From e0a04acbd85909f5a1b39b08e3d1b6685231cbbd Mon Sep 17 00:00:00 2001 From: kpj2006 Date: Tue, 1 Sep 2026 04:45:01 +0000 Subject: [PATCH] chore(template): merge template changes :up: Signed-off-by: kpj2006 --- .../coderabbit-approval-dispatch.yml | 101 --------------- .github/workflows/coderabbit-approval.yml | 50 -------- .github/workflows/gitleaks-scanning.yml | 3 +- .github/workflows/osv-scanner-pr.yml | 2 +- .github/workflows/osv-scanner-release.yml | 2 +- .github/workflows/osv-scanner-scheduled.yml | 2 +- .github/workflows/scorecard.yml | 4 +- .github/workflows/stale.yml | 2 +- MAINTAINERS.md | 25 ++++ PRIVACY.md | 115 ++++++++++++++++++ socket.yml | 29 +++++ 11 files changed, 176 insertions(+), 159 deletions(-) delete mode 100644 .github/workflows/coderabbit-approval-dispatch.yml delete mode 100644 .github/workflows/coderabbit-approval.yml create mode 100644 MAINTAINERS.md create mode 100644 PRIVACY.md create mode 100644 socket.yml diff --git a/.github/workflows/coderabbit-approval-dispatch.yml b/.github/workflows/coderabbit-approval-dispatch.yml deleted file mode 100644 index 71eb225..0000000 --- a/.github/workflows/coderabbit-approval-dispatch.yml +++ /dev/null @@ -1,101 +0,0 @@ -name: CodeRabbit Approval Label Applier - -on: - repository_dispatch: - types: [coderabbit_approved] - -permissions: - pull-requests: write - issues: write - -jobs: - apply-labels: - if: ${{ github.repository_owner == 'AOSSIE-Org' }} - runs-on: ubuntu-latest - steps: - - name: Remove pending CodeRabbit review label - id: remove-label - uses: actions/github-script@v9 - with: - github-token: ${{ github.token }} - script: | - const prNumber = context.payload.client_payload?.pr_number; - const labelToRemove = 'pending-coderabbit-review'; - - if (!prNumber) { - core.setFailed('Missing pr_number in repository_dispatch payload.'); - return; - } - - try { - const pr = await github.rest.issues.get({ - owner: context.repo.owner, - repo: context.repo.repo, - issue_number: prNumber - }); - - const hasLabel = pr.data.labels.some((label) => label.name === labelToRemove); - - if (hasLabel) { - await github.rest.issues.removeLabel({ - owner: context.repo.owner, - repo: context.repo.repo, - issue_number: prNumber, - name: labelToRemove - }); - - console.log(`✅ Removed '${labelToRemove}' from PR #${prNumber}`); - core.setOutput('label_was_present', 'true'); - } else { - console.log(`ℹ️ '${labelToRemove}' not present on PR #${prNumber}`); - core.setOutput('label_was_present', 'false'); - } - } catch (error) { - if (error.status === 404) { - console.log(`ℹ️ '${labelToRemove}' not found on PR #${prNumber}`); - core.setOutput('label_was_present', 'false'); - } else { - throw error; - } - } - - - name: Add CodeRabbit approved label - uses: actions/github-script@v9 - with: - github-token: ${{ github.token }} - script: | - const prNumber = context.payload.client_payload?.pr_number; - - if (!prNumber) { - core.setFailed('Missing pr_number in repository_dispatch payload.'); - return; - } - - await github.rest.issues.addLabels({ - owner: context.repo.owner, - repo: context.repo.repo, - issue_number: prNumber, - labels: ['coderabbit-approved'] - }); - - console.log(`✅ Added 'coderabbit-approved' to PR #${prNumber}`); - - - name: Summary - uses: actions/github-script@v9 - with: - github-token: ${{ github.token }} - script: | - const prNumber = context.payload.client_payload?.pr_number; - const labelWasPresent = '${{ steps.remove-label.outputs.label_was_present }}' === 'true'; - - console.log('='.repeat(50)); - console.log('CodeRabbit Approval Label Applier Complete'); - console.log('='.repeat(50)); - console.log(`✅ Processed PR #${prNumber}`); - if (labelWasPresent) { - console.log("✅ Removed 'pending-coderabbit-review' label"); - } else { - console.log("ℹ️ 'pending-coderabbit-review' label was not present"); - } - console.log("✅ Added 'coderabbit-approved' label"); - console.log('='.repeat(50)); diff --git a/.github/workflows/coderabbit-approval.yml b/.github/workflows/coderabbit-approval.yml deleted file mode 100644 index b5e386c..0000000 --- a/.github/workflows/coderabbit-approval.yml +++ /dev/null @@ -1,50 +0,0 @@ -name: CodeRabbit Approval Handler - -on: - pull_request_review: - types: [submitted] - -permissions: - contents: write - actions: write - pull-requests: write - -jobs: - dispatch-coderabbit-approval: - if: ${{ github.repository_owner == 'AOSSIE-Org' }} - runs-on: ubuntu-latest - steps: - - name: Dispatch event when CodeRabbit approves - uses: actions/github-script@v9 - with: - github-token: ${{ github.token }} - script: | - const prNumber = context.payload.pull_request.number; - const review = context.payload.review; - const reviewer = review?.user?.login || ''; - const state = review?.state || ''; - - console.log(`PR number: ${prNumber}`); - console.log(`Reviewer: ${reviewer}`); - console.log(`Review state: ${state}`); - - const isCodeRabbit = reviewer === 'coderabbitai' || reviewer === 'coderabbitai[bot]'; - const isApproved = state === 'approved'; - - if (!isCodeRabbit || !isApproved) { - console.log('Not a CodeRabbit approval review. No dispatch will be sent.'); - return; - } - - await github.rest.repos.createDispatchEvent({ - owner: context.repo.owner, - repo: context.repo.repo, - event_type: 'coderabbit_approved', - client_payload: { - pr_number: prNumber, - reviewer, - review_state: state - } - }); - - console.log(`✅ Dispatched 'coderabbit_approved' event for PR #${prNumber}`); diff --git a/.github/workflows/gitleaks-scanning.yml b/.github/workflows/gitleaks-scanning.yml index fe88e87..9a7e77b 100644 --- a/.github/workflows/gitleaks-scanning.yml +++ b/.github/workflows/gitleaks-scanning.yml @@ -1,6 +1,5 @@ name: gitleaks on: - pull_request: push: workflow_dispatch: schedule: @@ -16,4 +15,4 @@ jobs: - uses: gitleaks/gitleaks-action@v3 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE }} \ No newline at end of file + GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE }} diff --git a/.github/workflows/osv-scanner-pr.yml b/.github/workflows/osv-scanner-pr.yml index 4951186..396c352 100644 --- a/.github/workflows/osv-scanner-pr.yml +++ b/.github/workflows/osv-scanner-pr.yml @@ -18,4 +18,4 @@ permissions: jobs: scan-pr: - uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml@v2.3.8 \ No newline at end of file + uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml@v2.5.1 \ No newline at end of file diff --git a/.github/workflows/osv-scanner-release.yml b/.github/workflows/osv-scanner-release.yml index d543db9..180f2a3 100644 --- a/.github/workflows/osv-scanner-release.yml +++ b/.github/workflows/osv-scanner-release.yml @@ -16,7 +16,7 @@ permissions: jobs: osv-scan: - uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml@v2.3.8" + uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml@v2.5.1" with: # Recursive scan supports multiple ecosystems: # Go, Node.js, Python, Rust, Java, etc. diff --git a/.github/workflows/osv-scanner-scheduled.yml b/.github/workflows/osv-scanner-scheduled.yml index f21ed7a..53d357f 100644 --- a/.github/workflows/osv-scanner-scheduled.yml +++ b/.github/workflows/osv-scanner-scheduled.yml @@ -18,4 +18,4 @@ permissions: jobs: scan-scheduled: - uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@v2.3.8" \ No newline at end of file + uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@v2.5.1" \ No newline at end of file diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 5b54af5..c3d0554 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -40,7 +40,7 @@ jobs: steps: - name: "Harden Runner" - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 + uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 with: disable-sudo-and-containers: false # MAINTAINER CHOICE: Use "audit" first to discover needed endpoints, @@ -68,7 +68,7 @@ jobs: persist-credentials: false - name: "Run analysis" - uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3 + uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4 with: results_file: results.sarif results_format: sarif diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml index 496ccd6..83ce121 100644 --- a/.github/workflows/stale.yml +++ b/.github/workflows/stale.yml @@ -18,7 +18,7 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/stale@v10 + - uses: actions/stale@v11 with: repo-token: ${{ secrets.GITHUB_TOKEN }} diff --git a/MAINTAINERS.md b/MAINTAINERS.md new file mode 100644 index 0000000..6035f6f --- /dev/null +++ b/MAINTAINERS.md @@ -0,0 +1,25 @@ +# Maintainers, Mentors and Ideators + +This document lists the individuals fulfilling the key roles of [Maintainer](https://github.com/AOSSIE-Org/Info/blob/main/Roles/Maintainer.md), [Mentor](https://github.com/AOSSIE-Org/Info/blob/main/Roles/Mentors.md) and [Ideator](https://github.com/AOSSIE-Org/Info/blob/main/Roles/Ideator.md) for this repository, in accordance with [AOSSIE's Role Definitions](https://github.com/AOSSIE-Org/Info/tree/main/Roles). + +--- + +> **Note:** If multiple contributors are fulfilling a role in a single repository, please include and fill out the extra columns to clarify responsibilities (e.g., `Project / Feature Idea`, `Area / Focus`, and `Proposal / Discussion Link` for Ideators; `Area / Focus` for Mentors and Maintainers). If there is only one person for a role, do not add these columns. + +## Ideators + +| Name | GitHub Username | Discord Username | Project / Feature Idea | Area / Focus | Proposal / Discussion Link | +| ---- | --------------- | ---------------- | ------------------------------- | -------------------- | ------------------------------------------- | +| TODO | @username | @discord_user | Context-First AI Infrastructure | AI Workflow & Skills | [Discussion](https://github.com/AOSSIE-Org) | + +## Mentors + +| Name | GitHub Username | Discord Username | Area / Focus | +| ---- | --------------- | ---------------- | ----------------------------------- | +| TODO | @username | @discord_user | whole Project Guidance & PR Reviews | + +## Maintainers + +| Name | GitHub Username | Discord Username | Area / Focus | +| ---- | --------------- | ---------------- | -------------------------------- | +| TODO | @username | @discord_user | Repository Maintenance & Merging | diff --git a/PRIVACY.md b/PRIVACY.md new file mode 100644 index 0000000..3533c0d --- /dev/null +++ b/PRIVACY.md @@ -0,0 +1,115 @@ +# Privacy Policy + +## Introduction + +[TODO: Project Name] (the App) is committed to protecting your privacy and providing a transparent and user-friendly experience. + +This Privacy Policy explains how the App handles information when you use it. + +The App follows a privacy-conscious and local-first approach. +It aims to collect and process only the information necessary to provide its functionalities. +Where possible, information is processed and stored locally on your device rather than being transmitted to or stored on remote servers. + + +## Information and Permissions + +Depending on the features you use and the permissions you grant, the App may access information such as: + +* Information you provide directly to the App +* Information generated through your use of the App +* Device information or permissions required for specific features +* [TODO: Add any project-specific information, such as location, health data, contacts, files, etc.] + +The information accessed by the App is used only for the purposes described in this Privacy Policy and to provide the functionality of the App. + +You can deny or revoke permissions at any time through your device settings. +Some features may not work if the permissions required for those features are not granted. + + +## Data Storage + +The App is designed to minimize the storage and transmission of personal information. + +[TODO: choose the applicable option:] +[-- TODO: Option A: Begin] +All information is stored locally on your device and is not uploaded to or maintained on any remote server. +[-- TODO: Option A: End] + +[-- TODO: Option B: Begin] +Any information stored in remote servers is limited to what is necessary for the App's functionality. +The App stores the following information in servers: +* [TODO: which information is stored, where it is stored and why] +* [TODO: which information is stored, where it is stored and why] +[-- TODO: Option B: End] + + +## Data Sharing + +The App does not sell your personal information. + +The App does not use personal information for targeted advertising. + +[TODO: choose the applicable option:] +[-- TODO: Option A: Begin] +No information is shared with any third parties. +[-- TODO: Option A: End] + +[-- TODO: Option B: Begin] +The App may communicate with third-parties when required to provide specific features. +Any information transmitted to such services is limited to what is necessary for the App's functionality. +The following is a list of third parties and the information that may be shared with them: +* [TODO: Third Party Name]: [TODO: information that is shared with that third party and for which feature] +* [TODO: Third Party Name]: [TODO: information that is shared with that third party and for which feature] + +Where a third-party processes information, its handling of that information is governed by its own privacy policy and terms of service. +[-- TODO: Option B: End] + + +## Data Security + +The App aims to minimize privacy and security risks by limiting unnecessary data collection and, +where possible, processing information locally on your device. + +However, no method of electronic storage or transmission can be guaranteed to be completely secure. Users are also responsible for maintaining the security of their devices and for protecting any information they choose to export, share, or otherwise make available. + + +## Data Deletion + +Where information is stored locally, you can generally remove it by using the App's available data-clearing features, +clearing the data through your device settings, or uninstalling the App. + +[TODO (add if applicable): Where information is stored on servers, you may request deletion of that information by TODO.] + + +## Data Export + +The App may allow you to export information. Exported files are created and stored on your device, +and you are responsible for protecting any files you choose to export or share. + + +## Children's Privacy + +The App is not intended to knowingly collect personal information from children where such collection is prohibited by applicable law. + +[TODO: If the project has specific age requirements, describe them here.] + + +## Free Access + +The App aims to keep its core functionality accessible to users without +requiring mandatory subscriptions or payments to unlock essential features. + +[TODO: If the project has paid features, subscriptions, or other monetization, describe them clearly here.] + + +## Changes to This Privacy Policy + +We may update this Privacy Policy from time to time to reflect changes to the App, its functionality, or applicable legal requirements. + +Any updates will be made available wherever this Privacy Policy is published. + +## Contact Us + +If you have any questions or concerns about this Privacy Policy or the App's privacy practices, please contact us at: + +[contact@aossie.org](mailto:contact@aossie.org) diff --git a/socket.yml b/socket.yml new file mode 100644 index 0000000..5cfbfd6 --- /dev/null +++ b/socket.yml @@ -0,0 +1,29 @@ +version: 2 + +# Skip these when ingesting manifests for scans +projectIgnorePaths: + - "build" + - "dist" + - ".dart_tool" + - "android/.gradle" + +# Only rescan PRs when dependency manifests actually change +triggerPaths: + - "package.json" + - "package-lock.json" + - "pnpm-lock.yaml" + - "yarn.lock" + - "requirements.txt" + - "pyproject.toml" + - "pubspec.yaml" # Flutter + - "pubspec.lock" + +githubApp: + enabled: true + pullRequestAlertsEnabled: true + dependencyOverviewEnabled: true + projectReportsEnabled: true + ignoreUsers: + - "dependabot[bot]" + - "github-actions[bot]" + disableCommentsAndCheckRuns: false