Skip to content

Commit 7a12f66

Browse files
RyanAlbertsclaude
RyanAlberts
and
claude
committed
chore: phase 0 — repo bootstrap with secrets hygiene and CI
Initial scaffold for yc-ai-pulse, an open-source YC batch analyzer. Phase 0 establishes the safety floor before any LLM code lands: - MIT license, README with anti-hallucination contract, CONTRIBUTING, SECURITY policy, CHANGELOG, BACKLOG, .env.example - pyproject.toml (ruff/mypy/pytest config), package.json placeholder - pre-commit with detect-secrets, gitleaks, ruff, custom Anthropic/ OpenAI/GitHub key regex, large-file guard - scripts/secret_scan.sh + scripts/publish_check.sh for the pre-publish PII/credential gate - .github/workflows/ci.yml: ruff, mypy, pytest, secret-scan, publish-check on every PR - Issue and PR templates referencing the anti-hallucination invariants in CONTRIBUTING.md - ADR 0001 (yc-oss/api as primary data source) and ADR 0002 (localhost FastAPI over native messaging) so future-me has the why - src/ycai package skeleton with version + CLI shim, tests/test_smoke.py Subsequent phases land in their own PRs against milestone v0.1. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
0 parents  commit 7a12f66

30 files changed

Lines changed: 1054 additions & 0 deletions

‎.env.example‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
# Copy to .env and fill in. Never commit .env.
2+
3+
# Optional: only set if you want to pay-per-run via the Anthropic API.
4+
# Leave unset to use the Claude Agent SDK against your Claude Max subscription.
5+
# ANTHROPIC_API_KEY=sk-ant-...
6+
7+
# Local backend port (default 8787).
8+
# YCAI_PORT=8787
9+
10+
# Default model. Override only if you know why.
11+
# YCAI_MODEL=claude-sonnet-4-6
12+
13+
# Concurrency for the per-company research sweep.
14+
# YCAI_CONCURRENCY=8

‎.github/ISSUE_TEMPLATE/bug_report.md‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
---
2+
name: Bug report
3+
about: Something doesn't work
4+
labels: bug
5+
---
6+
7+
## What happened
8+
9+
<!-- Concrete, reproducible. Include the exact command. -->
10+
11+
## What you expected
12+
13+
## Environment
14+
15+
- OS:
16+
- Python version:
17+
- `yc-ai-pulse` version (`pip show yc-ai-pulse`):
18+
- Browser (if extension):
19+
20+
## Logs
21+
22+
<!-- Redact any API keys before pasting. -->

‎.github/ISSUE_TEMPLATE/feature_request.md‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
---
2+
name: Feature request
3+
about: Propose a change
4+
labels: enhancement
5+
---
6+
7+
## Problem
8+
9+
<!-- What can't a user do today? -->
10+
11+
## Proposed solution
12+
13+
## Alternatives considered
14+
15+
## Phase
16+
17+
<!-- Which milestone does this belong to? v0.1 / v0.2 / v1.0 / unsure -->

‎.github/PULL_REQUEST_TEMPLATE.md‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
## What
2+
3+
<!-- One sentence on what changes for the user. -->
4+
5+
## Why
6+
7+
<!-- The motivation. Link the issue if there is one. -->
8+
9+
## How
10+
11+
<!-- Brief implementation notes. Diagrams encouraged for non-trivial changes. -->
12+
13+
## Acceptance
14+
15+
- [ ] `make validate-p0` (or current phase) green locally
16+
- [ ] `make publish-check` green
17+
- [ ] Pre-commit hooks all pass
18+
- [ ] No new lines in `BACKLOG.md` deferred without a reason
19+
- [ ] If this PR touches the LLM path: anti-hallucination invariants preserved (see [CONTRIBUTING.md](../CONTRIBUTING.md))
20+
- [ ] If this PR touches the extension: Playwright suite passes
21+
22+
## Test plan
23+
24+
<!-- How did you verify this? Include any manual smoke steps. -->

‎.github/workflows/ci.yml‎

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
name: CI
2+
3+
on:
4+
push:
5+
branches: [main]
6+
pull_request:
7+
branches: [main]
8+
9+
permissions:
10+
contents: read
11+
12+
concurrency:
13+
group: ci-${{ github.ref }}
14+
cancel-in-progress: true
15+
16+
jobs:
17+
python:
18+
name: lint / type / test
19+
runs-on: ubuntu-latest
20+
steps:
21+
- uses: actions/checkout@v4
22+
23+
- name: Set up Python
24+
uses: actions/setup-python@v5
25+
with:
26+
python-version: "3.11"
27+
cache: pip
28+
29+
- name: Install dev dependencies
30+
run: |
31+
python -m pip install --upgrade pip
32+
pip install -e ".[dev]"
33+
34+
- name: ruff
35+
run: ruff check .
36+
37+
- name: mypy (best-effort during phase 0)
38+
run: |
39+
if [ -d src/ycai ] && [ -n "$(find src/ycai -name '*.py' -not -empty)" ]; then
40+
mypy src/ycai
41+
else
42+
echo "no source yet — phase 0"
43+
fi
44+
45+
- name: pytest
46+
run: pytest -q
47+
48+
secret-scan:
49+
name: secret scan
50+
runs-on: ubuntu-latest
51+
steps:
52+
- uses: actions/checkout@v4
53+
with:
54+
fetch-depth: 0
55+
56+
- name: Set up Python (for detect-secrets)
57+
uses: actions/setup-python@v5
58+
with:
59+
python-version: "3.11"
60+
61+
- name: Install detect-secrets
62+
run: pip install detect-secrets
63+
64+
- name: Custom regex sweep
65+
run: bash scripts/secret_scan.sh
66+
67+
- name: gitleaks
68+
uses: gitleaks/gitleaks-action@v2
69+
env:
70+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
71+
72+
publish-check:
73+
name: publish hygiene
74+
runs-on: ubuntu-latest
75+
steps:
76+
- uses: actions/checkout@v4
77+
- name: publish-check
78+
run: bash scripts/publish_check.sh

‎.gitignore‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
# Secrets — never check these in
2+
.env
3+
.env.*
4+
!.env.example
5+
*.key
6+
*.pem
7+
secrets/
8+
~/.ycai/
9+
10+
# Run artifacts (timestamped output directories)
11+
runs/
12+
cache/
13+
14+
# Python
15+
__pycache__/
16+
*.py[cod]
17+
*$py.class
18+
*.so
19+
.Python
20+
build/
21+
dist/
22+
*.egg-info/
23+
.eggs/
24+
.pytest_cache/
25+
.mypy_cache/
26+
.ruff_cache/
27+
.coverage
28+
htmlcov/
29+
.tox/
30+
.venv/
31+
venv/
32+
env/
33+
34+
# Node / extension build
35+
node_modules/
36+
extension/dist/
37+
extension/.env.local
38+
*.tsbuildinfo
39+
40+
# Editor / OS
41+
.DS_Store
42+
.idea/
43+
.vscode/
44+
*.swp
45+
*~
46+
47+
# DBs / large files we don't want shipped
48+
*.sqlite
49+
*.sqlite3
50+
*.db

‎.pre-commit-config.yaml‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
# Pre-commit hooks. Install with: pre-commit install --install-hooks
2+
# CI re-runs the same checks on every PR.
3+
4+
repos:
5+
- repo: https://github.com/pre-commit/pre-commit-hooks
6+
rev: v4.6.0
7+
hooks:
8+
- id: trailing-whitespace
9+
- id: end-of-file-fixer
10+
- id: check-yaml
11+
- id: check-toml
12+
- id: check-json
13+
- id: check-merge-conflict
14+
- id: check-added-large-files
15+
args: ["--maxkb=500"]
16+
- id: detect-private-key
17+
- id: mixed-line-ending
18+
args: ["--fix=lf"]
19+
20+
- repo: https://github.com/Yelp/detect-secrets
21+
rev: v1.5.0
22+
hooks:
23+
- id: detect-secrets
24+
args: ["--baseline", ".secrets.baseline"]
25+
exclude: \.secrets\.baseline$
26+
27+
- repo: https://github.com/gitleaks/gitleaks
28+
rev: v8.21.2
29+
hooks:
30+
- id: gitleaks
31+
32+
- repo: https://github.com/astral-sh/ruff-pre-commit
33+
rev: v0.6.9
34+
hooks:
35+
- id: ruff
36+
args: [--fix]
37+
- id: ruff-format
38+
39+
- repo: local
40+
hooks:
41+
- id: anthropic-key-regex
42+
name: block Anthropic / OpenAI / GitHub credentials
43+
entry: bash scripts/secret_scan.sh
44+
language: system
45+
pass_filenames: false
46+
stages: [pre-commit]

‎.secrets.baseline‎

Lines changed: 131 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,131 @@
1+
{
2+
"version": "1.5.0",
3+
"plugins_used": [
4+
{
5+
"name": "ArtifactoryDetector"
6+
},
7+
{
8+
"name": "AWSKeyDetector"
9+
},
10+
{
11+
"name": "AzureStorageKeyDetector"
12+
},
13+
{
14+
"name": "Base64HighEntropyString",
15+
"limit": 4.5
16+
},
17+
{
18+
"name": "BasicAuthDetector"
19+
},
20+
{
21+
"name": "CloudantDetector"
22+
},
23+
{
24+
"name": "DiscordBotTokenDetector"
25+
},
26+
{
27+
"name": "GitHubTokenDetector"
28+
},
29+
{
30+
"name": "GitLabTokenDetector"
31+
},
32+
{
33+
"name": "HexHighEntropyString",
34+
"limit": 3.0
35+
},
36+
{
37+
"name": "IbmCloudIamDetector"
38+
},
39+
{
40+
"name": "IbmCosHmacDetector"
41+
},
42+
{
43+
"name": "IPPublicDetector"
44+
},
45+
{
46+
"name": "JwtTokenDetector"
47+
},
48+
{
49+
"name": "KeywordDetector",
50+
"keyword_exclude": ""
51+
},
52+
{
53+
"name": "MailchimpDetector"
54+
},
55+
{
56+
"name": "NpmDetector"
57+
},
58+
{
59+
"name": "OpenAIDetector"
60+
},
61+
{
62+
"name": "PrivateKeyDetector"
63+
},
64+
{
65+
"name": "PypiTokenDetector"
66+
},
67+
{
68+
"name": "SendGridDetector"
69+
},
70+
{
71+
"name": "SlackDetector"
72+
},
73+
{
74+
"name": "SoftlayerDetector"
75+
},
76+
{
77+
"name": "SquareOAuthDetector"
78+
},
79+
{
80+
"name": "StripeDetector"
81+
},
82+
{
83+
"name": "TelegramBotTokenDetector"
84+
},
85+
{
86+
"name": "TwilioKeyDetector"
87+
}
88+
],
89+
"filters_used": [
90+
{
91+
"path": "detect_secrets.filters.allowlist.is_line_allowlisted"
92+
},
93+
{
94+
"path": "detect_secrets.filters.common.is_baseline_file",
95+
"filename": ".secrets.baseline"
96+
},
97+
{
98+
"path": "detect_secrets.filters.common.is_ignored_due_to_verification_policies",
99+
"min_level": 2
100+
},
101+
{
102+
"path": "detect_secrets.filters.heuristic.is_indirect_reference"
103+
},
104+
{
105+
"path": "detect_secrets.filters.heuristic.is_likely_id_string"
106+
},
107+
{
108+
"path": "detect_secrets.filters.heuristic.is_lock_file"
109+
},
110+
{
111+
"path": "detect_secrets.filters.heuristic.is_not_alphanumeric_string"
112+
},
113+
{
114+
"path": "detect_secrets.filters.heuristic.is_potential_uuid"
115+
},
116+
{
117+
"path": "detect_secrets.filters.heuristic.is_prefixed_with_dollar_sign"
118+
},
119+
{
120+
"path": "detect_secrets.filters.heuristic.is_sequential_string"
121+
},
122+
{
123+
"path": "detect_secrets.filters.heuristic.is_swagger_file"
124+
},
125+
{
126+
"path": "detect_secrets.filters.heuristic.is_templated_secret"
127+
}
128+
],
129+
"results": {},
130+
"generated_at": "2026-05-01T17:09:18Z"
131+
}

0 commit comments

Comments
 (0)