chore: harden repo to open-source best practices - #1
Merged
Conversation
Bring the repo up to the SOP's best-in-class bar (community profile, trust signals, discoverability, CI, security). Added: - .github/workflows/ci.yml: type-check + test + build on Node 20/22/24, fail-fast:false, read-only token, SHA-pinned actions - .github/dependabot.yml (npm + github-actions weekly updates) - .github/SECURITY.md, SUPPORT.md, CODEOWNERS - CITATION.cff (drives "Cite this repository") - .editorconfig, .gitattributes (LF normalization, binary classing) - YAML issue forms + config chooser (replacing legacy .md templates) Changed: - README: CI badge, mermaid architecture diagram, live ASCII visualizer sample, table of contents, alt text, house-style hyphens - CONTRIBUTING: fixed clone URL, added good-first-issue / support / security pointers - package.json: corrected repository URLs (uhd -> OpenUHD) - CHANGELOG: Unreleased entry for the hardening work
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Brings the fork up to the open-source SOP's best-in-class bar: community-profile completeness, trust signals, discoverability, CI, and security. Uses the AeroFlex repo as the exemplar for structure and README visuals.
Added
.github/workflows/ci.yml) — type-check + test + build on Node 20/22/24,fail-fast: false, read-only token, actions pinned to commit SHAs (supply-chain hardening). Green build badge is now the top README trust signal..github/dependabot.yml) — weekly npm + github-actions updates.SECURITY.md,SUPPORT.md,CODEOWNERS..editorconfig,.gitattributes(LF normalization + binary classing; matters on Windows/CRLF).config.yml), replacing the legacy Markdown templates.Changed
uhd→OpenUHD).Unreleasedentry for this work.Verification
npm run type-check,npm test(83 passing), andnpm run buildall pass locally.Manual steps (GitHub web UI only — see the accompanying summary)
Topics, About description, social-preview image, branch ruleset, Dependabot/secret-scanning toggles, and private vulnerability reporting still need to be set in Settings.