Skip to content

Commit cb2002b

Browse files
inureyesinureyes
authored
chore: add OSS security automation and community health files (#3)
Closes the remaining D/B/E-section work from #1 plus a bonus discovery (missing PR-time audit gate). Section D — security automation: - .github/dependabot.yml (cargo root/core/surgery + github-actions, weekly Monday 09:00 KST, per-area labels) - deny.toml (cargo-deny config for shipping platforms + permissive license allow-list + crates.io as only registry) - .github/workflows/ci.yml (bonus): PR-time `cargo deny check` gate via EmbarkStudios/cargo-deny-action@v2 on ubuntu-latest, path-filtered, least-privilege permissions + persist-credentials false - Advisory fixes: rustls-webpki 0.103.10 -> 0.103.13 (RUSTSEC-2026-0098 /0099/0104), rand 0.9.2 -> 0.9.4 (RUSTSEC-2026-0097) - Documented unmaintained-with-justification: bincode 1.3.3 (RUSTSEC-2025-0141), paste 1.0.15 (RUSTSEC-2024-0436) Section B — community health (50% -> 100% profile health): - SECURITY.md (90-day coordinated disclosure, mlxcel-specific scope) - CONTRIBUTING.md (entry-level, points to AGENTS.md for the deep contract) - CITATION.cff (Citation File Format v1.2.0) - .github/ISSUE_TEMPLATE/{bug_report,feature_request,config}.yml - .github/PULL_REQUEST_TEMPLATE.md Section E — README polish: - Status badges (license, latest release, CI) - Contributing section linked to CONTRIBUTING.md + SECURITY.md - docs/ link integrity verified (no docs_internal/ references) Follow-up issues filed: #4 (fmt cleanup + fmt CI gate), #5 (clippy/test PR gate on self-hosted macOS), #6 (packaging env 4-eyes hardening, backlog), #7 (workspace conversion), #8 (bincode 1.x migration). Part of #1.
1 parent bbc5777 commit cb2002b

12 files changed

Lines changed: 920 additions & 5 deletions

File tree

‎.github/ISSUE_TEMPLATE/bug_report.yml‎

Lines changed: 116 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,116 @@
1+
name: Bug report
2+
description: Report something that is not working in mlxcel
3+
title: "fix: <short description>"
4+
labels: ["type:bug", "status:ready"]
5+
body:
6+
- type: markdown
7+
attributes:
8+
value: |
9+
Thanks for taking the time to file a bug report. The information below helps us reproduce the issue and ship a fix faster.
10+
11+
**Security issues**: Do **not** file security vulnerabilities here. See [SECURITY.md](https://github.com/lablup/mlxcel/blob/main/SECURITY.md) for the private reporting channel.
12+
13+
- type: textarea
14+
id: summary
15+
attributes:
16+
label: Summary
17+
description: A short, factual description of the bug.
18+
placeholder: e.g. "mlxcel-server crashes on /v1/chat/completions when the prompt contains a 4-byte UTF-8 character"
19+
validations:
20+
required: true
21+
22+
- type: textarea
23+
id: reproduction
24+
attributes:
25+
label: Reproduction steps
26+
description: |
27+
Minimal commands or HTTP requests that reproduce the issue. Include the prompt and seed if relevant.
28+
placeholder: |
29+
1. `mlxcel download mlx-community/Qwen3.5-0.8B-OptiQ-4bit`
30+
2. `mlxcel generate -m models/Qwen3.5-0.8B-OptiQ-4bit -p "..." -n 100 --seed 42`
31+
3. Observed: ...
32+
4. Expected: ...
33+
render: bash
34+
validations:
35+
required: true
36+
37+
- type: textarea
38+
id: expected
39+
attributes:
40+
label: Expected behavior
41+
description: What did you expect to happen?
42+
validations:
43+
required: true
44+
45+
- type: textarea
46+
id: actual
47+
attributes:
48+
label: Actual behavior
49+
description: What actually happened? Include error messages, panic backtraces, or unexpected output verbatim.
50+
render: text
51+
validations:
52+
required: true
53+
54+
- type: input
55+
id: version
56+
attributes:
57+
label: mlxcel version
58+
description: Output of `mlxcel --version` or the commit SHA you built from.
59+
placeholder: e.g. "v0.0.27" or "main @ abc1234"
60+
validations:
61+
required: true
62+
63+
- type: dropdown
64+
id: install
65+
attributes:
66+
label: Install method
67+
options:
68+
- Homebrew (lablup/tap)
69+
- Pre-built release binary (GitHub Releases)
70+
- Built from source
71+
- Other (please describe in Additional context)
72+
validations:
73+
required: true
74+
75+
- type: dropdown
76+
id: platform
77+
attributes:
78+
label: Platform
79+
options:
80+
- macOS (Apple Silicon)
81+
- Linux + CUDA (gb10)
82+
- Linux + CUDA (gh200)
83+
- Linux + CUDA (other — please specify in Additional context)
84+
- Other
85+
validations:
86+
required: true
87+
88+
- type: input
89+
id: model
90+
attributes:
91+
label: Model checkpoint
92+
description: The Hugging Face repo ID or local path of the model you were running, if relevant.
93+
placeholder: e.g. "mlx-community/Qwen3.5-0.8B-OptiQ-4bit"
94+
95+
- type: textarea
96+
id: logs
97+
attributes:
98+
label: Relevant logs
99+
description: Server / CLI output, ideally with `RUST_LOG=mlxcel=debug` set for stack traces.
100+
render: text
101+
102+
- type: textarea
103+
id: additional
104+
attributes:
105+
label: Additional context
106+
description: Anything else that might help — workarounds you tried, related issues, screenshots, etc.
107+
108+
- type: checkboxes
109+
id: checks
110+
attributes:
111+
label: Pre-submission checks
112+
options:
113+
- label: I searched existing issues and did not find a duplicate
114+
required: true
115+
- label: This is not a security vulnerability (those go to SECURITY.md instead)
116+
required: true

‎.github/ISSUE_TEMPLATE/config.yml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
blank_issues_enabled: false
2+
contact_links:
3+
- name: Security vulnerability
4+
url: https://github.com/lablup/mlxcel/security/advisories/new
5+
about: Report a security issue privately. Do not file these as public issues. See SECURITY.md for the full policy.
6+
- name: Question or discussion
7+
url: https://github.com/lablup/mlxcel/discussions
8+
about: General questions, design discussion, or "is this supported?" go here instead of issues.
9+
- name: Upstream MLX issues
10+
url: https://github.com/ml-explore/mlx/issues
11+
about: Bugs that reproduce against upstream MLX C++ libraries (not mlxcel-specific) should be reported upstream.

‎.github/ISSUE_TEMPLATE/feature_request.yml‎

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
name: Feature request
2+
description: Propose a new capability, model family, or behavior change for mlxcel
3+
title: "feat: <short description>"
4+
labels: ["type:enhancement", "status:ready"]
5+
body:
6+
- type: markdown
7+
attributes:
8+
value: |
9+
Thanks for proposing a feature. mlxcel tracks model coverage with [mlx-lm](https://github.com/ml-explore/mlx-lm) and [mlx-vlm](https://github.com/Blaizzy/mlx-vlm) where practical; the more upstream context you can provide, the easier it is to scope.
10+
11+
- type: textarea
12+
id: problem
13+
attributes:
14+
label: Problem / motivation
15+
description: What problem does this feature solve? Who is the user, and what are they trying to do today?
16+
placeholder: |
17+
e.g. "I want to serve LFM2-VL via mlxcel-server, but the architecture is not in the detection table."
18+
validations:
19+
required: true
20+
21+
- type: textarea
22+
id: proposal
23+
attributes:
24+
label: Proposed solution
25+
description: |
26+
Describe what should be built. For new model families, include the upstream reference (mlx-lm / mlx-vlm path or HF architecture).
27+
For new server features, sketch the CLI flag or API surface.
28+
validations:
29+
required: true
30+
31+
- type: textarea
32+
id: alternatives
33+
attributes:
34+
label: Alternatives considered
35+
description: Other approaches you considered, and why they were not chosen.
36+
37+
- type: dropdown
38+
id: scope
39+
attributes:
40+
label: Scope
41+
options:
42+
- New model family
43+
- Server / API surface (mlxcel-server)
44+
- CLI behavior (mlxcel)
45+
- Inference performance
46+
- Surgery operation
47+
- Tooling / documentation
48+
- Other
49+
validations:
50+
required: true
51+
52+
- type: textarea
53+
id: acceptance
54+
attributes:
55+
label: Acceptance criteria
56+
description: How will we know this is done? List the conditions in checkbox form.
57+
placeholder: |
58+
- [ ] Model loads from `mlx-community/...` without conversion
59+
- [ ] `mlxcel list` includes the new architecture
60+
- [ ] End-to-end inference matches Python reference within RMS < 5e-3
61+
62+
- type: textarea
63+
id: additional
64+
attributes:
65+
label: Additional context
66+
description: Upstream PRs, papers, benchmark numbers, etc.
67+
68+
- type: checkboxes
69+
id: checks
70+
attributes:
71+
label: Pre-submission checks
72+
options:
73+
- label: I searched existing issues and discussions and did not find a duplicate
74+
required: true

‎.github/PULL_REQUEST_TEMPLATE.md‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
<!--
2+
Thanks for opening a pull request! Please fill out the sections below.
3+
For the full contributor contract see AGENTS.md and CONTRIBUTING.md.
4+
-->
5+
6+
## Summary
7+
8+
<!-- One or two sentences: what does this PR do, and why? -->
9+
10+
## Related issues
11+
12+
<!-- Use closing keywords ("Closes #123", "Fixes #456") so the issue auto-closes on merge.
13+
For tracking-only references use "Refs #..." or "Part of #..." instead. -->
14+
15+
Closes #
16+
17+
## Type of change
18+
19+
<!-- Tick all that apply. -->
20+
21+
- [ ] `feat` — new user-visible feature
22+
- [ ] `fix` — bug fix
23+
- [ ] `perf` — performance improvement (include before/after numbers in the PR body)
24+
- [ ] `refactor` — internal restructuring without behavior change
25+
- [ ] `chore` — build, CI, dependencies, release infrastructure
26+
- [ ] `docs` — documentation only
27+
- [ ] `test` — tests only
28+
29+
## Test plan
30+
31+
<!--
32+
What did you run to convince yourself this works? Be specific.
33+
For inference changes, real-checkpoint validation is required — synthetic-only is not enough.
34+
-->
35+
36+
- [ ] `cargo fmt --check`
37+
- [ ] `cargo clippy --all-targets -- -D warnings`
38+
- [ ] `cargo test --release`
39+
- [ ] `cargo deny check`
40+
- [ ] Validated with a real checkpoint (specify which, e.g. `mlx-community/Qwen3.5-0.8B-OptiQ-4bit`): ...
41+
42+
## Notes for reviewers
43+
44+
<!-- Anything reviewers should know: assumed invariants, follow-up work, risks, alternatives considered. -->
45+
46+
## Checklist
47+
48+
- [ ] PR title uses a Conventional Commits prefix (`feat:`, `fix:`, etc.)
49+
- [ ] One logical change per PR (split unrelated changes)
50+
- [ ] Updated `docs/` if user-facing behavior or supported models changed
51+
- [ ] Updated `// Used by: ...` comments on any shared function I modified (see `docs/code-guidelines.md`)
52+
- [ ] No secrets, credentials, or `.env` files committed

‎.github/dependabot.yml‎

Lines changed: 97 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,97 @@
1+
# Dependabot configuration for automated dependency updates.
2+
# Docs: https://docs.github.com/en/code-security/dependabot/dependabot-version-updates
3+
4+
version: 2
5+
updates:
6+
# Cargo (Rust) dependencies — root `mlxcel` binary crate.
7+
- package-ecosystem: "cargo"
8+
directory: "/"
9+
schedule:
10+
interval: "weekly"
11+
day: "monday"
12+
time: "09:00"
13+
timezone: "Asia/Seoul"
14+
open-pull-requests-limit: 10
15+
groups:
16+
minor-and-patch:
17+
patterns:
18+
- "*"
19+
update-types:
20+
- "minor"
21+
- "patch"
22+
ignore:
23+
- dependency-name: "*"
24+
update-types: ["version-update:semver-major"]
25+
labels:
26+
- "type:dependency"
27+
commit-message:
28+
prefix: "deps"
29+
include: "scope"
30+
31+
# Cargo (Rust) dependencies — `mlxcel-core` library crate (separate Cargo.lock).
32+
- package-ecosystem: "cargo"
33+
directory: "/src/lib/mlxcel-core"
34+
schedule:
35+
interval: "weekly"
36+
day: "monday"
37+
time: "09:00"
38+
timezone: "Asia/Seoul"
39+
open-pull-requests-limit: 10
40+
groups:
41+
minor-and-patch:
42+
patterns:
43+
- "*"
44+
update-types:
45+
- "minor"
46+
- "patch"
47+
ignore:
48+
- dependency-name: "*"
49+
update-types: ["version-update:semver-major"]
50+
labels:
51+
- "type:dependency"
52+
- "area:core"
53+
commit-message:
54+
prefix: "deps(core)"
55+
include: "scope"
56+
57+
# Cargo (Rust) dependencies — `mlxcel-surgery` library crate.
58+
- package-ecosystem: "cargo"
59+
directory: "/src/lib/mlxcel-surgery"
60+
schedule:
61+
interval: "weekly"
62+
day: "monday"
63+
time: "09:00"
64+
timezone: "Asia/Seoul"
65+
open-pull-requests-limit: 5
66+
groups:
67+
minor-and-patch:
68+
patterns:
69+
- "*"
70+
update-types:
71+
- "minor"
72+
- "patch"
73+
ignore:
74+
- dependency-name: "*"
75+
update-types: ["version-update:semver-major"]
76+
labels:
77+
- "type:dependency"
78+
- "area:surgery"
79+
commit-message:
80+
prefix: "deps(surgery)"
81+
include: "scope"
82+
83+
# GitHub Actions dependencies.
84+
- package-ecosystem: "github-actions"
85+
directory: "/"
86+
schedule:
87+
interval: "weekly"
88+
day: "monday"
89+
time: "09:00"
90+
timezone: "Asia/Seoul"
91+
open-pull-requests-limit: 5
92+
labels:
93+
- "type:dependency"
94+
- "type:chore"
95+
commit-message:
96+
prefix: "ci"
97+
include: "scope"

0 commit comments

Comments
 (0)