Skip to content

v0.1.2 — public readiness: CodeQL, Dependabot, hardened CI, Scorecard

Choose a tag to compare

View all tags
@DocGerd DocGerd released this 17 Jul 09:13
v0.1.2
00fd960
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Public-readiness release — the repository now carries the security, supply-chain, and documentation posture expected of a public project. No changes to the deployed app's runtime behavior; the PWA you install is the same as v0.1.1 plus dev-dependency bumps.

Five issues closed through four reviewed, CI-gated PRs (#55, #56, #57, #61) plus a repo-settings close-out (#16), with a clean cross-PR final review.

Security & supply chain

  • CodeQL code scanning (#12): JavaScript/TypeScript + Python analysis on every push/PR to main and weekly — first scans came back with zero alerts (PR #56).
  • Dependabot (#13): weekly grouped version updates for app npm, pipeline npm, pipeline pip, and GitHub Actions; security updates land immediately and ungrouped. Deliberate pins are guarded (TypeScript fully; majors of fast-check/vitest/Playwright/React/workbox held back for manual migration) (PR #57).
  • Private vulnerability reporting enabled, with a SECURITY.md that documents scope and the reporting channel (PR #55).
  • Full-history secrets scan (gitleaks): clean. GitHub secret scanning + push protection active.

CI hardening (#14, PR #61)

  • Least-privilege permissions: in every workflow; elevation only where the deploy job needs it.
  • Every action pinned to a full commit SHA (Dependabot keeps the pins fresh).
  • Concurrency groups cancel superseded PR runs; pushes to main always run to completion.
  • New mask-integrity job: verify_mask.py flood-fill-checks the committed navigation mask whenever pipeline/** or app/public/data/** change.
  • OpenSSF Scorecard runs weekly and on main pushes, publishing results; badges (CI · CodeQL · Scorecard) now head the README.

Documentation (#10, PR #55)

  • README: screenshots (start view, planned route), an architecture sketch (build-time pipeline → committed static assets → PWA with the isochrone router in a Web Worker), and the test-timeout policy.
  • New CONTRIBUTING.md (ground rules: protected main, no backend, offline first, not a navigation device) and SECURITY.md.
  • Repo metadata: topics, homepage, description aligned with the live app.

Dependencies

  • vite 8.1.4 → 8.1.5 (dev, PR #59)
  • @types/node 24.13.3 → 26.1.1 (dev, PR #60)

Live app: https://docgerd.github.io/sail_command/ — SailCommand is a passage-planning aid, not a navigation device.

Assets 2
Loading