Skip to content

Commit eb0c87a

Browse files
xiaojiou176xiaojiou176
committed
chore(governance): add repo guardrails
1 parent cd40a2c commit eb0c87a

320 files changed

Lines changed: 76458 additions & 0 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/CODEOWNERS‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
# Default maintainer ownership.
2+
3+
* @xiaojiou176

‎.github/ISSUE_TEMPLATE/bug_report.md‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
---
2+
name: Bug report
3+
about: Report a reproducible repository bug
4+
title: "[bug] "
5+
labels: bug
6+
assignees: ""
7+
---
8+
9+
## Summary
10+
11+
Describe the bug in one short paragraph.
12+
13+
## Reproduction
14+
15+
1. Exact command(s):
16+
2. Exact file/path(s):
17+
3. Expected result:
18+
4. Actual result:
19+
20+
## Evidence
21+
22+
- logs or terminal output
23+
- relevant report/artifact path
24+
- commit/branch or workspace context if relevant
25+
26+
## Scope
27+
28+
- [ ] This is a narrow bug fix request
29+
- [ ] This is not a broad feature request
30+
- [ ] I checked README/docs before filing
31+
- [ ] I included commands, paths, and evidence

‎.github/ISSUE_TEMPLATE/config.yml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
blank_issues_enabled: false
2+
contact_links:
3+
- name: Security report
4+
url: https://github.com/xiaojiou176-open/CortexPilot-public/blob/main/SECURITY.md
5+
about: Do not open a public issue for vulnerabilities; use SECURITY.md for the live GitHub advisory form path. A second verified fallback private channel is still a maintainer follow-up item, not a public issue workflow.
6+
- name: Support guide
7+
url: https://github.com/xiaojiou176-open/CortexPilot-public/blob/main/SUPPORT.md
8+
about: Use SUPPORT.md for public bugs, docs fixes, and usage questions before opening an issue.

‎.github/ISSUE_TEMPLATE/docs_drift.md‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
---
2+
name: Docs drift
3+
about: Report factual drift between docs and implementation
4+
title: "[docs-drift] "
5+
labels: documentation
6+
assignees: ""
7+
---
8+
9+
## Drift Summary
10+
11+
What fact is wrong, stale, or duplicated?
12+
13+
## Source Of Truth
14+
15+
Which file, command, or generated artifact should be treated as authoritative?
16+
17+
## Affected Docs
18+
19+
List the path(s) that currently drift.
20+
21+
## Evidence
22+
23+
Provide the command output, file path, or generated artifact that proves the drift.

‎.github/ci/high_risk_paths.txt‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
# High-risk path rules for PR full-ci escalation.
2+
# One shell-glob pattern per line. Supports ** and * style matching in bash [[ ]].
3+
4+
# CI/workflow/policy surfaces
5+
.github/workflows/**
6+
policies/**
7+
tooling/registry.json
8+
9+
# Core orchestrator runtime and dependency lock surfaces
10+
apps/orchestrator/src/**
11+
apps/orchestrator/pyproject.toml
12+
apps/orchestrator/requirements.txt
13+
apps/orchestrator/uv.lock
14+
15+
# Dashboard/desktop runtime surfaces
16+
apps/dashboard/app/**
17+
apps/dashboard/components/**
18+
apps/dashboard/lib/**
19+
apps/desktop/src/**
20+
apps/desktop/src-tauri/src/**
21+
22+
# Env governance SSOT
23+
configs/env.registry.json
24+
configs/env_tiers.json
25+
26+
# CI entry scripts / hard gates
27+
scripts/ci.sh
28+
scripts/test.sh
29+
scripts/bootstrap.sh
30+
scripts/pre_commit_lint_gate.sh
31+
scripts/pre_commit_quality_gate.sh
32+
scripts/check_env_governance.py

‎.github/codeql/codeql-config.yml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
name: cortexpilot-codeql
2+
3+
paths-ignore:
4+
- .runtime-cache/**
5+
- apps/desktop/src-tauri/target/**
6+
- apps/dashboard/.next/**
7+
- apps/dashboard/node_modules/**
8+
- apps/desktop/node_modules/**

‎.github/dependabot.yml‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
version: 2
2+
updates:
3+
- package-ecosystem: "github-actions"
4+
directory: "/"
5+
schedule:
6+
interval: "weekly"
7+
open-pull-requests-limit: 5
8+
cooldown:
9+
default-days: 7
10+
- package-ecosystem: "npm"
11+
directory: "/"
12+
schedule:
13+
interval: "weekly"
14+
open-pull-requests-limit: 5
15+
cooldown:
16+
default-days: 7
17+
- package-ecosystem: "npm"
18+
directory: "/apps/dashboard"
19+
schedule:
20+
interval: "weekly"
21+
open-pull-requests-limit: 5
22+
cooldown:
23+
default-days: 7
24+
- package-ecosystem: "npm"
25+
directory: "/apps/desktop"
26+
schedule:
27+
interval: "weekly"
28+
open-pull-requests-limit: 5
29+
cooldown:
30+
default-days: 7
31+
- package-ecosystem: "pip"
32+
directory: "/apps/orchestrator"
33+
schedule:
34+
interval: "weekly"
35+
open-pull-requests-limit: 5
36+
cooldown:
37+
default-days: 7
38+
- package-ecosystem: "cargo"
39+
directory: "/apps/desktop/src-tauri"
40+
schedule:
41+
interval: "weekly"
42+
open-pull-requests-limit: 5
43+
cooldown:
44+
default-days: 7

‎.github/dependency-review-config.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
fail-on-severity: high
2+
license-check: true
3+
warn-only: false

‎.github/pull_request_template.md‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
## Summary
2+
3+
- what changed
4+
- why it changed
5+
6+
## Verification
7+
8+
- exact command(s) run
9+
- result(s)
10+
11+
## Docs / Policy Impact
12+
13+
- docs updated: yes/no
14+
- env registry updated if needed: yes/no
15+
- runtime/output policy updated if needed: yes/no
16+
- public-boundary docs updated if positioning, support, privacy, rights, or third-party claims changed: yes/no
17+
- security reporting docs updated if the vulnerability intake path or fallback guidance changed: yes/no
18+
19+
## Submission Terms
20+
21+
- [ ] I confirm I have the right to submit this contribution
22+
- [ ] I confirm this contribution does not violate third-party rights, employer obligations, or confidentiality duties
23+
- [ ] I agree that this contribution is submitted under the repository license
24+
- [ ] I did not include runtime output, secrets, or unrelated cleanup
25+
26+
## Risks
27+
28+
- unresolved risks
29+
- follow-up items if any
30+
- if this change affects vulnerability intake or private disclosure handling, note whether a maintainer follow-up is still required before calling the security surface closed

‎.github/workflows/changed-scope-quality-weekly.yml‎

Lines changed: 132 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,132 @@
1+
name: changed-scope-quality-weekly
2+
3+
on:
4+
schedule:
5+
- cron: '45 3 * * 1'
6+
workflow_dispatch:
7+
inputs:
8+
feedback_jsonl_path:
9+
description: 'Custom feedback JSONL path (optional)'
10+
required: false
11+
type: string
12+
default: ''
13+
pull_request:
14+
branches:
15+
- main
16+
paths:
17+
- 'scripts/report_changed_scope_quality.py'
18+
- 'configs/changed_scope/rule_tuning.json'
19+
- 'tests/fixtures/changed_scope/changed-scope-feedback.schema.json'
20+
- 'tests/fixtures/changed_scope/changed-scope-feedback.sample.jsonl'
21+
- '.github/workflows/changed-scope-quality-weekly.yml'
22+
23+
permissions:
24+
contents: read
25+
26+
jobs:
27+
changed-scope-quality:
28+
runs-on: ubuntu-24.04
29+
permissions:
30+
contents: read
31+
actions: write
32+
steps:
33+
- name: Initialize Runner Tool Cache Env
34+
run: |
35+
echo "AGENT_TOOLSDIRECTORY=${RUNNER_TEMP}/hostedtoolcache-${GITHUB_JOB}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "${GITHUB_ENV}"
36+
echo "RUNNER_TOOL_CACHE=${RUNNER_TEMP}/hostedtoolcache-${GITHUB_JOB}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "${GITHUB_ENV}"
37+
38+
- name: Checkout
39+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
40+
with:
41+
fetch-depth: 0
42+
persist-credentials: false
43+
clean: true
44+
45+
- name: Prepare input
46+
id: prep
47+
env:
48+
CUSTOM_INPUT: ${{ github.event.inputs.feedback_jsonl_path || '' }}
49+
run: |
50+
set -euo pipefail
51+
mkdir -p .runtime-cache/test_output/changed_scope_quality/input
52+
custom_input="${CUSTOM_INPUT}"
53+
default_input=".runtime-cache/test_output/changed_scope/feedback.jsonl"
54+
input_path="${default_input}"
55+
if [[ -n "${custom_input}" ]]; then
56+
input_path="${custom_input}"
57+
fi
58+
if [[ ! -f "${input_path}" ]]; then
59+
input_path=".runtime-cache/test_output/changed_scope_quality/input/feedback.sample.jsonl"
60+
cp tests/fixtures/changed_scope/changed-scope-feedback.sample.jsonl "${input_path}"
61+
echo "[changed-scope-quality] feedback input missing, fallback to sample dataset"
62+
sample_fallback_used="1"
63+
else
64+
sample_fallback_used="0"
65+
fi
66+
{
67+
echo "sample_fallback_used=${sample_fallback_used}"
68+
echo "input_path=${input_path}"
69+
} >> "${GITHUB_OUTPUT}"
70+
71+
- name: Generate changed-scope quality report via docker_ci lane
72+
env:
73+
INPUT_PATH: ${{ steps.prep.outputs.input_path }}
74+
run: |
75+
set -euo pipefail
76+
bash scripts/docker_ci.sh lane changed-scope-quality \
77+
--input-jsonl "${INPUT_PATH}" \
78+
--output-dir ".runtime-cache/test_output/changed_scope_quality" \
79+
--base-config "configs/changed_scope/rule_tuning.json"
80+
81+
- name: Publish summary
82+
if: always()
83+
env:
84+
RUN_ID: ${{ github.run_id }}
85+
INPUT_PATH: ${{ steps.prep.outputs.input_path }}
86+
SAMPLE_FALLBACK_USED: ${{ steps.prep.outputs.sample_fallback_used }}
87+
run: |
88+
set -euo pipefail
89+
latest_week="$(find .runtime-cache/test_output/changed_scope_quality -mindepth 1 -maxdepth 1 -type d -printf '%f\n' | sort | tail -n 1)"
90+
summary_md=".runtime-cache/test_output/changed_scope_quality/${latest_week}/changed_scope_quality.summary.md"
91+
if [[ -f "${summary_md}" ]]; then
92+
{
93+
echo "## changed-scope-quality-weekly"
94+
echo "- run_id: ${RUN_ID}"
95+
echo "- input: \`${INPUT_PATH}\`"
96+
echo "- sample_fallback_used: \`${SAMPLE_FALLBACK_USED}\`"
97+
echo ""
98+
cat "${summary_md}"
99+
} >> "${GITHUB_STEP_SUMMARY}"
100+
fi
101+
102+
- name: Emit truth-mode marker
103+
if: always()
104+
env:
105+
SAMPLE_FALLBACK_USED: ${{ steps.prep.outputs.sample_fallback_used }}
106+
run: |
107+
set -euo pipefail
108+
mkdir -p .runtime-cache/test_output/changed_scope_quality/meta
109+
if [[ "${SAMPLE_FALLBACK_USED}" == "1" ]]; then
110+
sample_fallback_used=true
111+
else
112+
sample_fallback_used=false
113+
fi
114+
cat > .runtime-cache/test_output/changed_scope_quality/meta/truth_status.json <<EOF
115+
{
116+
"report_type": "cortexpilot_changed_scope_truth_status",
117+
"sample_fallback_used": ${sample_fallback_used},
118+
"analytics_only": true,
119+
"blocking_quality_gate": false,
120+
"release_truth_eligible": false
121+
}
122+
EOF
123+
124+
- name: Upload changed-scope quality artifacts
125+
if: always()
126+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
127+
with:
128+
name: changed-scope-quality-weekly-${{ github.run_id }}
129+
retention-days: 14
130+
if-no-files-found: warn
131+
path: |
132+
.runtime-cache/test_output/changed_scope_quality/**

0 commit comments

Comments
 (0)