diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..4d9ae2f --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,51 @@ +# SPDX-License-Identifier: MPL-2.0 +# Dependabot configuration for RSR-compliant repositories +# Covers common ecosystems - remove unused ones for your project + +version: 2 +updates: + # GitHub Actions - always include + - package-ecosystem: "github-actions" + directory: "/" + schedule: + interval: "weekly" + groups: + actions: + patterns: + - "*" + + # Rust/Cargo + - package-ecosystem: "cargo" + directory: "/" + schedule: + interval: "weekly" + # `open-pull-requests-limit: 0` suppresses routine version-update PRs + # while leaving Dependabot SECURITY PRs flowing. The previous + # `ignore: "*" patch` rule also silenced security PRs under GitHub\'s + # current Dependabot behaviour. See rsr-template-repo commit 78b050e + # and 007-lang/audits/audit-dependabot-automation-gap-2026-04-17.md. + open-pull-requests-limit: 0 + + # Elixir/Mix + - package-ecosystem: "mix" + directory: "/" + schedule: + interval: "weekly" + + # Node.js/npm + - package-ecosystem: "npm" + directory: "/" + schedule: + interval: "weekly" + + # Python/pip + - package-ecosystem: "pip" + directory: "/" + schedule: + interval: "weekly" + + # Nix flakes + - package-ecosystem: "nix" + directory: "/" + schedule: + interval: "weekly" diff --git a/.github/workflows/cargo-audit.yml b/.github/workflows/cargo-audit.yml index bdfb83c..8dd44ac 100644 --- a/.github/workflows/cargo-audit.yml +++ b/.github/workflows/cargo-audit.yml @@ -16,6 +16,7 @@ on: - cron: '0 6 * * 1' # Weekly on Monday permissions: read-all + actions: read jobs: audit: diff --git a/.github/workflows/generator-generic-ossf-slsa3-publish.yml b/.github/workflows/generator-generic-ossf-slsa3-publish.yml index d266bcf..aa19ccf 100644 --- a/.github/workflows/generator-generic-ossf-slsa3-publish.yml +++ b/.github/workflows/generator-generic-ossf-slsa3-publish.yml @@ -18,6 +18,7 @@ on: types: [created] permissions: + actions: read contents: read jobs: diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index 62bbc98..906741d 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -27,6 +27,7 @@ concurrency: cancel-in-progress: true permissions: + actions: read contents: read jobs: diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml index 2e7e939..013c95a 100644 --- a/.github/workflows/hypatia-scan.yml +++ b/.github/workflows/hypatia-scan.yml @@ -19,6 +19,7 @@ concurrency: cancel-in-progress: true permissions: + actions: read contents: read security-events: write pull-requests: write diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml index c78489a..0273437 100755 --- a/.github/workflows/pages.yml +++ b/.github/workflows/pages.yml @@ -5,6 +5,7 @@ on: branches: [main, master] workflow_dispatch: permissions: + actions: read contents: read pages: write id-token: write diff --git a/.github/workflows/php.yml b/.github/workflows/php.yml index cfc1e5a..7d56b55 100644 --- a/.github/workflows/php.yml +++ b/.github/workflows/php.yml @@ -8,6 +8,7 @@ on: branches: [ "main" ] permissions: + actions: read contents: read jobs: diff --git a/.github/workflows/push-email-notify.yml b/.github/workflows/push-email-notify.yml index 0816771..ce036e2 100644 --- a/.github/workflows/push-email-notify.yml +++ b/.github/workflows/push-email-notify.yml @@ -7,6 +7,7 @@ name: Push email notification on: push: {} permissions: + actions: read contents: read jobs: notify: diff --git a/.github/workflows/rust.yml b/.github/workflows/rust.yml index f5bca70..daea490 100644 --- a/.github/workflows/rust.yml +++ b/.github/workflows/rust.yml @@ -11,6 +11,7 @@ env: CARGO_TERM_COLOR: always permissions: + actions: read contents: read jobs: diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index 9ed74ef..010c16d 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -11,6 +11,7 @@ concurrency: cancel-in-progress: true permissions: + actions: read contents: read jobs: @@ -19,5 +20,5 @@ jobs: contents: read pull-requests: write actions: read - uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@d135b05bfc647d0c0fbfedc7e80f37ea50f49236 + uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@7fdc2705df74b4e352d2a1cde3e87a5923fdf329 secrets: inherit \ No newline at end of file diff --git a/.github/workflows/workflow-linter.yml b/.github/workflows/workflow-linter.yml index 636a055..77f8756 100644 --- a/.github/workflows/workflow-linter.yml +++ b/.github/workflows/workflow-linter.yml @@ -11,6 +11,7 @@ on: - '.github/workflows/**' permissions: read-all + actions: read jobs: lint-workflows: diff --git a/CODE_OF_CONDUCT.md b/CODE_OF_CONDUCT.md new file mode 100644 index 0000000..8267cd4 --- /dev/null +++ b/CODE_OF_CONDUCT.md @@ -0,0 +1,327 @@ +# Code of Conduct + + + +## Our Pledge + +We as members, contributors, and leaders pledge to make participation in Squisher Corpus a harassment-free experience for everyone, regardless of age, body size, visible or invisible disability, ethnicity, sex characteristics, gender identity and expression, level of experience, education, socio-economic status, nationality, personal appearance, race, caste, colour, religion, or sexual identity and orientation. + +We pledge to act and interact in ways that contribute to an open, welcoming, diverse, inclusive, and healthy community. + +We recognise that a thriving open source community requires **psychological safety** — an environment where people can contribute, ask questions, make mistakes, and learn without fear of ridicule or retaliation. + +--- + +## Our Standards + +### Expected Behaviour + +The following behaviours contribute to a positive environment: + +**Communication** +- Using welcoming and inclusive language +- Being respectful of differing viewpoints and experiences +- Giving and gracefully accepting constructive feedback +- Assuming good intent while addressing impact +- Communicating clearly and patiently, especially with newcomers + +**Collaboration** +- Focusing on what is best for the community +- Showing empathy and kindness toward other community members +- Being collaborative rather than competitive +- Mentoring and supporting less experienced contributors +- Celebrating others' contributions and successes + +**Professionalism** +- Accepting responsibility and apologising to those affected by our mistakes +- Learning from the experience and avoiding repetition +- Respecting others' time and attention +- Staying on topic in project spaces +- Following project guidelines and conventions + +**Accessibility** +- Using plain language and avoiding unnecessary jargon +- Providing alt text for images and transcripts for audio/video +- Being patient with those using assistive technologies +- Accommodating different communication styles and needs +- Recognising that not everyone communicates the same way + +### Unacceptable Behaviour + +The following behaviours are considered harassment and are unacceptable: + +**Harassment** +- The use of sexualised language or imagery, and sexual attention or advances of any kind +- Trolling, insulting or derogatory comments, and personal or political attacks +- Public or private harassment +- Deliberate intimidation, stalking, or following (online or in-person) +- Unwelcome physical contact or simulated physical contact (e.g., emoji) +- Sustained disruption of talks, events, or online discussions + +**Discrimination** +- Discriminatory jokes and language +- Posting or threatening to post others' personally identifying information ("doxing") +- Advocating for, or encouraging, any of the above behaviour +- Microaggressions — subtle, often unintentional, discriminatory comments or actions + +**Professional Misconduct** +- Publishing others' private information without explicit permission +- Misrepresenting affiliation or contributions +- Plagiarism or claiming credit for others' work +- Retaliating against anyone who reports a Code of Conduct violation +- Other conduct which could reasonably be considered inappropriate in a professional setting + +### Grey Areas + +Some situations require judgement. When uncertain: + +- **Intent vs Impact**: Good intentions do not excuse harmful impact. Focus on making things right. +- **Power Dynamics**: Those with more power (maintainers, employers, experienced contributors) must be especially mindful of their impact. +- **Cultural Differences**: What's acceptable varies by culture. When in doubt, err on the side of caution and ask. +- **Humour**: Jokes at others' expense are rarely funny to everyone. Punch up, not down. + +--- + +## Scope + +This Code of Conduct applies within all community spaces, including: + +**Online Spaces** +- Repository discussions, issues, and pull/merge requests +- Project chat channels (Matrix, Discord, Slack, IRC) +- Mailing lists and forums +- Social media when representing the project +- Video calls and virtual meetings + +**In-Person Spaces** +- Conferences, meetups, and events +- Workshops and training sessions +- Any gathering where you represent the project + +**Representation** +This Code of Conduct also applies when an individual is officially representing the community in public spaces. Examples include: + +- Using an official project email address +- Posting via an official social media account +- Acting as an appointed representative at an event +- Speaking on behalf of the project + +--- + +## Enforcement + +### Reporting + +If you experience or witness unacceptable behaviour, or have any other concerns, please report it as soon as possible. + +**How to Report** + +| Method | Details | Best For | +|--------|---------|----------| +| **Email** | j.d.a.jewell@open.ac.uk | Detailed reports, sensitive matters | +| **Private Message** | Contact any maintainer directly | Quick questions, minor issues | +| **Anonymous Form** | [Link to form if available] | When you need anonymity | + +**What to Include** + +- Your contact information (unless anonymous) +- Names/usernames of those involved +- Description of what happened +- When and where it occurred +- Any witnesses +- Any supporting evidence (screenshots, links) +- How you would like us to respond (if you have a preference) + +**What Happens Next** + +1. You will receive acknowledgment within **48 hours** +2. The maintainers will review the report +3. We may ask for additional information +4. We will determine appropriate action +5. We will inform you of the outcome (respecting others' privacy) + +### Confidentiality + +All reports will be handled with discretion: + +- Reporter identity is protected by default +- Details are shared only with those who need to know +- We will ask before naming you in any communication +- Anonymous reports are accepted and investigated + +### Conflicts of Interest + +If a maintainers member is involved in an incident: + +- They will recuse themselves from the process +- Another maintainer or external party will handle the report +- We will disclose any potential conflicts + +--- + +## Enforcement Guidelines + +The maintainers will follow these guidelines in determining consequences: + +### 1. Correction + +**Community Impact**: Use of inappropriate language or other behaviour deemed unprofessional or unwelcome. + +**Consequence**: A private, written warning providing clarity around the nature of the violation and an explanation of why the behaviour was inappropriate. A public apology may be requested. + +**Duration**: Immediate + +### 2. Warning + +**Community Impact**: A violation through a single incident or series of actions. + +**Consequence**: A warning with consequences for continued behaviour. No interaction with the people involved, including unsolicited interaction with those enforcing the Code of Conduct, for a specified period. This includes avoiding interactions in community spaces as well as external channels like social media. Violating these terms may lead to a temporary or permanent ban. + +**Duration**: 1-4 weeks + +### 3. Temporary Ban + +**Community Impact**: A serious violation of community standards, including sustained inappropriate behaviour. + +**Consequence**: A temporary ban from any sort of interaction or public communication with the community for a specified period. No public or private interaction with the people involved, including unsolicited interaction with those enforcing the Code of Conduct, is allowed during this period. Violating these terms may lead to a permanent ban. + +**Duration**: 1-6 months + +### 4. Permanent Ban + +**Community Impact**: Demonstrating a pattern of violation of community standards, including sustained inappropriate behaviour, harassment of an individual, or aggression toward or disparagement of classes of individuals. + +**Consequence**: A permanent ban from any sort of public interaction within the community. + +**Duration**: Permanent (with appeal rights after 12 months) + +### Enforcement Across Perimeters + +For contributors with elevated access (Perimeter 2 or 1): + +| Level | Additional Consequence | +|-------|----------------------| +| Correction | Noted in contributor record | +| Warning | Access privileges may be temporarily reduced | +| Temporary Ban | Access reduced to Perimeter 3 for ban duration | +| Permanent Ban | All access revoked | + +--- + +## Appeals + +If you believe an enforcement decision was made in error: + +1. **Wait 7 days** after the decision (cooling-off period) +2. **Email** j.d.a.jewell@open.ac.uk with subject line "Appeal: [Original Report ID]" +3. **Explain** why you believe the decision should be reconsidered +4. **Provide** any new information not previously available + +**Appeals Process** + +- Appeals are reviewed by a different maintainers member than the original +- You will receive a response within 14 days +- The appeals decision is final +- You may only appeal once per incident + +**Grounds for Appeal** + +- Procedural errors in the original investigation +- New evidence not previously available +- Disproportionate response to the violation +- Misunderstanding of facts + +--- + +## Supporting Those Who Report + +We are committed to supporting those who report violations: + +**We Will** +- Believe and take all reports seriously +- Respect your privacy and confidentiality preferences +- Keep you informed of progress (if you wish) +- Take steps to protect you from retaliation +- Provide resources if you need support + +**We Will Not** +- Require you to confront the person directly +- Dismiss reports without investigation +- Reveal your identity without consent +- Tolerate retaliation against reporters +- Rush you to make decisions + +--- + +## Prevention + +Beyond enforcement, we actively work to prevent issues: + +**Onboarding** +- All contributors are expected to read this Code of Conduct +- Perimeter 2 applicants must confirm they've read and understood it +- Maintainers receive additional training on enforcement + +**Culture** +- We model the behaviour we expect +- We intervene early when we see potential issues +- We thank people for positive contributions +- We create opportunities for diverse voices + +**Review** +- This Code of Conduct is reviewed annually +- Community feedback is welcomed +- Changes are communicated clearly + +--- + +## Acknowledgments + +This Code of Conduct is adapted from: + +- [Contributor Covenant](https://www.contributor-covenant.org/), version 2.1 +- [Django Code of Conduct](https://www.djangoproject.com/conduct/) +- [Rust Code of Conduct](https://www.rust-lang.org/policies/code-of-conduct) +- [Python Community Code of Conduct](https://www.python.org/psf/conduct/) + +We thank these communities for their leadership in creating welcoming spaces. + +--- + +## Questions? + +If you have questions about this Code of Conduct: + +- Open a [Discussion](https://github.com/hyperpolymath/squisher-corpus/discussions) (for general questions) +- Email j.d.a.jewell@open.ac.uk (for private questions) +- Contact any maintainer directly + +--- + +## Summary + +**Be kind. Be respectful. Be collaborative.** + +We're all here because we care about this project. Let's make it a place where everyone can do their best work. + +--- + +Last updated: 2026 · Based on Contributor Covenant 2.1 diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md new file mode 100644 index 0000000..594b265 --- /dev/null +++ b/CONTRIBUTING.md @@ -0,0 +1,116 @@ +# Clone the repository +git clone https://github.com/hyperpolymath/squisher-corpus.git +cd squisher-corpus + +# Using Nix (recommended for reproducibility) +nix develop + +# Or using toolbox/distrobox +toolbox create squisher-corpus-dev +toolbox enter squisher-corpus-dev +# Install dependencies manually + +# Verify setup +just check # or: cargo check / mix compile / etc. +just test # Run test suite +``` + +### Repository Structure +``` +squisher-corpus/ +├── src/ # Source code (Perimeter 1-2) +├── lib/ # Library code (Perimeter 1-2) +├── extensions/ # Extensions (Perimeter 2) +├── plugins/ # Plugins (Perimeter 2) +├── tools/ # Tooling (Perimeter 2) +├── docs/ # Documentation (Perimeter 3) +│ ├── architecture/ # ADRs, specs (Perimeter 2) +│ └── proposals/ # RFCs (Perimeter 3) +├── examples/ # Examples (Perimeter 3) +├── spec/ # Spec tests (Perimeter 3) +├── tests/ # Test suite (Perimeter 2-3) +├── .well-known/ # Protocol files (Perimeter 1-3) +├── .github/ # GitHub config (Perimeter 1) +│ ├── ISSUE_TEMPLATE/ +│ └── workflows/ +├── CHANGELOG.md +├── CODE_OF_CONDUCT.md +├── CONTRIBUTING.md # This file +├── GOVERNANCE.md +├── LICENSE +├── MAINTAINERS.md +├── README.adoc +├── SECURITY.md +├── flake.nix # Nix flake (Perimeter 1) +└── Justfile # Task runner (Perimeter 1) +``` + +--- + +## How to Contribute + +### Reporting Bugs + +**Before reporting**: +1. Search existing issues +2. Check if it's already fixed in `main` +3. Determine which perimeter the bug affects + +**When reporting**: + +Use the [bug report template](.github/ISSUE_TEMPLATE/bug_report.md) and include: + +- Clear, descriptive title +- Environment details (OS, versions, toolchain) +- Steps to reproduce +- Expected vs actual behaviour +- Logs, screenshots, or minimal reproduction + +### Suggesting Features + +**Before suggesting**: +1. Check the [roadmap](ROADMAP.md) if available +2. Search existing issues and discussions +3. Consider which perimeter the feature belongs to + +**When suggesting**: + +Use the [feature request template](.github/ISSUE_TEMPLATE/feature_request.md) and include: + +- Problem statement (what pain point does this solve?) +- Proposed solution +- Alternatives considered +- Which perimeter this affects + +### Your First Contribution + +Look for issues labelled: + +- [`good first issue`](https://github.com/hyperpolymath/squisher-corpus/labels/good%20first%20issue) — Simple Perimeter 3 tasks +- [`help wanted`](https://github.com/hyperpolymath/squisher-corpus/labels/help%20wanted) — Community help needed +- [`documentation`](https://github.com/hyperpolymath/squisher-corpus/labels/documentation) — Docs improvements +- [`perimeter-3`](https://github.com/hyperpolymath/squisher-corpus/labels/perimeter-3) — Community sandbox scope + +--- + +## Development Workflow + +### Branch Naming +``` +docs/short-description # Documentation (P3) +test/what-added # Test additions (P3) +feat/short-description # New features (P2) +fix/issue-number-description # Bug fixes (P2) +refactor/what-changed # Code improvements (P2) +security/what-fixed # Security fixes (P1-2) +``` + +### Commit Messages + +We follow [Conventional Commits](https://www.conventionalcommits.org/): +``` +(): + +[optional body] + +[optional footer] diff --git a/GOVERNANCE.adoc b/GOVERNANCE.adoc deleted file mode 100644 index e3d211a..0000000 --- a/GOVERNANCE.adoc +++ /dev/null @@ -1,166 +0,0 @@ -= Project Wharf Governance -:toc: left -:icons: font - -== Overview - -Project Wharf is governed by a small group of Core Maintainers who make -decisions through consensus. This document outlines how decisions are made, -how maintainers are selected, and how the project operates. - -== Decision Making - -=== Consensus Model - -We use a **Lazy Consensus** model: - -1. Proposals are made via GitLab Issues or Merge Requests -2. A minimum 72-hour comment period is required for significant changes -3. If no objections, the proposal is accepted -4. If objections arise, discussion continues until consensus -5. If consensus cannot be reached, a vote is called - -=== Voting - -When consensus fails: - -* **Simple majority** (>50%) for operational decisions -* **Supermajority** (>66%) for architectural changes -* **Unanimous** for security-critical changes and new Core maintainers - -=== What Requires a Vote - -| Decision Type | Threshold | Comment Period | -|--------------|-----------|----------------| -| Bug fix | Lazy consensus | 24 hours | -| New feature | Lazy consensus | 72 hours | -| Breaking change | Supermajority | 1 week | -| Architecture change | Supermajority | 2 weeks | -| New Core maintainer | Unanimous | 2 weeks | -| License change | Unanimous | 1 month | - -== Roles - -=== Core Maintainers - -Core Maintainers have full commit access and are responsible for: - -* Reviewing and merging contributions -* Releasing new versions -* Security response -* Project direction - -Current Core Maintainers: - -* **Jonathan D. A. Jewell** (@hyperpolymath) - Founder, Lead - -=== Expert Contributors - -Expert Contributors have elevated trust and can: - -* Review Perimeter 3 contributions -* Approve non-critical MRs -* Triage issues - -See CONTRIBUTING.adoc for eligibility. - -=== Community Contributors - -Anyone can contribute at the Community level. See CONTRIBUTING.adoc. - -== Maintainer Selection - -=== Becoming a Core Maintainer - -1. **Nomination**: An existing Core maintainer nominates a candidate -2. **Evidence**: The nominator provides evidence of: - - Significant contributions - - Security awareness - - Community standing - - Long-term commitment -3. **Comment Period**: 2-week public comment period -4. **Vote**: Unanimous approval by existing Core -5. **Onboarding**: Access granted, added to MAINTAINERS.md - -=== Maintainer Removal - -A maintainer may be removed for: - -* Inactivity (>6 months without contribution) -* Code of Conduct violation -* Security breach -* Voluntary resignation - -Process: - -1. Private discussion among Core -2. Opportunity for the maintainer to respond -3. Vote (supermajority for removal) -4. Access revoked, removed from MAINTAINERS.md - -== Succession Planning - -If all Core maintainers become unavailable: - -1. Expert Contributors may elect new Core maintainers -2. If no Expert Contributors, the most active Community contributors -3. Repository may be transferred to a foundation (Software Freedom Conservancy) - -== Financial Governance - -=== Funding Sources - -* Individual sponsors (GitHub Sponsors, Liberapay) -* Corporate sponsors -* Grants - -=== Fund Allocation - -| Category | Percentage | -|----------|------------| -| Development | 50% | -| Security audits | 25% | -| Infrastructure | 15% | -| Documentation | 10% | - -=== Transparency - -* All sponsorships >$100 are publicly acknowledged -* Quarterly financial reports published -* Annual audit for funds >$10,000 - -== Code of Conduct Enforcement - -See CODE_OF_CONDUCT.adoc for the full Code of Conduct. - -=== Enforcement Committee - -The Core Maintainers serve as the Enforcement Committee. - -=== Conflict of Interest - -If a Core maintainer is involved in an incident: - -* They recuse themselves from the investigation -* Remaining Core decides -* If only one Core remains, an Expert Contributor is elevated - -== Amendments - -This governance document may be amended by: - -1. Proposal via Merge Request -2. 2-week comment period -3. Supermajority vote of Core Maintainers - -== Contact - -* **General governance questions**: governance@hyperpolymath.net -* **Code of Conduct issues**: conduct@hyperpolymath.net -* **Security issues**: security@hyperpolymath.net - -== Version History - -| Version | Date | Changes | -|---------|------|---------| -| 1.0.0 | 2025-11-26 | Initial governance document | diff --git a/guix.scm b/guix.scm deleted file mode 100644 index 14d6f0f..0000000 --- a/guix.scm +++ /dev/null @@ -1,25 +0,0 @@ -;; wharf - Guix Package Definition -;; Run: guix shell -D -f guix.scm - -(use-modules (guix packages) - (guix gexp) - (guix git-download) - (guix build-system cargo) - ((guix licenses) #:prefix license:) - (gnu packages base)) - -(define-public wharf - (package - (name "wharf") - (version "0.1.0") - (source (local-file "." "wharf-checkout" - #:recursive? #t - #:select? (git-predicate "."))) - (build-system cargo-build-system) - (synopsis "Rust application") - (description "Rust application - part of the RSR ecosystem.") - (home-page "https://github.com/hyperpolymath/wharf") - (license license:agpl3+))) - -;; Return package for guix shell -wharf