Conversation
Bakes in the resilience pattern (stale-cache-on-refresh-failure, no crash-loop on startup), rate limiting, and security headers from the start rather than as follow-up patches, per the reconciled context brief.
One coordinated documentation pass since these four reference each other: framing and scope (CONTEXT.md), vocabulary (LANGUAGE.md), structure and design decisions (ARCHITECTURE.md), and session rules (CLAUDE.md).
…urity tooling (#4) * Add community and governance files, flesh out README SECURITY.md, CONTRIBUTING.md, GOVERNANCE.md, CODE_OF_CONDUCT.md (Contributor Covenant v2.1, unmodified) didn't exist yet, built fresh rather than patched. README's deployment section names Render, matching ARCHITECTURE.md's ADR, rather than the stale Cloud Run reference in an earlier draft of this brief. * Add CHANGELOG.md Framed as a single [1.0.0] initial release rather than an Unreleased section building on a prior version, since this synthesizes the service's actual first shipped state rather than patching an existing changelog. * Add docker-compose.yml for local development * Add six custom skills under .claude/skills/ research, grill-with-doc, to-spec, to-tickets, implement, code-review, following a research -> interrogate -> spec -> tickets -> implement -> review shape built for this repo's own context. * Add .pre-commit-config.yaml trailing-whitespace/end-of-file-fixer/check-yaml/check-json/large-files, ruff + ruff-format, and two local hooks: no em dashes anywhere, and no stray mentions of one specific vendor's product name. Ran --all-files and fixed everything it flagged (ruff-format wrapped two lines in main.py) before committing. * Add CodeQL, Dependabot, and OpenSSF Scorecard CI Three Dependabot ecosystems (pip, docker, github-actions), not just Python, since the Dockerfile's base image and this repo's own Actions dependencies need patching too. Scorecard publishes results publicly, which is what README.md's badge (added in an earlier commit) links to.
* Add test skill: red-green-refactor TDD for this repo Test through the HTTP interface, not internals; never touch the real network; reset the module-level cache and rate limiter between tests; one behavior per test. Matches this repo's existing research -> grill-with-doc -> to-spec -> to-tickets -> implement shape, slotted in during implement. * Add pytest suite covering all four routes and the resilience pattern 14 tests, following the new test skill: happy paths and 404s for every route, mitigation neutrality (only the mitigation object, 404 when a record has none), search matching across all four documented fields, rate limiting present on a route, and the three resilience behaviors from CLAUDE.md (stale-serve on refresh failure, hard-fail only when the cache was never populated, no crash-loop on a failed initial fetch). All tests monkeypatch _refresh_cache, no real network access.
Both previously only ran on push to main. Since develop is where work actually lands first, scanning stopped there meant a window between merge to develop and the next develop-to-main sync where new code had no CodeQL or Scorecard coverage at all.
The build never copied constants.py after main.py started importing from it, so the container crashed on startup with ModuleNotFoundError inside Docker even though python3 -m py_compile passed locally (that check never runs inside the actual container). Verified by building the image and running it: previously exited immediately with ModuleNotFoundError: No module named 'constants'; now starts, binds the port, and serves real data.
The Dockerfile-missing-constants.py fix (#18) merged with a COPY line that builds fine locally under BuildKit (which normalizes . to a directory) but fails on Cloud Build's classic docker builder, which enforces the Dockerfile spec strictly: a multi-source COPY's destination must end with /. Reproduced the exact Cloud Build error locally with DOCKER_BUILDKIT=0, confirmed this fix resolves it under the same strict builder, and confirmed the resulting image starts and serves real data (curl to / returns 200).
ARCHITECTURE.md's ADR, README.md's Deployment section, and CHANGELOG.md now say Cloud Run rather than Render, since the first production deployment landed there instead. Kept the original Render reasoning in the ADR rather than erasing it, since ADRs record decisions at the time they were made and the switch itself is part of the record. Confirmed live: GET / on the deployed *.run.app URL returns real data (record_count: 59) matching the local verification from earlier.
ossf/scorecard-action only supports running against the repo's default branch: a push to develop failed the action outright with "validating options: only default branch is supported" / "Only the default branch main is supported." CodeQL has no such restriction and keeps running on both main and develop; this reverts only the Scorecard side of the earlier change.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.