Skip to content

Commit 5e7098a

Browse files
RickCogleyRickCogley
committed
chore: adopt devkit baseline (CI, security, Claude rules) + fix 2 type errors
Implements the punch list from issue #8. == CI/CD (none previously) == - .github/workflows/ci.yml: fmt + lint + check (mod.ts) on PR/main pushes. Tests intentionally NOT in CI right now — 7 pre-existing test failures on main predate this PR (AssertionError in language_alternates_schema and markdown_metadata test files). Tracking separately to keep this PR scope-bounded. - .github/dependabot.yml: weekly github-actions + npm (docs-site) updates. NO publish.yml — hibana publishes to deno.land/x via webhook on tag push (not JSR). Per project memory, JSR is intentionally not used because Lume's dev resists JSR (no http imports support), and hibana follows Lume's hosting choice. == Security == - .github/workflows/security.yml: wrapper triggering local vendored workflow on push/PR/weekly cron/dispatch. - .github/workflows/secrets-and-sast-vendored.yml: 451-line copy of eSolia/devkit/.github/workflows/secrets-and-sast.yml@main as of 2026-04-29. Vendored because hibana is public + cross-org from eSolia/devkit (private) — GitHub blocks public consumers from calling private reusable workflows AND blocks cross-org private calls. Same vendored pattern as RickCogley/pub-cogley, RickCogley/tedasuke, eSolia/marquis. == Claude tooling == - .claude/rules/change-management.md: copy of devkit's shared rule. Also fixed .gitignore to allow tracking .claude/rules/ (was ignoring all of .claude/). == Type-error fixes (2 from main) == - processors/vento_heading_anchors.ts:120 and processors/vento_toc.ts:163 both had `Required<...Options>` annotations on options merging, but `containerSelector` is genuinely optional (undefined means "scan whole document"). Aligned the annotations to Pick out containerSelector as optional, matching the existing pattern in the corresponding `defaults` declarations. == Deno hygiene == - Drop misleading `name: "@rick/hibana"` from deno.json — JSR-style scope but hibana doesn't publish to JSR (verified: jsr.io 404 for this name). Field was confusing readers about the publish target. - Add `preflight` task: deno fmt && deno check mod.ts && deno lint. - Scope the `check` task to `deno check mod.ts` instead of `deno check **/*.ts` — the glob picked up docs-site/ Astro internals and root-level scripts and produced 11k+ unrelated errors. mod.ts is the public entry point and what JSR-style consumers care about. - Commit deno.lock for reproducibility (was untracked on main; both global and project .gitignore had been ignoring it). - .gitignore overrides for `!deno.lock` (global gitignore_global ignores) and `!.github/workflows/*secret*` (global pattern matches the vendored filename). == Out of scope (flagged for follow-up) == - Fix the 7 failing tests in language_alternates_schema and markdown_metadata. The user has confirmed they were not aware of these — likely surfaced by recent upgrades. Will be tracked in a separate issue. - Remove `no-explicit-any` lint exclusion and fix the ~18 `any` usages (real cleanup work, not baseline scope). - Move root-level scripts (release.ts, generate_readme.ts, generate_readme2.ts, update_lume_version.ts) into scripts/. - Investigate whether generate_readme2.ts is dead code. Closes #8 InfoSec: brings continuous SAST + secret scanning + SBOM coverage to a repo that previously had zero security automation. The 2 type errors fixed are correctness improvements (avoids potential undefined access on `options.containerSelector` later in the code, though the runtime checks at usage sites already guard).
1 parent 5c2774c commit 5e7098a

10 files changed

Lines changed: 1005 additions & 17 deletions

File tree

‎.claude/rules/change-management.md‎

Lines changed: 108 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,108 @@
1+
# Change Management Rule (ISO 27001)
2+
3+
All code and content changes must follow a traceable workflow that an auditor
4+
can verify: **issue → branch → PR → merge → verify**.
5+
6+
## Standard Workflow
7+
8+
Every change that modifies behavior, configuration, content, or dependencies:
9+
10+
1. **Issue first.** Create a GitHub issue describing the change before starting
11+
work. If an issue already exists, reference it.
12+
2. **Branch.** Create a feature branch from `main` named
13+
`{type}/{short-description}` (e.g., `feat/engagement-model`,
14+
`fix/css-banner-edge-case`).
15+
3. **Work.** Make changes on the branch. Run preflight checks before committing.
16+
4. **PR.** Create a pull request linking to the issue with `Closes #N` or
17+
`Fixes #N` in the body. PR body must include a Summary and Test Plan.
18+
5. **Merge.** Merge with `gh pr merge --admin --merge --delete-branch` (org
19+
policy blocks auto-merge; admin override is authorized for the repo owner).
20+
6. **Post-merge verification.** After every merge to main:
21+
- Check GitHub CI: `gh run list --limit 3`
22+
- Check Cloudflare build logs (docs site deploys to CF Workers): verify the
23+
build succeeds
24+
- Check Dependabot:
25+
`gh api repos/RickCogley/hibana/dependabot/alerts --jq '[.[] | select(.state=="open")] | length'`
26+
— address any new alerts
27+
7. **Release.** Releases are created periodically via
28+
`gh release create v<x.y.z>` with hand-written notes. **deno.land/x**
29+
auto-publishes from the tag via webhook (no GitHub Action involvement). JSR
30+
is intentionally not used — Lume's dev resists JSR because JSR doesn't
31+
support http imports, and hibana follows Lume's hosting choice so it can be
32+
pulled into Lume cleanly.
33+
34+
## Branching correctly
35+
36+
Use `git switch -c <branch>` from main, NOT
37+
`git checkout origin/main -b <branch>` (the latter sets the upstream to
38+
`origin/main`, which can cause `git push -u origin <branch>` to push directly to
39+
main and bypass review).
40+
41+
```bash
42+
git switch main && git pull --ff-only
43+
git switch -c feat/whatever
44+
# ...work...
45+
git push -u origin HEAD
46+
```
47+
48+
Pre-push sanity check on a new branch:
49+
50+
```bash
51+
git branch -vv
52+
# Current branch should NOT show [origin/main] or any [origin/something-else]
53+
# upstream. An unset upstream (no brackets) is what you want.
54+
```
55+
56+
## Writing PR and issue bodies
57+
58+
Always pass multi-line or markdown-rich bodies **by file**, never inline via a
59+
heredoc:
60+
61+
```bash
62+
gh pr create --body-file <path>
63+
gh pr edit N --body-file <path>
64+
gh issue create --body-file <path>
65+
git commit -F <path>
66+
```
67+
68+
Heredocs cause backslash artifacts in rendered markdown.
69+
70+
## Conventional Commits
71+
72+
```
73+
type(scope): description
74+
75+
Body explaining the change (if needed).
76+
77+
InfoSec: [security/quality/privacy consideration]
78+
```
79+
80+
**Types:** `feat`, `fix`, `docs`, `style`, `refactor`, `test`, `chore`
81+
82+
**InfoSec line** — required for all changes. Examples:
83+
84+
- `InfoSec: input validation added for user-supplied query parameters`
85+
- `InfoSec: no security impact — content-only change`
86+
- `InfoSec: dependency update addresses CVE-2026-XXXX`
87+
88+
If a change has no security implications, state that explicitly.
89+
90+
## Rationale
91+
92+
This workflow produces the evidence chain that ISO 27001 (A.8.9, A.8.25, A.8.32)
93+
requires:
94+
95+
- **Change request** → GitHub issue
96+
- **Authorization** → PR review and merge approval
97+
- **Testing** → CI checks
98+
- **Implementation** → Commits on feature branch
99+
- **Verification** → Post-merge CI confirmation
100+
101+
An auditor can trace any production change from PR → issue → commits → CI
102+
results.
103+
104+
---
105+
106+
_Originally synced from
107+
[eSolia/devkit](https://github.com/eSolia/devkit)/.claude/shared-rules/change-management.md.
108+
This repo is not a devkit sync consumer — edit locally as needed._

‎.github/dependabot.yml‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
version: 2
2+
updates:
3+
- package-ecosystem: "github-actions"
4+
directory: "/"
5+
schedule:
6+
interval: "weekly"
7+
day: "monday"
8+
labels:
9+
- "dependencies"
10+
- "github-actions"
11+
commit-message:
12+
prefix: "chore"
13+
include: "scope"
14+
15+
- package-ecosystem: "npm"
16+
directory: "/docs-site"
17+
schedule:
18+
interval: "weekly"
19+
day: "monday"
20+
labels:
21+
- "dependencies"
22+
- "docs-site"
23+
commit-message:
24+
prefix: "chore"
25+
include: "scope"

‎.github/workflows/ci.yml‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
name: CI
2+
3+
on:
4+
push:
5+
branches: [main]
6+
pull_request:
7+
branches: [main]
8+
9+
permissions:
10+
contents: read
11+
12+
concurrency:
13+
group: ci-${{ github.ref }}
14+
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
15+
16+
jobs:
17+
verify:
18+
name: Verify (fmt / lint / check)
19+
runs-on: ubuntu-latest
20+
steps:
21+
- uses: actions/checkout@v4
22+
23+
- name: Setup Deno
24+
uses: denoland/setup-deno@v2
25+
with:
26+
deno-version: "2.x"
27+
28+
- name: Format check
29+
run: deno fmt --check
30+
31+
- name: Lint
32+
run: deno lint
33+
34+
- name: Type check (mod.ts only)
35+
# Scoped to mod.ts because the **/*.ts glob picks up docs-site/ Astro
36+
# internals and root-level scripts that produce 11k+ unrelated errors.
37+
# Tests intentionally excluded — 7 pre-existing failures tracked
38+
# separately. See follow-up issue.
39+
run: deno task check

0 commit comments

Comments
 (0)