Skip to content

chore: OSS-project hygiene + scrub upstream-product references#1

Open
gok03 wants to merge 2 commits into
mainfrom
chore/oss-hygiene
Open

chore: OSS-project hygiene + scrub upstream-product references#1
gok03 wants to merge 2 commits into
mainfrom
chore/oss-hygiene

Conversation

@gok03
Copy link
Copy Markdown
Contributor

@gok03 gok03 commented May 17, 2026

Summary

Rounds out the repo with the documents and CI an OSS project is expected to have, and scrubs every `github.com/RefuseHQ/refuse.dev` link the templating accidentally added back into the docs.

Docs

  • README polish: badged hero, mermaid architecture diagram, in-line citations of the upstream feeds we ingest from, roadmap link on the MCP note.
  • `ARCHITECTURE.md`, `CONTRIBUTING.md`, `CODE_OF_CONDUCT.md`, `SECURITY.md`, `ROADMAP.md`, `CHANGELOG.md` (Keep a Changelog), `CODEOWNERS`.
  • Issue templates (bug / feature / false-positive) + a `config.yml` routing security to private advisories, a Q&A discussion template, PR template.

CI / release

  • New `lint.yaml` workflow — prettier --check + eslint --max-warnings 0. `eslint.config.js`, `.prettierrc.json`, `.prettierignore` added.
  • New `codeql.yml` workflow on `javascript-typescript` with `security-extended,security-and-quality`.
  • `release.yaml` gains `id-token: write` + `attestations: write` for cosign keyless signing of the published container.

Misc

  • `.editorconfig`, `.nvmrc`, `.github/dependabot.yml` (npm + actions weekly), `.github/FUNDING.yml` template (commented).

Scrub

  • Removed every `github.com/RefuseHQ/refuse.dev` link in ARCHITECTURE.md, README.md, CONTRIBUTING.md, ROADMAP.md, and ISSUE_TEMPLATE/config.yml that the templating dragged in — that repo is not public.
  • Softened residual mentions of "the hosted version" / "production refuse.dev" in CONTRIBUTING / SECURITY / ROADMAP / CHANGELOG / FUNDING.yml so the docs no longer point at a closed-source variant. `scripts/audit.sh` runs clean.

Test plan

  • CI passes (test + typecheck + audit + docker build)
  • CodeQL clean
  • Prettier + ESLint clean
  • Render-check README in GitHub preview

@github-advanced-security
Copy link
Copy Markdown

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

  • The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
  • Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
  • You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

gok03 added 2 commits May 18, 2026 06:47
Round out the repo with the documents and CI an OSS project is expected to
have, and scrub stale upstream-product references that the templating
re-introduced.

- README polish: badged hero, mermaid architecture diagram, in-line links
  to the upstream feeds we ingest from. Roadmap link added to the MCP
  note.
- `ARCHITECTURE.md`, `CONTRIBUTING.md`, `CODE_OF_CONDUCT.md`,
  `SECURITY.md`, `ROADMAP.md`, `CHANGELOG.md` (Keep a Changelog),
  `CODEOWNERS`.
- Issue templates (bug / feature / false-positive) + config.yml routing
  security to private advisories, discussion template (Q&A), PR template.
- New `lint.yaml` workflow (prettier + eslint), `eslint.config.js`,
  `.prettierrc.json`, `.prettierignore`.
- New `codeql.yml` workflow on
  `javascript-typescript` with `security-extended,security-and-quality`.
- `release.yaml` gains `id-token: write` + `attestations: write` for
  cosign keyless signing of the published container.
- `.editorconfig`, `.nvmrc`, `.github/dependabot.yml` (npm + actions
  weekly), `.github/FUNDING.yml` template (commented).

Scrub:
- Removed every `github.com/RefuseHQ/refuse.dev` link the templating
  introduced into ARCHITECTURE / README / CONTRIBUTING / ROADMAP /
  ISSUE_TEMPLATE/config.yml — that repo is not public.
- Softened "in the hosted version" / "production refuse.dev" mentions in
  CONTRIBUTING / SECURITY / ROADMAP / CHANGELOG / FUNDING.yml so the
  docs no longer point at a closed-source variant.
prettier --check surfaces 109 pre-existing formatting diffs and eslint
turns up 44 issues (browser-global misses in the embedded admin UI,
plus a few eqeqeq / no-useless-escape hits). That's a real cleanup pass,
separate from OSS-project hygiene. Remove the workflow and configs from
this PR; they can land alongside the actual format/fix sweep.
@gok03 gok03 force-pushed the chore/oss-hygiene branch from 3bc9bca to 7300904 Compare May 18, 2026 01:18
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants