From a9896034ece43a33fbdb61d14d353f304de6ac71 Mon Sep 17 00:00:00 2001 From: Yasunobu <42543015+P4suta@users.noreply.github.com> Date: Tue, 25 Aug 2026 20:54:23 +0900 Subject: [PATCH 1/2] chore: establish repository governance --- .github/CODEOWNERS | 1 + .github/ISSUE_TEMPLATE/bug.yml | 61 +++++++++++++++++++++++ .github/ISSUE_TEMPLATE/config.yml | 8 +++ .github/ISSUE_TEMPLATE/feature.yml | 48 ++++++++++++++++++ .github/ISSUE_TEMPLATE/performance.yml | 42 ++++++++++++++++ .github/PULL_REQUEST_TEMPLATE.md | 19 +++++++ .github/dependabot.yml | 43 ++++++++++++++++ .github/workflows/benchmark.yml | 10 +++- .github/workflows/ci.yml | 38 ++++++++++---- .github/workflows/release.yml | 64 +++++++++++++++--------- CHANGELOG.md | 16 ++++++ CODE_OF_CONDUCT.md | 32 ++++++++++++ CONTRIBUTING.md | 68 ++++++++++++++++++++++++++ GOVERNANCE.md | 15 ++++++ README.md | 19 ++++++- SECURITY.md | 29 +++++++++++ SUPPORT.md | 12 +++++ benchmarks/README.md | 5 ++ ocaml/ocomment-ref.opam | 1 + rust/ocomment/src/git.rs | 2 +- 20 files changed, 495 insertions(+), 38 deletions(-) create mode 100644 .github/CODEOWNERS create mode 100644 .github/ISSUE_TEMPLATE/bug.yml create mode 100644 .github/ISSUE_TEMPLATE/config.yml create mode 100644 .github/ISSUE_TEMPLATE/feature.yml create mode 100644 .github/ISSUE_TEMPLATE/performance.yml create mode 100644 .github/PULL_REQUEST_TEMPLATE.md create mode 100644 CHANGELOG.md create mode 100644 CODE_OF_CONDUCT.md create mode 100644 CONTRIBUTING.md create mode 100644 GOVERNANCE.md create mode 100644 SECURITY.md create mode 100644 SUPPORT.md diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS new file mode 100644 index 0000000..bae6c00 --- /dev/null +++ b/.github/CODEOWNERS @@ -0,0 +1 @@ +* @P4suta diff --git a/.github/ISSUE_TEMPLATE/bug.yml b/.github/ISSUE_TEMPLATE/bug.yml new file mode 100644 index 0000000..9b947f1 --- /dev/null +++ b/.github/ISSUE_TEMPLATE/bug.yml @@ -0,0 +1,61 @@ +name: Bug report +description: Report reproducible incorrect behavior or a safety issue. +title: "[Bug]: " +labels: ["bug", "needs reproduction"] +body: + - type: markdown + attributes: + value: | + Thanks for helping improve OComment. For vulnerabilities, stop here and use the private security-report link. + - type: input + id: version + attributes: + label: OComment version + description: Paste `ocomment --version` or the commit SHA. + placeholder: ocomment 0.1.0 + validations: + required: true + - type: input + id: environment + attributes: + label: Environment + description: Operating system, architecture, installation method, and relevant Git/editor version. + validations: + required: true + - type: input + id: language + attributes: + label: Language and dialect + description: Include how the language was detected or selected. + validations: + required: true + - type: textarea + id: reproduction + attributes: + label: Minimal reproduction + description: Include safe input bytes, configuration, command, and exact steps. Redact secrets and private paths. + render: text + validations: + required: true + - type: textarea + id: expected + attributes: + label: Expected behavior + validations: + required: true + - type: textarea + id: actual + attributes: + label: Actual behavior and diagnostics + description: Include exit status and sanitized output from `ocomment doctor` when relevant. + validations: + required: true + - type: checkboxes + id: checks + attributes: + label: Checks + options: + - label: I searched existing issues and discussions. + required: true + - label: This report does not contain a credential or confidential source file. + required: true diff --git a/.github/ISSUE_TEMPLATE/config.yml b/.github/ISSUE_TEMPLATE/config.yml new file mode 100644 index 0000000..170ec1c --- /dev/null +++ b/.github/ISSUE_TEMPLATE/config.yml @@ -0,0 +1,8 @@ +blank_issues_enabled: false +contact_links: + - name: Questions and support + url: https://github.com/P4suta/OComment/discussions + about: Ask configuration, usage, and design questions in Discussions. + - name: Private security report + url: https://github.com/P4suta/OComment/security/advisories/new + about: Report suspected vulnerabilities privately, never in a public issue. diff --git a/.github/ISSUE_TEMPLATE/feature.yml b/.github/ISSUE_TEMPLATE/feature.yml new file mode 100644 index 0000000..ca47052 --- /dev/null +++ b/.github/ISSUE_TEMPLATE/feature.yml @@ -0,0 +1,48 @@ +name: Feature request +description: Propose a scoped language, policy, API, CLI, LSP, or plugin improvement. +title: "[Feature]: " +labels: ["enhancement", "needs design"] +body: + - type: textarea + id: problem + attributes: + label: Problem + description: What concrete workflow or compatibility gap should be solved? + validations: + required: true + - type: textarea + id: proposal + attributes: + label: Proposed behavior + description: Include examples and the expected CLI/API output where useful. + validations: + required: true + - type: textarea + id: alternatives + attributes: + label: Alternatives and compatibility + description: Describe alternatives, lexical ambiguity, safety risks, and migration impact. + validations: + required: true + - type: dropdown + id: area + attributes: + label: Area + options: + - Core scanner or transformer + - CLI or output + - Git integration + - LSP + - Profiles or plugins + - OCaml reference implementation + - Documentation or repository tooling + validations: + required: true + - type: checkboxes + id: checks + attributes: + label: Checks + options: + - label: I searched existing issues and discussions. + required: true + - label: I can help add fixtures or tests for this behavior. diff --git a/.github/ISSUE_TEMPLATE/performance.yml b/.github/ISSUE_TEMPLATE/performance.yml new file mode 100644 index 0000000..ad7c9e8 --- /dev/null +++ b/.github/ISSUE_TEMPLATE/performance.yml @@ -0,0 +1,42 @@ +name: Performance report +description: Report a reproducible throughput, latency, memory, or binary-size regression. +title: "[Performance]: " +labels: ["performance", "needs reproduction"] +body: + - type: input + id: version + attributes: + label: Compared versions or commits + validations: + required: true + - type: textarea + id: hardware + attributes: + label: Hardware and environment + description: Include CPU, memory, OS, filesystem, compiler, build profile, and thread count. + validations: + required: true + - type: textarea + id: workload + attributes: + label: Reproduction and workload + description: Include commands, warmup, sample count, input size and language, and whether files are cached. + render: shell + validations: + required: true + - type: textarea + id: results + attributes: + label: Results + description: Provide raw measurements and summary statistics, not only percentages. + validations: + required: true + - type: checkboxes + id: checks + attributes: + label: Checks + options: + - label: The benchmark input can be shared or independently reproduced. + required: true + - label: I compared equivalent release builds and configurations. + required: true diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md new file mode 100644 index 0000000..58d95b6 --- /dev/null +++ b/.github/PULL_REQUEST_TEMPLATE.md @@ -0,0 +1,19 @@ +## Summary + + + +## Compatibility and safety + + + +## Verification + + + +## Checklist + +- [ ] Observable behavior has tests or fixtures. +- [ ] Rust and OCaml expectations agree when the shared scanner contract changes. +- [ ] Documentation and generated embedded assets are updated where needed. +- [ ] The change does not include credentials, build output, or unrelated edits. +- [ ] Breaking behavior and migration steps are called out explicitly. diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 3a4d9ff..9a05fa8 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -4,7 +4,50 @@ updates: directory: /rust schedule: interval: weekly + day: monday + time: "09:00" + timezone: Asia/Tokyo + cooldown: + default-days: 7 + open-pull-requests-limit: 10 + labels: + - dependencies + commit-message: + prefix: "chore(deps)" + ignore: + - dependency-name: "*" + update-types: + - version-update:semver-major + groups: + rust-non-major: + patterns: + - "*" + update-types: + - minor + - patch - package-ecosystem: github-actions directory: / schedule: interval: weekly + day: monday + time: "09:30" + timezone: Asia/Tokyo + cooldown: + default-days: 7 + open-pull-requests-limit: 10 + labels: + - dependencies + - "area: ci" + commit-message: + prefix: "chore(deps)" + ignore: + - dependency-name: "*" + update-types: + - version-update:semver-major + groups: + actions-non-major: + patterns: + - "*" + update-types: + - minor + - patch diff --git a/.github/workflows/benchmark.yml b/.github/workflows/benchmark.yml index 7bc521f..a237ee1 100644 --- a/.github/workflows/benchmark.yml +++ b/.github/workflows/benchmark.yml @@ -14,15 +14,21 @@ on: permissions: contents: read +concurrency: + group: benchmark-${{ github.event.pull_request.number || github.ref }} + cancel-in-progress: true + jobs: gate: + if: vars.OCOMMENT_BENCHMARK_ENABLED == 'true' runs-on: [self-hosted, linux, x64, ocomment-benchmark] timeout-minutes: 30 steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 with: clean: true - - uses: dtolnay/rust-toolchain@stable + persist-credentials: false + - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable - run: cargo build --manifest-path rust/Cargo.toml --release --locked -p ocomment - run: cargo build --manifest-path rust/Cargo.toml --release --locked -p ocomment-core --example throughput - run: python3 tools/release_gate.py diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 02c0190..a64e44f 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -9,15 +9,22 @@ on: permissions: contents: read +concurrency: + group: ci-${{ github.event.pull_request.number || github.ref }} + cancel-in-progress: true + env: CARGO_TERM_COLOR: always jobs: rust: runs-on: ubuntu-latest + timeout-minutes: 20 steps: - - uses: actions/checkout@v6 - - uses: dtolnay/rust-toolchain@stable + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + with: + persist-credentials: false + - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable with: components: clippy,rustfmt - run: cargo fmt --all --manifest-path rust/Cargo.toml -- --check @@ -32,20 +39,28 @@ jobs: msrv: runs-on: ubuntu-latest + timeout-minutes: 15 steps: - - uses: actions/checkout@v6 - - uses: dtolnay/rust-toolchain@1.88.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + with: + persist-credentials: false + - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable + with: + toolchain: 1.88.0 - run: cargo check --manifest-path rust/Cargo.toml --workspace --all-targets --locked reference: runs-on: ubuntu-latest + timeout-minutes: 25 steps: - - uses: actions/checkout@v6 - - uses: dtolnay/rust-toolchain@stable - - uses: ocaml/setup-ocaml@v3 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + with: + persist-credentials: false + - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable + - uses: ocaml/setup-ocaml@f92e0606b7ae4873dd1238465ea4bf6f8e40d85c # v3 with: ocaml-compiler: "5.5" - - run: opam install ./ocaml/ocomment-ref.opam --deps-only + - run: opam install ./ocaml/ocomment-ref.opam --deps-only --with-test - run: opam exec -- dune runtest --root ocaml - run: opam exec -- ./tools/differential.sh @@ -55,9 +70,12 @@ jobs: matrix: os: [ubuntu-latest, macos-15, windows-2025] runs-on: ${{ matrix.os }} + timeout-minutes: 30 steps: - - uses: actions/checkout@v6 - - uses: dtolnay/rust-toolchain@stable + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + with: + persist-credentials: false + - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable - run: cargo build --manifest-path rust/Cargo.toml --release --locked -p ocomment - name: Unix smoke test if: runner.os != 'Windows' diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index a65d79e..feaa114 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -7,18 +7,25 @@ on: permissions: contents: read +concurrency: + group: release-${{ github.ref }} + cancel-in-progress: false + env: CARGO_TERM_COLOR: always jobs: prepare: runs-on: ubuntu-latest + timeout-minutes: 20 steps: - - uses: actions/checkout@v6 - - uses: dtolnay/rust-toolchain@stable + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + with: + persist-credentials: false + - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable - run: cargo build --manifest-path rust/Cargo.toml --release --locked -p ocomment - run: python3 tools/release_extras.py --binary rust/target/release/ocomment - - uses: actions/upload-artifact@v7 + - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 with: name: release-extras path: release-extras/ @@ -73,17 +80,22 @@ jobs: tar: none zip: all runs-on: ${{ matrix.os }} + timeout-minutes: 60 + env: + TARGET: ${{ matrix.target }} steps: - - uses: actions/checkout@v6 - - uses: dtolnay/rust-toolchain@stable + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + with: + persist-credentials: false + - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable with: targets: ${{ matrix.target }} - - uses: actions/download-artifact@v8 + - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8 with: name: release-extras path: release-extras - id: package - uses: taiki-e/upload-rust-binary-action@v1 + uses: taiki-e/upload-rust-binary-action@f0d45ae91ee7b8ee928de7a9d04d893a08bcbec6 # v1 with: bin: ocomment package: ocomment @@ -101,15 +113,15 @@ jobs: dry-run-intended: true - name: Native Unix smoke test if: runner.os != 'Windows' && !matrix.cross - run: ./rust/target/${{ matrix.target }}/release/ocomment --version + run: '"./rust/target/${TARGET}/release/ocomment" --version' - name: Cross Linux smoke test if: matrix.cross - run: cross run --manifest-path rust/Cargo.toml --locked -p ocomment --target ${{ matrix.target }} -- --version + run: cross run --manifest-path rust/Cargo.toml --locked -p ocomment --target "$TARGET" -- --version - name: Native Windows smoke test if: runner.os == 'Windows' shell: pwsh - run: '& rust/target/${{ matrix.target }}/release/ocomment.exe --version' - - uses: actions/upload-artifact@v7 + run: '& "rust/target/$env:TARGET/release/ocomment.exe" --version' + - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 with: name: ocomment-${{ matrix.target }} path: | @@ -121,21 +133,24 @@ jobs: publish-release: needs: build runs-on: ubuntu-latest + timeout-minutes: 30 permissions: - actions: read - artifact-metadata: write - attestations: write - contents: write - id-token: write + actions: read # Download artifacts produced by the build matrix. + artifact-metadata: write # Attach artifact attestations to uploaded assets. + attestations: write # Publish build provenance attestations. + contents: write # Create the immutable GitHub release for the pushed tag. + id-token: write # Obtain keyless Sigstore identities for signing. steps: - - uses: actions/checkout@v6 - - uses: actions/download-artifact@v8 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + with: + persist-credentials: false + - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8 with: pattern: ocomment-* path: release merge-multiple: true - name: Generate SPDX SBOM - uses: anchore/sbom-action@v0 + uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0 with: path: release format: spdx-json @@ -153,7 +168,7 @@ jobs: run: >- sha256sum ocomment-*.tar.gz ocomment-*.zip ocomment.spdx.json ocomment.rb ocomment-scoop.json ocomment.winget.yaml > SHA256SUMS - - uses: sigstore/cosign-installer@v4.1.0 + - uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2 - name: Sign every release subject shell: bash run: | @@ -161,7 +176,7 @@ jobs: cosign sign-blob --yes --bundle "${asset}.sigstore.json" "$asset" done < <(find release -maxdepth 1 -type f \( -name '*.tar.gz' -o -name '*.zip' -o -name '*.spdx.json' -o -name '*.rb' -o -name '*-scoop.json' -o -name '*.winget.yaml' -o -name 'SHA256SUMS' \) -print0) - name: Attest build provenance - uses: actions/attest@v4 + uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4 with: subject-path: | release/*.tar.gz @@ -175,9 +190,12 @@ jobs: needs: publish-release runs-on: ubuntu-latest environment: crates-io + timeout-minutes: 30 steps: - - uses: actions/checkout@v6 - - uses: dtolnay/rust-toolchain@stable + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + with: + persist-credentials: false + - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable - run: ./tools/publish-crates.sh env: CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }} diff --git a/CHANGELOG.md b/CHANGELOG.md new file mode 100644 index 0000000..e487d1b --- /dev/null +++ b/CHANGELOG.md @@ -0,0 +1,16 @@ +# Changelog + +All notable changes to OComment will be documented here. The project follows +[Semantic Versioning](https://semver.org/) after the first public release. + +## Unreleased + +### Added + +- Byte-oriented scanners and transformations for 15 built-in languages and the + documented dialects. +- CLI, staged Git fixes, LSP 3.18 server, declarative profiles, and sandboxed + WASM component plugins. +- Independent OCaml reference implementation and byte-for-byte differential + fixtures. +- Cross-platform CI, packaging definitions, and release verification gates. diff --git a/CODE_OF_CONDUCT.md b/CODE_OF_CONDUCT.md new file mode 100644 index 0000000..4d37f11 --- /dev/null +++ b/CODE_OF_CONDUCT.md @@ -0,0 +1,32 @@ +# Code of Conduct + +OComment contributors, maintainers, and participants are expected to make the +project a respectful, harassment-free place for everyone. + +## Expected behavior + +- Be considerate, specific, and constructive. +- Critique ideas and code, not people. +- Respect differing experience levels, backgrounds, and communication styles. +- Accept correction, take responsibility, and de-escalate disagreements. +- Keep security reports and other sensitive information confidential. + +Harassment, discrimination, threats, sexualized attention, deliberate +intimidation, doxxing, sustained disruption, and publishing private information +without permission are unacceptable. + +## Enforcement + +Maintainers may edit or remove contributions, lock conversations, issue a +warning, or temporarily or permanently restrict participation when behavior +harms the project or its community. Enforcement decisions should be +proportionate, documented privately, and applied consistently. + +For a confidential project-specific report, use the +[private report form](https://github.com/P4suta/OComment/security/advisories/new) +and begin the title with `Conduct:`. For behavior governed by GitHub itself, use +GitHub's abuse-reporting tools. Retaliation against a good-faith reporter is not +tolerated. + +This policy is informed by the Contributor Covenant 2.1 and the GitHub Community +Guidelines. diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md new file mode 100644 index 0000000..757ddc5 --- /dev/null +++ b/CONTRIBUTING.md @@ -0,0 +1,68 @@ +# Contributing to OComment + +Thank you for helping improve OComment. Bug reports, language fixtures, +documentation, performance data, and code changes are all welcome. + +## Before opening a change + +- Use [GitHub Discussions](https://github.com/P4suta/OComment/discussions) for + design questions and support. +- Use an issue for confirmed bugs and scoped feature requests. +- Report vulnerabilities through the private process in [SECURITY.md](SECURITY.md). + +Substantial scanner, policy, public API, Git, LSP, or plugin-contract changes +should have an agreed design before implementation. Small fixes can go directly +to a pull request. + +## Development setup + +The production workspace requires Rust 1.88 or newer. Differential verification +also requires OCaml 5.5, opam, Dune 3.24.2, Python 3, and the dependencies from +`ocaml/ocomment-ref.opam`. + +```sh +opam install ./ocaml/ocomment-ref.opam --deps-only --with-test +cargo build --manifest-path rust/Cargo.toml --workspace --locked +``` + +The repository is intentionally split into independent implementations: + +- `spec/` contains shared contracts and fixtures. +- `rust/` contains the product, public library, LSP server, and plugin host. +- `ocaml/` contains the independent reference implementation. + +Do not share scanner code between Rust and OCaml. Matching normalized outputs +are the cross-check. + +## Required checks + +Run the checks relevant to your change; scanner or policy changes should run all +of them. + +```sh +cargo fmt --manifest-path rust/Cargo.toml --all -- --check +cargo clippy --manifest-path rust/Cargo.toml --workspace --all-targets --locked -- -D warnings +cargo test --manifest-path rust/Cargo.toml --workspace --all-targets --locked +opam exec -- dune runtest --root ocaml +opam exec -- ./tools/differential.sh +python3 tools/check_embedded_specs.py +python3 tools/validate_schemas.py +./tools/package-list.sh +actionlint +``` + +When behavior changes, add the smallest fixture that proves the lexical edge +case. Keep byte spans half-open, edits sorted and non-overlapping, and output +deterministic. Update both implementations and their differential expectations +when the shared contract changes. + +## Pull requests + +- Keep each pull request focused and explain compatibility or safety effects. +- Add tests for observable behavior and update user-facing documentation. +- Regenerate checked-in schemas, WIT, man pages, or completions when their source + changes; `tools/check_embedded_specs.py` checks shared embedded assets. +- Do not include build output, credentials, or unrelated formatting changes. + +The repository uses squash merges. By submitting a contribution, you agree that +it is licensed under either MIT or Apache-2.0, at the user's option. diff --git a/GOVERNANCE.md b/GOVERNANCE.md new file mode 100644 index 0000000..66885f9 --- /dev/null +++ b/GOVERNANCE.md @@ -0,0 +1,15 @@ +# Governance + +OComment is currently maintained by [@P4suta](https://github.com/P4suta), who is +responsible for repository administration, final technical decisions, and +release authorization. + +Design work is discussed in public issues or Discussions whenever possible. +Decisions prioritize, in order, byte and file safety, compatibility with the +documented lexical contracts, deterministic Rust/OCaml agreement, correctness, +and measured performance. Significant changes should record the alternatives +and compatibility consequences before implementation. + +Contributors can earn broader maintenance responsibility through sustained, +high-quality review and implementation work. Changes to governance will be made +through a pull request so the history remains public. diff --git a/README.md b/README.md index 6213529..5cac55b 100644 --- a/README.md +++ b/README.md @@ -1,5 +1,9 @@ # OComment +[![CI](https://github.com/P4suta/OComment/actions/workflows/ci.yml/badge.svg)](https://github.com/P4suta/OComment/actions/workflows/ci.yml) +[![MSRV 1.88](https://img.shields.io/badge/MSRV-1.88-93450a.svg)](rust/Cargo.toml) +[![License: MIT OR Apache-2.0](https://img.shields.io/badge/license-MIT%20OR%20Apache--2.0-blue.svg)](#license) + OComment is a fast, byte-preserving comment checker and remover. The production tool is the Rust `ocomment` binary and the public `ocomment-core` library. `ocomment-ref` is an independent OCaml implementation used to check the scanner, @@ -102,5 +106,16 @@ python3 tools/check_embedded_specs.py ``` The release process and performance gates are documented in -[docs/releasing.md](docs/releasing.md). OComment is dual-licensed under MIT or -Apache-2.0. +[docs/releasing.md](docs/releasing.md). + +## Contributing and support + +See [CONTRIBUTING.md](CONTRIBUTING.md) before opening a pull request. Use +[Discussions](https://github.com/P4suta/OComment/discussions) for support and +design questions, and follow [SECURITY.md](SECURITY.md) for private vulnerability +reports. + +## License + +OComment is available under either the [MIT license](LICENSE-MIT) or the +[Apache License 2.0](LICENSE-APACHE), at your option. diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..c35c5ae --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,29 @@ +# Security policy + +## Supported versions + +Security fixes are made on `main`. After releases begin, the latest release line +will also receive fixes where practical. Older snapshots are not supported. + +## Reporting a vulnerability + +Please use GitHub's +[private vulnerability reporting form](https://github.com/P4suta/OComment/security/advisories/new). +Do not open a public issue for a suspected vulnerability. + +Include, when available: + +- the affected command, library API, LSP operation, or plugin path; +- the OComment version or commit; +- operating system and relevant configuration; +- a minimal input or plugin artifact and reproduction steps; +- the expected impact and any known mitigations. + +Redact repository contents, credentials, signing material, and personal data that +are not required to reproduce the issue. We aim to acknowledge reports within +five business days and will coordinate disclosure after a fix is available. + +Security-sensitive areas include unsafe file replacement, Git index corruption, +scanner confusion that changes program meaning, path traversal, plugin sandbox +escape or resource-limit bypass, signature verification bypass, and LSP edits +outside the requested document. diff --git a/SUPPORT.md b/SUPPORT.md new file mode 100644 index 0000000..3e02e98 --- /dev/null +++ b/SUPPORT.md @@ -0,0 +1,12 @@ +# Support + +Use [GitHub Discussions](https://github.com/P4suta/OComment/discussions) for +installation help, configuration questions, language-profile design, and usage +ideas. Search existing discussions and documentation first. + +Use [GitHub Issues](https://github.com/P4suta/OComment/issues) for reproducible +bugs and scoped feature requests. Include `ocomment --version`, the detected +language and dialect, relevant configuration, and the smallest safe example. + +Suspected vulnerabilities must follow [SECURITY.md](SECURITY.md) and must not be +reported in a public issue or discussion. diff --git a/benchmarks/README.md b/benchmarks/README.md index e20dfdf..55457fd 100644 --- a/benchmarks/README.md +++ b/benchmarks/README.md @@ -4,3 +4,8 @@ Refresh it only after reviewing an intentional performance change, using the JSON printed by `tools/release_gate.py --skip-regression`. Pull requests are rejected when throughput falls or latency/size grows by more than 5%. + +The benchmark workflow remains skipped until a runner with the +`self-hosted`, `linux`, `x64`, and `ocomment-benchmark` labels is online and the +repository variable `OCOMMENT_BENCHMARK_ENABLED` is set to `true`. This avoids +leaving pull requests permanently queued when the fixed runner is unavailable. diff --git a/ocaml/ocomment-ref.opam b/ocaml/ocomment-ref.opam index 8a9a872..d695919 100644 --- a/ocaml/ocomment-ref.opam +++ b/ocaml/ocomment-ref.opam @@ -13,6 +13,7 @@ depends: [ "yojson" {= "3.0.0"} "re" {= "1.14.0"} "uucp" {= "17.0.0"} + "alcotest" {with-test & = "1.9.1"} ] build: [ ["dune" "build" "-p" name "-j" jobs] diff --git a/rust/ocomment/src/git.rs b/rust/ocomment/src/git.rs index e2f91a8..ec980e2 100644 --- a/rust/ocomment/src/git.rs +++ b/rust/ocomment/src/git.rs @@ -378,7 +378,7 @@ fn added_line_ranges(root: &Path, path: &Path) -> Result 0 { From efa55c9d649923f7940a9fbc50a0acb252fe9092 Mon Sep 17 00:00:00 2001 From: Yasunobu <42543015+P4suta@users.noreply.github.com> Date: Tue, 25 Aug 2026 20:56:52 +0900 Subject: [PATCH 2/2] chore: codify repository rulesets --- .github/rulesets/README.md | 15 ++++++++++ .github/rulesets/main.json | 44 ++++++++++++++++++++++++++++++ .github/rulesets/release-tags.json | 17 ++++++++++++ GOVERNANCE.md | 4 +++ 4 files changed, 80 insertions(+) create mode 100644 .github/rulesets/README.md create mode 100644 .github/rulesets/main.json create mode 100644 .github/rulesets/release-tags.json diff --git a/.github/rulesets/README.md b/.github/rulesets/README.md new file mode 100644 index 0000000..76c0444 --- /dev/null +++ b/.github/rulesets/README.md @@ -0,0 +1,15 @@ +# Repository rulesets + +These JSON files mirror the active GitHub repository rulesets and can be +imported from the repository rules settings page or sent to the repository +rulesets REST endpoint. + +- `main.json` requires pull requests, immutable linear history, signed commits, + resolved review threads, and every portable CI job. +- `release-tags.json` makes version tags immutable and requires their target + commits to be signed. + +The fixed-runner benchmark is intentionally not a required check because the +runner may be offline. It is enabled separately with the +`OCOMMENT_BENCHMARK_ENABLED` repository variable. Update the checked-in JSON in +the same pull request as any live ruleset change. diff --git a/.github/rulesets/main.json b/.github/rulesets/main.json new file mode 100644 index 0000000..fc2c975 --- /dev/null +++ b/.github/rulesets/main.json @@ -0,0 +1,44 @@ +{ + "name": "Protect main", + "target": "branch", + "enforcement": "active", + "bypass_actors": [], + "conditions": { + "ref_name": { + "include": ["~DEFAULT_BRANCH"], + "exclude": [] + } + }, + "rules": [ + {"type": "deletion"}, + {"type": "non_fast_forward"}, + {"type": "required_linear_history"}, + {"type": "required_signatures"}, + { + "type": "pull_request", + "parameters": { + "allowed_merge_methods": ["squash"], + "dismiss_stale_reviews_on_push": false, + "require_code_owner_review": false, + "require_last_push_approval": false, + "required_approving_review_count": 0, + "required_review_thread_resolution": true + } + }, + { + "type": "required_status_checks", + "parameters": { + "do_not_enforce_on_create": true, + "required_status_checks": [ + {"context": "rust"}, + {"context": "msrv"}, + {"context": "reference"}, + {"context": "host-smoke (ubuntu-latest)"}, + {"context": "host-smoke (macos-15)"}, + {"context": "host-smoke (windows-2025)"} + ], + "strict_required_status_checks_policy": true + } + } + ] +} diff --git a/.github/rulesets/release-tags.json b/.github/rulesets/release-tags.json new file mode 100644 index 0000000..cf41fe7 --- /dev/null +++ b/.github/rulesets/release-tags.json @@ -0,0 +1,17 @@ +{ + "name": "Protect release tags", + "target": "tag", + "enforcement": "active", + "bypass_actors": [], + "conditions": { + "ref_name": { + "include": ["refs/tags/v*"], + "exclude": [] + } + }, + "rules": [ + {"type": "deletion"}, + {"type": "non_fast_forward"}, + {"type": "required_signatures"} + ] +} diff --git a/GOVERNANCE.md b/GOVERNANCE.md index 66885f9..d6e32a6 100644 --- a/GOVERNANCE.md +++ b/GOVERNANCE.md @@ -13,3 +13,7 @@ and compatibility consequences before implementation. Contributors can earn broader maintenance responsibility through sustained, high-quality review and implementation work. Changes to governance will be made through a pull request so the history remains public. + +The active default-branch and release-tag protections are mirrored under +`.github/rulesets/`. `main` requires the portable CI matrix and squash merging; +the fixed-runner performance gate remains opt-in while that runner is offline.