Conversation
## Summary Removes the decorative hero block, the sales tagline, and the "Roll your own vs Full IdP vs authcore" comparison table (with a bolded "~5 minutes" headline) flagged by GitHub as advertising-style content. Replaced with a plain paragraph describing the library's design. Keeps install, quick start, modules and docs sections. ## Test plan - Manual read-through; no code changes Signed-off-by: Jaro-c <75870284+Jaro-c@users.noreply.github.com>
The org standardised on MIT as its single license, so authcore moves off Apache-2.0 as part of the org-wide migration. What I changed: - `LICENSE` — canonical MIT text, `Copyright (c) 2026 Glyndor` (same file the other repos carry). - `README.md` — the two Apache-2.0 mentions (header line and the License section link) now say MIT. What I checked and found nothing to do: - Go has no `license` field in `go.mod`, so the `LICENSE` file is the only manifest surface here; pkg.go.dev reads it directly. - No `NOTICE` file (an Apache-2.0 §4(d) mechanism). - No `SPDX-License-Identifier` headers anywhere in the tree. - No dependency-license allow-list in this repo, so nothing there to leave alone. The relicense is clean: I hold the copyright and PRs are collaborators-only, so no CLA is needed. It lands on `develop` and reaches `main` at the next release. Closes #193 Closes #194 Signed-off-by: Jaro-c <75870284+Jaro-c@users.noreply.github.com>
I want the `Glyndor/.github` reusable pins to move on my schedule, not Dependabot's. A bump there changes what every job in the CI matrix does, so I adopt a new version after I have measured it — not because a bot saw a new tag. - Added an `ignore` for `Glyndor/.github/*` to the `github-actions` entry. - Third-party actions (`actions/checkout`, `actions/setup-go`) are deliberately **not** ignored — those I do want proposed automatically. Context: this repo's Dependabot version updates are currently switched off at the repository level, so the config file has been inert since June. I am turning that back on, and this entry lands first so the first run does not open a `v1.6.0 → v1.10.1` reusable bump I would only close. Signed-off-by: Jaro-c <75870284+Jaro-c@users.noreply.github.com>
I added an `ignore` for `Glyndor/.github` in #196 and I am taking it back out. Silencing the proposal is the wrong lever. I still want to be told when a new version of a reusable exists — I decide on the pull request whether to take it. An `ignore` removes the choice instead of handing it to me, and a pinned SHA that nothing ever proposes to move is how a repository ends up four versions behind without noticing. This also carries over the `commit-message` prefixes from #197, so the copy on `develop` and the copy on `main` stay identical. Signed-off-by: Jaro-c <75870284+Jaro-c@users.noreply.github.com>
Jaro-c
added
type:chore
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bringing develop to main so the license and the Dependabot config are the ones on the default branch. No tag, no release — this is a branch sync.
Why it matters beyond tidiness: Dependabot reads its config from the default branch, and its registration only comes back when that file changes there. As long as main carries the old copy, this repository keeps getting no update pull requests at all.
What rides along: