chore: fix the CodeQL badge, adopt Contributor Covenant 3.0 - #786
Conversation
The badge used the github-code-scanning/codeql path, which is where GitHub's default setup publishes. This repository runs CodeQL from its own .github/workflows/codeql.yml, so that URL had no run to report and the badge rendered "CodeQL - no status". Verified against both URLs: the old one returns a badge titled "CodeQL - no status", the new one "CodeQL - passing". Signed-off-by: Sebastian Mendel <github@sebastianmendel.de>
Replaces the 2.1 text with the canonical 3.0 wording, taken from EthicalSource/contributor_covenant rather than retyped. The TOML frontmatter is stripped and both upstream placeholders are filled: the reporting address stays security@netresearch.de, and the note asking the adopter to describe their own enforcement process is removed in favour of the Covenant's enforcement ladder, which is what this project applies. 3.0 restructures the document rather than editing it: "Encouraged Behaviors" and "Restricted Behaviors" replace the examples list, and "Addressing and Repairing Harm" replaces the four-tier enforcement guidelines. The badge is bumped to match. Signed-off-by: Sebastian Mendel <github@sebastianmendel.de>
|
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.Scanned FilesNone |
github-actions
Bot
added
the
documentation
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
Automated approval for maintainer PR
All automated quality gates passed. See SECURITY_CONTROLS.md for compensating controls.
There was a problem hiding this comment.
🟢 Ready to approve
The changes are straightforward documentation/badge updates with only minor wording/formatting nits noted.
This review doesn't count toward merge requirements. Sign up for the private preview to control whether Copilot approvals count.
Pull request overview
Updates repository-facing documentation/metadata by fixing the CodeQL badge target in the README and upgrading the project’s Code of Conduct to Contributor Covenant 3.0.
Changes:
- Point the README CodeQL badge at the repo’s actual
codeql.ymlworkflow so it reports status correctly. - Update the Contributor Covenant badge version from 2.1 to 3.0.
- Replace
CODE_OF_CONDUCT.mdcontent with Contributor Covenant 3.0 text (with project-specific reporting contact retained).
File summaries
| File | Description |
|---|---|
| README.md | Fixes the CodeQL badge URL to point at actions/workflows/codeql.yml, and bumps the Contributor Covenant badge to 3.0. |
| CODE_OF_CONDUCT.md | Replaces the Code of Conduct with Contributor Covenant 3.0 content and keeps the project’s reporting address. |
Review details
Suppressed comments (2)
CODE_OF_CONDUCT.md:41
- In "Other Restrictions", item 3 has the period outside the bolded heading, unlike the other items in the same list. Keeping the punctuation inside the bold text makes the formatting consistent.
3. **Promotional materials**. Sharing marketing or other commercial content in a way that is outside the norms of the community.
CODE_OF_CONDUCT.md:67
- Grammar: "A pattern of repeated violation" should be plural ("violations").
1) Event: A pattern of repeated violation which the Community Moderators have tried to address with warnings, or a single serious violation.
- Files reviewed: 2/2 changed files
- Comments generated: 4
- Review effort level: Lite
We're testing this review assessment. Please use 👍 or 👎 to tell us if it's correct.
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #786 +/- ##
==========================================
- Coverage 89.33% 89.32% -0.02%
==========================================
Files 88 88
Lines 12203 12203
==========================================
- Hits 10902 10900 -2
- Misses 1001 1003 +2
Partials 300 300
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. |
Two independent changes, one commit each.
The CodeQL badge showed nothing
It pointed at
actions/workflows/github-code-scanning/codeql/badge.svg, which is where GitHub's default setup publishes. This repository runs CodeQL from its own.github/workflows/codeql.yml, so that path had no run to report.Fetched both URLs to confirm rather than assume:
github-code-scanning/codeql/badge.svgCodeQL - no statuscodeql.yml/badge.svgCodeQL - passingSince one badge was broken, all fifteen were checked the same way. The rest resolve to real values — CI passing, Scorecard 8.8, codecov 89%, release v0.29.0, Best Practices silver. The
Go Referencebadge has no<text>node because pkg.go.dev draws its label as vector paths; the module page answers 200.Contributor Covenant 3.0
The 3.0 text is taken from EthicalSource/contributor_covenant rather than retyped. The TOML frontmatter is stripped and both upstream placeholders are filled:
3.0 restructures rather than edits. "Encouraged Behaviors" and "Restricted Behaviors" replace the old examples list, and "Addressing and Repairing Harm" replaces the four-tier enforcement guidelines — hence the large diff for a version bump. No placeholder text remains (
grep -c "NOTE:"→ 0), and no other file referenced the old version.lefthook run pre-pushexit 0.