diff --git a/.github/ISSUE_TEMPLATE/bug_report.yml b/.github/ISSUE_TEMPLATE/bug_report.yml new file mode 100644 index 0000000..ee37383 --- /dev/null +++ b/.github/ISSUE_TEMPLATE/bug_report.yml @@ -0,0 +1,44 @@ +name: Bug report +description: Report reproducible incorrect behavior in CodeMesh. +title: "bug: " +labels: + - bug +body: + - type: markdown + attributes: + value: >- + Do not include credentials, private source, customer identifiers, or + sensitive paths. Use the security-reporting route for vulnerabilities. + - type: checkboxes + id: safety + attributes: + label: Safety check + options: + - label: This report contains no secret or private source material. + required: true + - type: textarea + id: problem + attributes: + label: Problem + description: What happened, and what did you expect instead? + validations: + required: true + - type: textarea + id: reproduction + attributes: + label: Reproduction + description: Provide the smallest synthetic or public reproduction available. + validations: + required: true + - type: input + id: commit + attributes: + label: CodeMesh commit + description: Provide the tested commit SHA. + validations: + required: true + - type: textarea + id: validation + attributes: + label: Validation details + description: Include relevant checks, environment details, and bounded logs. diff --git a/.github/ISSUE_TEMPLATE/config.yml b/.github/ISSUE_TEMPLATE/config.yml new file mode 100644 index 0000000..3f07d52 --- /dev/null +++ b/.github/ISSUE_TEMPLATE/config.yml @@ -0,0 +1,5 @@ +blank_issues_enabled: false +contact_links: + - name: Security reports + url: https://github.com/Oneiros667/CodeMesh/security/policy + about: Report vulnerabilities and exposed secrets through the private route in the security policy. diff --git a/.github/ISSUE_TEMPLATE/feature_request.yml b/.github/ISSUE_TEMPLATE/feature_request.yml new file mode 100644 index 0000000..3bf6bef --- /dev/null +++ b/.github/ISSUE_TEMPLATE/feature_request.yml @@ -0,0 +1,32 @@ +name: Feature request +description: Propose a focused improvement aligned with the current roadmap. +title: "proposal: " +labels: + - enhancement +body: + - type: textarea + id: problem + attributes: + label: Problem + description: What agent or developer problem should CodeMesh address? + validations: + required: true + - type: textarea + id: evidence + attributes: + label: Evidence and users + description: What source, observation, or measurement supports the need? + validations: + required: true + - type: textarea + id: scope + attributes: + label: Proposed scope + description: Describe the smallest useful change and important exclusions. + validations: + required: true + - type: textarea + id: alternatives + attributes: + label: Alternatives considered + description: Note existing workflows or smaller alternatives. diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md new file mode 100644 index 0000000..c274ee2 --- /dev/null +++ b/.github/PULL_REQUEST_TEMPLATE.md @@ -0,0 +1,26 @@ +# Pull request + + + +## Summary + +Describe the problem, the change, and why this approach was selected. + +## Scope + +- Included: +- Intentionally excluded: + +## Validation + +List each relevant check as passed, failed, skipped, or unavailable. Include +commands when they help reviewers reproduce the result. + +## Safety and evidence + +- [ ] No credentials, private source, customer or employer material, generated + indexes, databases, model output, or raw evaluation traces are included. +- [ ] Documentation and status claims distinguish implementation, automated + verification, inspected evidence, acceptance, release, and deployment. +- [ ] Online providers, live services, and cost-bearing evaluation were not + used without explicit authorization. diff --git a/.github/workflows/baseline-standards.yml b/.github/workflows/baseline-standards.yml index d4b39f6..4446e82 100644 --- a/.github/workflows/baseline-standards.yml +++ b/.github/workflows/baseline-standards.yml @@ -87,9 +87,16 @@ jobs: uv run --no-sync python -m codemesh_agent_access eval - name: Check repository standards + env: + EVENT_NAME: ${{ github.event_name }} + PULL_REQUEST_TITLE: ${{ github.event.pull_request.title }} run: | git diff --check "$CHECK_RANGE" npx --yes markdownlint-cli2@0.23.1 "**/*.md" python tools/check_markdown_links.py python tools/check_publication_safety.py - python tools/check_conventional_commit.py --range "$CHECK_RANGE" + if [[ "$EVENT_NAME" == "pull_request" ]]; then + python tools/check_conventional_commit.py --message "$PULL_REQUEST_TITLE" + else + python tools/check_conventional_commit.py --range "$CHECK_RANGE" + fi diff --git a/CODE_OF_CONDUCT.md b/CODE_OF_CONDUCT.md new file mode 100644 index 0000000..1cbeaa1 --- /dev/null +++ b/CODE_OF_CONDUCT.md @@ -0,0 +1,32 @@ +# Code of Conduct + +## Our commitment + +CodeMesh contributors and maintainers commit to a respectful, inclusive, and +professional project environment. Participation should remain constructive and +focused on improving the software and its evidence. + +## Expected behaviour + +- Discuss ideas and reviews with empathy, clarity, and technical specificity. +- Welcome questions and good-faith disagreement. +- Respect privacy, confidentiality, licences, and repository boundaries. +- Give credit for work and distinguish observation from attribution or claim. +- Accept correction and help resolve misunderstandings proportionately. + +## Unacceptable behaviour + +Harassment, discrimination, threats, sexualized attention, personal attacks, +doxxing, deliberate disclosure of private material, sustained disruption, and +retaliation are not acceptable in project spaces. + +## Scope and enforcement + +This policy applies to repository interactions and to public representation of +the project. Maintainers may edit or remove contributions, limit participation, +or ban a participant when needed to protect the community. + +For a conduct concern, open an issue containing only a minimal, non-sensitive +request for maintainer contact. Do not publish private evidence or personal +information. The maintainer will arrange an appropriate private follow-up and +will handle the report as confidentially and impartially as practical. diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 105a7d2..6362432 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -32,7 +32,16 @@ password, and never commit the resulting file. summary-free and deterministic. - Add or update canonical documentation when behavior, commands, contracts, or architecture change. -- Use Conventional Commits when a commit is requested. +- Format pull-request titles and requested commits as Conventional Commits. + +## Pull requests + +- Keep each pull request focused and explain the problem, the chosen approach, + and any intentionally excluded work. +- Complete the repository pull-request template and report each relevant check + as passed, failed, skipped, or unavailable. +- Resolve review conversations and update the branch before squash merging. +- Follow the [Code of Conduct](CODE_OF_CONDUCT.md) in repository interactions. ## Validation diff --git a/README.md b/README.md index 92be4b9..0fc81aa 100644 --- a/README.md +++ b/README.md @@ -125,7 +125,8 @@ references, guides, status, evidence, engineering policy, and future proposals. ## Security, contribution, and licence Read [SECURITY.md](SECURITY.md) before reporting a suspected secret or -vulnerability, and [CONTRIBUTING.md](CONTRIBUTING.md) before proposing changes. +vulnerability, [CONTRIBUTING.md](CONTRIBUTING.md) before proposing changes, and +the [Code of Conduct](CODE_OF_CONDUCT.md) when participating in the project. CodeMesh is licensed under the [MIT License](LICENSE). Third-party packages, services, and referenced evaluation repositories retain their own licences; see diff --git a/docs/engineering/conventional-commits.md b/docs/engineering/conventional-commits.md index 2a35f13..14fcd8a 100644 --- a/docs/engineering/conventional-commits.md +++ b/docs/engineering/conventional-commits.md @@ -15,6 +15,11 @@ Validate a Git range before review or release: python tools/check_conventional_commit.py --range origin/main..HEAD ``` +Pull requests are squash-merged and their titles become the resulting commit +subjects. Use the same `type(optional-scope): imperative summary` format for a +pull-request title. The hosted pull-request workflow validates the title while +local range validation remains useful for branch review. + The checker allows merge and revert commits produced by Git workflows. It does not install a hook. Hook adoption requires a separate reviewed decision and must preserve existing repository tooling. diff --git a/docs/engineering/github-actions.md b/docs/engineering/github-actions.md index d06995a..489ee78 100644 --- a/docs/engineering/github-actions.md +++ b/docs/engineering/github-actions.md @@ -9,14 +9,15 @@ The read-only workflow validates: - Markdown with the repository-pinned `markdownlint-cli2` version; - local Markdown links; - publication-safety patterns in Git-visible files; and -- Conventional Commit messages in the pushed or pull-request range. +- Conventional Commit messages in the pushed range, or the pull-request title. -Normal pushes validate the complete pushed range and pull requests validate the -base-to-head range. A forced push validates only its new head commit because the -replaced history may be unavailable to the runner and is not a meaningful -Conventional Commit comparison. Force pushes require separate owner approval; -the publication rewrite is audited independently before its one-time remote -replacement. +Normal pushes validate the complete pushed range. Pull requests use the +base-to-head range for source checks and validate the pull-request title as the +future squash-commit subject. A forced push validates only its new head commit +because the replaced history may be unavailable to the runner and is not a +meaningful Conventional Commit comparison. Force pushes require separate owner +approval; a publication rewrite must be audited independently before its +one-time remote replacement. Every action is pinned to a full immutable commit SHA, checkout credentials are not persisted, and the workflow receives only `contents: read`. It uses no