From 69240bfbe460a04632e831f1580076fd13606d8f Mon Sep 17 00:00:00 2001 From: "Anaz S. Aji" Date: Tue, 1 Sep 2026 21:21:26 +0700 Subject: [PATCH 1/6] docs(governance): add CoC, security policy, PR/issue templates, PR checks --- CODE_OF_CONDUCT.md | 34 ++++++++++++++++++++++++++++++++++ 1 file changed, 34 insertions(+) create mode 100644 CODE_OF_CONDUCT.md diff --git a/CODE_OF_CONDUCT.md b/CODE_OF_CONDUCT.md new file mode 100644 index 0000000..7c14884 --- /dev/null +++ b/CODE_OF_CONDUCT.md @@ -0,0 +1,34 @@ +# Code of Conduct + +TrapFall is a small open-source project and we want it to stay a place people enjoy contributing to. + +## The rules, briefly + +- **Be respectful.** Disagreement is fine; rudeness, condescension, and personal attacks are not. +- **Assume good faith.** Most miscommunication isn't malicious, so clarify before escalating. +- **Stay on topic.** Issues, PRs, and discussions are about TrapFall. Take off-topic conversations elsewhere. +- **No harassment.** Targeted insults, slurs, sustained disruption, sexualized comments, doxxing, or threats are not tolerated, anywhere, against anyone. +- **No spam.** That includes promotional links, irrelevant cross-posting, and AI-generated noise that doesn't engage with the actual conversation. + +This applies to everything inside the project: issues, PRs, discussions, commits, and any community space we create later (Discord, etc.). + +## Enforcement + +If you see a violation, or experience one, email **hello@codecora.dev** with subject `[TrapFall conduct]`. Include links and context. + +Maintainers may, at their discretion: + +1. Edit or delete the offending content +2. Issue a private warning +3. Lock the thread +4. Block the account from the project + +We default to the lightest action that resolves the situation. Severe or repeat violations skip steps. + +## Scope + +Maintainers act in this project's spaces. We don't police behavior outside the project, but we do consider patterns of behavior elsewhere when deciding on enforcement here. + +--- + +*This document is intentionally short. It is inspired by the [Contributor Covenant](https://www.contributor-covenant.org/) but kept compact for a small project.* From a78a832f3abea9fad8e99fa21abf53758dd5ecb4 Mon Sep 17 00:00:00 2001 From: "Anaz S. Aji" Date: Tue, 1 Sep 2026 21:21:27 +0700 Subject: [PATCH 2/6] docs(governance): add CoC, security policy, PR/issue templates, PR checks --- SECURITY.md | 49 +++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 49 insertions(+) create mode 100644 SECURITY.md diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..7c09037 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,49 @@ +# Security Policy + +## Supported Versions + +| Version | Supported | +|---------|-----------| +| v0.2.x (latest release) | ✅ | +| Previous release line | ✅ (critical only) | +| Older versions | ❌ | + +## Reporting a Vulnerability + +If you discover a security vulnerability in TrapFall, please report it responsibly. + +**Do NOT** open a public issue for security vulnerabilities. + +### How to Report + +Use [GitHub Private Vulnerability Reporting](https://github.com/codecoradev/trapfall/security/advisories/new). This keeps the report confidential and visible only to maintainers. + +Include as much detail as possible: + +- Description of the vulnerability +- Steps to reproduce +- Potential impact +- Suggested fix (if any) + +### What to Expect + +- **Acknowledgment** within 48 hours +- **Initial assessment** within 5 business days +- **Fix timeline** depends on severity: + - Critical: 7 days + - High: 14 days + - Medium: 30 days + - Low: next minor release + +### Security in the Development Process + +TrapFall runs automated security checks on every PR and weekly (Monday 06:00 UTC): + +- **Cargo Audit** — Rust dependency advisories scan on the workspace +- **Trivy Secrets** — scans for committed credentials and keys +- **Trivy Filesystem** — misconfiguration and vulnerability scan +- **npm Audit** — frontend (`web/`) dependency advisories, tracked on PRs and the weekly schedule + +### Deployment Surface Notes + +The production Docker image is built `FROM scratch` with a statically linked MUSL binary and rustls (no OpenSSL). There is no shell, no package manager, and no OS layer inside the container, which keeps the runtime attack surface minimal. Report anything that contradicts that expectation. From 877f285515d1976b4c9369ae51cd0148df776bbd Mon Sep 17 00:00:00 2001 From: "Anaz S. Aji" Date: Tue, 1 Sep 2026 21:21:29 +0700 Subject: [PATCH 3/6] docs(governance): add CoC, security policy, PR/issue templates, PR checks --- .github/PULL_REQUEST_TEMPLATE.md | 34 ++++++++++++++++++++++++++++++++ 1 file changed, 34 insertions(+) create mode 100644 .github/PULL_REQUEST_TEMPLATE.md diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md new file mode 100644 index 0000000..541c59d --- /dev/null +++ b/.github/PULL_REQUEST_TEMPLATE.md @@ -0,0 +1,34 @@ + + +## What + + +## Why + + +## How + + +## Testing + +- [ ] `cargo test --workspace` passes +- [ ] `cargo fmt --all -- --check` passes +- [ ] `cargo clippy --workspace --all-targets -- -D warnings` passes +- [ ] Frontend checks pass (`svelte-check` + build) if `web/` changed +- [ ] Local code review tool run (e.g. Cora) +- [ ] Manual smoke-test of the affected feature + +## Related Issues + + +## Checklist + +- [ ] Branch name follows convention (`fix/`, `feat/`, `docs/`, `chore/`, `refactor/`, `test/`, `perf/`, `security/`) +- [ ] Branch is from `develop` +- [ ] Commit messages follow [Conventional Commits](https://www.conventionalcommits.org/) +- [ ] No secrets or credentials committed +- [ ] One logical change per PR (no mixed concerns) From 6159355b490aa93e04f3b09bbc42efb252d45e55 Mon Sep 17 00:00:00 2001 From: "Anaz S. Aji" Date: Tue, 1 Sep 2026 21:21:30 +0700 Subject: [PATCH 4/6] docs(governance): add CoC, security policy, PR/issue templates, PR checks --- .github/ISSUE_TEMPLATE/bug_report.yml | 79 +++++++++++++++++++++++++++ 1 file changed, 79 insertions(+) create mode 100644 .github/ISSUE_TEMPLATE/bug_report.yml diff --git a/.github/ISSUE_TEMPLATE/bug_report.yml b/.github/ISSUE_TEMPLATE/bug_report.yml new file mode 100644 index 0000000..a2ca29d --- /dev/null +++ b/.github/ISSUE_TEMPLATE/bug_report.yml @@ -0,0 +1,79 @@ +name: Bug report +description: Something is broken or behaving unexpectedly +labels: ["bug"] +body: + - type: markdown + attributes: + value: | + Thanks for taking the time to report a bug. Please fill in the fields below. + + For **security issues**, do NOT open an issue. See [SECURITY.md](../../SECURITY.md). + + - type: input + id: version + attributes: + label: Version + description: Run the version command or check the release you're on. + placeholder: "0.2.1" + validations: + required: true + + - type: dropdown + id: os + attributes: + label: Operating system + options: + - Linux + - macOS (Apple Silicon) + - macOS (Intel) + - Windows + - Other + validations: + required: true + + - type: input + id: os-version + attributes: + label: OS version + placeholder: "Ubuntu 24.04 / macOS 15.2 / Windows 11" + validations: + required: true + + - type: textarea + id: what-happened + attributes: + label: What happened? + description: A clear and concise description of the bug. + validations: + required: true + + - type: textarea + id: expected + attributes: + label: What did you expect to happen? + validations: + required: true + + - type: textarea + id: steps + attributes: + label: Steps to reproduce + description: Numbered list of exact steps. + validations: + required: true + + - type: textarea + id: logs + attributes: + label: Logs / output + description: Paste relevant terminal output or logs. + + - type: checkboxes + id: checks + attributes: + label: Before submitting + options: + - label: I searched existing issues and didn't find a duplicate + required: true + - label: I am running the latest version + required: false From 5c555ba9a2b850b2c0ff733f9ecfbe5fde1c9655 Mon Sep 17 00:00:00 2001 From: "Anaz S. Aji" Date: Tue, 1 Sep 2026 21:21:32 +0700 Subject: [PATCH 5/6] docs(governance): add CoC, security policy, PR/issue templates, PR checks --- .github/ISSUE_TEMPLATE/feature_request.yml | 50 ++++++++++++++++++++++ 1 file changed, 50 insertions(+) create mode 100644 .github/ISSUE_TEMPLATE/feature_request.yml diff --git a/.github/ISSUE_TEMPLATE/feature_request.yml b/.github/ISSUE_TEMPLATE/feature_request.yml new file mode 100644 index 0000000..f0328dd --- /dev/null +++ b/.github/ISSUE_TEMPLATE/feature_request.yml @@ -0,0 +1,50 @@ +name: Feature request +description: Suggest a new feature or improvement +labels: ["enhancement"] +body: + - type: markdown + attributes: + value: | + Thanks for the idea! A short conversation here saves everyone time before any code is written. + + - type: textarea + id: problem + attributes: + label: What problem does this solve? + description: The **why**, not the **what**. + placeholder: "When I'm working with X, I want Y so that Z." + validations: + required: true + + - type: textarea + id: proposal + attributes: + label: Proposed solution + description: How would you imagine using this? + validations: + required: true + + - type: textarea + id: alternatives + attributes: + label: Alternatives considered + description: What workarounds have you tried? + + - type: dropdown + id: contribution + attributes: + label: Are you willing to contribute the implementation? + options: + - "Yes, with guidance" + - "Yes, I can do it" + - "No, just suggesting" + validations: + required: true + + - type: checkboxes + id: checks + attributes: + label: Before submitting + options: + - label: I searched existing issues and didn't find a duplicate + required: true From 5436835ac8e5dcbf11bc86717806c879607d72a0 Mon Sep 17 00:00:00 2001 From: "Anaz S. Aji" Date: Tue, 1 Sep 2026 21:21:33 +0700 Subject: [PATCH 6/6] docs(governance): add CoC, security policy, PR/issue templates, PR checks --- .github/workflows/pr-checks.yml | 70 +++++++++++++++++++++++++++++++++ 1 file changed, 70 insertions(+) create mode 100644 .github/workflows/pr-checks.yml diff --git a/.github/workflows/pr-checks.yml b/.github/workflows/pr-checks.yml new file mode 100644 index 0000000..0a02934 --- /dev/null +++ b/.github/workflows/pr-checks.yml @@ -0,0 +1,70 @@ +name: PR Checks + +on: + pull_request: + types: [opened, edited, synchronize, reopened] + branches: [develop, main] + +jobs: + branch-naming: + name: Branch Naming + runs-on: ubuntu-latest + steps: + - name: Check branch name + env: + HEAD_REF: ${{ github.head_ref }} + run: | + echo "Checking branch: $HEAD_REF" + ALLOWED="^(feat|fix|docs|chore|perf|security|refactor|test|build|ci)/" + if echo "$HEAD_REF" | grep -qE "$ALLOWED"; then + echo "OK: branch name follows convention" + else + echo "::error::Branch name must start with one of: feat/, fix/, docs/, chore/, perf/, security/, refactor/, test/, build/, ci/" + echo "Example: fix/ingest-envelope, feat/web-filters" + echo "Current: $HEAD_REF" + exit 1 + fi + + pr-template: + name: PR Description + runs-on: ubuntu-latest + steps: + - name: Check PR body + env: + PR_BODY: ${{ github.event.pull_request.body }} + run: | + echo "Checking PR description..." + MISSING="" + if ! echo "$PR_BODY" | grep -qi "## What"; then + MISSING="$MISSING\n - ## What (description of the change)" + fi + if ! echo "$PR_BODY" | grep -qi "## Why"; then + MISSING="$MISSING\n - ## Why (the problem you're solving)" + fi + if ! echo "$PR_BODY" | grep -qi "## Testing"; then + MISSING="$MISSING\n - ## Testing (how you verified this works)" + fi + if [ -n "$MISSING" ]; then + echo "::error::PR description is missing required sections:$MISSING" + exit 1 + fi + echo "OK: PR description has required sections" + + commit-conventional: + name: Conventional Commits + runs-on: ubuntu-latest + steps: + - name: Check PR title format + env: + PR_TITLE: ${{ github.event.pull_request.title }} + run: | + echo "Checking PR title: $PR_TITLE" + PATTERN="^(feat|fix|docs|chore|perf|refactor|test|build|ci|security)(\(.+\))?!?: .+" + if echo "$PR_TITLE" | grep -qE "$PATTERN"; then + echo "OK: PR title follows Conventional Commits" + else + echo "::error::PR title must follow Conventional Commits format" + echo "Expected: type(scope): short description" + echo "Example: fix(ingest): handle empty envelope" + exit 1 + fi