefail` for new scripts and quote + variables. +4. Run `scripts/verify.sh` and confirm it passes on your system. It is + read-only and exits non-zero if anything prescribed is missing. +5. Update the README or related docs if behaviour or recommendations changed. +6. Open a pull request using the template and describe what you tested. + +## Commit messages + +Use a short imperative summary with an optional prefix, for example: + +```text +docs: record obs-studio as installed +fix(scripts): quote package list in 02-development.sh +feat(gnome): add theming phase +``` + +## Reporting bugs and requesting features + +Use the issue templates. For a bug, include your CachyOS and GNOME versions +(`fastfetch` or `gnome-shell --version`), the phase or script involved, and the +exact output. Remove any personal or host-specific details before pasting. + +## License + +Contributions are licensed under the [MIT License](LICENSE). diff --git a/README.md b/README.md index 2ae7f8d..60a8d0b 100644 --- a/README.md +++ b/README.md @@ -1758,6 +1758,13 @@ Official documentation should take precedence over this repository when software MIT. See [LICENSE](LICENSE). +# 43. Contributing and community + +- [Contributing guide](CONTRIBUTING.md): ground rules, workflow, commit style +- [Code of Conduct](CODE_OF_CONDUCT.md): Contributor Covenant 2.1 +- [Security policy](SECURITY.md): report vulnerabilities privately, not in public issues +- Bugs and feature requests: use the [issue templates](https://github.com/RavenRepo/cachyossystem/issues/new/choose) + ---
diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..f24d847 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,55 @@ +# Security Policy + +This repository documents and scripts a CachyOS + GNOME developer workstation. +It contains documentation and shell scripts, not a hosted service, but the +scripts install software and change system configuration, so security matters. + +## Supported versions + +Only the latest commit on `main` is maintained. Docs are audited against a live +system periodically (see the "last audit" date in the README); older revisions +do not receive fixes. + +## Reporting a vulnerability + +**Do not open a public issue for security problems.** + +Report privately through GitHub: +[Report a vulnerability](https://github.com/RavenRepo/cachyossystem/security/advisories/new). + +Please include: + +- The affected file(s) and the commit or date you looked at +- What an attacker could do, and under what conditions +- Steps to reproduce, or a minimal proof of concept +- A suggested fix, if you have one + +You can expect an acknowledgement within 7 days and a fix or an explanation +within 30 days. Credit is given in the fix commit unless you ask otherwise. + +## In scope + +- Scripts in `scripts/` that could run attacker-controlled code, fetch + software over an insecure channel, or leave files with unsafe permissions +- Documentation that recommends an insecure configuration (for example a + firewall, SSH, secrets-handling, or privilege-escalation step that weakens + the host) +- Accidentally committed secrets, tokens, keys, or personal data + +## Out of scope + +- Vulnerabilities in third-party software this repo only installs (report those + to the upstream project) +- Issues that require an attacker to already have root on your machine +- Findings that depend on a configuration this repo does not recommend + +## Repository hygiene + +- No secrets, tokens, keys, `.env` files with values, VPN/mesh auth keys, or + browser profiles are committed. If you find one, report it privately as + above so it can be removed and rotated. +- Documentation describes how the workstation is built, and avoids publishing + host-specific details (addresses, hostnames, open ports, rule sets, key + material) that would help someone target a particular machine. +- Scripts are meant to be read before they are run. This is not a one-click + installer, and nothing here should be piped to a shell without review.