chore: SECURITY.md, CodeQL workflow, package metadata, refresh CONTRIBUTING#47
Merged
Conversation
…ONTRIBUTING Bundles three P2 polish items from the post-1.0 audit: ## SECURITY.md (gap #10 policy half) New top-level file documenting: - Supported versions - Private reporting channels (GitHub Security Advisory + email) - Scope (in-scope: command injection, path traversal, secret leakage, TLS/OCI auth, runtime privilege escalation; out-of-scope: upstream Docker/Podman bugs, third-party features, CLI-process DoS) - Coordinated disclosure window - Pointer to the CI security gates ## CodeQL workflow (gap #10 scanning half) New `.github/workflows/codeql.yml`: Rust analysis on PR + push to main + weekly schedule (Monday 06:00 UTC, staggered from cargo-deny's 07:00 UTC daily). Uses the workspace MSRV. Builds `--workspace --all-targets` so the full subcommand surface is analyzed. ## Cargo manifest metadata (gap #12) Added to `[workspace.package]` and per-package `[package]`: - `homepage`, `documentation`, `keywords`, `categories` - Per-package `description` and `readme` for crates.io rendering This unblocks publishing both crates to crates.io with proper search discoverability. ## CONTRIBUTING.md refresh (gap #13) The Quick Start and Common Tasks sections centered on raw `cargo test`, but the repo standardized on `cargo-nextest` + `make` targets long ago. Updated to: - Lead with `make dev-fast` / `make test-nextest-fast` in the Quick Start - Replace the Common Tasks table with the make-target taxonomy - Drop the long e2e-by-name list (replaced with general "filter by name" guidance — the e2e suite has grown past the original 7 named tests) - CI/CD section now reflects the actual workflows on main: ci.yml + codeql.yml + cargo-deny, with Conventional-Commits PR-title gate. ## Verification - `cargo build` ✓ - `cargo fmt --all -- --check` ✓ Refs: gaps #10, #12, #13 from the post-1.0 audit. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
pofallon
changed the title
pofallon
added a commit
that referenced
this pull request
May 26, 2026
) The README's `Shipped Commands` table was missing four commands that landed in 2026-05, and the `In Progress` table claimed five features were "Planned" / "Experimental" when they had actually shipped. ## Shipped Commands — added 4 - `set-up` (PR-6a/6b/6c — lifecycle hooks against an existing container + dotfiles + `/etc` patches) - `upgrade` (PR-5a/5b — regenerate-lockfile + Dependabot pinning) - `outdated` (current/wanted/latest feature versions) - `config` (config management subcommands) Also rewrote one-liners for the existing commands to be more accurate (e.g. `up` notes features-at-build-time, `build` notes the Dockerfile-only feature scope, `read-configuration` mentions extends + variable substitution). ## In Progress → Known limitations The old table claimed these five were not ready, all wrong now: - Docker Compose profiles → shipped (`populate_profiles` in `compose.rs`) - Features during `up` → shipped (PR-4a/4b/4c) - Container-side dotfiles → shipped (PR-6b) - `--expect-existing-container` → shipped (`container.rs:435` + `compose.rs:146`) - Port forwarding → shipped (`forward_ports` flows through both paths) Replaced the whole table with two honest entries: - **Podman runtime** — still experimental in 1.0; #30 tracks 1.1 - **`build` features** — Dockerfile-only; compose-build + image-ref still error with features Footer now points at #52 (post-1.0 hardening tracker) too. ## Badges — added 4 Existing: Latest Release, CI status, License. Added: - CodeQL workflow status (new in PR #47) - Coveralls coverage badge (matches the "Coverage is published to Coveralls" line later in the README) - MSRV 1.82 (bumped in PR #26) - Security Policy badge linking to GH security policy (SECURITY.md landed in PR #47) Also pinned the CI badge to `?branch=main` so a feature-branch failure doesn't flap the README. ## Code Signing section Removed the false "tracked in issue: Code Signing" claim — no such issue exists. Replaced with a "file one if you need this prioritized" note so readers know it's not actively scheduled. Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bundles three P2 polish items from the post-1.0 audit.
SECURITY.md (gap #10 policy half)
New top-level file documenting supported versions, private reporting channels (GitHub Security Advisory + email), in/out-of-scope, coordinated-disclosure window, and pointer to the CI security gates.
CodeQL workflow (gap #10 scanning half)
New
.github/workflows/codeql.yml— Rust analysis on PR + push to main + weekly schedule (Monday 06:00 UTC, staggered from cargo-deny's 07:00 UTC daily).Cargo manifest metadata (gap #12)
Added
homepage,documentation,keywords,categoriesto[workspace.package]+ per-packagedescriptionandreadme. Unblocks crates.io publish with proper search discoverability.CONTRIBUTING.md refresh (gap #13)
The Quick Start + Common Tasks sections centered on raw
cargo test, but the repo standardized oncargo-nextest+maketargets long ago. Updated:make dev-fast/make test-nextest-fasttest-nextest-fast,test-nextest-unit,test-nextest-docker,test-nextest-smoke,release-check,test-nextest-audit,coverage)ci.yml+codeql.yml+ cargo-deny + Conventional-Commits PR titleVerification
cargo build✓cargo fmt --all -- --check✓Refs: gaps #10, #12, #13 from the post-1.0 audit.
🤖 Generated with Claude Code